@skylabs-digital/react-identity-access 3.2.3 → 3.4.1

package/dist/index.es.js

@@ -1,6 +1,6 @@
 import { jsx as s, Fragment as U, jsxs as f } from "react/jsx-runtime";
-import me, { createContext as fe, useState as N, useRef as ye, useCallback as te, useMemo as V, useEffect as re, useContext as ne } from "react";
-import { useLocation as xe, Navigate as we, useNavigate as vt, useSearchParams as Tt } from "react-router-dom";
+import me, { createContext as fe, useState as C, useRef as be, useCallback as te, useMemo as O, useEffect as re, useContext as ne, useSyncExternalStore as Et } from "react";
+import { useLocation as Re, Navigate as ve, useNavigate as xt, useSearchParams as Rt } from "react-router-dom";
 class he {
   constructor(e, t = 1e4) {
     this.baseUrl = e.replace(/\/$/, ""), this.timeout = t;
@@ -11,25 +11,25 @@ class he {
   getBaseUrl() {
     return this.baseUrl;
   }
-  async executeRequest(e, t, n, i, a = !1) {
-    const l = `${this.baseUrl}${t.startsWith("/") ? t : `/${t}`}`, h = (i == null ? void 0 : i.timeout) || this.timeout;
-    let S = {
+  async executeRequest(e, t, n, i, o = !1) {
+    const a = `${this.baseUrl}${t.startsWith("/") ? t : `/${t}`}`, p = (i == null ? void 0 : i.timeout) || this.timeout;
+    let k = {
       "Content-Type": "application/json",
       ...i == null ? void 0 : i.headers
     };
     if (!(i != null && i.skipAuth) && this.sessionManager) {
       const c = await this.sessionManager.getValidAccessToken();
-      S = { ...S, Authorization: `Bearer ${c}` };
+      k = { ...k, Authorization: `Bearer ${c}` };
     }
-    const k = new AbortController(), T = setTimeout(() => k.abort(), h);
+    const E = new AbortController(), S = setTimeout(() => E.abort(), p);
     try {
-      const c = await fetch(l, {
+      const c = await fetch(a, {
         method: e,
-        headers: S,
+        headers: k,
         body: n ? JSON.stringify(n) : void 0,
-        signal: k.signal
+        signal: E.signal
       });
-      if (clearTimeout(T), c.status === 401 && !(i != null && i.skipAuth) && this.sessionManager && !a) {
+      if (clearTimeout(S), c.status === 401 && !(i != null && i.skipAuth) && this.sessionManager && !o) {
         try {
           await c.text();
         } catch {
@@ -41,7 +41,7 @@ class he {
       const d = c.headers.get("content-type");
       return !d || !d.includes("application/json") ? {} : await c.json();
     } catch (c) {
-      throw clearTimeout(T), c instanceof Error && c.name === "AbortError" ? new Error(`Request timeout after ${h}ms`) : c;
+      throw clearTimeout(S), c instanceof Error && c.name === "AbortError" ? new Error(`Request timeout after ${p}ms`) : c;
     }
   }
   async get(e, t) {
@@ -57,7 +57,7 @@ class he {
     return this.executeRequest("DELETE", e, void 0, t);
   }
 }
-function ce(r) {
+function le(r) {
   if (!r) return "";
   const e = new URLSearchParams();
   for (const [n, i] of Object.entries(r))
@@ -65,7 +65,7 @@ function ce(r) {
   const t = e.toString();
   return t ? `?${t}` : "";
 }
-class Je {
+class Ye {
   constructor(e) {
     this.httpService = e;
   }
@@ -74,7 +74,7 @@ class Je {
   }
   async getApps(e) {
     const t = await this.httpService.get(
-      `/apps/${ce(e)}`
+      `/apps/${le(e)}`
     );
     return { apps: t.data, meta: t.meta };
   }
@@ -105,92 +105,92 @@ class Je {
     return (await this.httpService.get(`/apps/${e}/export-config`)).data;
   }
 }
-const $e = fe(null), St = 5 * 60 * 1e3;
-function kr({ config: r, children: e }) {
-  var E, m, g;
-  const { appId: t, baseUrl: n } = r, i = (((E = r.cache) == null ? void 0 : E.enabled) ?? !0) && !!t, a = ((m = r.cache) == null ? void 0 : m.ttl) ?? St, l = ((g = r.cache) == null ? void 0 : g.storageKey) ?? (t ? `app_cache_${t}` : ""), [h, S] = N(() => {
+const Be = fe(null), At = 300 * 1e3;
+function Pr({ config: r, children: e }) {
+  var R, m, g;
+  const { appId: t, baseUrl: n } = r, i = (((R = r.cache) == null ? void 0 : R.enabled) ?? !0) && !!t, o = ((m = r.cache) == null ? void 0 : m.ttl) ?? At, a = ((g = r.cache) == null ? void 0 : g.storageKey) ?? (t ? `app_cache_${t}` : ""), [p, k] = C(() => {
     if (!i) return null;
     try {
-      const b = localStorage.getItem(l);
+      const b = localStorage.getItem(a);
       if (!b) return null;
-      const C = JSON.parse(b);
-      return Date.now() - C.timestamp < a && C.appId === t ? C.data : (localStorage.removeItem(l), null);
+      const w = JSON.parse(b);
+      return Date.now() - w.timestamp < o && w.appId === t ? w.data : (localStorage.removeItem(a), null);
     } catch {
       return null;
     }
-  }), [k, T] = N(!!t && !h), [c, d] = N(null), A = ye(h);
-  A.current = h;
-  const P = te(
+  }), [E, S] = C(!!t && !p), [c, d] = C(null), x = be(p);
+  x.current = p;
+  const I = te(
     async (b = !1) => {
-      if (t && !(!b && i && A.current))
+      if (t && !(!b && i && x.current))
         try {
-          T(!0), d(null);
-          const o = await new Je(new he(n)).getPublicAppInfo(t);
-          if (S(o), i)
+          S(!0), d(null);
+          const l = await new Ye(new he(n)).getPublicAppInfo(t);
+          if (k(l), i)
             try {
-              const p = {
-                data: o,
+              const h = {
+                data: l,
                 timestamp: Date.now(),
                 appId: t
               };
-              localStorage.setItem(l, JSON.stringify(p));
-            } catch (p) {
-              process.env.NODE_ENV === "development" && console.warn("[AppProvider] Failed to cache app info:", p);
+              localStorage.setItem(a, JSON.stringify(h));
+            } catch (h) {
+              process.env.NODE_ENV === "development" && console.warn("[AppProvider] Failed to cache app info:", h);
             }
-        } catch (C) {
-          const o = C instanceof Error ? C : new Error("Failed to load app information");
-          d(o), S(null);
+        } catch (w) {
+          const l = w instanceof Error ? w : new Error("Failed to load app information");
+          d(l), k(null);
         } finally {
-          T(!1);
+          S(!1);
         }
     },
-    [n, t, i, l]
-  ), I = te(async () => {
-    if (!(!t || !i || !A.current))
+    [n, t, i, a]
+  ), L = te(async () => {
+    if (!(!t || !i || !x.current))
       try {
-        const b = localStorage.getItem(l);
+        const b = localStorage.getItem(a);
         if (!b) return;
-        const C = JSON.parse(b);
-        if (Date.now() - C.timestamp <= a * 0.5) return;
-        const p = await new Je(new he(n)).getPublicAppInfo(t);
-        S(p);
-        const x = {
-          data: p,
+        const w = JSON.parse(b);
+        if (Date.now() - w.timestamp <= o * 0.5) return;
+        const h = await new Ye(new he(n)).getPublicAppInfo(t);
+        k(h);
+        const A = {
+          data: h,
           timestamp: Date.now(),
           appId: t
         };
-        localStorage.setItem(l, JSON.stringify(x));
+        localStorage.setItem(a, JSON.stringify(A));
       } catch (b) {
         process.env.NODE_ENV === "development" && console.warn("[AppProvider] Background app refresh failed:", b);
       }
-  }, [n, t, i, a, l]), R = V(
+  }, [n, t, i, o, a]), P = O(
     () => ({
       appId: t,
       baseUrl: n,
-      appInfo: h,
-      isAppLoading: k,
+      appInfo: p,
+      isAppLoading: E,
       appError: c,
       retryApp: () => {
-        P(!0);
+        I(!0);
       }
     }),
-    [t, n, h, k, c, P]
+    [t, n, p, E, c, I]
   );
   return re(() => {
-    t && (A.current ? I() : P());
-  }, []), /* @__PURE__ */ s($e.Provider, { value: R, children: e });
+    t && (x.current ? L() : I());
+  }, []), /* @__PURE__ */ s(Be.Provider, { value: P, children: e });
 }
 function Ae() {
-  const r = ne($e);
+  const r = ne(Be);
   if (!r)
     throw new Error("useApp must be used within an AppProvider");
   return r;
 }
-function Ue() {
-  return ne($e);
+function _e() {
+  return ne(Be);
 }
-const Er = Ae;
-class Z extends Error {
+const Ir = Ae;
+class Q extends Error {
   constructor(e, t) {
     const n = {
       token_expired: "Refresh token has expired",
@@ -200,24 +200,24 @@ class Z extends Error {
     super(t || n[e]), this.name = "SessionExpiredError", this.reason = e;
   }
 }
-class kt extends Error {
+class Pt extends Error {
   constructor(e) {
     super(`Token refresh timed out after ${e}ms`), this.name = "TokenRefreshTimeoutError", this.timeoutMs = e;
   }
 }
-class Et extends Error {
+class It extends Error {
   constructor(e, t) {
     super(
       `Token refresh failed after ${e} attempts: ${(t == null ? void 0 : t.message) || "Unknown error"}`
     ), this.name = "TokenRefreshError", this.attempts = e, this.lastError = t;
   }
 }
-class oe extends Error {
+class ie extends Error {
   constructor(e, t, n) {
-    super(`Invalid configuration "${e}": ${n} (received: ${xt(t)})`), this.name = "ConfigurationError", this.field = e, this.received = t;
+    super(`Invalid configuration "${e}": ${n} (received: ${Lt(t)})`), this.name = "ConfigurationError", this.field = e, this.received = t;
   }
 }
-function xt(r) {
+function Lt(r) {
   if (r === void 0) return "undefined";
   try {
     const e = JSON.stringify(r);
@@ -226,85 +226,92 @@ function xt(r) {
     return typeof r;
   }
 }
-function Ze(r) {
+function Xe(r) {
   return JSON.parse(atob(r.replace(/-/g, "+").replace(/_/g, "/")));
 }
-function Re(r) {
+function Pe(r) {
   const e = r.split(".");
   if (e.length !== 3) return null;
   try {
-    return { header: Ze(e[0]), payload: Ze(e[1]) };
+    return { header: Xe(e[0]), payload: Xe(e[1]) };
   } catch {
     return null;
   }
 }
-function Ke(r) {
-  const e = Re(r), t = e == null ? void 0 : e.payload.exp;
+function et(r) {
+  const e = Pe(r), t = e == null ? void 0 : e.payload.exp;
   return typeof t == "number" ? t * 1e3 : void 0;
 }
-function At(r, e) {
+function Ft(r, e) {
   var n;
-  const t = (n = Re(r)) == null ? void 0 : n.payload[e];
+  const t = (n = Pe(r)) == null ? void 0 : n.payload[e];
   return typeof t == "string" ? t : void 0;
 }
-const Rt = /^(javascript|data|vbscript|file):/i, Pt = /^https?:\/\//i;
-function It(r, e = "baseUrl") {
+const Nt = /^(javascript|data|vbscript|file):/i, Ct = /^https?:\/\//i;
+function Dt(r, e = "baseUrl") {
   if (!(r == null || r === "")) {
     if (typeof r != "string")
-      throw new oe(e, r, "must be a string");
-    if (Rt.test(r))
-      throw new oe(e, r, "dangerous URL scheme is not allowed");
-    if (!Pt.test(r))
-      throw new oe(e, r, "must start with http:// or https://");
+      throw new ie(e, r, "must be a string");
+    if (Nt.test(r))
+      throw new ie(e, r, "dangerous URL scheme is not allowed");
+    if (!Ct.test(r))
+      throw new ie(e, r, "must start with http:// or https://");
   }
 }
 function ge(r, e, t = {}) {
   if (e === void 0) return;
   if (typeof e != "number" || !Number.isFinite(e))
-    throw new oe(r, e, "must be a finite number");
+    throw new ie(r, e, "must be a finite number");
   const { min: n = 0, max: i = Number.MAX_SAFE_INTEGER } = t;
   if (e < n)
-    throw new oe(r, e, `must be >= ${n}`);
+    throw new ie(r, e, `must be >= ${n}`);
   if (e > i)
-    throw new oe(r, e, `must be <= ${i}`);
+    throw new ie(r, e, `must be <= ${i}`);
 }
-function Ye(r, e) {
+function tt(r, e) {
   if (e !== void 0 && typeof e != "boolean")
-    throw new oe(r, e, "must be a boolean");
+    throw new ie(r, e, "must be a boolean");
 }
-function Lt(r, e = "accessToken") {
+function Mt(r, e = "accessToken") {
   if (typeof r != "string" || r.length === 0)
-    throw new oe(e, r, "must be a non-empty string");
+    throw new ie(e, r, "must be a non-empty string");
   if (!r.includes(".")) return;
   const t = r.split(".");
   if (t.length !== 3)
-    throw new oe(
+    throw new ie(
       e,
       `<${t.length}-segment token>`,
       "JWT must have exactly 3 segments (header.payload.signature)"
     );
-  if (Re(r) === null)
-    throw new oe(
+  if (Pe(r) === null)
+    throw new ie(
       e,
       "<malformed JWT>",
       "JWT header or payload is not valid base64url-encoded JSON"
     );
 }
-function Ft(r) {
+function $t(r) {
   if (r !== void 0 && (typeof r != "number" || !Number.isFinite(r) || r <= 0))
-    throw new oe("expiresIn", r, "must be a finite positive number (seconds)");
+    throw new ie("expiresIn", r, "must be a finite positive number (seconds)");
 }
-function Nt(r) {
+function Ut(r) {
   if (r !== void 0 && (typeof r != "number" || !Number.isFinite(r) || r <= 0))
-    throw new oe(
+    throw new ie(
       "expiresAt",
       r,
       "must be a finite positive timestamp (ms since epoch)"
     );
 }
-const ie = class ie {
+const rt = "__RIA_SESSION_INSTANCES_V1__", ye = (() => {
+  const r = globalThis, e = r[rt];
+  if (e instanceof Map) return e;
+  const t = /* @__PURE__ */ new Map();
+  return r[rt] = t, t;
+})(), de = class de {
   constructor(e = {}) {
-    this.refreshPromise = null, this.refreshQueue = [], this.proactiveTimerId = null, this.backgroundRetryTimerId = null, this.isDestroyed = !1, this.sessionGeneration = 0, this.consecutiveBackgroundFailures = 0, this.memoryStore = null, this.visibilityListener = null, ie.validateConfig(e), this.storageKey = e.storageKey || "auth_tokens", this.autoRefresh = e.autoRefresh ?? !0, this.refreshThreshold = e.refreshThreshold || 3e5, this.onRefreshFailed = e.onRefreshFailed, this.onSessionExpired = e.onSessionExpired, this.baseUrl = e.baseUrl || "", this.enableCookieSession = e.enableCookieSession ?? !1, this.proactiveRefreshMargin = e.proactiveRefreshMargin ?? 6e4, this.refreshQueueTimeout = e.refreshQueueTimeout ?? 1e4, this.maxRefreshRetries = e.maxRefreshRetries ?? 3, this.retryBackoffBase = e.retryBackoffBase ?? 1e3, this.tokenStorage = e.tokenStorage || this.createTokenStorage(this.storageKey), this.attachVisibilityListener(), this.scheduleProactiveRefresh();
+    this.refreshPromise = null, this.refreshQueue = [], this.proactiveTimerId = null, this.backgroundRetryTimerId = null, this.isDestroyed = !1, this.sessionGeneration = 0, this.consecutiveBackgroundFailures = 0, this.state = "idle", this.isRefreshing = !1, this.lastExpiryReason = null, this.logoutInFlight = !1, this.listeners = /* @__PURE__ */ new Set(), this.notifyVersion = 0, this.memoryStore = null, this.visibilityListener = null, this.storageListener = null, de.validateConfig(e), this.storageKey = e.storageKey || "auth_tokens", this.autoRefresh = e.autoRefresh ?? !0, this.refreshThreshold = e.refreshThreshold || 3e5, this.onRefreshFailed = e.onRefreshFailed, this.onSessionExpired = e.onSessionExpired, this.baseUrl = e.baseUrl || "", this.enableCookieSession = e.enableCookieSession ?? !1, this.proactiveRefreshMargin = e.proactiveRefreshMargin ?? 6e4, this.refreshQueueTimeout = e.refreshQueueTimeout ?? 1e4, this.maxRefreshRetries = e.maxRefreshRetries ?? 3, this.retryBackoffBase = e.retryBackoffBase ?? 1e3, this.tokenStorage = e.tokenStorage || this.createTokenStorage(this.storageKey);
+    const t = this.tokenStorage.get();
+    t != null && t.accessToken && (this.state = "restoring"), this.attachVisibilityListener(), this.attachStorageListener(), this.scheduleProactiveRefresh();
   }
   /**
    * Get or create a SessionManager instance for the given config.
@@ -312,30 +319,30 @@ const ie = class ie {
    * Mutable config (callbacks, baseUrl) is updated on the existing instance.
