@skylabs-digital/react-identity-access 3.2.1 → 3.2.3

package/dist/index.es.js

@@ -1,6 +1,6 @@
-import { jsx as s, Fragment as B, jsxs as f } from "react/jsx-runtime";
-import me, { createContext as fe, useState as N, useRef as Ee, useCallback as te, useMemo as V, useEffect as re, useContext as ne } from "react";
-import { useLocation as xe, Navigate as be, useNavigate as wt, useSearchParams as vt } from "react-router-dom";
+import { jsx as s, Fragment as U, jsxs as f } from "react/jsx-runtime";
+import me, { createContext as fe, useState as N, useRef as ye, useCallback as te, useMemo as V, useEffect as re, useContext as ne } from "react";
+import { useLocation as xe, Navigate as we, useNavigate as vt, useSearchParams as Tt } from "react-router-dom";
 class he {
   constructor(e, t = 1e4) {
     this.baseUrl = e.replace(/\/$/, ""), this.timeout = t;
@@ -11,30 +11,37 @@ class he {
   getBaseUrl() {
     return this.baseUrl;
   }
-  async executeRequest(e, t, n, i) {
-    const a = `${this.baseUrl}${t.startsWith("/") ? t : `/${t}`}`, l = (i == null ? void 0 : i.timeout) || this.timeout;
-    let d = {
+  async executeRequest(e, t, n, i, a = !1) {
+    const l = `${this.baseUrl}${t.startsWith("/") ? t : `/${t}`}`, h = (i == null ? void 0 : i.timeout) || this.timeout;
+    let S = {
       "Content-Type": "application/json",
       ...i == null ? void 0 : i.headers
     };
     if (!(i != null && i.skipAuth) && this.sessionManager) {
       const c = await this.sessionManager.getValidAccessToken();
-      d = { ...d, Authorization: `Bearer ${c}` };
+      S = { ...S, Authorization: `Bearer ${c}` };
     }
-    const T = new AbortController(), A = setTimeout(() => T.abort(), l);
+    const k = new AbortController(), T = setTimeout(() => k.abort(), h);
     try {
-      const c = await fetch(a, {
+      const c = await fetch(l, {
         method: e,
-        headers: d,
+        headers: S,
         body: n ? JSON.stringify(n) : void 0,
-        signal: T.signal
+        signal: k.signal
       });
-      if (clearTimeout(A), !c.ok)
+      if (clearTimeout(T), c.status === 401 && !(i != null && i.skipAuth) && this.sessionManager && !a) {
+        try {
+          await c.text();
+        } catch {
+        }
+        return await this.sessionManager.forceRefresh(), this.executeRequest(e, t, n, i, !0);
+      }
+      if (!c.ok)
         throw new Error(`HTTP ${c.status}: ${c.statusText}`);
-      const S = c.headers.get("content-type");
-      return !S || !S.includes("application/json") ? {} : await c.json();
+      const d = c.headers.get("content-type");
+      return !d || !d.includes("application/json") ? {} : await c.json();
     } catch (c) {
-      throw clearTimeout(A), c instanceof Error && c.name === "AbortError" ? new Error(`Request timeout after ${l}ms`) : c;
+      throw clearTimeout(T), c instanceof Error && c.name === "AbortError" ? new Error(`Request timeout after ${h}ms`) : c;
     }
   }
   async get(e, t) {
@@ -98,10 +105,10 @@ class Je {
     return (await this.httpService.get(`/apps/${e}/export-config`)).data;
   }
 }
-const $e = fe(null), Tt = 5 * 60 * 1e3;
-function Sr({ config: r, children: e }) {
-  var k, m, g;
-  const { appId: t, baseUrl: n } = r, i = (((k = r.cache) == null ? void 0 : k.enabled) ?? !0) && !!t, a = ((m = r.cache) == null ? void 0 : m.ttl) ?? Tt, l = ((g = r.cache) == null ? void 0 : g.storageKey) ?? (t ? `app_cache_${t}` : ""), [d, T] = N(() => {
+const $e = fe(null), St = 5 * 60 * 1e3;
+function kr({ config: r, children: e }) {
+  var E, m, g;
+  const { appId: t, baseUrl: n } = r, i = (((E = r.cache) == null ? void 0 : E.enabled) ?? !0) && !!t, a = ((m = r.cache) == null ? void 0 : m.ttl) ?? St, l = ((g = r.cache) == null ? void 0 : g.storageKey) ?? (t ? `app_cache_${t}` : ""), [h, S] = N(() => {
     if (!i) return null;
     try {
       const b = localStorage.getItem(l);
@@ -111,15 +118,15 @@ function Sr({ config: r, children: e }) {
     } catch {
       return null;
     }
-  }), [A, c] = N(!!t && !d), [S, h] = N(null), x = Ee(d);
-  x.current = d;
+  }), [k, T] = N(!!t && !h), [c, d] = N(null), A = ye(h);
+  A.current = h;
   const P = te(
     async (b = !1) => {
-      if (t && !(!b && i && x.current))
+      if (t && !(!b && i && A.current))
         try {
-          c(!0), h(null);
+          T(!0), d(null);
           const o = await new Je(new he(n)).getPublicAppInfo(t);
-          if (T(o), i)
+          if (S(o), i)
             try {
               const p = {
                 data: o,
@@ -132,27 +139,27 @@ function Sr({ config: r, children: e }) {
             }
         } catch (C) {
           const o = C instanceof Error ? C : new Error("Failed to load app information");
-          h(o), T(null);
+          d(o), S(null);
         } finally {
-          c(!1);
+          T(!1);
         }
     },
     [n, t, i, l]
   ), I = te(async () => {
-    if (!(!t || !i || !x.current))
+    if (!(!t || !i || !A.current))
       try {
         const b = localStorage.getItem(l);
         if (!b) return;
         const C = JSON.parse(b);
         if (Date.now() - C.timestamp <= a * 0.5) return;
         const p = await new Je(new he(n)).getPublicAppInfo(t);
-        T(p);
-        const E = {
+        S(p);
+        const x = {
           data: p,
           timestamp: Date.now(),
           appId: t
         };
-        localStorage.setItem(l, JSON.stringify(E));
+        localStorage.setItem(l, JSON.stringify(x));
       } catch (b) {
         process.env.NODE_ENV === "development" && console.warn("[AppProvider] Background app refresh failed:", b);
       }
@@ -160,17 +167,17 @@ function Sr({ config: r, children: e }) {
     () => ({
       appId: t,
       baseUrl: n,
-      appInfo: d,
-      isAppLoading: A,
-      appError: S,
+      appInfo: h,
+      isAppLoading: k,
+      appError: c,
       retryApp: () => {
         P(!0);
       }
     }),
-    [t, n, d, A, S, P]
+    [t, n, h, k, c, P]
   );
   return re(() => {
-    t && (x.current ? I() : P());
+    t && (A.current ? I() : P());
   }, []), /* @__PURE__ */ s($e.Provider, { value: R, children: e });
 }
 function Ae() {
@@ -182,8 +189,8 @@ function Ae() {
 function Ue() {
   return ne($e);
 }
-const kr = Ae;
-class ee extends Error {
+const Er = Ae;
+class Z extends Error {
   constructor(e, t) {
     const n = {
       token_expired: "Refresh token has expired",
@@ -193,12 +200,12 @@ class ee extends Error {
     super(t || n[e]), this.name = "SessionExpiredError", this.reason = e;
   }
 }
-class St extends Error {
+class kt extends Error {
   constructor(e) {
     super(`Token refresh timed out after ${e}ms`), this.name = "TokenRefreshTimeoutError", this.timeoutMs = e;
   }
 }
-class kt extends Error {
+class Et extends Error {
   constructor(e, t) {
     super(
       `Token refresh failed after ${e} attempts: ${(t == null ? void 0 : t.message) || "Unknown error"}`
@@ -207,10 +214,10 @@ class kt extends Error {
 }
 class oe extends Error {
   constructor(e, t, n) {
-    super(`Invalid configuration "${e}": ${n} (received: ${Et(t)})`), this.name = "ConfigurationError", this.field = e, this.received = t;
+    super(`Invalid configuration "${e}": ${n} (received: ${xt(t)})`), this.name = "ConfigurationError", this.field = e, this.received = t;
   }
 }
-function Et(r) {
+function xt(r) {
   if (r === void 0) return "undefined";
   try {
     const e = JSON.stringify(r);
@@ -235,19 +242,19 @@ function Ke(r) {
   const e = Re(r), t = e == null ? void 0 : e.payload.exp;
   return typeof t == "number" ? t * 1e3 : void 0;
 }
-function xt(r, e) {
+function At(r, e) {
   var n;
   const t = (n = Re(r)) == null ? void 0 : n.payload[e];
   return typeof t == "string" ? t : void 0;
 }
-const At = /^(javascript|data|vbscript|file):/i, Rt = /^https?:\/\//i;
-function Pt(r, e = "baseUrl") {
+const Rt = /^(javascript|data|vbscript|file):/i, Pt = /^https?:\/\//i;
+function It(r, e = "baseUrl") {
   if (!(r == null || r === "")) {
     if (typeof r != "string")
       throw new oe(e, r, "must be a string");
-    if (At.test(r))
+    if (Rt.test(r))
       throw new oe(e, r, "dangerous URL scheme is not allowed");
-    if (!Rt.test(r))
+    if (!Pt.test(r))
       throw new oe(e, r, "must start with http:// or https://");
   }
 }
@@ -265,7 +272,7 @@ function Ye(r, e) {
   if (e !== void 0 && typeof e != "boolean")
     throw new oe(r, e, "must be a boolean");
 }
-function It(r, e = "accessToken") {
+function Lt(r, e = "accessToken") {
   if (typeof r != "string" || r.length === 0)
     throw new oe(e, r, "must be a non-empty string");
   if (!r.includes(".")) return;
@@ -283,11 +290,11 @@ function It(r, e = "accessToken") {
       "JWT header or payload is not valid base64url-encoded JSON"
     );
 }
-function Lt(r) {
+function Ft(r) {
   if (r !== void 0 && (typeof r != "number" || !Number.isFinite(r) || r <= 0))
     throw new oe("expiresIn", r, "must be a finite positive number (seconds)");
 }
-function Ft(r) {
+function Nt(r) {
   if (r !== void 0 && (typeof r != "number" || !Number.isFinite(r) || r <= 0))
     throw new oe(
       "expiresAt",
@@ -321,7 +328,7 @@ const ie = class ie {
     return e.storageKey || "auth_tokens";
   }
   static validateConfig(e) {
-    Pt(e.baseUrl), Ye("enableCookieSession", e.enableCookieSession), Ye("autoRefresh", e.autoRefresh), ge("refreshThreshold", e.refreshThreshold, { min: 0 }), ge("proactiveRefreshMargin", e.proactiveRefreshMargin, { min: 0 }), ge("refreshQueueTimeout", e.refreshQueueTimeout, { min: 1 }), ge("maxRefreshRetries", e.maxRefreshRetries, { min: 0 }), ge("retryBackoffBase", e.retryBackoffBase, { min: 1 });
+    It(e.baseUrl), Ye("enableCookieSession", e.enableCookieSession), Ye("autoRefresh", e.autoRefresh), ge("refreshThreshold", e.refreshThreshold, { min: 0 }), ge("proactiveRefreshMargin", e.proactiveRefreshMargin, { min: 0 }), ge("refreshQueueTimeout", e.refreshQueueTimeout, { min: 1 }), ge("maxRefreshRetries", e.maxRefreshRetries, { min: 0 }), ge("retryBackoffBase", e.retryBackoffBase, { min: 1 });
   }
   /** Update mutable config (callbacks, baseUrl) on an existing instance. */
   updateConfig(e) {
@@ -390,9 +397,9 @@ const ie = class ie {
   }
   // --- Token CRUD ---
   setTokens(e) {
-    if (It(e.accessToken, "accessToken"), e.refreshToken !== void 0 && typeof e.refreshToken != "string")
+    if (Lt(e.accessToken, "accessToken"), e.refreshToken !== void 0 && typeof e.refreshToken != "string")
       throw new oe("refreshToken", e.refreshToken, "must be a string");
-    Lt(e.expiresIn), Ft(e.expiresAt);
+    Ft(e.expiresIn), Nt(e.expiresAt);
     const t = e.expiresAt || (e.expiresIn ? Date.now() + e.expiresIn * 1e3 : void 0) || Ke(e.accessToken), n = {
       ...e,
       expiresAt: t
@@ -472,13 +479,13 @@ const ie = class ie {
     this.startRefreshAndResolveQueue(e.refreshToken).then(() => {
       this.consecutiveBackgroundFailures = 0;
     }).catch((n) => {
-      if (!(n instanceof ee)) {
+      if (!(n instanceof Z)) {
         if (this.sessionGeneration === t) {
           if (this.consecutiveBackgroundFailures++, this.consecutiveBackgroundFailures >= ie.MAX_BACKGROUND_FAILURES) {
             process.env.NODE_ENV === "development" && console.error(
               `[SessionManager] Background refresh failed ${this.consecutiveBackgroundFailures} consecutive times — expiring session`
             ), this.consecutiveBackgroundFailures = 0, this.handleSessionExpired(
-              new ee("token_invalid", "Background refresh failed repeatedly")
+              new Z("token_invalid", "Background refresh failed repeatedly")
             );
             return;
           }
@@ -545,17 +552,40 @@ const ie = class ie {
   async getValidAccessToken() {
     const e = this.getTokens();
     if (!(e != null && e.accessToken)) {
-      const t = new ee("token_invalid", "No tokens available");
+      const t = new Z("token_invalid", "No tokens available");
       throw this.handleSessionExpired(t), t;
     }
     if (!this.shouldRefreshToken(e) && !this.isTokenExpired(e))
       return e.accessToken;
     if (!e.refreshToken) {
-      const t = new ee("token_invalid", "No refresh token available");
+      const t = new Z("token_invalid", "No refresh token available");
       throw this.handleSessionExpired(t), t;
     }
     return this.refreshPromise ? this.enqueueForToken() : this.startRefreshAndResolveQueue(e.refreshToken);
   }
+  /**
+   * Force a refresh ignoring local expiry heuristics. Callers (e.g. HttpService
+   * retrying a 401) use this when the backend rejected the current access token
+   * as invalid even though `expiresAt` claims it's still valid. Shares the same
+   * refreshPromise/queue as getValidAccessToken, so concurrent forceRefresh
+   * calls deduplicate to a single refresh network call.
+   *
+   * @throws {SessionExpiredError} if no refresh token → caller should logout
+   * @throws {TokenRefreshTimeoutError} if queue wait exceeds timeout
+   * @throws {TokenRefreshError} if refresh fails after all retries
+   */
+  async forceRefresh() {
+    const e = this.getTokens();
+    if (!(e != null && e.accessToken)) {
+      const t = new Z("token_invalid", "No tokens available");
+      throw this.handleSessionExpired(t), t;
+    }
+    if (!e.refreshToken) {
+      const t = new Z("token_invalid", "No refresh token available");
+      throw this.handleSessionExpired(t), t;
+    }
+    return this.refreshPromise ? this.enqueueForToken() : this.startRefreshAndResolveQueue(e.refreshToken, !0);
+  }
   /**
    * Backward-compatible getAuthHeaders — now delegates to getValidAccessToken.
    */
@@ -563,27 +593,27 @@ const ie = class ie {
     try {
       return { Authorization: `Bearer ${await this.getValidAccessToken()}` };
     } catch (e) {
-      return e instanceof ee && this.onRefreshFailed && this.onRefreshFailed(), {};
+      return e instanceof Z && this.onRefreshFailed && this.onRefreshFailed(), {};
     }
   }
   enqueueForToken() {
     return new Promise((e, t) => {
       const n = setTimeout(() => {
         const i = this.refreshQueue.findIndex((a) => a.timeoutId === n);
-        i !== -1 && this.refreshQueue.splice(i, 1), t(new St(this.refreshQueueTimeout));
+        i !== -1 && this.refreshQueue.splice(i, 1), t(new kt(this.refreshQueueTimeout));
       }, this.refreshQueueTimeout);
       this.refreshQueue.push({ resolve: e, reject: t, timeoutId: n });
     });
   }
-  async startRefreshAndResolveQueue(e) {
-    this.refreshPromise = this.executeRefreshWithRetry(e);
+  async startRefreshAndResolveQueue(e, t = !1) {
+    this.refreshPromise = this.executeRefreshWithRetry(e, t);
     try {
       await this.refreshPromise;
-      const t = this.getTokens(), n = (t == null ? void 0 : t.accessToken) || "";
-      return this.resolveQueue(n), n;
-    } catch (t) {
-      const n = t instanceof Error ? t : new Error("Token refresh failed");
-      throw n instanceof ee ? (this.rejectQueue(n), this.handleSessionExpired(n)) : this.rejectQueue(n), n;
+      const n = this.getTokens(), i = (n == null ? void 0 : n.accessToken) || "";
+      return this.resolveQueue(i), i;
+    } catch (n) {
+      const i = n instanceof Error ? n : new Error("Token refresh failed");
+      throw i instanceof Z ? (this.rejectQueue(i), this.handleSessionExpired(i)) : this.rejectQueue(i), i;
     } finally {
       this.refreshPromise = null;
     }
@@ -601,74 +631,74 @@ const ie = class ie {
       clearTimeout(n.timeoutId), n.reject(e);
   }
   // --- Refresh with retry + error classification ---
-  async executeRefreshWithRetry(e) {
-    let t;
-    const n = this.sessionGeneration;
-    for (let i = 0; i <= this.maxRefreshRetries; i++) {
-      if (this.sessionGeneration !== n)
-        throw new ee("token_invalid", "Session cleared during refresh");
+  async executeRefreshWithRetry(e, t = !1) {
+    let n;
+    const i = this.sessionGeneration;
+    for (let a = 0; a <= this.maxRefreshRetries; a++) {
+      if (this.sessionGeneration !== i)
+        throw new Z("token_invalid", "Session cleared during refresh");
       try {
-        await this.performTokenRefresh(e, n);
+        await this.performTokenRefresh(e, i, t);
         return;
-      } catch (a) {
-        const l = a instanceof Error ? a : new Error(String(a));
-        if (l instanceof ee)
-          throw l;
-        if (t = l, i < this.maxRefreshRetries) {
-          const d = this.retryBackoffBase * Math.pow(2, i);
-          await this.sleep(d);
+      } catch (l) {
+        const h = l instanceof Error ? l : new Error(String(l));
+        if (h instanceof Z)
+          throw h;
+        if (n = h, a < this.maxRefreshRetries) {
+          const S = this.retryBackoffBase * Math.pow(2, a);
+          await this.sleep(S);
         }
       }
     }
-    throw new kt(this.maxRefreshRetries + 1, t);
+    throw new Et(this.maxRefreshRetries + 1, n);
   }
   /**
    * Single refresh attempt with error classification.
