@skylabs-digital/react-identity-access 2.27.0 → 2.28.0

package/dist/index.es.js

@@ -1,5 +1,5 @@
 import { jsx as s, Fragment as _, jsxs as u } from "react/jsx-runtime";
-import { createContext as ye, useMemo as Z, useState as x, useCallback as ie, useEffect as ne, useContext as le, useRef as Ne } from "react";
+import { createContext as ye, useMemo as Z, useState as x, useCallback as oe, useEffect as ne, useContext as le, useRef as Ne } from "react";
 import { useLocation as xe, Navigate as Se, useNavigate as mt, useSearchParams as yt } from "react-router-dom";
 class de {
   constructor(e, t = 1e4) {
@@ -31,8 +31,8 @@ class de {
       });
       if (clearTimeout(y), !f.ok)
         throw new Error(`HTTP ${f.status}: ${f.statusText}`);
-      const D = f.headers.get("content-type");
-      return !D || !D.includes("application/json") ? {} : await f.json();
+      const F = f.headers.get("content-type");
+      return !F || !F.includes("application/json") ? {} : await f.json();
     } catch (f) {
       throw clearTimeout(y), f instanceof Error && f.name === "AbortError" ? new Error(`Request timeout after ${a}ms`) : f;
     }
@@ -109,7 +109,7 @@ class Ve {
     })).data;
   }
 }
-const De = ye(null);
+const Fe = ye(null);
 function br({ config: n, children: e }) {
   const t = Z(
     () => {
@@ -145,7 +145,7 @@ function br({ config: n, children: e }) {
       appError: c,
       retryApp: g
     };
-  }, [n, r, o, c]), f = ie(
+  }, [n, r, o, c]), f = oe(
     async (g = !1) => {
       if (!(!g && t.enabled && r))
         try {
@@ -170,7 +170,7 @@ function br({ config: n, children: e }) {
         }
     },
     [n.baseUrl, n.appId, t, r]
-  ), D = ie(async () => {
+  ), F = oe(async () => {
     if (!(!t.enabled || !r))
       try {
         const g = localStorage.getItem(t.storageKey);
@@ -191,17 +191,17 @@ function br({ config: n, children: e }) {
       }
   }, [n, t, r]);
   return ne(() => {
-    r ? D() : f();
-  }, []), /* @__PURE__ */ s(De.Provider, { value: y, children: e });
+    r ? F() : f();
+  }, []), /* @__PURE__ */ s(Fe.Provider, { value: y, children: e });
 }
 function Ae() {
-  const n = le(De);
+  const n = le(Fe);
   if (!n)
     throw new Error("useApp must be used within an AppProvider");
   return n;
 }
-function Fe() {
-  return le(De);
+function De() {
+  return le(Fe);
 }
 const vr = Ae;
 class se extends Error {
@@ -226,9 +226,9 @@ class bt extends Error {
     ), this.name = "TokenRefreshError", this.attempts = e, this.lastError = t;
   }
 }
-const oe = class oe {
+const ie = class ie {
   constructor(e = {}) {
-    this.refreshPromise = null, this.refreshQueue = [], this.proactiveTimerId = null, this.backgroundRetryTimerId = null, this.isDestroyed = !1, this.sessionGeneration = 0, e.tenantSlug !== void 0 ? this.storageKey = e.tenantSlug ? `auth_tokens_${e.tenantSlug}` : "auth_tokens" : this.storageKey = e.storageKey || "auth_tokens", this.autoRefresh = e.autoRefresh ?? !0, this.refreshThreshold = e.refreshThreshold || 3e5, this.onRefreshFailed = e.onRefreshFailed, this.onSessionExpired = e.onSessionExpired, this.baseUrl = e.baseUrl || "", this.proactiveRefreshMargin = e.proactiveRefreshMargin ?? 6e4, this.refreshQueueTimeout = e.refreshQueueTimeout ?? 1e4, this.maxRefreshRetries = e.maxRefreshRetries ?? 3, this.retryBackoffBase = e.retryBackoffBase ?? 1e3, this.tokenStorage = e.tokenStorage || this.createTokenStorage(this.storageKey), this.scheduleProactiveRefresh();
+    this.refreshPromise = null, this.refreshQueue = [], this.proactiveTimerId = null, this.backgroundRetryTimerId = null, this.isDestroyed = !1, this.sessionGeneration = 0, this.consecutiveBackgroundFailures = 0, e.tenantSlug !== void 0 ? this.storageKey = e.tenantSlug ? `auth_tokens_${e.tenantSlug}` : "auth_tokens" : this.storageKey = e.storageKey || "auth_tokens", this.autoRefresh = e.autoRefresh ?? !0, this.refreshThreshold = e.refreshThreshold || 3e5, this.onRefreshFailed = e.onRefreshFailed, this.onSessionExpired = e.onSessionExpired, this.baseUrl = e.baseUrl || "", this.proactiveRefreshMargin = e.proactiveRefreshMargin ?? 6e4, this.refreshQueueTimeout = e.refreshQueueTimeout ?? 1e4, this.maxRefreshRetries = e.maxRefreshRetries ?? 3, this.retryBackoffBase = e.retryBackoffBase ?? 1e3, this.tokenStorage = e.tokenStorage || this.createTokenStorage(this.storageKey), this.scheduleProactiveRefresh();
   }
   /**
    * Get or create a SessionManager instance for the given config.
@@ -236,17 +236,17 @@ const oe = class oe {
    * Mutable config (callbacks, baseUrl) is updated on the existing instance.
    */
   static getInstance(e = {}) {
-    const t = oe.resolveStorageKey(e), r = oe.instances.get(t);
+    const t = ie.resolveStorageKey(e), r = ie.instances.get(t);
     if (r)
       return r.updateConfig(e), r;
-    const i = new oe(e);
-    return oe.instances.set(t, i), i;
+    const i = new ie(e);
+    return ie.instances.set(t, i), i;
   }
   /** Reset all singleton instances. For testing only. */
   static resetAllInstances() {
-    for (const e of oe.instances.values())
+    for (const e of ie.instances.values())
       e.destroy();
-    oe.instances.clear();
+    ie.instances.clear();
   }
   static resolveStorageKey(e) {
     return e.storageKey ? e.storageKey : e.tenantSlug !== void 0 && e.tenantSlug ? `auth_tokens_${e.tenantSlug}` : "auth_tokens";
@@ -296,7 +296,7 @@ const oe = class oe {
     }
   }
   setTokens(e) {
-    const t = e.expiresAt || (e.expiresIn ? Date.now() + e.expiresIn * 1e3 : void 0) || oe.extractJwtExpiry(e.accessToken), r = {
+    const t = e.expiresAt || (e.expiresIn ? Date.now() + e.expiresIn * 1e3 : void 0) || ie.extractJwtExpiry(e.accessToken), r = {
       ...e,
       expiresAt: t
     }, i = this.tokenStorage.get() || {};
@@ -306,7 +306,7 @@ const oe = class oe {
     const { accessToken: e, refreshToken: t, expiresAt: r, expiresIn: i, tokenType: o } = this.tokenStorage.get() || {};
     if (!e)
       return null;
-    const a = r || oe.extractJwtExpiry(e);
+    const a = r || ie.extractJwtExpiry(e);
     return {
       accessToken: e,
       refreshToken: t,
@@ -353,13 +353,26 @@ const oe = class oe {
     if (!(e != null && e.refreshToken) || this.refreshPromise) return;
     const t = this.sessionGeneration;
     this.startRefreshAndResolveQueue(e.refreshToken).then(() => {
+      this.consecutiveBackgroundFailures = 0;
     }).catch((r) => {
-      r instanceof se || this.sessionGeneration === t && (process.env.NODE_ENV === "development" && console.warn(
-        "[SessionManager] Background refresh failed, retrying in 30s:",
-        r.message
-      ), this.backgroundRetryTimerId = setTimeout(() => {
-        this.backgroundRefresh();
-      }, 3e4));
+      if (!(r instanceof se)) {
+        if (this.sessionGeneration === t) {
+          if (this.consecutiveBackgroundFailures++, this.consecutiveBackgroundFailures >= ie.MAX_BACKGROUND_FAILURES) {
+            process.env.NODE_ENV === "development" && console.error(
+              `[SessionManager] Background refresh failed ${this.consecutiveBackgroundFailures} consecutive times — expiring session`
+            ), this.consecutiveBackgroundFailures = 0, this.handleSessionExpired(
+              new se("token_invalid", "Background refresh failed repeatedly")
+            );
+            return;
+          }
+          process.env.NODE_ENV === "development" && console.warn(
+            "[SessionManager] Background refresh failed, retrying in 30s:",
+            r.message
+          ), this.backgroundRetryTimerId = setTimeout(() => {
+            this.backgroundRefresh();
+          }, 3e4);
+        }
+      }
     });
   }
   /**
@@ -490,7 +503,7 @@ const oe = class oe {
       } catch {
         a = i.statusText.toLowerCase();
       }
-      throw i.status === 401 ? a.includes("expired") ? new se("token_expired") : a.includes("invalid") ? new se("token_invalid") : new se("token_invalid", `Unauthorized: ${a}`) : i.status === 400 ? a.includes("inactive") ? new se("user_inactive") : a.includes("expired") || a.includes("invalid") ? new se("token_invalid", a) : new Error(`Token refresh failed (400): ${a}`) : new Error(`Token refresh failed: ${i.status} ${a}`);
+      throw i.status === 401 ? a.includes("expired") ? new se("token_expired") : a.includes("invalid") ? new se("token_invalid") : new se("token_invalid", `Unauthorized: ${a}`) : i.status === 400 ? a.includes("inactive") ? new se("user_inactive") : a.includes("expired") || a.includes("invalid") ? new se("token_invalid", a) : a.includes("reuse") || a.includes("revoked") ? new se("token_invalid", a) : new Error(`Token refresh failed (400): ${a}`) : new Error(`Token refresh failed: ${i.status} ${a}`);
     }
     if (this.sessionGeneration !== t)
       throw new se("token_invalid", "Session cleared during refresh");
@@ -529,7 +542,7 @@ const oe = class oe {
    * Cancels all timers and rejects pending queue entries.