    */
   static getInstance(e = {}) {
-    const t = ie.resolveStorageKey(e), n = ie.instances.get(t);
+    const t = de.resolveStorageKey(e), n = ye.get(t);
     if (n)
       return n.updateConfig(e), n;
-    const i = new ie(e);
-    return ie.instances.set(t, i), i;
+    const i = new de(e);
+    return ye.set(t, i), i;
   }
   /** Reset all singleton instances. For testing only. */
   static resetAllInstances() {
-    for (const e of ie.instances.values())
+    for (const e of ye.values())
       e.destroy();
-    ie.instances.clear();
+    ye.clear();
   }
   static resolveStorageKey(e) {
     return e.storageKey || "auth_tokens";
   }
   static validateConfig(e) {
-    It(e.baseUrl), Ye("enableCookieSession", e.enableCookieSession), Ye("autoRefresh", e.autoRefresh), ge("refreshThreshold", e.refreshThreshold, { min: 0 }), ge("proactiveRefreshMargin", e.proactiveRefreshMargin, { min: 0 }), ge("refreshQueueTimeout", e.refreshQueueTimeout, { min: 1 }), ge("maxRefreshRetries", e.maxRefreshRetries, { min: 0 }), ge("retryBackoffBase", e.retryBackoffBase, { min: 1 });
+    Dt(e.baseUrl), tt("enableCookieSession", e.enableCookieSession), tt("autoRefresh", e.autoRefresh), ge("refreshThreshold", e.refreshThreshold, { min: 0 }), ge("proactiveRefreshMargin", e.proactiveRefreshMargin, { min: 0 }), ge("refreshQueueTimeout", e.refreshQueueTimeout, { min: 1 }), ge("maxRefreshRetries", e.maxRefreshRetries, { min: 0 }), ge("retryBackoffBase", e.retryBackoffBase, { min: 1 });
   }
   /** Update mutable config (callbacks, baseUrl) on an existing instance. */
   updateConfig(e) {
     e.onSessionExpired !== void 0 && (this.onSessionExpired = e.onSessionExpired), e.onRefreshFailed !== void 0 && (this.onRefreshFailed = e.onRefreshFailed), e.baseUrl && (this.baseUrl = e.baseUrl), e.enableCookieSession !== void 0 && (this.enableCookieSession = e.enableCookieSession);
   }
   createTokenStorage(e) {
-    return ie.probeLocalStorage() || this.activateMemoryFallback(), {
+    return de.probeLocalStorage() || this.activateMemoryFallback(), {
       get: () => {
         const t = this.storageGet(e);
         if (!t) return null;
@@ -397,26 +404,26 @@ const ie = class ie {
   }
   // --- Token CRUD ---
   setTokens(e) {
-    if (Lt(e.accessToken, "accessToken"), e.refreshToken !== void 0 && typeof e.refreshToken != "string")
-      throw new oe("refreshToken", e.refreshToken, "must be a string");
-    Ft(e.expiresIn), Nt(e.expiresAt);
-    const t = e.expiresAt || (e.expiresIn ? Date.now() + e.expiresIn * 1e3 : void 0) || Ke(e.accessToken), n = {
+    if (Mt(e.accessToken, "accessToken"), e.refreshToken !== void 0 && typeof e.refreshToken != "string")
+      throw new ie("refreshToken", e.refreshToken, "must be a string");
+    $t(e.expiresIn), Ut(e.expiresAt);
+    const t = e.expiresAt || (e.expiresIn ? Date.now() + e.expiresIn * 1e3 : void 0) || et(e.accessToken), n = {
       ...e,
       expiresAt: t
     }, i = this.tokenStorage.get() || {};
-    this.tokenStorage.set({ ...i, ...n }), this.scheduleProactiveRefresh();
+    this.tokenStorage.set({ ...i, ...n }), this.scheduleProactiveRefresh(), this.isTokenExpired(n) || this.transitionTo("authenticated"), this.notify();
   }
   getTokens() {
-    const { accessToken: e, refreshToken: t, expiresAt: n, expiresIn: i, tokenType: a } = this.tokenStorage.get() || {};
+    const { accessToken: e, refreshToken: t, expiresAt: n, expiresIn: i, tokenType: o } = this.tokenStorage.get() || {};
     if (!e)
       return null;
-    const l = n || Ke(e);
+    const a = n || et(e);
     return {
       accessToken: e,
       refreshToken: t,
-      expiresAt: l,
+      expiresAt: a,
       expiresIn: i,
-      tokenType: a
+      tokenType: o
     };
   }
   clearTokens() {
@@ -471,6 +478,90 @@ const ie = class ie {
       }
     this.visibilityListener = null;
   }
+  attachStorageListener() {
+    if (!this.storageListener && !(typeof window > "u" || typeof window.addEventListener != "function")) {
+      this.storageListener = (e) => {
+        if (e.key === this.storageKey && !(e.storageArea && e.storageArea !== localStorage) && !this.isDestroyed) {
+          if (e.newValue === null) {
+            this.sessionGeneration++, this.cancelProactiveTimer();
+            const t = new Q(
+              "token_invalid",
+              "Session cleared in another tab"
+            );
+            this.rejectQueue(t), this.transitionTo("idle");
+          } else {
+            this.scheduleProactiveRefresh();
+            const t = this.getTokens();
+            t != null && t.accessToken && !this.isTokenExpired(t) && this.transitionTo("authenticated");
+          }
+          this.notify();
+        }
+      };
+      try {
+        window.addEventListener("storage", this.storageListener);
+      } catch {
+        this.storageListener = null;
+      }
+    }
+  }
+  detachStorageListener() {
+    if (this.storageListener && typeof window < "u")
+      try {
+        window.removeEventListener("storage", this.storageListener);
+      } catch {
+      }
+    this.storageListener = null;
+  }
+  // --- Reactivity (useSyncExternalStore-compatible) ---
+  /**
+   * Subscribe to session state changes. Returns an unsubscribe function.
+   * Fires on: setTokens, setUser, clearUser, clearSession, handleSessionExpired,
+   * refresh in-flight transitions, and cross-tab storage events.
+   */
+  subscribe(e) {
+    return this.listeners.add(e), () => {
+      this.listeners.delete(e);
+    };
+  }
+  /**
+   * Numeric snapshot for useSyncExternalStore. Strictly monotonic — every
+   * call to `notify()` bumps it so React will observe a fresh value even
+   * when the higher-level state ordinal and refreshing flag look identical.
+   */
+  getSnapshot() {
+    return this.notifyVersion;
+  }
+  /** True iff a refresh network call is currently in flight or queued. */
+  getRefreshInFlight() {
+    return this.refreshPromise !== null;
+  }
+  /** Current state of the session machine. */
+  getState() {
+    return this.state;
+  }
+  /** Diagnostic snapshot — useful for tests and DevTools. */
+  getRefreshStats() {
+    return {
+      state: this.state,
+      isRefreshing: this.isRefreshing,
+      inFlight: this.refreshPromise !== null,
+      queued: this.refreshQueue.length,
+      sessionGeneration: this.sessionGeneration,
+      consecutiveBackgroundFailures: this.consecutiveBackgroundFailures,
+      lastExpiryReason: this.lastExpiryReason
+    };
+  }
+  notify() {
+    this.notifyVersion++;
+    for (const e of this.listeners)
+      try {
+        e();
+      } catch {
+      }
+  }
+  transitionTo(e) {
+    this.state !== e && (this.state = e);
+  }
   backgroundRefresh() {
     if (this.isDestroyed) return;
     const e = this.getTokens();
@@ -479,13 +570,13 @@ const ie = class ie {
     this.startRefreshAndResolveQueue(e.refreshToken).then(() => {
       this.consecutiveBackgroundFailures = 0;
     }).catch((n) => {
-      if (!(n instanceof Z)) {
+      if (!(n instanceof Q)) {
         if (this.sessionGeneration === t) {
-          if (this.consecutiveBackgroundFailures++, this.consecutiveBackgroundFailures >= ie.MAX_BACKGROUND_FAILURES) {
+          if (this.consecutiveBackgroundFailures++, this.consecutiveBackgroundFailures >= de.MAX_BACKGROUND_FAILURES) {
             process.env.NODE_ENV === "development" && console.error(
               `[SessionManager] Background refresh failed ${this.consecutiveBackgroundFailures} consecutive times — expiring session`
             ), this.consecutiveBackgroundFailures = 0, this.handleSessionExpired(
-              new Z("token_invalid", "Background refresh failed repeatedly")
+              new Q("token_invalid", "Background refresh failed repeatedly")
             );
             return;
           }
@@ -552,13 +643,13 @@ const ie = class ie {
   async getValidAccessToken() {
     const e = this.getTokens();
     if (!(e != null && e.accessToken)) {
-      const t = new Z("token_invalid", "No tokens available");
+      const t = new Q("token_invalid", "No tokens available");
       throw this.handleSessionExpired(t), t;
     }
     if (!this.shouldRefreshToken(e) && !this.isTokenExpired(e))
       return e.accessToken;
     if (!e.refreshToken) {
-      const t = new Z("token_invalid", "No refresh token available");
+      const t = new Q("token_invalid", "No refresh token available");
       throw this.handleSessionExpired(t), t;
     }
     return this.refreshPromise ? this.enqueueForToken() : this.startRefreshAndResolveQueue(e.refreshToken);
@@ -577,15 +668,48 @@ const ie = class ie {
   async forceRefresh() {
     const e = this.getTokens();
     if (!(e != null && e.accessToken)) {
-      const t = new Z("token_invalid", "No tokens available");
+      const t = new Q("token_invalid", "No tokens available");
       throw this.handleSessionExpired(t), t;
     }
     if (!e.refreshToken) {
-      const t = new Z("token_invalid", "No refresh token available");
+      const t = new Q("token_invalid", "No refresh token available");
       throw this.handleSessionExpired(t), t;
     }
     return this.refreshPromise ? this.enqueueForToken() : this.startRefreshAndResolveQueue(e.refreshToken, !0);
   }
+  /**
+   * Active bootstrap resolution: drive the session to a terminal state.
+   *
+   * Unlike `waitForPendingRefresh()` which only awaits a refresh someone else
+   * already started, this method actively triggers the refresh when needed.
+   * Use it from `AuthProvider` during initial mount so a page load with a
+   * stale access token but valid refresh token doesn't expose
+   * `isAuthenticated=false` before the refresh even runs.
+   *
+   * Resolves to:
+   *  - `'authenticated'`: tokens exist and are valid (refreshed if necessary)
+   *  - `'unauthenticated'`: no tokens at all (callers should treat as anon)
+   *  - `'expired'`: tokens existed but refresh failed fatally; the
+   *    `onSessionExpired` callback was already fired by `handleSessionExpired`.
+   *
+   * Never throws — all error paths collapse into `'expired'`.
+   */
+  async ensureValidSession() {
+    const e = this.getTokens();
+    if (!(e != null && e.accessToken))
+      return this.transitionTo("idle"), this.notify(), "unauthenticated";
+    if (!this.isTokenExpired(e) && !this.shouldRefreshToken(e))
+      return this.transitionTo("authenticated"), this.notify(), "authenticated";
+    if (!e.refreshToken)
+      return this.handleSessionExpired(
+        new Q("token_invalid", "No refresh token available")
+      ), "expired";
+    try {
+      return await this.getValidAccessToken(), this.transitionTo("authenticated"), this.notify(), "authenticated";
+    } catch {
+      return this.state !== "expired" && (this.transitionTo("expired"), this.notify()), "expired";
+    }
+  }
   /**
    * Backward-compatible getAuthHeaders — now delegates to getValidAccessToken.
    */
@@ -593,29 +717,30 @@ const ie = class ie {
     try {
       return { Authorization: `Bearer ${await this.getValidAccessToken()}` };
     } catch (e) {
-      return e instanceof Z && this.onRefreshFailed && this.onRefreshFailed(), {};
+      return e instanceof Q && this.onRefreshFailed && this.onRefreshFailed(), {};
     }
   }
   enqueueForToken() {
     return new Promise((e, t) => {
       const n = setTimeout(() => {
-        const i = this.refreshQueue.findIndex((a) => a.timeoutId === n);
-        i !== -1 && this.refreshQueue.splice(i, 1), t(new kt(this.refreshQueueTimeout));
+        const i = this.refreshQueue.findIndex((o) => o.timeoutId === n);
+        i !== -1 && this.refreshQueue.splice(i, 1), t(new Pt(this.refreshQueueTimeout));
       }, this.refreshQueueTimeout);
       this.refreshQueue.push({ resolve: e, reject: t, timeoutId: n });
     });
   }
   async startRefreshAndResolveQueue(e, t = !1) {
-    this.refreshPromise = this.executeRefreshWithRetry(e, t);
+    const n = this.sessionGeneration;
+    this.refreshPromise = this.executeRefreshWithRetry(e, t), this.isRefreshing = !0, this.notify();
     try {
       await this.refreshPromise;
-      const n = this.getTokens(), i = (n == null ? void 0 : n.accessToken) || "";
-      return this.resolveQueue(i), i;
-    } catch (n) {
-      const i = n instanceof Error ? n : new Error("Token refresh failed");
-      throw i instanceof Z ? (this.rejectQueue(i), this.handleSessionExpired(i)) : this.rejectQueue(i), i;
+      const i = this.getTokens(), o = (i == null ? void 0 : i.accessToken) || "";
+      return this.resolveQueue(o), o;
+    } catch (i) {
+      const o = i instanceof Error ? i : new Error("Token refresh failed");
+      throw o instanceof Q ? (this.rejectQueue(o), this.sessionGeneration === n && this.handleSessionExpired(o)) : this.rejectQueue(o), o;
     } finally {
-      this.refreshPromise = null;
+      this.refreshPromise = null, this.isRefreshing = !1, this.notify();
     }
   }
   resolveQueue(e) {
@@ -634,23 +759,23 @@ const ie = class ie {
   async executeRefreshWithRetry(e, t = !1) {
     let n;
     const i = this.sessionGeneration;
-    for (let a = 0; a <= this.maxRefreshRetries; a++) {
+    for (let o = 0; o <= this.maxRefreshRetries; o++) {
       if (this.sessionGeneration !== i)
-        throw new Z("token_invalid", "Session cleared during refresh");
+        throw new Q("token_invalid", "Session cleared during refresh");
       try {
         await this.performTokenRefresh(e, i, t);
         return;
-      } catch (l) {
-        const h = l instanceof Error ? l : new Error(String(l));
-        if (h instanceof Z)
-          throw h;
-        if (n = h, a < this.maxRefreshRetries) {
-          const S = this.retryBackoffBase * Math.pow(2, a);
-          await this.sleep(S);
+      } catch (a) {
+        const p = a instanceof Error ? a : new Error(String(a));
+        if (p instanceof Q)
+          throw p;
+        if (n = p, o < this.maxRefreshRetries) {
+          const k = this.retryBackoffBase * Math.pow(2, o);
+          await this.sleep(k);
         }
       }
     }
-    throw new Et(this.maxRefreshRetries + 1, n);
+    throw new It(this.maxRefreshRetries + 1, n);
   }
   /**
    * Single refresh attempt with error classification.
@@ -669,46 +794,49 @@ const ie = class ie {
     const i = this.getTokens();
     if (!n && (i != null && i.accessToken) && !this.isTokenExpired(i) && !this.shouldRefreshToken(i))
       return;
-    const a = (i == null ? void 0 : i.refreshToken) || e, l = `${this.baseUrl}/auth/refresh`, h = At(a, "deviceId"), S = { refreshToken: a };
-    h && (S.deviceId = h);
-    let k;
+    const o = (i == null ? void 0 : i.refreshToken) || e, a = `${this.baseUrl}/auth/refresh`, p = Ft(o, "deviceId"), k = { refreshToken: o };
+    p && (k.deviceId = p);
+    let E;
     try {
-      k = await fetch(l, {
+      E = await fetch(a, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify(S),
+        body: JSON.stringify(k),
         ...this.enableCookieSession && { credentials: "include" }
       });
     } catch (c) {
       throw c instanceof Error ? c : new Error("Network error during token refresh");
     }
-    if (!k.ok) {
+    if (!E.ok) {
       let c = "";
       try {
-        const d = await k.json();
+        const d = await E.json();
         c = (d.message || d.error || "").toLowerCase();
       } catch {
-        c = k.statusText.toLowerCase();
+        c = E.statusText.toLowerCase();
       }
-      throw k.status === 401 ? c.includes("expired") ? new Z("token_expired") : c.includes("invalid") ? new Z("token_invalid") : new Z("token_invalid", `Unauthorized: ${c}`) : k.status === 400 ? c.includes("inactive") ? new Z("user_inactive") : c.includes("expired") || c.includes("invalid") ? new Z("token_invalid", c) : c.includes("reuse") || c.includes("revoked") ? new Z("token_invalid", c) : new Error(`Token refresh failed (400): ${c}`) : new Error(`Token refresh failed: ${k.status} ${c}`);
+      throw E.status === 401 ? c.includes("expired") ? new Q("token_expired") : c.includes("invalid") ? new Q("token_invalid") : new Q("token_invalid", `Unauthorized: ${c}`) : E.status === 400 ? c.includes("inactive") ? new Q("user_inactive") : c.includes("expired") || c.includes("invalid") ? new Q("token_invalid", c) : c.includes("reuse") || c.includes("revoked") ? new Q("token_invalid", c) : new Error(`Token refresh failed (400): ${c}`) : new Error(`Token refresh failed: ${E.status} ${c}`);
     }
     if (this.sessionGeneration !== t)
-      throw new Z("token_invalid", "Session cleared during refresh");
-    const T = await k.json();
+      throw new Q("token_invalid", "Session cleared during refresh");
+    const S = await E.json();
     this.setTokens({
-      accessToken: T.accessToken,
-      refreshToken: T.refreshToken || a,
-      expiresIn: T.expiresIn
+      accessToken: S.accessToken,
+      refreshToken: S.refreshToken || o,
+      expiresIn: S.expiresIn
     });
   }
   // --- Session expiry handler ---
   handleSessionExpired(e) {
-    this.cancelProactiveTimer(), this.clearSession(), this.onSessionExpired ? this.onSessionExpired(e) : this.onRefreshFailed && this.onRefreshFailed();
+    const t = this.logoutInFlight;
+    this.lastExpiryReason = e.message, this.cancelProactiveTimer(), this.sessionGeneration++, this.clearTokens();
+    const n = new Q("token_invalid", "Session cleared");
+    this.rejectQueue(n), this.transitionTo(t ? "idle" : "expired"), this.notify(), !t && (this.onSessionExpired ? this.onSessionExpired(e) : this.onRefreshFailed && this.onRefreshFailed());
   }
   // --- User data ---
   setUser(e) {
     const t = this.tokenStorage.get() || {};
-    this.tokenStorage.set({ ...t, user: e });
+    this.tokenStorage.set({ ...t, user: e }), this.notify();
   }
   getUser() {
     const e = this.tokenStorage.get();
@@ -716,28 +844,37 @@ const ie = class ie {
   }
   clearUser() {
     const e = this.tokenStorage.get() || {};
-    delete e.user, this.tokenStorage.set(e);
+    delete e.user, this.tokenStorage.set(e), this.notify();
   }
   // --- Session lifecycle ---
-  clearSession() {
-    this.sessionGeneration++, this.cancelProactiveTimer(), this.clearTokens();
-    const e = new Z("token_invalid", "Session cleared");
-    this.rejectQueue(e);
+  /**
+   * Clear all session state.
+   *
+   * @param reason - 'logout' for intentional sign-out (suppresses any
+   *   onSessionExpired callbacks fired by in-flight refreshes that race the
+   *   logout); 'expired' for fatal-error paths. Defaults to 'expired' for
+   *   backward compatibility.
+   */
+  clearSession(e = "expired") {
+    const t = e === "logout";
+    t && (this.logoutInFlight = !0), this.sessionGeneration++, this.cancelProactiveTimer(), this.clearTokens();
+    const n = new Q("token_invalid", "Session cleared");
+    this.rejectQueue(n), this.transitionTo(t ? "idle" : "expired"), this.notify(), t && (this.logoutInFlight = !1);
   }
   /**
    * Dispose of this SessionManager instance.
    * Cancels all timers and rejects pending queue entries.
