@skylabs-digital/react-identity-access 2.21.0 → 2.23.0

package/dist/index.es.js

@@ -1,6 +1,6 @@
 import { jsx as s, Fragment as _, jsxs as d } from "react/jsx-runtime";
-import { createContext as fe, useMemo as Z, useState as T, useCallback as se, useEffect as ee, useContext as le, useRef as Ke } from "react";
-import { useLocation as ke, Navigate as Se, useNavigate as gt, useSearchParams as mt } from "react-router-dom";
+import { createContext as me, useMemo as Z, useState as T, useCallback as ie, useEffect as ee, useContext as le, useRef as Ke } from "react";
+import { useLocation as Ae, Navigate as Te, useNavigate as gt, useSearchParams as mt } from "react-router-dom";
 class ce {
   constructor(e, t = 1e4) {
     this.baseUrl = e.replace(/\/$/, ""), this.timeout = t;
@@ -13,19 +13,19 @@ class ce {
   }
   async executeRequest(e, t, r, i) {
     const o = `${this.baseUrl}${t.startsWith("/") ? t : `/${t}`}`, a = (i == null ? void 0 : i.timeout) || this.timeout;
-    let f = {
+    let h = {
       "Content-Type": "application/json",
       ...i == null ? void 0 : i.headers
     };
     if (!(i != null && i.skipAuth) && this.sessionManager) {
       const c = await this.sessionManager.getValidAccessToken();
-      f = { ...f, Authorization: `Bearer ${c}` };
+      h = { ...h, Authorization: `Bearer ${c}` };
     }
     const g = new AbortController(), w = setTimeout(() => g.abort(), a);
     try {
       const c = await fetch(o, {
         method: e,
-        headers: f,
+        headers: h,
         body: r ? JSON.stringify(r) : void 0,
         signal: g.signal
       });
@@ -109,7 +109,7 @@ class ze {
     })).data;
   }
 }
-const Fe = fe(null);
+const Fe = me(null);
 function yr({ config: n, children: e }) {
   const t = Z(
     () => {
@@ -132,7 +132,7 @@ function yr({ config: n, children: e }) {
     } catch {
       return null;
     }
-  }), [o, a] = T(!r), [f, g] = T(null), w = Z(() => {
+  }), [o, a] = T(!r), [h, g] = T(null), w = Z(() => {
     const p = () => {
       c();
     };
@@ -142,10 +142,10 @@ function yr({ config: n, children: e }) {
       // App info
       appInfo: r,
       isAppLoading: o,
-      appError: f,
+      appError: h,
       retryApp: p
     };
-  }, [n, r, o, f]), c = se(
+  }, [n, r, o, h]), c = ie(
     async (p = !1) => {
       if (!(!p && t.enabled && r))
         try {
@@ -170,7 +170,7 @@ function yr({ config: n, children: e }) {
         }
     },
     [n.baseUrl, n.appId, t, r]
-  ), I = se(async () => {
+  ), I = ie(async () => {
     if (!(!t.enabled || !r))
       try {
         const p = localStorage.getItem(t.storageKey);
@@ -194,7 +194,7 @@ function yr({ config: n, children: e }) {
     r ? I() : c();
   }, []), /* @__PURE__ */ s(Fe.Provider, { value: w, children: e });
 }
-function ve() {
+function ke() {
   const n = le(Fe);
   if (!n)
     throw new Error("useApp must be used within an AppProvider");
@@ -203,8 +203,8 @@ function ve() {
 function Ze() {
   return le(Fe);
 }
-const wr = ve;
-class ie extends Error {
+const wr = ke;
+class se extends Error {
   constructor(e, t) {
     const r = {
       token_expired: "Refresh token has expired",
@@ -228,7 +228,7 @@ class wt extends Error {
 }
 const oe = class oe {
   constructor(e = {}) {
-    this.refreshPromise = null, this.refreshQueue = [], this.proactiveTimerId = null, this.backgroundRetryTimerId = null, this.isDestroyed = !1, e.tenantSlug !== void 0 ? this.storageKey = e.tenantSlug ? `auth_tokens_${e.tenantSlug}` : "auth_tokens" : this.storageKey = e.storageKey || "auth_tokens", this.autoRefresh = e.autoRefresh ?? !0, this.refreshThreshold = e.refreshThreshold || 3e5, this.onRefreshFailed = e.onRefreshFailed, this.onSessionExpired = e.onSessionExpired, this.baseUrl = e.baseUrl || "", this.proactiveRefreshMargin = e.proactiveRefreshMargin ?? 6e4, this.refreshQueueTimeout = e.refreshQueueTimeout ?? 1e4, this.maxRefreshRetries = e.maxRefreshRetries ?? 3, this.retryBackoffBase = e.retryBackoffBase ?? 1e3, this.tokenStorage = e.tokenStorage || this.createTokenStorage(this.storageKey), this.scheduleProactiveRefresh();
+    this.refreshPromise = null, this.refreshQueue = [], this.proactiveTimerId = null, this.backgroundRetryTimerId = null, this.isDestroyed = !1, this.sessionGeneration = 0, e.tenantSlug !== void 0 ? this.storageKey = e.tenantSlug ? `auth_tokens_${e.tenantSlug}` : "auth_tokens" : this.storageKey = e.storageKey || "auth_tokens", this.autoRefresh = e.autoRefresh ?? !0, this.refreshThreshold = e.refreshThreshold || 3e5, this.onRefreshFailed = e.onRefreshFailed, this.onSessionExpired = e.onSessionExpired, this.baseUrl = e.baseUrl || "", this.proactiveRefreshMargin = e.proactiveRefreshMargin ?? 6e4, this.refreshQueueTimeout = e.refreshQueueTimeout ?? 1e4, this.maxRefreshRetries = e.maxRefreshRetries ?? 3, this.retryBackoffBase = e.retryBackoffBase ?? 1e3, this.tokenStorage = e.tokenStorage || this.createTokenStorage(this.storageKey), this.scheduleProactiveRefresh();
   }
   /**
    * Get or create a SessionManager instance for the given config.
@@ -299,8 +299,8 @@ const oe = class oe {
     const t = e.expiresAt || (e.expiresIn ? Date.now() + e.expiresIn * 1e3 : void 0) || oe.extractJwtExpiry(e.accessToken), r = {
       ...e,
       expiresAt: t
-    };
-    this.tokenStorage.set(r), this.scheduleProactiveRefresh();
+    }, i = this.tokenStorage.get() || {};
+    this.tokenStorage.set({ ...i, ...r }), this.scheduleProactiveRefresh();
   }
   getTokens() {
     const { accessToken: e, refreshToken: t, expiresAt: r, expiresIn: i, tokenType: o } = this.tokenStorage.get() || {};
@@ -350,15 +350,29 @@ const oe = class oe {
   backgroundRefresh() {
     if (this.isDestroyed) return;
     const e = this.getTokens();
-    e != null && e.refreshToken && (this.refreshPromise || this.startRefreshAndResolveQueue(e.refreshToken).then(() => {
-    }).catch((t) => {
-      t instanceof ie || (console.warn(
+    if (!(e != null && e.refreshToken) || this.refreshPromise) return;
+    const t = this.sessionGeneration;
+    this.startRefreshAndResolveQueue(e.refreshToken).then(() => {
+    }).catch((r) => {
+      r instanceof se || this.sessionGeneration === t && (console.warn(
         "[SessionManager] Background refresh failed, retrying in 30s:",
-        t.message
+        r.message
       ), this.backgroundRetryTimerId = setTimeout(() => {
         this.backgroundRefresh();
       }, 3e4));
-    }));
+    });
+  }
+  /**
+   * Wait for any in-progress token refresh to settle.
+   * Returns true if refresh succeeded, false if it failed or no refresh was pending.
+   */
+  async waitForPendingRefresh() {
+    if (!this.refreshPromise) return !1;
+    try {
+      return await this.refreshPromise, !0;
+    } catch {
+      return !1;
+    }
   }
   // --- Core: getValidAccessToken with queue + timeout ---
   /**
@@ -372,13 +386,13 @@ const oe = class oe {
   async getValidAccessToken() {
     const e = this.getTokens();
     if (!(e != null && e.accessToken)) {
-      const t = new ie("token_invalid", "No tokens available");
+      const t = new se("token_invalid", "No tokens available");
       throw this.handleSessionExpired(t), t;
     }
     if (!this.shouldRefreshToken(e) && !this.isTokenExpired(e))
       return e.accessToken;
     if (!e.refreshToken) {
-      const t = new ie("token_invalid", "No refresh token available");
+      const t = new se("token_invalid", "No refresh token available");
       throw this.handleSessionExpired(t), t;
     }
     return this.refreshPromise ? this.enqueueForToken() : this.startRefreshAndResolveQueue(e.refreshToken);
@@ -390,7 +404,7 @@ const oe = class oe {
     try {
       return { Authorization: `Bearer ${await this.getValidAccessToken()}` };
     } catch (e) {
-      return e instanceof ie && this.onRefreshFailed && this.onRefreshFailed(), {};
+      return e instanceof se && this.onRefreshFailed && this.onRefreshFailed(), {};
     }
   }
   enqueueForToken() {
@@ -410,7 +424,7 @@ const oe = class oe {
       return this.resolveQueue(r), r;
     } catch (t) {
       const r = t instanceof Error ? t : new Error("Token refresh failed");
-      throw r instanceof ie ? (this.rejectQueue(r), this.handleSessionExpired(r)) : this.rejectQueue(r), r;
+      throw r instanceof se ? (this.rejectQueue(r), this.handleSessionExpired(r)) : this.rejectQueue(r), r;
     } finally {
       this.refreshPromise = null;
     }
@@ -430,19 +444,23 @@ const oe = class oe {
   // --- Refresh with retry + error classification ---
   async executeRefreshWithRetry(e) {
     let t;
-    for (let r = 0; r <= this.maxRefreshRetries; r++)
+    const r = this.sessionGeneration;
+    for (let i = 0; i <= this.maxRefreshRetries; i++) {
+      if (this.sessionGeneration !== r)
+        throw new se("token_invalid", "Session cleared during refresh");
       try {
-        await this.performTokenRefresh(e);
+        await this.performTokenRefresh(e, r);
         return;
-      } catch (i) {
-        const o = i instanceof Error ? i : new Error(String(i));
-        if (o instanceof ie)
-          throw o;
-        if (t = o, r < this.maxRefreshRetries) {
-          const a = this.retryBackoffBase * Math.pow(2, r);
-          await this.sleep(a);
+      } catch (o) {
+        const a = o instanceof Error ? o : new Error(String(o));
+        if (a instanceof se)
+          throw a;
+        if (t = a, i < this.maxRefreshRetries) {
+          const h = this.retryBackoffBase * Math.pow(2, i);
+          await this.sleep(h);
         }
       }
+    }
     throw new wt(this.maxRefreshRetries + 1, t);
   }
   /**
@@ -450,35 +468,37 @@ const oe = class oe {
    * Throws SessionExpiredError for fatal errors (no retry).
    * Throws generic Error for transient errors (will be retried).