    */
   destroy() {
-    this.isDestroyed = !0, oe.instances.delete(this.storageKey), this.cancelProactiveTimer();
+    this.isDestroyed = !0, ie.instances.delete(this.storageKey), this.cancelProactiveTimer();
     const e = new se("token_invalid", "SessionManager destroyed");
     this.rejectQueue(e);
   }
@@ -568,8 +581,8 @@ const oe = class oe {
     return new Promise((t) => setTimeout(t, e));
   }
 };
-oe.instances = /* @__PURE__ */ new Map();
-let be = oe;
+ie.instances = /* @__PURE__ */ new Map(), ie.MAX_BACKGROUND_FAILURES = 3;
+let be = ie;
 const Ie = /* @__PURE__ */ new Map();
 class vt {
   constructor(e) {
@@ -882,7 +895,7 @@ function Et() {
 }
 const Ue = ye(null);
 function Sr({ config: n, children: e }) {
-  const { baseUrl: t, appInfo: r, appId: i } = Ae(), o = ie(() => typeof window > "u" ? null : xt(
+  const { baseUrl: t, appInfo: r, appId: i } = Ae(), o = oe(() => typeof window > "u" ? null : xt(
     {
       tenantMode: n.tenantMode || "selector",
       baseDomain: n.baseDomain,
@@ -916,13 +929,13 @@ function Sr({ config: n, children: e }) {
     } catch {
       return null;
     }
-  }), [D, g] = x(!y && !n.initialTenant), [T, A] = x(null), [L, M] = x(null), [P, d] = x(!1), [v, N] = x(null);
+  }), [F, g] = x(!y && !n.initialTenant), [T, A] = x(null), [L, M] = x(null), [P, d] = x(!1), [v, N] = x(null);
   ne(() => {
     if (n.tenantMode === "fixed") return;
     const p = o();
     c(p);
   }, [o, n.tenantMode]);
-  const $ = (r == null ? void 0 : r.settingsSchema) || null, w = ie(
+  const B = (r == null ? void 0 : r.settingsSchema) || null, w = oe(
     async (p, U = !1) => {
       if (!(!U && m.enabled && y && y.domain === p))
         try {
@@ -947,7 +960,7 @@ function Sr({ config: n, children: e }) {
         }
     },
     [t, i, m, y]
-  ), R = ie(async () => {
+  ), R = oe(async () => {
     if (!(!m.enabled || !y || !a))
       try {
         const p = localStorage.getItem(m.storageKey);
@@ -956,17 +969,17 @@ function Sr({ config: n, children: e }) {
         if (Date.now() - U.timestamp > m.ttl * 0.5) {
           const h = new de(t), E = await new ve(h, i).getPublicTenantInfo(a);
           f(E);
-          const Q = {
+          const K = {
             data: E,
             timestamp: Date.now(),
             tenantSlug: a
           };
-          localStorage.setItem(m.storageKey, JSON.stringify(Q));
+          localStorage.setItem(m.storageKey, JSON.stringify(K));
         }
       } catch (p) {
         process.env.NODE_ENV === "development" && console.warn("[TenantProvider] Background tenant refresh failed:", p);
       }
-  }, [t, i, m, y, a]), k = ie(async () => {
+  }, [t, i, m, y, a]), k = oe(async () => {
     if (y != null && y.id)
       try {
         d(!0), N(null);
@@ -978,25 +991,25 @@ function Sr({ config: n, children: e }) {
       } finally {
         d(!1);
       }
-  }, [t, y]), I = ie(() => {
+  }, [t, y]), I = oe(() => {
     k();
-  }, [k]), l = ie(
+  }, [k]), l = oe(
     (p) => {
-      if (!$)
+      if (!B)
         return { isValid: !0, errors: [] };
       const U = [];
       try {
-        return $.properties && Object.entries($.properties).forEach(([b, h]) => {
+        return B.properties && Object.entries(B.properties).forEach(([b, h]) => {
           var E;
           const S = p[b];
-          if ((E = $.required) != null && E.includes(b) && S == null) {
+          if ((E = B.required) != null && E.includes(b) && S == null) {
             U.push(`Field '${b}' is required`);
             return;
           }
           if (S != null) {
             if (h.type) {
-              const Q = h.type, G = typeof S;
-              Q === "string" && G !== "string" ? U.push(`Field '${b}' must be a string`) : (Q === "number" || Q === "integer") && G !== "number" ? U.push(`Field '${b}' must be a number`) : Q === "boolean" && G !== "boolean" ? U.push(`Field '${b}' must be a boolean`) : Q === "array" && !Array.isArray(S) && U.push(`Field '${b}' must be an array`);
+              const K = h.type, G = typeof S;
+              K === "string" && G !== "string" ? U.push(`Field '${b}' must be a string`) : (K === "number" || K === "integer") && G !== "number" ? U.push(`Field '${b}' must be a number`) : K === "boolean" && G !== "boolean" ? U.push(`Field '${b}' must be a boolean`) : K === "array" && !Array.isArray(S) && U.push(`Field '${b}' must be an array`);
             }
             h.minLength !== void 0 && typeof S == "string" && S.length < h.minLength && U.push(
               `Field '${b}' must be at least ${h.minLength} characters long`
@@ -1015,14 +1028,14 @@ function Sr({ config: n, children: e }) {
         };
       }
     },
-    [$]
+    [B]
   );
   ne(() => {
     !n.initialTenant && a ? y ? R() : w(a) : !n.initialTenant && !a && (f(null), A(null), g(!1));
   }, [n.initialTenant, a, y, w, R]), ne(() => {
     y != null && y.id ? k() : (M(null), N(null), d(!1));
   }, [y == null ? void 0 : y.id, k]);
-  const z = ie(
+  const z = oe(
     (p, U) => {
       const { mode: b = "reload", tokens: h, redirectPath: S } = U || {}, E = n.tenantMode || "selector";
       if (E === "fixed") {
@@ -1033,46 +1046,46 @@ function Sr({ config: n, children: e }) {
         return;
       }
       if (localStorage.setItem("tenant", p), E === "subdomain") {
-        const Q = window.location.hostname, G = At(
+        const K = window.location.hostname, G = At(
           p,
-          Q,
+          K,
           n.baseDomain
         );
         if (!G) {
           process.env.NODE_ENV === "development" && console.warn(
             "[TenantProvider] Cannot switch subdomain, invalid hostname:",
-            Q
+            K
           );
           return;
         }
         const X = S || window.location.pathname, W = new URL(`${window.location.protocol}//${G}${X}`);
-        new URLSearchParams(window.location.search).forEach((V, B) => {
-          B !== me && W.searchParams.set(B, V);
+        new URLSearchParams(window.location.search).forEach((V, H) => {
+          H !== me && W.searchParams.set(H, V);
         }), h && W.searchParams.set(me, je(h)), window.location.href = W.toString();
       } else if (E === "selector") {
-        const Q = S || window.location.pathname, G = new URLSearchParams(window.location.search);
+        const K = S || window.location.pathname, G = new URLSearchParams(window.location.search);
         if (G.set(n.selectorParam || "tenant", p), G.delete(me), h && G.set(me, je(h)), b === "reload") {
-          const X = `${Q}?${G.toString()}${window.location.hash}`;
+          const X = `${K}?${G.toString()}${window.location.hash}`;
           window.location.href = X;
         } else {
-          const X = `${Q}?${G.toString()}${window.location.hash}`;
+          const X = `${K}?${G.toString()}${window.location.hash}`;
           window.history.pushState({}, "", X), c(p), w(p);
         }
       }
     },
     [n.tenantMode, n.selectorParam, n.baseDomain, w]
-  ), F = Z(() => ({
+  ), D = Z(() => ({
     // Tenant info
     tenant: y,
     tenantSlug: a,
-    isTenantLoading: D,
+    isTenantLoading: F,
     tenantError: T,
     retryTenant: () => {
       a && w(a);
     },
     // Settings
     settings: L,
-    settingsSchema: $,
+    settingsSchema: B,
     isSettingsLoading: P,
     settingsError: v,
     // Actions
@@ -1083,17 +1096,17 @@ function Sr({ config: n, children: e }) {
   }), [
     y,
     a,
-    D,
+    F,
     T,
     L,
-    $,
+    B,
     P,
     v,
     I,
     z,
     l
   ]);
-  return /* @__PURE__ */ s(Ue.Provider, { value: F, children: e });
+  return /* @__PURE__ */ s(Ue.Provider, { value: D, children: e });
 }
 function Te() {
   const n = le(Ue);
@@ -1125,25 +1138,25 @@ function Je() {
     retry: i
   };
 }
-const $e = ye(null);
+const Be = ye(null);
 function xr({ config: n = {}, children: e }) {
-  const t = Fe(), r = pe(), i = (t == null ? void 0 : t.baseUrl) ?? n.baseUrl ?? "", o = (t == null ? void 0 : t.appId) ?? n.appId, a = (r == null ? void 0 : r.tenant) ?? null, c = (r == null ? void 0 : r.tenantSlug) ?? null, m = (r == null ? void 0 : r.switchTenant) ?? (() => {
+  const t = De(), r = pe(), i = (t == null ? void 0 : t.baseUrl) ?? n.baseUrl ?? "", o = (t == null ? void 0 : t.appId) ?? n.appId, a = (r == null ? void 0 : r.tenant) ?? null, c = (r == null ? void 0 : r.tenantSlug) ?? null, m = (r == null ? void 0 : r.switchTenant) ?? (() => {
   });
   if (!i)
     throw new Error(
       "[AuthProvider] baseUrl is required. Provide it via AppProvider or AuthConfig.baseUrl."
     );
-  const [y, f] = x(n.initialRoles || []), [D, g] = x(!n.initialRoles), [T, A] = x(null), [L, M] = x(!1), [P, d] = x(null), [v, N] = x(() => {
+  const [y, f] = x(n.initialRoles || []), [F, g] = x(!n.initialRoles), [T, A] = x(null), [L, M] = x(!1), [P, d] = x(null), [v, N] = x(() => {
     try {
-      const C = localStorage.getItem("userTenants");
-      return C ? JSON.parse(C) : [];
+      const $ = localStorage.getItem("userTenants");
+      return $ ? JSON.parse($) : [];
     } catch {
       return [];
     }
-  }), [$, w] = x(!1), R = Ne({ done: !1, urlTokens: null });
+  }), [B, w] = x(!1), R = Ne({ done: !1, urlTokens: null });
   R.current.done || (R.current.done = !0, R.current.urlTokens = Rt());
   const [k, I] = x(() => R.current.urlTokens !== null), l = Z(() => {
-    const C = be.getInstance({
+    const $ = be.getInstance({
       tenantSlug: c,
       baseUrl: i,
       refreshQueueTimeout: n.refreshQueueTimeout,
@@ -1157,23 +1170,23 @@ function xr({ config: n = {}, children: e }) {
         n.onSessionExpired ? n.onSessionExpired(ce) : n.onRefreshFailed && n.onRefreshFailed();
       }
     });
-    return R.current.urlTokens && C.setTokens({
+    return R.current.urlTokens && $.setTokens({
       accessToken: R.current.urlTokens.accessToken,
       refreshToken: R.current.urlTokens.refreshToken,
       expiresIn: R.current.urlTokens.expiresIn
-    }), C;
-  }, [c, i, n.refreshQueueTimeout, n.proactiveRefreshMargin]), [z, F] = x(() => {
+    }), $;
+  }, [c, i, n.refreshQueueTimeout, n.proactiveRefreshMargin]), [z, D] = x(() => {
     if (R.current.urlTokens) return !1;
-    const C = l.getTokens();
-    return C ? l.hasValidSession() || !!C.refreshToken : !1;
+    const $ = l.getTokens();
+    return $ ? l.hasValidSession() || !!$.refreshToken : !1;
   }), p = R.current.done && !k && !z, U = Z(() => {