    */
   destroy() {
-    this.isDestroyed = !0, ie.instances.delete(this.storageKey), this.cancelProactiveTimer(), this.detachVisibilityListener();
-    const e = new Z("token_invalid", "SessionManager destroyed");
+    this.isDestroyed = !0, ye.delete(this.storageKey), this.cancelProactiveTimer(), this.detachVisibilityListener(), this.detachStorageListener(), this.listeners.clear();
+    const e = new Q("token_invalid", "SessionManager destroyed");
     this.rejectQueue(e);
   }
   // --- JWT helpers ---
   getTokenPayload() {
     var t, n;
     const e = (t = this.getTokens()) == null ? void 0 : t.accessToken;
-    return e ? ((n = Re(e)) == null ? void 0 : n.payload) ?? null : null;
+    return e ? ((n = Pe(e)) == null ? void 0 : n.payload) ?? null : null;
   }
   /**
    * Get userId from token (source of truth) or fallback to stored user
@@ -757,9 +894,9 @@ const ie = class ie {
     return new Promise((t) => setTimeout(t, e));
   }
 };
-ie.instances = /* @__PURE__ */ new Map(), ie.MAX_BACKGROUND_FAILURES = 3;
-let Me = ie;
-class Ct {
+de.MAX_BACKGROUND_FAILURES = 3;
+let Ue = de;
+class Bt {
   constructor(e) {
     this.httpService = e, this.verificationCache = /* @__PURE__ */ new Map(), this.VERIFY_CACHE_TTL_MS = 6e4, this.pendingMagicLinks = /* @__PURE__ */ new Map();
   }
@@ -816,10 +953,10 @@ class Ct {
       "/auth/magic-link/verify",
       e,
       { skipAuth: !0 }
-    ), a = { promise: i };
-    return this.verificationCache.set(t, a), i.then(
+    ), o = { promise: i };
+    return this.verificationCache.set(t, o), i.then(
       () => {
-        a.timer = setTimeout(
+        o.timer = setTimeout(
           () => this.verificationCache.delete(t),
           this.VERIFY_CACHE_TTL_MS
         );
@@ -836,7 +973,7 @@ class Ct {
     await this.httpService.post("/auth/change-password", e);
   }
 }
-class Dt {
+class _t {
   constructor(e) {
     this.httpService = e;
   }
@@ -854,7 +991,7 @@ class Dt {
   }
   async getRolesByApp(e, t) {
     const n = await this.httpService.get(
-      `/roles/app/${e}${ce(t)}`,
+      `/roles/app/${e}${le(t)}`,
       { skipAuth: !0 }
     );
     return { roles: n.data, meta: n.meta };
@@ -867,12 +1004,12 @@ class Dt {
   }
   async getUserRoles(e, t) {
     const n = await this.httpService.get(
-      `/roles/user/${e}${ce(t)}`
+      `/roles/user/${e}${le(t)}`
     );
     return { roles: n.data, meta: n.meta };
   }
 }
-class Mt {
+class Ot {
   constructor(e) {
     this.httpService = e;
   }
@@ -881,7 +1018,7 @@ class Mt {
   }
   async getUsers(e) {
     const t = await this.httpService.get(
-      `/users/${ce(e)}`
+      `/users/${le(e)}`
     );
     return { users: t.data, meta: t.meta };
   }
@@ -895,7 +1032,7 @@ class Mt {
     await this.httpService.delete(`/users/${e}`);
   }
 }
-class be {
+class we {
   constructor(e, t) {
     this.httpService = e, this.appId = t;
   }
@@ -904,7 +1041,7 @@ class be {
   }
   async getTenants(e) {
     const t = await this.httpService.get(
-      `/tenants/${ce(e)}`
+      `/tenants/${le(e)}`
     );
     return { tenants: t.data, meta: t.meta };
   }
@@ -939,40 +1076,40 @@ class be {
     )).data;
   }
 }
-function $t(r, e) {
+function Vt(r, e) {
   if (r === "localhost" || r.startsWith("127.") || r.startsWith("192.168."))
     return null;
   if (e) {
-    const i = e.toLowerCase(), a = r.toLowerCase();
-    if (a === i || a === `www.${i}`)
+    const i = e.toLowerCase(), o = r.toLowerCase();
+    if (o === i || o === `www.${i}`)
       return null;
-    if (a.endsWith(`.${i}`)) {
-      const l = a.slice(0, -(i.length + 1));
-      return l === "www" ? null : l;
+    if (o.endsWith(`.${i}`)) {
+      const a = o.slice(0, -(i.length + 1));
+      return a === "www" ? null : a;
     }
     return null;
   }
   const n = r.split(".");
   return n.length >= 3 && n[0] !== "www" ? n[0] : null;
 }
-function Ut(r, e = "tenant", t) {
+function qt(r, e = "tenant", t) {
   const i = new URLSearchParams(r).get(e);
   return i ? (t && t.setItem("tenant", i), i) : t ? t.getItem("tenant") : null;
 }
-function Bt(r, e, t) {
-  const { tenantMode: n, baseDomain: i, selectorParam: a, fixedTenantSlug: l } = r;
-  return n === "fixed" ? l || null : n === "subdomain" ? $t(e.hostname, i) : n === "selector" ? Ut(e.search, a, t) : null;
+function zt(r, e, t) {
+  const { tenantMode: n, baseDomain: i, selectorParam: o, fixedTenantSlug: a } = r;
+  return n === "fixed" ? a || null : n === "subdomain" ? Vt(e.hostname, i) : n === "selector" ? qt(e.search, o, t) : null;
 }
-function _t(r, e, t) {
+function Gt(r, e, t) {
   if (t)
     return `${r}.${t}`;
   const n = e.split(".");
   return n.length === 2 ? `${r}.${e}` : n.length >= 3 ? (n[0] = r, n.join(".")) : null;
 }
-const Be = fe(null);
-function xr({ config: r, children: e }) {
-  var j, K, $;
-  const { baseUrl: t, appInfo: n, appId: i } = Ae(), a = te(() => typeof window > "u" ? null : Bt(
+const Oe = fe(null);
+function Lr({ config: r, children: e }) {
+  var z, Z, K;
+  const { baseUrl: t, appInfo: n, appId: i } = Ae(), o = te(() => typeof window > "u" ? null : zt(
     {
       tenantMode: r.tenantMode || "selector",
       baseDomain: r.baseDomain,
@@ -984,111 +1121,111 @@ function xr({ config: r, children: e }) {
       search: window.location.search
     },
     window.localStorage
-  ), [r.tenantMode, r.baseDomain, r.selectorParam, r.fixedTenantSlug]), [l, h] = N(() => a()), S = ((j = r.cache) == null ? void 0 : j.enabled) ?? !0, k = ((K = r.cache) == null ? void 0 : K.ttl) ?? 5 * 60 * 1e3, T = (($ = r.cache) == null ? void 0 : $.storageKey) ?? `tenant_cache_${l || "default"}`, c = V(
-    () => ({ enabled: S, ttl: k, storageKey: T }),
-    [S, k, T]
-  ), [d, A] = N(() => {
+  ), [r.tenantMode, r.baseDomain, r.selectorParam, r.fixedTenantSlug]), [a, p] = C(() => o()), k = ((z = r.cache) == null ? void 0 : z.enabled) ?? !0, E = ((Z = r.cache) == null ? void 0 : Z.ttl) ?? 300 * 1e3, S = ((K = r.cache) == null ? void 0 : K.storageKey) ?? `tenant_cache_${a || "default"}`, c = O(
+    () => ({ enabled: k, ttl: E, storageKey: S }),
+    [k, E, S]
+  ), [d, x] = C(() => {
     if (r.initialTenant) return r.initialTenant;
-    if (!c.enabled || !l) return null;
+    if (!c.enabled || !a) return null;
     try {
-      const B = localStorage.getItem(c.storageKey);
-      if (!B) return null;
-      const L = JSON.parse(B);
-      return Date.now() - L.timestamp < c.ttl && L.tenantSlug === l ? L.data : (localStorage.removeItem(c.storageKey), null);
+      const D = localStorage.getItem(c.storageKey);
+      if (!D) return null;
+      const F = JSON.parse(D);
+      return Date.now() - F.timestamp < c.ttl && F.tenantSlug === a ? F.data : (localStorage.removeItem(c.storageKey), null);
     } catch {
       return null;
     }
-  }), [P, I] = N(!d && !r.initialTenant), [R, E] = N(null), [m, g] = N(null), [b, C] = N(!1), [o, p] = N(null);
+  }), [I, L] = C(!d && !r.initialTenant), [P, R] = C(null), [m, g] = C(null), [b, w] = C(!1), [l, h] = C(null);
   re(() => {
     if (r.tenantMode === "fixed") return;
-    const B = a();
-    h(B);
-  }, [a, r.tenantMode]);
-  const x = (n == null ? void 0 : n.settingsSchema) || null, y = te(
-    async (B, L = !1) => {
-      if (!(!L && c.enabled && d && d.subdomain === B))
+    const D = o();
+    p(D);
+  }, [o, r.tenantMode]);
+  const A = (n == null ? void 0 : n.settingsSchema) || null, y = te(
+    async (D, F = !1) => {
+      if (!(!F && c.enabled && d && d.subdomain === D))
         try {
-          I(!0), E(null);
-          const q = new he(t), W = await new be(q, i).getPublicTenantInfo(B);
-          if (A(W), c.enabled)
+          L(!0), R(null);
+          const _ = new he(t), G = await new we(_, i).getPublicTenantInfo(D);
+          if (x(G), c.enabled)
             try {
               const Y = {
-                data: W,
+                data: G,
                 timestamp: Date.now(),
-                tenantSlug: B
+                tenantSlug: D
               };
               localStorage.setItem(c.storageKey, JSON.stringify(Y));
             } catch (Y) {
               process.env.NODE_ENV === "development" && console.warn("[TenantProvider] Failed to cache tenant info:", Y);
             }
-        } catch (q) {
-          const _ = q instanceof Error ? q : new Error("Failed to load tenant information");
-          E(_), A(null);
+        } catch (_) {
+          const B = _ instanceof Error ? _ : new Error("Failed to load tenant information");
+          R(B), x(null);
         } finally {
-          I(!1);
+          L(!1);
         }
     },
     [t, i, c, d]
   ), u = te(async () => {
-    if (!(!c.enabled || !d || !l))
+    if (!(!c.enabled || !d || !a))
       try {
-        const B = localStorage.getItem(c.storageKey);
-        if (!B) return;
-        const L = JSON.parse(B);
-        if (Date.now() - L.timestamp > c.ttl * 0.5) {
-          const _ = new he(t), Y = await new be(_, i).getPublicTenantInfo(l);
-          A(Y);
+        const D = localStorage.getItem(c.storageKey);
+        if (!D) return;
+        const F = JSON.parse(D);
+        if (Date.now() - F.timestamp > c.ttl * 0.5) {
+          const B = new he(t), Y = await new we(B, i).getPublicTenantInfo(a);
+          x(Y);
           const X = {
             data: Y,
             timestamp: Date.now(),
-            tenantSlug: l
+            tenantSlug: a
           };
           localStorage.setItem(c.storageKey, JSON.stringify(X));
         }
-      } catch (B) {
-        process.env.NODE_ENV === "development" && console.warn("[TenantProvider] Background tenant refresh failed:", B);
+      } catch (D) {
+        process.env.NODE_ENV === "development" && console.warn("[TenantProvider] Background tenant refresh failed:", D);
       }
-  }, [t, i, c, d, l]), v = te(async () => {
+  }, [t, i, c, d, a]), T = te(async () => {
     if (d != null && d.id)
       try {
-        C(!0), p(null);
-        const B = new he(t), q = await new be(B, d.appId).getTenantSettings(d.id);
-        g(q);
-      } catch (B) {
-        const L = B instanceof Error ? B : new Error("Failed to load tenant settings");
-        p(L), g(null);
+        w(!0), h(null);
+        const D = new he(t), _ = await new we(D, d.appId).getTenantSettings(d.id);
+        g(_);
+      } catch (D) {
+        const F = D instanceof Error ? D : new Error("Failed to load tenant settings");
+        h(F), g(null);
       } finally {
-        C(!1);
+        w(!1);
       }
-  }, [t, d]), D = te(() => {
-    v();
-  }, [v]), se = te(
-    (B) => {
-      if (!x)
+  }, [t, d]), M = te(() => {
+    T();
+  }, [T]), se = te(
+    (D) => {
+      if (!A)
         return { isValid: !0, errors: [] };
-      const L = [];
+      const F = [];
       try {
-        return x.properties && Object.entries(x.properties).forEach(([q, _]) => {
+        return A.properties && Object.entries(A.properties).forEach(([_, B]) => {
           var Y;
-          const W = B[q];
-          if ((Y = x.required) != null && Y.includes(q) && W == null) {
-            L.push(`Field '${q}' is required`);
+          const G = D[_];
+          if ((Y = A.required) != null && Y.includes(_) && G == null) {
+            F.push(`Field '${_}' is required`);
             return;
           }
-          if (W != null) {
-            if (_.type) {
-              const X = _.type, le = typeof W;
-              X === "string" && le !== "string" ? L.push(`Field '${q}' must be a string`) : (X === "number" || X === "integer") && le !== "number" ? L.push(`Field '${q}' must be a number`) : X === "boolean" && le !== "boolean" ? L.push(`Field '${q}' must be a boolean`) : X === "array" && !Array.isArray(W) && L.push(`Field '${q}' must be an array`);
+          if (G != null) {
+            if (B.type) {
+              const X = B.type, ae = typeof G;
+              X === "string" && ae !== "string" ? F.push(`Field '${_}' must be a string`) : (X === "number" || X === "integer") && ae !== "number" ? F.push(`Field '${_}' must be a number`) : X === "boolean" && ae !== "boolean" ? F.push(`Field '${_}' must be a boolean`) : X === "array" && !Array.isArray(G) && F.push(`Field '${_}' must be an array`);
             }
-            _.minLength !== void 0 && typeof W == "string" && W.length < _.minLength && L.push(
-              `Field '${q}' must be at least ${_.minLength} characters long`
-            ), _.maxLength !== void 0 && typeof W == "string" && W.length > _.maxLength && L.push(
-              `Field '${q}' must be no more than ${_.maxLength} characters long`
-            ), _.minimum !== void 0 && typeof W == "number" && W < _.minimum && L.push(`Field '${q}' must be at least ${_.minimum}`), _.maximum !== void 0 && typeof W == "number" && W > _.maximum && L.push(`Field '${q}' must be no more than ${_.maximum}`), _.pattern && typeof W == "string" && (new RegExp(_.pattern).test(W) || L.push(`Field '${q}' does not match the required pattern`)), _.enum && !_.enum.includes(W) && L.push(`Field '${q}' must be one of: ${_.enum.join(", ")}`);
+            B.minLength !== void 0 && typeof G == "string" && G.length < B.minLength && F.push(
+              `Field '${_}' must be at least ${B.minLength} characters long`
+            ), B.maxLength !== void 0 && typeof G == "string" && G.length > B.maxLength && F.push(
+              `Field '${_}' must be no more than ${B.maxLength} characters long`
+            ), B.minimum !== void 0 && typeof G == "number" && G < B.minimum && F.push(`Field '${_}' must be at least ${B.minimum}`), B.maximum !== void 0 && typeof G == "number" && G > B.maximum && F.push(`Field '${_}' must be no more than ${B.maximum}`), B.pattern && typeof G == "string" && (new RegExp(B.pattern).test(G) || F.push(`Field '${_}' does not match the required pattern`)), B.enum && !B.enum.includes(G) && F.push(`Field '${_}' must be one of: ${B.enum.join(", ")}`);
           }
         }), {
-          isValid: L.length === 0,
-          errors: L
+          isValid: F.length === 0,
+          errors: F
         };
       } catch {
         return {
@@ -1097,26 +1234,26 @@ function xr({ config: r, children: e }) {
         };
       }
     },
-    [x]
+    [A]
   );
   re(() => {
-    !r.initialTenant && l ? d ? u() : y(l) : !r.initialTenant && !l && (A(null), E(null), I(!1));
-  }, [r.initialTenant, l, d, y, u]), re(() => {
-    d != null && d.id ? v() : (g(null), p(null), C(!1));
-  }, [d == null ? void 0 : d.id, v]);
-  const F = te(
-    (B, L) => {
-      const { mode: q = "reload", redirectPath: _ } = L || {}, W = r.tenantMode || "selector";
-      if (W === "fixed") {
+    !r.initialTenant && a ? d ? u() : y(a) : !r.initialTenant && !a && (x(null), R(null), L(!1));
+  }, [r.initialTenant, a, d, y, u]), re(() => {
+    d != null && d.id ? T() : (g(null), h(null), w(!1));
+  }, [d == null ? void 0 : d.id, T]);
+  const N = te(
+    (D, F) => {
+      const { mode: _ = "reload", redirectPath: B } = F || {}, G = r.tenantMode || "selector";
+      if (G === "fixed") {
         process.env.NODE_ENV === "development" && console.warn(
           "[TenantProvider] switchTenant is a no-op in fixed mode. Tenant is always:",
           r.fixedTenantSlug
-        ), _ && (window.location.href = _);
+        ), B && (window.location.href = B);
         return;
       }
-      if (localStorage.setItem("tenant", B), W === "subdomain") {
-        const Y = window.location.hostname, X = _t(
-          B,
+      if (localStorage.setItem("tenant", D), G === "subdomain") {
+        const Y = window.location.hostname, X = Gt(
+          D,
           Y,
           r.baseDomain
         );
@@ -1127,68 +1264,68 @@ function xr({ config: r, children: e }) {
           );
           return;
         }
-        const le = _ || window.location.pathname, Se = new URL(`${window.location.protocol}//${X}${le}`);
-        new URLSearchParams(window.location.search).forEach((Fe, Ne) => {
-          Se.searchParams.set(Ne, Fe);
-        }), window.location.href = Se.toString();
-      } else if (W === "selector") {
-        const Y = _ || window.location.pathname, X = new URLSearchParams(window.location.search);
-        if (X.set(r.selectorParam || "tenant", B), q === "reload") {
-          const le = `${Y}?${X.toString()}${window.location.hash}`;
-          window.location.href = le;
+        const ae = B || window.location.pathname, ke = new URL(`${window.location.protocol}//${X}${ae}`);
+        new URLSearchParams(window.location.search).forEach((Ne, Ce) => {
+          ke.searchParams.set(Ce, Ne);
+        }), window.location.href = ke.toString();
+      } else if (G === "selector") {
+        const Y = B || window.location.pathname, X = new URLSearchParams(window.location.search);
+        if (X.set(r.selectorParam || "tenant", D), _ === "reload") {
+          const ae = `${Y}?${X.toString()}${window.location.hash}`;
+          window.location.href = ae;
         } else {
-          const le = `${Y}?${X.toString()}${window.location.hash}`;
-          window.history.pushState({}, "", le), h(B), y(B);
+          const ae = `${Y}?${X.toString()}${window.location.hash}`;
+          window.history.pushState({}, "", ae), p(D), y(D);
         }
       }
     },
     [r.tenantMode, r.selectorParam, r.baseDomain, r.fixedTenantSlug, y]
-  ), H = V(() => ({
+  ), W = O(() => ({
     // Tenant info
     tenant: d,
-    tenantSlug: l,
-    isTenantLoading: P,
-    tenantError: R,
+    tenantSlug: a,
+    isTenantLoading: I,
+    tenantError: P,
     retryTenant: () => {
-      l && y(l);
+      a && y(a);
     },
     // Settings
     settings: m,
-    settingsSchema: x,
+    settingsSchema: A,
     isSettingsLoading: b,
-    settingsError: o,
+    settingsError: l,
     // Actions
-    refreshSettings: D,
-    switchTenant: F,
+    refreshSettings: M,
+    switchTenant: N,
     // Validation
     validateSettings: se
   }), [
     d,
-    l,
+    a,
+    I,
     P,
-    R,
     m,
-    x,
+    A,
     b,
-    o,
-    D,
-    F,
+    l,
+    M,
+    N,
     se
   ]);
-  return /* @__PURE__ */ s(Be.Provider, { value: H, children: e });
+  return /* @__PURE__ */ s(Oe.Provider, { value: W, children: e });
 }
-function Te() {
-  const r = ne(Be);
+function Se() {
+  const r = ne(Oe);
   if (!r)
     throw new Error("useTenant must be used within a TenantProvider");
   return r;
 }
 function pe() {
-  return ne(Be);
+  return ne(Oe);
 }
-const Ar = Te;
-function Rr() {
-  const { settings: r, settingsSchema: e, isSettingsLoading: t, settingsError: n, validateSettings: i } = Te();
+const Fr = Se;
+function Nr() {
+  const { settings: r, settingsSchema: e, isSettingsLoading: t, settingsError: n, validateSettings: i } = Se();
   return {
     settings: r,
     settingsSchema: e,
@@ -1197,8 +1334,8 @@ function Rr() {
     validateSettings: i
   };
 }
-function ot() {
-  const { tenant: r, tenantSlug: e, isTenantLoading: t, tenantError: n, retryTenant: i } = Te();
+function ct() {
+  const { tenant: r, tenantSlug: e, isTenantLoading: t, tenantError: n, retryTenant: i } = Se();
   return {
     tenant: r,
     tenantSlug: e,
@@ -1207,380 +1344,392 @@ function ot() {
     retry: i
   };
 }
-const _e = "userTenants";
-function Ot() {
+const Ve = "userTenants";
+function jt() {
   try {
-    const r = localStorage.getItem(_e);
+    const r = localStorage.getItem(Ve);
     return r ? JSON.parse(r) : [];
   } catch {
     return [];
   }
 }
-function Xe(r) {
+function nt(r) {
   try {
-    localStorage.setItem(_e, JSON.stringify(r));
+    localStorage.setItem(Ve, JSON.stringify(r));
   } catch {
   }
 }
-function et() {
+function De() {
   try {
-    localStorage.removeItem(_e);
+    localStorage.removeItem(Ve);
   } catch {
   }
 }
-const Pe = fe(null), Ie = fe(null);
-function Pr({ config: r = {}, children: e }) {
-  const t = Ue(), n = pe(), i = (t == null ? void 0 : t.baseUrl) ?? r.baseUrl ?? "", a = (t == null ? void 0 : t.appId) ?? r.appId, l = (n == null ? void 0 : n.tenant) ?? null, h = (n == null ? void 0 : n.tenantSlug) ?? null, S = (n == null ? void 0 : n.switchTenant) ?? (() => {
+const Ie = fe(null), Le = fe(null);
+function Cr({ config: r = {}, children: e }) {
+  const t = _e(), n = pe(), i = (t == null ? void 0 : t.baseUrl) ?? r.baseUrl ?? "", o = (t == null ? void 0 : t.appId) ?? r.appId, a = (n == null ? void 0 : n.tenant) ?? null, p = (n == null ? void 0 : n.tenantSlug) ?? null, k = (n == null ? void 0 : n.switchTenant) ?? (() => {
   });
   if (!i)
     throw new Error(
       "[AuthProvider] baseUrl is required. Provide it via AppProvider or AuthConfig.baseUrl."