    */
-  async performTokenRefresh(e) {
+  async performTokenRefresh(e, t) {
     if (!this.baseUrl)
       throw new Error("Base URL not configured for token refresh");
-    const t = `${this.baseUrl}/auth/refresh`;
-    let r;
+    const r = `${this.baseUrl}/auth/refresh`;
+    let i;
     try {
-      r = await fetch(t, {
+      i = await fetch(r, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ refreshToken: e })
       });
-    } catch (o) {
-      throw o instanceof Error ? o : new Error("Network error during token refresh");
+    } catch (a) {
+      throw a instanceof Error ? a : new Error("Network error during token refresh");
     }
-    if (!r.ok) {
-      let o = "";
+    if (!i.ok) {
+      let a = "";
       try {
-        const a = await r.json();
-        o = (a.message || a.error || "").toLowerCase();
+        const h = await i.json();
+        a = (h.message || h.error || "").toLowerCase();
       } catch {
-        o = r.statusText.toLowerCase();
+        a = i.statusText.toLowerCase();
       }
-      throw r.status === 401 ? o.includes("expired") ? new ie("token_expired") : o.includes("invalid") ? new ie("token_invalid") : new ie("token_invalid", `Unauthorized: ${o}`) : r.status === 400 ? o.includes("inactive") ? new ie("user_inactive") : new Error(`Token refresh failed (400): ${o}`) : new Error(`Token refresh failed: ${r.status} ${o}`);
+      throw i.status === 401 ? a.includes("expired") ? new se("token_expired") : a.includes("invalid") ? new se("token_invalid") : new se("token_invalid", `Unauthorized: ${a}`) : i.status === 400 ? a.includes("inactive") ? new se("user_inactive") : a.includes("expired") || a.includes("invalid") ? new se("token_invalid", a) : new Error(`Token refresh failed (400): ${a}`) : new Error(`Token refresh failed: ${i.status} ${a}`);
     }
-    const i = await r.json();
+    if (this.sessionGeneration !== t)
+      throw new se("token_invalid", "Session cleared during refresh");
+    const o = await i.json();
     this.setTokens({
-      accessToken: i.accessToken,
-      refreshToken: i.refreshToken || e,
-      expiresIn: i.expiresIn
+      accessToken: o.accessToken,
+      refreshToken: o.refreshToken || e,
+      expiresIn: o.expiresIn
     });
   }
   // --- Session expiry handler ---
@@ -500,8 +520,8 @@ const oe = class oe {
   }
   // --- Session lifecycle ---
   clearSession() {
-    this.cancelProactiveTimer(), this.clearTokens(), this.clearUser();
-    const e = new ie("token_invalid", "Session cleared");
+    this.sessionGeneration++, this.cancelProactiveTimer(), this.clearTokens();
+    const e = new se("token_invalid", "Session cleared");
     this.rejectQueue(e);
   }
   /**
@@ -510,7 +530,7 @@ const oe = class oe {
    */
   destroy() {
     this.isDestroyed = !0, oe.instances.delete(this.storageKey), this.cancelProactiveTimer();
-    const e = new ie("token_invalid", "SessionManager destroyed");
+    const e = new se("token_invalid", "SessionManager destroyed");
     this.rejectQueue(e);
   }
   // --- JWT helpers ---
@@ -549,7 +569,7 @@ const oe = class oe {
   }
 };
 oe.instances = /* @__PURE__ */ new Map();
-let we = oe;
+let Se = oe;
 class bt {
   constructor(e) {
     this.httpService = e;
@@ -722,7 +742,7 @@ class St {
     });
   }
 }
-class be {
+class ve {
   constructor(e, t, r) {
     this.httpService = e, this.appId = t, this.sessionManager = r;
   }
@@ -830,7 +850,7 @@ function xt(n, e, t) {
   const r = e.split(".");
   return r.length === 2 ? `${n}.${e}` : r.length >= 3 ? (r[0] = n, r.join(".")) : null;
 }
-const pe = "_auth";
+const ge = "_auth";
 function We(n) {
   const e = JSON.stringify(n);
   return btoa(e).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
@@ -849,7 +869,7 @@ function At(n) {
 function Pt() {
   if (typeof window > "u")
     return console.log("[CrossDomainAuth] SSR environment, skipping URL token extraction"), null;
-  const e = new URLSearchParams(window.location.search).get(pe);
+  const e = new URLSearchParams(window.location.search).get(ge);
   if (console.log("[CrossDomainAuth] extractAuthTokensFromUrl called", {
     hasAuthParam: !!e,
     searchParams: window.location.search,
@@ -866,14 +886,14 @@ function Pt() {
 function Rt() {
   if (typeof window > "u") return;
   const n = new URL(window.location.href);
-  n.searchParams.delete(pe), console.log("[CrossDomainAuth] Clearing auth tokens from URL", {
+  n.searchParams.delete(ge), console.log("[CrossDomainAuth] Clearing auth tokens from URL", {
     oldUrl: window.location.href,
     newUrl: n.toString()
   }), window.history.replaceState({}, "", n.toString());
 }
-const De = fe(null);
+const De = me(null);
 function br({ config: n, children: e }) {
-  const { baseUrl: t, appInfo: r, appId: i } = ve(), o = se(() => typeof window > "u" ? null : kt(
+  const { baseUrl: t, appInfo: r, appId: i } = ke(), o = ie(() => typeof window > "u" ? null : kt(
     {
       tenantMode: n.tenantMode || "selector",
       baseDomain: n.baseDomain,
@@ -885,11 +905,11 @@ function br({ config: n, children: e }) {
       search: window.location.search
     },
     window.localStorage
-  ), [n.tenantMode, n.baseDomain, n.selectorParam, n.fixedTenantSlug]), [a, f] = T(() => o()), g = Z(
+  ), [n.tenantMode, n.baseDomain, n.selectorParam, n.fixedTenantSlug]), [a, h] = T(() => o()), g = Z(
     () => {
-      var h, C, S;
+      var f, C, S;
       return {
-        enabled: ((h = n.cache) == null ? void 0 : h.enabled) ?? !0,
+        enabled: ((f = n.cache) == null ? void 0 : f.enabled) ?? !0,
         ttl: ((C = n.cache) == null ? void 0 : C.ttl) ?? 5 * 60 * 1e3,
         // 5 minutes default
         storageKey: ((S = n.cache) == null ? void 0 : S.storageKey) ?? `tenant_cache_${a || "default"}`
@@ -900,9 +920,9 @@ function br({ config: n, children: e }) {
     if (n.initialTenant) return n.initialTenant;
     if (!g.enabled || !a) return null;
     try {
-      const h = localStorage.getItem(g.storageKey);
-      if (!h) return null;
-      const C = JSON.parse(h);
+      const f = localStorage.getItem(g.storageKey);
+      if (!f) return null;
+      const C = JSON.parse(f);
       return Date.now() - C.timestamp < g.ttl && C.tenantSlug === a ? C.data : (localStorage.removeItem(g.storageKey), null);
     } catch {
       return null;
@@ -910,21 +930,21 @@ function br({ config: n, children: e }) {
   }), [I, p] = T(!w && !n.initialTenant), [x, R] = T(null), [F, E] = T(null), [A, u] = T(!1), [k, m] = T(null);
   ee(() => {
     if (n.tenantMode === "fixed") return;
-    const h = o();
-    f(h);
+    const f = o();
+    h(f);
   }, [o, n.tenantMode]);
-  const M = (r == null ? void 0 : r.settingsSchema) || null, L = se(
-    async (h, C = !1) => {
-      if (!(!C && g.enabled && w && w.domain === h))
+  const M = (r == null ? void 0 : r.settingsSchema) || null, L = ie(
+    async (f, C = !1) => {
+      if (!(!C && g.enabled && w && w.domain === f))
         try {
           p(!0), R(null);
-          const S = new ce(t), y = await new be(S, i).getPublicTenantInfo(h);
+          const S = new ce(t), y = await new ve(S, i).getPublicTenantInfo(f);
           if (c(y), g.enabled)
             try {
               const v = {
                 data: y,
                 timestamp: Date.now(),
-                tenantSlug: h
+                tenantSlug: f
               };
               localStorage.setItem(g.storageKey, JSON.stringify(v));
             } catch (v) {
@@ -938,56 +958,56 @@ function br({ config: n, children: e }) {
         }
     },
     [t, i, g, w]
-  ), D = se(async () => {
+  ), D = ie(async () => {
     if (!(!g.enabled || !w || !a))
       try {
-        const h = localStorage.getItem(g.storageKey);
-        if (!h) return;
-        const C = JSON.parse(h);
+        const f = localStorage.getItem(g.storageKey);
+        if (!f) return;
+        const C = JSON.parse(f);
         if (Date.now() - C.timestamp > g.ttl * 0.5) {
-          const b = new ce(t), v = await new be(b, i).getPublicTenantInfo(a);
+          const b = new ce(t), v = await new ve(b, i).getPublicTenantInfo(a);
           c(v);
-          const j = {
+          const G = {
             data: v,
             timestamp: Date.now(),
             tenantSlug: a
           };
-          localStorage.setItem(g.storageKey, JSON.stringify(j));
+          localStorage.setItem(g.storageKey, JSON.stringify(G));
         }
-      } catch (h) {
-        console.warn("Background tenant refresh failed:", h);
+      } catch (f) {
+        console.warn("Background tenant refresh failed:", f);
       }
-  }, [t, i, g, w, a]), P = se(async () => {
+  }, [t, i, g, w, a]), P = ie(async () => {
     if (w != null && w.id)
       try {
         u(!0), m(null);
-        const h = new ce(t), S = await new be(h, w.appId).getTenantSettings(w.id);
+        const f = new ce(t), S = await new ve(f, w.appId).getTenantSettings(w.id);
         E(S);
-      } catch (h) {
-        const C = h instanceof Error ? h : new Error("Failed to load tenant settings");
+      } catch (f) {
+        const C = f instanceof Error ? f : new Error("Failed to load tenant settings");
         m(C), E(null);
       } finally {
         u(!1);
       }
-  }, [t, w]), U = se(() => {
+  }, [t, w]), U = ie(() => {
     P();
-  }, [P]), l = se(
-    (h) => {
+  }, [P]), l = ie(
+    (f) => {
       if (!M)
         return { isValid: !0, errors: [] };
       const C = [];
       try {
         return M.properties && Object.entries(M.properties).forEach(([S, b]) => {
           var v;
-          const y = h[S];
+          const y = f[S];
           if ((v = M.required) != null && v.includes(S) && y == null) {
             C.push(`Field '${S}' is required`);
             return;
           }
           if (y != null) {
             if (b.type) {
-              const j = b.type, Q = typeof y;