-    const C = new de(i);
-    return C.setSessionManager(l), C;
-  }, [i, l]), b = Z(() => new vt(new de(i)), [i]), h = Z(() => new St(U, l), [U, l]), S = Z(() => new We(new de(i)), [i]), E = Z(() => T || l.getUser(), [T, l]), Q = Z(() => E != null && E.roleId && y.find((C) => C.id === E.roleId) || null, [E, y]), G = Z(() => (Q == null ? void 0 : Q.permissions) || [], [Q]), X = Z(() => l.hasValidSession() && T !== null, [l, T]), W = Ne(async () => {
+    const $ = new de(i);
+    return $.setSessionManager(l), $;
+  }, [i, l]), b = Z(() => new vt(new de(i)), [i]), h = Z(() => new St(U, l), [U, l]), S = Z(() => new We(new de(i)), [i]), E = Z(() => T || l.getUser(), [T, l]), K = Z(() => E != null && E.roleId && y.find(($) => $.id === E.roleId) || null, [E, y]), G = Z(() => (K == null ? void 0 : K.permissions) || [], [K]), X = Z(() => l.hasValidSession() && T !== null, [l, T]), W = Ne(async () => {
   }), q = Z(() => {
-    const C = async (H = !1) => {
+    const $ = async (C = !1) => {
       try {
-        if (!l.hasValidSession() || !H && T)
+        if (!l.hasValidSession() || !C && T)
           return;
         const O = l.getUserId();
         if (!O) {
@@ -1190,13 +1203,13 @@ function xr({ config: n = {}, children: e }) {
         M(!1);
       }
     }, ce = async () => {
-      await C();
-    }, fe = async (H) => {
+      await $();
+    }, fe = async (C) => {
       var _e;
-      const { username: O, password: J, tenantSlug: j, redirectPath: Y } = H;
+      const { username: O, password: J, tenantSlug: j, redirectPath: Y } = C;
       let ee = a == null ? void 0 : a.id, te = c, re = l;
       j && (ee = (await new ve(U, o).getPublicTenantInfo(j)).id, te = j);
-      const K = await b.login({
+      const Q = await b.login({
         username: O,
         password: J,
         appId: o,
@@ -1206,45 +1219,45 @@ function xr({ config: n = {}, children: e }) {
         tenantSlug: te,
         baseUrl: i
       })), re.setTokens({
-        accessToken: K.accessToken,
-        refreshToken: K.refreshToken,
-        expiresIn: K.expiresIn
-      }), K.user) {
-        re.setUser(K.user), A(K.user);
+        accessToken: Q.accessToken,
+        refreshToken: Q.refreshToken,
+        expiresIn: Q.expiresIn
+      }), Q.user) {
+        re.setUser(Q.user), A(Q.user);
         try {
-          await C();
+          await $();
         } catch (ke) {
           process.env.NODE_ENV === "development" && console.warn("[AuthProvider] Failed to load complete user data after login:", ke);
         }
       }
-      if (K.tenants && K.tenants.length > 0) {
-        N(K.tenants);
+      if (Q.tenants && Q.tenants.length > 0) {
+        N(Q.tenants);
         try {
-          localStorage.setItem("userTenants", JSON.stringify(K.tenants));
+          localStorage.setItem("userTenants", JSON.stringify(Q.tenants));
         } catch {
         }
       }
-      const Re = ((_e = K.user) == null ? void 0 : _e.tenantId) !== null;
+      const Re = ((_e = Q.user) == null ? void 0 : _e.tenantId) !== null;
       w(Re);
       const Ee = {
-        accessToken: K.accessToken,
-        refreshToken: K.refreshToken,
-        expiresIn: K.expiresIn
+        accessToken: Q.accessToken,
+        refreshToken: Q.refreshToken,
+        expiresIn: Q.expiresIn
       };
       if (we && te)
-        return m(te, { tokens: Ee, redirectPath: Y }), K;
+        return m(te, { tokens: Ee, redirectPath: Y }), Q;
       if (Y && Y !== window.location.pathname)
-        return m(te || c || "", { tokens: Ee, redirectPath: Y }), K;
-      if (!Re && K.tenants && K.tenants.length > 0) {
-        const ke = H.autoSwitch !== !1 && n.autoSwitchSingleTenant !== !1;
-        if (K.tenants.length === 1 && ke) {
-          const ze = K.tenants[0];
-          return m(ze.subdomain, { tokens: Ee, redirectPath: Y }), K;
-        } else K.tenants.length > 1 && n.onTenantSelectionRequired && n.onTenantSelectionRequired(K.tenants);
+        return m(te || c || "", { tokens: Ee, redirectPath: Y }), Q;
+      if (!Re && Q.tenants && Q.tenants.length > 0) {
+        const ke = C.autoSwitch !== !1 && n.autoSwitchSingleTenant !== !1;
+        if (Q.tenants.length === 1 && ke) {
+          const ze = Q.tenants[0];
+          return m(ze.subdomain, { tokens: Ee, redirectPath: Y }), Q;
+        } else Q.tenants.length > 1 && n.onTenantSelectionRequired && n.onTenantSelectionRequired(Q.tenants);
       }
-      return K;
-    }, ge = async (H) => {
-      const { email: O, phoneNumber: J, name: j, password: Y, lastName: ee, tenantId: te } = H;
+      return Q;
+    }, ge = async (C) => {
+      const { email: O, phoneNumber: J, name: j, password: Y, lastName: ee, tenantId: te } = C;
       if (!O && !J)
         throw new Error("Either email or phoneNumber is required");
       if (!j || !Y)
@@ -1259,8 +1272,8 @@ function xr({ config: n = {}, children: e }) {
         lastName: ee,
         appId: o
       });
-    }, nt = async (H) => {
-      const { email: O, phoneNumber: J, name: j, password: Y, tenantName: ee, lastName: te } = H;
+    }, nt = async (C) => {
+      const { email: O, phoneNumber: J, name: j, password: Y, tenantName: ee, lastName: te } = C;
       if (!O && !J)
         throw new Error("Either email or phoneNumber is required");
       if (!j || !Y || !ee)
@@ -1274,19 +1287,19 @@ function xr({ config: n = {}, children: e }) {
         appId: o,
         lastName: te
       });
-    }, st = async (H) => {
-      const { currentPassword: O, newPassword: J } = H, j = await l.getAuthHeaders();
+    }, st = async (C) => {
+      const { currentPassword: O, newPassword: J } = C, j = await l.getAuthHeaders();
       await b.changePassword({ currentPassword: O, newPassword: J }, j);
-    }, it = async (H) => {
-      const { email: O, tenantId: J } = H, j = J ?? (a == null ? void 0 : a.id);
+    }, it = async (C) => {
+      const { email: O, tenantId: J } = C, j = J ?? (a == null ? void 0 : a.id);
       if (!j)
         throw new Error("tenantId is required for password reset");
       await b.requestPasswordReset({ email: O, tenantId: j });
-    }, ot = async (H) => {
-      const { token: O, newPassword: J } = H;
+    }, ot = async (C) => {
+      const { token: O, newPassword: J } = C;
       await b.confirmPasswordReset({ token: O, newPassword: J });
-    }, at = async (H) => {
-      const { email: O, frontendUrl: J, name: j, lastName: Y, tenantId: ee } = H, te = ee ?? (a == null ? void 0 : a.id);
+    }, at = async (C) => {
+      const { email: O, frontendUrl: J, name: j, lastName: Y, tenantId: ee } = C, te = ee ?? (a == null ? void 0 : a.id);
       if (!te)
         throw new Error("tenantId is required for magic link authentication");
       return await b.sendMagicLink({
@@ -1297,8 +1310,8 @@ function xr({ config: n = {}, children: e }) {
         lastName: Y,
         appId: o
       });
-    }, lt = async (H) => {
-      const { token: O, email: J, tenantSlug: j } = H;
+    }, lt = async (C) => {
+      const { token: O, email: J, tenantSlug: j } = C;
       let Y = a == null ? void 0 : a.id, ee = c, te = l;
       j && (Y = (await new ve(U, o).getPublicTenantInfo(j)).id, ee = j);
       const re = await b.verifyMagicLink({
@@ -1306,8 +1319,8 @@ function xr({ config: n = {}, children: e }) {
         email: J,
         appId: o,
         tenantId: Y
-      }), K = j && j !== c;
-      if (K && (te = new be({
+      }), Q = j && j !== c;
+      if (Q && (te = new be({
         tenantSlug: ee,
         baseUrl: i
       })), te.setTokens({
@@ -1317,7 +1330,7 @@ function xr({ config: n = {}, children: e }) {
       }), re.user) {
         te.setUser(re.user), A(re.user);
         try {
-          await C();
+          await $();
         } catch (we) {
           process.env.NODE_ENV === "development" && console.warn(
             "[AuthProvider] Failed to load complete user data after magic link:",
@@ -1325,7 +1338,7 @@ function xr({ config: n = {}, children: e }) {
           );
         }
       }
-      return K && ee && ee !== c && m(ee, {
+      return Q && ee && ee !== c && m(ee, {
         tokens: {
           accessToken: re.accessToken,
           refreshToken: re.refreshToken,
@@ -1333,15 +1346,15 @@ function xr({ config: n = {}, children: e }) {
         }
       }), re;
     }, ct = async () => {
-      const H = l.getTokens();
-      if (!(H != null && H.refreshToken))
+      const C = l.getTokens();
+      if (!(C != null && C.refreshToken))
         throw new Error("No refresh token available");
       const O = await b.refreshToken({
-        refreshToken: H.refreshToken
+        refreshToken: C.refreshToken
       });
       l.setTokens({
         accessToken: O.accessToken,
-        refreshToken: O.refreshToken || H.refreshToken,
+        refreshToken: O.refreshToken || C.refreshToken,
         expiresIn: O.expiresIn
       });
     }, dt = () => {
@@ -1350,29 +1363,29 @@ function xr({ config: n = {}, children: e }) {
         localStorage.removeItem("userTenants");
       } catch {
       }
-    }, ut = (H) => {
-      l.setTokens(H);
+    }, ut = (C) => {
+      l.setTokens(C);
     }, ht = () => l.hasValidSession(), pt = () => {
       l.clearSession(), A(null), d(null);
     }, ft = async () => {
       if (o)
         try {
           g(!0);
-          const { roles: H } = await S.getRolesByApp(o);
-          f(H);
-        } catch (H) {
-          process.env.NODE_ENV === "development" && console.error("[AuthProvider] Failed to fetch roles:", H);
+          const { roles: C } = await S.getRolesByApp(o);
+          f(C);
+        } catch (C) {
+          process.env.NODE_ENV === "development" && console.error("[AuthProvider] Failed to fetch roles:", C);
         } finally {
           g(!1);
         }
     }, gt = async () => {
       await ft();
-    }, Pe = (H) => {
+    }, Pe = (C) => {
       if (!G || G.length === 0)
         return !1;
-      if (typeof H == "string")
-        return G.includes(H);
-      const O = `${H.resource}.${H.action}`;
+      if (typeof C == "string")
+        return G.includes(C);
+      const O = `${C.resource}.${C.action}`;
       return G.includes(O);
     };
     return {
@@ -1396,29 +1409,29 @@ function xr({ config: n = {}, children: e }) {
       currentUser: T,
       isUserLoading: L,
       userError: P,
-      loadUserData: C,
+      loadUserData: $,