    * Throws SessionExpiredError for fatal errors (no retry).
    * Throws generic Error for transient errors (will be retried).
    */
-  async performTokenRefresh(e, t) {
+  async performTokenRefresh(e, t, n = !1) {
     return typeof navigator < "u" && navigator.locks ? navigator.locks.request(
       `session-refresh:${this.storageKey}`,
-      () => this.performTokenRefreshInner(e, t)
-    ) : this.performTokenRefreshInner(e, t);
+      () => this.performTokenRefreshInner(e, t, n)
+    ) : this.performTokenRefreshInner(e, t, n);
   }
-  async performTokenRefreshInner(e, t) {
+  async performTokenRefreshInner(e, t, n = !1) {
     if (!this.baseUrl)
       throw new Error("Base URL not configured for token refresh");
-    const n = this.getTokens();
-    if (n != null && n.accessToken && !this.isTokenExpired(n) && !this.shouldRefreshToken(n))
+    const i = this.getTokens();
+    if (!n && (i != null && i.accessToken) && !this.isTokenExpired(i) && !this.shouldRefreshToken(i))
       return;
-    const i = (n == null ? void 0 : n.refreshToken) || e, a = `${this.baseUrl}/auth/refresh`, l = xt(i, "deviceId"), d = { refreshToken: i };
-    l && (d.deviceId = l);
-    let T;
+    const a = (i == null ? void 0 : i.refreshToken) || e, l = `${this.baseUrl}/auth/refresh`, h = At(a, "deviceId"), S = { refreshToken: a };
+    h && (S.deviceId = h);
+    let k;
     try {
-      T = await fetch(a, {
+      k = await fetch(l, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify(d),
+        body: JSON.stringify(S),
         ...this.enableCookieSession && { credentials: "include" }
       });
     } catch (c) {
       throw c instanceof Error ? c : new Error("Network error during token refresh");
     }
-    if (!T.ok) {
+    if (!k.ok) {
       let c = "";
       try {
-        const S = await T.json();
-        c = (S.message || S.error || "").toLowerCase();
+        const d = await k.json();
+        c = (d.message || d.error || "").toLowerCase();
       } catch {
-        c = T.statusText.toLowerCase();
+        c = k.statusText.toLowerCase();
       }
-      throw T.status === 401 ? c.includes("expired") ? new ee("token_expired") : c.includes("invalid") ? new ee("token_invalid") : new ee("token_invalid", `Unauthorized: ${c}`) : T.status === 400 ? c.includes("inactive") ? new ee("user_inactive") : c.includes("expired") || c.includes("invalid") ? new ee("token_invalid", c) : c.includes("reuse") || c.includes("revoked") ? new ee("token_invalid", c) : new Error(`Token refresh failed (400): ${c}`) : new Error(`Token refresh failed: ${T.status} ${c}`);
+      throw k.status === 401 ? c.includes("expired") ? new Z("token_expired") : c.includes("invalid") ? new Z("token_invalid") : new Z("token_invalid", `Unauthorized: ${c}`) : k.status === 400 ? c.includes("inactive") ? new Z("user_inactive") : c.includes("expired") || c.includes("invalid") ? new Z("token_invalid", c) : c.includes("reuse") || c.includes("revoked") ? new Z("token_invalid", c) : new Error(`Token refresh failed (400): ${c}`) : new Error(`Token refresh failed: ${k.status} ${c}`);
     }
     if (this.sessionGeneration !== t)
-      throw new ee("token_invalid", "Session cleared during refresh");
-    const A = await T.json();
+      throw new Z("token_invalid", "Session cleared during refresh");
+    const T = await k.json();
     this.setTokens({
-      accessToken: A.accessToken,
-      refreshToken: A.refreshToken || i,
-      expiresIn: A.expiresIn
+      accessToken: T.accessToken,
+      refreshToken: T.refreshToken || a,
+      expiresIn: T.expiresIn
     });
   }
   // --- Session expiry handler ---
@@ -691,7 +721,7 @@ const ie = class ie {
   // --- Session lifecycle ---
   clearSession() {
     this.sessionGeneration++, this.cancelProactiveTimer(), this.clearTokens();
-    const e = new ee("token_invalid", "Session cleared");
+    const e = new Z("token_invalid", "Session cleared");
     this.rejectQueue(e);
   }
   /**
@@ -700,7 +730,7 @@ const ie = class ie {
    */
   destroy() {
     this.isDestroyed = !0, ie.instances.delete(this.storageKey), this.cancelProactiveTimer(), this.detachVisibilityListener();
-    const e = new ee("token_invalid", "SessionManager destroyed");
+    const e = new Z("token_invalid", "SessionManager destroyed");
     this.rejectQueue(e);
   }
   // --- JWT helpers ---
@@ -729,9 +759,9 @@ const ie = class ie {
 };
 ie.instances = /* @__PURE__ */ new Map(), ie.MAX_BACKGROUND_FAILURES = 3;
 let Me = ie;
-class Nt {
+class Ct {
   constructor(e) {
-    this.httpService = e, this.pendingVerifications = /* @__PURE__ */ new Map(), this.pendingMagicLinks = /* @__PURE__ */ new Map();
+    this.httpService = e, this.verificationCache = /* @__PURE__ */ new Map(), this.VERIFY_CACHE_TTL_MS = 6e4, this.pendingMagicLinks = /* @__PURE__ */ new Map();
   }
   // Public endpoints - no auth required.
   // Must pass `{ skipAuth: true }` so HttpService does NOT call
@@ -780,12 +810,24 @@ class Nt {
     return this.pendingMagicLinks.set(t, i), i;
   }
   async verifyMagicLink(e) {
-    const t = e.token, n = this.pendingVerifications.get(t);
-    if (n) return n;
-    const i = this.httpService.post("/auth/magic-link/verify", e, { skipAuth: !0 }).finally(() => {
-      this.pendingVerifications.delete(t);
-    });
-    return this.pendingVerifications.set(t, i), i;
+    const t = e.token, n = this.verificationCache.get(t);
+    if (n) return n.promise;
+    const i = this.httpService.post(
+      "/auth/magic-link/verify",
+      e,
+      { skipAuth: !0 }
+    ), a = { promise: i };
+    return this.verificationCache.set(t, a), i.then(
+      () => {
+        a.timer = setTimeout(
+          () => this.verificationCache.delete(t),
+          this.VERIFY_CACHE_TTL_MS
+        );
+      },
+      () => {
+        this.verificationCache.delete(t);
+      }
+    ), i;
   }
   async confirmPasswordReset(e) {
     await this.httpService.post("/auth/password-reset/confirm", e, { skipAuth: !0 });
@@ -794,7 +836,7 @@ class Nt {
     await this.httpService.post("/auth/change-password", e);
   }
 }
-class Ct {
+class Dt {
   constructor(e) {
     this.httpService = e;
   }
@@ -830,7 +872,7 @@ class Ct {
     return { roles: n.data, meta: n.meta };
   }
 }
-class Dt {
+class Mt {
   constructor(e) {
     this.httpService = e;
   }
@@ -853,7 +895,7 @@ class Dt {
     await this.httpService.delete(`/users/${e}`);
   }
 }
-class ye {
+class be {
   constructor(e, t) {
     this.httpService = e, this.appId = t;
   }
@@ -897,7 +939,7 @@ class ye {
     )).data;
   }
 }
-function Mt(r, e) {
+function $t(r, e) {
   if (r === "localhost" || r.startsWith("127.") || r.startsWith("192.168."))
     return null;
   if (e) {
@@ -913,24 +955,24 @@ function Mt(r, e) {
   const n = r.split(".");
   return n.length >= 3 && n[0] !== "www" ? n[0] : null;
 }
-function $t(r, e = "tenant", t) {
+function Ut(r, e = "tenant", t) {
   const i = new URLSearchParams(r).get(e);
   return i ? (t && t.setItem("tenant", i), i) : t ? t.getItem("tenant") : null;
 }
-function Ut(r, e, t) {
+function Bt(r, e, t) {
   const { tenantMode: n, baseDomain: i, selectorParam: a, fixedTenantSlug: l } = r;
-  return n === "fixed" ? l || null : n === "subdomain" ? Mt(e.hostname, i) : n === "selector" ? $t(e.search, a, t) : null;
+  return n === "fixed" ? l || null : n === "subdomain" ? $t(e.hostname, i) : n === "selector" ? Ut(e.search, a, t) : null;
 }
-function Bt(r, e, t) {
+function _t(r, e, t) {
   if (t)
     return `${r}.${t}`;
   const n = e.split(".");
   return n.length === 2 ? `${r}.${e}` : n.length >= 3 ? (n[0] = r, n.join(".")) : null;
 }
 const Be = fe(null);
-function Er({ config: r, children: e }) {
-  var j, Z, $;
-  const { baseUrl: t, appInfo: n, appId: i } = Ae(), a = te(() => typeof window > "u" ? null : Ut(
+function xr({ config: r, children: e }) {
+  var j, K, $;
+  const { baseUrl: t, appInfo: n, appId: i } = Ae(), a = te(() => typeof window > "u" ? null : Bt(
     {
       tenantMode: r.tenantMode || "selector",
       baseDomain: r.baseDomain,
@@ -942,101 +984,101 @@ function Er({ config: r, children: e }) {
       search: window.location.search
     },
     window.localStorage
-  ), [r.tenantMode, r.baseDomain, r.selectorParam, r.fixedTenantSlug]), [l, d] = N(() => a()), T = ((j = r.cache) == null ? void 0 : j.enabled) ?? !0, A = ((Z = r.cache) == null ? void 0 : Z.ttl) ?? 5 * 60 * 1e3, c = (($ = r.cache) == null ? void 0 : $.storageKey) ?? `tenant_cache_${l || "default"}`, S = V(
-    () => ({ enabled: T, ttl: A, storageKey: c }),
-    [T, A, c]
-  ), [h, x] = N(() => {
+  ), [r.tenantMode, r.baseDomain, r.selectorParam, r.fixedTenantSlug]), [l, h] = N(() => a()), S = ((j = r.cache) == null ? void 0 : j.enabled) ?? !0, k = ((K = r.cache) == null ? void 0 : K.ttl) ?? 5 * 60 * 1e3, T = (($ = r.cache) == null ? void 0 : $.storageKey) ?? `tenant_cache_${l || "default"}`, c = V(
+    () => ({ enabled: S, ttl: k, storageKey: T }),
+    [S, k, T]
+  ), [d, A] = N(() => {
     if (r.initialTenant) return r.initialTenant;
-    if (!S.enabled || !l) return null;
+    if (!c.enabled || !l) return null;
     try {
-      const U = localStorage.getItem(S.storageKey);
-      if (!U) return null;
-      const L = JSON.parse(U);
-      return Date.now() - L.timestamp < S.ttl && L.tenantSlug === l ? L.data : (localStorage.removeItem(S.storageKey), null);
+      const B = localStorage.getItem(c.storageKey);
+      if (!B) return null;
+      const L = JSON.parse(B);
+      return Date.now() - L.timestamp < c.ttl && L.tenantSlug === l ? L.data : (localStorage.removeItem(c.storageKey), null);
     } catch {
       return null;
     }
-  }), [P, I] = N(!h && !r.initialTenant), [R, k] = N(null), [m, g] = N(null), [b, C] = N(!1), [o, p] = N(null);
+  }), [P, I] = N(!d && !r.initialTenant), [R, E] = N(null), [m, g] = N(null), [b, C] = N(!1), [o, p] = N(null);
   re(() => {
     if (r.tenantMode === "fixed") return;
-    const U = a();
-    d(U);
+    const B = a();
+    h(B);
   }, [a, r.tenantMode]);
-  const E = (n == null ? void 0 : n.settingsSchema) || null, y = te(
-    async (U, L = !1) => {
-      if (!(!L && S.enabled && h && h.subdomain === U))
+  const x = (n == null ? void 0 : n.settingsSchema) || null, y = te(
+    async (B, L = !1) => {
+      if (!(!L && c.enabled && d && d.subdomain === B))
         try {
-          I(!0), k(null);
-          const q = new he(t), W = await new ye(q, i).getPublicTenantInfo(U);
-          if (x(W), S.enabled)
+          I(!0), E(null);
+          const q = new he(t), W = await new be(q, i).getPublicTenantInfo(B);
+          if (A(W), c.enabled)
             try {
-              const K = {
+              const Y = {
                 data: W,
                 timestamp: Date.now(),
-                tenantSlug: U
+                tenantSlug: B
               };
-              localStorage.setItem(S.storageKey, JSON.stringify(K));
-            } catch (K) {
-              process.env.NODE_ENV === "development" && console.warn("[TenantProvider] Failed to cache tenant info:", K);
+              localStorage.setItem(c.storageKey, JSON.stringify(Y));
+            } catch (Y) {
+              process.env.NODE_ENV === "development" && console.warn("[TenantProvider] Failed to cache tenant info:", Y);
             }
         } catch (q) {
           const _ = q instanceof Error ? q : new Error("Failed to load tenant information");
-          k(_), x(null);
+          E(_), A(null);
         } finally {
           I(!1);
         }
     },
-    [t, i, S, h]
+    [t, i, c, d]
   ), u = te(async () => {
-    if (!(!S.enabled || !h || !l))
+    if (!(!c.enabled || !d || !l))
       try {
-        const U = localStorage.getItem(S.storageKey);
-        if (!U) return;
-        const L = JSON.parse(U);
-        if (Date.now() - L.timestamp > S.ttl * 0.5) {
-          const _ = new he(t), K = await new ye(_, i).getPublicTenantInfo(l);
-          x(K);
-          const Y = {
-            data: K,
+        const B = localStorage.getItem(c.storageKey);
+        if (!B) return;
+        const L = JSON.parse(B);
+        if (Date.now() - L.timestamp > c.ttl * 0.5) {
+          const _ = new he(t), Y = await new be(_, i).getPublicTenantInfo(l);
+          A(Y);
+          const X = {
+            data: Y,
             timestamp: Date.now(),
             tenantSlug: l
           };
-          localStorage.setItem(S.storageKey, JSON.stringify(Y));
+          localStorage.setItem(c.storageKey, JSON.stringify(X));
         }
-      } catch (U) {
-        process.env.NODE_ENV === "development" && console.warn("[TenantProvider] Background tenant refresh failed:", U);
+      } catch (B) {
+        process.env.NODE_ENV === "development" && console.warn("[TenantProvider] Background tenant refresh failed:", B);
       }
-  }, [t, i, S, h, l]), v = te(async () => {
-    if (h != null && h.id)
+  }, [t, i, c, d, l]), v = te(async () => {
+    if (d != null && d.id)
       try {
         C(!0), p(null);
-        const U = new he(t), q = await new ye(U, h.appId).getTenantSettings(h.id);
+        const B = new he(t), q = await new be(B, d.appId).getTenantSettings(d.id);
         g(q);
-      } catch (U) {
-        const L = U instanceof Error ? U : new Error("Failed to load tenant settings");
+      } catch (B) {
+        const L = B instanceof Error ? B : new Error("Failed to load tenant settings");
         p(L), g(null);
       } finally {
         C(!1);
       }
-  }, [t, h]), D = te(() => {
+  }, [t, d]), D = te(() => {
     v();
   }, [v]), se = te(
-    (U) => {
-      if (!E)
+    (B) => {
+      if (!x)
         return { isValid: !0, errors: [] };
       const L = [];
       try {
-        return E.properties && Object.entries(E.properties).forEach(([q, _]) => {
-          var K;
-          const W = U[q];
-          if ((K = E.required) != null && K.includes(q) && W == null) {
+        return x.properties && Object.entries(x.properties).forEach(([q, _]) => {
+          var Y;
+          const W = B[q];
+          if ((Y = x.required) != null && Y.includes(q) && W == null) {
             L.push(`Field '${q}' is required`);
             return;
           }
           if (W != null) {
             if (_.type) {
-              const Y = _.type, le = typeof W;
-              Y === "string" && le !== "string" ? L.push(`Field '${q}' must be a string`) : (Y === "number" || Y === "integer") && le !== "number" ? L.push(`Field '${q}' must be a number`) : Y === "boolean" && le !== "boolean" ? L.push(`Field '${q}' must be a boolean`) : Y === "array" && !Array.isArray(W) && L.push(`Field '${q}' must be an array`);
+              const X = _.type, le = typeof W;
+              X === "string" && le !== "string" ? L.push(`Field '${q}' must be a string`) : (X === "number" || X === "integer") && le !== "number" ? L.push(`Field '${q}' must be a number`) : X === "boolean" && le !== "boolean" ? L.push(`Field '${q}' must be a boolean`) : X === "array" && !Array.isArray(W) && L.push(`Field '${q}' must be an array`);
             }
             _.minLength !== void 0 && typeof W == "string" && W.length < _.minLength && L.push(
               `Field '${q}' must be at least ${_.minLength} characters long`
@@ -1055,15 +1097,15 @@ function Er({ config: r, children: e }) {
         };
       }
     },
-    [E]
+    [x]
   );
   re(() => {
-    !r.initialTenant && l ? h ? u() : y(l) : !r.initialTenant && !l && (x(null), k(null), I(!1));
-  }, [r.initialTenant, l, h, y, u]), re(() => {
-    h != null && h.id ? v() : (g(null), p(null), C(!1));
-  }, [h == null ? void 0 : h.id, v]);
+    !r.initialTenant && l ? d ? u() : y(l) : !r.initialTenant && !l && (A(null), E(null), I(!1));
+  }, [r.initialTenant, l, d, y, u]), re(() => {
+    d != null && d.id ? v() : (g(null), p(null), C(!1));
+  }, [d == null ? void 0 : d.id, v]);
   const F = te(
-    (U, L) => {
+    (B, L) => {
       const { mode: q = "reload", redirectPath: _ } = L || {}, W = r.tenantMode || "selector";
