@skylabs-digital/react-identity-access 2.21.0 → 2.22.0

package/dist/index.es.js

@@ -1,6 +1,6 @@
 import { jsx as s, Fragment as _, jsxs as d } from "react/jsx-runtime";
-import { createContext as fe, useMemo as Z, useState as T, useCallback as se, useEffect as ee, useContext as le, useRef as Ke } from "react";
-import { useLocation as ke, Navigate as Se, useNavigate as gt, useSearchParams as mt } from "react-router-dom";
+import { createContext as me, useMemo as Z, useState as T, useCallback as ie, useEffect as ee, useContext as le, useRef as Ke } from "react";
+import { useLocation as Ae, Navigate as Te, useNavigate as gt, useSearchParams as mt } from "react-router-dom";
 class ce {
   constructor(e, t = 1e4) {
     this.baseUrl = e.replace(/\/$/, ""), this.timeout = t;
@@ -109,7 +109,7 @@ class ze {
     })).data;
   }
 }
-const Fe = fe(null);
+const Fe = me(null);
 function yr({ config: n, children: e }) {
   const t = Z(
     () => {
@@ -145,7 +145,7 @@ function yr({ config: n, children: e }) {
       appError: f,
       retryApp: p
     };
-  }, [n, r, o, f]), c = se(
+  }, [n, r, o, f]), c = ie(
     async (p = !1) => {
       if (!(!p && t.enabled && r))
         try {
@@ -170,7 +170,7 @@ function yr({ config: n, children: e }) {
         }
     },
     [n.baseUrl, n.appId, t, r]
-  ), I = se(async () => {
+  ), I = ie(async () => {
     if (!(!t.enabled || !r))
       try {
         const p = localStorage.getItem(t.storageKey);
@@ -194,7 +194,7 @@ function yr({ config: n, children: e }) {
     r ? I() : c();
   }, []), /* @__PURE__ */ s(Fe.Provider, { value: w, children: e });
 }
-function ve() {
+function ke() {
   const n = le(Fe);
   if (!n)
     throw new Error("useApp must be used within an AppProvider");
@@ -203,8 +203,8 @@ function ve() {
 function Ze() {
   return le(Fe);
 }
-const wr = ve;
-class ie extends Error {
+const wr = ke;
+class se extends Error {
   constructor(e, t) {
     const r = {
       token_expired: "Refresh token has expired",
@@ -228,7 +228,7 @@ class wt extends Error {
 }
 const oe = class oe {
   constructor(e = {}) {
-    this.refreshPromise = null, this.refreshQueue = [], this.proactiveTimerId = null, this.backgroundRetryTimerId = null, this.isDestroyed = !1, e.tenantSlug !== void 0 ? this.storageKey = e.tenantSlug ? `auth_tokens_${e.tenantSlug}` : "auth_tokens" : this.storageKey = e.storageKey || "auth_tokens", this.autoRefresh = e.autoRefresh ?? !0, this.refreshThreshold = e.refreshThreshold || 3e5, this.onRefreshFailed = e.onRefreshFailed, this.onSessionExpired = e.onSessionExpired, this.baseUrl = e.baseUrl || "", this.proactiveRefreshMargin = e.proactiveRefreshMargin ?? 6e4, this.refreshQueueTimeout = e.refreshQueueTimeout ?? 1e4, this.maxRefreshRetries = e.maxRefreshRetries ?? 3, this.retryBackoffBase = e.retryBackoffBase ?? 1e3, this.tokenStorage = e.tokenStorage || this.createTokenStorage(this.storageKey), this.scheduleProactiveRefresh();
+    this.refreshPromise = null, this.refreshQueue = [], this.proactiveTimerId = null, this.backgroundRetryTimerId = null, this.isDestroyed = !1, this.sessionGeneration = 0, e.tenantSlug !== void 0 ? this.storageKey = e.tenantSlug ? `auth_tokens_${e.tenantSlug}` : "auth_tokens" : this.storageKey = e.storageKey || "auth_tokens", this.autoRefresh = e.autoRefresh ?? !0, this.refreshThreshold = e.refreshThreshold || 3e5, this.onRefreshFailed = e.onRefreshFailed, this.onSessionExpired = e.onSessionExpired, this.baseUrl = e.baseUrl || "", this.proactiveRefreshMargin = e.proactiveRefreshMargin ?? 6e4, this.refreshQueueTimeout = e.refreshQueueTimeout ?? 1e4, this.maxRefreshRetries = e.maxRefreshRetries ?? 3, this.retryBackoffBase = e.retryBackoffBase ?? 1e3, this.tokenStorage = e.tokenStorage || this.createTokenStorage(this.storageKey), this.scheduleProactiveRefresh();
   }
   /**
    * Get or create a SessionManager instance for the given config.
@@ -350,15 +350,29 @@ const oe = class oe {
   backgroundRefresh() {
     if (this.isDestroyed) return;
     const e = this.getTokens();
-    e != null && e.refreshToken && (this.refreshPromise || this.startRefreshAndResolveQueue(e.refreshToken).then(() => {
-    }).catch((t) => {
-      t instanceof ie || (console.warn(
+    if (!(e != null && e.refreshToken) || this.refreshPromise) return;
+    const t = this.sessionGeneration;
+    this.startRefreshAndResolveQueue(e.refreshToken).then(() => {
+    }).catch((r) => {
+      r instanceof se || this.sessionGeneration === t && (console.warn(
         "[SessionManager] Background refresh failed, retrying in 30s:",
-        t.message
+        r.message
       ), this.backgroundRetryTimerId = setTimeout(() => {
         this.backgroundRefresh();
       }, 3e4));
-    }));
+    });
+  }
+  /**
+   * Wait for any in-progress token refresh to settle.
+   * Returns true if refresh succeeded, false if it failed or no refresh was pending.