       refreshUser: ce,
       isAuthInitializing: !p,
       isAuthReady: p,
-      userRole: Q,
+      userRole: K,
       userPermissions: G,
       availableRoles: y,
-      rolesLoading: D,
+      rolesLoading: F,
       hasPermission: Pe,
-      hasAnyPermission: (H) => H.some((O) => Pe(O)),
-      hasAllPermissions: (H) => H.every((O) => Pe(O)),
+      hasAnyPermission: (C) => C.some((O) => Pe(O)),
+      hasAllPermissions: (C) => C.every((O) => Pe(O)),
       getUserPermissionStrings: () => G || [],
       refreshRoles: gt,
       // RFC-004: Multi-tenant user membership
       userTenants: v,
-      hasTenantContext: $,
-      switchToTenant: async (H, O) => {
+      hasTenantContext: B,
+      switchToTenant: async (C, O) => {
         const { redirectPath: J } = O || {}, j = l.getTokens();
         if (!(j != null && j.refreshToken))
           throw new Error("No refresh token available for tenant switch");
         const Y = await b.switchTenant({
           refreshToken: j.refreshToken,
-          tenantId: H
+          tenantId: C
         });
         l.setTokens({
           accessToken: Y.accessToken,
@@ -1426,7 +1439,7 @@ function xr({ config: n = {}, children: e }) {
           // Keep the same refresh token
           expiresIn: Y.expiresIn
         }), A(Y.user), l.setUser(Y.user), w(!0);
-        const ee = v.find((te) => te.id === H);
+        const ee = v.find((te) => te.id === C);
         ee && m(ee.subdomain, {
           tokens: {
             accessToken: Y.accessToken,
@@ -1437,7 +1450,7 @@ function xr({ config: n = {}, children: e }) {
         });
       },
       refreshUserTenants: async () => {
-        const H = await l.getAuthHeaders(), O = await b.getUserTenants(H);
+        const C = await l.getAuthHeaders(), O = await b.getUserTenants(C);
         N(O);
         try {
           localStorage.setItem("userTenants", JSON.stringify(O));
@@ -1462,9 +1475,9 @@ function xr({ config: n = {}, children: e }) {
     L,
     P,
     v,
-    $,
+    B,
     p,
-    Q,
+    K,
     G
   ]);
   W.current = q.loadUserData, ne(() => {
@@ -1480,38 +1493,38 @@ function xr({ config: n = {}, children: e }) {
       }
     })();
   }, [o, i, n.initialRoles]);
-  const [V, B] = x(!1);
+  const [V, H] = x(!1);
   return ne(() => {
-    V || (B(!0), R.current.urlTokens && (Et(), I(!0), q.loadUserData().catch((C) => {
-      process.env.NODE_ENV === "development" && console.error("[AuthProvider] Failed to load user data after URL tokens:", C);
+    V || (H(!0), R.current.urlTokens && (Et(), I(!0), q.loadUserData().catch(($) => {
+      process.env.NODE_ENV === "development" && console.error("[AuthProvider] Failed to load user data after URL tokens:", $);
     }).finally(() => {
       I(!1);
     })));
   }, [q, V]), ne(() => {
-    let C = !1;
+    let $ = !1;
     return (async () => {
       var ge;
-      if (!l.hasValidSession() && ((ge = l.getTokens()) != null && ge.refreshToken) && await l.waitForPendingRefresh(), C) return;
+      if (!l.hasValidSession() && ((ge = l.getTokens()) != null && ge.refreshToken) && await l.waitForPendingRefresh(), $) return;
       const fe = l.getUser();
-      fe && l.hasValidSession() && A(fe), F(!1);
+      fe && l.hasValidSession() && A(fe), D(!1);
     })(), () => {
-      C = !0;
+      $ = !0;
     };
   }, [l]), ne(() => {
     V && (R.current.urlTokens || (!T && !L && !P && l.hasValidSession() ? W.current().catch(() => {
     }).finally(() => {
-      F(!1);
-    }) : F(!1)));
-  }, [T, L, P, l, V]), /* @__PURE__ */ s($e.Provider, { value: q, children: e });
+      D(!1);
+    }) : D(!1)));
+  }, [T, L, P, l, V]), /* @__PURE__ */ s(Be.Provider, { value: q, children: e });
 }
 function he() {
-  const n = le($e);
+  const n = le(Be);
   if (!n)
     throw new Error("useAuth must be used within an AuthProvider");
   return n;
 }
-function Ce() {
-  return le($e);
+function $e() {
+  return le(Be);
 }
 class It {
   constructor(e, t) {
@@ -1593,9 +1606,9 @@ class It {
     })).data;
   }
 }
-const He = ye(null);
+const Ce = ye(null);
 function Ar({ config: n = {}, children: e }) {
-  const t = Fe(), r = pe(), i = (t == null ? void 0 : t.baseUrl) ?? "", o = (t == null ? void 0 : t.appId) ?? "", a = (r == null ? void 0 : r.tenant) ?? null, [c, m] = x([]), [y, f] = x(!1), [D, g] = x(null), [T, A] = x(!1), L = Z(() => {
+  const t = De(), r = pe(), i = (t == null ? void 0 : t.baseUrl) ?? "", o = (t == null ? void 0 : t.appId) ?? "", a = (r == null ? void 0 : r.tenant) ?? null, [c, m] = x([]), [y, f] = x(!1), [F, g] = x(null), [T, A] = x(!1), L = Z(() => {
     const d = new de(i);
     return new It(d);
   }, [i]), M = async () => {
@@ -1627,30 +1640,30 @@ function Ar({ config: n = {}, children: e }) {
     }, v = (R) => c.find((k) => k.key === R), N = (R) => {
       const k = c.find((I) => I.key === R);
       return k ? k.value ? "enabled" : "disabled" : "not_found";
-    }, $ = async () => {
+    }, B = async () => {
       await M();
     }, w = !!(i && o) && (T || !(a != null && a.id));
     return {
       featureFlags: c,
       loading: y,
-      error: D,
+      error: F,
       isReady: w,
       isEnabled: d,
       getFlag: v,
       getFlagState: N,
-      refresh: $
+      refresh: B
     };
-  }, [c, y, D, i, o, a == null ? void 0 : a.id, T]);
-  return /* @__PURE__ */ s(He.Provider, { value: P, children: e });
+  }, [c, y, F, i, o, a == null ? void 0 : a.id, T]);
+  return /* @__PURE__ */ s(Ce.Provider, { value: P, children: e });
 }
 function Mt() {
-  const n = le(He);
+  const n = le(Ce);
   if (!n)
     throw new Error("useFeatureFlags must be used within a FeatureFlagProvider");
   return n;
 }
 function Ye() {
-  return le(He);
+  return le(Ce);
 }
 class Lt {
   constructor(e, t) {
@@ -1718,9 +1731,9 @@ class Lt {
     )).data;
   }
 }
-const Be = ye(void 0);
+const He = ye(void 0);
 function Pr({ config: n = {}, children: e }) {
-  const t = Fe(), r = pe(), i = (t == null ? void 0 : t.baseUrl) ?? "", o = (r == null ? void 0 : r.tenant) ?? null, [a, c] = x(null), [m, y] = x(!1), [f, D] = x(null), [g, T] = x(!1), A = Z(() => {
+  const t = De(), r = pe(), i = (t == null ? void 0 : t.baseUrl) ?? "", o = (r == null ? void 0 : r.tenant) ?? null, [a, c] = x(null), [m, y] = x(!1), [f, F] = x(null), [g, T] = x(!1), A = Z(() => {
     const P = new de(i);
     return new Lt(P);
   }, [i]), L = async () => {
@@ -1728,13 +1741,13 @@ function Pr({ config: n = {}, children: e }) {
       c(null);
       return;
     }
-    y(!0), D(null);
+    y(!0), F(null);
     try {
       const P = await A.getTenantSubscriptionFeatures(o.id);
       c(P);
     } catch (P) {
       const d = P instanceof Error ? P.message : "Failed to fetch subscription";
-      D(d), n.onError && n.onError(P instanceof Error ? P : new Error(d));
+      F(d), n.onError && n.onError(P instanceof Error ? P : new Error(d));
     } finally {
       y(!1);
     }
@@ -1751,7 +1764,7 @@ function Pr({ config: n = {}, children: e }) {
     }, v = (k) => P.find((I) => I.key === k), N = (k, I) => {
       const l = P.find((z) => z.key === k);
       return l ? l.value : I;
-    }, $ = (k) => !a || !a.isActive ? !1 : k.includes(a.planId), w = async () => {
+    }, B = (k) => !a || !a.isActive ? !1 : k.includes(a.planId), w = async () => {
       await L();
     }, R = !!i && (g || !(o != null && o.id));
     return {
@@ -1763,20 +1776,20 @@ function Pr({ config: n = {}, children: e }) {
       isFeatureEnabled: d,
       getFeature: v,
       getFeatureValue: N,
-      hasAllowedPlan: $,
+      hasAllowedPlan: B,
       refresh: w
     };
   }, [a, m, f, i, o == null ? void 0 : o.id, g]);
-  return /* @__PURE__ */ s(Be.Provider, { value: M, children: e });
+  return /* @__PURE__ */ s(He.Provider, { value: M, children: e });
 }
 function Nt() {
-  const n = le(Be);
+  const n = le(He);
   if (n === void 0)
     throw new Error("useSubscription must be used within a SubscriptionProvider");
   return n;
 }
 function Xe() {
-  return le(Be) ?? null;
+  return le(He) ?? null;
 }
 var ae = /* @__PURE__ */ ((n) => (n.SUPERUSER = "SUPERUSER", n.TENANT_ADMIN = "TENANT_ADMIN", n.USER = "USER", n))(ae || {});
 const Oe = {
@@ -1832,7 +1845,7 @@ function Er() {
     throw new Error("useRouting must be used within a RoutingProvider");
   return n;
 }
-function Dt() {
+function Ft() {
   const n = le(qe);
   return n || {
     zoneRoots: Oe,
@@ -1881,7 +1894,7 @@ const Ge = () => /* @__PURE__ */ u(
       )
     ]
   }
-), Qe = ({
+), Ke = ({
   userType: n,
   minUserType: e,
   missingPermissions: t
@@ -1922,7 +1935,7 @@ const Ge = () => /* @__PURE__ */ u(
       ] })
     ]
   }
-), Ft = (n, e) => {
+), Dt = (n, e) => {
   const t = {
     [ae.USER]: 1,
     [ae.TENANT_ADMIN]: 2,
@@ -1943,11 +1956,11 @@ function Ir({
   const f = a.getUser();
   if (!f)
     return /* @__PURE__ */ s(_, { children: e || /* @__PURE__ */ s(Ge, {}) });
-  if (t && !Ft(f.userType, t))
-    return /* @__PURE__ */ s(Qe, { userType: f.userType, minUserType: t });
+  if (t && !Dt(f.userType, t))
+    return /* @__PURE__ */ s(Ke, { userType: f.userType, minUserType: t });
   if (r && r.length > 0 && !(i ? y(r) : m(r))) {
     const g = r.filter((T) => !c(T)).map((T) => typeof T == "string" ? T : T.name);
-    return /* @__PURE__ */ s(Qe, { missingPermissions: g });
+    return /* @__PURE__ */ s(Ke, { missingPermissions: g });
   }
   return /* @__PURE__ */ s(_, { children: n });
 }
@@ -1987,7 +2000,7 @@ const Ut = ({ redirectPath: n }) => /* @__PURE__ */ s(
       }
     )
   }
-), Ke = ({
+), Qe = ({
   userType: n,
   requiredUserType: e,
   missingPermissions: t
@@ -2038,7 +2051,7 @@ const Ut = ({ redirectPath: n }) => /* @__PURE__ */ s(
       }
     )
   }
-), $t = (n, e) => n === e;
+), Bt = (n, e) => n === e;
 function Mr({
   children: n,
   redirectTo: e = "/login",
@@ -2047,7 +2060,7 @@ function Mr({
   requireAllPermissions: i = !1,
   fallback: o
 }) {
-  const { hasValidSession: a, sessionManager: c, hasPermission: m, hasAnyPermission: y, hasAllPermissions: f } = he(), D = xe();
+  const { hasValidSession: a, sessionManager: c, hasPermission: m, hasAnyPermission: y, hasAllPermissions: f } = he(), F = xe();
   if (ne(() => {
     process.env.NODE_ENV === "development" && console.warn(
       "[react-identity-access] ProtectedRoute is deprecated. Use AuthenticatedZone or AdminZone from ZoneRoute instead."