       if (W === "fixed") {
         process.env.NODE_ENV === "development" && console.warn(
@@ -1072,38 +1114,38 @@ function Er({ config: r, children: e }) {
         ), _ && (window.location.href = _);
         return;
       }
-      if (localStorage.setItem("tenant", U), W === "subdomain") {
-        const K = window.location.hostname, Y = Bt(
-          U,
-          K,
+      if (localStorage.setItem("tenant", B), W === "subdomain") {
+        const Y = window.location.hostname, X = _t(
+          B,
+          Y,
           r.baseDomain
         );
-        if (!Y) {
+        if (!X) {
           process.env.NODE_ENV === "development" && console.warn(
             "[TenantProvider] Cannot switch subdomain, invalid hostname:",
-            K
+            Y
           );
           return;
         }
-        const le = _ || window.location.pathname, Te = new URL(`${window.location.protocol}//${Y}${le}`);
+        const le = _ || window.location.pathname, Se = new URL(`${window.location.protocol}//${X}${le}`);
         new URLSearchParams(window.location.search).forEach((Fe, Ne) => {
-          Te.searchParams.set(Ne, Fe);
-        }), window.location.href = Te.toString();
+          Se.searchParams.set(Ne, Fe);
+        }), window.location.href = Se.toString();
       } else if (W === "selector") {
-        const K = _ || window.location.pathname, Y = new URLSearchParams(window.location.search);
-        if (Y.set(r.selectorParam || "tenant", U), q === "reload") {
-          const le = `${K}?${Y.toString()}${window.location.hash}`;
+        const Y = _ || window.location.pathname, X = new URLSearchParams(window.location.search);
+        if (X.set(r.selectorParam || "tenant", B), q === "reload") {
+          const le = `${Y}?${X.toString()}${window.location.hash}`;
           window.location.href = le;
         } else {
-          const le = `${K}?${Y.toString()}${window.location.hash}`;
-          window.history.pushState({}, "", le), d(U), y(U);
+          const le = `${Y}?${X.toString()}${window.location.hash}`;
+          window.history.pushState({}, "", le), h(B), y(B);
         }
       }
     },
     [r.tenantMode, r.selectorParam, r.baseDomain, r.fixedTenantSlug, y]
   ), H = V(() => ({
     // Tenant info
-    tenant: h,
+    tenant: d,
     tenantSlug: l,
     isTenantLoading: P,
     tenantError: R,
@@ -1112,7 +1154,7 @@ function Er({ config: r, children: e }) {
     },
     // Settings
     settings: m,
-    settingsSchema: E,
+    settingsSchema: x,
     isSettingsLoading: b,
     settingsError: o,
     // Actions
@@ -1121,12 +1163,12 @@ function Er({ config: r, children: e }) {
     // Validation
     validateSettings: se
   }), [
-    h,
+    d,
     l,
     P,
     R,
     m,
-    E,
+    x,
     b,
     o,
     D,
@@ -1135,7 +1177,7 @@ function Er({ config: r, children: e }) {
   ]);
   return /* @__PURE__ */ s(Be.Provider, { value: H, children: e });
 }
-function ve() {
+function Te() {
   const r = ne(Be);
   if (!r)
     throw new Error("useTenant must be used within a TenantProvider");
@@ -1144,9 +1186,9 @@ function ve() {
 function pe() {
   return ne(Be);
 }
-const xr = ve;
-function Ar() {
-  const { settings: r, settingsSchema: e, isSettingsLoading: t, settingsError: n, validateSettings: i } = ve();
+const Ar = Te;
+function Rr() {
+  const { settings: r, settingsSchema: e, isSettingsLoading: t, settingsError: n, validateSettings: i } = Te();
   return {
     settings: r,
     settingsSchema: e,
@@ -1156,7 +1198,7 @@ function Ar() {
   };
 }
 function ot() {
-  const { tenant: r, tenantSlug: e, isTenantLoading: t, tenantError: n, retryTenant: i } = ve();
+  const { tenant: r, tenantSlug: e, isTenantLoading: t, tenantError: n, retryTenant: i } = Te();
   return {
     tenant: r,
     tenantSlug: e,
@@ -1166,7 +1208,7 @@ function ot() {
   };
 }
 const _e = "userTenants";
-function _t() {
+function Ot() {
   try {
     const r = localStorage.getItem(_e);
     return r ? JSON.parse(r) : [];
@@ -1187,14 +1229,14 @@ function et() {
   }
 }
 const Pe = fe(null), Ie = fe(null);
-function Rr({ config: r = {}, children: e }) {
-  const t = Ue(), n = pe(), i = (t == null ? void 0 : t.baseUrl) ?? r.baseUrl ?? "", a = (t == null ? void 0 : t.appId) ?? r.appId, l = (n == null ? void 0 : n.tenant) ?? null, d = (n == null ? void 0 : n.tenantSlug) ?? null, T = (n == null ? void 0 : n.switchTenant) ?? (() => {
+function Pr({ config: r = {}, children: e }) {
+  const t = Ue(), n = pe(), i = (t == null ? void 0 : t.baseUrl) ?? r.baseUrl ?? "", a = (t == null ? void 0 : t.appId) ?? r.appId, l = (n == null ? void 0 : n.tenant) ?? null, h = (n == null ? void 0 : n.tenantSlug) ?? null, S = (n == null ? void 0 : n.switchTenant) ?? (() => {
   });
   if (!i)
     throw new Error(
       "[AuthProvider] baseUrl is required. Provide it via AppProvider or AuthConfig.baseUrl."
     );
-  const [A, c] = N(r.initialRoles || []), [S, h] = N(!r.initialRoles), [x, P] = N(null), [I, R] = N(!1), [k, m] = N(null), [g, b] = N(() => _t()), C = Ee({ done: !1 });
+  const [k, T] = N(r.initialRoles || []), [c, d] = N(!r.initialRoles), [A, P] = N(null), [I, R] = N(!1), [E, m] = N(null), [g, b] = N(() => Ot()), C = ye({ done: !1 });
   C.current.done || (C.current.done = !0);
   const o = V(() => Me.getInstance({
     baseUrl: i,
@@ -1209,27 +1251,27 @@ function Rr({ config: r = {}, children: e }) {
     r.enableCookieSession,
     r.refreshQueueTimeout,
     r.proactiveRefreshMargin
-  ]), [p, E] = N(() => {
+  ]), [p, x] = N(() => {
     const w = o.getTokens();
     return w ? o.hasValidSession() || !!w.refreshToken : !!r.enableCookieSession;
   }), y = C.current.done && !p, u = V(() => {
     const w = new he(i);
     return w.setSessionManager(o), w;
   }, [i, o]), v = V(
-    () => new Nt(u),
+    () => new Ct(u),
     [u]
   ), D = V(
-    () => new Dt(u),
+    () => new Mt(u),
     [u]
   ), se = V(
-    () => new Ct(u),
+    () => new Dt(u),
     [u]
-  ), F = V(() => x != null && x.roleId && A.find((w) => w.id === x.roleId) || null, [x, A]), H = V(() => (F == null ? void 0 : F.permissions) || [], [F]), j = V(
-    () => o.hasValidSession() && x !== null,
-    [o, x]
-  ), Z = V(() => (x == null ? void 0 : x.tenantId) != null, [x]), $ = Ee(null), U = async (w = !1) => {
+  ), F = V(() => A != null && A.roleId && k.find((w) => w.id === A.roleId) || null, [A, k]), H = V(() => (F == null ? void 0 : F.permissions) || [], [F]), j = V(
+    () => o.hasValidSession() && A !== null,
+    [o, A]
+  ), K = V(() => (A == null ? void 0 : A.tenantId) != null, [A]), $ = ye(null), B = ye(/* @__PURE__ */ new Set()), L = async (w = !1) => {
     try {
-      if (!o.hasValidSession() || !w && x) return;
+      if (!o.hasValidSession() || !w && A) return;
       const M = o.getUserId();
       if (!M) {
         process.env.NODE_ENV === "development" && console.warn("[AuthProvider] No userId available in token or storage");
@@ -1244,17 +1286,17 @@ function Rr({ config: r = {}, children: e }) {
     } finally {
       R(!1);
     }
-  }, L = async (w) => {
+  }, q = async (w) => {
     var He;
-    const { username: M, password: z, tenantSlug: O, redirectPath: Q } = w;
-    let X = l == null ? void 0 : l.id, J = d;
-    O && (X = (await new ye(u, a).getPublicTenantInfo(O)).id, J = O);
+    const { username: M, password: z, tenantSlug: O, redirectPath: J } = w;
+    let ee = l == null ? void 0 : l.id, Q = h;
+    O && (ee = (await new be(u, a).getPublicTenantInfo(O)).id, Q = O);
     const G = await v.login({
       username: M,
       password: z,
       appId: a,
-      tenantId: X
-    }), Se = O && O !== d;
+      tenantId: ee
+    }), ke = O && O !== h;
     if (o.setTokens({
       accessToken: G.accessToken,
       refreshToken: G.refreshToken,
@@ -1262,100 +1304,104 @@ function Rr({ config: r = {}, children: e }) {
     }), G.user) {
       o.setUser(G.user), P(G.user);
       try {
-        await U();
-      } catch (ke) {
-        process.env.NODE_ENV === "development" && console.warn("[AuthProvider] Failed to load complete user data after login:", ke);
+        await L();
+      } catch (Ee) {
+        process.env.NODE_ENV === "development" && console.warn("[AuthProvider] Failed to load complete user data after login:", Ee);
       }
     }
     G.tenants && G.tenants.length > 0 && (b(G.tenants), Xe(G.tenants));
     const Ge = ((He = G.user) == null ? void 0 : He.tenantId) !== null;
-    if (Se && J)
-      return T(J, { redirectPath: Q }), G;
-    if (Q && Q !== window.location.pathname)
-      return T(J || d || "", { redirectPath: Q }), G;
+    if (ke && Q)
+      return S(Q, { redirectPath: J }), G;
+    if (J && J !== window.location.pathname)
+      return S(Q || h || "", { redirectPath: J }), G;
     if (!Ge && G.tenants && G.tenants.length > 0) {
-      const ke = w.autoSwitch !== !1 && r.autoSwitchSingleTenant !== !1;
-      if (G.tenants.length === 1 && ke) {
+      const Ee = w.autoSwitch !== !1 && r.autoSwitchSingleTenant !== !1;
+      if (G.tenants.length === 1 && Ee) {
         const Qe = G.tenants[0];
-        return T(Qe.subdomain, { redirectPath: Q }), G;
+        return S(Qe.subdomain, { redirectPath: J }), G;
       } else G.tenants.length > 1 && r.onTenantSelectionRequired && r.onTenantSelectionRequired(G.tenants);
     }
     return G;
-  }, q = async (w) => {
-    const { email: M, phoneNumber: z, name: O, password: Q, lastName: X, tenantId: J } = w;
+  }, _ = async (w) => {
+    const { email: M, phoneNumber: z, name: O, password: J, lastName: ee, tenantId: Q } = w;
     if (!M && !z)
       throw new Error("Either email or phoneNumber is required");
-    if (!O || !Q)
+    if (!O || !J)
       throw new Error("Name and password are required");
     return v.signup({
       email: M,
       phoneNumber: z,
       name: O,
-      password: Q,
-      tenantId: J ?? (l == null ? void 0 : l.id),
-      lastName: X,
+      password: J,
+      tenantId: Q ?? (l == null ? void 0 : l.id),
+      lastName: ee,
       appId: a
     });
-  }, _ = async (w) => {
-    const { email: M, phoneNumber: z, name: O, password: Q, tenantName: X, lastName: J } = w;
+  }, W = async (w) => {
+    const { email: M, phoneNumber: z, name: O, password: J, tenantName: ee, lastName: Q } = w;
     if (!M && !z)
       throw new Error("Either email or phoneNumber is required");
-    if (!O || !Q || !X)
+    if (!O || !J || !ee)
       throw new Error("Name, password, and tenantName are required");
     return v.signupTenantAdmin({
       email: M,
       phoneNumber: z,
       name: O,
-      password: Q,
-      tenantName: X,
+      password: J,
+      tenantName: ee,
       appId: a,
-      lastName: J
+      lastName: Q
     });
-  }, W = async (w) => {
+  }, Y = async (w) => {
     await v.changePassword(w);
-  }, K = async (w) => {
+  }, X = async (w) => {
     const { email: M, tenantId: z } = w, O = z ?? (l == null ? void 0 : l.id);
     if (!O)
       throw new Error("tenantId is required for password reset");
     await v.requestPasswordReset({ email: M, tenantId: O });
-  }, Y = async (w) => {
-    await v.confirmPasswordReset(w);
   }, le = async (w) => {
-    const { email: M, frontendUrl: z, name: O, lastName: Q, tenantId: X } = w, J = X ?? (l == null ? void 0 : l.id);
-    if (!J)
+    await v.confirmPasswordReset(w);
+  }, Se = async (w) => {
+    const { email: M, frontendUrl: z, name: O, lastName: J, tenantId: ee } = w, Q = ee ?? (l == null ? void 0 : l.id);
+    if (!Q)
       throw new Error("tenantId is required for magic link authentication");
     return v.sendMagicLink({
       email: M,
-      tenantId: J,
+      tenantId: Q,
       frontendUrl: z,
       name: O,
-      lastName: Q,
+      lastName: J,
       appId: a
     });
-  }, Te = async (w) => {
+  }, We = async (w) => {
     const { token: M, email: z, tenantSlug: O } = w;
-    let Q = l == null ? void 0 : l.id, X = d;
-    O && (Q = (await new ye(u, a).getPublicTenantInfo(O)).id, X = O);
-    const J = await v.verifyMagicLink({
+    let J = l == null ? void 0 : l.id, ee = h;
+    O && (J = (await new be(u, a).getPublicTenantInfo(O)).id, ee = O);
+    const Q = await v.verifyMagicLink({
       token: M,
       email: z,
       appId: a,
-      tenantId: Q
-    }), G = O && O !== d;
+      tenantId: J
+    });
+    if (B.current.has(M))
+      return Q;
+    B.current.add(M);
+    const G = O && O !== h;
     if (o.setTokens({
-      accessToken: J.accessToken,
-      refreshToken: J.refreshToken,
-      expiresIn: J.expiresIn
-    }), J.user) {
-      o.setUser(J.user), P(J.user);
+      accessToken: Q.accessToken,
+      refreshToken: Q.refreshToken,
+      expiresIn: Q.expiresIn
+    }), Q.user) {
+      o.setUser(Q.user), P(Q.user);
       try {
-        await U();
-      } catch (Se) {
-        process.env.NODE_ENV === "development" && console.warn("[AuthProvider] Failed to load complete user data after magic link:", Se);
+        await L();
+      } catch (ke) {
+        process.env.NODE_ENV === "development" && console.warn("[AuthProvider] Failed to load complete user data after magic link:", ke);
       }
     }
-    return G && X && X !== d && T(X), J;
-  }, We = async () => {
+    return G && ee && ee !== h && S(ee), Q;
+  }, Fe = async () => {
     const w = o.getTokens();
     if (!(w != null && w.refreshToken))
       throw new Error("No refresh token available");
@@ -1367,63 +1413,63 @@ function Rr({ config: r = {}, children: e }) {
       refreshToken: M.refreshToken || w.refreshToken,
       expiresIn: M.expiresIn
     });
-  }, Fe = () => {
+  }, Ne = () => {
     o.clearSession(), P(null), m(null), b([]), et();
-  }, Ne = (w) => {
+  }, ht = (w) => {
     o.setTokens(w);
-  }, ht = () => o.hasValidSession(), pt = () => {
+  }, pt = () => o.hasValidSession(), ft = () => {
     o.clearSession(), P(null), m(null);
-  }, ft = async () => {
+  }, mt = async () => {
     if (a)
       try {
-        h(!0);
+        d(!0);
         const { roles: w } = await se.getRolesByApp(a);
-        c(w);
+        T(w);
       } catch (w) {
         process.env.NODE_ENV === "development" && console.error("[AuthProvider] Failed to fetch roles:", w);
       } finally {
-        h(!1);
+        d(!1);
       }
-  }, mt = async (w, M) => {
+  }, gt = async (w, M) => {
     const { redirectPath: z } = M || {}, O = o.getTokens();
     if (!(O != null && O.refreshToken))
       throw new Error("No refresh token available for tenant switch");
-    const Q = await v.switchTenant({
+    const J = await v.switchTenant({
       refreshToken: O.refreshToken,
       tenantId: w
     });
     o.setTokens({
-      accessToken: Q.accessToken,
+      accessToken: J.accessToken,
       refreshToken: O.refreshToken,
-      expiresIn: Q.expiresIn
-    }), P(Q.user), o.setUser(Q.user);
-    const X = g.find((J) => J.id === w);
-    X && T(X.subdomain, { redirectPath: z });
-  }, gt = async () => {
+      expiresIn: J.expiresIn
+    }), P(J.user), o.setUser(J.user);
+    const ee = g.find((Q) => Q.id === w);
+    ee && S(ee.subdomain, { redirectPath: z });
+  }, yt = async () => {
     const w = await v.getUserTenants();
     return b(w), Xe(w), w;
   };
   $.current = {
-    login: L,
-    signup: q,
-    signupTenantAdmin: _,
-    sendMagicLink: le,
-    verifyMagicLink: Te,
-    changePassword: W,
-    requestPasswordReset: K,
-    confirmPasswordReset: Y,
-    refreshToken: We,
-    logout: Fe,
-    setTokens: Ne,
-    hasValidSession: ht,
-    clearSession: pt,
-    loadUserData: U,
-    refreshUser: () => U(),
-    refreshRoles: ft,
-    switchToTenant: mt,
-    refreshUserTenants: gt
+    login: q,
+    signup: _,
+    signupTenantAdmin: W,
+    sendMagicLink: Se,
+    verifyMagicLink: We,
+    changePassword: Y,
+    requestPasswordReset: X,
+    confirmPasswordReset: le,
+    refreshToken: Fe,
+    logout: Ne,
+    setTokens: ht,
+    hasValidSession: pt,
+    clearSession: ft,
+    loadUserData: L,
+    refreshUser: () => L(),