+   */
+  async waitForPendingRefresh() {
+    if (!this.refreshPromise) return !1;
+    try {
+      return await this.refreshPromise, !0;
+    } catch {
+      return !1;
+    }
   }
   // --- Core: getValidAccessToken with queue + timeout ---
   /**
@@ -372,13 +386,13 @@ const oe = class oe {
   async getValidAccessToken() {
     const e = this.getTokens();
     if (!(e != null && e.accessToken)) {
-      const t = new ie("token_invalid", "No tokens available");
+      const t = new se("token_invalid", "No tokens available");
       throw this.handleSessionExpired(t), t;
     }
     if (!this.shouldRefreshToken(e) && !this.isTokenExpired(e))
       return e.accessToken;
     if (!e.refreshToken) {
-      const t = new ie("token_invalid", "No refresh token available");
+      const t = new se("token_invalid", "No refresh token available");
       throw this.handleSessionExpired(t), t;
     }
     return this.refreshPromise ? this.enqueueForToken() : this.startRefreshAndResolveQueue(e.refreshToken);
@@ -390,7 +404,7 @@ const oe = class oe {
     try {
       return { Authorization: `Bearer ${await this.getValidAccessToken()}` };
     } catch (e) {
-      return e instanceof ie && this.onRefreshFailed && this.onRefreshFailed(), {};
+      return e instanceof se && this.onRefreshFailed && this.onRefreshFailed(), {};
     }
   }
   enqueueForToken() {
@@ -410,7 +424,7 @@ const oe = class oe {
       return this.resolveQueue(r), r;
     } catch (t) {
       const r = t instanceof Error ? t : new Error("Token refresh failed");
-      throw r instanceof ie ? (this.rejectQueue(r), this.handleSessionExpired(r)) : this.rejectQueue(r), r;
+      throw r instanceof se ? (this.rejectQueue(r), this.handleSessionExpired(r)) : this.rejectQueue(r), r;
     } finally {
       this.refreshPromise = null;
     }
@@ -430,19 +444,23 @@ const oe = class oe {
   // --- Refresh with retry + error classification ---
   async executeRefreshWithRetry(e) {
     let t;
-    for (let r = 0; r <= this.maxRefreshRetries; r++)
+    const r = this.sessionGeneration;
+    for (let i = 0; i <= this.maxRefreshRetries; i++) {
+      if (this.sessionGeneration !== r)
+        throw new se("token_invalid", "Session cleared during refresh");
       try {
         await this.performTokenRefresh(e);
         return;
-      } catch (i) {
-        const o = i instanceof Error ? i : new Error(String(i));
-        if (o instanceof ie)
-          throw o;
-        if (t = o, r < this.maxRefreshRetries) {
-          const a = this.retryBackoffBase * Math.pow(2, r);
-          await this.sleep(a);
+      } catch (o) {
+        const a = o instanceof Error ? o : new Error(String(o));
+        if (a instanceof se)
+          throw a;
+        if (t = a, i < this.maxRefreshRetries) {
+          const f = this.retryBackoffBase * Math.pow(2, i);
+          await this.sleep(f);
         }
       }
+    }
     throw new wt(this.maxRefreshRetries + 1, t);
   }
   /**
@@ -472,7 +490,7 @@ const oe = class oe {
       } catch {
         o = r.statusText.toLowerCase();
       }
-      throw r.status === 401 ? o.includes("expired") ? new ie("token_expired") : o.includes("invalid") ? new ie("token_invalid") : new ie("token_invalid", `Unauthorized: ${o}`) : r.status === 400 ? o.includes("inactive") ? new ie("user_inactive") : new Error(`Token refresh failed (400): ${o}`) : new Error(`Token refresh failed: ${r.status} ${o}`);
+      throw r.status === 401 ? o.includes("expired") ? new se("token_expired") : o.includes("invalid") ? new se("token_invalid") : new se("token_invalid", `Unauthorized: ${o}`) : r.status === 400 ? o.includes("inactive") ? new se("user_inactive") : new Error(`Token refresh failed (400): ${o}`) : new Error(`Token refresh failed: ${r.status} ${o}`);
     }
     const i = await r.json();
     this.setTokens({
@@ -500,8 +518,8 @@ const oe = class oe {
   }
   // --- Session lifecycle ---
   clearSession() {
-    this.cancelProactiveTimer(), this.clearTokens(), this.clearUser();
-    const e = new ie("token_invalid", "Session cleared");
+    this.sessionGeneration++, this.cancelProactiveTimer(), this.clearTokens(), this.clearUser();
+    const e = new se("token_invalid", "Session cleared");
     this.rejectQueue(e);
   }
   /**
@@ -510,7 +528,7 @@ const oe = class oe {
    */
   destroy() {
     this.isDestroyed = !0, oe.instances.delete(this.storageKey), this.cancelProactiveTimer();
-    const e = new ie("token_invalid", "SessionManager destroyed");
+    const e = new se("token_invalid", "SessionManager destroyed");
     this.rejectQueue(e);
   }
   // --- JWT helpers ---
@@ -549,7 +567,7 @@ const oe = class oe {
   }
 };
 oe.instances = /* @__PURE__ */ new Map();
-let we = oe;
+let Se = oe;
 class bt {
   constructor(e) {
     this.httpService = e;
@@ -722,7 +740,7 @@ class St {
     });
   }
 }
-class be {
+class ve {
   constructor(e, t, r) {
     this.httpService = e, this.appId = t, this.sessionManager = r;
   }
@@ -830,7 +848,7 @@ function xt(n, e, t) {
   const r = e.split(".");
   return r.length === 2 ? `${n}.${e}` : r.length >= 3 ? (r[0] = n, r.join(".")) : null;
 }
-const pe = "_auth";
+const ge = "_auth";
 function We(n) {
   const e = JSON.stringify(n);
   return btoa(e).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
@@ -849,7 +867,7 @@ function At(n) {
 function Pt() {
   if (typeof window > "u")
     return console.log("[CrossDomainAuth] SSR environment, skipping URL token extraction"), null;
-  const e = new URLSearchParams(window.location.search).get(pe);
+  const e = new URLSearchParams(window.location.search).get(ge);
   if (console.log("[CrossDomainAuth] extractAuthTokensFromUrl called", {
     hasAuthParam: !!e,
     searchParams: window.location.search,
@@ -866,14 +884,14 @@ function Pt() {
 function Rt() {
   if (typeof window > "u") return;
   const n = new URL(window.location.href);
-  n.searchParams.delete(pe), console.log("[CrossDomainAuth] Clearing auth tokens from URL", {
+  n.searchParams.delete(ge), console.log("[CrossDomainAuth] Clearing auth tokens from URL", {
     oldUrl: window.location.href,
     newUrl: n.toString()
   }), window.history.replaceState({}, "", n.toString());
 }
-const De = fe(null);
+const De = me(null);
 function br({ config: n, children: e }) {
-  const { baseUrl: t, appInfo: r, appId: i } = ve(), o = se(() => typeof window > "u" ? null : kt(
+  const { baseUrl: t, appInfo: r, appId: i } = ke(), o = ie(() => typeof window > "u" ? null : kt(
     {
       tenantMode: n.tenantMode || "selector",
       baseDomain: n.baseDomain,
@@ -913,12 +931,12 @@ function br({ config: n, children: e }) {
     const h = o();
     f(h);
   }, [o, n.tenantMode]);