-              j === "string" && Q !== "string" ? C.push(`Field '${S}' must be a string`) : (j === "number" || j === "integer") && Q !== "number" ? C.push(`Field '${S}' must be a number`) : j === "boolean" && Q !== "boolean" ? C.push(`Field '${S}' must be a boolean`) : j === "array" && !Array.isArray(y) && C.push(`Field '${S}' must be an array`);
+              const G = b.type, Q = typeof y;
+              G === "string" && Q !== "string" ? C.push(`Field '${S}' must be a string`) : (G === "number" || G === "integer") && Q !== "number" ? C.push(`Field '${S}' must be a number`) : G === "boolean" && Q !== "boolean" ? C.push(`Field '${S}' must be a boolean`) : G === "array" && !Array.isArray(y) && C.push(`Field '${S}' must be an array`);
             }
             b.minLength !== void 0 && typeof y == "string" && y.length < b.minLength && C.push(
               `Field '${S}' must be at least ${b.minLength} characters long`
@@ -1013,8 +1033,8 @@ function br({ config: n, children: e }) {
   }, [n.initialTenant, a, w, L, D]), ee(() => {
     w != null && w.id ? P() : (E(null), m(null), u(!1));
   }, [w == null ? void 0 : w.id, P]);
-  const N = se(
-    (h, C) => {
+  const N = ie(
+    (f, C) => {
       const { mode: S = "reload", tokens: b, redirectPath: y } = C || {}, v = n.tenantMode || "selector";
       if (v === "fixed") {
         console.warn(
@@ -1023,36 +1043,36 @@ function br({ config: n, children: e }) {
         ), y && (window.location.href = y);
         return;
       }
-      if (localStorage.setItem("tenant", h), v === "subdomain") {
-        const j = window.location.hostname, Q = xt(
-          h,
-          j,
+      if (localStorage.setItem("tenant", f), v === "subdomain") {
+        const G = window.location.hostname, Q = xt(
+          f,
+          G,
           n.baseDomain
         );
         if (!Q) {
           console.warn(
             "[TenantProvider] Cannot switch subdomain, invalid hostname:",
-            j
+            G
           );
           return;
         }
         const O = y || window.location.pathname, q = new URL(`${window.location.protocol}//${Q}${O}`);
         new URLSearchParams(window.location.search).forEach((B, X) => {
-          X !== pe && q.searchParams.set(X, B);
-        }), b && q.searchParams.set(pe, We(b)), window.location.href = q.toString();
+          X !== ge && q.searchParams.set(X, B);
+        }), b && q.searchParams.set(ge, We(b)), window.location.href = q.toString();
       } else if (v === "selector") {
-        const j = y || window.location.pathname, Q = new URLSearchParams(window.location.search);
-        if (Q.set(n.selectorParam || "tenant", h), Q.delete(pe), b && Q.set(pe, We(b)), S === "reload") {
-          const O = `${j}?${Q.toString()}${window.location.hash}`;
+        const G = y || window.location.pathname, Q = new URLSearchParams(window.location.search);
+        if (Q.set(n.selectorParam || "tenant", f), Q.delete(ge), b && Q.set(ge, We(b)), S === "reload") {
+          const O = `${G}?${Q.toString()}${window.location.hash}`;
           window.location.href = O;
         } else {
-          const O = `${j}?${Q.toString()}${window.location.hash}`;
-          window.history.pushState({}, "", O), f(h), L(h);
+          const O = `${G}?${Q.toString()}${window.location.hash}`;
+          window.history.pushState({}, "", O), h(f), L(f);
         }
       }
     },
     [n.tenantMode, n.selectorParam, n.baseDomain, L]
-  ), $ = Z(() => ({
+  ), H = Z(() => ({
     // Tenant info
     tenant: w,
     tenantSlug: a,
@@ -1084,20 +1104,20 @@ function br({ config: n, children: e }) {
     N,
     l
   ]);
-  return /* @__PURE__ */ s(De.Provider, { value: $, children: e });
+  return /* @__PURE__ */ s(De.Provider, { value: H, children: e });
 }
-function ge() {
+function ye() {
   const n = le(De);
   if (!n)
     throw new Error("useTenant must be used within a TenantProvider");
   return n;
 }
-function xe() {
+function Pe() {
   return le(De);
 }
-const Sr = ge;
+const Sr = ye;
 function vr() {
-  const { settings: n, settingsSchema: e, isSettingsLoading: t, settingsError: r, validateSettings: i } = ge();
+  const { settings: n, settingsSchema: e, isSettingsLoading: t, settingsError: r, validateSettings: i } = ye();
   return {
     settings: n,
     settingsSchema: e,
@@ -1106,8 +1126,8 @@ function vr() {
     validateSettings: i
   };
 }
-function me() {
-  const { tenant: n, tenantSlug: e, isTenantLoading: t, tenantError: r, retryTenant: i } = ge();
+function we() {
+  const { tenant: n, tenantSlug: e, isTenantLoading: t, tenantError: r, retryTenant: i } = ye();
   return {
     tenant: n,
     tenantSlug: e,
@@ -1116,12 +1136,12 @@ function me() {
     retry: i
   };
 }
-const Ne = fe(null);
+const Ne = me(null);
 function Tr({ config: n = {}, children: e }) {
-  const { appId: t, baseUrl: r } = ve(), { tenant: i, tenantSlug: o, switchTenant: a } = ge(), [f, g] = T(n.initialRoles || []), [w, c] = T(!n.initialRoles), [I, p] = T(null), [x, R] = T(!1), [F, E] = T(null), [A, u] = T(0), [k, m] = T(() => {
+  const { appId: t, baseUrl: r } = ke(), { tenant: i, tenantSlug: o, switchTenant: a } = ye(), [h, g] = T(n.initialRoles || []), [w, c] = T(!n.initialRoles), [I, p] = T(null), [x, R] = T(!1), [F, E] = T(null), [A, u] = T(0), [k, m] = T(() => {
     try {
-      const G = localStorage.getItem("userTenants");
-      return G ? JSON.parse(G) : [];
+      const V = localStorage.getItem("userTenants");
+      return V ? JSON.parse(V) : [];
     } catch {
       return [];
     }
@@ -1130,10 +1150,10 @@ function Tr({ config: n = {}, children: e }) {
     "[AuthProvider] SYNC: URL tokens found, will block isAuthReady until user loaded"
   ));
   const [P, U] = T(() => {
-    const G = D.current.urlTokens !== null;
-    return console.log("[AuthProvider] SYNC: isLoadingAfterUrlTokens initial:", G), G;
+    const V = D.current.urlTokens !== null;
+    return console.log("[AuthProvider] SYNC: isLoadingAfterUrlTokens initial:", V), V;
   }), l = Z(() => {
-    const G = we.getInstance({
+    const V = Se.getInstance({
       tenantSlug: o,
       baseUrl: r,
       refreshQueueTimeout: n.refreshQueueTimeout,
@@ -1147,29 +1167,33 @@ function Tr({ config: n = {}, children: e }) {
         n.onSessionExpired ? n.onSessionExpired(he) : n.onRefreshFailed && n.onRefreshFailed();
       }
     });
-    return D.current.urlTokens && (console.log("[AuthProvider] SYNC: Saving URL tokens to session manager"), G.setTokens({
+    return D.current.urlTokens && (console.log("[AuthProvider] SYNC: Saving URL tokens to session manager"), V.setTokens({
       accessToken: D.current.urlTokens.accessToken,
       refreshToken: D.current.urlTokens.refreshToken,
       expiresIn: D.current.urlTokens.expiresIn
-    }), console.log("[AuthProvider] SYNC: Session valid:", G.hasValidSession())), G;
-  }, [o, r, n.refreshQueueTimeout, n.proactiveRefreshMargin]), [N, $] = T(() => D.current.urlTokens ? !1 : l.hasValidSession()), h = D.current.done && !P && !N, C = Z(() => {
-    const G = new ce(r);
-    return G.setSessionManager(l), G;
-  }, [r, l]), S = Z(() => new bt(new ce(r)), [r]), b = Z(() => new St(C, l), [C, l]), y = Z(() => new _e(new ce(r)), [r]), v = Z(() => I || l.getUser(), [I, l]), j = Z(() => v != null && v.roleId && f.find((G) => G.id === v.roleId) || null, [v, f]), Q = Z(() => (j == null ? void 0 : j.permissions) || [], [j]), O = Z(() => l.hasValidSession() && I !== null, [l, I]), q = 5 * 60 * 1e3, W = Z(() => {
-    const G = async (H = !1) => {
+    }), console.log("[AuthProvider] SYNC: Session valid:", V.hasValidSession())), V;
+  }, [o, r, n.refreshQueueTimeout, n.proactiveRefreshMargin]), [N, H] = T(() => {
+    if (D.current.urlTokens) return !1;
+    const V = l.getTokens();
+    return V ? l.hasValidSession() || !!V.refreshToken : !1;
+  }), f = D.current.done && !P && !N, C = Z(() => {
+    const V = new ce(r);
+    return V.setSessionManager(l), V;
+  }, [r, l]), S = Z(() => new bt(new ce(r)), [r]), b = Z(() => new St(C, l), [C, l]), y = Z(() => new _e(new ce(r)), [r]), v = Z(() => I || l.getUser(), [I, l]), G = Z(() => v != null && v.roleId && h.find((V) => V.id === v.roleId) || null, [v, h]), Q = Z(() => (G == null ? void 0 : G.permissions) || [], [G]), O = Z(() => l.hasValidSession() && I !== null, [l, I]), q = 5 * 60 * 1e3, W = Z(() => {
+    const V = async ($ = !1) => {
       try {
         if (!l.hasValidSession())
           return;
         const z = Date.now();
-        if (!H && z - A < q && I)
+        if (!$ && z - A < q && I)
           return;
-        const V = l.getUserId();
-        if (!V) {
+        const j = l.getUserId();
+        if (!j) {
           console.warn("[AuthProvider] No userId available in token or storage");
           return;
         }
         R(!0), E(null);
-        const J = await b.getUserById(V);
+        const J = await b.getUserById(j);
         p(J), l.setUser(J), u(Date.now());
       } catch (z) {
         const Y = z instanceof Error ? z : new Error("Failed to load user data");
@@ -1178,19 +1202,19 @@ function Tr({ config: n = {}, children: e }) {
         R(!1);
       }
     }, he = async () => {
-      await G();
-    }, Ae = async (H) => {
+      await V();
+    }, fe = async ($) => {
       var qe;
-      const { username: z, password: Y, tenantSlug: V, redirectPath: J } = H;
+      const { username: z, password: Y, tenantSlug: j, redirectPath: J } = $;
       let te = i == null ? void 0 : i.id, re = o, ne = l;
-      V && (te = (await new be(C, t).getPublicTenantInfo(V)).id, re = V);
+      j && (te = (await new ve(C, t).getPublicTenantInfo(j)).id, re = j);
       const K = await S.login({
         username: z,
         password: Y,
         appId: t,
         tenantId: te
-      }), ye = V && V !== o;
-      if (ye && (ne = new we({
+      }), be = j && j !== o;
+      if (be && (ne = new Se({