+    refreshRoles: mt,
+    switchToTenant: gt,
+    refreshUserTenants: yt
   };
-  const yt = V(
+  const bt = V(
     () => ({
       login: (w) => $.current.login(w),
       signup: (w) => $.current.signup(w),
@@ -1445,21 +1491,21 @@ function Rr({ config: r = {}, children: e }) {
       refreshUserTenants: () => $.current.refreshUserTenants()
     }),
     []
-  ), bt = V(() => {
+  ), wt = V(() => {
     const w = (M) => !H || H.length === 0 ? !1 : typeof M == "string" ? H.includes(M) : H.includes(`${M.resource}.${M.action}`);
     return {
       isAuthenticated: j,
       isAuthInitializing: !y,
       isAuthReady: y,
-      currentUser: x,
+      currentUser: A,
       isUserLoading: I,
-      userError: k,
+      userError: E,
       userRole: F,
       userPermissions: H,
-      availableRoles: A,
-      rolesLoading: S,
+      availableRoles: k,
+      rolesLoading: c,
       userTenants: g,
-      hasTenantContext: Z,
+      hasTenantContext: K,
       sessionManager: o,
       authenticatedHttpService: u,
       hasPermission: w,
@@ -1470,27 +1516,27 @@ function Rr({ config: r = {}, children: e }) {
   }, [
     j,
     y,
-    x,
+    A,
     I,
-    k,
+    E,
     F,
     H,
-    A,
-    S,
+    k,
+    c,
     g,
-    Z,
+    K,
     o,
     u
   ]);
   return re(() => {
     if (r.initialRoles || !a) return;
     let w = !1;
-    return h(!0), se.getRolesByApp(a).then(({ roles: M }) => {
-      w || c(M);
+    return d(!0), se.getRolesByApp(a).then(({ roles: M }) => {
+      w || T(M);
     }).catch((M) => {
       process.env.NODE_ENV === "development" && console.error("[AuthProvider] Failed to fetch roles:", M);
     }).finally(() => {
-      w || h(!1);
+      w || d(!1);
     }), () => {
       w = !0;
     };
@@ -1501,24 +1547,24 @@ function Rr({ config: r = {}, children: e }) {
       if (!o.hasValidSession() && ((O = o.getTokens()) != null && O.refreshToken) && await o.waitForPendingRefresh(), w || !o.hasValidSession() && !o.getTokens() && r.enableCookieSession && (await o.attemptCookieSessionRestore(), w))
         return;
       const z = o.getUser();
-      z && o.hasValidSession() && P(z), E(!1);
+      z && o.hasValidSession() && P(z), x(!1);
     })(), () => {
       w = !0;
     };
   }, [o, r.enableCookieSession]), re(() => {
-    !x && !I && !k && o.hasValidSession() ? $.current.loadUserData().catch(() => {
+    !A && !I && !E && o.hasValidSession() ? $.current.loadUserData().catch(() => {
     }).finally(() => {
-      E(!1);
-    }) : E(!1);
-  }, [x, I, k, o]), /* @__PURE__ */ s(Ie.Provider, { value: yt, children: /* @__PURE__ */ s(Pe.Provider, { value: bt, children: e }) });
+      x(!1);
+    }) : x(!1);
+  }, [A, I, E, o]), /* @__PURE__ */ s(Ie.Provider, { value: bt, children: /* @__PURE__ */ s(Pe.Provider, { value: wt, children: e }) });
 }
-function Pr() {
+function Ir() {
   const r = ne(Pe);
   if (!r)
     throw new Error("useAuthState must be used within an AuthProvider");
   return r;
 }
-function Ir() {
+function Lr() {
   const r = ne(Ie);
   if (!r)
     throw new Error("useAuthActions must be used within an AuthProvider");
@@ -1534,7 +1580,7 @@ function Oe() {
   const r = ne(Pe), e = ne(Ie);
   return V(() => !r || !e ? null : { ...r, ...e }, [r, e]);
 }
-class Ot {
+class Vt {
   constructor(e) {
     this.httpService = e;
   }
@@ -1582,24 +1628,24 @@ class Ot {
   }
 }
 const Ve = fe(null);
-function Lr({ config: r = {}, children: e }) {
-  const t = Ue(), n = pe(), i = (t == null ? void 0 : t.baseUrl) ?? "", a = (t == null ? void 0 : t.appId) ?? "", l = (n == null ? void 0 : n.tenant) ?? null, [d, T] = N([]), [A, c] = N(!1), [S, h] = N(null), [x, P] = N(!1), I = V(() => {
+function Fr({ config: r = {}, children: e }) {
+  const t = Ue(), n = pe(), i = (t == null ? void 0 : t.baseUrl) ?? "", a = (t == null ? void 0 : t.appId) ?? "", l = (n == null ? void 0 : n.tenant) ?? null, [h, S] = N([]), [k, T] = N(!1), [c, d] = N(null), [A, P] = N(!1), I = V(() => {
     const m = new he(i);
-    return new Ot(m);
+    return new Vt(m);
   }, [i]), R = async () => {
     if (!(l != null && l.id)) {
-      T([]);
+      S([]);
       return;
     }
-    c(!0), h(null);
+    T(!0), d(null);
     try {
       const m = await I.getTenantFeatureFlags(l.id, a);
-      T(m);
+      S(m);
     } catch (m) {
       const g = m instanceof Error ? m.message : "Failed to fetch feature flags";
-      h(g), r.onError && r.onError(m instanceof Error ? m : new Error(g));
+      d(g), r.onError && r.onError(m instanceof Error ? m : new Error(g));
     } finally {
-      c(!1);
+      T(!1);
     }
   };
   re(() => {
@@ -1608,30 +1654,30 @@ function Lr({ config: r = {}, children: e }) {
     const m = r.refreshInterval || 5 * 60 * 1e3, g = setInterval(R, m);
     return () => clearInterval(g);
   }, [l == null ? void 0 : l.id, i, a, r.refreshInterval]);
-  const k = V(() => {
+  const E = V(() => {
     const m = (p) => {
-      const E = d.find((y) => y.key === p);
-      return (E == null ? void 0 : E.value) === !0;
-    }, g = (p) => d.find((E) => E.key === p), b = (p) => {
-      const E = d.find((y) => y.key === p);
-      return E ? E.value ? "enabled" : "disabled" : "not_found";
+      const x = h.find((y) => y.key === p);
+      return (x == null ? void 0 : x.value) === !0;
+    }, g = (p) => h.find((x) => x.key === p), b = (p) => {
+      const x = h.find((y) => y.key === p);
+      return x ? x.value ? "enabled" : "disabled" : "not_found";
     }, C = async () => {
       await R();
-    }, o = !!(i && a) && (x || !(l != null && l.id));
+    }, o = !!(i && a) && (A || !(l != null && l.id));
     return {
-      featureFlags: d,
-      loading: A,
-      error: S,
+      featureFlags: h,
+      loading: k,
+      error: c,
       isReady: o,
       isEnabled: m,
       getFlag: g,
       getFlagState: b,
       refresh: C
     };
-  }, [d, A, S, i, a, l == null ? void 0 : l.id, x]);
-  return /* @__PURE__ */ s(Ve.Provider, { value: k, children: e });
+  }, [h, k, c, i, a, l == null ? void 0 : l.id, A]);
+  return /* @__PURE__ */ s(Ve.Provider, { value: E, children: e });
 }
-function Vt() {
+function qt() {
   const r = ne(Ve);
   if (!r)
     throw new Error("useFeatureFlags must be used within a FeatureFlagProvider");
@@ -1640,7 +1686,7 @@ function Vt() {
 function at() {
   return ne(Ve);
 }
-class qt {
+class zt {
   constructor(e) {
     this.httpService = e;
   }
@@ -1681,46 +1727,46 @@ class qt {
   }
 }
 const qe = fe(void 0);
-function Fr({ config: r = {}, children: e }) {
-  const t = Ue(), n = pe(), i = (t == null ? void 0 : t.baseUrl) ?? "", a = (n == null ? void 0 : n.tenant) ?? null, [l, d] = N(null), [T, A] = N(!1), [c, S] = N(null), [h, x] = N(!1), P = V(() => {
-    const k = new he(i);
-    return new qt(k);
+function Nr({ config: r = {}, children: e }) {
+  const t = Ue(), n = pe(), i = (t == null ? void 0 : t.baseUrl) ?? "", a = (n == null ? void 0 : n.tenant) ?? null, [l, h] = N(null), [S, k] = N(!1), [T, c] = N(null), [d, A] = N(!1), P = V(() => {
+    const E = new he(i);
+    return new zt(E);
   }, [i]), I = async () => {
     if (!(a != null && a.id)) {
-      d(null);
+      h(null);
       return;
     }
-    A(!0), S(null);
+    k(!0), c(null);
     try {
-      const k = await P.getTenantSubscriptionFeatures(a.id);
-      d(k);
-    } catch (k) {
-      const m = k instanceof Error ? k.message : "Failed to fetch subscription";
-      S(m), r.onError && r.onError(k instanceof Error ? k : new Error(m));
+      const E = await P.getTenantSubscriptionFeatures(a.id);
+      h(E);
+    } catch (E) {
+      const m = E instanceof Error ? E.message : "Failed to fetch subscription";
+      c(m), r.onError && r.onError(E instanceof Error ? E : new Error(m));
     } finally {
-      A(!1);
+      k(!1);
     }
   };
   re(() => {
-    if (!i || (I().finally(() => x(!0)), !r.refreshInterval)) return;
-    const k = r.refreshInterval || 10 * 60 * 1e3, m = setInterval(I, k);
+    if (!i || (I().finally(() => A(!0)), !r.refreshInterval)) return;
+    const E = r.refreshInterval || 10 * 60 * 1e3, m = setInterval(I, E);
     return () => clearInterval(m);
   }, [a == null ? void 0 : a.id, i, r.refreshInterval]);
   const R = V(() => {
-    const k = (l == null ? void 0 : l.features) || [], m = (E) => {
-      const y = k.find((u) => u.key === E);
+    const E = (l == null ? void 0 : l.features) || [], m = (x) => {
+      const y = E.find((u) => u.key === x);
       return y ? y.type === "BOOLEAN" || y.type === "boolean" ? y.value === !0 : !!y.value : !1;
-    }, g = (E) => k.find((y) => y.key === E), b = (E, y) => {
-      const u = k.find((v) => v.key === E);
+    }, g = (x) => E.find((y) => y.key === x), b = (x, y) => {
+      const u = E.find((v) => v.key === x);
       return u ? u.value : y;
-    }, C = (E) => !l || !l.isActive ? !1 : E.includes(l.planId), o = async () => {
+    }, C = (x) => !l || !l.isActive ? !1 : x.includes(l.planId), o = async () => {
       await I();
-    }, p = !!i && (h || !(a != null && a.id));
+    }, p = !!i && (d || !(a != null && a.id));
     return {
       subscription: l,
-      features: k,
-      loading: T,
-      error: c,
+      features: E,
+      loading: S,
+      error: T,
       isReady: p,
       isFeatureEnabled: m,
       getFeature: g,
@@ -1728,10 +1774,10 @@ function Fr({ config: r = {}, children: e }) {
       hasAllowedPlan: C,
       refresh: o
     };
-  }, [l, T, c, i, a == null ? void 0 : a.id, h]);
+  }, [l, S, T, i, a == null ? void 0 : a.id, d]);
   return /* @__PURE__ */ s(qe.Provider, { value: R, children: e });
 }
-function zt() {
+function jt() {
   const r = ne(qe);
   if (r === void 0)
     throw new Error("useSubscription must be used within a SubscriptionProvider");
@@ -1766,7 +1812,7 @@ const ze = {
   admin: { tenant: "required", auth: "required", userType: ae.TENANT_ADMIN },
   // Fully open
   open: { tenant: "optional", auth: "optional" }
-}, je = fe(null), jt = {
+}, je = fe(null), Wt = {
   zoneRoots: ze,
   presets: ct,
   loadingFallback: null,
@@ -1775,7 +1821,7 @@ const ze = {
   returnToParam: "returnTo",
   returnToStorage: "url"
 };
-function Nr({ config: r = {}, children: e }) {
+function Cr({ config: r = {}, children: e }) {
   const t = V(() => {
     const n = {
       ...ze,
@@ -1796,14 +1842,14 @@ function Nr({ config: r = {}, children: e }) {
   }, [r]);
   return /* @__PURE__ */ s(je.Provider, { value: t, children: e });
 }
-function Cr() {
+function Dr() {
   const r = ne(je);
   if (!r)
     throw new Error("useRouting must be used within a RoutingProvider");
   return r;
 }
-function Wt() {
-  return ne(je) ?? jt;
+function Gt() {
+  return ne(je) ?? Wt;
 }
 const tt = () => /* @__PURE__ */ f(
   "div",
@@ -1864,7 +1910,7 @@ const tt = () => /* @__PURE__ */ f(
     children: [
       /* @__PURE__ */ s("div", { style: { fontSize: "2rem", marginBottom: "10px" }, children: "⚠️" }),
       /* @__PURE__ */ s("h3", { style: { color: "#856404", marginBottom: "10px" }, children: "Insufficient Permissions" }),
-      e && r ? /* @__PURE__ */ f(B, { children: [
+      e && r ? /* @__PURE__ */ f(U, { children: [
         /* @__PURE__ */ f("p", { style: { color: "#856404", fontSize: "14px", marginBottom: "10px" }, children: [
           "This content requires ",
           /* @__PURE__ */ s("strong", { children: e }),
@@ -1874,7 +1920,7 @@ const tt = () => /* @__PURE__ */ f(
           "Your current access level: ",
           /* @__PURE__ */ s("strong", { children: r })
         ] })
-      ] }) : /* @__PURE__ */ f(B, { children: [
+      ] }) : /* @__PURE__ */ f(U, { children: [
         /* @__PURE__ */ s("p", { style: { color: "#856404", fontSize: "14px", marginBottom: "10px" }, children: "You don't have the required permissions to view this content." }),
         t && t.length > 0 && /* @__PURE__ */ f("p", { style: { color: "#6c757d", fontSize: "12px" }, children: [
           "Required permissions: ",
@@ -1883,7 +1929,7 @@ const tt = () => /* @__PURE__ */ f(
       ] })
     ]
   }
-), Gt = (r, e) => {
+), Ht = (r, e) => {
   const t = {
     [ae.USER]: 1,
     [ae.TENANT_ADMIN]: 2,
@@ -1891,28 +1937,28 @@ const tt = () => /* @__PURE__ */ f(
   };
   return t[r] >= t[e];
 };
-function Dr({
+function Mr({
   children: r,
   fallback: e,
   minUserType: t,
   requiredPermissions: n,
   requireAllPermissions: i = !1
 }) {
-  const { hasValidSession: a, sessionManager: l, hasPermission: d, hasAnyPermission: T, hasAllPermissions: A } = de();
+  const { hasValidSession: a, sessionManager: l, hasPermission: h, hasAnyPermission: S, hasAllPermissions: k } = de();
   if (!a())
-    return /* @__PURE__ */ s(B, { children: e || /* @__PURE__ */ s(tt, {}) });
-  const c = l.getUser();
-  if (!c)
-    return /* @__PURE__ */ s(B, { children: e || /* @__PURE__ */ s(tt, {}) });
-  if (t && !Gt(c.userType, t))
-    return /* @__PURE__ */ s(rt, { userType: c.userType, minUserType: t });
-  if (n && n.length > 0 && !(i ? A(n) : T(n))) {
-    const h = n.filter((x) => !d(x)).map((x) => typeof x == "string" ? x : x.name);
-    return /* @__PURE__ */ s(rt, { missingPermissions: h });
-  }
-  return /* @__PURE__ */ s(B, { children: r });
-}
-const Ht = ({ redirectPath: r }) => /* @__PURE__ */ s(
+    return /* @__PURE__ */ s(U, { children: e || /* @__PURE__ */ s(tt, {}) });
+  const T = l.getUser();
+  if (!T)
+    return /* @__PURE__ */ s(U, { children: e || /* @__PURE__ */ s(tt, {}) });
+  if (t && !Ht(T.userType, t))
+    return /* @__PURE__ */ s(rt, { userType: T.userType, minUserType: t });
+  if (n && n.length > 0 && !(i ? k(n) : S(n))) {
+    const d = n.filter((A) => !h(A)).map((A) => typeof A == "string" ? A : A.name);
+    return /* @__PURE__ */ s(rt, { missingPermissions: d });
+  }
+  return /* @__PURE__ */ s(U, { children: r });
+}
+const Qt = ({ redirectPath: r }) => /* @__PURE__ */ s(
   "div",
   {
     style: {
@@ -1978,7 +2024,7 @@ const Ht = ({ redirectPath: r }) => /* @__PURE__ */ s(
         children: [
           /* @__PURE__ */ s("div", { style: { fontSize: "3rem", marginBottom: "1rem" }, children: "⚠️" }),
           /* @__PURE__ */ s("h2", { style: { color: "#374151", marginBottom: "1rem" }, children: "Insufficient Permissions" }),
-          e && r ? /* @__PURE__ */ f(B, { children: [
+          e && r ? /* @__PURE__ */ f(U, { children: [
             /* @__PURE__ */ f("p", { style: { color: "#6b7280", marginBottom: "1rem" }, children: [
               "This page requires ",
               /* @__PURE__ */ s("strong", { children: e }),
@@ -1988,7 +2034,7 @@ const Ht = ({ redirectPath: r }) => /* @__PURE__ */ s(
               "Your current user type: ",
               /* @__PURE__ */ s("strong", { children: r })
             ] })
-          ] }) : /* @__PURE__ */ f(B, { children: [
+          ] }) : /* @__PURE__ */ f(U, { children: [
             /* @__PURE__ */ s("p", { style: { color: "#6b7280", marginBottom: "1rem" }, children: "You don't have the required permissions to access this page." }),
             t && t.length > 0 && /* @__PURE__ */ f("p", { style: { color: "#9ca3af", fontSize: "0.875rem" }, children: [
               "Required permissions: ",
@@ -1999,8 +2045,8 @@ const Ht = ({ redirectPath: r }) => /* @__PURE__ */ s(
       }
     )
   }
-), Qt = (r, e) => r === e;
-function Mr({
+), Jt = (r, e) => r === e;
+function $r({
   children: r,
   redirectTo: e = "/login",
   requiredUserType: t,
@@ -2008,34 +2054,34 @@ function Mr({
   requireAllPermissions: i = !1,
   fallback: a
 }) {
-  const { hasValidSession: l, sessionManager: d, hasPermission: T, hasAnyPermission: A, hasAllPermissions: c } = de(), S = xe();
+  const { hasValidSession: l, sessionManager: h, hasPermission: S, hasAnyPermission: k, hasAllPermissions: T } = de(), c = xe();
   if (re(() => {
     process.env.NODE_ENV === "development" && console.warn(
       "[react-identity-access] ProtectedRoute is deprecated. Use AuthenticatedZone or AdminZone from ZoneRoute instead."