-  const M = (r == null ? void 0 : r.settingsSchema) || null, L = se(
+  const M = (r == null ? void 0 : r.settingsSchema) || null, L = ie(
     async (h, C = !1) => {
       if (!(!C && g.enabled && w && w.domain === h))
         try {
           p(!0), R(null);
-          const S = new ce(t), y = await new be(S, i).getPublicTenantInfo(h);
+          const S = new ce(t), y = await new ve(S, i).getPublicTenantInfo(h);
           if (c(y), g.enabled)
             try {
               const v = {
@@ -938,30 +956,30 @@ function br({ config: n, children: e }) {
         }
     },
     [t, i, g, w]
-  ), D = se(async () => {
+  ), D = ie(async () => {
     if (!(!g.enabled || !w || !a))
       try {
         const h = localStorage.getItem(g.storageKey);
         if (!h) return;
         const C = JSON.parse(h);
         if (Date.now() - C.timestamp > g.ttl * 0.5) {
-          const b = new ce(t), v = await new be(b, i).getPublicTenantInfo(a);
+          const b = new ce(t), v = await new ve(b, i).getPublicTenantInfo(a);
           c(v);
-          const j = {
+          const G = {
             data: v,
             timestamp: Date.now(),
             tenantSlug: a
           };
-          localStorage.setItem(g.storageKey, JSON.stringify(j));
+          localStorage.setItem(g.storageKey, JSON.stringify(G));
         }
       } catch (h) {
         console.warn("Background tenant refresh failed:", h);
       }
-  }, [t, i, g, w, a]), P = se(async () => {
+  }, [t, i, g, w, a]), P = ie(async () => {
     if (w != null && w.id)
       try {
         u(!0), m(null);
-        const h = new ce(t), S = await new be(h, w.appId).getTenantSettings(w.id);
+        const h = new ce(t), S = await new ve(h, w.appId).getTenantSettings(w.id);
         E(S);
       } catch (h) {
         const C = h instanceof Error ? h : new Error("Failed to load tenant settings");
@@ -969,9 +987,9 @@ function br({ config: n, children: e }) {
       } finally {
         u(!1);
       }
-  }, [t, w]), U = se(() => {
+  }, [t, w]), U = ie(() => {
     P();
-  }, [P]), l = se(
+  }, [P]), l = ie(
     (h) => {
       if (!M)
         return { isValid: !0, errors: [] };
@@ -986,8 +1004,8 @@ function br({ config: n, children: e }) {
           }
           if (y != null) {
             if (b.type) {
-              const j = b.type, Q = typeof y;
-              j === "string" && Q !== "string" ? C.push(`Field '${S}' must be a string`) : (j === "number" || j === "integer") && Q !== "number" ? C.push(`Field '${S}' must be a number`) : j === "boolean" && Q !== "boolean" ? C.push(`Field '${S}' must be a boolean`) : j === "array" && !Array.isArray(y) && C.push(`Field '${S}' must be an array`);
+              const G = b.type, Q = typeof y;
+              G === "string" && Q !== "string" ? C.push(`Field '${S}' must be a string`) : (G === "number" || G === "integer") && Q !== "number" ? C.push(`Field '${S}' must be a number`) : G === "boolean" && Q !== "boolean" ? C.push(`Field '${S}' must be a boolean`) : G === "array" && !Array.isArray(y) && C.push(`Field '${S}' must be an array`);
             }
             b.minLength !== void 0 && typeof y == "string" && y.length < b.minLength && C.push(
               `Field '${S}' must be at least ${b.minLength} characters long`
@@ -1013,7 +1031,7 @@ function br({ config: n, children: e }) {
   }, [n.initialTenant, a, w, L, D]), ee(() => {
     w != null && w.id ? P() : (E(null), m(null), u(!1));
   }, [w == null ? void 0 : w.id, P]);
-  const N = se(
+  const N = ie(
     (h, C) => {
       const { mode: S = "reload", tokens: b, redirectPath: y } = C || {}, v = n.tenantMode || "selector";
       if (v === "fixed") {
@@ -1024,29 +1042,29 @@ function br({ config: n, children: e }) {
         return;
       }
       if (localStorage.setItem("tenant", h), v === "subdomain") {
-        const j = window.location.hostname, Q = xt(
+        const G = window.location.hostname, Q = xt(
           h,
-          j,
+          G,
           n.baseDomain
         );
         if (!Q) {
           console.warn(
             "[TenantProvider] Cannot switch subdomain, invalid hostname:",
-            j
+            G
           );
           return;
         }
         const O = y || window.location.pathname, q = new URL(`${window.location.protocol}//${Q}${O}`);
         new URLSearchParams(window.location.search).forEach((B, X) => {
-          X !== pe && q.searchParams.set(X, B);
-        }), b && q.searchParams.set(pe, We(b)), window.location.href = q.toString();
+          X !== ge && q.searchParams.set(X, B);
+        }), b && q.searchParams.set(ge, We(b)), window.location.href = q.toString();
       } else if (v === "selector") {
-        const j = y || window.location.pathname, Q = new URLSearchParams(window.location.search);
-        if (Q.set(n.selectorParam || "tenant", h), Q.delete(pe), b && Q.set(pe, We(b)), S === "reload") {
-          const O = `${j}?${Q.toString()}${window.location.hash}`;
+        const G = y || window.location.pathname, Q = new URLSearchParams(window.location.search);
+        if (Q.set(n.selectorParam || "tenant", h), Q.delete(ge), b && Q.set(ge, We(b)), S === "reload") {
+          const O = `${G}?${Q.toString()}${window.location.hash}`;
           window.location.href = O;
         } else {
-          const O = `${j}?${Q.toString()}${window.location.hash}`;
+          const O = `${G}?${Q.toString()}${window.location.hash}`;
           window.history.pushState({}, "", O), f(h), L(h);
         }
       }
@@ -1086,18 +1104,18 @@ function br({ config: n, children: e }) {
   ]);
   return /* @__PURE__ */ s(De.Provider, { value: $, children: e });
 }
-function ge() {
+function ye() {
   const n = le(De);
   if (!n)
     throw new Error("useTenant must be used within a TenantProvider");
   return n;
 }
-function xe() {
+function Pe() {
   return le(De);
 }
-const Sr = ge;
+const Sr = ye;
 function vr() {
-  const { settings: n, settingsSchema: e, isSettingsLoading: t, settingsError: r, validateSettings: i } = ge();
+  const { settings: n, settingsSchema: e, isSettingsLoading: t, settingsError: r, validateSettings: i } = ye();
   return {
     settings: n,
     settingsSchema: e,
@@ -1106,8 +1124,8 @@ function vr() {
     validateSettings: i
   };
 }
-function me() {
-  const { tenant: n, tenantSlug: e, isTenantLoading: t, tenantError: r, retryTenant: i } = ge();
+function we() {
+  const { tenant: n, tenantSlug: e, isTenantLoading: t, tenantError: r, retryTenant: i } = ye();
   return {
     tenant: n,
     tenantSlug: e,
@@ -1116,12 +1134,12 @@ function me() {
     retry: i
   };
 }
-const Ne = fe(null);
+const Ne = me(null);
 function Tr({ config: n = {}, children: e }) {