     );
-  const [k, T] = N(r.initialRoles || []), [c, d] = N(!r.initialRoles), [A, P] = N(null), [I, R] = N(!1), [E, m] = N(null), [g, b] = N(() => Ot()), C = ye({ done: !1 });
-  C.current.done || (C.current.done = !0);
-  const o = V(() => Me.getInstance({
+  const [E, S] = C(r.initialRoles || []), [c, d] = C(!r.initialRoles), [x, I] = C(null), [L, P] = C(!1), [R, m] = C(null), [g, b] = C(() => jt()), w = O(() => Ue.getInstance({
     baseUrl: i,
     enableCookieSession: r.enableCookieSession,
     refreshQueueTimeout: r.refreshQueueTimeout,
     proactiveRefreshMargin: r.proactiveRefreshMargin,
-    onSessionExpired: (w) => {
-      P(null), m(null), b([]), et(), r.onSessionExpired ? r.onSessionExpired(w) : r.onRefreshFailed && r.onRefreshFailed();
+    onSessionExpired: (v) => {
+      I(null), m(null), b([]), De(), r.onSessionExpired ? r.onSessionExpired(v) : r.onRefreshFailed && r.onRefreshFailed();
     }
   }), [
     i,
     r.enableCookieSession,
     r.refreshQueueTimeout,
     r.proactiveRefreshMargin
-  ]), [p, x] = N(() => {
-    const w = o.getTokens();
-    return w ? o.hasValidSession() || !!w.refreshToken : !!r.enableCookieSession;
-  }), y = C.current.done && !p, u = V(() => {
-    const w = new he(i);
-    return w.setSessionManager(o), w;
-  }, [i, o]), v = V(
-    () => new Ct(u),
+  ]), l = Et(
+    (v) => w.subscribe(v),
+    () => w.getSnapshot(),
+    () => 0
+  ), [h, A] = C(!1), y = h, u = O(() => {
+    const v = new he(i);
+    return v.setSessionManager(w), v;
+  }, [i, w]), T = O(
+    () => new Bt(u),
     [u]
-  ), D = V(
-    () => new Mt(u),
+  ), M = O(
+    () => new Ot(u),
     [u]
-  ), se = V(
-    () => new Dt(u),
+  ), se = O(
+    () => new _t(u),
     [u]
-  ), F = V(() => A != null && A.roleId && k.find((w) => w.id === A.roleId) || null, [A, k]), H = V(() => (F == null ? void 0 : F.permissions) || [], [F]), j = V(
-    () => o.hasValidSession() && A !== null,
-    [o, A]
-  ), K = V(() => (A == null ? void 0 : A.tenantId) != null, [A]), $ = ye(null), B = ye(/* @__PURE__ */ new Set()), L = async (w = !1) => {
+  ), N = O(() => x != null && x.roleId && E.find((v) => v.id === x.roleId) || null, [x, E]), W = O(() => (N == null ? void 0 : N.permissions) || [], [N]), z = O(
+    () => w.hasValidSession() && x !== null,
+    [w, x, l]
+  ), Z = O(() => h ? w.getState() === "expired" ? "expired" : w.getRefreshInFlight() ? "refreshing" : w.hasValidSession() && x !== null ? "authenticated" : "unauthenticated" : "initializing", [w, h, x, l]), K = O(() => (x == null ? void 0 : x.tenantId) != null, [x]), D = be(null), F = be(/* @__PURE__ */ new Set()), _ = async (v = !1) => {
     try {
-      if (!o.hasValidSession() || !w && A) return;
-      const M = o.getUserId();
-      if (!M) {
+      if (!w.hasValidSession() || !v && x) return;
+      const $ = w.getUserId();
+      if (!$) {
         process.env.NODE_ENV === "development" && console.warn("[AuthProvider] No userId available in token or storage");
         return;
       }
-      R(!0), m(null);
-      const z = await D.getUserById(M);
-      P(z), o.setUser(z);
-    } catch (M) {
-      const z = M instanceof Error ? M : new Error("Failed to load user data");
-      m(z), process.env.NODE_ENV === "development" && console.error("[AuthProvider] Failed to load user data:", z);
+      P(!0), m(null);
+      const V = await M.getUserById($);
+      I(V), w.setUser(V);
+    } catch ($) {
+      const V = $ instanceof Error ? $ : new Error("Failed to load user data");
+      m(V), process.env.NODE_ENV === "development" && console.error("[AuthProvider] Failed to load user data:", V);
     } finally {
-      R(!1);
+      P(!1);
     }
-  }, q = async (w) => {
-    var He;
-    const { username: M, password: z, tenantSlug: O, redirectPath: J } = w;
-    let ee = l == null ? void 0 : l.id, Q = h;
-    O && (ee = (await new be(u, a).getPublicTenantInfo(O)).id, Q = O);
-    const G = await v.login({
-      username: M,
-      password: z,
-      appId: a,
+  }, B = async (v) => {
+    var Ke;
+    const { username: $, password: V, tenantSlug: q, redirectPath: J } = v;
+    let ee = a == null ? void 0 : a.id, H = p;
+    q && (ee = (await new we(u, o).getPublicTenantInfo(q)).id, H = q);
+    const j = await T.login({
+      username: $,
+      password: V,
+      appId: o,
       tenantId: ee
-    }), ke = O && O !== h;
-    if (o.setTokens({
-      accessToken: G.accessToken,
-      refreshToken: G.refreshToken,
-      expiresIn: G.expiresIn
-    }), G.user) {
-      o.setUser(G.user), P(G.user);
+    }), Ee = q && q !== p;
+    if (w.setTokens({
+      accessToken: j.accessToken,
+      refreshToken: j.refreshToken,
+      expiresIn: j.expiresIn
+    }), j.user) {
+      w.setUser(j.user), I(j.user);
       try {
-        await L();
-      } catch (Ee) {
-        process.env.NODE_ENV === "development" && console.warn("[AuthProvider] Failed to load complete user data after login:", Ee);
+        await _();
+      } catch (xe) {
+        process.env.NODE_ENV === "development" && console.warn("[AuthProvider] Failed to load complete user data after login:", xe);
       }
     }
-    G.tenants && G.tenants.length > 0 && (b(G.tenants), Xe(G.tenants));
-    const Ge = ((He = G.user) == null ? void 0 : He.tenantId) !== null;
-    if (ke && Q)
-      return S(Q, { redirectPath: J }), G;
+    j.tenants && j.tenants.length > 0 && (b(j.tenants), nt(j.tenants));
+    const Je = ((Ke = j.user) == null ? void 0 : Ke.tenantId) !== null;
+    if (Ee && H)
+      return k(H, { redirectPath: J }), j;
     if (J && J !== window.location.pathname)
-      return S(Q || h || "", { redirectPath: J }), G;
-    if (!Ge && G.tenants && G.tenants.length > 0) {
-      const Ee = w.autoSwitch !== !1 && r.autoSwitchSingleTenant !== !1;
-      if (G.tenants.length === 1 && Ee) {
-        const Qe = G.tenants[0];
-        return S(Qe.subdomain, { redirectPath: J }), G;
-      } else G.tenants.length > 1 && r.onTenantSelectionRequired && r.onTenantSelectionRequired(G.tenants);
+      return k(H || p || "", { redirectPath: J }), j;
+    if (!Je && j.tenants && j.tenants.length > 0) {
+      const xe = v.autoSwitch !== !1 && r.autoSwitchSingleTenant !== !1;
+      if (j.tenants.length === 1 && xe) {
+        const Ze = j.tenants[0];
+        return k(Ze.subdomain, { redirectPath: J }), j;
+      } else j.tenants.length > 1 && r.onTenantSelectionRequired && r.onTenantSelectionRequired(j.tenants);
     }
-    return G;
-  }, _ = async (w) => {
-    const { email: M, phoneNumber: z, name: O, password: J, lastName: ee, tenantId: Q } = w;
-    if (!M && !z)
+    return j;
+  }, G = async (v) => {
+    const { email: $, phoneNumber: V, name: q, password: J, lastName: ee, tenantId: H } = v;
+    if (!$ && !V)
       throw new Error("Either email or phoneNumber is required");
-    if (!O || !J)
+    if (!q || !J)
       throw new Error("Name and password are required");
-    return v.signup({
-      email: M,
-      phoneNumber: z,
-      name: O,
+    return T.signup({
+      email: $,
+      phoneNumber: V,
+      name: q,
       password: J,
-      tenantId: Q ?? (l == null ? void 0 : l.id),
+      tenantId: H ?? (a == null ? void 0 : a.id),
       lastName: ee,
-      appId: a
+      appId: o
     });
-  }, W = async (w) => {
-    const { email: M, phoneNumber: z, name: O, password: J, tenantName: ee, lastName: Q } = w;
-    if (!M && !z)
+  }, Y = async (v) => {
+    const { email: $, phoneNumber: V, name: q, password: J, tenantName: ee, lastName: H } = v;
+    if (!$ && !V)
       throw new Error("Either email or phoneNumber is required");
-    if (!O || !J || !ee)
+    if (!q || !J || !ee)
       throw new Error("Name, password, and tenantName are required");
-    return v.signupTenantAdmin({
-      email: M,
-      phoneNumber: z,
-      name: O,
+    return T.signupTenantAdmin({
+      email: $,
+      phoneNumber: V,
+      name: q,
       password: J,
       tenantName: ee,
-      appId: a,
-      lastName: Q
+      appId: o,
+      lastName: H
     });
-  }, Y = async (w) => {
-    await v.changePassword(w);
-  }, X = async (w) => {
-    const { email: M, tenantId: z } = w, O = z ?? (l == null ? void 0 : l.id);
-    if (!O)
+  }, X = async (v) => {
+    await T.changePassword(v);
+  }, ae = async (v) => {
+    const { email: $, tenantId: V } = v, q = V ?? (a == null ? void 0 : a.id);
+    if (!q)
       throw new Error("tenantId is required for password reset");
-    await v.requestPasswordReset({ email: M, tenantId: O });
-  }, le = async (w) => {
-    await v.confirmPasswordReset(w);
-  }, Se = async (w) => {
-    const { email: M, frontendUrl: z, name: O, lastName: J, tenantId: ee } = w, Q = ee ?? (l == null ? void 0 : l.id);
-    if (!Q)
+    await T.requestPasswordReset({ email: $, tenantId: q });
+  }, ke = async (v) => {
+    await T.confirmPasswordReset(v);
+  }, He = async (v) => {
+    const { email: $, frontendUrl: V, name: q, lastName: J, tenantId: ee } = v, H = ee ?? (a == null ? void 0 : a.id);
+    if (!H)
       throw new Error("tenantId is required for magic link authentication");
-    return v.sendMagicLink({
-      email: M,
-      tenantId: Q,
-      frontendUrl: z,
-      name: O,
+    return T.sendMagicLink({
+      email: $,
+      tenantId: H,
+      frontendUrl: V,
+      name: q,
       lastName: J,
-      appId: a
+      appId: o
     });
-  }, We = async (w) => {
-    const { token: M, email: z, tenantSlug: O } = w;
-    let J = l == null ? void 0 : l.id, ee = h;
-    O && (J = (await new be(u, a).getPublicTenantInfo(O)).id, ee = O);
-    const Q = await v.verifyMagicLink({
-      token: M,
-      email: z,
-      appId: a,
+  }, Ne = async (v) => {
+    const { token: $, email: V, tenantSlug: q } = v;
+    let J = a == null ? void 0 : a.id, ee = p;
+    q && (J = (await new we(u, o).getPublicTenantInfo(q)).id, ee = q);
+    const H = await T.verifyMagicLink({
+      token: $,
+      email: V,
+      appId: o,
       tenantId: J
     });
-    if (B.current.has(M))
-      return Q;
-    B.current.add(M);
-    const G = O && O !== h;
-    if (o.setTokens({
-      accessToken: Q.accessToken,
-      refreshToken: Q.refreshToken,
-      expiresIn: Q.expiresIn
-    }), Q.user) {
-      o.setUser(Q.user), P(Q.user);
+    if (F.current.has($))
+      return H;
+    F.current.add($);
+    const j = q && q !== p;
+    if (w.setTokens({
+      accessToken: H.accessToken,
+      refreshToken: H.refreshToken,
+      expiresIn: H.expiresIn
+    }), H.user) {
+      w.setUser(H.user), I(H.user);
       try {
-        await L();
-      } catch (ke) {
-        process.env.NODE_ENV === "development" && console.warn("[AuthProvider] Failed to load complete user data after magic link:", ke);
+        await _();
+      } catch (Ee) {
+        process.env.NODE_ENV === "development" && console.warn("[AuthProvider] Failed to load complete user data after magic link:", Ee);
       }
     }
-    return G && ee && ee !== h && S(ee), Q;
-  }, Fe = async () => {
-    const w = o.getTokens();
-    if (!(w != null && w.refreshToken))
+    return j && ee && ee !== p && k(ee), H;
+  }, Ce = async () => {
+    const v = w.getTokens();
+    if (!(v != null && v.refreshToken))
       throw new Error("No refresh token available");
-    const M = await v.refreshToken({
-      refreshToken: w.refreshToken
+    const $ = await T.refreshToken({
+      refreshToken: v.refreshToken
     });
-    o.setTokens({
-      accessToken: M.accessToken,
-      refreshToken: M.refreshToken || w.refreshToken,
-      expiresIn: M.expiresIn
+    w.setTokens({
+      accessToken: $.accessToken,
+      refreshToken: $.refreshToken || v.refreshToken,
+      expiresIn: $.expiresIn
     });
-  }, Ne = () => {
-    o.clearSession(), P(null), m(null), b([]), et();
-  }, ht = (w) => {
-    o.setTokens(w);
-  }, pt = () => o.hasValidSession(), ft = () => {
-    o.clearSession(), P(null), m(null);
-  }, mt = async () => {
-    if (a)
+  }, mt = () => {
+    w.clearSession("logout"), I(null), m(null), b([]), De();
+  }, gt = (v) => {
+    w.setTokens(v);
+  }, yt = () => w.hasValidSession(), bt = () => {
+    w.clearSession(), I(null), m(null);
+  }, wt = async () => {
+    if (o)
       try {
         d(!0);
-        const { roles: w } = await se.getRolesByApp(a);
-        T(w);
-      } catch (w) {
-        process.env.NODE_ENV === "development" && console.error("[AuthProvider] Failed to fetch roles:", w);
+        const { roles: v } = await se.getRolesByApp(o);
+        S(v);
+      } catch (v) {
+        process.env.NODE_ENV === "development" && console.error("[AuthProvider] Failed to fetch roles:", v);
       } finally {
         d(!1);
       }
-  }, gt = async (w, M) => {
-    const { redirectPath: z } = M || {}, O = o.getTokens();
-    if (!(O != null && O.refreshToken))
+  }, vt = async (v, $) => {
+    const { redirectPath: V } = $ || {}, q = w.getTokens();
+    if (!(q != null && q.refreshToken))
       throw new Error("No refresh token available for tenant switch");
-    const J = await v.switchTenant({
-      refreshToken: O.refreshToken,
-      tenantId: w
+    const J = await T.switchTenant({
+      refreshToken: q.refreshToken,
+      tenantId: v
     });
-    o.setTokens({
+    w.setTokens({
       accessToken: J.accessToken,
-      refreshToken: O.refreshToken,
+      refreshToken: q.refreshToken,
       expiresIn: J.expiresIn
-    }), P(J.user), o.setUser(J.user);
-    const ee = g.find((Q) => Q.id === w);
-    ee && S(ee.subdomain, { redirectPath: z });
-  }, yt = async () => {
-    const w = await v.getUserTenants();
-    return b(w), Xe(w), w;
+    }), I(J.user), w.setUser(J.user);
+    const ee = g.find((H) => H.id === v);
+    ee && k(ee.subdomain, { redirectPath: V });
+  }, Tt = async () => {
+    const v = await T.getUserTenants();
+    return b(v), nt(v), v;
   };
-  $.current = {
-    login: q,
-    signup: _,
-    signupTenantAdmin: W,
-    sendMagicLink: Se,
-    verifyMagicLink: We,
-    changePassword: Y,
-    requestPasswordReset: X,
-    confirmPasswordReset: le,
-    refreshToken: Fe,
-    logout: Ne,
-    setTokens: ht,
-    hasValidSession: pt,
-    clearSession: ft,
-    loadUserData: L,
-    refreshUser: () => L(),
-    refreshRoles: mt,
-    switchToTenant: gt,
-    refreshUserTenants: yt
+  D.current = {
+    login: B,
+    signup: G,
+    signupTenantAdmin: Y,
+    sendMagicLink: He,
+    verifyMagicLink: Ne,
+    changePassword: X,
+    requestPasswordReset: ae,
+    confirmPasswordReset: ke,
+    refreshToken: Ce,
+    logout: mt,
+    setTokens: gt,
+    hasValidSession: yt,
+    clearSession: bt,
+    loadUserData: _,
+    refreshUser: () => _(),
+    refreshRoles: wt,
+    switchToTenant: vt,
+    refreshUserTenants: Tt
   };
-  const bt = V(
+  const St = O(
     () => ({
-      login: (w) => $.current.login(w),
-      signup: (w) => $.current.signup(w),
-      signupTenantAdmin: (w) => $.current.signupTenantAdmin(w),
-      sendMagicLink: (w) => $.current.sendMagicLink(w),
-      verifyMagicLink: (w) => $.current.verifyMagicLink(w),
-      changePassword: (w) => $.current.changePassword(w),
-      requestPasswordReset: (w) => $.current.requestPasswordReset(w),
-      confirmPasswordReset: (w) => $.current.confirmPasswordReset(w),
-      refreshToken: () => $.current.refreshToken(),
-      logout: () => $.current.logout(),
-      setTokens: (w) => $.current.setTokens(w),
-      hasValidSession: () => $.current.hasValidSession(),
-      clearSession: () => $.current.clearSession(),
-      loadUserData: (w) => $.current.loadUserData(w),
-      refreshUser: () => $.current.refreshUser(),
-      refreshRoles: () => $.current.refreshRoles(),
-      switchToTenant: (w, M) => $.current.switchToTenant(w, M),
-      refreshUserTenants: () => $.current.refreshUserTenants()
+      login: (v) => D.current.login(v),
+      signup: (v) => D.current.signup(v),
+      signupTenantAdmin: (v) => D.current.signupTenantAdmin(v),
+      sendMagicLink: (v) => D.current.sendMagicLink(v),
+      verifyMagicLink: (v) => D.current.verifyMagicLink(v),
+      changePassword: (v) => D.current.changePassword(v),
+      requestPasswordReset: (v) => D.current.requestPasswordReset(v),
+      confirmPasswordReset: (v) => D.current.confirmPasswordReset(v),
+      refreshToken: () => D.current.refreshToken(),
+      logout: () => D.current.logout(),
+      setTokens: (v) => D.current.setTokens(v),
+      hasValidSession: () => D.current.hasValidSession(),
+      clearSession: () => D.current.clearSession(),
+      loadUserData: (v) => D.current.loadUserData(v),
+      refreshUser: () => D.current.refreshUser(),
+      refreshRoles: () => D.current.refreshRoles(),
+      switchToTenant: (v, $) => D.current.switchToTenant(v, $),
+      refreshUserTenants: () => D.current.refreshUserTenants()
     }),
     []
-  ), wt = V(() => {
-    const w = (M) => !H || H.length === 0 ? !1 : typeof M == "string" ? H.includes(M) : H.includes(`${M.resource}.${M.action}`);
+  ), kt = O(() => {
+    const v = ($) => !W || W.length === 0 ? !1 : typeof $ == "string" ? W.includes($) : W.includes(`${$.resource}.${$.action}`);
     return {
-      isAuthenticated: j,
+      isAuthenticated: z,
       isAuthInitializing: !y,
       isAuthReady: y,
-      currentUser: A,
-      isUserLoading: I,
-      userError: E,
-      userRole: F,
-      userPermissions: H,
-      availableRoles: k,
+      sessionStatus: Z,
+      currentUser: x,
+      isUserLoading: L,
+      userError: R,
+      userRole: N,
+      userPermissions: W,
+      availableRoles: E,
       rolesLoading: c,
       userTenants: g,
       hasTenantContext: K,