     );
   }, []), !l())
-    return a ? /* @__PURE__ */ s(B, { children: a }) : /* @__PURE__ */ f(B, { children: [
-      /* @__PURE__ */ s(Ht, { redirectPath: e }),
-      /* @__PURE__ */ s(be, { to: e, state: { from: S.pathname }, replace: !0 })
+    return a ? /* @__PURE__ */ s(U, { children: a }) : /* @__PURE__ */ f(U, { children: [
+      /* @__PURE__ */ s(Qt, { redirectPath: e }),
+      /* @__PURE__ */ s(we, { to: e, state: { from: c.pathname }, replace: !0 })
     ] });
-  const h = d.getUser();
-  if (!h)
-    return /* @__PURE__ */ s(be, { to: e, state: { from: S.pathname }, replace: !0 });
-  if (t && !Qt(h.userType, t))
+  const d = h.getUser();
+  if (!d)
+    return /* @__PURE__ */ s(we, { to: e, state: { from: c.pathname }, replace: !0 });
+  if (t && !Jt(d.userType, t))
     return /* @__PURE__ */ s(
       nt,
       {
-        userType: h.userType,
+        userType: d.userType,
         requiredUserType: t
       }
     );
-  if (n && n.length > 0 && !(i ? c(n) : A(n))) {
-    const P = n.filter((I) => !T(I)).map((I) => typeof I == "string" ? I : I.name);
+  if (n && n.length > 0 && !(i ? T(n) : k(n))) {
+    const P = n.filter((I) => !S(I)).map((I) => typeof I == "string" ? I : I.name);
     return /* @__PURE__ */ s(nt, { missingPermissions: P });
   }
-  return /* @__PURE__ */ s(B, { children: r });
+  return /* @__PURE__ */ s(U, { children: r });
 }
-const Jt = ({ redirectPath: r }) => /* @__PURE__ */ s(
+const Zt = ({ redirectPath: r }) => /* @__PURE__ */ s(
   "div",
   {
     style: {
@@ -2072,18 +2118,18 @@ const Jt = ({ redirectPath: r }) => /* @__PURE__ */ s(
     )
   }
 );
-function $r({ children: r, redirectTo: e = "/", fallback: t }) {
+function Ur({ children: r, redirectTo: e = "/", fallback: t }) {
   const { tenant: n, isLoading: i, error: a } = ot(), l = xe();
   return re(() => {
     process.env.NODE_ENV === "development" && console.warn(
       "[react-identity-access] TenantRoute is deprecated. Use TenantZone from ZoneRoute instead."
     );
-  }, []), i || a ? null : n ? /* @__PURE__ */ s(B, { children: r }) : t ? /* @__PURE__ */ s(B, { children: t }) : /* @__PURE__ */ f(B, { children: [
-    /* @__PURE__ */ s(Jt, { redirectPath: e }),
-    /* @__PURE__ */ s(be, { to: e, state: { from: l.pathname }, replace: !0 })
+  }, []), i || a ? null : n ? /* @__PURE__ */ s(U, { children: r }) : t ? /* @__PURE__ */ s(U, { children: t }) : /* @__PURE__ */ f(U, { children: [
+    /* @__PURE__ */ s(Zt, { redirectPath: e }),
+    /* @__PURE__ */ s(we, { to: e, state: { from: l.pathname }, replace: !0 })
   ] });
 }
-const Zt = ({ redirectPath: r }) => /* @__PURE__ */ s(
+const Kt = ({ redirectPath: r }) => /* @__PURE__ */ s(
   "div",
   {
     style: {
@@ -2120,36 +2166,36 @@ const Zt = ({ redirectPath: r }) => /* @__PURE__ */ s(
     )
   }
 );
-function Ur({ children: r, redirectTo: e = "/dashboard", fallback: t }) {
+function Br({ children: r, redirectTo: e = "/dashboard", fallback: t }) {
   const { tenant: n, isLoading: i, error: a } = ot(), l = xe();
   return re(() => {
     process.env.NODE_ENV === "development" && console.warn(
       "[react-identity-access] LandingRoute is deprecated. Use PublicZone from ZoneRoute instead."
     );
-  }, []), i || a ? null : n ? t ? /* @__PURE__ */ s(B, { children: t }) : /* @__PURE__ */ f(B, { children: [
-    /* @__PURE__ */ s(Zt, { redirectPath: e }),
-    /* @__PURE__ */ s(be, { to: e, state: { from: l.pathname }, replace: !0 })
-  ] }) : /* @__PURE__ */ s(B, { children: r });
+  }, []), i || a ? null : n ? t ? /* @__PURE__ */ s(U, { children: t }) : /* @__PURE__ */ f(U, { children: [
+    /* @__PURE__ */ s(Kt, { redirectPath: e }),
+    /* @__PURE__ */ s(we, { to: e, state: { from: l.pathname }, replace: !0 })
+  ] }) : /* @__PURE__ */ s(U, { children: r });
 }
-function Kt(r, e) {
+function Yt(r, e) {
   return e ? r ? Array.isArray(e) ? e.includes(r) : r === e : !1 : !0;
 }
 function st(r, e) {
   return !r || r === "optional" ? "skip" : r === "required" ? e ? "pass" : "fail" : r === "forbidden" ? e ? "fail" : "pass" : "skip";
 }
-function Yt(r, e) {
-  return st(r.tenant, e.hasTenant) === "fail" ? e.hasTenant ? "has_tenant" : "no_tenant" : st(r.auth, e.isAuthenticated) === "fail" ? e.isAuthenticated ? "already_authenticated" : "not_authenticated" : r.userType && e.isAuthenticated && !Kt(e.userType, r.userType) ? "wrong_user_type" : r.permissions && r.permissions.length > 0 && !(r.requireAllPermissions !== !1 ? (a) => a.every((l) => e.permissions.includes(l)) : (a) => a.some((l) => e.permissions.includes(l)))(r.permissions) ? "missing_permissions" : null;
-}
 function Xt(r, e) {
+  return st(r.tenant, e.hasTenant) === "fail" ? e.hasTenant ? "has_tenant" : "no_tenant" : st(r.auth, e.isAuthenticated) === "fail" ? e.isAuthenticated ? "already_authenticated" : "not_authenticated" : r.userType && e.isAuthenticated && !Yt(e.userType, r.userType) ? "wrong_user_type" : r.permissions && r.permissions.length > 0 && !(r.requireAllPermissions !== !1 ? (a) => a.every((l) => e.permissions.includes(l)) : (a) => a.some((l) => e.permissions.includes(l)))(r.permissions) ? "missing_permissions" : null;
+}
+function er(r, e) {
   return r.hasTenant ? r.isAuthenticated ? r.userType === ae.TENANT_ADMIN ? e.tenantAdmin : e.tenantUser : e.tenantGuest : r.isAuthenticated ? r.userType === ae.TENANT_ADMIN ? e.publicAdmin : e.publicUser : e.publicGuest;
 }
-function er(r, e, t, n, i) {
+function tr(r, e, t, n, i) {
   if (!e || i !== "url")
     return r;
   const a = typeof e == "string" ? e : t, l = r.includes("?") ? "&" : "?";
   return `${r}${l}${n}=${encodeURIComponent(a)}`;
 }
-function tr(r, e, t) {
+function rr(r, e, t) {
   if (!r || t === "url") return;
   const n = typeof r == "string" ? r : e, i = "zone_return_to";
   t === "session" ? sessionStorage.setItem(i, n) : t === "local" && localStorage.setItem(i, n);
@@ -2162,13 +2208,13 @@ const ue = ({
   userType: i,
   requiredPermissions: a,
   requireAllPermissions: l = !0,
-  returnTo: d,
-  onAccessDenied: T,
-  redirectTo: A,
-  loadingFallback: c,
-  accessDeniedFallback: S
+  returnTo: h,
+  onAccessDenied: S,
+  redirectTo: k,
+  loadingFallback: T,
+  accessDeniedFallback: c
 }) => {
-  const h = xe(), { isAuthenticated: x, isAuthInitializing: P, currentUser: I, userPermissions: R } = de(), { tenant: k, isTenantLoading: m } = ve(), g = Wt(), b = V(() => {
+  const d = xe(), { isAuthenticated: A, isAuthInitializing: P, currentUser: I, userPermissions: R } = de(), { tenant: E, isTenantLoading: m } = Te(), g = Gt(), b = V(() => {
     if (e)
       return g.presets[e];
   }, [e, g.presets]), C = V(
@@ -2182,21 +2228,21 @@ const ue = ({
     [t, n, i, a, b, l]
   ), o = V(
     () => ({
-      hasTenant: !!k,
-      isAuthenticated: x,
+      hasTenant: !!E,
+      isAuthenticated: A,
       userType: I == null ? void 0 : I.userType,
       permissions: R,
       isLoading: P || m
     }),
     [
-      k,
-      x,
+      E,
+      A,
       I == null ? void 0 : I.userType,
       R,
       P,
       m
     ]
-  ), p = V(() => o.isLoading ? null : Yt(C, o), [C, o]), E = V(() => p ? A || Xt(o, g.zoneRoots) : null, [p, A, o, g.zoneRoots]), y = V(() => !p || !E ? null : {
+  ), p = V(() => o.isLoading ? null : Xt(C, o), [C, o]), x = V(() => p ? k || er(o, g.zoneRoots) : null, [p, k, o, g.zoneRoots]), y = V(() => !p || !x ? null : {
     type: p,
     required: {
       tenant: C.tenant,
@@ -2210,35 +2256,35 @@ const ue = ({
       userType: o.userType,
       permissions: o.permissions
     },
-    redirectTo: E
-  }, [p, E, C, o]);
+    redirectTo: x
+  }, [p, x, C, o]);
   if (re(() => {
-    y && (T ? T(y) : g.onAccessDenied && g.onAccessDenied(y));
-  }, [y, T, g]), re(() => {
-    y && d && tr(d, h.pathname + h.search, g.returnToStorage);
+    y && (S ? S(y) : g.onAccessDenied && g.onAccessDenied(y));
+  }, [y, S, g]), re(() => {
+    y && h && rr(h, d.pathname + d.search, g.returnToStorage);
   }, [
     y,
-    d,
-    h.pathname,
-    h.search,
+    h,
+    d.pathname,
+    d.search,
     g.returnToStorage
   ]), o.isLoading)
-    return /* @__PURE__ */ s(B, { children: c ?? g.loadingFallback ?? null });
-  if (y && E) {
-    const u = S ?? g.accessDeniedFallback;
+    return /* @__PURE__ */ s(U, { children: T ?? g.loadingFallback ?? null });
+  if (y && x) {
+    const u = c ?? g.accessDeniedFallback;
     if (u)
-      return /* @__PURE__ */ s(B, { children: u });
-    const v = er(
-      E,
-      d,
-      h.pathname + h.search,
+      return /* @__PURE__ */ s(U, { children: u });
+    const v = tr(
+      x,
+      h,
+      d.pathname + d.search,
       g.returnToParam,
       g.returnToStorage
     );
-    return /* @__PURE__ */ s(be, { to: v, replace: !0 });
+    return /* @__PURE__ */ s(we, { to: v, replace: !0 });
   }
-  return /* @__PURE__ */ s(B, { children: r });
-}, Br = (r) => /* @__PURE__ */ s(ue, { tenant: "required", ...r }), _r = (r) => /* @__PURE__ */ s(ue, { tenant: "forbidden", ...r }), Or = (r) => /* @__PURE__ */ s(ue, { auth: "required", ...r }), Vr = (r) => /* @__PURE__ */ s(ue, { auth: "forbidden", ...r }), qr = (r) => /* @__PURE__ */ s(ue, { auth: "required", userType: ae.TENANT_ADMIN, ...r }), zr = (r) => /* @__PURE__ */ s(ue, { auth: "required", userType: ae.USER, ...r }), jr = (r) => /* @__PURE__ */ s(ue, { tenant: "optional", auth: "optional", ...r }), Wr = (r) => /* @__PURE__ */ s(ue, { tenant: "required", auth: "required", ...r }), Gr = (r) => /* @__PURE__ */ s(ue, { tenant: "required", auth: "optional", ...r }), Hr = (r) => /* @__PURE__ */ s(ue, { tenant: "required", auth: "forbidden", ...r }), rr = () => /* @__PURE__ */ f(
+  return /* @__PURE__ */ s(U, { children: r });
+}, _r = (r) => /* @__PURE__ */ s(ue, { tenant: "required", ...r }), Or = (r) => /* @__PURE__ */ s(ue, { tenant: "forbidden", ...r }), Vr = (r) => /* @__PURE__ */ s(ue, { auth: "required", ...r }), qr = (r) => /* @__PURE__ */ s(ue, { auth: "forbidden", ...r }), zr = (r) => /* @__PURE__ */ s(ue, { auth: "required", userType: ae.TENANT_ADMIN, ...r }), jr = (r) => /* @__PURE__ */ s(ue, { auth: "required", userType: ae.USER, ...r }), Wr = (r) => /* @__PURE__ */ s(ue, { tenant: "optional", auth: "optional", ...r }), Gr = (r) => /* @__PURE__ */ s(ue, { tenant: "required", auth: "required", ...r }), Hr = (r) => /* @__PURE__ */ s(ue, { tenant: "required", auth: "optional", ...r }), Qr = (r) => /* @__PURE__ */ s(ue, { tenant: "required", auth: "forbidden", ...r }), nr = () => /* @__PURE__ */ f(
   "div",
   {
     style: {
@@ -2255,14 +2301,14 @@ const ue = ({
     ]
   }
 );
-function Qr({
+function Jr({
   children: r,
-  fallback: e = /* @__PURE__ */ s(rr, {}),
+  fallback: e = /* @__PURE__ */ s(nr, {}),
   allowedPlans: t,
   requiredFeature: n
 }) {
-  const { subscription: i, hasAllowedPlan: a, isFeatureEnabled: l, loading: d } = zt();
-  return d ? /* @__PURE__ */ s(
+  const { subscription: i, hasAllowedPlan: a, isFeatureEnabled: l, loading: h } = jt();
+  return h ? /* @__PURE__ */ s(
     "div",
     {
       style: {
@@ -2272,9 +2318,9 @@ function Qr({
       },
       children: "Loading subscription..."
     }
-  ) : i ? i.isActive ? t && t.length > 0 && !a(t) ? /* @__PURE__ */ s(B, { children: e }) : n && !l(n) ? /* @__PURE__ */ s(B, { children: e }) : /* @__PURE__ */ s(B, { children: r }) : /* @__PURE__ */ s(B, { children: e }) : /* @__PURE__ */ s(B, { children: e });
+  ) : i ? i.isActive ? t && t.length > 0 && !a(t) ? /* @__PURE__ */ s(U, { children: e }) : n && !l(n) ? /* @__PURE__ */ s(U, { children: e }) : /* @__PURE__ */ s(U, { children: r }) : /* @__PURE__ */ s(U, { children: e }) : /* @__PURE__ */ s(U, { children: e });
 }
-const nr = ({ flagName: r }) => /* @__PURE__ */ f(
+const sr = ({ flagName: r }) => /* @__PURE__ */ f(
   "div",
   {
     style: {
@@ -2301,8 +2347,8 @@ const nr = ({ flagName: r }) => /* @__PURE__ */ f(
     ]
   }
 );
-function Jr({ name: r, children: e, fallback: t }) {
-  const { isEnabled: n, loading: i } = Vt();
+function Zr({ name: r, children: e, fallback: t }) {
+  const { isEnabled: n, loading: i } = qt();
   return i ? /* @__PURE__ */ s(
     "div",
     {
@@ -2316,32 +2362,32 @@ function Jr({ name: r, children: e, fallback: t }) {
       },
       children: "Loading feature flags..."