@@ -2055,14 +2068,14 @@ function Mr({
   }, []), !a())
     return o ? /* @__PURE__ */ s(_, { children: o }) : /* @__PURE__ */ u(_, { children: [
       /* @__PURE__ */ s(Ut, { redirectPath: e }),
-      /* @__PURE__ */ s(Se, { to: e, state: { from: D.pathname }, replace: !0 })
+      /* @__PURE__ */ s(Se, { to: e, state: { from: F.pathname }, replace: !0 })
     ] });
   const g = c.getUser();
   if (!g)
-    return /* @__PURE__ */ s(Se, { to: e, state: { from: D.pathname }, replace: !0 });
-  if (t && !$t(g.userType, t))
+    return /* @__PURE__ */ s(Se, { to: e, state: { from: F.pathname }, replace: !0 });
+  if (t && !Bt(g.userType, t))
     return /* @__PURE__ */ s(
-      Ke,
+      Qe,
       {
         userType: g.userType,
         requiredUserType: t
@@ -2070,11 +2083,11 @@ function Mr({
     );
   if (r && r.length > 0 && !(i ? f(r) : y(r))) {
     const A = r.filter((L) => !m(L)).map((L) => typeof L == "string" ? L : L.name);
-    return /* @__PURE__ */ s(Ke, { missingPermissions: A });
+    return /* @__PURE__ */ s(Qe, { missingPermissions: A });
   }
   return /* @__PURE__ */ s(_, { children: n });
 }
-const Ct = ({ redirectPath: n }) => /* @__PURE__ */ s(
+const $t = ({ redirectPath: n }) => /* @__PURE__ */ s(
   "div",
   {
     style: {
@@ -2118,11 +2131,11 @@ function Lr({ children: n, redirectTo: e = "/", fallback: t }) {
       "[react-identity-access] TenantRoute is deprecated. Use TenantZone from ZoneRoute instead."
     );
   }, []), i || o ? null : r ? /* @__PURE__ */ s(_, { children: n }) : t ? /* @__PURE__ */ s(_, { children: t }) : /* @__PURE__ */ u(_, { children: [
-    /* @__PURE__ */ s(Ct, { redirectPath: e }),
+    /* @__PURE__ */ s($t, { redirectPath: e }),
     /* @__PURE__ */ s(Se, { to: e, state: { from: a.pathname }, replace: !0 })
   ] });
 }
-const Ht = ({ redirectPath: n }) => /* @__PURE__ */ s(
+const Ct = ({ redirectPath: n }) => /* @__PURE__ */ s(
   "div",
   {
     style: {
@@ -2166,18 +2179,18 @@ function Nr({ children: n, redirectTo: e = "/dashboard", fallback: t }) {
       "[react-identity-access] LandingRoute is deprecated. Use PublicZone from ZoneRoute instead."
     );
   }, []), i || o ? null : r ? t ? /* @__PURE__ */ s(_, { children: t }) : /* @__PURE__ */ u(_, { children: [
-    /* @__PURE__ */ s(Ht, { redirectPath: e }),
+    /* @__PURE__ */ s(Ct, { redirectPath: e }),
     /* @__PURE__ */ s(Se, { to: e, state: { from: a.pathname }, replace: !0 })
   ] }) : /* @__PURE__ */ s(_, { children: n });
 }
-function Bt(n, e) {
+function Ht(n, e) {
   return e ? n ? Array.isArray(e) ? e.includes(n) : n === e : !1 : !0;
 }
 function Ze(n, e) {
   return !n || n === "optional" ? "skip" : n === "required" ? e ? "pass" : "fail" : n === "forbidden" ? e ? "fail" : "pass" : "skip";
 }
 function Ot(n, e) {
-  return Ze(n.tenant, e.hasTenant) === "fail" ? e.hasTenant ? "has_tenant" : "no_tenant" : Ze(n.auth, e.isAuthenticated) === "fail" ? e.isAuthenticated ? "already_authenticated" : "not_authenticated" : n.userType && e.isAuthenticated && !Bt(e.userType, n.userType) ? "wrong_user_type" : n.permissions && n.permissions.length > 0 && !(n.requireAllPermissions !== !1 ? (o) => o.every((a) => e.permissions.includes(a)) : (o) => o.some((a) => e.permissions.includes(a)))(n.permissions) ? "missing_permissions" : null;
+  return Ze(n.tenant, e.hasTenant) === "fail" ? e.hasTenant ? "has_tenant" : "no_tenant" : Ze(n.auth, e.isAuthenticated) === "fail" ? e.isAuthenticated ? "already_authenticated" : "not_authenticated" : n.userType && e.isAuthenticated && !Ht(e.userType, n.userType) ? "wrong_user_type" : n.permissions && n.permissions.length > 0 && !(n.requireAllPermissions !== !1 ? (o) => o.every((a) => e.permissions.includes(a)) : (o) => o.some((a) => e.permissions.includes(a)))(n.permissions) ? "missing_permissions" : null;
 }
 function qt(n, e) {
   return n.hasTenant ? n.isAuthenticated ? n.userType === ae.TENANT_ADMIN ? e.tenantAdmin : e.tenantUser : e.tenantGuest : n.isAuthenticated ? n.userType === ae.TENANT_ADMIN ? e.publicAdmin : e.publicUser : e.publicGuest;
@@ -2205,12 +2218,12 @@ const ue = ({
   onAccessDenied: m,
   redirectTo: y,
   loadingFallback: f,
-  accessDeniedFallback: D
+  accessDeniedFallback: F
 }) => {
-  const g = xe(), { isAuthenticated: T, isAuthInitializing: A, currentUser: L, userPermissions: M } = he(), { tenant: P, isTenantLoading: d } = Te(), v = Dt(), N = Z(() => {
+  const g = xe(), { isAuthenticated: T, isAuthInitializing: A, currentUser: L, userPermissions: M } = he(), { tenant: P, isTenantLoading: d } = Te(), v = Ft(), N = Z(() => {
     if (e)
       return v.presets[e];
-  }, [e, v.presets]), $ = Z(
+  }, [e, v.presets]), B = Z(
     () => ({
       tenant: t ?? (N == null ? void 0 : N.tenant),
       auth: r ?? (N == null ? void 0 : N.auth),
@@ -2235,13 +2248,13 @@ const ue = ({
       A,
       d
     ]
-  ), R = Z(() => w.isLoading ? null : Ot($, w), [$, w]), k = Z(() => R ? y || qt(w, v.zoneRoots) : null, [R, y, w, v.zoneRoots]), I = Z(() => !R || !k ? null : {
+  ), R = Z(() => w.isLoading ? null : Ot(B, w), [B, w]), k = Z(() => R ? y || qt(w, v.zoneRoots) : null, [R, y, w, v.zoneRoots]), I = Z(() => !R || !k ? null : {
     type: R,
     required: {
-      tenant: $.tenant,
-      auth: $.auth,
-      userType: $.userType,
-      permissions: $.permissions
+      tenant: B.tenant,
+      auth: B.auth,
+      userType: B.userType,
+      permissions: B.permissions
     },
     current: {
       hasTenant: w.hasTenant,
@@ -2250,7 +2263,7 @@ const ue = ({
       permissions: w.permissions
     },
     redirectTo: k
-  }, [R, k, $, w]);
+  }, [R, k, B, w]);
   if (ne(() => {
     I && (m ? m(I) : v.onAccessDenied && v.onAccessDenied(I));
   }, [I, m, v]), ne(() => {
@@ -2264,7 +2277,7 @@ const ue = ({
   ]), w.isLoading)
     return /* @__PURE__ */ s(_, { children: f ?? v.loadingFallback ?? null });
   if (I && k) {
-    const l = D ?? v.accessDeniedFallback;
+    const l = F ?? v.accessDeniedFallback;
     if (l)
       return /* @__PURE__ */ s(_, { children: l });
     const z = _t(
@@ -2277,7 +2290,7 @@ const ue = ({
     return /* @__PURE__ */ s(Se, { to: z, replace: !0 });
   }
   return /* @__PURE__ */ s(_, { children: n });
-}, Dr = (n) => /* @__PURE__ */ s(ue, { tenant: "required", ...n }), Fr = (n) => /* @__PURE__ */ s(ue, { tenant: "forbidden", ...n }), Ur = (n) => /* @__PURE__ */ s(ue, { auth: "required", ...n }), $r = (n) => /* @__PURE__ */ s(ue, { auth: "forbidden", ...n }), Cr = (n) => /* @__PURE__ */ s(ue, { auth: "required", userType: ae.TENANT_ADMIN, ...n }), Hr = (n) => /* @__PURE__ */ s(ue, { auth: "required", userType: ae.USER, ...n }), Br = (n) => /* @__PURE__ */ s(ue, { tenant: "optional", auth: "optional", ...n }), Or = (n) => /* @__PURE__ */ s(ue, { tenant: "required", auth: "required", ...n }), qr = (n) => /* @__PURE__ */ s(ue, { tenant: "required", auth: "optional", ...n }), _r = (n) => /* @__PURE__ */ s(ue, { tenant: "required", auth: "forbidden", ...n }), Vt = () => /* @__PURE__ */ u(
+}, Fr = (n) => /* @__PURE__ */ s(ue, { tenant: "required", ...n }), Dr = (n) => /* @__PURE__ */ s(ue, { tenant: "forbidden", ...n }), Ur = (n) => /* @__PURE__ */ s(ue, { auth: "required", ...n }), Br = (n) => /* @__PURE__ */ s(ue, { auth: "forbidden", ...n }), $r = (n) => /* @__PURE__ */ s(ue, { auth: "required", userType: ae.TENANT_ADMIN, ...n }), Cr = (n) => /* @__PURE__ */ s(ue, { auth: "required", userType: ae.USER, ...n }), Hr = (n) => /* @__PURE__ */ s(ue, { tenant: "optional", auth: "optional", ...n }), Or = (n) => /* @__PURE__ */ s(ue, { tenant: "required", auth: "required", ...n }), qr = (n) => /* @__PURE__ */ s(ue, { tenant: "required", auth: "optional", ...n }), _r = (n) => /* @__PURE__ */ s(ue, { tenant: "required", auth: "forbidden", ...n }), Vt = () => /* @__PURE__ */ u(
   "div",
   {
     style: {
@@ -2391,10 +2404,10 @@ const jt = () => /* @__PURE__ */ u(
       /* @__PURE__ */ s("line", { x1: "1", y1: "1", x2: "23", y2: "23" })
     ]
   }
-), Qt = {
+), Kt = {
   showPassword: /* @__PURE__ */ s(jt, {}),
   hidePassword: /* @__PURE__ */ s(Gt, {})
-}, Kt = {
+}, Qt = {
   title: "Sign In",
   usernameLabel: "Email or Phone",
   usernamePlaceholder: "Enter your email or phone number",
@@ -2534,14 +2547,14 @@ function Wr({
   showForgotPassword: m = !0,
   showSignupLink: y = !0,
   showMagicLinkOption: f = !0,
-  className: D
+  className: F
 }) {
-  const [g, T] = x(""), [A, L] = x(""), [M, P] = x(!1), [d, v] = x(!1), [N, $] = x(""), [w, R] = x({}), { login: k } = he(), I = { ...Kt, ...n }, l = { ...Zt, ...e }, z = { ...Qt, ...t }, F = () => {
+  const [g, T] = x(""), [A, L] = x(""), [M, P] = x(!1), [d, v] = x(!1), [N, B] = x(""), [w, R] = x({}), { login: k } = he(), I = { ...Qt, ...n }, l = { ...Zt, ...e }, z = { ...Kt, ...t }, D = () => {
     const h = {};
     return g.trim() || (h.username = !0), A.trim() || (h.password = !0), R(h), Object.keys(h).length === 0;
   }, p = async (h) => {
-    if (h.preventDefault(), !!F()) {
-      v(!0), $("");
+    if (h.preventDefault(), !!D()) {
+      v(!0), B("");
       try {
         const S = await k({
           username: g,
@@ -2551,7 +2564,7 @@ function Wr({
         r == null || r(S);
       } catch (S) {
         const E = S.message || I.errorMessage;
-        $(E), i == null || i(E);
+        B(E), i == null || i(E);
       } finally {
         v(!1);
       }
@@ -2564,7 +2577,7 @@ function Wr({
     ...d ? l.buttonLoading : {},
     ...!g || !A || d ? l.buttonDisabled : {}
   });
-  return /* @__PURE__ */ u("div", { className: D, style: l.container, children: [
+  return /* @__PURE__ */ u("div", { className: F, style: l.container, children: [
     /* @__PURE__ */ s("h2", { style: l.title, children: I.title }),
     /* @__PURE__ */ u("form", { onSubmit: p, style: l.form, children: [
       /* @__PURE__ */ u("div", { style: l.fieldGroup, children: [
@@ -2790,11 +2803,11 @@ function jr({
   className: y
 }) {
   var V;