         tenantSlug: re,
         baseUrl: r
       })), ne.setTokens({
@@ -1200,9 +1224,9 @@ function Tr({ config: n = {}, children: e }) {
       }), K.user) {
         ne.setUser(K.user), p(K.user);
         try {
-          await G();
-        } catch (Te) {
-          console.warn("Failed to load complete user data after login:", Te);
+          await V();
+        } catch (xe) {
+          console.warn("Failed to load complete user data after login:", xe);
         }
       }
       if (K.tenants && K.tenants.length > 0) {
@@ -1219,83 +1243,83 @@ function Tr({ config: n = {}, children: e }) {
         refreshToken: K.refreshToken,
         expiresIn: K.expiresIn
       };
-      if (ye && re)
+      if (be && re)
         return a(re, { tokens: Ee, redirectPath: J }), K;
       if (J && J !== window.location.pathname)
         return a(re || o || "", { tokens: Ee, redirectPath: J }), K;
       if (!Ie && K.tenants && K.tenants.length > 0) {
-        const Te = H.autoSwitch !== !1 && n.autoSwitchSingleTenant !== !1;
-        if (K.tenants.length === 1 && Te) {
+        const xe = $.autoSwitch !== !1 && n.autoSwitchSingleTenant !== !1;
+        if (K.tenants.length === 1 && xe) {
           const Oe = K.tenants[0];
           return a(Oe.subdomain, { tokens: Ee, redirectPath: J }), K;
         } else K.tenants.length > 1 && n.onTenantSelectionRequired && n.onTenantSelectionRequired(K.tenants);
       }
       return K;
-    }, Pe = async (H) => {
-      const { email: z, phoneNumber: Y, name: V, password: J, lastName: te, tenantId: re } = H;
+    }, pe = async ($) => {
+      const { email: z, phoneNumber: Y, name: j, password: J, lastName: te, tenantId: re } = $;
       if (!z && !Y)
         throw new Error("Either email or phoneNumber is required");
-      if (!V || !J)
+      if (!j || !J)
         throw new Error("Name and password are required");
       const ne = re ?? (i == null ? void 0 : i.id);
       return await S.signup({
         email: z,
         phoneNumber: Y,
-        name: V,
+        name: j,
         password: J,
         tenantId: ne,
         lastName: te,
         appId: t
       });
-    }, rt = async (H) => {
-      const { email: z, phoneNumber: Y, name: V, password: J, tenantName: te, lastName: re } = H;
+    }, rt = async ($) => {
+      const { email: z, phoneNumber: Y, name: j, password: J, tenantName: te, lastName: re } = $;
       if (!z && !Y)
         throw new Error("Either email or phoneNumber is required");
-      if (!V || !J || !te)
+      if (!j || !J || !te)
         throw new Error("Name, password, and tenantName are required");
       return await S.signupTenantAdmin({
         email: z,
         phoneNumber: Y,
-        name: V,
+        name: j,
         password: J,
         tenantName: te,
         appId: t,
         lastName: re
       });
-    }, nt = async (H) => {
-      const { currentPassword: z, newPassword: Y } = H, V = await l.getAuthHeaders();
-      await S.changePassword({ currentPassword: z, newPassword: Y }, V);
-    }, st = async (H) => {
-      const { email: z, tenantId: Y } = H, V = Y ?? (i == null ? void 0 : i.id);
-      if (!V)
+    }, nt = async ($) => {
+      const { currentPassword: z, newPassword: Y } = $, j = await l.getAuthHeaders();
+      await S.changePassword({ currentPassword: z, newPassword: Y }, j);
+    }, st = async ($) => {
+      const { email: z, tenantId: Y } = $, j = Y ?? (i == null ? void 0 : i.id);
+      if (!j)
         throw new Error("tenantId is required for password reset");
-      await S.requestPasswordReset({ email: z, tenantId: V });
-    }, it = async (H) => {
-      const { token: z, newPassword: Y } = H;
+      await S.requestPasswordReset({ email: z, tenantId: j });
+    }, it = async ($) => {
+      const { token: z, newPassword: Y } = $;
       await S.confirmPasswordReset({ token: z, newPassword: Y });
-    }, ot = async (H) => {
-      const { email: z, frontendUrl: Y, name: V, lastName: J, tenantId: te } = H, re = te ?? (i == null ? void 0 : i.id);
+    }, ot = async ($) => {
+      const { email: z, frontendUrl: Y, name: j, lastName: J, tenantId: te } = $, re = te ?? (i == null ? void 0 : i.id);
       if (!re)
         throw new Error("tenantId is required for magic link authentication");
       return await S.sendMagicLink({
         email: z,
         tenantId: re,
         frontendUrl: Y,
-        name: V,
+        name: j,
         lastName: J,
         appId: t
       });
-    }, at = async (H) => {
-      const { token: z, email: Y, tenantSlug: V } = H;
+    }, at = async ($) => {
+      const { token: z, email: Y, tenantSlug: j } = $;
       let J = i == null ? void 0 : i.id, te = o, re = l;
-      V && (J = (await new be(C, t).getPublicTenantInfo(V)).id, te = V);
+      j && (J = (await new ve(C, t).getPublicTenantInfo(j)).id, te = j);
       const ne = await S.verifyMagicLink({
         token: z,
         email: Y,
         appId: t,
         tenantId: J
-      }), K = V && V !== o;
-      if (K && (re = new we({
+      }), K = j && j !== o;
+      if (K && (re = new Se({
         tenantSlug: te,
         baseUrl: r
       })), re.setTokens({
@@ -1305,9 +1329,9 @@ function Tr({ config: n = {}, children: e }) {
       }), ne.user) {
         re.setUser(ne.user), p(ne.user);
         try {
-          await G();
-        } catch (ye) {
-          console.warn("Failed to load complete user data after magic link login:", ye);
+          await V();
+        } catch (be) {
+          console.warn("Failed to load complete user data after magic link login:", be);
         }
       }
       return K && te && te !== o && a(te, {
@@ -1318,15 +1342,15 @@ function Tr({ config: n = {}, children: e }) {
         }
       }), ne;
     }, lt = async () => {
-      const H = l.getTokens();
-      if (!(H != null && H.refreshToken))
+      const $ = l.getTokens();
+      if (!($ != null && $.refreshToken))
         throw new Error("No refresh token available");
       const z = await S.refreshToken({
-        refreshToken: H.refreshToken
+        refreshToken: $.refreshToken
       });
       l.setTokens({
         accessToken: z.accessToken,
-        refreshToken: z.refreshToken || H.refreshToken,
+        refreshToken: z.refreshToken || $.refreshToken,
         expiresIn: z.expiresIn
       });
     }, ct = () => {
@@ -1335,29 +1359,29 @@ function Tr({ config: n = {}, children: e }) {
         localStorage.removeItem("userTenants");
       } catch {
       }
-    }, dt = (H) => {
-      l.setTokens(H);
+    }, dt = ($) => {
+      l.setTokens($);
     }, ut = () => l.hasValidSession(), ht = () => {
       l.clearSession(), p(null), E(null);
-    }, pt = async () => {
+    }, ft = async () => {
       if (t)
         try {
           c(!0);
-          const { roles: H } = await y.getRolesByApp(t);
-          g(H);
-        } catch (H) {
-          console.error("Failed to fetch roles:", H);
+          const { roles: $ } = await y.getRolesByApp(t);
+          g($);
+        } catch ($) {
+          console.error("Failed to fetch roles:", $);
         } finally {
           c(!1);
         }
-    }, ft = async () => {
-      await pt();
-    }, Re = (H) => {
+    }, pt = async () => {
+      await ft();
+    }, Re = ($) => {
       if (!Q || Q.length === 0)
         return !1;
-      if (typeof H == "string")
-        return Q.includes(H);
-      const z = `${H.resource}.${H.action}`;
+      if (typeof $ == "string")
+        return Q.includes($);
+      const z = `${$.resource}.${$.action}`;
       return Q.includes(z);
     };
     return {
@@ -1365,8 +1389,8 @@ function Tr({ config: n = {}, children: e }) {
       isAuthenticated: O,
       sessionManager: l,
       authenticatedHttpService: C,
-      login: Ae,
-      signup: Pe,
+      login: fe,
+      signup: pe,
       signupTenantAdmin: rt,
       sendMagicLink: ot,
       verifyMagicLink: at,
@@ -1381,48 +1405,48 @@ function Tr({ config: n = {}, children: e }) {
       currentUser: I,
       isUserLoading: x,
       userError: F,
-      loadUserData: G,
+      loadUserData: V,
       refreshUser: he,
-      isAuthInitializing: !h,
-      isAuthReady: h,
-      userRole: j,
+      isAuthInitializing: !f,
+      isAuthReady: f,
+      userRole: G,
       userPermissions: Q,
-      availableRoles: f,
+      availableRoles: h,
       rolesLoading: w,
       hasPermission: Re,
-      hasAnyPermission: (H) => H.some((z) => Re(z)),
-      hasAllPermissions: (H) => H.every((z) => Re(z)),
+      hasAnyPermission: ($) => $.some((z) => Re(z)),
+      hasAllPermissions: ($) => $.every((z) => Re(z)),
       getUserPermissionStrings: () => Q || [],
-      refreshRoles: ft,
+      refreshRoles: pt,
       // RFC-004: Multi-tenant user membership
       userTenants: k,
       hasTenantContext: M,
-      switchToTenant: async (H, z) => {
-        const { redirectPath: Y } = z || {}, V = l.getTokens();
-        if (!(V != null && V.refreshToken))
+      switchToTenant: async ($, z) => {
+        const { redirectPath: Y } = z || {}, j = l.getTokens();
+        if (!(j != null && j.refreshToken))
           throw new Error("No refresh token available for tenant switch");
         const J = await S.switchTenant({
-          refreshToken: V.refreshToken,
-          tenantId: H
+          refreshToken: j.refreshToken,
+          tenantId: $
         });
         l.setTokens({
           accessToken: J.accessToken,
-          refreshToken: V.refreshToken,
+          refreshToken: j.refreshToken,
           // Keep the same refresh token
           expiresIn: J.expiresIn
         }), p(J.user), l.setUser(J.user), L(!0);
-        const te = k.find((re) => re.id === H);
+        const te = k.find((re) => re.id === $);
         te && a(te.subdomain, {
           tokens: {
             accessToken: J.accessToken,