     }
-  ) : n(r) ? /* @__PURE__ */ s(B, { children: e }) : /* @__PURE__ */ s(B, { children: t || /* @__PURE__ */ s(nr, { flagName: r }) });
-}
-function we(r) {
-  const { submit: e, defaultErrorMessage: t, validate: n, onSuccess: i, onError: a } = r, [l, d] = N(!1), [T, A] = N(""), [c, S] = N({}), h = te((R, k) => {
-    S((m) => ({ ...m, [R]: k }));
-  }, []), x = te((R) => {
-    S((k) => {
-      if (!k[R]) return k;
-      const m = { ...k };
+  ) : n(r) ? /* @__PURE__ */ s(U, { children: e }) : /* @__PURE__ */ s(U, { children: t || /* @__PURE__ */ s(sr, { flagName: r }) });
+}
+function ve(r) {
+  const { submit: e, defaultErrorMessage: t, validate: n, onSuccess: i, onError: a } = r, [l, h] = N(!1), [S, k] = N(""), [T, c] = N({}), d = te((R, E) => {
+    c((m) => ({ ...m, [R]: E }));
+  }, []), A = te((R) => {
+    c((E) => {
+      if (!E[R]) return E;
+      const m = { ...E };
       return delete m[R], m;
     });
   }, []), P = te(() => {
-    A(""), S({});
+    k(""), c({});
   }, []), I = te(
     async (R) => {
       if (R && R.preventDefault(), !(n && !n())) {
-        d(!0), A("");
+        h(!0), k("");
         try {
-          const k = await e();
-          return i == null || i(k), k;
-        } catch (k) {
-          const m = k instanceof Error ? k.message : t;
-          A(m), a == null || a(m);
+          const E = await e();
+          return i == null || i(E), E;
+        } catch (E) {
+          const m = E instanceof Error ? E.message : t;
+          k(m), a == null || a(m);
           return;
         } finally {
-          d(!1);
+          h(!1);
         }
       }
     },
@@ -2349,11 +2395,11 @@ function we(r) {
   );
   return {
     loading: l,
-    error: T,
-    setError: A,
-    fieldErrors: c,
-    setFieldError: h,
-    clearFieldError: x,
+    error: S,
+    setError: k,
+    fieldErrors: T,
+    setFieldError: d,
+    clearFieldError: A,
     resetErrors: P,
     handleSubmit: I
   };
@@ -2533,7 +2579,7 @@ function Le(r, e) {
     }
   };
 }
-const sr = () => me.createElement(
+const ir = () => me.createElement(
   "svg",
   {
     width: "16",
@@ -2548,7 +2594,7 @@ const sr = () => me.createElement(
   },
   me.createElement("path", { d: "M1 12s4-8 11-8 11 8 11 8-4 8-11 8-11-8-11-8z" }),
   me.createElement("circle", { cx: "12", cy: "12", r: "3" })
-), ir = () => me.createElement(
+), or = () => me.createElement(
   "svg",
   {
     width: "16",
@@ -2565,10 +2611,10 @@ const sr = () => me.createElement(
     d: "M17.94 17.94A10.07 10.07 0 0 1 12 20c-7 0-11-8-11-8a18.45 18.45 0 0 1 5.06-5.94M9.9 4.24A9.12 9.12 0 0 1 12 4c7 0 11 8 11 8a18.5 18.5 0 0 1-2.16 3.19m-6.72-1.07a3 3 0 1 1-4.24-4.24"
   }),
   me.createElement("line", { x1: "1", y1: "1", x2: "23", y2: "23" })
-), or = {
-  showPassword: /* @__PURE__ */ s(sr, {}),
-  hidePassword: /* @__PURE__ */ s(ir, {})
-}, ar = {
+), ar = {
+  showPassword: /* @__PURE__ */ s(ir, {}),
+  hidePassword: /* @__PURE__ */ s(or, {})
+}, lr = {
   title: "Sign In",
   usernameLabel: "Email or Phone",
   usernamePlaceholder: "Enter your email or phone number",
@@ -2587,7 +2633,7 @@ const sr = () => me.createElement(
   showPasswordAriaLabel: "Show password",
   hidePasswordAriaLabel: "Hide password"
 };
-function Zr({
+function Kr({
   copy: r = {},
   styles: e = {},
   icons: t = {},
@@ -2595,30 +2641,30 @@ function Zr({
   onError: i,
   onForgotPassword: a,
   onSignupClick: l,
-  onMagicLinkClick: d,
-  showForgotPassword: T = !0,
-  showSignupLink: A = !0,
-  showMagicLinkOption: c = !0,
-  className: S
+  onMagicLinkClick: h,
+  showForgotPassword: S = !0,
+  showSignupLink: k = !0,
+  showMagicLinkOption: T = !0,
+  className: c
 }) {
-  const [h, x] = N(""), [P, I] = N(""), [R, k] = N(!1), { login: m } = de(), g = { ...ar, ...r }, b = Le("#3b82f6", e), C = { ...or, ...t }, o = we({
+  const [d, A] = N(""), [P, I] = N(""), [R, E] = N(!1), { login: m } = de(), g = { ...lr, ...r }, b = Le("#3b82f6", e), C = { ...ar, ...t }, o = ve({
     defaultErrorMessage: g.errorMessage,
     validate: () => {
       const u = [];
-      return h.trim() || u.push("username"), P.trim() || u.push("password"), u.forEach((v) => o.setFieldError(v, !0)), u.length === 0;
+      return d.trim() || u.push("username"), P.trim() || u.push("password"), u.forEach((v) => o.setFieldError(v, !0)), u.length === 0;
     },
-    submit: () => m({ username: h, password: P }),
+    submit: () => m({ username: d, password: P }),
     onSuccess: n,
     onError: i
   }), p = (u) => ({
     ...b.input,
     ...o.fieldErrors[u] ? b.inputError : {}
-  }), E = !h || !P || o.loading, y = {
+  }), x = !d || !P || o.loading, y = {
     ...b.button,
     ...o.loading ? b.buttonLoading : {},
-    ...E ? b.buttonDisabled : {}
+    ...x ? b.buttonDisabled : {}
   };
-  return /* @__PURE__ */ f("div", { className: S, style: b.container, children: [
+  return /* @__PURE__ */ f("div", { className: c, style: b.container, children: [
     /* @__PURE__ */ s("h2", { style: b.title, children: g.title }),
     /* @__PURE__ */ f("form", { onSubmit: o.handleSubmit, style: b.form, children: [
       /* @__PURE__ */ f("div", { style: b.fieldGroup, children: [
@@ -2629,9 +2675,9 @@ function Zr({
             id: "username",
             name: "username",
             type: "text",
-            value: h,
+            value: d,
             onChange: (u) => {
-              x(u.target.value), o.clearFieldError("username");
+              A(u.target.value), o.clearFieldError("username");
             },
             placeholder: g.usernamePlaceholder,
             style: p("username"),
@@ -2661,7 +2707,7 @@ function Zr({
             "button",
             {
               type: "button",
-              onClick: () => k(!R),
+              onClick: () => E(!R),
               style: b.passwordToggle,
               disabled: o.loading,
               "aria-label": R ? g.hidePasswordAriaLabel : g.showPasswordAriaLabel,
@@ -2670,21 +2716,21 @@ function Zr({
           )
         ] })
       ] }),
-      /* @__PURE__ */ s("button", { type: "submit", disabled: E, style: y, children: o.loading ? g.loadingText : g.submitButton }),
+      /* @__PURE__ */ s("button", { type: "submit", disabled: x, style: y, children: o.loading ? g.loadingText : g.submitButton }),
       o.error && /* @__PURE__ */ s("div", { style: b.errorText, children: o.error })
     ] }),
-    (T || A || c) && /* @__PURE__ */ f("div", { style: b.linkContainer, children: [
-      c && /* @__PURE__ */ f("div", { children: [
+    (S || k || T) && /* @__PURE__ */ f("div", { style: b.linkContainer, children: [
+      T && /* @__PURE__ */ f("div", { children: [
         /* @__PURE__ */ f("span", { style: b.divider, children: [
           g.magicLinkText,
           " "
         ] }),
-        /* @__PURE__ */ s("a", { onClick: d, style: b.link, children: g.magicLinkLink })
+        /* @__PURE__ */ s("a", { onClick: h, style: b.link, children: g.magicLinkLink })
       ] }),
-      c && (T || A) && /* @__PURE__ */ s("div", { style: b.divider, children: g.dividerBullet }),
-      T && /* @__PURE__ */ s("a", { onClick: a, style: b.link, children: g.forgotPasswordLink }),
-      T && A && /* @__PURE__ */ s("div", { style: b.divider, children: g.dividerBullet }),
-      A && /* @__PURE__ */ f("div", { children: [
+      T && (S || k) && /* @__PURE__ */ s("div", { style: b.divider, children: g.dividerBullet }),
+      S && /* @__PURE__ */ s("a", { onClick: a, style: b.link, children: g.forgotPasswordLink }),
+      S && k && /* @__PURE__ */ s("div", { style: b.divider, children: g.dividerBullet }),
+      k && /* @__PURE__ */ f("div", { children: [
         /* @__PURE__ */ f("span", { style: b.divider, children: [
           g.signupText,
           " "
@@ -2694,7 +2740,7 @@ function Zr({
     ] })
   ] });
 }
-const lr = {
+const cr = {
   title: "Create Account",
   nameLabel: "First Name",
   namePlaceholder: "Enter your first name",
@@ -2724,7 +2770,7 @@ const lr = {
   tenantNotFoundError: "Tenant not found",
   dividerBullet: "•"
 };
-function Kr({
+function Yr({
   copy: r = {},
   styles: e = {},
   signupType: t = "user",
@@ -2732,45 +2778,45 @@ function Kr({
   onError: i,
   onLoginClick: a,
   onMagicLinkClick: l,
-  showLoginLink: d = !0,
-  showMagicLinkOption: T = !0,
-  className: A
+  showLoginLink: h = !0,
+  showMagicLinkOption: S = !0,
+  className: k
 }) {
-  var U;
-  const [c, S] = N(""), [h, x] = N(""), [P, I] = N(""), [R, k] = N(""), [m, g] = N(""), [b, C] = N(""), [o, p] = N(""), { signup: E, signupTenantAdmin: y } = de(), u = ((U = pe()) == null ? void 0 : U.tenant) ?? null, v = { ...lr, ...r }, D = Le("#10b981", e), se = !!c && (!!P || !!R) && !!m && !!b && (t === "user" || !!o), F = we({
+  var B;
+  const [T, c] = N(""), [d, A] = N(""), [P, I] = N(""), [R, E] = N(""), [m, g] = N(""), [b, C] = N(""), [o, p] = N(""), { signup: x, signupTenantAdmin: y } = de(), u = ((B = pe()) == null ? void 0 : B.tenant) ?? null, v = { ...cr, ...r }, D = Le("#10b981", e), se = !!T && (!!P || !!R) && !!m && !!b && (t === "user" || !!o), F = ve({
     defaultErrorMessage: v.errorMessage,
     validate: () => {
       const L = [];
-      return c.trim() || L.push("name"), !P.trim() && !R.trim() && (L.push("email"), L.push("phoneNumber")), m.trim() || L.push("password"), b.trim() || L.push("confirmPassword"), t === "tenant" && !o.trim() && L.push("tenantName"), L.forEach((q) => F.setFieldError(q, !0)), L.length > 0 ? !1 : m !== b ? (F.setError(v.passwordMismatchError), F.setFieldError("confirmPassword", !0), !1) : t === "user" && !(u != null && u.id) ? (F.setError(v.tenantNotFoundError), !1) : !0;
+      return T.trim() || L.push("name"), !P.trim() && !R.trim() && (L.push("email"), L.push("phoneNumber")), m.trim() || L.push("password"), b.trim() || L.push("confirmPassword"), t === "tenant" && !o.trim() && L.push("tenantName"), L.forEach((q) => F.setFieldError(q, !0)), L.length > 0 ? !1 : m !== b ? (F.setError(v.passwordMismatchError), F.setFieldError("confirmPassword", !0), !1) : t === "user" && !(u != null && u.id) ? (F.setError(v.tenantNotFoundError), !1) : !0;
     },
     submit: async () => t === "tenant" ? y({
       email: P || void 0,
       phoneNumber: R || void 0,
-      name: c,
+      name: T,
       password: m,
       tenantName: o,
-      lastName: h || void 0
-    }) : E({
+      lastName: d || void 0
+    }) : x({
       email: P || void 0,
       phoneNumber: R || void 0,
-      name: c,
+      name: T,
       password: m,
       tenantId: u.id,
-      lastName: h || void 0
+      lastName: d || void 0
     }),
     onSuccess: n,
     onError: i
   }), H = (L) => ({
     ...D.input,
     ...F.fieldErrors[L] ? D.inputError : {}
-  }), j = !se || F.loading, Z = {
+  }), j = !se || F.loading, K = {
     ...D.button,
     ...F.loading ? D.buttonLoading : {},
     ...j ? D.buttonDisabled : {}
   }, $ = () => {
     F.clearFieldError("email"), F.clearFieldError("phoneNumber");
   };
-  return /* @__PURE__ */ f("div", { className: A, style: D.container, children: [
+  return /* @__PURE__ */ f("div", { className: k, style: D.container, children: [
     /* @__PURE__ */ s("h2", { style: D.title, children: v.title }),
     /* @__PURE__ */ f("form", { onSubmit: F.handleSubmit, style: D.form, children: [
       /* @__PURE__ */ f("div", { style: D.fieldGroup, children: [
@@ -2781,9 +2827,9 @@ function Kr({
             id: "name",
             name: "name",
             type: "text",
-            value: c,
+            value: T,
             onChange: (L) => {
-              S(L.target.value), F.clearFieldError("name");
+              c(L.target.value), F.clearFieldError("name");
             },
             placeholder: v.namePlaceholder,
             style: H("name"),
@@ -2799,8 +2845,8 @@ function Kr({
             id: "lastName",
             name: "lastName",
             type: "text",
-            value: h,
-            onChange: (L) => x(L.target.value),
+            value: d,
+            onChange: (L) => A(L.target.value),
             placeholder: v.lastNamePlaceholder,
             style: D.input,
             disabled: F.loading
@@ -2835,7 +2881,7 @@ function Kr({
             type: "tel",
             value: R,
             onChange: (L) => {
-              k(L.target.value), $();
+              E(L.target.value), $();
             },
             placeholder: v.phoneNumberPlaceholder,
             style: H("phoneNumber"),
@@ -2898,19 +2944,19 @@ function Kr({
           }
         )
       ] }),
-      /* @__PURE__ */ s("button", { type: "submit", disabled: j, style: Z, children: F.loading ? v.loadingText : v.submitButton }),
+      /* @__PURE__ */ s("button", { type: "submit", disabled: j, style: K, children: F.loading ? v.loadingText : v.submitButton }),
       F.error && /* @__PURE__ */ s("div", { style: D.errorText, children: F.error })
     ] }),
-    (d || T) && /* @__PURE__ */ f("div", { style: D.linkContainer, children: [
-      T && /* @__PURE__ */ f("div", { children: [
+    (h || S) && /* @__PURE__ */ f("div", { style: D.linkContainer, children: [
+      S && /* @__PURE__ */ f("div", { children: [
         /* @__PURE__ */ f("span", { style: D.divider, children: [
           v.magicLinkText,
           " "
         ] }),
         /* @__PURE__ */ s("a", { onClick: l, style: D.link, children: v.magicLinkLink })
       ] }),
-      T && d && /* @__PURE__ */ s("div", { style: D.divider, children: v.dividerBullet }),
-      d && /* @__PURE__ */ f("div", { children: [
+      S && h && /* @__PURE__ */ s("div", { style: D.divider, children: v.dividerBullet }),
+      h && /* @__PURE__ */ f("div", { children: [
         /* @__PURE__ */ f("span", { style: D.divider, children: [
           v.loginText,
           " "
@@ -2920,7 +2966,7 @@ function Kr({
     ] })
   ] });
 }
-const cr = {
+const ur = {
   title: "Sign In with Magic Link",
   emailLabel: "Email",
   emailPlaceholder: "Enter your email",
@@ -2945,7 +2991,7 @@ const cr = {
   missingTenantOrEmailError: "Missing tenant or email",
   dividerBullet: "•"
 };
-function Yr({
+function Xr({
   copy: r = {},
   styles: e = {},
   onSuccess: t,
@@ -2953,62 +2999,62 @@ function Yr({
   onLoginClick: i,
   onSignupClick: a,
   showTraditionalLinks: l = !0,
-  className: d,
-  verifyToken: T,
-  frontendUrl: A
+  className: h,
+  verifyToken: S,
+  frontendUrl: k
 }) {
   var H;
-  const [c, S] = N(""), [h, x] = N(""), [P, I] = N(""), [R, k] = N(!1), [m, g] = N(""), [b, C] = N(!1), { sendMagicLink: o, verifyMagicLink: p } = de(), E = ((H = pe()) == null ? void 0 : H.tenant) ?? null, y = { ...cr, ...r }, u = Le("#3b82f6", e), v = we({
+  const [T, c] = N(""), [d, A] = N(""), [P, I] = N(""), [R, E] = N(!1), [m, g] = N(""), [b, C] = N(!1), { sendMagicLink: o, verifyMagicLink: p } = de(), x = ((H = pe()) == null ? void 0 : H.tenant) ?? null, y = { ...ur, ...r }, u = Le("#3b82f6", e), v = ve({
     defaultErrorMessage: y.errorMessage,
     validate: () => {
       const j = [];
-      return c.trim() || j.push("email"), b && !h.trim() && j.push("name"), j.forEach((Z) => v.setFieldError(Z, !0)), j.length > 0 ? !1 : E != null && E.id ? !0 : (v.setError(y.tenantNotFoundError), !1);