-  const [f, D] = x(""), [g, T] = x(""), [A, L] = x(""), [M, P] = x(""), [d, v] = x(""), [N, $] = x(""), [w, R] = x(""), [k, I] = x(!1), [l, z] = x(""), [F, p] = x({}), { signup: U, signupTenantAdmin: b } = he(), h = ((V = pe()) == null ? void 0 : V.tenant) ?? null, S = { ...Jt, ...n }, E = { ...Yt, ...e }, Q = () => {
-    const B = {};
-    return f.trim() || (B.name = !0), !A.trim() && !M.trim() && (B.email = !0, B.phoneNumber = !0), d.trim() || (B.password = !0), N.trim() || (B.confirmPassword = !0), t === "tenant" && !w.trim() && (B.tenantName = !0), p(B), Object.keys(B).length === 0;
-  }, G = async (B) => {
-    if (B.preventDefault(), !!Q()) {
+  const [f, F] = x(""), [g, T] = x(""), [A, L] = x(""), [M, P] = x(""), [d, v] = x(""), [N, B] = x(""), [w, R] = x(""), [k, I] = x(!1), [l, z] = x(""), [D, p] = x({}), { signup: U, signupTenantAdmin: b } = he(), h = ((V = pe()) == null ? void 0 : V.tenant) ?? null, S = { ...Jt, ...n }, E = { ...Yt, ...e }, K = () => {
+    const H = {};
+    return f.trim() || (H.name = !0), !A.trim() && !M.trim() && (H.email = !0, H.phoneNumber = !0), d.trim() || (H.password = !0), N.trim() || (H.confirmPassword = !0), t === "tenant" && !w.trim() && (H.tenantName = !0), p(H), Object.keys(H).length === 0;
+  }, G = async (H) => {
+    if (H.preventDefault(), !!K()) {
       if (d !== N) {
         z(S.passwordMismatchError), p({ confirmPassword: !0 });
         return;
@@ -2805,32 +2818,32 @@ function jr({
       }
       I(!0), z("");
       try {
-        let C;
-        t === "tenant" ? C = await b({
+        let $;
+        t === "tenant" ? $ = await b({
           email: A || void 0,
           phoneNumber: M || void 0,
           name: f,
           password: d,
           tenantName: w,
           lastName: g || void 0
-        }) : C = await U({
+        }) : $ = await U({
           email: A || void 0,
           phoneNumber: M || void 0,
           name: f,
           password: d,
           tenantId: h.id,
           lastName: g || void 0
-        }), r == null || r(C);
-      } catch (C) {
-        const ce = C.message || S.errorMessage;
+        }), r == null || r($);
+      } catch ($) {
+        const ce = $.message || S.errorMessage;
         z(ce), i == null || i(ce);
       } finally {
         I(!1);
       }
     }
-  }, X = (B) => ({
+  }, X = (H) => ({
     ...E.input,
-    ...F[B] ? E.inputError : {}
+    ...D[H] ? E.inputError : {}
   }), W = () => ({
     ...E.button,
     ...k ? E.buttonLoading : {},
@@ -2848,8 +2861,8 @@ function jr({
             name: "name",
             type: "text",
             value: f,
-            onChange: (B) => {
-              D(B.target.value), F.name && p((C) => ({ ...C, name: !1 }));
+            onChange: (H) => {
+              F(H.target.value), D.name && p(($) => ({ ...$, name: !1 }));
             },
             placeholder: S.namePlaceholder,
             style: X("name"),
@@ -2866,7 +2879,7 @@ function jr({
             name: "lastName",
             type: "text",
             value: g,
-            onChange: (B) => T(B.target.value),
+            onChange: (H) => T(H.target.value),
             placeholder: S.lastNamePlaceholder,
             style: E.input,
             disabled: k
@@ -2882,8 +2895,8 @@ function jr({
             name: "email",
             type: "email",
             value: A,
-            onChange: (B) => {
-              L(B.target.value), F.email && p((C) => ({ ...C, email: !1, phoneNumber: !1 }));
+            onChange: (H) => {
+              L(H.target.value), D.email && p(($) => ({ ...$, email: !1, phoneNumber: !1 }));
             },
             placeholder: S.emailPlaceholder,
             style: X("email"),
@@ -2900,8 +2913,8 @@ function jr({
             name: "phoneNumber",
             type: "tel",
             value: M,
-            onChange: (B) => {
-              P(B.target.value), F.phoneNumber && p((C) => ({ ...C, email: !1, phoneNumber: !1 }));
+            onChange: (H) => {
+              P(H.target.value), D.phoneNumber && p(($) => ({ ...$, email: !1, phoneNumber: !1 }));
             },
             placeholder: S.phoneNumberPlaceholder,
             style: X("phoneNumber"),
@@ -2919,8 +2932,8 @@ function jr({
             name: "password",
             type: "password",
             value: d,
-            onChange: (B) => {
-              v(B.target.value), F.password && p((C) => ({ ...C, password: !1 }));
+            onChange: (H) => {
+              v(H.target.value), D.password && p(($) => ({ ...$, password: !1 }));
             },
             placeholder: S.passwordPlaceholder,
             style: X("password"),
@@ -2937,8 +2950,8 @@ function jr({
             name: "confirmPassword",
             type: "password",
             value: N,
-            onChange: (B) => {
-              $(B.target.value), F.confirmPassword && p((C) => ({ ...C, confirmPassword: !1 })), l === S.passwordMismatchError && z("");
+            onChange: (H) => {
+              B(H.target.value), D.confirmPassword && p(($) => ({ ...$, confirmPassword: !1 })), l === S.passwordMismatchError && z("");
             },
             placeholder: S.confirmPasswordPlaceholder,
             style: X("confirmPassword"),
@@ -2955,8 +2968,8 @@ function jr({
             name: "tenantName",
             type: "text",
             value: w,
-            onChange: (B) => {
-              R(B.target.value), F.tenantName && p((C) => ({ ...C, tenantName: !1 }));
+            onChange: (H) => {
+              R(H.target.value), D.tenantName && p(($) => ({ ...$, tenantName: !1 }));
             },
             placeholder: S.tenantNamePlaceholder,
             style: X("tenantName"),
@@ -3146,16 +3159,16 @@ function Gr({
   frontendUrl: y
 }) {
   var W;
-  const [f, D] = x(""), [g, T] = x(""), [A, L] = x(""), [M, P] = x(!1), [d, v] = x(!1), [N, $] = x(""), [w, R] = x(""), [k, I] = x({}), [l, z] = x(!1), { sendMagicLink: F, verifyMagicLink: p } = he(), U = ((W = pe()) == null ? void 0 : W.tenant) ?? null, b = { ...Xt, ...n }, h = { ...er, ...e };
+  const [f, F] = x(""), [g, T] = x(""), [A, L] = x(""), [M, P] = x(!1), [d, v] = x(!1), [N, B] = x(""), [w, R] = x(""), [k, I] = x({}), [l, z] = x(!1), { sendMagicLink: D, verifyMagicLink: p } = he(), U = ((W = pe()) == null ? void 0 : W.tenant) ?? null, b = { ...Xt, ...n }, h = { ...er, ...e };
   ne(() => {
     m && S(m);
   }, [m]);
   const S = async (q) => {
     if (!U || !f) {
-      $(b.missingTenantOrEmailError);
+      B(b.missingTenantOrEmailError);
       return;
     }
-    v(!0), $("");
+    v(!0), B("");
     try {
       const V = await p({
         token: q,
@@ -3164,33 +3177,33 @@ function Gr({
       });
       t == null || t(V);
     } catch (V) {
-      const B = V.message || "Failed to verify magic link";
-      $(B), r == null || r(B);
+      const H = V.message || "Failed to verify magic link";
+      B(H), r == null || r(H);
     } finally {
       v(!1);
     }
   }, E = () => {
     const q = {};
     return f.trim() || (q.email = !0), l && !g.trim() && (q.name = !0), I(q), Object.keys(q).length === 0;
-  }, Q = async (q) => {
+  }, K = async (q) => {
     if (q.preventDefault(), !!E()) {
       if (!(U != null && U.id)) {
-        $(b.tenantNotFoundError);
+        B(b.tenantNotFoundError);
         return;
       }
-      P(!0), $(""), R("");
+      P(!0), B(""), R("");
       try {
-        const V = y || (typeof window < "u" ? window.location.origin : ""), B = await F({
+        const V = y || (typeof window < "u" ? window.location.origin : ""), H = await D({
           email: f,
           tenantId: U.id,
           frontendUrl: V,
           name: l ? g : void 0,
           lastName: l ? A : void 0
         });
-        R(b.successMessage), t == null || t(B);
+        R(b.successMessage), t == null || t(H);
       } catch (V) {
-        const B = V.message || b.errorMessage;
-        $(B), r == null || r(B);
+        const H = V.message || b.errorMessage;
+        B(H), r == null || r(H);
       } finally {
         P(!1);
       }
@@ -3209,7 +3222,7 @@ function Gr({
   ] }) : /* @__PURE__ */ u("div", { className: c, style: h.container, children: [
     /* @__PURE__ */ s("h2", { style: h.title, children: b.title }),
     /* @__PURE__ */ s("p", { style: h.description, children: b.description }),
-    /* @__PURE__ */ u("form", { onSubmit: Q, style: h.form, children: [
+    /* @__PURE__ */ u("form", { onSubmit: K, style: h.form, children: [
       /* @__PURE__ */ u("div", { style: h.fieldGroup, children: [
         /* @__PURE__ */ s("label", { style: h.label, children: b.emailLabel }),
         /* @__PURE__ */ s(
@@ -3220,7 +3233,7 @@ function Gr({
             type: "email",
             value: f,
             onChange: (q) => {
-              D(q.target.value), k.email && I((V) => ({ ...V, email: !1 }));
+              F(q.target.value), k.email && I((V) => ({ ...V, email: !1 }));
             },
             placeholder: b.emailPlaceholder,
             style: G("email"),
@@ -3449,7 +3462,7 @@ const tr = {
   success: /* @__PURE__ */ s(nr, {}),
   error: /* @__PURE__ */ s(sr, {})
 };
-function Qr({
+function Kr({
   copy: n = {},
   styles: e = {},
   icons: t = {},
@@ -3461,22 +3474,22 @@ function Qr({
   token: m,
   email: y,
   appId: f,
-  tenantSlug: D,
+  tenantSlug: F,
   autoRedirectDelay: g = 3e3
 }) {
-  const [T, A] = x("verifying"), [L, M] = x(""), { verifyMagicLink: P } = he(), d = { ...tr, ...n }, v = { ...tt, ...e }, N = { ...ir, ...t }, $ = () => {
+  const [T, A] = x("verifying"), [L, M] = x(""), { verifyMagicLink: P } = he(), d = { ...tr, ...n }, v = { ...tt, ...e }, N = { ...ir, ...t }, B = () => {
     if (typeof window > "u") return {};
     const l = new URLSearchParams(window.location.search);
     return {
       token: m || l.get("token") || "",
       email: y || l.get("email") || "",
       appId: f || l.get("appId") || "",
-      tenantSlug: D || l.get("tenantSlug") || void 0