-  const { appId: t, baseUrl: r } = ve(), { tenant: i, tenantSlug: o, switchTenant: a } = ge(), [f, g] = T(n.initialRoles || []), [w, c] = T(!n.initialRoles), [I, p] = T(null), [x, R] = T(!1), [F, E] = T(null), [A, u] = T(0), [k, m] = T(() => {
+  const { appId: t, baseUrl: r } = ke(), { tenant: i, tenantSlug: o, switchTenant: a } = ye(), [f, g] = T(n.initialRoles || []), [w, c] = T(!n.initialRoles), [I, p] = T(null), [x, R] = T(!1), [F, E] = T(null), [A, u] = T(0), [k, m] = T(() => {
     try {
-      const G = localStorage.getItem("userTenants");
-      return G ? JSON.parse(G) : [];
+      const V = localStorage.getItem("userTenants");
+      return V ? JSON.parse(V) : [];
     } catch {
       return [];
     }
@@ -1130,10 +1148,10 @@ function Tr({ config: n = {}, children: e }) {
     "[AuthProvider] SYNC: URL tokens found, will block isAuthReady until user loaded"
   ));
   const [P, U] = T(() => {
-    const G = D.current.urlTokens !== null;
-    return console.log("[AuthProvider] SYNC: isLoadingAfterUrlTokens initial:", G), G;
+    const V = D.current.urlTokens !== null;
+    return console.log("[AuthProvider] SYNC: isLoadingAfterUrlTokens initial:", V), V;
   }), l = Z(() => {
-    const G = we.getInstance({
+    const V = Se.getInstance({
       tenantSlug: o,
       baseUrl: r,
       refreshQueueTimeout: n.refreshQueueTimeout,
@@ -1147,29 +1165,33 @@ function Tr({ config: n = {}, children: e }) {
         n.onSessionExpired ? n.onSessionExpired(he) : n.onRefreshFailed && n.onRefreshFailed();
       }
     });
-    return D.current.urlTokens && (console.log("[AuthProvider] SYNC: Saving URL tokens to session manager"), G.setTokens({
+    return D.current.urlTokens && (console.log("[AuthProvider] SYNC: Saving URL tokens to session manager"), V.setTokens({
       accessToken: D.current.urlTokens.accessToken,
       refreshToken: D.current.urlTokens.refreshToken,
       expiresIn: D.current.urlTokens.expiresIn
-    }), console.log("[AuthProvider] SYNC: Session valid:", G.hasValidSession())), G;
-  }, [o, r, n.refreshQueueTimeout, n.proactiveRefreshMargin]), [N, $] = T(() => D.current.urlTokens ? !1 : l.hasValidSession()), h = D.current.done && !P && !N, C = Z(() => {
-    const G = new ce(r);
-    return G.setSessionManager(l), G;
-  }, [r, l]), S = Z(() => new bt(new ce(r)), [r]), b = Z(() => new St(C, l), [C, l]), y = Z(() => new _e(new ce(r)), [r]), v = Z(() => I || l.getUser(), [I, l]), j = Z(() => v != null && v.roleId && f.find((G) => G.id === v.roleId) || null, [v, f]), Q = Z(() => (j == null ? void 0 : j.permissions) || [], [j]), O = Z(() => l.hasValidSession() && I !== null, [l, I]), q = 5 * 60 * 1e3, W = Z(() => {
-    const G = async (H = !1) => {
+    }), console.log("[AuthProvider] SYNC: Session valid:", V.hasValidSession())), V;
+  }, [o, r, n.refreshQueueTimeout, n.proactiveRefreshMargin]), [N, $] = T(() => {
+    if (D.current.urlTokens) return !1;
+    const V = l.getTokens();
+    return V ? l.hasValidSession() || !!V.refreshToken : !1;
+  }), h = D.current.done && !P && !N, C = Z(() => {
+    const V = new ce(r);
+    return V.setSessionManager(l), V;
+  }, [r, l]), S = Z(() => new bt(new ce(r)), [r]), b = Z(() => new St(C, l), [C, l]), y = Z(() => new _e(new ce(r)), [r]), v = Z(() => I || l.getUser(), [I, l]), G = Z(() => v != null && v.roleId && f.find((V) => V.id === v.roleId) || null, [v, f]), Q = Z(() => (G == null ? void 0 : G.permissions) || [], [G]), O = Z(() => l.hasValidSession() && I !== null, [l, I]), q = 5 * 60 * 1e3, W = Z(() => {
+    const V = async (H = !1) => {
       try {
         if (!l.hasValidSession())
           return;
         const z = Date.now();
         if (!H && z - A < q && I)
           return;
-        const V = l.getUserId();
-        if (!V) {
+        const j = l.getUserId();
+        if (!j) {
           console.warn("[AuthProvider] No userId available in token or storage");
           return;
         }
         R(!0), E(null);
-        const J = await b.getUserById(V);
+        const J = await b.getUserById(j);
         p(J), l.setUser(J), u(Date.now());
       } catch (z) {
         const Y = z instanceof Error ? z : new Error("Failed to load user data");
@@ -1178,19 +1200,19 @@ function Tr({ config: n = {}, children: e }) {
         R(!1);
       }
     }, he = async () => {
-      await G();
-    }, Ae = async (H) => {
+      await V();
+    }, fe = async (H) => {
       var qe;
-      const { username: z, password: Y, tenantSlug: V, redirectPath: J } = H;
+      const { username: z, password: Y, tenantSlug: j, redirectPath: J } = H;
       let te = i == null ? void 0 : i.id, re = o, ne = l;
-      V && (te = (await new be(C, t).getPublicTenantInfo(V)).id, re = V);
+      j && (te = (await new ve(C, t).getPublicTenantInfo(j)).id, re = j);
       const K = await S.login({
         username: z,
         password: Y,
         appId: t,
         tenantId: te
-      }), ye = V && V !== o;
-      if (ye && (ne = new we({
+      }), be = j && j !== o;
+      if (be && (ne = new Se({
         tenantSlug: re,
         baseUrl: r
       })), ne.setTokens({
@@ -1200,9 +1222,9 @@ function Tr({ config: n = {}, children: e }) {
       }), K.user) {
         ne.setUser(K.user), p(K.user);
         try {
-          await G();
-        } catch (Te) {
-          console.warn("Failed to load complete user data after login:", Te);
+          await V();
+        } catch (xe) {
+          console.warn("Failed to load complete user data after login:", xe);
         }
       }
       if (K.tenants && K.tenants.length > 0) {
@@ -1219,83 +1241,83 @@ function Tr({ config: n = {}, children: e }) {
         refreshToken: K.refreshToken,
         expiresIn: K.expiresIn
       };
-      if (ye && re)
+      if (be && re)
         return a(re, { tokens: Ee, redirectPath: J }), K;
       if (J && J !== window.location.pathname)
         return a(re || o || "", { tokens: Ee, redirectPath: J }), K;
       if (!Ie && K.tenants && K.tenants.length > 0) {
-        const Te = H.autoSwitch !== !1 && n.autoSwitchSingleTenant !== !1;
-        if (K.tenants.length === 1 && Te) {
+        const xe = H.autoSwitch !== !1 && n.autoSwitchSingleTenant !== !1;
+        if (K.tenants.length === 1 && xe) {
           const Oe = K.tenants[0];
           return a(Oe.subdomain, { tokens: Ee, redirectPath: J }), K;
         } else K.tenants.length > 1 && n.onTenantSelectionRequired && n.onTenantSelectionRequired(K.tenants);
       }
       return K;
-    }, Pe = async (H) => {
-      const { email: z, phoneNumber: Y, name: V, password: J, lastName: te, tenantId: re } = H;
+    }, pe = async (H) => {
+      const { email: z, phoneNumber: Y, name: j, password: J, lastName: te, tenantId: re } = H;