-            refreshToken: V.refreshToken,
+            refreshToken: j.refreshToken,
             expiresIn: J.expiresIn
           },
           redirectPath: Y
         });
       },
       refreshUserTenants: async () => {
-        const H = await l.getAuthHeaders(), z = await S.getUserTenants(H);
+        const $ = await l.getAuthHeaders(), z = await S.getUserTenants($);
         m(z);
         try {
           localStorage.setItem("userTenants", JSON.stringify(z));
@@ -1442,14 +1466,14 @@ function Tr({ config: n = {}, children: e }) {
     i,
     o,
     a,
-    f,
+    h,
     I,
     x,
     F,
     k,
     M,
-    h,
-    j,
+    f,
+    G,
     Q,
     A,
     q
@@ -1458,8 +1482,8 @@ function Tr({ config: n = {}, children: e }) {
     !n.initialRoles && t && (async () => {
       try {
         c(!0);
-        const he = new ce(r), Ae = new _e(he), { roles: Pe } = await Ae.getRolesByApp(t);
-        g(Pe);
+        const he = new ce(r), fe = new _e(he), { roles: pe } = await fe.getRolesByApp(t);
+        g(pe);
       } catch (he) {
         console.error("Failed to fetch roles:", he);
       } finally {
@@ -1469,27 +1493,34 @@ function Tr({ config: n = {}, children: e }) {
   }, [t, r, n.initialRoles]);
   const [B, X] = T(!1);
   return ee(() => {
-    B || (X(!0), D.current.urlTokens && (console.log("[AuthProvider] EFFECT: Cleaning up URL after sync token processing"), Rt(), U(!0), console.log("[AuthProvider] EFFECT: Loading user data (blocking isAuthReady)..."), W.loadUserData().catch((G) => {
-      console.error("[AuthProvider] Failed to load user data:", G);
+    B || (X(!0), D.current.urlTokens && (console.log("[AuthProvider] EFFECT: Cleaning up URL after sync token processing"), Rt(), U(!0), console.log("[AuthProvider] EFFECT: Loading user data (blocking isAuthReady)..."), W.loadUserData().catch((V) => {
+      console.error("[AuthProvider] Failed to load user data:", V);
     }).finally(() => {
       console.log("[AuthProvider] EFFECT: User data loaded, releasing isAuthReady"), U(!1);
     })));
   }, [W, B]), ee(() => {
-    const G = l.getUser();
-    G && l.hasValidSession() ? (p(G), $(!1)) : l.hasValidSession() || $(!1);
+    let V = !1;
+    return (async () => {
+      var pe;
+      if (!l.hasValidSession() && ((pe = l.getTokens()) != null && pe.refreshToken) && await l.waitForPendingRefresh(), V) return;
+      const fe = l.getUser();
+      fe && l.hasValidSession() && p(fe), H(!1);
+    })(), () => {
+      V = !0;
+    };
   }, [l]), ee(() => {
     B && (D.current.urlTokens || (!I && !x && l.hasValidSession() ? (console.log("[AuthProvider] Auto-loading user data..."), W.loadUserData().catch(() => {
     }).finally(() => {
-      $(!1);
-    })) : I && $(!1)));
+      H(!1);
+    })) : I && H(!1)));
   }, [I, x, W, l, B]), ee(() => {
     if (!l.hasValidSession() || !I)
       return;
-    const G = setInterval(() => {
+    const V = setInterval(() => {
       W.loadUserData().catch(() => {
       });
     }, q);
-    return () => clearInterval(G);
+    return () => clearInterval(V);
   }, [l, I, W, q]), /* @__PURE__ */ s(Ne.Provider, { value: W, children: e });
 }
 function ue() {
@@ -1581,9 +1612,9 @@ class It {
     })).data;
   }
 }
-const Ue = fe(null);
+const Ue = me(null);
 function kr({ config: n = {}, children: e }) {
-  const t = Ze(), r = xe(), i = (t == null ? void 0 : t.baseUrl) ?? "", o = (t == null ? void 0 : t.appId) ?? "", a = (r == null ? void 0 : r.tenant) ?? null, [f, g] = T([]), [w, c] = T(!1), [I, p] = T(null), [x, R] = T(!1), F = Z(() => {
+  const t = Ze(), r = Pe(), i = (t == null ? void 0 : t.baseUrl) ?? "", o = (t == null ? void 0 : t.appId) ?? "", a = (r == null ? void 0 : r.tenant) ?? null, [h, g] = T([]), [w, c] = T(!1), [I, p] = T(null), [x, R] = T(!1), F = Z(() => {
     const u = new ce(i);
     return new It(u);
   }, [i]), E = async () => {
@@ -1610,16 +1641,16 @@ function kr({ config: n = {}, children: e }) {
   }, [a == null ? void 0 : a.id, i, o, n.refreshInterval]);
   const A = Z(() => {
     const u = (D) => {
-      const P = f.find((U) => U.key === D);
+      const P = h.find((U) => U.key === D);
       return (P == null ? void 0 : P.value) === !0;
-    }, k = (D) => f.find((P) => P.key === D), m = (D) => {
-      const P = f.find((U) => U.key === D);
+    }, k = (D) => h.find((P) => P.key === D), m = (D) => {
+      const P = h.find((U) => U.key === D);
       return P ? P.value ? "enabled" : "disabled" : "not_found";
     }, M = async () => {
       await E();
     }, L = !!(i && o) && (x || !(a != null && a.id));
     return {
-      featureFlags: f,
+      featureFlags: h,
       loading: w,
       error: I,
       isReady: L,
@@ -1628,7 +1659,7 @@ function kr({ config: n = {}, children: e }) {
       getFlagState: m,
       refresh: M
     };
-  }, [f, w, I, i, o, a == null ? void 0 : a.id, x]);
+  }, [h, w, I, i, o, a == null ? void 0 : a.id, x]);
   return /* @__PURE__ */ s(Ue.Provider, { value: A, children: e });
 }
 function Et() {
@@ -1706,20 +1737,20 @@ class Mt {
     )).data;
   }
 }
-const $e = fe(void 0);
+const $e = me(void 0);
 function xr({ config: n = {}, children: e }) {
-  const t = Ze(), r = xe(), i = (t == null ? void 0 : t.baseUrl) ?? "", o = (r == null ? void 0 : r.tenant) ?? null, [a, f] = T(null), [g, w] = T(!1), [c, I] = T(null), [p, x] = T(!1), R = Z(() => {
+  const t = Ze(), r = Pe(), i = (t == null ? void 0 : t.baseUrl) ?? "", o = (r == null ? void 0 : r.tenant) ?? null, [a, h] = T(null), [g, w] = T(!1), [c, I] = T(null), [p, x] = T(!1), R = Z(() => {
     const A = new ce(i);
     return new Mt(A);
   }, [i]), F = async () => {
     if (!(o != null && o.id)) {
-      f(null);
+      h(null);
       return;
     }
     w(!0), I(null);
     try {
       const A = await R.getTenantSubscriptionFeatures(o.id);
-      f(A);
+      h(A);
     } catch (A) {
       const u = A instanceof Error ? A.message : "Failed to fetch subscription";
       I(u), n.onError && n.onError(A instanceof Error ? A : new Error(u));
@@ -1792,7 +1823,7 @@ const He = {
   admin: { tenant: "required", auth: "required", userType: ae.TENANT_ADMIN },
   // Fully open
   open: { tenant: "optional", auth: "optional" }
-}, Be = fe(null);
+}, Be = me(null);
 function Ar({ config: n = {}, children: e }) {
   const t = Z(() => {
     const r = {
@@ -1925,7 +1956,7 @@ function Rr({
   requiredPermissions: r,
   requireAllPermissions: i = !1
 }) {
-  const { hasValidSession: o, sessionManager: a, hasPermission: f, hasAnyPermission: g, hasAllPermissions: w } = ue();
+  const { hasValidSession: o, sessionManager: a, hasPermission: h, hasAnyPermission: g, hasAllPermissions: w } = ue();
   if (!o())
     return /* @__PURE__ */ s(_, { children: e || /* @__PURE__ */ s(Ve, {}) });
   const c = a.getUser();
@@ -1934,7 +1965,7 @@ function Rr({
   if (t && !Dt(c.userType, t))
     return /* @__PURE__ */ s(je, { userType: c.userType, minUserType: t });
   if (r && r.length > 0 && !(i ? w(r) : g(r))) {
-    const p = r.filter((x) => !f(x)).map((x) => typeof x == "string" ? x : x.name);
+    const p = r.filter((x) => !h(x)).map((x) => typeof x == "string" ? x : x.name);
     return /* @__PURE__ */ s(je, { missingPermissions: p });
   }
   return /* @__PURE__ */ s(_, { children: n });
@@ -2035,7 +2066,7 @@ function Ir({
   requireAllPermissions: i = !1,
   fallback: o
 }) {
-  const { hasValidSession: a, sessionManager: f, hasPermission: g, hasAnyPermission: w, hasAllPermissions: c } = ue(), I = ke();
+  const { hasValidSession: a, sessionManager: h, hasPermission: g, hasAnyPermission: w, hasAllPermissions: c } = ue(), I = Ae();
   if (ee(() => {
     process.env.NODE_ENV === "development" && console.warn(
       "[react-identity-access] ProtectedRoute is deprecated. Use AuthenticatedZone or AdminZone from ZoneRoute instead."
@@ -2043,11 +2074,11 @@ function Ir({
   }, []), !a())
     return o ? /* @__PURE__ */ s(_, { children: o }) : /* @__PURE__ */ d(_, { children: [
       /* @__PURE__ */ s(Nt, { redirectPath: e }),
-      /* @__PURE__ */ s(Se, { to: e, state: { from: I.pathname }, replace: !0 })
+      /* @__PURE__ */ s(Te, { to: e, state: { from: I.pathname }, replace: !0 })
     ] });
-  const p = f.getUser();
+  const p = h.getUser();
   if (!p)
-    return /* @__PURE__ */ s(Se, { to: e, state: { from: I.pathname }, replace: !0 });
+    return /* @__PURE__ */ s(Te, { to: e, state: { from: I.pathname }, replace: !0 });
   if (t && !Ct(p.userType, t))
     return /* @__PURE__ */ s(
       Ge,
@@ -2100,14 +2131,14 @@ const Ut = ({ redirectPath: n }) => /* @__PURE__ */ s(
   }
 );
 function Er({ children: n, redirectTo: e = "/", fallback: t }) {
-  const { tenant: r, isLoading: i, error: o } = me(), a = ke();
+  const { tenant: r, isLoading: i, error: o } = we(), a = Ae();
   return ee(() => {
     process.env.NODE_ENV === "development" && console.warn(
       "[react-identity-access] TenantRoute is deprecated. Use TenantZone from ZoneRoute instead."
     );
   }, []), i || o ? null : r ? /* @__PURE__ */ s(_, { children: n }) : t ? /* @__PURE__ */ s(_, { children: t }) : /* @__PURE__ */ d(_, { children: [
     /* @__PURE__ */ s(Ut, { redirectPath: e }),
-    /* @__PURE__ */ s(Se, { to: e, state: { from: a.pathname }, replace: !0 })
+    /* @__PURE__ */ s(Te, { to: e, state: { from: a.pathname }, replace: !0 })
   ] });
 }
 const $t = ({ redirectPath: n }) => /* @__PURE__ */ s(
@@ -2148,14 +2179,14 @@ const $t = ({ redirectPath: n }) => /* @__PURE__ */ s(
   }
 );
 function Mr({ children: n, redirectTo: e = "/dashboard", fallback: t }) {
-  const { tenant: r, isLoading: i, error: o } = me(), a = ke();
+  const { tenant: r, isLoading: i, error: o } = we(), a = Ae();
   return ee(() => {
     process.env.NODE_ENV === "development" && console.warn(
       "[react-identity-access] LandingRoute is deprecated. Use PublicZone from ZoneRoute instead."