+      return T.trim() || j.push("email"), b && !d.trim() && j.push("name"), j.forEach((K) => v.setFieldError(K, !0)), j.length > 0 ? !1 : x != null && x.id ? !0 : (v.setError(y.tenantNotFoundError), !1);
     },
     submit: async () => {
       g("");
-      const j = A || (typeof window < "u" ? window.location.origin : ""), Z = await o({
-        email: c,
-        tenantId: E.id,
+      const j = k || (typeof window < "u" ? window.location.origin : ""), K = await o({
+        email: T,
+        tenantId: x.id,
         frontendUrl: j,
-        name: b ? h : void 0,
+        name: b ? d : void 0,
         lastName: b ? P : void 0
       });
-      return g(y.successMessage), Z;
+      return g(y.successMessage), K;
     },
     onSuccess: t,
     onError: n
   });
   re(() => {
-    if (!T) return;
+    if (!S) return;
     (async () => {
-      if (!E || !c) {
+      if (!x || !T) {
         v.setError(y.missingTenantOrEmailError);
         return;
       }
-      k(!0), v.setError("");
+      E(!0), v.setError("");
       try {
-        const Z = await p({ token: T, email: c });
-        t == null || t(Z);
-      } catch (Z) {
-        const $ = Z instanceof Error ? Z.message : "Failed to verify magic link";
+        const K = await p({ token: S, email: T });
+        t == null || t(K);
+      } catch (K) {
+        const $ = K instanceof Error ? K.message : "Failed to verify magic link";
         v.setError($), n == null || n($);
       } finally {
-        k(!1);
+        E(!1);
       }
     })();
-  }, [T]);
+  }, [S]);
   const D = (j) => ({
     ...u.input,
     ...v.fieldErrors[j] ? u.inputError : {}
-  }), se = !c || v.loading || R, F = {
+  }), se = !T || v.loading || R, F = {
     ...u.button,
     ...v.loading || R ? u.buttonLoading : {},
     ...se ? u.buttonDisabled : {}
   };
-  return R ? /* @__PURE__ */ f("div", { className: d, style: u.container, children: [
+  return R ? /* @__PURE__ */ f("div", { className: h, style: u.container, children: [
     /* @__PURE__ */ s("h2", { style: u.title, children: y.verifyingText }),
     /* @__PURE__ */ s("div", { style: u.verifyingContainer, children: /* @__PURE__ */ s("div", { style: u.verifyingText, children: y.verifyingDescription }) })
-  ] }) : /* @__PURE__ */ f("div", { className: d, style: u.container, children: [
+  ] }) : /* @__PURE__ */ f("div", { className: h, style: u.container, children: [
     /* @__PURE__ */ s("h2", { style: u.title, children: y.title }),
     /* @__PURE__ */ s("p", { style: u.description, children: y.description }),
     /* @__PURE__ */ f("form", { onSubmit: v.handleSubmit, style: u.form, children: [
@@ -3020,9 +3066,9 @@ function Yr({
             id: "email",
             name: "email",
             type: "email",
-            value: c,
+            value: T,
             onChange: (j) => {
-              S(j.target.value), v.clearFieldError("email");
+              c(j.target.value), v.clearFieldError("email");
             },
             placeholder: y.emailPlaceholder,
             style: D("email"),
@@ -3039,7 +3085,7 @@ function Yr({
           children: y.showNameToggle
         }
       ) }),
-      b && /* @__PURE__ */ f(B, { children: [
+      b && /* @__PURE__ */ f(U, { children: [
         /* @__PURE__ */ f("div", { style: u.fieldGroup, children: [
           /* @__PURE__ */ s("label", { style: u.label, children: y.nameLabel }),
           /* @__PURE__ */ s(
@@ -3048,9 +3094,9 @@ function Yr({
               id: "name",
               name: "name",
               type: "text",
-              value: h,
+              value: d,
               onChange: (j) => {
-                x(j.target.value), v.clearFieldError("name");
+                A(j.target.value), v.clearFieldError("name");
               },
               placeholder: y.namePlaceholder,
               style: D("name"),
@@ -3079,7 +3125,7 @@ function Yr({
           {
             type: "button",
             onClick: () => {
-              C(!1), x(""), I("");
+              C(!1), A(""), I("");
             },
             style: u.toggleLink,
             children: y.hideNameToggle
@@ -3109,7 +3155,7 @@ function Yr({
     ] })
   ] });
 }
-const ur = {
+const dr = {
   title: "Verifying Magic Link",
   verifyingMessage: "Please wait while we verify your magic link...",
   successMessage: "Magic link verified successfully! You are now logged in.",
@@ -3211,7 +3257,7 @@ const ur = {
   backButtonHover: {
     backgroundColor: "#e5e7eb"
   }
-}, dr = () => /* @__PURE__ */ s("div", { style: ut.spinner }), hr = () => /* @__PURE__ */ f(
+}, hr = () => /* @__PURE__ */ s("div", { style: ut.spinner }), pr = () => /* @__PURE__ */ f(
   "svg",
   {
     width: "48",
@@ -3228,7 +3274,7 @@ const ur = {
       /* @__PURE__ */ s("polyline", { points: "22,4 12,14.01 9,11.01" })
     ]
   }
-), pr = () => /* @__PURE__ */ f(
+), fr = () => /* @__PURE__ */ f(
   "svg",
   {
     width: "48",
@@ -3246,12 +3292,12 @@ const ur = {
       /* @__PURE__ */ s("line", { x1: "9", y1: "9", x2: "15", y2: "15" })
     ]
   }
-), fr = {
-  loading: /* @__PURE__ */ s(dr, {}),
-  success: /* @__PURE__ */ s(hr, {}),
-  error: /* @__PURE__ */ s(pr, {})
+), mr = {
+  loading: /* @__PURE__ */ s(hr, {}),
+  success: /* @__PURE__ */ s(pr, {}),
+  error: /* @__PURE__ */ s(fr, {})
 };
-function Xr({
+function en({
   copy: r = {},
   styles: e = {},
   icons: t = {},
@@ -3259,21 +3305,21 @@ function Xr({
   onError: i,
   onRetry: a,
   onBackToLogin: l,
-  className: d,
-  token: T,
-  email: A,
-  appId: c,
-  tenantSlug: S,
-  autoRedirectDelay: h = 3e3
+  className: h,
+  token: S,
+  email: k,
+  appId: T,
+  tenantSlug: c,
+  autoRedirectDelay: d = 3e3
 }) {
-  const [x, P] = N("verifying"), [I, R] = N(""), { verifyMagicLink: k } = de(), m = { ...ur, ...r }, g = { ...ut, ...e }, b = { ...fr, ...t }, C = () => {
+  const [A, P] = N("verifying"), [I, R] = N(""), { verifyMagicLink: E } = de(), m = { ...dr, ...r }, g = { ...ut, ...e }, b = { ...mr, ...t }, C = () => {
     if (typeof window > "u") return {};
     const u = new URLSearchParams(window.location.search);
     return {
-      token: T || u.get("token") || "",
-      email: A || u.get("email") || "",
-      appId: c || u.get("appId") || "",
-      tenantSlug: S || u.get("tenantSlug") || void 0
+      token: S || u.get("token") || "",
+      email: k || u.get("email") || "",
+      appId: T || u.get("appId") || "",
+      tenantSlug: c || u.get("tenantSlug") || void 0
     };
   }, o = async () => {
     P("verifying"), R("");
@@ -3281,45 +3327,45 @@ function Xr({
       const u = C();
       if (!u.token || !u.email)
         throw new Error(m.missingParamsError);
-      const v = await k({
+      const v = await E({
         token: u.token,
         email: u.email,
         tenantSlug: u.tenantSlug
       });
-      P("success"), n == null || n(v), h > 0 && setTimeout(() => {
+      P("success"), n == null || n(v), d > 0 && setTimeout(() => {
         P("redirecting");
-      }, h);
+      }, d);
     } catch (u) {
       const v = u.message || m.errorMessage;
       R(v), P("error"), i == null || i(v);
     }
   }, p = () => {
     a == null || a(), o();
-  }, E = () => {
+  }, x = () => {
     l == null || l();
   };
   re(() => {
     o();
   }, []);
   const y = () => {
-    switch (x) {
+    switch (A) {
       case "verifying":
         return /* @__PURE__ */ f("div", { style: g.message, children: [
           b.loading,
           m.verifyingMessage
         ] });
       case "success":
-        return /* @__PURE__ */ f(B, { children: [
+        return /* @__PURE__ */ f(U, { children: [
           b.success,
           /* @__PURE__ */ s("div", { style: g.successMessage, children: m.successMessage })
         ] });
       case "redirecting":
-        return /* @__PURE__ */ f(B, { children: [
+        return /* @__PURE__ */ f(U, { children: [
           b.loading,
           /* @__PURE__ */ s("div", { style: g.message, children: m.redirectingMessage })
         ] });
       case "error":
-        return /* @__PURE__ */ f(B, { children: [
+        return /* @__PURE__ */ f(U, { children: [
           b.error,
           /* @__PURE__ */ s("div", { style: g.errorMessage, children: I || m.errorMessage }),
           /* @__PURE__ */ f("div", { style: g.buttonContainer, children: [
@@ -3343,7 +3389,7 @@ function Xr({
             /* @__PURE__ */ s(
               "button",
               {
-                onClick: E,
+                onClick: x,
                 style: g.backButton,
                 onMouseOver: (u) => {
                   Object.assign(u.currentTarget.style, g.backButtonHover);
@@ -3363,7 +3409,7 @@ function Xr({
         return null;
     }
   };
-  return /* @__PURE__ */ f("div", { style: g.container, className: d, children: [
+  return /* @__PURE__ */ f("div", { style: g.container, className: h, children: [
     /* @__PURE__ */ s("style", { children: `
           @keyframes spin {
             0% { transform: rotate(0deg); }
@@ -3374,7 +3420,7 @@ function Xr({
     y()
   ] });
 }
-const mr = {
+const gr = {
   title: "Reset Password",
   subtitle: "Enter your email address and we'll send you a link to reset your password.",
   emailLabel: "Email",
@@ -3401,7 +3447,7 @@ const mr = {
   tenantNotFoundError: "Tenant not found",
   dividerBullet: "•"
 };
-function en({
+function tn({
   copy: r = {},
   styles: e = {},
   mode: t = "request",
@@ -3409,26 +3455,26 @@ function en({
   onSuccess: i,
   onError: a,
   onBackToLogin: l,
-  onModeChange: d,
-  className: T
+  onModeChange: h,
+  className: S
 }) {
   var se;
-  const [A, c] = N(""), [S, h] = N(n), [x, P] = N(""), [I, R] = N(""), [k, m] = N(""), { requestPasswordReset: g, confirmPasswordReset: b } = de(), C = ((se = pe()) == null ? void 0 : se.tenant) ?? null, o = { ...mr, ...r }, p = Le("#f59e0b", e), E = we({
+  const [k, T] = N(""), [c, d] = N(n), [A, P] = N(""), [I, R] = N(""), [E, m] = N(""), { requestPasswordReset: g, confirmPasswordReset: b } = de(), C = ((se = pe()) == null ? void 0 : se.tenant) ?? null, o = { ...gr, ...r }, p = Le("#f59e0b", e), x = ve({
     defaultErrorMessage: o.errorMessage,
-    validate: () => A.trim() ? C != null && C.id ? !0 : (E.setError(o.tenantNotFoundError), !1) : (E.setFieldError("email", !0), !1),
+    validate: () => k.trim() ? C != null && C.id ? !0 : (x.setError(o.tenantNotFoundError), !1) : (x.setFieldError("email", !0), !1),
     submit: async () => {
-      m(""), await g({ email: A, tenantId: C.id }), m(o.successMessage);
+      m(""), await g({ email: k, tenantId: C.id }), m(o.successMessage);
     },
     onSuccess: () => i == null ? void 0 : i(),
     onError: a
-  }), y = we({
+  }), y = ve({
     defaultErrorMessage: o.errorMessage,
     validate: () => {
       const F = [];
-      return S.trim() || F.push("token"), x.trim() || F.push("newPassword"), I.trim() || F.push("confirmPassword"), F.forEach((H) => y.setFieldError(H, !0)), F.length > 0 ? !1 : x !== I ? (y.setError(o.passwordMismatchError), y.setFieldError("confirmPassword", !0), !1) : !0;
+      return c.trim() || F.push("token"), A.trim() || F.push("newPassword"), I.trim() || F.push("confirmPassword"), F.forEach((H) => y.setFieldError(H, !0)), F.length > 0 ? !1 : A !== I ? (y.setError(o.passwordMismatchError), y.setFieldError("confirmPassword", !0), !1) : !0;
     },
     submit: async () => {
-      m(""), await b({ token: S, newPassword: x }), m(o.resetSuccessMessage);
+      m(""), await b({ token: c, newPassword: A }), m(o.resetSuccessMessage);
     },
     onSuccess: () => i == null ? void 0 : i(),
     onError: a
@@ -3437,12 +3483,12 @@ function en({
     const F = ($) => ({
       ...p.input,
       ...y.fieldErrors[$] ? p.inputError : {}
-    }), j = !(!!S && !!x && !!I) || y.loading, Z = {
+    }), j = !(!!c && !!A && !!I) || y.loading, K = {
       ...p.button,
       ...y.loading ? p.buttonLoading : {},
       ...j ? p.buttonDisabled : {}
     };
-    return /* @__PURE__ */ f("div", { className: T, style: p.container, children: [
+    return /* @__PURE__ */ f("div", { className: S, style: p.container, children: [
       /* @__PURE__ */ s("h2", { style: p.title, children: o.resetTitle }),
       /* @__PURE__ */ s("p", { style: p.subtitle, children: o.resetSubtitle }),
       /* @__PURE__ */ f("form", { onSubmit: y.handleSubmit, style: p.form, children: [
@@ -3452,9 +3498,9 @@ function en({
             "input",
             {
               type: "text",
-              value: S,
+              value: c,
               onChange: ($) => {
-                h($.target.value), y.clearFieldError("token");
+                d($.target.value), y.clearFieldError("token");
               },
               placeholder: o.tokenPlaceholder,
               style: F("token"),
@@ -3468,7 +3514,7 @@ function en({
             "input",
             {
               type: "password",
-              value: x,
+              value: A,
               onChange: ($) => {
                 P($.target.value), y.clearFieldError("newPassword");
               },
@@ -3494,61 +3540,61 @@ function en({
             }
           )
         ] }),
-        /* @__PURE__ */ s("button", { type: "submit", disabled: j, style: Z, children: y.loading ? o.resetLoadingText : o.resetSubmitButton }),
+        /* @__PURE__ */ s("button", { type: "submit", disabled: j, style: K, children: y.loading ? o.resetLoadingText : o.resetSubmitButton }),
         y.error && /* @__PURE__ */ s("div", { style: p.errorText, children: y.error }),
-        k && /* @__PURE__ */ s("div", { style: p.successText, children: k })
+        E && /* @__PURE__ */ s("div", { style: p.successText, children: E })
       ] }),
       /* @__PURE__ */ f("div", { style: p.linkContainer, children: [
         /* @__PURE__ */ s("a", { onClick: l, style: p.link, children: o.backToLoginLink }),
-        d && /* @__PURE__ */ f(B, { children: [
+        h && /* @__PURE__ */ f(U, { children: [
           /* @__PURE__ */ s("span", { style: p.modeSwitchDivider, children: o.dividerBullet }),
-          /* @__PURE__ */ s("a", { onClick: () => d("request"), style: p.link, children: o.requestNewLinkLink })
+          /* @__PURE__ */ s("a", { onClick: () => h("request"), style: p.link, children: o.requestNewLinkLink })
         ] })
       ] })
     ] });
   }
   const u = (F) => ({
     ...p.input,
-    ...E.fieldErrors[F] ? p.inputError : {}
-  }), v = !A || E.loading, D = {
+    ...x.fieldErrors[F] ? p.inputError : {}
+  }), v = !k || x.loading, D = {
     ...p.button,
-    ...E.loading ? p.buttonLoading : {},
+    ...x.loading ? p.buttonLoading : {},
     ...v ? p.buttonDisabled : {}
   };
-  return /* @__PURE__ */ f("div", { className: T, style: p.container, children: [
+  return /* @__PURE__ */ f("div", { className: S, style: p.container, children: [
     /* @__PURE__ */ s("h2", { style: p.title, children: o.title }),
     /* @__PURE__ */ s("p", { style: p.subtitle, children: o.subtitle }),
-    /* @__PURE__ */ f("form", { onSubmit: E.handleSubmit, style: p.form, children: [
+    /* @__PURE__ */ f("form", { onSubmit: x.handleSubmit, style: p.form, children: [
       /* @__PURE__ */ f("div", { style: p.fieldGroup, children: [
         /* @__PURE__ */ s("label", { style: p.label, children: o.emailLabel }),
         /* @__PURE__ */ s(
           "input",
           {
             type: "email",