       if (!z && !Y)
         throw new Error("Either email or phoneNumber is required");
-      if (!V || !J)
+      if (!j || !J)
         throw new Error("Name and password are required");
       const ne = re ?? (i == null ? void 0 : i.id);
       return await S.signup({
         email: z,
         phoneNumber: Y,
-        name: V,
+        name: j,
         password: J,
         tenantId: ne,
         lastName: te,
         appId: t
       });
     }, rt = async (H) => {
-      const { email: z, phoneNumber: Y, name: V, password: J, tenantName: te, lastName: re } = H;
+      const { email: z, phoneNumber: Y, name: j, password: J, tenantName: te, lastName: re } = H;
       if (!z && !Y)
         throw new Error("Either email or phoneNumber is required");
-      if (!V || !J || !te)
+      if (!j || !J || !te)
         throw new Error("Name, password, and tenantName are required");
       return await S.signupTenantAdmin({
         email: z,
         phoneNumber: Y,
-        name: V,
+        name: j,
         password: J,
         tenantName: te,
         appId: t,
         lastName: re
       });
     }, nt = async (H) => {
-      const { currentPassword: z, newPassword: Y } = H, V = await l.getAuthHeaders();
-      await S.changePassword({ currentPassword: z, newPassword: Y }, V);
+      const { currentPassword: z, newPassword: Y } = H, j = await l.getAuthHeaders();
+      await S.changePassword({ currentPassword: z, newPassword: Y }, j);
     }, st = async (H) => {
-      const { email: z, tenantId: Y } = H, V = Y ?? (i == null ? void 0 : i.id);
-      if (!V)
+      const { email: z, tenantId: Y } = H, j = Y ?? (i == null ? void 0 : i.id);
+      if (!j)
         throw new Error("tenantId is required for password reset");
-      await S.requestPasswordReset({ email: z, tenantId: V });
+      await S.requestPasswordReset({ email: z, tenantId: j });
     }, it = async (H) => {
       const { token: z, newPassword: Y } = H;
       await S.confirmPasswordReset({ token: z, newPassword: Y });
     }, ot = async (H) => {
-      const { email: z, frontendUrl: Y, name: V, lastName: J, tenantId: te } = H, re = te ?? (i == null ? void 0 : i.id);
+      const { email: z, frontendUrl: Y, name: j, lastName: J, tenantId: te } = H, re = te ?? (i == null ? void 0 : i.id);
       if (!re)
         throw new Error("tenantId is required for magic link authentication");
       return await S.sendMagicLink({
         email: z,
         tenantId: re,
         frontendUrl: Y,
-        name: V,
+        name: j,
         lastName: J,
         appId: t
       });
     }, at = async (H) => {
-      const { token: z, email: Y, tenantSlug: V } = H;
+      const { token: z, email: Y, tenantSlug: j } = H;
       let J = i == null ? void 0 : i.id, te = o, re = l;
-      V && (J = (await new be(C, t).getPublicTenantInfo(V)).id, te = V);
+      j && (J = (await new ve(C, t).getPublicTenantInfo(j)).id, te = j);
       const ne = await S.verifyMagicLink({
         token: z,
         email: Y,
         appId: t,
         tenantId: J
-      }), K = V && V !== o;
-      if (K && (re = new we({
+      }), K = j && j !== o;
+      if (K && (re = new Se({
         tenantSlug: te,
         baseUrl: r
       })), re.setTokens({
@@ -1305,9 +1327,9 @@ function Tr({ config: n = {}, children: e }) {
       }), ne.user) {
         re.setUser(ne.user), p(ne.user);
         try {
-          await G();
-        } catch (ye) {
-          console.warn("Failed to load complete user data after magic link login:", ye);
+          await V();
+        } catch (be) {
+          console.warn("Failed to load complete user data after magic link login:", be);
         }
       }
       return K && te && te !== o && a(te, {
@@ -1339,7 +1361,7 @@ function Tr({ config: n = {}, children: e }) {
       l.setTokens(H);
     }, ut = () => l.hasValidSession(), ht = () => {
       l.clearSession(), p(null), E(null);
-    }, pt = async () => {
+    }, ft = async () => {
       if (t)
         try {
           c(!0);
@@ -1350,8 +1372,8 @@ function Tr({ config: n = {}, children: e }) {
         } finally {
           c(!1);
         }
-    }, ft = async () => {
-      await pt();
+    }, pt = async () => {
+      await ft();
     }, Re = (H) => {
       if (!Q || Q.length === 0)
         return !1;
@@ -1365,8 +1387,8 @@ function Tr({ config: n = {}, children: e }) {
       isAuthenticated: O,
       sessionManager: l,
       authenticatedHttpService: C,
-      login: Ae,
-      signup: Pe,
+      login: fe,
+      signup: pe,
       signupTenantAdmin: rt,
       sendMagicLink: ot,
       verifyMagicLink: at,
@@ -1381,11 +1403,11 @@ function Tr({ config: n = {}, children: e }) {
       currentUser: I,
       isUserLoading: x,
       userError: F,
-      loadUserData: G,
+      loadUserData: V,
       refreshUser: he,
       isAuthInitializing: !h,
       isAuthReady: h,
-      userRole: j,
+      userRole: G,
       userPermissions: Q,
       availableRoles: f,
       rolesLoading: w,
@@ -1393,21 +1415,21 @@ function Tr({ config: n = {}, children: e }) {
       hasAnyPermission: (H) => H.some((z) => Re(z)),
       hasAllPermissions: (H) => H.every((z) => Re(z)),
       getUserPermissionStrings: () => Q || [],
-      refreshRoles: ft,
+      refreshRoles: pt,
       // RFC-004: Multi-tenant user membership
       userTenants: k,
       hasTenantContext: M,
       switchToTenant: async (H, z) => {
-        const { redirectPath: Y } = z || {}, V = l.getTokens();
-        if (!(V != null && V.refreshToken))
+        const { redirectPath: Y } = z || {}, j = l.getTokens();
+        if (!(j != null && j.refreshToken))
           throw new Error("No refresh token available for tenant switch");
         const J = await S.switchTenant({
-          refreshToken: V.refreshToken,
+          refreshToken: j.refreshToken,
           tenantId: H
         });
         l.setTokens({
           accessToken: J.accessToken,
-          refreshToken: V.refreshToken,
+          refreshToken: j.refreshToken,
           // Keep the same refresh token
           expiresIn: J.expiresIn
         }), p(J.user), l.setUser(J.user), L(!0);
@@ -1415,7 +1437,7 @@ function Tr({ config: n = {}, children: e }) {
         te && a(te.subdomain, {
           tokens: {
             accessToken: J.accessToken,
-            refreshToken: V.refreshToken,
+            refreshToken: j.refreshToken,
             expiresIn: J.expiresIn
           },
           redirectPath: Y
@@ -1449,7 +1471,7 @@ function Tr({ config: n = {}, children: e }) {
     k,
     M,
     h,
-    j,
+    G,
     Q,
     A,
     q
@@ -1458,8 +1480,8 @@ function Tr({ config: n = {}, children: e }) {