     );
   }, []), i || o ? null : r ? t ? /* @__PURE__ */ s(_, { children: t }) : /* @__PURE__ */ d(_, { children: [
     /* @__PURE__ */ s($t, { redirectPath: e }),
-    /* @__PURE__ */ s(Se, { to: e, state: { from: a.pathname }, replace: !0 })
+    /* @__PURE__ */ s(Te, { to: e, state: { from: a.pathname }, replace: !0 })
   ] }) : /* @__PURE__ */ s(_, { children: n });
 }
 function Ht(n, e) {
@@ -2189,13 +2220,13 @@ const de = ({
   userType: i,
   requiredPermissions: o,
   requireAllPermissions: a = !0,
-  returnTo: f,
+  returnTo: h,
   onAccessDenied: g,
   redirectTo: w,
   loadingFallback: c,
   accessDeniedFallback: I
 }) => {
-  const p = ke(), { isAuthenticated: x, isAuthInitializing: R, currentUser: F, userPermissions: E } = ue(), { tenant: A, isTenantLoading: u } = ge(), k = Ft(), m = Z(() => {
+  const p = Ae(), { isAuthenticated: x, isAuthInitializing: R, currentUser: F, userPermissions: E } = ue(), { tenant: A, isTenantLoading: u } = ye(), k = Ft(), m = Z(() => {
     if (e)
       return k.presets[e];
   }, [e, k.presets]), M = Z(
@@ -2242,10 +2273,10 @@ const de = ({
   if (ee(() => {
     U && (g ? g(U) : k.onAccessDenied && k.onAccessDenied(U));
   }, [U, g, k]), ee(() => {
-    U && f && zt(f, p.pathname + p.search, k.returnToStorage);
+    U && h && zt(h, p.pathname + p.search, k.returnToStorage);
   }, [
     U,
-    f,
+    h,
     p.pathname,
     p.search,
     k.returnToStorage
@@ -2257,12 +2288,12 @@ const de = ({
       return /* @__PURE__ */ s(_, { children: l });
     const N = Ot(
       P,
-      f,
+      h,
       p.pathname + p.search,
       k.returnToParam,
       k.returnToStorage
     );
-    return /* @__PURE__ */ s(Se, { to: N, replace: !0 });
+    return /* @__PURE__ */ s(Te, { to: N, replace: !0 });
   }
   return /* @__PURE__ */ s(_, { children: n });
 }, Lr = (n) => /* @__PURE__ */ s(de, { tenant: "required", ...n }), Fr = (n) => /* @__PURE__ */ s(de, { tenant: "forbidden", ...n }), Dr = (n) => /* @__PURE__ */ s(de, { auth: "required", ...n }), Nr = (n) => /* @__PURE__ */ s(de, { auth: "forbidden", ...n }), Cr = (n) => /* @__PURE__ */ s(de, { auth: "required", userType: ae.TENANT_ADMIN, ...n }), Ur = (n) => /* @__PURE__ */ s(de, { auth: "required", userType: ae.USER, ...n }), $r = (n) => /* @__PURE__ */ s(de, { tenant: "optional", auth: "optional", ...n }), Hr = (n) => /* @__PURE__ */ s(de, { tenant: "required", auth: "required", ...n }), Br = (n) => /* @__PURE__ */ s(de, { tenant: "required", auth: "optional", ...n }), qr = (n) => /* @__PURE__ */ s(de, { tenant: "required", auth: "forbidden", ...n }), _t = () => /* @__PURE__ */ d(
@@ -2288,8 +2319,8 @@ function Or({
   allowedPlans: t,
   requiredFeature: r
 }) {
-  const { subscription: i, hasAllowedPlan: o, isFeatureEnabled: a, loading: f } = Lt();
-  return f ? /* @__PURE__ */ s(
+  const { subscription: i, hasAllowedPlan: o, isFeatureEnabled: a, loading: h } = Lt();
+  return h ? /* @__PURE__ */ s(
     "div",
     {
       style: {
@@ -2511,17 +2542,17 @@ function _r({
   onError: i,
   onForgotPassword: o,
   onSignupClick: a,
-  onMagicLinkClick: f,
+  onMagicLinkClick: h,
   showForgotPassword: g = !0,
   showSignupLink: w = !0,
   showMagicLinkOption: c = !0,
   className: I
 }) {
-  const [p, x] = T(""), [R, F] = T(""), [E, A] = T(!1), [u, k] = T(!1), [m, M] = T(""), [L, D] = T({}), { login: P } = ue(), { tenant: U } = me(), l = { ...Qt, ...n }, N = { ...Kt, ...e }, $ = { ...Gt, ...t }, h = () => {
+  const [p, x] = T(""), [R, F] = T(""), [E, A] = T(!1), [u, k] = T(!1), [m, M] = T(""), [L, D] = T({}), { login: P } = ue(), { tenant: U } = we(), l = { ...Qt, ...n }, N = { ...Kt, ...e }, H = { ...Gt, ...t }, f = () => {
     const y = {};
     return p.trim() || (y.username = !0), R.trim() || (y.password = !0), D(y), Object.keys(y).length === 0;
   }, C = async (y) => {
-    if (y.preventDefault(), !!h()) {
+    if (y.preventDefault(), !!f()) {
       if (!(U != null && U.id)) {
         M("Tenant not found");
         return;
@@ -2535,8 +2566,8 @@ function _r({
         });
         r == null || r(v);
       } catch (v) {
-        const j = v.message || l.errorMessage;
-        M(j), i == null || i(j);
+        const G = v.message || l.errorMessage;
+        M(G), i == null || i(G);
       } finally {
         k(!1);
       }
@@ -2600,7 +2631,7 @@ function _r({
               style: N.passwordToggle,
               disabled: u,
               "aria-label": E ? "Hide password" : "Show password",
-              children: E ? $.hidePassword : $.showPassword
+              children: E ? H.hidePassword : H.showPassword
             }
           )
         ] })
@@ -2614,7 +2645,7 @@ function _r({
           l.magicLinkText,
           " "
         ] }),
-        /* @__PURE__ */ s("a", { onClick: f, style: N.link, children: l.magicLinkLink })
+        /* @__PURE__ */ s("a", { onClick: h, style: N.link, children: l.magicLinkLink })
       ] }),
       c && (g || w) && /* @__PURE__ */ s("div", { style: N.divider, children: "•" }),
       g && /* @__PURE__ */ s("a", { onClick: o, style: N.link, children: l.forgotPasswordLink }),
@@ -2762,17 +2793,17 @@ function Wr({
   onError: i,
   onLoginClick: o,
   onMagicLinkClick: a,
-  showLoginLink: f = !0,
+  showLoginLink: h = !0,
   showMagicLinkOption: g = !0,
   className: w
 }) {
-  const [c, I] = T(""), [p, x] = T(""), [R, F] = T(""), [E, A] = T(""), [u, k] = T(""), [m, M] = T(""), [L, D] = T(""), [P, U] = T(!1), [l, N] = T(""), [$, h] = T({}), { signup: C, signupTenantAdmin: S } = ue(), { tenant: b } = me(), y = { ...Zt, ...n }, v = { ...Jt, ...e }, j = () => {
+  const [c, I] = T(""), [p, x] = T(""), [R, F] = T(""), [E, A] = T(""), [u, k] = T(""), [m, M] = T(""), [L, D] = T(""), [P, U] = T(!1), [l, N] = T(""), [H, f] = T({}), { signup: C, signupTenantAdmin: S } = ue(), { tenant: b } = we(), y = { ...Zt, ...n }, v = { ...Jt, ...e }, G = () => {
     const B = {};
-    return c.trim() || (B.name = !0), !R.trim() && !E.trim() && (B.email = !0, B.phoneNumber = !0), u.trim() || (B.password = !0), m.trim() || (B.confirmPassword = !0), t === "tenant" && !L.trim() && (B.tenantName = !0), h(B), Object.keys(B).length === 0;
+    return c.trim() || (B.name = !0), !R.trim() && !E.trim() && (B.email = !0, B.phoneNumber = !0), u.trim() || (B.password = !0), m.trim() || (B.confirmPassword = !0), t === "tenant" && !L.trim() && (B.tenantName = !0), f(B), Object.keys(B).length === 0;
   }, Q = async (B) => {
-    if (B.preventDefault(), !!j()) {
+    if (B.preventDefault(), !!G()) {
       if (u !== m) {
-        N(y.passwordMismatchError), h({ confirmPassword: !0 });
+        N(y.passwordMismatchError), f({ confirmPassword: !0 });
         return;
       }
       if (t === "user" && !(b != null && b.id)) {
@@ -2798,15 +2829,15 @@ function Wr({
           lastName: p || void 0
         }), r == null || r(X);
       } catch (X) {
-        const G = X.message || y.errorMessage;
-        N(G), i == null || i(G);
+        const V = X.message || y.errorMessage;
+        N(V), i == null || i(V);
       } finally {
         U(!1);
       }
     }
   }, O = (B) => ({
     ...v.input,
-    ...$[B] ? v.inputError : {}
+    ...H[B] ? v.inputError : {}
   }), q = () => ({
     ...v.button,
     ...P ? v.buttonLoading : {},
@@ -2825,7 +2856,7 @@ function Wr({
             type: "text",
             value: c,
             onChange: (B) => {
-              I(B.target.value), $.name && h((X) => ({ ...X, name: !1 }));
+              I(B.target.value), H.name && f((X) => ({ ...X, name: !1 }));
             },
             placeholder: y.namePlaceholder,
             style: O("name"),
@@ -2859,7 +2890,7 @@ function Wr({
             type: "email",
             value: R,
             onChange: (B) => {
-              F(B.target.value), $.email && h((X) => ({ ...X, email: !1, phoneNumber: !1 }));
+              F(B.target.value), H.email && f((X) => ({ ...X, email: !1, phoneNumber: !1 }));
             },
             placeholder: y.emailPlaceholder,
             style: O("email"),
@@ -2877,7 +2908,7 @@ function Wr({
             type: "tel",
             value: E,
             onChange: (B) => {
-              A(B.target.value), $.phoneNumber && h((X) => ({ ...X, email: !1, phoneNumber: !1 }));
+              A(B.target.value), H.phoneNumber && f((X) => ({ ...X, email: !1, phoneNumber: !1 }));
             },
             placeholder: y.phoneNumberPlaceholder,
             style: O("phoneNumber"),
@@ -2907,7 +2938,7 @@ function Wr({
             type: "password",
             value: u,
             onChange: (B) => {
-              k(B.target.value), $.password && h((X) => ({ ...X, password: !1 }));
+              k(B.target.value), H.password && f((X) => ({ ...X, password: !1 }));
             },
             placeholder: y.passwordPlaceholder,
             style: O("password"),
@@ -2925,7 +2956,7 @@ function Wr({
             type: "password",
             value: m,
             onChange: (B) => {
-              M(B.target.value), $.confirmPassword && h((X) => ({ ...X, confirmPassword: !1 })), l === y.passwordMismatchError && N("");
+              M(B.target.value), H.confirmPassword && f((X) => ({ ...X, confirmPassword: !1 })), l === y.passwordMismatchError && N("");
             },
             placeholder: y.confirmPasswordPlaceholder,
             style: O("confirmPassword"),
@@ -2943,7 +2974,7 @@ function Wr({
             type: "text",
             value: L,
             onChange: (B) => {
-              D(B.target.value), $.tenantName && h((X) => ({ ...X, tenantName: !1 }));
+              D(B.target.value), H.tenantName && f((X) => ({ ...X, tenantName: !1 }));
             },
             placeholder: y.tenantNamePlaceholder,
             style: O("tenantName"),
@@ -2954,7 +2985,7 @@ function Wr({
       /* @__PURE__ */ s("button", { type: "submit", disabled: !W || P, style: q(), children: P ? y.loadingText : y.submitButton }),
       l && /* @__PURE__ */ s("div", { style: v.errorText, children: l })
     ] }),
-    (f || g) && /* @__PURE__ */ d("div", { style: v.linkContainer, children: [