-      sessionManager: o,
+      sessionManager: w,
       authenticatedHttpService: u,
-      hasPermission: w,
-      hasAnyPermission: (M) => M.some((z) => w(z)),
-      hasAllPermissions: (M) => M.every((z) => w(z)),
-      getUserPermissionStrings: () => H || []
+      hasPermission: v,
+      hasAnyPermission: ($) => $.some((V) => v(V)),
+      hasAllPermissions: ($) => $.every((V) => v(V)),
+      getUserPermissionStrings: () => W || []
     };
   }, [
-    j,
+    z,
     y,
-    A,
-    I,
+    Z,
+    x,
+    L,
+    R,
+    N,
+    W,
     E,
-    F,
-    H,
-    k,
     c,
     g,
     K,
-    o,
+    w,
     u
   ]);
-  return re(() => {
-    if (r.initialRoles || !a) return;
-    let w = !1;
-    return d(!0), se.getRolesByApp(a).then(({ roles: M }) => {
-      w || T(M);
-    }).catch((M) => {
-      process.env.NODE_ENV === "development" && console.error("[AuthProvider] Failed to fetch roles:", M);
+  re(() => {
+    if (r.initialRoles || !o) return;
+    let v = !1;
+    return d(!0), se.getRolesByApp(o).then(({ roles: $ }) => {
+      v || S($);
+    }).catch(($) => {
+      process.env.NODE_ENV === "development" && console.error("[AuthProvider] Failed to fetch roles:", $);
     }).finally(() => {
-      w || d(!1);
+      v || d(!1);
     }), () => {
-      w = !0;
+      v = !0;
     };
-  }, [a, r.initialRoles, se]), re(() => {
-    let w = !1;
+  }, [o, r.initialRoles, se]);
+  const Qe = be({ completed: !1 });
+  return re(() => {
+    let v = !1;
     return (async () => {
-      var O;
-      if (!o.hasValidSession() && ((O = o.getTokens()) != null && O.refreshToken) && await o.waitForPendingRefresh(), w || !o.hasValidSession() && !o.getTokens() && r.enableCookieSession && (await o.attemptCookieSessionRestore(), w))
-        return;
-      const z = o.getUser();
-      z && o.hasValidSession() && P(z), x(!1);
+      try {
+        if (Qe.current.completed || !w.getTokens() && r.enableCookieSession && (await w.attemptCookieSessionRestore(), v))
+          return;
+        const $ = await w.ensureValidSession();
+        if (v) return;
+        if ($ === "authenticated") {
+          const V = w.getUser();
+          V && I(V);
+          try {
+            await D.current.loadUserData(!V);
+          } catch {
+          }
+          if (v) return;
+        }
+      } finally {
+        v || (Qe.current.completed = !0, A(!0));
+      }
     })(), () => {
-      w = !0;
+      v = !0;
     };
-  }, [o, r.enableCookieSession]), re(() => {
-    !A && !I && !E && o.hasValidSession() ? $.current.loadUserData().catch(() => {
-    }).finally(() => {
-      x(!1);
-    }) : x(!1);
-  }, [A, I, E, o]), /* @__PURE__ */ s(Ie.Provider, { value: bt, children: /* @__PURE__ */ s(Pe.Provider, { value: wt, children: e }) });
+  }, [w, r.enableCookieSession]), re(() => {
+    h && !w.hasValidSession() && x !== null && (I(null), m(null), b([]), De());
+  }, [l, h, x, w]), /* @__PURE__ */ s(Le.Provider, { value: St, children: /* @__PURE__ */ s(Ie.Provider, { value: kt, children: e }) });
 }
-function Ir() {
-  const r = ne(Pe);
+function Dr() {
+  const r = ne(Ie);
   if (!r)
     throw new Error("useAuthState must be used within an AuthProvider");
   return r;
 }
-function Lr() {
-  const r = ne(Ie);
+function Mr() {
+  const r = ne(Le);
   if (!r)
     throw new Error("useAuthActions must be used within an AuthProvider");
   return r;
 }
-function de() {
-  const r = ne(Pe), e = ne(Ie);
+function ue() {
+  const r = ne(Ie), e = ne(Le);
   if (!r || !e)
     throw new Error("useAuth must be used within an AuthProvider");
-  return V(() => ({ ...r, ...e }), [r, e]);
+  return O(() => ({ ...r, ...e }), [r, e]);
 }
-function Oe() {
-  const r = ne(Pe), e = ne(Ie);
-  return V(() => !r || !e ? null : { ...r, ...e }, [r, e]);
+function qe() {
+  const r = ne(Ie), e = ne(Le);
+  return O(() => !r || !e ? null : { ...r, ...e }, [r, e]);
 }
-class Vt {
+class Wt {
   constructor(e) {
     this.httpService = e;
   }
@@ -1592,7 +1741,7 @@ class Vt {
   }
   async getFeatureFlags(e) {
     const t = await this.httpService.get(
-      `/feature-flags/${ce(e)}`
+      `/feature-flags/${le(e)}`
     );
     return { featureFlags: t.data, meta: t.meta };
   }
@@ -1611,7 +1760,7 @@ class Vt {
   async getTenantFeatureFlags(e, t) {
     if (!e || !t)
       throw new Error("Tenant ID and App ID are required");
-    const n = ce({ tenantId: e, appId: t });
+    const n = le({ tenantId: e, appId: t });
     return (await this.httpService.get(
       `/tenant-feature-flags${n}`,
       { headers: { "X-Tenant-ID": e }, skipAuth: !0 }
@@ -1620,73 +1769,73 @@ class Vt {
   async getTenantFeatureFlag(e, t, n) {
     if (!e || !t || !n)
       throw new Error("Flag Key, Tenant ID and App ID are required");
-    const i = ce({ tenantId: t, appId: n });
+    const i = le({ tenantId: t, appId: n });
     return (await this.httpService.get(
       `/tenant-feature-flags/${e}${i}`,
       { headers: { "X-Tenant-ID": t }, skipAuth: !0 }
     )).data;
   }
 }
-const Ve = fe(null);
-function Fr({ config: r = {}, children: e }) {
-  const t = Ue(), n = pe(), i = (t == null ? void 0 : t.baseUrl) ?? "", a = (t == null ? void 0 : t.appId) ?? "", l = (n == null ? void 0 : n.tenant) ?? null, [h, S] = N([]), [k, T] = N(!1), [c, d] = N(null), [A, P] = N(!1), I = V(() => {
+const ze = fe(null);
+function $r({ config: r = {}, children: e }) {
+  const t = _e(), n = pe(), i = (t == null ? void 0 : t.baseUrl) ?? "", o = (t == null ? void 0 : t.appId) ?? "", a = (n == null ? void 0 : n.tenant) ?? null, [p, k] = C([]), [E, S] = C(!1), [c, d] = C(null), [x, I] = C(!1), L = O(() => {
     const m = new he(i);
-    return new Vt(m);
-  }, [i]), R = async () => {
-    if (!(l != null && l.id)) {
-      S([]);
+    return new Wt(m);
+  }, [i]), P = async () => {
+    if (!(a != null && a.id)) {
+      k([]);
       return;
     }
-    T(!0), d(null);
+    S(!0), d(null);
     try {
-      const m = await I.getTenantFeatureFlags(l.id, a);
-      S(m);
+      const m = await L.getTenantFeatureFlags(a.id, o);
+      k(m);
     } catch (m) {
       const g = m instanceof Error ? m.message : "Failed to fetch feature flags";
       d(g), r.onError && r.onError(m instanceof Error ? m : new Error(g));
     } finally {
-      T(!1);
+      S(!1);
     }
   };
   re(() => {
-    if (!i || !a) return;
-    R().finally(() => P(!0));
-    const m = r.refreshInterval || 5 * 60 * 1e3, g = setInterval(R, m);
+    if (!i || !o) return;
+    P().finally(() => I(!0));
+    const m = r.refreshInterval || 300 * 1e3, g = setInterval(P, m);
     return () => clearInterval(g);
-  }, [l == null ? void 0 : l.id, i, a, r.refreshInterval]);
-  const E = V(() => {
-    const m = (p) => {
-      const x = h.find((y) => y.key === p);
-      return (x == null ? void 0 : x.value) === !0;
-    }, g = (p) => h.find((x) => x.key === p), b = (p) => {
-      const x = h.find((y) => y.key === p);
-      return x ? x.value ? "enabled" : "disabled" : "not_found";
-    }, C = async () => {
-      await R();
-    }, o = !!(i && a) && (A || !(l != null && l.id));
+  }, [a == null ? void 0 : a.id, i, o, r.refreshInterval]);
+  const R = O(() => {
+    const m = (h) => {
+      const A = p.find((y) => y.key === h);
+      return (A == null ? void 0 : A.value) === !0;
+    }, g = (h) => p.find((A) => A.key === h), b = (h) => {
+      const A = p.find((y) => y.key === h);
+      return A ? A.value ? "enabled" : "disabled" : "not_found";
+    }, w = async () => {
+      await P();
+    }, l = !!(i && o) && (x || !(a != null && a.id));
     return {
-      featureFlags: h,
-      loading: k,
+      featureFlags: p,
+      loading: E,
       error: c,
-      isReady: o,
+      isReady: l,
       isEnabled: m,
       getFlag: g,
       getFlagState: b,
-      refresh: C
+      refresh: w
     };
-  }, [h, k, c, i, a, l == null ? void 0 : l.id, A]);
-  return /* @__PURE__ */ s(Ve.Provider, { value: E, children: e });
+  }, [p, E, c, i, o, a == null ? void 0 : a.id, x]);
+  return /* @__PURE__ */ s(ze.Provider, { value: R, children: e });
 }
-function qt() {
-  const r = ne(Ve);
+function Ht() {
+  const r = ne(ze);
   if (!r)
     throw new Error("useFeatureFlags must be used within a FeatureFlagProvider");
   return r;
 }
-function at() {
-  return ne(Ve);
+function ut() {
+  return ne(ze);
 }
-class zt {
+class Qt {
   constructor(e) {
     this.httpService = e;
   }
@@ -1726,68 +1875,68 @@ class zt {
     )).data;
   }
 }
-const qe = fe(void 0);
-function Nr({ config: r = {}, children: e }) {
-  const t = Ue(), n = pe(), i = (t == null ? void 0 : t.baseUrl) ?? "", a = (n == null ? void 0 : n.tenant) ?? null, [l, h] = N(null), [S, k] = N(!1), [T, c] = N(null), [d, A] = N(!1), P = V(() => {
-    const E = new he(i);
-    return new zt(E);
-  }, [i]), I = async () => {
-    if (!(a != null && a.id)) {
-      h(null);
+const Ge = fe(void 0);
+function Ur({ config: r = {}, children: e }) {
+  const t = _e(), n = pe(), i = (t == null ? void 0 : t.baseUrl) ?? "", o = (n == null ? void 0 : n.tenant) ?? null, [a, p] = C(null), [k, E] = C(!1), [S, c] = C(null), [d, x] = C(!1), I = O(() => {
+    const R = new he(i);
+    return new Qt(R);
+  }, [i]), L = async () => {
+    if (!(o != null && o.id)) {
+      p(null);
       return;
     }
-    k(!0), c(null);
+    E(!0), c(null);
     try {
-      const E = await P.getTenantSubscriptionFeatures(a.id);
-      h(E);
-    } catch (E) {
-      const m = E instanceof Error ? E.message : "Failed to fetch subscription";
-      c(m), r.onError && r.onError(E instanceof Error ? E : new Error(m));
+      const R = await I.getTenantSubscriptionFeatures(o.id);
+      p(R);
+    } catch (R) {
+      const m = R instanceof Error ? R.message : "Failed to fetch subscription";
+      c(m), r.onError && r.onError(R instanceof Error ? R : new Error(m));
     } finally {
-      k(!1);
+      E(!1);
     }
   };
   re(() => {
-    if (!i || (I().finally(() => A(!0)), !r.refreshInterval)) return;
-    const E = r.refreshInterval || 10 * 60 * 1e3, m = setInterval(I, E);
+    if (!i || (L().finally(() => x(!0)), !r.refreshInterval)) return;
+    const R = r.refreshInterval || 600 * 1e3, m = setInterval(L, R);
     return () => clearInterval(m);
-  }, [a == null ? void 0 : a.id, i, r.refreshInterval]);
-  const R = V(() => {
-    const E = (l == null ? void 0 : l.features) || [], m = (x) => {
-      const y = E.find((u) => u.key === x);
+  }, [o == null ? void 0 : o.id, i, r.refreshInterval]);
+  const P = O(() => {
+    const R = (a == null ? void 0 : a.features) || [], m = (A) => {
+      const y = R.find((u) => u.key === A);
       return y ? y.type === "BOOLEAN" || y.type === "boolean" ? y.value === !0 : !!y.value : !1;
-    }, g = (x) => E.find((y) => y.key === x), b = (x, y) => {
-      const u = E.find((v) => v.key === x);
+    }, g = (A) => R.find((y) => y.key === A), b = (A, y) => {
+      const u = R.find((T) => T.key === A);
       return u ? u.value : y;
-    }, C = (x) => !l || !l.isActive ? !1 : x.includes(l.planId), o = async () => {
-      await I();
-    }, p = !!i && (d || !(a != null && a.id));
+    }, w = (A) => !a || !a.isActive ? !1 : A.includes(a.planId), l = async () => {
+      await L();
+    }, h = !!i && (d || !(o != null && o.id));
     return {
-      subscription: l,
-      features: E,
-      loading: S,
-      error: T,
-      isReady: p,
+      subscription: a,
+      features: R,
+      loading: k,
+      error: S,
+      isReady: h,
       isFeatureEnabled: m,
       getFeature: g,
       getFeatureValue: b,
-      hasAllowedPlan: C,
-      refresh: o
+      hasAllowedPlan: w,
+      refresh: l
     };
-  }, [l, S, T, i, a == null ? void 0 : a.id, d]);
-  return /* @__PURE__ */ s(qe.Provider, { value: R, children: e });
+  }, [a, k, S, i, o == null ? void 0 : o.id, d]);
+  return /* @__PURE__ */ s(Ge.Provider, { value: P, children: e });
 }
-function jt() {
-  const r = ne(qe);
+function Jt() {
+  const r = ne(Ge);
   if (r === void 0)
     throw new Error("useSubscription must be used within a SubscriptionProvider");
   return r;
 }
-function lt() {
-  return ne(qe) ?? null;
+function dt() {
+  return ne(Ge) ?? null;
 }
-var ae = /* @__PURE__ */ ((r) => (r.SUPERUSER = "SUPERUSER", r.TENANT_ADMIN = "TENANT_ADMIN", r.USER = "USER", r))(ae || {});
-const ze = {
+var oe = /* @__PURE__ */ ((r) => (r.SUPERUSER = "SUPERUSER", r.TENANT_ADMIN = "TENANT_ADMIN", r.USER = "USER", r))(oe || {});
+const je = {
   publicGuest: "/",
   publicUser: "/account",
   publicAdmin: "/admin",
@@ -1795,7 +1944,7 @@ const ze = {
   tenantUser: "/dashboard",
   tenantAdmin: "/admin/dashboard",
   default: "/"
-}, ct = {
+}, ht = {
   // Public/Landing zones
   landing: { tenant: "forbidden", auth: "optional" },
   publicOnly: { tenant: "forbidden", auth: "forbidden" },
@@ -1808,26 +1957,26 @@ const ze = {
   tenantOpen: { tenant: "required", auth: "optional" },
   tenantAuth: { tenant: "required", auth: "required" },
   // User type zones
-  user: { tenant: "required", auth: "required", userType: ae.USER },
-  admin: { tenant: "required", auth: "required", userType: ae.TENANT_ADMIN },
+  user: { tenant: "required", auth: "required", userType: oe.USER },
+  admin: { tenant: "required", auth: "required", userType: oe.TENANT_ADMIN },
   // Fully open
   open: { tenant: "optional", auth: "optional" }
-}, je = fe(null), Wt = {
-  zoneRoots: ze,
-  presets: ct,
+}, We = fe(null), Kt = {
+  zoneRoots: je,
+  presets: ht,
   loadingFallback: null,
   accessDeniedFallback: null,
   onAccessDenied: void 0,
   returnToParam: "returnTo",
   returnToStorage: "url"
 };
-function Cr({ config: r = {}, children: e }) {
-  const t = V(() => {
+function Br({ config: r = {}, children: e }) {
+  const t = O(() => {
     const n = {
-      ...ze,
+      ...je,
       ...r.zoneRoots
     }, i = {
-      ...ct,
+      ...ht,
       ...r.presets
     };
     return {
@@ -1840,18 +1989,18 @@ function Cr({ config: r = {}, children: e }) {
       returnToStorage: r.returnToStorage ?? "url"
     };
   }, [r]);
-  return /* @__PURE__ */ s(je.Provider, { value: t, children: e });
+  return /* @__PURE__ */ s(We.Provider, { value: t, children: e });
 }
-function Dr() {
-  const r = ne(je);
+function _r() {
+  const r = ne(We);
   if (!r)
     throw new Error("useRouting must be used within a RoutingProvider");
   return r;
 }
-function Gt() {
-  return ne(je) ?? Wt;
+function Zt() {
+  return ne(We) ?? Kt;
 }
-const tt = () => /* @__PURE__ */ f(
+const st = () => /* @__PURE__ */ f(
   "div",
   {
     style: {
@@ -1888,7 +2037,7 @@ const tt = () => /* @__PURE__ */ f(
       )
     ]
   }
-), rt = ({
+), it = ({
   userType: r,
   minUserType: e,
   missingPermissions: t
@@ -1929,36 +2078,36 @@ const tt = () => /* @__PURE__ */ f(
       ] })
     ]
   }
-), Ht = (r, e) => {
+), Yt = (r, e) => {
   const t = {
-    [ae.USER]: 1,
-    [ae.TENANT_ADMIN]: 2,
-    [ae.SUPERUSER]: 3
+    [oe.USER]: 1,
+    [oe.TENANT_ADMIN]: 2,
+    [oe.SUPERUSER]: 3
   };
   return t[r] >= t[e];
 };
-function Mr({
+function Or({
   children: r,
   fallback: e,
   minUserType: t,
   requiredPermissions: n,
   requireAllPermissions: i = !1
 }) {
-  const { hasValidSession: a, sessionManager: l, hasPermission: h, hasAnyPermission: S, hasAllPermissions: k } = de();
-  if (!a())
-    return /* @__PURE__ */ s(U, { children: e || /* @__PURE__ */ s(tt, {}) });
-  const T = l.getUser();
-  if (!T)
-    return /* @__PURE__ */ s(U, { children: e || /* @__PURE__ */ s(tt, {}) });
-  if (t && !Ht(T.userType, t))
-    return /* @__PURE__ */ s(rt, { userType: T.userType, minUserType: t });
-  if (n && n.length > 0 && !(i ? k(n) : S(n))) {
-    const d = n.filter((A) => !h(A)).map((A) => typeof A == "string" ? A : A.name);
-    return /* @__PURE__ */ s(rt, { missingPermissions: d });
+  const { hasValidSession: o, sessionManager: a, hasPermission: p, hasAnyPermission: k, hasAllPermissions: E } = ue();
+  if (!o())
+    return /* @__PURE__ */ s(U, { children: e || /* @__PURE__ */ s(st, {}) });
+  const S = a.getUser();
+  if (!S)
+    return /* @__PURE__ */ s(U, { children: e || /* @__PURE__ */ s(st, {}) });
+  if (t && !Yt(S.userType, t))
+    return /* @__PURE__ */ s(it, { userType: S.userType, minUserType: t });
+  if (n && n.length > 0 && !(i ? E(n) : k(n))) {
+    const d = n.filter((x) => !p(x)).map((x) => typeof x == "string" ? x : x.name);
+    return /* @__PURE__ */ s(it, { missingPermissions: d });
   }
   return /* @__PURE__ */ s(U, { children: r });
 }
-const Qt = ({ redirectPath: r }) => /* @__PURE__ */ s(
+const Xt = ({ redirectPath: r }) => /* @__PURE__ */ s(
   "div",
   {
     style: {
@@ -1994,7 +2143,7 @@ const Qt = ({ redirectPath: r }) => /* @__PURE__ */ s(
       }
     )
   }
-), nt = ({
+), ot = ({
   userType: r,
   requiredUserType: e,
   missingPermissions: t
@@ -2045,43 +2194,43 @@ const Qt = ({ redirectPath: r }) => /* @__PURE__ */ s(
       }
     )
   }
-), Jt = (r, e) => r === e;
-function $r({
+), er = (r, e) => r === e;
+function Vr({
   children: r,
   redirectTo: e = "/login",
   requiredUserType: t,
   requiredPermissions: n,
   requireAllPermissions: i = !1,
-  fallback: a
+  fallback: o
 }) {
-  const { hasValidSession: l, sessionManager: h, hasPermission: S, hasAnyPermission: k, hasAllPermissions: T } = de(), c = xe();
+  const { hasValidSession: a, sessionManager: p, hasPermission: k, hasAnyPermission: E, hasAllPermissions: S } = ue(), c = Re();
   if (re(() => {
     process.env.NODE_ENV === "development" && console.warn(
       "[react-identity-access] ProtectedRoute is deprecated. Use AuthenticatedZone or AdminZone from ZoneRoute instead."