+      tenantSlug: F || l.get("tenantSlug") || void 0
     };
   }, w = async () => {
     A("verifying"), M("");
     try {
-      const l = $();
+      const l = B();
       if (!l.token || !l.email)
         throw new Error(d.missingParamsError);
       const z = await P({
@@ -3531,8 +3544,8 @@ function Qr({
                 },
                 onMouseOut: (l) => {
                   const z = v.retryButton || {};
-                  Object.keys(v.retryButtonHover || {}).forEach((F) => {
-                    l.currentTarget.style[F] = z[F] ?? "";
+                  Object.keys(v.retryButtonHover || {}).forEach((D) => {
+                    l.currentTarget.style[D] = z[D] ?? "";
                   });
                 },
                 children: d.retryButton
@@ -3548,8 +3561,8 @@ function Qr({
                 },
                 onMouseOut: (l) => {
                   const z = v.backButton || {};
-                  Object.keys(v.backButtonHover || {}).forEach((F) => {
-                    l.currentTarget.style[F] = z[F] ?? "";
+                  Object.keys(v.backButtonHover || {}).forEach((D) => {
+                    l.currentTarget.style[D] = z[D] ?? "";
                   });
                 },
                 children: d.backToLoginButton
@@ -3694,7 +3707,7 @@ const or = {
     color: "#6b7280"
   }
 };
-function Kr({
+function Qr({
   copy: n = {},
   styles: e = {},
   mode: t = "request",
@@ -3706,23 +3719,23 @@ function Kr({
   className: m
 }) {
   var X;
-  const [y, f] = x(""), [D, g] = x(r), [T, A] = x(""), [L, M] = x(""), [P, d] = x(!1), [v, N] = x(""), [$, w] = x(""), [R, k] = x({}), { requestPasswordReset: I, confirmPasswordReset: l } = he(), z = ((X = pe()) == null ? void 0 : X.tenant) ?? null, F = { ...or, ...n }, p = { ...ar, ...e }, U = () => {
+  const [y, f] = x(""), [F, g] = x(r), [T, A] = x(""), [L, M] = x(""), [P, d] = x(!1), [v, N] = x(""), [B, w] = x(""), [R, k] = x({}), { requestPasswordReset: I, confirmPasswordReset: l } = he(), z = ((X = pe()) == null ? void 0 : X.tenant) ?? null, D = { ...or, ...n }, p = { ...ar, ...e }, U = () => {
     const W = {};
     return y.trim() || (W.email = !0), k(W), Object.keys(W).length === 0;
   }, b = () => {
     const W = {};
-    return D.trim() || (W.token = !0), T.trim() || (W.newPassword = !0), L.trim() || (W.confirmPassword = !0), k(W), Object.keys(W).length === 0;
+    return F.trim() || (W.token = !0), T.trim() || (W.newPassword = !0), L.trim() || (W.confirmPassword = !0), k(W), Object.keys(W).length === 0;
   }, h = async (W) => {
     if (W.preventDefault(), !!U()) {
       if (!(z != null && z.id)) {
-        N(F.tenantNotFoundError);
+        N(D.tenantNotFoundError);
         return;
       }
       d(!0), N(""), w("");
       try {
-        await I({ email: y, tenantId: z.id }), w(F.successMessage), i == null || i();
+        await I({ email: y, tenantId: z.id }), w(D.successMessage), i == null || i();
       } catch (q) {
-        const V = q.message || F.errorMessage;
+        const V = q.message || D.errorMessage;
         N(V), o == null || o(V);
       } finally {
         d(!1);
@@ -3731,14 +3744,14 @@ function Kr({
   }, S = async (W) => {
     if (W.preventDefault(), !!b()) {
       if (T !== L) {
-        N(F.passwordMismatchError), k({ confirmPassword: !0 });
+        N(D.passwordMismatchError), k({ confirmPassword: !0 });
         return;
       }
       d(!0), N(""), w("");
       try {
-        await l({ token: D, newPassword: T }), w(F.resetSuccessMessage), i == null || i();
+        await l({ token: F, newPassword: T }), w(D.resetSuccessMessage), i == null || i();
       } catch (q) {
-        const V = q.message || F.errorMessage;
+        const V = q.message || D.errorMessage;
         N(V), o == null || o(V);
       } finally {
         d(!1);
@@ -3747,34 +3760,34 @@ function Kr({
   }, E = (W) => ({
     ...p.input,
     ...R[W] ? p.inputError : {}
-  }), Q = () => ({
+  }), K = () => ({
     ...p.button,
     ...P ? p.buttonLoading : {}
   });
   if (t === "reset") {
-    const W = D && T && L;
+    const W = F && T && L;
     return /* @__PURE__ */ u("div", { className: m, style: p.container, children: [
-      /* @__PURE__ */ s("h2", { style: p.title, children: F.resetTitle }),
-      /* @__PURE__ */ s("p", { style: p.subtitle, children: F.resetSubtitle }),
+      /* @__PURE__ */ s("h2", { style: p.title, children: D.resetTitle }),
+      /* @__PURE__ */ s("p", { style: p.subtitle, children: D.resetSubtitle }),
       /* @__PURE__ */ u("form", { onSubmit: S, style: p.form, children: [
         /* @__PURE__ */ u("div", { style: p.fieldGroup, children: [
-          /* @__PURE__ */ s("label", { style: p.label, children: F.tokenLabel }),
+          /* @__PURE__ */ s("label", { style: p.label, children: D.tokenLabel }),
           /* @__PURE__ */ s(
             "input",
             {
               type: "text",
-              value: D,
+              value: F,
               onChange: (q) => {
                 g(q.target.value), R.token && k((V) => ({ ...V, token: !1 }));
               },
-              placeholder: F.tokenPlaceholder,
+              placeholder: D.tokenPlaceholder,
               style: E("token"),
               disabled: P
             }
           )
         ] }),
         /* @__PURE__ */ u("div", { style: p.fieldGroup, children: [
-          /* @__PURE__ */ s("label", { style: p.label, children: F.newPasswordLabel }),
+          /* @__PURE__ */ s("label", { style: p.label, children: D.newPasswordLabel }),
           /* @__PURE__ */ s(
             "input",
             {
@@ -3783,23 +3796,23 @@ function Kr({
               onChange: (q) => {
                 A(q.target.value), R.newPassword && k((V) => ({ ...V, newPassword: !1 }));
               },
-              placeholder: F.newPasswordPlaceholder,
+              placeholder: D.newPasswordPlaceholder,
               style: E("newPassword"),
               disabled: P
             }
           )
         ] }),
         /* @__PURE__ */ u("div", { style: p.fieldGroup, children: [
-          /* @__PURE__ */ s("label", { style: p.label, children: F.confirmPasswordLabel }),
+          /* @__PURE__ */ s("label", { style: p.label, children: D.confirmPasswordLabel }),
           /* @__PURE__ */ s(
             "input",
             {
               type: "password",
               value: L,
               onChange: (q) => {
-                M(q.target.value), R.confirmPassword && k((V) => ({ ...V, confirmPassword: !1 })), v === F.passwordMismatchError && N("");
+                M(q.target.value), R.confirmPassword && k((V) => ({ ...V, confirmPassword: !1 })), v === D.passwordMismatchError && N("");
               },
-              placeholder: F.confirmPasswordPlaceholder,
+              placeholder: D.confirmPasswordPlaceholder,
               style: E("confirmPassword"),
               disabled: P
             }
@@ -3811,31 +3824,31 @@ function Kr({
             type: "submit",
             disabled: !W || P,
             style: {
-              ...Q(),
+              ...K(),
               ...!W || P ? p.buttonDisabled : {}
             },
-            children: P ? F.resetLoadingText : F.resetSubmitButton
+            children: P ? D.resetLoadingText : D.resetSubmitButton
           }
         ),
         v && /* @__PURE__ */ s("div", { style: p.errorText, children: v }),
-        $ && /* @__PURE__ */ s("div", { style: p.successText, children: $ })
+        B && /* @__PURE__ */ s("div", { style: p.successText, children: B })
       ] }),
       /* @__PURE__ */ u("div", { style: p.linkContainer, children: [
-        /* @__PURE__ */ s("a", { onClick: a, style: p.link, children: F.backToLoginLink }),
+        /* @__PURE__ */ s("a", { onClick: a, style: p.link, children: D.backToLoginLink }),
         c && /* @__PURE__ */ u(_, { children: [
-          /* @__PURE__ */ s("span", { style: p.modeSwitchDivider, children: F.dividerBullet }),
-          /* @__PURE__ */ s("a", { onClick: () => c("request"), style: p.link, children: F.requestNewLinkLink })
+          /* @__PURE__ */ s("span", { style: p.modeSwitchDivider, children: D.dividerBullet }),
+          /* @__PURE__ */ s("a", { onClick: () => c("request"), style: p.link, children: D.requestNewLinkLink })
         ] })
       ] })
     ] });
   }
   const G = y;
   return /* @__PURE__ */ u("div", { className: m, style: p.container, children: [
-    /* @__PURE__ */ s("h2", { style: p.title, children: F.title }),
-    /* @__PURE__ */ s("p", { style: p.subtitle, children: F.subtitle }),
+    /* @__PURE__ */ s("h2", { style: p.title, children: D.title }),
+    /* @__PURE__ */ s("p", { style: p.subtitle, children: D.subtitle }),
     /* @__PURE__ */ u("form", { onSubmit: h, style: p.form, children: [
       /* @__PURE__ */ u("div", { style: p.fieldGroup, children: [
-        /* @__PURE__ */ s("label", { style: p.label, children: F.emailLabel }),
+        /* @__PURE__ */ s("label", { style: p.label, children: D.emailLabel }),
         /* @__PURE__ */ s(
           "input",
           {
@@ -3844,7 +3857,7 @@ function Kr({
             onChange: (W) => {
               f(W.target.value), R.email && k((q) => ({ ...q, email: !1 }));
             },
-            placeholder: F.emailPlaceholder,
+            placeholder: D.emailPlaceholder,
             style: E("email"),
             disabled: P
           }
@@ -3856,20 +3869,20 @@ function Kr({
           type: "submit",
           disabled: !G || P,
           style: {
-            ...Q(),
+            ...K(),
             ...!G || P ? p.buttonDisabled : {}
           },
-          children: P ? F.loadingText : F.submitButton
+          children: P ? D.loadingText : D.submitButton
         }
       ),
       v && /* @__PURE__ */ s("div", { style: p.errorText, children: v }),
-      $ && /* @__PURE__ */ s("div", { style: p.successText, children: $ })
+      B && /* @__PURE__ */ s("div", { style: p.successText, children: B })