     !n.initialRoles && t && (async () => {
       try {
         c(!0);
-        const he = new ce(r), Ae = new _e(he), { roles: Pe } = await Ae.getRolesByApp(t);
-        g(Pe);
+        const he = new ce(r), fe = new _e(he), { roles: pe } = await fe.getRolesByApp(t);
+        g(pe);
       } catch (he) {
         console.error("Failed to fetch roles:", he);
       } finally {
@@ -1469,14 +1491,21 @@ function Tr({ config: n = {}, children: e }) {
   }, [t, r, n.initialRoles]);
   const [B, X] = T(!1);
   return ee(() => {
-    B || (X(!0), D.current.urlTokens && (console.log("[AuthProvider] EFFECT: Cleaning up URL after sync token processing"), Rt(), U(!0), console.log("[AuthProvider] EFFECT: Loading user data (blocking isAuthReady)..."), W.loadUserData().catch((G) => {
-      console.error("[AuthProvider] Failed to load user data:", G);
+    B || (X(!0), D.current.urlTokens && (console.log("[AuthProvider] EFFECT: Cleaning up URL after sync token processing"), Rt(), U(!0), console.log("[AuthProvider] EFFECT: Loading user data (blocking isAuthReady)..."), W.loadUserData().catch((V) => {
+      console.error("[AuthProvider] Failed to load user data:", V);
     }).finally(() => {
       console.log("[AuthProvider] EFFECT: User data loaded, releasing isAuthReady"), U(!1);
     })));
   }, [W, B]), ee(() => {
-    const G = l.getUser();
-    G && l.hasValidSession() ? (p(G), $(!1)) : l.hasValidSession() || $(!1);
+    let V = !1;
+    return (async () => {
+      var pe;
+      if (!l.hasValidSession() && ((pe = l.getTokens()) != null && pe.refreshToken) && await l.waitForPendingRefresh(), V) return;
+      const fe = l.getUser();
+      fe && l.hasValidSession() ? (p(fe), $(!1)) : l.hasValidSession() || $(!1);
+    })(), () => {
+      V = !0;
+    };
   }, [l]), ee(() => {
     B && (D.current.urlTokens || (!I && !x && l.hasValidSession() ? (console.log("[AuthProvider] Auto-loading user data..."), W.loadUserData().catch(() => {
     }).finally(() => {
@@ -1485,11 +1514,11 @@ function Tr({ config: n = {}, children: e }) {
   }, [I, x, W, l, B]), ee(() => {
     if (!l.hasValidSession() || !I)
       return;
-    const G = setInterval(() => {
+    const V = setInterval(() => {
       W.loadUserData().catch(() => {
       });
     }, q);
-    return () => clearInterval(G);
+    return () => clearInterval(V);
   }, [l, I, W, q]), /* @__PURE__ */ s(Ne.Provider, { value: W, children: e });
 }
 function ue() {
@@ -1581,9 +1610,9 @@ class It {
     })).data;
   }
 }
-const Ue = fe(null);
+const Ue = me(null);
 function kr({ config: n = {}, children: e }) {
-  const t = Ze(), r = xe(), i = (t == null ? void 0 : t.baseUrl) ?? "", o = (t == null ? void 0 : t.appId) ?? "", a = (r == null ? void 0 : r.tenant) ?? null, [f, g] = T([]), [w, c] = T(!1), [I, p] = T(null), [x, R] = T(!1), F = Z(() => {
+  const t = Ze(), r = Pe(), i = (t == null ? void 0 : t.baseUrl) ?? "", o = (t == null ? void 0 : t.appId) ?? "", a = (r == null ? void 0 : r.tenant) ?? null, [f, g] = T([]), [w, c] = T(!1), [I, p] = T(null), [x, R] = T(!1), F = Z(() => {
     const u = new ce(i);
     return new It(u);
   }, [i]), E = async () => {
@@ -1706,9 +1735,9 @@ class Mt {
     )).data;
   }
 }
-const $e = fe(void 0);
+const $e = me(void 0);
 function xr({ config: n = {}, children: e }) {
-  const t = Ze(), r = xe(), i = (t == null ? void 0 : t.baseUrl) ?? "", o = (r == null ? void 0 : r.tenant) ?? null, [a, f] = T(null), [g, w] = T(!1), [c, I] = T(null), [p, x] = T(!1), R = Z(() => {
+  const t = Ze(), r = Pe(), i = (t == null ? void 0 : t.baseUrl) ?? "", o = (r == null ? void 0 : r.tenant) ?? null, [a, f] = T(null), [g, w] = T(!1), [c, I] = T(null), [p, x] = T(!1), R = Z(() => {
     const A = new ce(i);
     return new Mt(A);
   }, [i]), F = async () => {
@@ -1792,7 +1821,7 @@ const He = {
   admin: { tenant: "required", auth: "required", userType: ae.TENANT_ADMIN },
   // Fully open
   open: { tenant: "optional", auth: "optional" }
-}, Be = fe(null);
+}, Be = me(null);
 function Ar({ config: n = {}, children: e }) {
   const t = Z(() => {
     const r = {
@@ -2035,7 +2064,7 @@ function Ir({
   requireAllPermissions: i = !1,
   fallback: o
 }) {
-  const { hasValidSession: a, sessionManager: f, hasPermission: g, hasAnyPermission: w, hasAllPermissions: c } = ue(), I = ke();
+  const { hasValidSession: a, sessionManager: f, hasPermission: g, hasAnyPermission: w, hasAllPermissions: c } = ue(), I = Ae();
   if (ee(() => {
     process.env.NODE_ENV === "development" && console.warn(
       "[react-identity-access] ProtectedRoute is deprecated. Use AuthenticatedZone or AdminZone from ZoneRoute instead."
@@ -2043,11 +2072,11 @@ function Ir({
   }, []), !a())
     return o ? /* @__PURE__ */ s(_, { children: o }) : /* @__PURE__ */ d(_, { children: [
       /* @__PURE__ */ s(Nt, { redirectPath: e }),
-      /* @__PURE__ */ s(Se, { to: e, state: { from: I.pathname }, replace: !0 })
+      /* @__PURE__ */ s(Te, { to: e, state: { from: I.pathname }, replace: !0 })
     ] });
   const p = f.getUser();
   if (!p)
-    return /* @__PURE__ */ s(Se, { to: e, state: { from: I.pathname }, replace: !0 });
+    return /* @__PURE__ */ s(Te, { to: e, state: { from: I.pathname }, replace: !0 });
   if (t && !Ct(p.userType, t))
     return /* @__PURE__ */ s(
       Ge,
@@ -2100,14 +2129,14 @@ const Ut = ({ redirectPath: n }) => /* @__PURE__ */ s(
   }
 );
 function Er({ children: n, redirectTo: e = "/", fallback: t }) {
-  const { tenant: r, isLoading: i, error: o } = me(), a = ke();
+  const { tenant: r, isLoading: i, error: o } = we(), a = Ae();
   return ee(() => {
     process.env.NODE_ENV === "development" && console.warn(
       "[react-identity-access] TenantRoute is deprecated. Use TenantZone from ZoneRoute instead."
     );
   }, []), i || o ? null : r ? /* @__PURE__ */ s(_, { children: n }) : t ? /* @__PURE__ */ s(_, { children: t }) : /* @__PURE__ */ d(_, { children: [
     /* @__PURE__ */ s(Ut, { redirectPath: e }),
-    /* @__PURE__ */ s(Se, { to: e, state: { from: a.pathname }, replace: !0 })
+    /* @__PURE__ */ s(Te, { to: e, state: { from: a.pathname }, replace: !0 })
   ] });
 }
 const $t = ({ redirectPath: n }) => /* @__PURE__ */ s(
@@ -2148,14 +2177,14 @@ const $t = ({ redirectPath: n }) => /* @__PURE__ */ s(
   }
 );
 function Mr({ children: n, redirectTo: e = "/dashboard", fallback: t }) {
-  const { tenant: r, isLoading: i, error: o } = me(), a = ke();
+  const { tenant: r, isLoading: i, error: o } = we(), a = Ae();
   return ee(() => {
     process.env.NODE_ENV === "development" && console.warn(
       "[react-identity-access] LandingRoute is deprecated. Use PublicZone from ZoneRoute instead."