-            value: A,
+            value: k,
             onChange: (F) => {
-              c(F.target.value), E.clearFieldError("email");
+              T(F.target.value), x.clearFieldError("email");
             },
             placeholder: o.emailPlaceholder,
             style: u("email"),
-            disabled: E.loading
+            disabled: x.loading
           }
         )
       ] }),
-      /* @__PURE__ */ s("button", { type: "submit", disabled: v, style: D, children: E.loading ? o.loadingText : o.submitButton }),
-      E.error && /* @__PURE__ */ s("div", { style: p.errorText, children: E.error }),
-      k && /* @__PURE__ */ s("div", { style: p.successText, children: k })
+      /* @__PURE__ */ s("button", { type: "submit", disabled: v, style: D, children: x.loading ? o.loadingText : o.submitButton }),
+      x.error && /* @__PURE__ */ s("div", { style: p.errorText, children: x.error }),
+      E && /* @__PURE__ */ s("div", { style: p.successText, children: E })
     ] }),
     /* @__PURE__ */ f("div", { style: p.linkContainer, children: [
       /* @__PURE__ */ s("a", { onClick: l, style: p.link, children: o.backToLoginLink }),
-      d && /* @__PURE__ */ f(B, { children: [
+      h && /* @__PURE__ */ f(U, { children: [
         /* @__PURE__ */ s("span", { style: p.modeSwitchDivider, children: o.dividerBullet }),
-        /* @__PURE__ */ s("a", { onClick: () => d("reset"), style: p.link, children: o.haveTokenLink })
+        /* @__PURE__ */ s("a", { onClick: () => h("reset"), style: p.link, children: o.haveTokenLink })
       ] })
     ] })
   ] });
 }
-const gr = () => /* @__PURE__ */ s(
+const yr = () => /* @__PURE__ */ s(
   "div",
   {
     style: {
@@ -3560,7 +3606,7 @@ const gr = () => /* @__PURE__ */ s(
     },
     children: /* @__PURE__ */ s("div", { children: "Loading..." })
   }
-), yr = ({ error: r, retry: e }) => /* @__PURE__ */ f(
+), br = ({ error: r, retry: e }) => /* @__PURE__ */ f(
   "div",
   {
     style: {
@@ -3594,43 +3640,43 @@ const gr = () => /* @__PURE__ */ s(
     ]
   }
 );
-function tn({
+function rn({
   children: r,
   loadingFallback: e,
   errorFallback: t,
   requireTenant: n = !0
 }) {
-  const { isAppLoading: i, appError: a, retryApp: l } = Ae(), d = pe(), T = Oe(), A = at(), c = lt(), S = (d == null ? void 0 : d.isTenantLoading) ?? !1, h = (d == null ? void 0 : d.tenantError) ?? null, x = (d == null ? void 0 : d.tenantSlug) ?? null, P = (d == null ? void 0 : d.retryTenant) ?? (() => {
-  }), I = (T == null ? void 0 : T.isAuthReady) ?? !0, R = (A == null ? void 0 : A.isReady) ?? !0, k = (c == null ? void 0 : c.isReady) ?? !0, m = n && d && x, o = i || m && S || T && !I || A && !R || c && !k, p = a || (m ? h : null), E = () => {
-    a && l(), h && d && P();
+  const { isAppLoading: i, appError: a, retryApp: l } = Ae(), h = pe(), S = Oe(), k = at(), T = lt(), c = (h == null ? void 0 : h.isTenantLoading) ?? !1, d = (h == null ? void 0 : h.tenantError) ?? null, A = (h == null ? void 0 : h.tenantSlug) ?? null, P = (h == null ? void 0 : h.retryTenant) ?? (() => {
+  }), I = (S == null ? void 0 : S.isAuthReady) ?? !0, R = (k == null ? void 0 : k.isReady) ?? !0, E = (T == null ? void 0 : T.isReady) ?? !0, m = n && h && A, o = i || m && c || S && !I || k && !R || T && !E, p = a || (m ? d : null), x = () => {
+    a && l(), d && h && P();
   };
   if (o)
-    return /* @__PURE__ */ s(B, { children: e || /* @__PURE__ */ s(gr, {}) });
+    return /* @__PURE__ */ s(U, { children: e || /* @__PURE__ */ s(yr, {}) });
   if (p) {
-    const y = typeof t == "function" ? t(p, E) : t || /* @__PURE__ */ s(yr, { error: p, retry: E });
-    return /* @__PURE__ */ s(B, { children: y });
+    const y = typeof t == "function" ? t(p, x) : t || /* @__PURE__ */ s(br, { error: p, retry: x });
+    return /* @__PURE__ */ s(U, { children: y });
   }
-  return /* @__PURE__ */ s(B, { children: r });
+  return /* @__PURE__ */ s(U, { children: r });
 }
-function rn(r = !0) {
-  const { isAppLoading: e, appError: t, retryApp: n, appInfo: i } = Ae(), a = pe(), l = Oe(), d = at(), T = lt(), A = (a == null ? void 0 : a.isTenantLoading) ?? !1, c = (a == null ? void 0 : a.tenantError) ?? null, S = (a == null ? void 0 : a.tenant) ?? null, h = (a == null ? void 0 : a.tenantSlug) ?? null, x = (a == null ? void 0 : a.retryTenant) ?? (() => {
-  }), P = (l == null ? void 0 : l.isAuthReady) ?? !0, I = (d == null ? void 0 : d.isReady) ?? !0, R = (T == null ? void 0 : T.isReady) ?? !0, k = r && a && h, C = e || k && A || l && !P || d && !I || T && !R, o = t || (k ? c : null);
+function nn(r = !0) {
+  const { isAppLoading: e, appError: t, retryApp: n, appInfo: i } = Ae(), a = pe(), l = Oe(), h = at(), S = lt(), k = (a == null ? void 0 : a.isTenantLoading) ?? !1, T = (a == null ? void 0 : a.tenantError) ?? null, c = (a == null ? void 0 : a.tenant) ?? null, d = (a == null ? void 0 : a.tenantSlug) ?? null, A = (a == null ? void 0 : a.retryTenant) ?? (() => {
+  }), P = (l == null ? void 0 : l.isAuthReady) ?? !0, I = (h == null ? void 0 : h.isReady) ?? !0, R = (S == null ? void 0 : S.isReady) ?? !0, E = r && a && d, C = e || E && k || l && !P || h && !I || S && !R, o = t || (E ? T : null);
   return {
     isLoading: C,
     error: o,
-    isReady: !C && !o && i !== null && (!k || S !== null),
+    isReady: !C && !o && i !== null && (!E || c !== null),
     retry: () => {
-      t && n(), c && a && x();
+      t && n(), T && a && A();
     },
     // Individual states
     app: { isLoading: e, error: t, data: i },
-    tenant: a ? { isLoading: A, error: c, data: S } : null,
+    tenant: a ? { isLoading: k, error: T, data: c } : null,
     auth: l ? { isReady: P } : null,
-    featureFlags: d ? { isReady: I } : null,
-    subscription: T ? { isReady: R } : null
+    featureFlags: h ? { isReady: I } : null,
+    subscription: S ? { isReady: R } : null
   };
 }
-const br = {
+const wr = {
   wrapper: {
     position: "relative"
   },
@@ -3674,7 +3720,7 @@ const br = {
     marginLeft: 8
   }
 };
-function nn({
+function sn({
   tenants: r,
   currentTenantId: e,
   onSelect: t,
@@ -3682,14 +3728,14 @@ function nn({
   className: i = "",
   dropdownClassName: a = "",
   itemClassName: l = "",
-  renderItem: d,
-  placeholder: T = "Select tenant",
-  disabled: A = !1,
-  showCurrentTenant: c = !0
+  renderItem: h,
+  placeholder: S = "Select tenant",
+  disabled: k = !1,
+  showCurrentTenant: T = !0
 }) {
   var C;
-  const S = { ...br, ...n }, h = Oe(), [x, P] = N(!1), I = Ee(null), R = r ?? (h == null ? void 0 : h.userTenants) ?? [], k = e ?? ((C = h == null ? void 0 : h.currentUser) == null ? void 0 : C.tenantId) ?? null, m = async (o) => {
-    P(!1), t ? t(o) : h != null && h.switchToTenant && await h.switchToTenant(o);
+  const c = { ...wr, ...n }, d = Oe(), [A, P] = N(!1), I = ye(null), R = r ?? (d == null ? void 0 : d.userTenants) ?? [], E = e ?? ((C = d == null ? void 0 : d.currentUser) == null ? void 0 : C.tenantId) ?? null, m = async (o) => {
+    P(!1), t ? t(o) : d != null && d.switchToTenant && await d.switchToTenant(o);
   };
   re(() => {
     const o = (p) => {
@@ -3697,66 +3743,66 @@ function nn({
     };
     return document.addEventListener("mousedown", o), () => document.removeEventListener("mousedown", o);
   }, []);
-  const g = R.find((o) => o.id === k);
+  const g = R.find((o) => o.id === E);
   if (R.length === 0)
     return null;
-  if (R.length === 1 && c)
+  if (R.length === 1 && T)
     return /* @__PURE__ */ s("div", { className: i, children: /* @__PURE__ */ s("span", { children: R[0].name }) });
   const b = (o, p) => /* @__PURE__ */ f("span", { style: { fontWeight: p ? "bold" : "normal" }, children: [
     o.name,
-    o.role && /* @__PURE__ */ f("span", { style: S.itemRole, children: [
+    o.role && /* @__PURE__ */ f("span", { style: c.itemRole, children: [
       "(",
       o.role,
       ")"
     ] })
   ] });
-  return /* @__PURE__ */ f("div", { ref: I, className: i, style: S.wrapper, children: [
+  return /* @__PURE__ */ f("div", { ref: I, className: i, style: c.wrapper, children: [
     /* @__PURE__ */ f(
       "button",
       {
         type: "button",
-        onClick: () => !A && P(!x),
-        disabled: A,
+        onClick: () => !k && P(!A),
+        disabled: k,
         style: {
-          ...S.button,
-          ...A ? S.buttonDisabled : {}
+          ...c.button,
+          ...k ? c.buttonDisabled : {}
         },
         children: [
-          g ? g.name : T,
-          /* @__PURE__ */ s("span", { style: S.arrow, children: x ? "▲" : "▼" })
+          g ? g.name : S,
+          /* @__PURE__ */ s("span", { style: c.arrow, children: A ? "▲" : "▼" })
         ]
       }
     ),
-    x && /* @__PURE__ */ s("div", { className: a, style: S.dropdown, children: R.map((o) => {
-      const p = o.id === k;
+    A && /* @__PURE__ */ s("div", { className: a, style: c.dropdown, children: R.map((o) => {
+      const p = o.id === E;
       return /* @__PURE__ */ s(
         "div",
         {
           className: l,
           onClick: () => m(o.id),
           style: {
-            ...S.item,
-            ...p ? S.itemSelected : {}
+            ...c.item,
+            ...p ? c.itemSelected : {}
           },
-          onMouseEnter: (E) => {
-            p || Object.assign(E.currentTarget.style, S.itemHover);
+          onMouseEnter: (x) => {
+            p || Object.assign(x.currentTarget.style, c.itemHover);
           },
-          onMouseLeave: (E) => {
+          onMouseLeave: (x) => {
             if (!p) {
-              const y = S.item || {};
-              Object.keys(S.itemHover || {}).forEach((u) => {
-                E.currentTarget.style[u] = y[u] ?? "";
+              const y = c.item || {};
+              Object.keys(c.itemHover || {}).forEach((u) => {
+                x.currentTarget.style[u] = y[u] ?? "";
               });
             }
           },
-          children: d ? d(o, p) : b(o, p)
+          children: h ? h(o, p) : b(o, p)
         },
         o.id
       );
     }) })
   ] });
 }
-class sn {
+class on {
   constructor(e) {
     this.httpService = e;
   }
@@ -3789,7 +3835,7 @@ class sn {
     return { permissions: n.data, meta: n.meta };
   }
 }
-class on {
+class an {
   constructor(e) {
     this.httpService = e;
   }
@@ -3820,7 +3866,7 @@ class on {
     await this.httpService.delete(`/subscription-plans/${e}`);
   }
 }
-class an {
+class ln {
   constructor(e) {
     this.httpService = e;
   }
@@ -3830,12 +3876,12 @@ class an {
   }
 }
 const dt = "returnTo", Ce = "zone_return_to", De = "zone_return_to";
-function ln(r = {}) {
+function cn(r = {}) {
   const {
     zoneRoots: e = {},
     returnToParam: t = dt,
     returnToStorage: n = "url"
-  } = r, i = wt(), [a, l] = vt(), { isAuthenticated: d, currentUser: T } = de(), { tenant: A } = ve(), c = V(() => ({ ...ze, ...e }), [e]), S = !!A, h = T == null ? void 0 : T.userType, x = V(() => {
+  } = r, i = vt(), [a, l] = Tt(), { isAuthenticated: h, currentUser: S } = de(), { tenant: k } = Te(), T = V(() => ({ ...ze, ...e }), [e]), c = !!k, d = S == null ? void 0 : S.userType, A = V(() => {
     switch (n) {
       case "url":
         return a.get(t);
@@ -3879,92 +3925,92 @@ function ln(r = {}) {
     [n, a, t, l]
   ), R = te(
     (m) => {
-      const g = c[m] || c.default;
+      const g = T[m] || T.default;
       i(g);
     },
-    [i, c]
-  ), k = te(() => S ? d ? h === ae.TENANT_ADMIN ? c.tenantAdmin : c.tenantUser : c.tenantGuest : d ? h === ae.TENANT_ADMIN ? c.publicAdmin : c.publicUser : c.publicGuest, [S, d, h, c]);
+    [i, T]
+  ), E = te(() => c ? h ? d === ae.TENANT_ADMIN ? T.tenantAdmin : T.tenantUser : T.tenantGuest : h ? d === ae.TENANT_ADMIN ? T.publicAdmin : T.publicUser : T.publicGuest, [c, h, d, T]);
   return {
-    returnToUrl: x,
+    returnToUrl: A,
     clearReturnTo: P,
     setReturnTo: I,
     navigateToZone: R,
-    getSmartRedirect: k
+    getSmartRedirect: E
   };
 }
-function cn(r, e, t = dt, n = "url") {
+function un(r, e, t = dt, n = "url") {
   if (!e || n !== "url")
     return r;
   const i = new URL(r, window.location.origin);
   return i.searchParams.set(t, e), i.pathname + i.search;
 }
 export {
-  qr as AdminZone,
+  zr as AdminZone,
   Je as AppApiService,
-  tn as AppLoader,
-  Sr as AppProvider,
-  Nt as AuthApiService,
-  Rr as AuthProvider,
-  Or as AuthenticatedZone,
+  rn as AppLoader,
+  kr as AppProvider,
+  Ct as AuthApiService,
+  Pr as AuthProvider,
+  Vr as AuthenticatedZone,
   oe as ConfigurationError,
   ct as DEFAULT_ZONE_PRESETS,
   ze as DEFAULT_ZONE_ROOTS,
-  Jr as FeatureFlag,
-  Ot as FeatureFlagApiService,
-  Lr as FeatureFlagProvider,
-  Vr as GuestZone,
-  an as HealthApiService,
+  Zr as FeatureFlag,
+  Vt as FeatureFlagApiService,
+  Fr as FeatureFlagProvider,
+  qr as GuestZone,
+  ln as HealthApiService,
   he as HttpService,
-  Ur as LandingRoute,
-  Zr as LoginForm,
-  Yr as MagicLinkForm,
-  Xr as MagicLinkVerify,
-  jr as OpenZone,
-  en as PasswordRecoveryForm,
-  sn as PermissionApiService,
-  Dr as Protected,
-  Mr as ProtectedRoute,
-  _r as PublicZone,
-  Ct as RoleApiService,
-  Nr as RoutingProvider,
-  ee as SessionExpiredError,
+  Br as LandingRoute,
+  Kr as LoginForm,
+  Xr as MagicLinkForm,
+  en as MagicLinkVerify,
+  Wr as OpenZone,
+  tn as PasswordRecoveryForm,
+  on as PermissionApiService,
+  Mr as Protected,
+  $r as ProtectedRoute,
+  Or as PublicZone,
+  Dt as RoleApiService,
+  Cr as RoutingProvider,
+  Z as SessionExpiredError,
   Me as SessionManager,
-  Kr as SignupForm,
-  qt as SubscriptionApiService,
-  Qr as SubscriptionGuard,
-  on as SubscriptionPlanApiService,
-  Fr as SubscriptionProvider,
-  ye as TenantApiService,
-  Wr as TenantAuthenticatedZone,
-  Hr as TenantGuestZone,
-  Gr as TenantOpenZone,
-  Er as TenantProvider,
-  $r as TenantRoute,
-  nn as TenantSelector,
-  Br as TenantZone,
-  kt as TokenRefreshError,
-  St as TokenRefreshTimeoutError,
-  Dt as UserApiService,
+  Yr as SignupForm,
+  zt as SubscriptionApiService,
+  Jr as SubscriptionGuard,
+  an as SubscriptionPlanApiService,
+  Nr as SubscriptionProvider,
+  be as TenantApiService,
+  Gr as TenantAuthenticatedZone,
+  Qr as TenantGuestZone,
+  Hr as TenantOpenZone,
+  xr as TenantProvider,
+  Ur as TenantRoute,
+  sn as TenantSelector,
+  _r as TenantZone,
+  Et as TokenRefreshError,
+  kt as TokenRefreshTimeoutError,
+  Mt as UserApiService,
   ae as UserType,
-  zr as UserZone,
+  jr as UserZone,
   ue as ZoneRoute,
-  cn as buildRedirectUrl,
-  kr as useApi,
+  un as buildRedirectUrl,
+  Er as useApi,
   Ae as useApp,
-  rn as useAppLoaderState,
+  nn as useAppLoaderState,
   de as useAuth,
-  Ir as useAuthActions,
+  Lr as useAuthActions,
   Oe as useAuthOptional,
-  Pr as useAuthState,
-  Vt as useFeatureFlags,
-  Cr as useRouting,
-  Wt as useRoutingOptional,
-  Ar as useSettings,
-  zt as useSubscription,
-  ve as useTenant,
+  Ir as useAuthState,
+  qt as useFeatureFlags,
+  Dr as useRouting,
+  Gt as useRoutingOptional,
+  Rr as useSettings,
+  jt as useSubscription,
+  Te as useTenant,
   ot as useTenantInfo,
   pe as useTenantOptional,
-  xr as useTenantSettings,
-  ln as useZoneNavigation
+  Ar as useTenantSettings,
+  cn as useZoneNavigation
 };
 //# sourceMappingURL=index.es.js.map