     ] }),
     /* @__PURE__ */ u("div", { style: p.linkContainer, children: [
-      /* @__PURE__ */ s("a", { onClick: a, style: p.link, children: F.backToLoginLink }),
+      /* @__PURE__ */ s("a", { onClick: a, style: p.link, children: D.backToLoginLink }),
       c && /* @__PURE__ */ u(_, { children: [
-        /* @__PURE__ */ s("span", { style: p.modeSwitchDivider, children: F.dividerBullet }),
-        /* @__PURE__ */ s("a", { onClick: () => c("reset"), style: p.link, children: F.haveTokenLink })
+        /* @__PURE__ */ s("span", { style: p.modeSwitchDivider, children: D.dividerBullet }),
+        /* @__PURE__ */ s("a", { onClick: () => c("reset"), style: p.link, children: D.haveTokenLink })
       ] })
     ] })
   ] });
@@ -3926,8 +3939,8 @@ function Zr({
   errorFallback: t,
   requireTenant: r = !0
 }) {
-  const { isAppLoading: i, appError: o, retryApp: a } = Ae(), c = pe(), m = Ce(), y = Ye(), f = Xe(), D = (c == null ? void 0 : c.isTenantLoading) ?? !1, g = (c == null ? void 0 : c.tenantError) ?? null, T = (c == null ? void 0 : c.tenantSlug) ?? null, A = (c == null ? void 0 : c.retryTenant) ?? (() => {
-  }), L = (m == null ? void 0 : m.isAuthReady) ?? !0, M = (y == null ? void 0 : y.isReady) ?? !0, P = (f == null ? void 0 : f.isReady) ?? !0, d = r && c && T, w = i || d && D || m && !L || y && !M || f && !P, R = o || (d ? g : null), k = () => {
+  const { isAppLoading: i, appError: o, retryApp: a } = Ae(), c = pe(), m = $e(), y = Ye(), f = Xe(), F = (c == null ? void 0 : c.isTenantLoading) ?? !1, g = (c == null ? void 0 : c.tenantError) ?? null, T = (c == null ? void 0 : c.tenantSlug) ?? null, A = (c == null ? void 0 : c.retryTenant) ?? (() => {
+  }), L = (m == null ? void 0 : m.isAuthReady) ?? !0, M = (y == null ? void 0 : y.isReady) ?? !0, P = (f == null ? void 0 : f.isReady) ?? !0, d = r && c && T, w = i || d && F || m && !L || y && !M || f && !P, R = o || (d ? g : null), k = () => {
     o && a(), g && c && A();
   };
   if (w)
@@ -3939,18 +3952,18 @@ function Zr({
   return /* @__PURE__ */ s(_, { children: n });
 }
 function Jr(n = !0) {
-  const { isAppLoading: e, appError: t, retryApp: r, appInfo: i } = Ae(), o = pe(), a = Ce(), c = Ye(), m = Xe(), y = (o == null ? void 0 : o.isTenantLoading) ?? !1, f = (o == null ? void 0 : o.tenantError) ?? null, D = (o == null ? void 0 : o.tenant) ?? null, g = (o == null ? void 0 : o.tenantSlug) ?? null, T = (o == null ? void 0 : o.retryTenant) ?? (() => {
-  }), A = (a == null ? void 0 : a.isAuthReady) ?? !0, L = (c == null ? void 0 : c.isReady) ?? !0, M = (m == null ? void 0 : m.isReady) ?? !0, P = n && o && g, $ = e || P && y || a && !A || c && !L || m && !M, w = t || (P ? f : null);
+  const { isAppLoading: e, appError: t, retryApp: r, appInfo: i } = Ae(), o = pe(), a = $e(), c = Ye(), m = Xe(), y = (o == null ? void 0 : o.isTenantLoading) ?? !1, f = (o == null ? void 0 : o.tenantError) ?? null, F = (o == null ? void 0 : o.tenant) ?? null, g = (o == null ? void 0 : o.tenantSlug) ?? null, T = (o == null ? void 0 : o.retryTenant) ?? (() => {
+  }), A = (a == null ? void 0 : a.isAuthReady) ?? !0, L = (c == null ? void 0 : c.isReady) ?? !0, M = (m == null ? void 0 : m.isReady) ?? !0, P = n && o && g, B = e || P && y || a && !A || c && !L || m && !M, w = t || (P ? f : null);
   return {
-    isLoading: $,
+    isLoading: B,
     error: w,
-    isReady: !$ && !w && i !== null && (!P || D !== null),
+    isReady: !B && !w && i !== null && (!P || F !== null),
     retry: () => {
       t && r(), f && o && T();
     },
     // Individual states
     app: { isLoading: e, error: t, data: i },
-    tenant: o ? { isLoading: y, error: f, data: D } : null,
+    tenant: o ? { isLoading: y, error: f, data: F } : null,
     auth: a ? { isReady: A } : null,
     featureFlags: c ? { isReady: L } : null,
     subscription: m ? { isReady: M } : null
@@ -4013,8 +4026,8 @@ function Yr({
   disabled: y = !1,
   showCurrentTenant: f = !0
 }) {
-  var $;
-  const D = { ...dr, ...r }, g = Ce(), [T, A] = x(!1), L = Ne(null), M = n ?? (g == null ? void 0 : g.userTenants) ?? [], P = e ?? (($ = g == null ? void 0 : g.currentUser) == null ? void 0 : $.tenantId) ?? null, d = async (w) => {
+  var B;
+  const F = { ...dr, ...r }, g = $e(), [T, A] = x(!1), L = Ne(null), M = n ?? (g == null ? void 0 : g.userTenants) ?? [], P = e ?? ((B = g == null ? void 0 : g.currentUser) == null ? void 0 : B.tenantId) ?? null, d = async (w) => {
     A(!1), t ? t(w) : g != null && g.switchToTenant && await g.switchToTenant(w);
   };
   ne(() => {
@@ -4030,13 +4043,13 @@ function Yr({
     return /* @__PURE__ */ s("div", { className: i, children: /* @__PURE__ */ s("span", { children: M[0].name }) });
   const N = (w, R) => /* @__PURE__ */ u("span", { style: { fontWeight: R ? "bold" : "normal" }, children: [
     w.name,
-    w.role && /* @__PURE__ */ u("span", { style: D.itemRole, children: [
+    w.role && /* @__PURE__ */ u("span", { style: F.itemRole, children: [
       "(",
       w.role,
       ")"
     ] })
   ] });
-  return /* @__PURE__ */ u("div", { ref: L, className: i, style: D.wrapper, children: [
+  return /* @__PURE__ */ u("div", { ref: L, className: i, style: F.wrapper, children: [
     /* @__PURE__ */ u(
       "button",
       {
@@ -4044,16 +4057,16 @@ function Yr({
         onClick: () => !y && A(!T),
         disabled: y,
         style: {
-          ...D.button,
-          ...y ? D.buttonDisabled : {}
+          ...F.button,
+          ...y ? F.buttonDisabled : {}
         },
         children: [
           v ? v.name : m,
-          /* @__PURE__ */ s("span", { style: D.arrow, children: T ? "▲" : "▼" })
+          /* @__PURE__ */ s("span", { style: F.arrow, children: T ? "▲" : "▼" })
         ]
       }
     ),
-    T && /* @__PURE__ */ s("div", { className: o, style: D.dropdown, children: M.map((w) => {
+    T && /* @__PURE__ */ s("div", { className: o, style: F.dropdown, children: M.map((w) => {
       const R = w.id === P;
       return /* @__PURE__ */ s(
         "div",
@@ -4061,16 +4074,16 @@ function Yr({
           className: a,
           onClick: () => d(w.id),
           style: {
-            ...D.item,
-            ...R ? D.itemSelected : {}
+            ...F.item,
+            ...R ? F.itemSelected : {}
           },
           onMouseEnter: (k) => {
-            R || Object.assign(k.currentTarget.style, D.itemHover);
+            R || Object.assign(k.currentTarget.style, F.itemHover);
           },
           onMouseLeave: (k) => {
             if (!R) {
-              const I = D.item || {};
-              Object.keys(D.itemHover || {}).forEach((l) => {
+              const I = F.item || {};
+              Object.keys(F.itemHover || {}).forEach((l) => {
                 k.currentTarget.style[l] = I[l] ?? "";
               });
             }
@@ -4338,7 +4351,7 @@ function nn(n = {}) {
     zoneRoots: e = {},
     returnToParam: t = rt,
     returnToStorage: r = "url"
-  } = n, i = mt(), [o, a] = yt(), { isAuthenticated: c, currentUser: m } = he(), { tenant: y } = Te(), f = Z(() => ({ ...Oe, ...e }), [e]), D = !!y, g = m == null ? void 0 : m.userType, T = Z(() => {
+  } = n, i = mt(), [o, a] = yt(), { isAuthenticated: c, currentUser: m } = he(), { tenant: y } = Te(), f = Z(() => ({ ...Oe, ...e }), [e]), F = !!y, g = m == null ? void 0 : m.userType, T = Z(() => {
     switch (r) {
       case "url":
         return o.get(t);
@@ -4349,7 +4362,7 @@ function nn(n = {}) {
       default:
         return null;
     }
-  }, [r, o, t]), A = ie(() => {
+  }, [r, o, t]), A = oe(() => {
     switch (r) {
       case "url": {
         const d = new URLSearchParams(o);
@@ -4363,7 +4376,7 @@ function nn(n = {}) {
         localStorage.removeItem(Le);
         break;
     }
-  }, [r, o, t, a]), L = ie(
+  }, [r, o, t, a]), L = oe(
     (d) => {
       switch (r) {
         case "url": {
@@ -4380,13 +4393,13 @@ function nn(n = {}) {
       }
     },
     [r, o, t, a]
-  ), M = ie(
+  ), M = oe(
     (d) => {
       const v = f[d] || f.default;
       i(v);
     },
     [i, f]
-  ), P = ie(() => D ? c ? g === ae.TENANT_ADMIN ? f.tenantAdmin : f.tenantUser : f.tenantGuest : c ? g === ae.TENANT_ADMIN ? f.publicAdmin : f.publicUser : f.publicGuest, [D, c, g, f]);
+  ), P = oe(() => F ? c ? g === ae.TENANT_ADMIN ? f.tenantAdmin : f.tenantUser : f.tenantGuest : c ? g === ae.TENANT_ADMIN ? f.publicAdmin : f.publicUser : f.publicGuest, [F, c, g, f]);
   return {
     returnToUrl: T,
     clearReturnTo: A,
@@ -4402,7 +4415,7 @@ function sn(n, e, t = rt, r = "url") {
   return i.searchParams.set(t, e), i.pathname + i.search;
 }
 export {
-  Cr as AdminZone,
+  $r as AdminZone,
   rn as ApiMappers,
   Ve as AppApiService,
   Zr as AppLoader,
@@ -4415,19 +4428,19 @@ export {
   Vr as FeatureFlag,
   It as FeatureFlagApiService,
   Ar as FeatureFlagProvider,
-  $r as GuestZone,
+  Br as GuestZone,
   tn as HealthApiService,
   de as HttpService,
   Nr as LandingRoute,
   Wr as LoginForm,
   Gr as MagicLinkForm,
-  Qr as MagicLinkVerify,
-  Br as OpenZone,
-  Kr as PasswordRecoveryForm,
+  Kr as MagicLinkVerify,
+  Hr as OpenZone,
+  Qr as PasswordRecoveryForm,
   Xr as PermissionApiService,
   Ir as Protected,
   Mr as ProtectedRoute,
-  Fr as PublicZone,
+  Dr as PublicZone,
   We as RoleApiService,
   Rr as RoutingProvider,
   se as SessionExpiredError,
@@ -4444,12 +4457,12 @@ export {
   Sr as TenantProvider,
   Lr as TenantRoute,
   Yr as TenantSelector,
-  Dr as TenantZone,
+  Fr as TenantZone,
   bt as TokenRefreshError,
   wt as TokenRefreshTimeoutError,
   St as UserApiService,
   ae as UserType,
-  Hr as UserZone,
+  Cr as UserZone,
   ue as ZoneRoute,
   sn as buildRedirectUrl,
   vr as useApi,
@@ -4458,7 +4471,7 @@ export {
   he as useAuth,
   Mt as useFeatureFlags,
   Er as useRouting,
-  Dt as useRoutingOptional,
+  Ft as useRoutingOptional,
   kr as useSettings,
   Nt as useSubscription,
   Te as useTenant,