+    (h || g) && /* @__PURE__ */ d("div", { style: v.linkContainer, children: [
       g && /* @__PURE__ */ d("div", { children: [
         /* @__PURE__ */ d("span", { style: v.divider, children: [
           y.magicLinkText,
@@ -2962,8 +2993,8 @@ function Wr({
         ] }),
         /* @__PURE__ */ s("a", { onClick: a, style: v.link, children: y.magicLinkLink })
       ] }),
-      g && f && /* @__PURE__ */ s("div", { style: v.divider, children: "•" }),
-      f && /* @__PURE__ */ d("div", { children: [
+      g && h && /* @__PURE__ */ s("div", { style: v.divider, children: "•" }),
+      h && /* @__PURE__ */ d("div", { children: [
         /* @__PURE__ */ d("span", { style: v.divider, children: [
           y.loginText,
           " "
@@ -3102,11 +3133,11 @@ function Vr({
   onLoginClick: i,
   onSignupClick: o,
   showTraditionalLinks: a = !0,
-  className: f,
+  className: h,
   verifyToken: g,
   frontendUrl: w
 }) {
-  const [c, I] = T(""), [p, x] = T(""), [R, F] = T(""), [E, A] = T(!1), [u, k] = T(!1), [m, M] = T(""), [L, D] = T(""), [P, U] = T({}), [l, N] = T(!1), { sendMagicLink: $, verifyMagicLink: h } = ue(), { tenant: C } = me(), S = { ...Yt, ...n }, b = { ...Xt, ...e };
+  const [c, I] = T(""), [p, x] = T(""), [R, F] = T(""), [E, A] = T(!1), [u, k] = T(!1), [m, M] = T(""), [L, D] = T(""), [P, U] = T({}), [l, N] = T(!1), { sendMagicLink: H, verifyMagicLink: f } = ue(), { tenant: C } = we(), S = { ...Yt, ...n }, b = { ...Xt, ...e };
   ee(() => {
     g && y(g);
   }, [g]);
@@ -3117,7 +3148,7 @@ function Vr({
     }
     k(!0), M("");
     try {
-      const W = await h({
+      const W = await f({
         token: q,
         email: c
         // tenantId inferred from context automatically
@@ -3132,7 +3163,7 @@ function Vr({
   }, v = () => {
     const q = {};
     return c.trim() || (q.email = !0), l && !p.trim() && (q.name = !0), U(q), Object.keys(q).length === 0;
-  }, j = async (q) => {
+  }, G = async (q) => {
     if (q.preventDefault(), !!v()) {
       if (!(C != null && C.id)) {
         M("Tenant not found");
@@ -3140,7 +3171,7 @@ function Vr({
       }
       A(!0), M(""), D("");
       try {
-        const W = w || (typeof window < "u" ? window.location.origin : ""), B = await $({
+        const W = w || (typeof window < "u" ? window.location.origin : ""), B = await H({
           email: c,
           tenantId: C.id,
           frontendUrl: W,
@@ -3163,13 +3194,13 @@ function Vr({
     ...E || u ? b.buttonLoading : {},
     ...!c || E || u ? b.buttonDisabled : {}
   });
-  return u ? /* @__PURE__ */ d("div", { className: f, style: b.container, children: [
+  return u ? /* @__PURE__ */ d("div", { className: h, style: b.container, children: [
     /* @__PURE__ */ s("h2", { style: b.title, children: S.verifyingText }),
     /* @__PURE__ */ s("div", { style: { textAlign: "center", padding: "2rem" }, children: /* @__PURE__ */ s("div", { style: { fontSize: "1rem", color: "#6b7280" }, children: "Please wait while we verify your magic link..." }) })
-  ] }) : /* @__PURE__ */ d("div", { className: f, style: b.container, children: [
+  ] }) : /* @__PURE__ */ d("div", { className: h, style: b.container, children: [
     /* @__PURE__ */ s("h2", { style: b.title, children: S.title }),
     /* @__PURE__ */ s("p", { style: b.description, children: S.description }),
-    /* @__PURE__ */ d("form", { onSubmit: j, style: b.form, children: [
+    /* @__PURE__ */ d("form", { onSubmit: G, style: b.form, children: [
       /* @__PURE__ */ d("div", { style: b.fieldGroup, children: [
         /* @__PURE__ */ s("label", { style: b.label, children: S.emailLabel }),
         /* @__PURE__ */ s(
@@ -3424,7 +3455,7 @@ function jr({
   onError: i,
   onRetry: o,
   onBackToLogin: a,
-  className: f,
+  className: h,
   token: g,
   email: w,
   appId: c,
@@ -3522,7 +3553,7 @@ function jr({
         return null;
     }
   };
-  return /* @__PURE__ */ d("div", { style: k.container, className: f, children: [
+  return /* @__PURE__ */ d("div", { style: k.container, className: h, children: [
     /* @__PURE__ */ s("style", { children: `
           @keyframes spin {
             0% { transform: rotate(0deg); }
@@ -3655,10 +3686,10 @@ function Gr({
   onSuccess: i,
   onError: o,
   onBackToLogin: a,
-  onModeChange: f,
+  onModeChange: h,
   className: g
 }) {
-  const [w, c] = T(""), [I, p] = T(r), [x, R] = T(""), [F, E] = T(""), [A, u] = T(!1), [k, m] = T(""), [M, L] = T(""), [D, P] = T({}), { requestPasswordReset: U, confirmPasswordReset: l } = ue(), { tenant: N } = me(), $ = { ...ir, ...n }, h = { ...or, ...e }, C = () => {
+  const [w, c] = T(""), [I, p] = T(r), [x, R] = T(""), [F, E] = T(""), [A, u] = T(!1), [k, m] = T(""), [M, L] = T(""), [D, P] = T({}), { requestPasswordReset: U, confirmPasswordReset: l } = ue(), { tenant: N } = we(), H = { ...ir, ...n }, f = { ...or, ...e }, C = () => {
     const O = {};
     return w.trim() || (O.email = !0), P(O), Object.keys(O).length === 0;
   }, S = () => {
@@ -3672,9 +3703,9 @@ function Gr({
       }
       u(!0), m(""), L("");
       try {
-        await U({ email: w, tenantId: N.id }), L($.successMessage), i == null || i();
+        await U({ email: w, tenantId: N.id }), L(H.successMessage), i == null || i();
       } catch (q) {
-        const W = q.message || $.errorMessage;
+        const W = q.message || H.errorMessage;
         m(W), o == null || o(W);
       } finally {
         u(!1);
@@ -3683,34 +3714,34 @@ function Gr({
   }, y = async (O) => {
     if (O.preventDefault(), !!S()) {
       if (x !== F) {
-        m($.passwordMismatchError), P({ confirmPassword: !0 });
+        m(H.passwordMismatchError), P({ confirmPassword: !0 });
         return;
       }
       u(!0), m(""), L("");
       try {
-        await l({ token: I, newPassword: x }), L($.resetSuccessMessage), i == null || i();
+        await l({ token: I, newPassword: x }), L(H.resetSuccessMessage), i == null || i();
       } catch (q) {
-        const W = q.message || $.errorMessage;
+        const W = q.message || H.errorMessage;
         m(W), o == null || o(W);
       } finally {
         u(!1);
       }
     }
   }, v = (O) => ({
-    ...h.input,
-    ...D[O] ? h.inputError : {}
-  }), j = () => ({
-    ...h.button,
-    ...A ? h.buttonLoading : {}
+    ...f.input,
+    ...D[O] ? f.inputError : {}
+  }), G = () => ({
+    ...f.button,
+    ...A ? f.buttonLoading : {}
   });
   if (t === "reset") {
     const O = I && x && F;
-    return /* @__PURE__ */ d("div", { className: g, style: h.container, children: [
-      /* @__PURE__ */ s("h2", { style: h.title, children: $.resetTitle }),
-      /* @__PURE__ */ s("p", { style: h.subtitle, children: $.resetSubtitle }),
-      /* @__PURE__ */ d("form", { onSubmit: y, style: h.form, children: [
-        /* @__PURE__ */ d("div", { style: h.fieldGroup, children: [
-          /* @__PURE__ */ s("label", { style: h.label, children: $.tokenLabel }),
+    return /* @__PURE__ */ d("div", { className: g, style: f.container, children: [
+      /* @__PURE__ */ s("h2", { style: f.title, children: H.resetTitle }),
+      /* @__PURE__ */ s("p", { style: f.subtitle, children: H.resetSubtitle }),
+      /* @__PURE__ */ d("form", { onSubmit: y, style: f.form, children: [
+        /* @__PURE__ */ d("div", { style: f.fieldGroup, children: [
+          /* @__PURE__ */ s("label", { style: f.label, children: H.tokenLabel }),
           /* @__PURE__ */ s(
             "input",
             {
@@ -3719,14 +3750,14 @@ function Gr({
               onChange: (q) => {
                 p(q.target.value), D.token && P((W) => ({ ...W, token: !1 }));
               },
-              placeholder: $.tokenPlaceholder,
+              placeholder: H.tokenPlaceholder,
               style: v("token"),
               disabled: A
             }
           )
         ] }),
-        /* @__PURE__ */ d("div", { style: h.fieldGroup, children: [
-          /* @__PURE__ */ s("label", { style: h.label, children: $.newPasswordLabel }),
+        /* @__PURE__ */ d("div", { style: f.fieldGroup, children: [
+          /* @__PURE__ */ s("label", { style: f.label, children: H.newPasswordLabel }),
           /* @__PURE__ */ s(
             "input",
             {
@@ -3735,23 +3766,23 @@ function Gr({
               onChange: (q) => {
                 R(q.target.value), D.newPassword && P((W) => ({ ...W, newPassword: !1 }));
               },
-              placeholder: $.newPasswordPlaceholder,
+              placeholder: H.newPasswordPlaceholder,
               style: v("newPassword"),
               disabled: A
             }
           )
         ] }),
-        /* @__PURE__ */ d("div", { style: h.fieldGroup, children: [
-          /* @__PURE__ */ s("label", { style: h.label, children: $.confirmPasswordLabel }),
+        /* @__PURE__ */ d("div", { style: f.fieldGroup, children: [
+          /* @__PURE__ */ s("label", { style: f.label, children: H.confirmPasswordLabel }),
           /* @__PURE__ */ s(
             "input",
             {
               type: "password",
               value: F,
               onChange: (q) => {
-                E(q.target.value), D.confirmPassword && P((W) => ({ ...W, confirmPassword: !1 })), k === $.passwordMismatchError && m("");
+                E(q.target.value), D.confirmPassword && P((W) => ({ ...W, confirmPassword: !1 })), k === H.passwordMismatchError && m("");
               },
-              placeholder: $.confirmPasswordPlaceholder,
+              placeholder: H.confirmPasswordPlaceholder,
               style: v("confirmPassword"),
               disabled: A
             }
@@ -3763,31 +3794,31 @@ function Gr({
             type: "submit",
             disabled: !O || A,
             style: {
-              ...j(),
-              ...!O || A ? h.buttonDisabled : {}
+              ...G(),
+              ...!O || A ? f.buttonDisabled : {}
             },
-            children: A ? $.resetLoadingText : $.resetSubmitButton
+            children: A ? H.resetLoadingText : H.resetSubmitButton
           }
         ),