     );
   }, []), i || o ? null : r ? t ? /* @__PURE__ */ s(_, { children: t }) : /* @__PURE__ */ d(_, { children: [
     /* @__PURE__ */ s($t, { redirectPath: e }),
-    /* @__PURE__ */ s(Se, { to: e, state: { from: a.pathname }, replace: !0 })
+    /* @__PURE__ */ s(Te, { to: e, state: { from: a.pathname }, replace: !0 })
   ] }) : /* @__PURE__ */ s(_, { children: n });
 }
 function Ht(n, e) {
@@ -2195,7 +2224,7 @@ const de = ({
   loadingFallback: c,
   accessDeniedFallback: I
 }) => {
-  const p = ke(), { isAuthenticated: x, isAuthInitializing: R, currentUser: F, userPermissions: E } = ue(), { tenant: A, isTenantLoading: u } = ge(), k = Ft(), m = Z(() => {
+  const p = Ae(), { isAuthenticated: x, isAuthInitializing: R, currentUser: F, userPermissions: E } = ue(), { tenant: A, isTenantLoading: u } = ye(), k = Ft(), m = Z(() => {
     if (e)
       return k.presets[e];
   }, [e, k.presets]), M = Z(
@@ -2262,7 +2291,7 @@ const de = ({
       k.returnToParam,
       k.returnToStorage
     );
-    return /* @__PURE__ */ s(Se, { to: N, replace: !0 });
+    return /* @__PURE__ */ s(Te, { to: N, replace: !0 });
   }
   return /* @__PURE__ */ s(_, { children: n });
 }, Lr = (n) => /* @__PURE__ */ s(de, { tenant: "required", ...n }), Fr = (n) => /* @__PURE__ */ s(de, { tenant: "forbidden", ...n }), Dr = (n) => /* @__PURE__ */ s(de, { auth: "required", ...n }), Nr = (n) => /* @__PURE__ */ s(de, { auth: "forbidden", ...n }), Cr = (n) => /* @__PURE__ */ s(de, { auth: "required", userType: ae.TENANT_ADMIN, ...n }), Ur = (n) => /* @__PURE__ */ s(de, { auth: "required", userType: ae.USER, ...n }), $r = (n) => /* @__PURE__ */ s(de, { tenant: "optional", auth: "optional", ...n }), Hr = (n) => /* @__PURE__ */ s(de, { tenant: "required", auth: "required", ...n }), Br = (n) => /* @__PURE__ */ s(de, { tenant: "required", auth: "optional", ...n }), qr = (n) => /* @__PURE__ */ s(de, { tenant: "required", auth: "forbidden", ...n }), _t = () => /* @__PURE__ */ d(
@@ -2517,7 +2546,7 @@ function _r({
   showMagicLinkOption: c = !0,
   className: I
 }) {
-  const [p, x] = T(""), [R, F] = T(""), [E, A] = T(!1), [u, k] = T(!1), [m, M] = T(""), [L, D] = T({}), { login: P } = ue(), { tenant: U } = me(), l = { ...Qt, ...n }, N = { ...Kt, ...e }, $ = { ...Gt, ...t }, h = () => {
+  const [p, x] = T(""), [R, F] = T(""), [E, A] = T(!1), [u, k] = T(!1), [m, M] = T(""), [L, D] = T({}), { login: P } = ue(), { tenant: U } = we(), l = { ...Qt, ...n }, N = { ...Kt, ...e }, $ = { ...Gt, ...t }, h = () => {
     const y = {};
     return p.trim() || (y.username = !0), R.trim() || (y.password = !0), D(y), Object.keys(y).length === 0;
   }, C = async (y) => {
@@ -2535,8 +2564,8 @@ function _r({
         });
         r == null || r(v);
       } catch (v) {
-        const j = v.message || l.errorMessage;
-        M(j), i == null || i(j);
+        const G = v.message || l.errorMessage;
+        M(G), i == null || i(G);
       } finally {
         k(!1);
       }
@@ -2766,11 +2795,11 @@ function Wr({
   showMagicLinkOption: g = !0,
   className: w
 }) {
-  const [c, I] = T(""), [p, x] = T(""), [R, F] = T(""), [E, A] = T(""), [u, k] = T(""), [m, M] = T(""), [L, D] = T(""), [P, U] = T(!1), [l, N] = T(""), [$, h] = T({}), { signup: C, signupTenantAdmin: S } = ue(), { tenant: b } = me(), y = { ...Zt, ...n }, v = { ...Jt, ...e }, j = () => {
+  const [c, I] = T(""), [p, x] = T(""), [R, F] = T(""), [E, A] = T(""), [u, k] = T(""), [m, M] = T(""), [L, D] = T(""), [P, U] = T(!1), [l, N] = T(""), [$, h] = T({}), { signup: C, signupTenantAdmin: S } = ue(), { tenant: b } = we(), y = { ...Zt, ...n }, v = { ...Jt, ...e }, G = () => {
     const B = {};
     return c.trim() || (B.name = !0), !R.trim() && !E.trim() && (B.email = !0, B.phoneNumber = !0), u.trim() || (B.password = !0), m.trim() || (B.confirmPassword = !0), t === "tenant" && !L.trim() && (B.tenantName = !0), h(B), Object.keys(B).length === 0;
   }, Q = async (B) => {
-    if (B.preventDefault(), !!j()) {
+    if (B.preventDefault(), !!G()) {
       if (u !== m) {
         N(y.passwordMismatchError), h({ confirmPassword: !0 });
         return;
@@ -2798,8 +2827,8 @@ function Wr({
           lastName: p || void 0
         }), r == null || r(X);
       } catch (X) {
-        const G = X.message || y.errorMessage;
-        N(G), i == null || i(G);
+        const V = X.message || y.errorMessage;
+        N(V), i == null || i(V);
       } finally {
         U(!1);
       }
@@ -3106,7 +3135,7 @@ function Vr({
   verifyToken: g,
   frontendUrl: w
 }) {
-  const [c, I] = T(""), [p, x] = T(""), [R, F] = T(""), [E, A] = T(!1), [u, k] = T(!1), [m, M] = T(""), [L, D] = T(""), [P, U] = T({}), [l, N] = T(!1), { sendMagicLink: $, verifyMagicLink: h } = ue(), { tenant: C } = me(), S = { ...Yt, ...n }, b = { ...Xt, ...e };
+  const [c, I] = T(""), [p, x] = T(""), [R, F] = T(""), [E, A] = T(!1), [u, k] = T(!1), [m, M] = T(""), [L, D] = T(""), [P, U] = T({}), [l, N] = T(!1), { sendMagicLink: $, verifyMagicLink: h } = ue(), { tenant: C } = we(), S = { ...Yt, ...n }, b = { ...Xt, ...e };
   ee(() => {
     g && y(g);
   }, [g]);
@@ -3132,7 +3161,7 @@ function Vr({
   }, v = () => {
     const q = {};
     return c.trim() || (q.email = !0), l && !p.trim() && (q.name = !0), U(q), Object.keys(q).length === 0;
-  }, j = async (q) => {
+  }, G = async (q) => {
     if (q.preventDefault(), !!v()) {
       if (!(C != null && C.id)) {
         M("Tenant not found");
@@ -3169,7 +3198,7 @@ function Vr({
   ] }) : /* @__PURE__ */ d("div", { className: f, style: b.container, children: [
     /* @__PURE__ */ s("h2", { style: b.title, children: S.title }),
     /* @__PURE__ */ s("p", { style: b.description, children: S.description }),
-    /* @__PURE__ */ d("form", { onSubmit: j, style: b.form, children: [
+    /* @__PURE__ */ d("form", { onSubmit: G, style: b.form, children: [
       /* @__PURE__ */ d("div", { style: b.fieldGroup, children: [
         /* @__PURE__ */ s("label", { style: b.label, children: S.emailLabel }),
         /* @__PURE__ */ s(
@@ -3658,7 +3687,7 @@ function Gr({
   onModeChange: f,
   className: g
 }) {