     );
-  }, []), !l())
-    return a ? /* @__PURE__ */ s(U, { children: a }) : /* @__PURE__ */ f(U, { children: [
-      /* @__PURE__ */ s(Qt, { redirectPath: e }),
-      /* @__PURE__ */ s(we, { to: e, state: { from: c.pathname }, replace: !0 })
+  }, []), !a())
+    return o ? /* @__PURE__ */ s(U, { children: o }) : /* @__PURE__ */ f(U, { children: [
+      /* @__PURE__ */ s(Xt, { redirectPath: e }),
+      /* @__PURE__ */ s(ve, { to: e, state: { from: c.pathname }, replace: !0 })
     ] });
-  const d = h.getUser();
+  const d = p.getUser();
   if (!d)
-    return /* @__PURE__ */ s(we, { to: e, state: { from: c.pathname }, replace: !0 });
-  if (t && !Jt(d.userType, t))
+    return /* @__PURE__ */ s(ve, { to: e, state: { from: c.pathname }, replace: !0 });
+  if (t && !er(d.userType, t))
     return /* @__PURE__ */ s(
-      nt,
+      ot,
       {
         userType: d.userType,
         requiredUserType: t
       }
     );
-  if (n && n.length > 0 && !(i ? T(n) : k(n))) {
-    const P = n.filter((I) => !S(I)).map((I) => typeof I == "string" ? I : I.name);
-    return /* @__PURE__ */ s(nt, { missingPermissions: P });
+  if (n && n.length > 0 && !(i ? S(n) : E(n))) {
+    const I = n.filter((L) => !k(L)).map((L) => typeof L == "string" ? L : L.name);
+    return /* @__PURE__ */ s(ot, { missingPermissions: I });
   }
   return /* @__PURE__ */ s(U, { children: r });
 }
-const Zt = ({ redirectPath: r }) => /* @__PURE__ */ s(
+const tr = ({ redirectPath: r }) => /* @__PURE__ */ s(
   "div",
   {
     style: {
@@ -2118,18 +2267,18 @@ const Zt = ({ redirectPath: r }) => /* @__PURE__ */ s(
     )
   }
 );
-function Ur({ children: r, redirectTo: e = "/", fallback: t }) {
-  const { tenant: n, isLoading: i, error: a } = ot(), l = xe();
+function qr({ children: r, redirectTo: e = "/", fallback: t }) {
+  const { tenant: n, isLoading: i, error: o } = ct(), a = Re();
   return re(() => {
     process.env.NODE_ENV === "development" && console.warn(
       "[react-identity-access] TenantRoute is deprecated. Use TenantZone from ZoneRoute instead."
     );
-  }, []), i || a ? null : n ? /* @__PURE__ */ s(U, { children: r }) : t ? /* @__PURE__ */ s(U, { children: t }) : /* @__PURE__ */ f(U, { children: [
-    /* @__PURE__ */ s(Zt, { redirectPath: e }),
-    /* @__PURE__ */ s(we, { to: e, state: { from: l.pathname }, replace: !0 })
+  }, []), i || o ? null : n ? /* @__PURE__ */ s(U, { children: r }) : t ? /* @__PURE__ */ s(U, { children: t }) : /* @__PURE__ */ f(U, { children: [
+    /* @__PURE__ */ s(tr, { redirectPath: e }),
+    /* @__PURE__ */ s(ve, { to: e, state: { from: a.pathname }, replace: !0 })
   ] });
 }
-const Kt = ({ redirectPath: r }) => /* @__PURE__ */ s(
+const rr = ({ redirectPath: r }) => /* @__PURE__ */ s(
   "div",
   {
     style: {
@@ -2166,125 +2315,125 @@ const Kt = ({ redirectPath: r }) => /* @__PURE__ */ s(
     )
   }
 );
-function Br({ children: r, redirectTo: e = "/dashboard", fallback: t }) {
-  const { tenant: n, isLoading: i, error: a } = ot(), l = xe();
+function zr({ children: r, redirectTo: e = "/dashboard", fallback: t }) {
+  const { tenant: n, isLoading: i, error: o } = ct(), a = Re();
   return re(() => {
     process.env.NODE_ENV === "development" && console.warn(
       "[react-identity-access] LandingRoute is deprecated. Use PublicZone from ZoneRoute instead."
     );
-  }, []), i || a ? null : n ? t ? /* @__PURE__ */ s(U, { children: t }) : /* @__PURE__ */ f(U, { children: [
-    /* @__PURE__ */ s(Kt, { redirectPath: e }),
-    /* @__PURE__ */ s(we, { to: e, state: { from: l.pathname }, replace: !0 })
+  }, []), i || o ? null : n ? t ? /* @__PURE__ */ s(U, { children: t }) : /* @__PURE__ */ f(U, { children: [
+    /* @__PURE__ */ s(rr, { redirectPath: e }),
+    /* @__PURE__ */ s(ve, { to: e, state: { from: a.pathname }, replace: !0 })
   ] }) : /* @__PURE__ */ s(U, { children: r });
 }
-function Yt(r, e) {
+function nr(r, e) {
   return e ? r ? Array.isArray(e) ? e.includes(r) : r === e : !1 : !0;
 }
-function st(r, e) {
+function at(r, e) {
   return !r || r === "optional" ? "skip" : r === "required" ? e ? "pass" : "fail" : r === "forbidden" ? e ? "fail" : "pass" : "skip";
 }
-function Xt(r, e) {
-  return st(r.tenant, e.hasTenant) === "fail" ? e.hasTenant ? "has_tenant" : "no_tenant" : st(r.auth, e.isAuthenticated) === "fail" ? e.isAuthenticated ? "already_authenticated" : "not_authenticated" : r.userType && e.isAuthenticated && !Yt(e.userType, r.userType) ? "wrong_user_type" : r.permissions && r.permissions.length > 0 && !(r.requireAllPermissions !== !1 ? (a) => a.every((l) => e.permissions.includes(l)) : (a) => a.some((l) => e.permissions.includes(l)))(r.permissions) ? "missing_permissions" : null;
+function sr(r, e) {
+  return at(r.tenant, e.hasTenant) === "fail" ? e.hasTenant ? "has_tenant" : "no_tenant" : at(r.auth, e.isAuthenticated) === "fail" ? e.isAuthenticated ? "already_authenticated" : "not_authenticated" : r.userType && e.isAuthenticated && !nr(e.userType, r.userType) ? "wrong_user_type" : r.permissions && r.permissions.length > 0 && !(r.requireAllPermissions !== !1 ? (o) => o.every((a) => e.permissions.includes(a)) : (o) => o.some((a) => e.permissions.includes(a)))(r.permissions) ? "missing_permissions" : null;
 }
-function er(r, e) {
-  return r.hasTenant ? r.isAuthenticated ? r.userType === ae.TENANT_ADMIN ? e.tenantAdmin : e.tenantUser : e.tenantGuest : r.isAuthenticated ? r.userType === ae.TENANT_ADMIN ? e.publicAdmin : e.publicUser : e.publicGuest;
+function ir(r, e) {
+  return r.hasTenant ? r.isAuthenticated ? r.userType === oe.TENANT_ADMIN ? e.tenantAdmin : e.tenantUser : e.tenantGuest : r.isAuthenticated ? r.userType === oe.TENANT_ADMIN ? e.publicAdmin : e.publicUser : e.publicGuest;
 }
-function tr(r, e, t, n, i) {
+function or(r, e, t, n, i) {
   if (!e || i !== "url")
     return r;
-  const a = typeof e == "string" ? e : t, l = r.includes("?") ? "&" : "?";
-  return `${r}${l}${n}=${encodeURIComponent(a)}`;
+  const o = typeof e == "string" ? e : t, a = r.includes("?") ? "&" : "?";
+  return `${r}${a}${n}=${encodeURIComponent(o)}`;
 }
-function rr(r, e, t) {
+function ar(r, e, t) {
   if (!r || t === "url") return;
   const n = typeof r == "string" ? r : e, i = "zone_return_to";
   t === "session" ? sessionStorage.setItem(i, n) : t === "local" && localStorage.setItem(i, n);
 }
-const ue = ({
+const ce = ({
   children: r,
   preset: e,
   tenant: t,
   auth: n,
   userType: i,
-  requiredPermissions: a,
-  requireAllPermissions: l = !0,
-  returnTo: h,
-  onAccessDenied: S,
-  redirectTo: k,
-  loadingFallback: T,
+  requiredPermissions: o,
+  requireAllPermissions: a = !0,
+  returnTo: p,
+  onAccessDenied: k,
+  redirectTo: E,
+  loadingFallback: S,
   accessDeniedFallback: c
 }) => {
-  const d = xe(), { isAuthenticated: A, isAuthInitializing: P, currentUser: I, userPermissions: R } = de(), { tenant: E, isTenantLoading: m } = Te(), g = Gt(), b = V(() => {
+  const d = Re(), { isAuthenticated: x, isAuthInitializing: I, currentUser: L, userPermissions: P } = ue(), { tenant: R, isTenantLoading: m } = Se(), g = Zt(), b = O(() => {
     if (e)
       return g.presets[e];
-  }, [e, g.presets]), C = V(
+  }, [e, g.presets]), w = O(
     () => ({
       tenant: t ?? (b == null ? void 0 : b.tenant),
       auth: n ?? (b == null ? void 0 : b.auth),
       userType: i ?? (b == null ? void 0 : b.userType),
-      permissions: a ?? (b == null ? void 0 : b.requiredPermissions),
-      requireAllPermissions: l
+      permissions: o ?? (b == null ? void 0 : b.requiredPermissions),
+      requireAllPermissions: a
     }),
-    [t, n, i, a, b, l]
-  ), o = V(
+    [t, n, i, o, b, a]
+  ), l = O(
     () => ({
-      hasTenant: !!E,
-      isAuthenticated: A,
-      userType: I == null ? void 0 : I.userType,
-      permissions: R,
-      isLoading: P || m
+      hasTenant: !!R,
+      isAuthenticated: x,
+      userType: L == null ? void 0 : L.userType,
+      permissions: P,
+      isLoading: I || m
     }),
     [
-      E,
-      A,
-      I == null ? void 0 : I.userType,
       R,
+      x,
+      L == null ? void 0 : L.userType,
       P,
+      I,
       m
     ]
-  ), p = V(() => o.isLoading ? null : Xt(C, o), [C, o]), x = V(() => p ? k || er(o, g.zoneRoots) : null, [p, k, o, g.zoneRoots]), y = V(() => !p || !x ? null : {
-    type: p,
+  ), h = O(() => l.isLoading ? null : sr(w, l), [w, l]), A = O(() => h ? E || ir(l, g.zoneRoots) : null, [h, E, l, g.zoneRoots]), y = O(() => !h || !A ? null : {
+    type: h,
     required: {
-      tenant: C.tenant,
-      auth: C.auth,
-      userType: C.userType,
-      permissions: C.permissions
+      tenant: w.tenant,
+      auth: w.auth,
+      userType: w.userType,
+      permissions: w.permissions
     },
     current: {
-      hasTenant: o.hasTenant,
-      isAuthenticated: o.isAuthenticated,
-      userType: o.userType,
-      permissions: o.permissions
+      hasTenant: l.hasTenant,
+      isAuthenticated: l.isAuthenticated,
+      userType: l.userType,
+      permissions: l.permissions
     },
-    redirectTo: x
-  }, [p, x, C, o]);
+    redirectTo: A
+  }, [h, A, w, l]);
   if (re(() => {
-    y && (S ? S(y) : g.onAccessDenied && g.onAccessDenied(y));
-  }, [y, S, g]), re(() => {
-    y && h && rr(h, d.pathname + d.search, g.returnToStorage);
+    y && (k ? k(y) : g.onAccessDenied && g.onAccessDenied(y));
+  }, [y, k, g]), re(() => {
+    y && p && ar(p, d.pathname + d.search, g.returnToStorage);
   }, [
     y,
-    h,
+    p,
     d.pathname,
     d.search,
     g.returnToStorage
-  ]), o.isLoading)
-    return /* @__PURE__ */ s(U, { children: T ?? g.loadingFallback ?? null });
-  if (y && x) {
+  ]), l.isLoading)
+    return /* @__PURE__ */ s(U, { children: S ?? g.loadingFallback ?? null });
+  if (y && A) {
     const u = c ?? g.accessDeniedFallback;
     if (u)
       return /* @__PURE__ */ s(U, { children: u });
-    const v = tr(
-      x,
-      h,
+    const T = or(
+      A,
+      p,
       d.pathname + d.search,
       g.returnToParam,
       g.returnToStorage
     );
-    return /* @__PURE__ */ s(we, { to: v, replace: !0 });
+    return /* @__PURE__ */ s(ve, { to: T, replace: !0 });
   }
   return /* @__PURE__ */ s(U, { children: r });
-}, _r = (r) => /* @__PURE__ */ s(ue, { tenant: "required", ...r }), Or = (r) => /* @__PURE__ */ s(ue, { tenant: "forbidden", ...r }), Vr = (r) => /* @__PURE__ */ s(ue, { auth: "required", ...r }), qr = (r) => /* @__PURE__ */ s(ue, { auth: "forbidden", ...r }), zr = (r) => /* @__PURE__ */ s(ue, { auth: "required", userType: ae.TENANT_ADMIN, ...r }), jr = (r) => /* @__PURE__ */ s(ue, { auth: "required", userType: ae.USER, ...r }), Wr = (r) => /* @__PURE__ */ s(ue, { tenant: "optional", auth: "optional", ...r }), Gr = (r) => /* @__PURE__ */ s(ue, { tenant: "required", auth: "required", ...r }), Hr = (r) => /* @__PURE__ */ s(ue, { tenant: "required", auth: "optional", ...r }), Qr = (r) => /* @__PURE__ */ s(ue, { tenant: "required", auth: "forbidden", ...r }), nr = () => /* @__PURE__ */ f(
+}, Gr = (r) => /* @__PURE__ */ s(ce, { tenant: "required", ...r }), jr = (r) => /* @__PURE__ */ s(ce, { tenant: "forbidden", ...r }), Wr = (r) => /* @__PURE__ */ s(ce, { auth: "required", ...r }), Hr = (r) => /* @__PURE__ */ s(ce, { auth: "forbidden", ...r }), Qr = (r) => /* @__PURE__ */ s(ce, { auth: "required", userType: oe.TENANT_ADMIN, ...r }), Jr = (r) => /* @__PURE__ */ s(ce, { auth: "required", userType: oe.USER, ...r }), Kr = (r) => /* @__PURE__ */ s(ce, { tenant: "optional", auth: "optional", ...r }), Zr = (r) => /* @__PURE__ */ s(ce, { tenant: "required", auth: "required", ...r }), Yr = (r) => /* @__PURE__ */ s(ce, { tenant: "required", auth: "optional", ...r }), Xr = (r) => /* @__PURE__ */ s(ce, { tenant: "required", auth: "forbidden", ...r }), lr = () => /* @__PURE__ */ f(
   "div",
   {
     style: {
@@ -2301,14 +2450,14 @@ const ue = ({
     ]
   }
 );
-function Jr({
+function en({
   children: r,
-  fallback: e = /* @__PURE__ */ s(nr, {}),
+  fallback: e = /* @__PURE__ */ s(lr, {}),
   allowedPlans: t,
   requiredFeature: n
 }) {
-  const { subscription: i, hasAllowedPlan: a, isFeatureEnabled: l, loading: h } = jt();
-  return h ? /* @__PURE__ */ s(
+  const { subscription: i, hasAllowedPlan: o, isFeatureEnabled: a, loading: p } = Jt();
+  return p ? /* @__PURE__ */ s(
     "div",
     {
       style: {
@@ -2318,9 +2467,9 @@ function Jr({
       },
       children: "Loading subscription..."
     }
-  ) : i ? i.isActive ? t && t.length > 0 && !a(t) ? /* @__PURE__ */ s(U, { children: e }) : n && !l(n) ? /* @__PURE__ */ s(U, { children: e }) : /* @__PURE__ */ s(U, { children: r }) : /* @__PURE__ */ s(U, { children: e }) : /* @__PURE__ */ s(U, { children: e });
+  ) : i ? i.isActive ? t && t.length > 0 && !o(t) ? /* @__PURE__ */ s(U, { children: e }) : n && !a(n) ? /* @__PURE__ */ s(U, { children: e }) : /* @__PURE__ */ s(U, { children: r }) : /* @__PURE__ */ s(U, { children: e }) : /* @__PURE__ */ s(U, { children: e });
 }
-const sr = ({ flagName: r }) => /* @__PURE__ */ f(
+const cr = ({ flagName: r }) => /* @__PURE__ */ f(
   "div",
   {
     style: {
@@ -2347,8 +2496,8 @@ const sr = ({ flagName: r }) => /* @__PURE__ */ f(
     ]
   }
 );
-function Zr({ name: r, children: e, fallback: t }) {
-  const { isEnabled: n, loading: i } = qt();
+function tn({ name: r, children: e, fallback: t }) {
+  const { isEnabled: n, loading: i } = Ht();
   return i ? /* @__PURE__ */ s(
     "div",
     {
@@ -2362,49 +2511,49 @@ function Zr({ name: r, children: e, fallback: t }) {
       },
       children: "Loading feature flags..."