-        k && /* @__PURE__ */ s("div", { style: h.errorText, children: k }),
-        M && /* @__PURE__ */ s("div", { style: h.successText, children: M })
+        k && /* @__PURE__ */ s("div", { style: f.errorText, children: k }),
+        M && /* @__PURE__ */ s("div", { style: f.successText, children: M })
       ] }),
-      /* @__PURE__ */ d("div", { style: h.linkContainer, children: [
-        /* @__PURE__ */ s("a", { onClick: a, style: h.link, children: $.backToLoginLink }),
-        f && /* @__PURE__ */ d(_, { children: [
+      /* @__PURE__ */ d("div", { style: f.linkContainer, children: [
+        /* @__PURE__ */ s("a", { onClick: a, style: f.link, children: H.backToLoginLink }),
+        h && /* @__PURE__ */ d(_, { children: [
           /* @__PURE__ */ s("span", { style: { margin: "0 0.5rem", color: "#6b7280" }, children: "•" }),
-          /* @__PURE__ */ s("a", { onClick: () => f("request"), style: h.link, children: "Request New Link" })
+          /* @__PURE__ */ s("a", { onClick: () => h("request"), style: f.link, children: "Request New Link" })
         ] })
       ] })
     ] });
   }
   const Q = w;
-  return /* @__PURE__ */ d("div", { className: g, style: h.container, children: [
-    /* @__PURE__ */ s("h2", { style: h.title, children: $.title }),
-    /* @__PURE__ */ s("p", { style: h.subtitle, children: $.subtitle }),
-    /* @__PURE__ */ d("form", { onSubmit: b, style: h.form, children: [
-      /* @__PURE__ */ d("div", { style: h.fieldGroup, children: [
-        /* @__PURE__ */ s("label", { style: h.label, children: $.emailLabel }),
+  return /* @__PURE__ */ d("div", { className: g, style: f.container, children: [
+    /* @__PURE__ */ s("h2", { style: f.title, children: H.title }),
+    /* @__PURE__ */ s("p", { style: f.subtitle, children: H.subtitle }),
+    /* @__PURE__ */ d("form", { onSubmit: b, style: f.form, children: [
+      /* @__PURE__ */ d("div", { style: f.fieldGroup, children: [
+        /* @__PURE__ */ s("label", { style: f.label, children: H.emailLabel }),
         /* @__PURE__ */ s(
           "input",
           {
@@ -3796,7 +3827,7 @@ function Gr({
             onChange: (O) => {
               c(O.target.value), D.email && P((q) => ({ ...q, email: !1 }));
             },
-            placeholder: $.emailPlaceholder,
+            placeholder: H.emailPlaceholder,
             style: v("email"),
             disabled: A
           }
@@ -3808,20 +3839,20 @@ function Gr({
           type: "submit",
           disabled: !Q || A,
           style: {
-            ...j(),
-            ...!Q || A ? h.buttonDisabled : {}
+            ...G(),
+            ...!Q || A ? f.buttonDisabled : {}
           },
-          children: A ? $.loadingText : $.submitButton
+          children: A ? H.loadingText : H.submitButton
         }
       ),
-      k && /* @__PURE__ */ s("div", { style: h.errorText, children: k }),
-      M && /* @__PURE__ */ s("div", { style: h.successText, children: M })
+      k && /* @__PURE__ */ s("div", { style: f.errorText, children: k }),
+      M && /* @__PURE__ */ s("div", { style: f.successText, children: M })
     ] }),
-    /* @__PURE__ */ d("div", { style: h.linkContainer, children: [
-      /* @__PURE__ */ s("a", { onClick: a, style: h.link, children: $.backToLoginLink }),
-      f && /* @__PURE__ */ d(_, { children: [
+    /* @__PURE__ */ d("div", { style: f.linkContainer, children: [
+      /* @__PURE__ */ s("a", { onClick: a, style: f.link, children: H.backToLoginLink }),
+      h && /* @__PURE__ */ d(_, { children: [
         /* @__PURE__ */ s("span", { style: { margin: "0 0.5rem", color: "#6b7280" }, children: "•" }),
-        /* @__PURE__ */ s("a", { onClick: () => f("reset"), style: h.link, children: "I have a token" })
+        /* @__PURE__ */ s("a", { onClick: () => h("reset"), style: f.link, children: "I have a token" })
       ] })
     ] })
   ] });
@@ -3878,9 +3909,9 @@ function Qr({
   errorFallback: t,
   requireTenant: r = !0
 }) {
-  const { isAppLoading: i, appError: o, retryApp: a } = ve(), f = xe(), g = Ce(), w = Je(), c = Ye(), I = (f == null ? void 0 : f.isTenantLoading) ?? !1, p = (f == null ? void 0 : f.tenantError) ?? null, x = (f == null ? void 0 : f.tenantSlug) ?? null, R = (f == null ? void 0 : f.retryTenant) ?? (() => {
-  }), F = (g == null ? void 0 : g.isAuthReady) ?? !0, E = (w == null ? void 0 : w.isReady) ?? !0, A = (c == null ? void 0 : c.isReady) ?? !0, u = r && f && x, L = i || u && I || g && !F || w && !E || c && !A, D = o || (u ? p : null), P = () => {
-    o && a(), p && f && R();
+  const { isAppLoading: i, appError: o, retryApp: a } = ke(), h = Pe(), g = Ce(), w = Je(), c = Ye(), I = (h == null ? void 0 : h.isTenantLoading) ?? !1, p = (h == null ? void 0 : h.tenantError) ?? null, x = (h == null ? void 0 : h.tenantSlug) ?? null, R = (h == null ? void 0 : h.retryTenant) ?? (() => {
+  }), F = (g == null ? void 0 : g.isAuthReady) ?? !0, E = (w == null ? void 0 : w.isReady) ?? !0, A = (c == null ? void 0 : c.isReady) ?? !0, u = r && h && x, L = i || u && I || g && !F || w && !E || c && !A, D = o || (u ? p : null), P = () => {
+    o && a(), p && h && R();
   };
   if (L)
     return /* @__PURE__ */ s(_, { children: e || /* @__PURE__ */ s(ar, {}) });
@@ -3891,8 +3922,8 @@ function Qr({
   return /* @__PURE__ */ s(_, { children: n });
 }
 function Kr(n = !0) {
-  const { isAppLoading: e, appError: t, retryApp: r, appInfo: i } = ve(), o = xe(), a = Ce(), f = Je(), g = Ye(), w = (o == null ? void 0 : o.isTenantLoading) ?? !1, c = (o == null ? void 0 : o.tenantError) ?? null, I = (o == null ? void 0 : o.tenant) ?? null, p = (o == null ? void 0 : o.tenantSlug) ?? null, x = (o == null ? void 0 : o.retryTenant) ?? (() => {
-  }), R = (a == null ? void 0 : a.isAuthReady) ?? !0, F = (f == null ? void 0 : f.isReady) ?? !0, E = (g == null ? void 0 : g.isReady) ?? !0, A = n && o && p, M = e || A && w || a && !R || f && !F || g && !E, L = t || (A ? c : null);
+  const { isAppLoading: e, appError: t, retryApp: r, appInfo: i } = ke(), o = Pe(), a = Ce(), h = Je(), g = Ye(), w = (o == null ? void 0 : o.isTenantLoading) ?? !1, c = (o == null ? void 0 : o.tenantError) ?? null, I = (o == null ? void 0 : o.tenant) ?? null, p = (o == null ? void 0 : o.tenantSlug) ?? null, x = (o == null ? void 0 : o.retryTenant) ?? (() => {
+  }), R = (a == null ? void 0 : a.isAuthReady) ?? !0, F = (h == null ? void 0 : h.isReady) ?? !0, E = (g == null ? void 0 : g.isReady) ?? !0, A = n && o && p, M = e || A && w || a && !R || h && !F || g && !E, L = t || (A ? c : null);
   return {
     isLoading: M,
     error: L,
@@ -3904,7 +3935,7 @@ function Kr(n = !0) {
     app: { isLoading: e, error: t, data: i },
     tenant: o ? { isLoading: w, error: c, data: I } : null,
     auth: a ? { isReady: R } : null,
-    featureFlags: f ? { isReady: F } : null,
+    featureFlags: h ? { isReady: F } : null,
     subscription: g ? { isReady: E } : null
   };
 }
@@ -3916,7 +3947,7 @@ function Zr({
   dropdownClassName: i = "",
   itemClassName: o = "",
   renderItem: a,
-  placeholder: f = "Select tenant",
+  placeholder: h = "Select tenant",
   disabled: g = !1,
   showCurrentTenant: w = !0
 }) {
@@ -3955,7 +3986,7 @@ function Zr({
           opacity: g ? 0.6 : 1
         },
         children: [
-          A ? A.name : f,
+          A ? A.name : h,
           /* @__PURE__ */ s("span", { style: { marginLeft: 8 }, children: I ? "▲" : "▼" })
         ]
       }
@@ -4260,7 +4291,7 @@ function tn(n = {}) {
     zoneRoots: e = {},
     returnToParam: t = tt,
     returnToStorage: r = "url"
-  } = n, i = gt(), [o, a] = mt(), { isAuthenticated: f, currentUser: g } = ue(), { tenant: w } = ge(), c = Z(() => ({ ...He, ...e }), [e]), I = !!w, p = g == null ? void 0 : g.userType, x = Z(() => {
+  } = n, i = gt(), [o, a] = mt(), { isAuthenticated: h, currentUser: g } = ue(), { tenant: w } = ye(), c = Z(() => ({ ...He, ...e }), [e]), I = !!w, p = g == null ? void 0 : g.userType, x = Z(() => {
     switch (r) {
       case "url":
         return o.get(t);
@@ -4271,7 +4302,7 @@ function tn(n = {}) {
       default:
         return null;
     }
-  }, [r, o, t]), R = se(() => {
+  }, [r, o, t]), R = ie(() => {
     switch (r) {
       case "url": {
         const u = new URLSearchParams(o);
@@ -4285,7 +4316,7 @@ function tn(n = {}) {
         localStorage.removeItem(Le);
         break;
     }
-  }, [r, o, t, a]), F = se(
+  }, [r, o, t, a]), F = ie(
     (u) => {
       switch (r) {
         case "url": {
@@ -4302,13 +4333,13 @@ function tn(n = {}) {
       }
     },
     [r, o, t, a]
-  ), E = se(
+  ), E = ie(
     (u) => {
       const k = c[u] || c.default;
       i(k);
     },
     [i, c]
-  ), A = se(() => I ? f ? p === ae.TENANT_ADMIN ? c.tenantAdmin : c.tenantUser : c.tenantGuest : f ? p === ae.TENANT_ADMIN ? c.publicAdmin : c.publicUser : c.publicGuest, [I, f, p, c]);
+  ), A = ie(() => I ? h ? p === ae.TENANT_ADMIN ? c.tenantAdmin : c.tenantUser : c.tenantGuest : h ? p === ae.TENANT_ADMIN ? c.publicAdmin : c.publicUser : c.publicGuest, [I, h, p, c]);
   return {
     returnToUrl: x,
     clearReturnTo: R,
@@ -4352,14 +4383,14 @@ export {
   Fr as PublicZone,
   _e as RoleApiService,
   Ar as RoutingProvider,
-  ie as SessionExpiredError,
-  we as SessionManager,
+  se as SessionExpiredError,
+  Se as SessionManager,
   Wr as SignupForm,
   Mt as SubscriptionApiService,
   Or as SubscriptionGuard,
   Yr as SubscriptionPlanApiService,
   xr as SubscriptionProvider,
-  be as TenantApiService,
+  ve as TenantApiService,
   Hr as TenantAuthenticatedZone,
   qr as TenantGuestZone,
   Br as TenantOpenZone,
@@ -4375,7 +4406,7 @@ export {
   de as ZoneRoute,
   rn as buildRedirectUrl,
   wr as useApi,
-  ve as useApp,
+  ke as useApp,
   Kr as useAppLoaderState,
   ue as useAuth,
   Et as useFeatureFlags,
@@ -4383,9 +4414,9 @@ export {
   Ft as useRoutingOptional,
   vr as useSettings,
   Lt as useSubscription,
-  ge as useTenant,
-  me as useTenantInfo,
-  xe as useTenantOptional,
+  ye as useTenant,
+  we as useTenantInfo,
+  Pe as useTenantOptional,
   Sr as useTenantSettings,
   tn as useZoneNavigation
 };