-  const [w, c] = T(""), [I, p] = T(r), [x, R] = T(""), [F, E] = T(""), [A, u] = T(!1), [k, m] = T(""), [M, L] = T(""), [D, P] = T({}), { requestPasswordReset: U, confirmPasswordReset: l } = ue(), { tenant: N } = me(), $ = { ...ir, ...n }, h = { ...or, ...e }, C = () => {
+  const [w, c] = T(""), [I, p] = T(r), [x, R] = T(""), [F, E] = T(""), [A, u] = T(!1), [k, m] = T(""), [M, L] = T(""), [D, P] = T({}), { requestPasswordReset: U, confirmPasswordReset: l } = ue(), { tenant: N } = we(), $ = { ...ir, ...n }, h = { ...or, ...e }, C = () => {
     const O = {};
     return w.trim() || (O.email = !0), P(O), Object.keys(O).length === 0;
   }, S = () => {
@@ -3699,7 +3728,7 @@ function Gr({
   }, v = (O) => ({
     ...h.input,
     ...D[O] ? h.inputError : {}
-  }), j = () => ({
+  }), G = () => ({
     ...h.button,
     ...A ? h.buttonLoading : {}
   });
@@ -3763,7 +3792,7 @@ function Gr({
             type: "submit",
             disabled: !O || A,
             style: {
-              ...j(),
+              ...G(),
               ...!O || A ? h.buttonDisabled : {}
             },
             children: A ? $.resetLoadingText : $.resetSubmitButton
@@ -3808,7 +3837,7 @@ function Gr({
           type: "submit",
           disabled: !Q || A,
           style: {
-            ...j(),
+            ...G(),
             ...!Q || A ? h.buttonDisabled : {}
           },
           children: A ? $.loadingText : $.submitButton
@@ -3878,7 +3907,7 @@ function Qr({
   errorFallback: t,
   requireTenant: r = !0
 }) {
-  const { isAppLoading: i, appError: o, retryApp: a } = ve(), f = xe(), g = Ce(), w = Je(), c = Ye(), I = (f == null ? void 0 : f.isTenantLoading) ?? !1, p = (f == null ? void 0 : f.tenantError) ?? null, x = (f == null ? void 0 : f.tenantSlug) ?? null, R = (f == null ? void 0 : f.retryTenant) ?? (() => {
+  const { isAppLoading: i, appError: o, retryApp: a } = ke(), f = Pe(), g = Ce(), w = Je(), c = Ye(), I = (f == null ? void 0 : f.isTenantLoading) ?? !1, p = (f == null ? void 0 : f.tenantError) ?? null, x = (f == null ? void 0 : f.tenantSlug) ?? null, R = (f == null ? void 0 : f.retryTenant) ?? (() => {
   }), F = (g == null ? void 0 : g.isAuthReady) ?? !0, E = (w == null ? void 0 : w.isReady) ?? !0, A = (c == null ? void 0 : c.isReady) ?? !0, u = r && f && x, L = i || u && I || g && !F || w && !E || c && !A, D = o || (u ? p : null), P = () => {
     o && a(), p && f && R();
   };
@@ -3891,7 +3920,7 @@ function Qr({
   return /* @__PURE__ */ s(_, { children: n });
 }
 function Kr(n = !0) {
-  const { isAppLoading: e, appError: t, retryApp: r, appInfo: i } = ve(), o = xe(), a = Ce(), f = Je(), g = Ye(), w = (o == null ? void 0 : o.isTenantLoading) ?? !1, c = (o == null ? void 0 : o.tenantError) ?? null, I = (o == null ? void 0 : o.tenant) ?? null, p = (o == null ? void 0 : o.tenantSlug) ?? null, x = (o == null ? void 0 : o.retryTenant) ?? (() => {
+  const { isAppLoading: e, appError: t, retryApp: r, appInfo: i } = ke(), o = Pe(), a = Ce(), f = Je(), g = Ye(), w = (o == null ? void 0 : o.isTenantLoading) ?? !1, c = (o == null ? void 0 : o.tenantError) ?? null, I = (o == null ? void 0 : o.tenant) ?? null, p = (o == null ? void 0 : o.tenantSlug) ?? null, x = (o == null ? void 0 : o.retryTenant) ?? (() => {
   }), R = (a == null ? void 0 : a.isAuthReady) ?? !0, F = (f == null ? void 0 : f.isReady) ?? !0, E = (g == null ? void 0 : g.isReady) ?? !0, A = n && o && p, M = e || A && w || a && !R || f && !F || g && !E, L = t || (A ? c : null);
   return {
     isLoading: M,
@@ -4260,7 +4289,7 @@ function tn(n = {}) {
     zoneRoots: e = {},
     returnToParam: t = tt,
     returnToStorage: r = "url"
-  } = n, i = gt(), [o, a] = mt(), { isAuthenticated: f, currentUser: g } = ue(), { tenant: w } = ge(), c = Z(() => ({ ...He, ...e }), [e]), I = !!w, p = g == null ? void 0 : g.userType, x = Z(() => {
+  } = n, i = gt(), [o, a] = mt(), { isAuthenticated: f, currentUser: g } = ue(), { tenant: w } = ye(), c = Z(() => ({ ...He, ...e }), [e]), I = !!w, p = g == null ? void 0 : g.userType, x = Z(() => {
     switch (r) {
       case "url":
         return o.get(t);
@@ -4271,7 +4300,7 @@ function tn(n = {}) {
       default:
         return null;
     }
-  }, [r, o, t]), R = se(() => {
+  }, [r, o, t]), R = ie(() => {
     switch (r) {
       case "url": {
         const u = new URLSearchParams(o);
@@ -4285,7 +4314,7 @@ function tn(n = {}) {
         localStorage.removeItem(Le);
         break;
     }
-  }, [r, o, t, a]), F = se(
+  }, [r, o, t, a]), F = ie(
     (u) => {
       switch (r) {
         case "url": {
@@ -4302,13 +4331,13 @@ function tn(n = {}) {
       }
     },
     [r, o, t, a]
-  ), E = se(
+  ), E = ie(
     (u) => {
       const k = c[u] || c.default;
       i(k);
     },
     [i, c]
-  ), A = se(() => I ? f ? p === ae.TENANT_ADMIN ? c.tenantAdmin : c.tenantUser : c.tenantGuest : f ? p === ae.TENANT_ADMIN ? c.publicAdmin : c.publicUser : c.publicGuest, [I, f, p, c]);
+  ), A = ie(() => I ? f ? p === ae.TENANT_ADMIN ? c.tenantAdmin : c.tenantUser : c.tenantGuest : f ? p === ae.TENANT_ADMIN ? c.publicAdmin : c.publicUser : c.publicGuest, [I, f, p, c]);
   return {
     returnToUrl: x,
     clearReturnTo: R,
@@ -4352,14 +4381,14 @@ export {
   Fr as PublicZone,
   _e as RoleApiService,
   Ar as RoutingProvider,
-  ie as SessionExpiredError,
-  we as SessionManager,
+  se as SessionExpiredError,
+  Se as SessionManager,
   Wr as SignupForm,
   Mt as SubscriptionApiService,
   Or as SubscriptionGuard,
   Yr as SubscriptionPlanApiService,
   xr as SubscriptionProvider,
-  be as TenantApiService,
+  ve as TenantApiService,
   Hr as TenantAuthenticatedZone,
   qr as TenantGuestZone,
   Br as TenantOpenZone,
@@ -4375,7 +4404,7 @@ export {
   de as ZoneRoute,
   rn as buildRedirectUrl,
   wr as useApi,
-  ve as useApp,
+  ke as useApp,
   Kr as useAppLoaderState,
   ue as useAuth,
   Et as useFeatureFlags,
@@ -4383,9 +4412,9 @@ export {
   Ft as useRoutingOptional,
   vr as useSettings,
   Lt as useSubscription,
-  ge as useTenant,
-  me as useTenantInfo,
-  xe as useTenantOptional,
+  ye as useTenant,
+  we as useTenantInfo,
+  Pe as useTenantOptional,
   Sr as useTenantSettings,
   tn as useZoneNavigation
 };