     }
-  ) : n(r) ? /* @__PURE__ */ s(U, { children: e }) : /* @__PURE__ */ s(U, { children: t || /* @__PURE__ */ s(sr, { flagName: r }) });
-}
-function ve(r) {
-  const { submit: e, defaultErrorMessage: t, validate: n, onSuccess: i, onError: a } = r, [l, h] = N(!1), [S, k] = N(""), [T, c] = N({}), d = te((R, E) => {
-    c((m) => ({ ...m, [R]: E }));
-  }, []), A = te((R) => {
-    c((E) => {
-      if (!E[R]) return E;
-      const m = { ...E };
-      return delete m[R], m;
+  ) : n(r) ? /* @__PURE__ */ s(U, { children: e }) : /* @__PURE__ */ s(U, { children: t || /* @__PURE__ */ s(cr, { flagName: r }) });
+}
+function Te(r) {
+  const { submit: e, defaultErrorMessage: t, validate: n, onSuccess: i, onError: o } = r, [a, p] = C(!1), [k, E] = C(""), [S, c] = C({}), d = te((P, R) => {
+    c((m) => ({ ...m, [P]: R }));
+  }, []), x = te((P) => {
+    c((R) => {
+      if (!R[P]) return R;
+      const m = { ...R };
+      return delete m[P], m;
     });
-  }, []), P = te(() => {
-    k(""), c({});
-  }, []), I = te(
-    async (R) => {
-      if (R && R.preventDefault(), !(n && !n())) {
-        h(!0), k("");
+  }, []), I = te(() => {
+    E(""), c({});
+  }, []), L = te(
+    async (P) => {
+      if (P && P.preventDefault(), !(n && !n())) {
+        p(!0), E("");
         try {
-          const E = await e();
-          return i == null || i(E), E;
-        } catch (E) {
-          const m = E instanceof Error ? E.message : t;
-          k(m), a == null || a(m);
+          const R = await e();
+          return i == null || i(R), R;
+        } catch (R) {
+          const m = R instanceof Error ? R.message : t;
+          E(m), o == null || o(m);
           return;
         } finally {
-          h(!1);
+          p(!1);
         }
       }
     },
-    [e, n, t, i, a]
+    [e, n, t, i, o]
   );
   return {
-    loading: l,
-    error: S,
-    setError: k,
-    fieldErrors: T,
+    loading: a,
+    error: k,
+    setError: E,
+    fieldErrors: S,
     setFieldError: d,
-    clearFieldError: A,
-    resetErrors: P,
-    handleSubmit: I
+    clearFieldError: x,
+    resetErrors: I,
+    handleSubmit: L
   };
 }
-const it = {
+const lt = {
   container: {
     maxWidth: "400px",
     width: "100%",
@@ -2568,18 +2717,18 @@ const it = {
     color: "#6b7280"
   }
 };
-function Le(r, e) {
+function Fe(r, e) {
   return {
-    ...it,
+    ...lt,
     ...e,
     button: {
-      ...it.button,
+      ...lt.button,
       backgroundColor: r,
       ...(e == null ? void 0 : e.button) || {}
     }
   };
 }
-const ir = () => me.createElement(
+const ur = () => me.createElement(
   "svg",
   {
     width: "16",
@@ -2594,7 +2743,7 @@ const ir = () => me.createElement(
   },
   me.createElement("path", { d: "M1 12s4-8 11-8 11 8 11 8-4 8-11 8-11-8-11-8z" }),
   me.createElement("circle", { cx: "12", cy: "12", r: "3" })
-), or = () => me.createElement(
+), dr = () => me.createElement(
   "svg",
   {
     width: "16",
@@ -2611,10 +2760,10 @@ const ir = () => me.createElement(
     d: "M17.94 17.94A10.07 10.07 0 0 1 12 20c-7 0-11-8-11-8a18.45 18.45 0 0 1 5.06-5.94M9.9 4.24A9.12 9.12 0 0 1 12 4c7 0 11 8 11 8a18.5 18.5 0 0 1-2.16 3.19m-6.72-1.07a3 3 0 1 1-4.24-4.24"
   }),
   me.createElement("line", { x1: "1", y1: "1", x2: "23", y2: "23" })
-), ar = {
-  showPassword: /* @__PURE__ */ s(ir, {}),
-  hidePassword: /* @__PURE__ */ s(or, {})
-}, lr = {
+), hr = {
+  showPassword: /* @__PURE__ */ s(ur, {}),
+  hidePassword: /* @__PURE__ */ s(dr, {})
+}, pr = {
   title: "Sign In",
   usernameLabel: "Email or Phone",
   usernamePlaceholder: "Enter your email or phone number",
@@ -2633,40 +2782,40 @@ const ir = () => me.createElement(
   showPasswordAriaLabel: "Show password",
   hidePasswordAriaLabel: "Hide password"
 };
-function Kr({
+function rn({
   copy: r = {},
   styles: e = {},
   icons: t = {},
   onSuccess: n,
   onError: i,
-  onForgotPassword: a,
-  onSignupClick: l,
-  onMagicLinkClick: h,
-  showForgotPassword: S = !0,
-  showSignupLink: k = !0,
-  showMagicLinkOption: T = !0,
+  onForgotPassword: o,
+  onSignupClick: a,
+  onMagicLinkClick: p,
+  showForgotPassword: k = !0,
+  showSignupLink: E = !0,
+  showMagicLinkOption: S = !0,
   className: c
 }) {
-  const [d, A] = N(""), [P, I] = N(""), [R, E] = N(!1), { login: m } = de(), g = { ...lr, ...r }, b = Le("#3b82f6", e), C = { ...ar, ...t }, o = ve({
+  const [d, x] = C(""), [I, L] = C(""), [P, R] = C(!1), { login: m } = ue(), g = { ...pr, ...r }, b = Fe("#3b82f6", e), w = { ...hr, ...t }, l = Te({
     defaultErrorMessage: g.errorMessage,
     validate: () => {
       const u = [];
-      return d.trim() || u.push("username"), P.trim() || u.push("password"), u.forEach((v) => o.setFieldError(v, !0)), u.length === 0;
+      return d.trim() || u.push("username"), I.trim() || u.push("password"), u.forEach((T) => l.setFieldError(T, !0)), u.length === 0;
     },
-    submit: () => m({ username: d, password: P }),
+    submit: () => m({ username: d, password: I }),
     onSuccess: n,
     onError: i
-  }), p = (u) => ({
+  }), h = (u) => ({
     ...b.input,
-    ...o.fieldErrors[u] ? b.inputError : {}
-  }), x = !d || !P || o.loading, y = {
+    ...l.fieldErrors[u] ? b.inputError : {}
+  }), A = !d || !I || l.loading, y = {
     ...b.button,
-    ...o.loading ? b.buttonLoading : {},
-    ...x ? b.buttonDisabled : {}
+    ...l.loading ? b.buttonLoading : {},
+    ...A ? b.buttonDisabled : {}
   };
   return /* @__PURE__ */ f("div", { className: c, style: b.container, children: [
     /* @__PURE__ */ s("h2", { style: b.title, children: g.title }),
-    /* @__PURE__ */ f("form", { onSubmit: o.handleSubmit, style: b.form, children: [
+    /* @__PURE__ */ f("form", { onSubmit: l.handleSubmit, style: b.form, children: [
       /* @__PURE__ */ f("div", { style: b.fieldGroup, children: [
         /* @__PURE__ */ s("label", { style: b.label, children: g.usernameLabel }),
         /* @__PURE__ */ s(
@@ -2677,11 +2826,11 @@ function Kr({
             type: "text",
             value: d,
             onChange: (u) => {
-              A(u.target.value), o.clearFieldError("username");
+              x(u.target.value), l.clearFieldError("username");
             },
             placeholder: g.usernamePlaceholder,
-            style: p("username"),
-            disabled: o.loading
+            style: h("username"),
+            disabled: l.loading
           }
         )
       ] }),
@@ -2693,54 +2842,54 @@ function Kr({
             {
               id: "password",
               name: "password",
-              type: R ? "text" : "password",
-              value: P,
+              type: P ? "text" : "password",
+              value: I,
               onChange: (u) => {
-                I(u.target.value), o.clearFieldError("password");
+                L(u.target.value), l.clearFieldError("password");
               },
               placeholder: g.passwordPlaceholder,
-              style: { ...p("password"), ...b.inputWithIcon },
-              disabled: o.loading
+              style: { ...h("password"), ...b.inputWithIcon },
+              disabled: l.loading
             }
           ),
           /* @__PURE__ */ s(
             "button",
             {
               type: "button",
-              onClick: () => E(!R),
+              onClick: () => R(!P),
               style: b.passwordToggle,
-              disabled: o.loading,
-              "aria-label": R ? g.hidePasswordAriaLabel : g.showPasswordAriaLabel,
-              children: R ? C.hidePassword : C.showPassword
+              disabled: l.loading,
+              "aria-label": P ? g.hidePasswordAriaLabel : g.showPasswordAriaLabel,
+              children: P ? w.hidePassword : w.showPassword
             }
           )
         ] })
       ] }),
-      /* @__PURE__ */ s("button", { type: "submit", disabled: x, style: y, children: o.loading ? g.loadingText : g.submitButton }),
-      o.error && /* @__PURE__ */ s("div", { style: b.errorText, children: o.error })
+      /* @__PURE__ */ s("button", { type: "submit", disabled: A, style: y, children: l.loading ? g.loadingText : g.submitButton }),
+      l.error && /* @__PURE__ */ s("div", { style: b.errorText, children: l.error })
     ] }),
-    (S || k || T) && /* @__PURE__ */ f("div", { style: b.linkContainer, children: [
-      T && /* @__PURE__ */ f("div", { children: [
+    (k || E || S) && /* @__PURE__ */ f("div", { style: b.linkContainer, children: [
+      S && /* @__PURE__ */ f("div", { children: [
         /* @__PURE__ */ f("span", { style: b.divider, children: [
           g.magicLinkText,
           " "
         ] }),
-        /* @__PURE__ */ s("a", { onClick: h, style: b.link, children: g.magicLinkLink })
+        /* @__PURE__ */ s("a", { onClick: p, style: b.link, children: g.magicLinkLink })
       ] }),
-      T && (S || k) && /* @__PURE__ */ s("div", { style: b.divider, children: g.dividerBullet }),
-      S && /* @__PURE__ */ s("a", { onClick: a, style: b.link, children: g.forgotPasswordLink }),
-      S && k && /* @__PURE__ */ s("div", { style: b.divider, children: g.dividerBullet }),
-      k && /* @__PURE__ */ f("div", { children: [
+      S && (k || E) && /* @__PURE__ */ s("div", { style: b.divider, children: g.dividerBullet }),
+      k && /* @__PURE__ */ s("a", { onClick: o, style: b.link, children: g.forgotPasswordLink }),
+      k && E && /* @__PURE__ */ s("div", { style: b.divider, children: g.dividerBullet }),
+      E && /* @__PURE__ */ f("div", { children: [
         /* @__PURE__ */ f("span", { style: b.divider, children: [
           g.signupText,
           " "
         ] }),
-        /* @__PURE__ */ s("a", { onClick: l, style: b.link, children: g.signupLink })
+        /* @__PURE__ */ s("a", { onClick: a, style: b.link, children: g.signupLink })
       ] })
     ] })
   ] });
 }
-const cr = {
+const fr = {
   title: "Create Account",
   nameLabel: "First Name",
   namePlaceholder: "Enter your first name",
@@ -2770,75 +2919,75 @@ const cr = {
   tenantNotFoundError: "Tenant not found",
   dividerBullet: "•"
 };
-function Yr({
+function nn({
   copy: r = {},
   styles: e = {},
   signupType: t = "user",
   onSuccess: n,
   onError: i,
-  onLoginClick: a,
-  onMagicLinkClick: l,
-  showLoginLink: h = !0,
-  showMagicLinkOption: S = !0,
-  className: k
+  onLoginClick: o,
+  onMagicLinkClick: a,
+  showLoginLink: p = !0,
+  showMagicLinkOption: k = !0,
+  className: E
 }) {
-  var B;
-  const [T, c] = N(""), [d, A] = N(""), [P, I] = N(""), [R, E] = N(""), [m, g] = N(""), [b, C] = N(""), [o, p] = N(""), { signup: x, signupTenantAdmin: y } = de(), u = ((B = pe()) == null ? void 0 : B.tenant) ?? null, v = { ...cr, ...r }, D = Le("#10b981", e), se = !!T && (!!P || !!R) && !!m && !!b && (t === "user" || !!o), F = ve({
-    defaultErrorMessage: v.errorMessage,
+  var D;
+  const [S, c] = C(""), [d, x] = C(""), [I, L] = C(""), [P, R] = C(""), [m, g] = C(""), [b, w] = C(""), [l, h] = C(""), { signup: A, signupTenantAdmin: y } = ue(), u = ((D = pe()) == null ? void 0 : D.tenant) ?? null, T = { ...fr, ...r }, M = Fe("#10b981", e), se = !!S && (!!I || !!P) && !!m && !!b && (t === "user" || !!l), N = Te({
+    defaultErrorMessage: T.errorMessage,
     validate: () => {
-      const L = [];
-      return T.trim() || L.push("name"), !P.trim() && !R.trim() && (L.push("email"), L.push("phoneNumber")), m.trim() || L.push("password"), b.trim() || L.push("confirmPassword"), t === "tenant" && !o.trim() && L.push("tenantName"), L.forEach((q) => F.setFieldError(q, !0)), L.length > 0 ? !1 : m !== b ? (F.setError(v.passwordMismatchError), F.setFieldError("confirmPassword", !0), !1) : t === "user" && !(u != null && u.id) ? (F.setError(v.tenantNotFoundError), !1) : !0;
+      const F = [];
+      return S.trim() || F.push("name"), !I.trim() && !P.trim() && (F.push("email"), F.push("phoneNumber")), m.trim() || F.push("password"), b.trim() || F.push("confirmPassword"), t === "tenant" && !l.trim() && F.push("tenantName"), F.forEach((_) => N.setFieldError(_, !0)), F.length > 0 ? !1 : m !== b ? (N.setError(T.passwordMismatchError), N.setFieldError("confirmPassword", !0), !1) : t === "user" && !(u != null && u.id) ? (N.setError(T.tenantNotFoundError), !1) : !0;
     },
     submit: async () => t === "tenant" ? y({
-      email: P || void 0,
-      phoneNumber: R || void 0,
-      name: T,
+      email: I || void 0,
+      phoneNumber: P || void 0,
+      name: S,
       password: m,
-      tenantName: o,
+      tenantName: l,
       lastName: d || void 0
-    }) : x({
-      email: P || void 0,
-      phoneNumber: R || void 0,
-      name: T,
+    }) : A({
+      email: I || void 0,
+      phoneNumber: P || void 0,
+      name: S,
       password: m,
       tenantId: u.id,
       lastName: d || void 0
     }),
     onSuccess: n,
     onError: i
-  }), H = (L) => ({
-    ...D.input,
-    ...F.fieldErrors[L] ? D.inputError : {}
-  }), j = !se || F.loading, K = {
-    ...D.button,
-    ...F.loading ? D.buttonLoading : {},
-    ...j ? D.buttonDisabled : {}
-  }, $ = () => {
-    F.clearFieldError("email"), F.clearFieldError("phoneNumber");
+  }), W = (F) => ({
+    ...M.input,
+    ...N.fieldErrors[F] ? M.inputError : {}
+  }), z = !se || N.loading, Z = {
+    ...M.button,
+    ...N.loading ? M.buttonLoading : {},
+    ...z ? M.buttonDisabled : {}
+  }, K = () => {
+    N.clearFieldError("email"), N.clearFieldError("phoneNumber");
   };
-  return /* @__PURE__ */ f("div", { className: k, style: D.container, children: [
-    /* @__PURE__ */ s("h2", { style: D.title, children: v.title }),
-    /* @__PURE__ */ f("form", { onSubmit: F.handleSubmit, style: D.form, children: [
-      /* @__PURE__ */ f("div", { style: D.fieldGroup, children: [
-        /* @__PURE__ */ s("label", { style: D.label, children: v.nameLabel }),
+  return /* @__PURE__ */ f("div", { className: E, style: M.container, children: [
+    /* @__PURE__ */ s("h2", { style: M.title, children: T.title }),
+    /* @__PURE__ */ f("form", { onSubmit: N.handleSubmit, style: M.form, children: [
+      /* @__PURE__ */ f("div", { style: M.fieldGroup, children: [
+        /* @__PURE__ */ s("label", { style: M.label, children: T.nameLabel }),
         /* @__PURE__ */ s(
           "input",
           {
             id: "name",
             name: "name",
             type: "text",
-            value: T,
-            onChange: (L) => {
-              c(L.target.value), F.clearFieldError("name");
+            value: S,
+            onChange: (F) => {
+              c(F.target.value), N.clearFieldError("name");
             },
-            placeholder: v.namePlaceholder,
-            style: H("name"),
-            disabled: F.loading
+            placeholder: T.namePlaceholder,
+            style: W("name"),
+            disabled: N.loading
           }
         )
       ] }),
-      /* @__PURE__ */ f("div", { style: D.fieldGroup, children: [
-        /* @__PURE__ */ s("label", { style: D.label, children: v.lastNameLabel }),
+      /* @__PURE__ */ f("div", { style: M.fieldGroup, children: [
+        /* @__PURE__ */ s("label", { style: M.label, children: T.lastNameLabel }),
         /* @__PURE__ */ s(
           "input",
           {
@@ -2846,52 +2995,52 @@ function Yr({
             name: "lastName",
             type: "text",
             value: d,
-            onChange: (L) => A(L.target.value),
-            placeholder: v.lastNamePlaceholder,
-            style: D.input,
-            disabled: F.loading
+            onChange: (F) => x(F.target.value),
+            placeholder: T.lastNamePlaceholder,
+            style: M.input,
+            disabled: N.loading
           }
         )
       ] }),
-      /* @__PURE__ */ f("div", { style: D.fieldGroup, children: [
-        /* @__PURE__ */ s("label", { style: D.label, children: v.emailLabel }),
+      /* @__PURE__ */ f("div", { style: M.fieldGroup, children: [
+        /* @__PURE__ */ s("label", { style: M.label, children: T.emailLabel }),
         /* @__PURE__ */ s(
           "input",
           {
             id: "email",
             name: "email",
             type: "email",
-            value: P,
-            onChange: (L) => {
-              I(L.target.value), $();
+            value: I,
+            onChange: (F) => {
+              L(F.target.value), K();
             },
-            placeholder: v.emailPlaceholder,
-            style: H("email"),
-            disabled: F.loading
+            placeholder: T.emailPlaceholder,
+            style: W("email"),
+            disabled: N.loading
           }
         )
       ] }),
-      /* @__PURE__ */ f("div", { style: D.fieldGroup, children: [
-        /* @__PURE__ */ s("label", { style: D.label, children: v.phoneNumberLabel }),
+      /* @__PURE__ */ f("div", { style: M.fieldGroup, children: [
+        /* @__PURE__ */ s("label", { style: M.label, children: T.phoneNumberLabel }),
         /* @__PURE__ */ s(
           "input",
           {
             id: "phoneNumber",
             name: "phoneNumber",
             type: "tel",
-            value: R,
-            onChange: (L) => {
-              E(L.target.value), $();
+            value: P,
+            onChange: (F) => {
+              R(F.target.value), K();
             },
-            placeholder: v.phoneNumberPlaceholder,
-            style: H("phoneNumber"),
-            disabled: F.loading
+            placeholder: T.phoneNumberPlaceholder,
+            style: W("phoneNumber"),
+            disabled: N.loading
           }
         )
       ] }),
-      /* @__PURE__ */ s("div", { style: D.hintText, children: v.contactMethodHint }),
-      /* @__PURE__ */ f("div", { style: D.fieldGroup, children: [
-        /* @__PURE__ */ s("label", { style: D.label, children: v.passwordLabel }),
+      /* @__PURE__ */ s("div", { style: M.hintText, children: T.contactMethodHint }),
+      /* @__PURE__ */ f("div", { style: M.fieldGroup, children: [
+        /* @__PURE__ */ s("label", { style: M.label, children: T.passwordLabel }),
         /* @__PURE__ */ s(
           "input",
           {
@@ -2899,17 +3048,17 @@ function Yr({
             name: "password",
             type: "password",
             value: m,
-            onChange: (L) => {
-              g(L.target.value), F.clearFieldError("password");
+            onChange: (F) => {
+              g(F.target.value), N.clearFieldError("password");
             },
-            placeholder: v.passwordPlaceholder,
-            style: H("password"),
-            disabled: F.loading
+            placeholder: T.passwordPlaceholder,
+            style: W("password"),
+            disabled: N.loading
           }
         )
       ] }),
-      /* @__PURE__ */ f("div", { style: D.fieldGroup, children: [
-        /* @__PURE__ */ s("label", { style: D.label, children: v.confirmPasswordLabel }),
+      /* @__PURE__ */ f("div", { style: M.fieldGroup, children: [
+        /* @__PURE__ */ s("label", { style: M.label, children: T.confirmPasswordLabel }),
         /* @__PURE__ */ s(
           "input",
           {
@@ -2917,56 +3066,56 @@ function Yr({
             name: "confirmPassword",
             type: "password",
             value: b,
-            onChange: (L) => {
-              C(L.target.value), F.clearFieldError("confirmPassword"), F.error === v.passwordMismatchError && F.setError("");
+            onChange: (F) => {
+              w(F.target.value), N.clearFieldError("confirmPassword"), N.error === T.passwordMismatchError && N.setError("");
             },
-            placeholder: v.confirmPasswordPlaceholder,
-            style: H("confirmPassword"),
-            disabled: F.loading
+            placeholder: T.confirmPasswordPlaceholder,
+            style: W("confirmPassword"),
+            disabled: N.loading
           }
         )
       ] }),
-      t === "tenant" && /* @__PURE__ */ f("div", { style: D.fieldGroup, children: [
-        /* @__PURE__ */ s("label", { style: D.label, children: v.tenantNameLabel }),
+      t === "tenant" && /* @__PURE__ */ f("div", { style: M.fieldGroup, children: [
+        /* @__PURE__ */ s("label", { style: M.label, children: T.tenantNameLabel }),
         /* @__PURE__ */ s(
           "input",
           {
             id: "tenantName",
             name: "tenantName",
             type: "text",
-            value: o,
-            onChange: (L) => {
-              p(L.target.value), F.clearFieldError("tenantName");
+            value: l,
+            onChange: (F) => {
+              h(F.target.value), N.clearFieldError("tenantName");
             },
-            placeholder: v.tenantNamePlaceholder,
-            style: H("tenantName"),
-            disabled: F.loading
+            placeholder: T.tenantNamePlaceholder,
+            style: W("tenantName"),
+            disabled: N.loading
           }
         )
       ] }),
-      /* @__PURE__ */ s("button", { type: "submit", disabled: j, style: K, children: F.loading ? v.loadingText : v.submitButton }),
-      F.error && /* @__PURE__ */ s("div", { style: D.errorText, children: F.error })
+      /* @__PURE__ */ s("button", { type: "submit", disabled: z, style: Z, children: N.loading ? T.loadingText : T.submitButton }),
+      N.error && /* @__PURE__ */ s("div", { style: M.errorText, children: N.error })
     ] }),
-    (h || S) && /* @__PURE__ */ f("div", { style: D.linkContainer, children: [
-      S && /* @__PURE__ */ f("div", { children: [
-        /* @__PURE__ */ f("span", { style: D.divider, children: [
-          v.magicLinkText,
+    (p || k) && /* @__PURE__ */ f("div", { style: M.linkContainer, children: [
+      k && /* @__PURE__ */ f("div", { children: [
+        /* @__PURE__ */ f("span", { style: M.divider, children: [
+          T.magicLinkText,
           " "
         ] }),
-        /* @__PURE__ */ s("a", { onClick: l, style: D.link, children: v.magicLinkLink })
+        /* @__PURE__ */ s("a", { onClick: a, style: M.link, children: T.magicLinkLink })
       ] }),
-      S && h && /* @__PURE__ */ s("div", { style: D.divider, children: v.dividerBullet }),
-      h && /* @__PURE__ */ f("div", { children: [
-        /* @__PURE__ */ f("span", { style: D.divider, children: [
-          v.loginText,
+      k && p && /* @__PURE__ */ s("div", { style: M.divider, children: T.dividerBullet }),
+      p && /* @__PURE__ */ f("div", { children: [
+        /* @__PURE__ */ f("span", { style: M.divider, children: [
+          T.loginText,
           " "
         ] }),
-        /* @__PURE__ */ s("a", { onClick: a, style: D.link, children: v.loginLink })
+        /* @__PURE__ */ s("a", { onClick: o, style: M.link, children: T.loginLink })
       ] })
     ] })
   ] });
 }
-const ur = {
+const mr = {
   title: "Sign In with Magic Link",
   emailLabel: "Email",
   emailPlaceholder: "Enter your email",
@@ -2991,73 +3140,73 @@ const ur = {
   missingTenantOrEmailError: "Missing tenant or email",
   dividerBullet: "•"
 };
-function Xr({
+function sn({
   copy: r = {},
   styles: e = {},
   onSuccess: t,
   onError: n,
   onLoginClick: i,
-  onSignupClick: a,
-  showTraditionalLinks: l = !0,
-  className: h,
-  verifyToken: S,
-  frontendUrl: k
+  onSignupClick: o,
+  showTraditionalLinks: a = !0,
+  className: p,
+  verifyToken: k,
+  frontendUrl: E
 }) {
-  var H;
-  const [T, c] = N(""), [d, A] = N(""), [P, I] = N(""), [R, E] = N(!1), [m, g] = N(""), [b, C] = N(!1), { sendMagicLink: o, verifyMagicLink: p } = de(), x = ((H = pe()) == null ? void 0 : H.tenant) ?? null, y = { ...ur, ...r }, u = Le("#3b82f6", e), v = ve({
+  var W;
+  const [S, c] = C(""), [d, x] = C(""), [I, L] = C(""), [P, R] = C(!1), [m, g] = C(""), [b, w] = C(!1), { sendMagicLink: l, verifyMagicLink: h } = ue(), A = ((W = pe()) == null ? void 0 : W.tenant) ?? null, y = { ...mr, ...r }, u = Fe("#3b82f6", e), T = Te({
     defaultErrorMessage: y.errorMessage,
     validate: () => {
-      const j = [];
-      return T.trim() || j.push("email"), b && !d.trim() && j.push("name"), j.forEach((K) => v.setFieldError(K, !0)), j.length > 0 ? !1 : x != null && x.id ? !0 : (v.setError(y.tenantNotFoundError), !1);
+      const z = [];
+      return S.trim() || z.push("email"), b && !d.trim() && z.push("name"), z.forEach((Z) => T.setFieldError(Z, !0)), z.length > 0 ? !1 : A != null && A.id ? !0 : (T.setError(y.tenantNotFoundError), !1);
     },
     submit: async () => {
       g("");
-      const j = k || (typeof window < "u" ? window.location.origin : ""), K = await o({
-        email: T,
-        tenantId: x.id,
-        frontendUrl: j,
+      const z = E || (typeof window < "u" ? window.location.origin : ""), Z = await l({
+        email: S,
+        tenantId: A.id,
+        frontendUrl: z,
         name: b ? d : void 0,
-        lastName: b ? P : void 0
+        lastName: b ? I : void 0
       });
-      return g(y.successMessage), K;
+      return g(y.successMessage), Z;
     },
     onSuccess: t,
     onError: n
   });
   re(() => {
-    if (!S) return;
+    if (!k) return;
     (async () => {
-      if (!x || !T) {
-        v.setError(y.missingTenantOrEmailError);
+      if (!A || !S) {
+        T.setError(y.missingTenantOrEmailError);
         return;
       }
-      E(!0), v.setError("");
+      R(!0), T.setError("");
       try {
-        const K = await p({ token: S, email: T });
-        t == null || t(K);
-      } catch (K) {
-        const $ = K instanceof Error ? K.message : "Failed to verify magic link";
-        v.setError($), n == null || n($);
+        const Z = await h({ token: k, email: S });
+        t == null || t(Z);
+      } catch (Z) {
+        const K = Z instanceof Error ? Z.message : "Failed to verify magic link";
+        T.setError(K), n == null || n(K);
       } finally {
-        E(!1);
+        R(!1);
       }
     })();
-  }, [S]);
-  const D = (j) => ({
+  }, [k]);
+  const M = (z) => ({
     ...u.input,
-    ...v.fieldErrors[j] ? u.inputError : {}
-  }), se = !T || v.loading || R, F = {
+    ...T.fieldErrors[z] ? u.inputError : {}
+  }), se = !S || T.loading || P, N = {
     ...u.button,
-    ...v.loading || R ? u.buttonLoading : {},
+    ...T.loading || P ? u.buttonLoading : {},
     ...se ? u.buttonDisabled : {}
   };
-  return R ? /* @__PURE__ */ f("div", { className: h, style: u.container, children: [
+  return P ? /* @__PURE__ */ f("div", { className: p, style: u.container, children: [
     /* @__PURE__ */ s("h2", { style: u.title, children: y.verifyingText }),
     /* @__PURE__ */ s("div", { style: u.verifyingContainer, children: /* @__PURE__ */ s("div", { style: u.verifyingText, children: y.verifyingDescription }) })
-  ] }) : /* @__PURE__ */ f("div", { className: h, style: u.container, children: [
+  ] }) : /* @__PURE__ */ f("div", { className: p, style: u.container, children: [
     /* @__PURE__ */ s("h2", { style: u.title, children: y.title }),
     /* @__PURE__ */ s("p", { style: u.description, children: y.description }),
-    /* @__PURE__ */ f("form", { onSubmit: v.handleSubmit, style: u.form, children: [
+    /* @__PURE__ */ f("form", { onSubmit: T.handleSubmit, style: u.form, children: [
       /* @__PURE__ */ f("div", { style: u.fieldGroup, children: [
         /* @__PURE__ */ s("label", { style: u.label, children: y.emailLabel }),
         /* @__PURE__ */ s(
@@ -3066,13 +3215,13 @@ function Xr({
             id: "email",
             name: "email",
             type: "email",
-            value: T,
-            onChange: (j) => {
-              c(j.target.value), v.clearFieldError("email");
+            value: S,
+            onChange: (z) => {
+              c(z.target.value), T.clearFieldError("email");
             },
             placeholder: y.emailPlaceholder,
-            style: D("email"),
-            disabled: v.loading || R
+            style: M("email"),
+            disabled: T.loading || P
           }
         )
       ] }),
@@ -3080,7 +3229,7 @@ function Xr({
         "button",
         {
           type: "button",
-          onClick: () => C(!0),
+          onClick: () => w(!0),
           style: u.toggleLink,
           children: y.showNameToggle
         }
@@ -3095,12 +3244,12 @@ function Xr({
               name: "name",
               type: "text",
               value: d,
-              onChange: (j) => {
-                A(j.target.value), v.clearFieldError("name");
+              onChange: (z) => {
+                x(z.target.value), T.clearFieldError("name");
               },
               placeholder: y.namePlaceholder,
-              style: D("name"),
-              disabled: v.loading || R
+              style: M("name"),
+              disabled: T.loading || P
             }
           )
         ] }),
@@ -3112,11 +3261,11 @@ function Xr({
               id: "lastName",
               name: "lastName",
               type: "text",
-              value: P,
-              onChange: (j) => I(j.target.value),
+              value: I,
+              onChange: (z) => L(z.target.value),
               placeholder: y.lastNamePlaceholder,
               style: u.input,
-              disabled: v.loading || R
+              disabled: T.loading || P
             }
           )
         ] }),
@@ -3125,18 +3274,18 @@ function Xr({
           {
             type: "button",
             onClick: () => {
-              C(!1), A(""), I("");
+              w(!1), x(""), L("");
             },
             style: u.toggleLink,
             children: y.hideNameToggle
           }
         ) })
       ] }),
-      /* @__PURE__ */ s("button", { type: "submit", disabled: se, style: F, children: v.loading ? y.loadingText : y.submitButton }),
-      v.error && /* @__PURE__ */ s("div", { style: u.errorText, children: v.error }),
+      /* @__PURE__ */ s("button", { type: "submit", disabled: se, style: N, children: T.loading ? y.loadingText : y.submitButton }),
+      T.error && /* @__PURE__ */ s("div", { style: u.errorText, children: T.error }),
       m && /* @__PURE__ */ s("div", { style: u.successText, children: m })
     ] }),
-    l && /* @__PURE__ */ f("div", { style: u.linkContainer, children: [
+    a && /* @__PURE__ */ f("div", { style: u.linkContainer, children: [
       /* @__PURE__ */ f("div", { children: [
         /* @__PURE__ */ f("span", { style: u.divider, children: [
           y.loginText,
@@ -3150,12 +3299,12 @@ function Xr({
           y.signupText,
           " "
         ] }),
-        /* @__PURE__ */ s("a", { onClick: a, style: u.link, children: y.signupLink })
+        /* @__PURE__ */ s("a", { onClick: o, style: u.link, children: y.signupLink })
       ] })
     ] })
   ] });
 }
-const dr = {
+const gr = {
   title: "Verifying Magic Link",
   verifyingMessage: "Please wait while we verify your magic link...",
   successMessage: "Magic link verified successfully! You are now logged in.",
@@ -3164,7 +3313,7 @@ const dr = {
   retryButton: "Try Again",
   backToLoginButton: "Back to Login",
   missingParamsError: "Missing required parameters: token or email"
-}, ut = {
+}, pt = {
   container: {
     maxWidth: "400px",
     width: "100%",
@@ -3257,7 +3406,7 @@ const dr = {
   backButtonHover: {
     backgroundColor: "#e5e7eb"
   }
-}, hr = () => /* @__PURE__ */ s("div", { style: ut.spinner }), pr = () => /* @__PURE__ */ f(
+}, yr = () => /* @__PURE__ */ s("div", { style: pt.spinner }), br = () => /* @__PURE__ */ f(
   "svg",
   {
     width: "48",
@@ -3274,7 +3423,7 @@ const dr = {
       /* @__PURE__ */ s("polyline", { points: "22,4 12,14.01 9,11.01" })
     ]
   }
-), fr = () => /* @__PURE__ */ f(
+), wr = () => /* @__PURE__ */ f(
   "svg",
   {
     width: "48",
@@ -3292,63 +3441,63 @@ const dr = {
       /* @__PURE__ */ s("line", { x1: "9", y1: "9", x2: "15", y2: "15" })
     ]
   }
-), mr = {
-  loading: /* @__PURE__ */ s(hr, {}),
-  success: /* @__PURE__ */ s(pr, {}),
-  error: /* @__PURE__ */ s(fr, {})
+), vr = {
+  loading: /* @__PURE__ */ s(yr, {}),
+  success: /* @__PURE__ */ s(br, {}),
+  error: /* @__PURE__ */ s(wr, {})
 };
-function en({
+function on({
   copy: r = {},
   styles: e = {},
   icons: t = {},
   onSuccess: n,
   onError: i,
-  onRetry: a,
-  onBackToLogin: l,
-  className: h,
-  token: S,
-  email: k,
-  appId: T,
+  onRetry: o,
+  onBackToLogin: a,
+  className: p,
+  token: k,
+  email: E,
+  appId: S,
   tenantSlug: c,
   autoRedirectDelay: d = 3e3
 }) {
-  const [A, P] = N("verifying"), [I, R] = N(""), { verifyMagicLink: E } = de(), m = { ...dr, ...r }, g = { ...ut, ...e }, b = { ...mr, ...t }, C = () => {
+  const [x, I] = C("verifying"), [L, P] = C(""), { verifyMagicLink: R } = ue(), m = { ...gr, ...r }, g = { ...pt, ...e }, b = { ...vr, ...t }, w = () => {
     if (typeof window > "u") return {};
     const u = new URLSearchParams(window.location.search);
     return {
-      token: S || u.get("token") || "",
-      email: k || u.get("email") || "",
-      appId: T || u.get("appId") || "",
+      token: k || u.get("token") || "",
+      email: E || u.get("email") || "",
+      appId: S || u.get("appId") || "",
       tenantSlug: c || u.get("tenantSlug") || void 0
     };
-  }, o = async () => {
-    P("verifying"), R("");
+  }, l = async () => {
+    I("verifying"), P("");
     try {
-      const u = C();
+      const u = w();
       if (!u.token || !u.email)
         throw new Error(m.missingParamsError);
-      const v = await E({
+      const T = await R({
         token: u.token,
         email: u.email,
         tenantSlug: u.tenantSlug
       });
-      P("success"), n == null || n(v), d > 0 && setTimeout(() => {
-        P("redirecting");
+      I("success"), n == null || n(T), d > 0 && setTimeout(() => {
+        I("redirecting");
       }, d);
     } catch (u) {
-      const v = u.message || m.errorMessage;
-      R(v), P("error"), i == null || i(v);
+      const T = u.message || m.errorMessage;
+      P(T), I("error"), i == null || i(T);
     }
-  }, p = () => {
-    a == null || a(), o();
-  }, x = () => {
-    l == null || l();
+  }, h = () => {
+    o == null || o(), l();
+  }, A = () => {
+    a == null || a();
   };
   re(() => {
-    o();
+    l();
   }, []);
   const y = () => {
-    switch (A) {
+    switch (x) {
       case "verifying":
         return /* @__PURE__ */ f("div", { style: g.message, children: [
           b.loading,
@@ -3367,20 +3516,20 @@ function en({
       case "error":
         return /* @__PURE__ */ f(U, { children: [
           b.error,
-          /* @__PURE__ */ s("div", { style: g.errorMessage, children: I || m.errorMessage }),
+          /* @__PURE__ */ s("div", { style: g.errorMessage, children: L || m.errorMessage }),
           /* @__PURE__ */ f("div", { style: g.buttonContainer, children: [
             /* @__PURE__ */ s(
               "button",
               {
-                onClick: p,
+                onClick: h,
                 style: g.retryButton,
                 onMouseOver: (u) => {
                   Object.assign(u.currentTarget.style, g.retryButtonHover);
                 },
                 onMouseOut: (u) => {
-                  const v = g.retryButton || {};
-                  Object.keys(g.retryButtonHover || {}).forEach((D) => {
-                    u.currentTarget.style[D] = v[D] ?? "";
+                  const T = g.retryButton || {};
+                  Object.keys(g.retryButtonHover || {}).forEach((M) => {
+                    u.currentTarget.style[M] = T[M] ?? "";
                   });
                 },
                 children: m.retryButton
@@ -3389,15 +3538,15 @@ function en({
             /* @__PURE__ */ s(
               "button",
               {
-                onClick: x,
+                onClick: A,
                 style: g.backButton,
                 onMouseOver: (u) => {
                   Object.assign(u.currentTarget.style, g.backButtonHover);
                 },
                 onMouseOut: (u) => {
-                  const v = g.backButton || {};
-                  Object.keys(g.backButtonHover || {}).forEach((D) => {
-                    u.currentTarget.style[D] = v[D] ?? "";
+                  const T = g.backButton || {};
+                  Object.keys(g.backButtonHover || {}).forEach((M) => {
+                    u.currentTarget.style[M] = T[M] ?? "";
                   });
                 },
                 children: m.backToLoginButton
@@ -3409,7 +3558,7 @@ function en({
         return null;
     }
   };
-  return /* @__PURE__ */ f("div", { style: g.container, className: h, children: [
+  return /* @__PURE__ */ f("div", { style: g.container, className: p, children: [
     /* @__PURE__ */ s("style", { children: `
           @keyframes spin {
             0% { transform: rotate(0deg); }
@@ -3420,7 +3569,7 @@ function en({
     y()
   ] });
 }
-const gr = {
+const Tr = {
   title: "Reset Password",
   subtitle: "Enter your email address and we'll send you a link to reset your password.",
   emailLabel: "Email",
@@ -3447,154 +3596,154 @@ const gr = {
   tenantNotFoundError: "Tenant not found",
   dividerBullet: "•"
 };
-function tn({
+function an({
   copy: r = {},
   styles: e = {},
   mode: t = "request",
   token: n = "",
   onSuccess: i,
-  onError: a,
-  onBackToLogin: l,
-  onModeChange: h,
-  className: S
+  onError: o,
+  onBackToLogin: a,
+  onModeChange: p,
+  className: k
 }) {
   var se;
-  const [k, T] = N(""), [c, d] = N(n), [A, P] = N(""), [I, R] = N(""), [E, m] = N(""), { requestPasswordReset: g, confirmPasswordReset: b } = de(), C = ((se = pe()) == null ? void 0 : se.tenant) ?? null, o = { ...gr, ...r }, p = Le("#f59e0b", e), x = ve({
-    defaultErrorMessage: o.errorMessage,
-    validate: () => k.trim() ? C != null && C.id ? !0 : (x.setError(o.tenantNotFoundError), !1) : (x.setFieldError("email", !0), !1),
+  const [E, S] = C(""), [c, d] = C(n), [x, I] = C(""), [L, P] = C(""), [R, m] = C(""), { requestPasswordReset: g, confirmPasswordReset: b } = ue(), w = ((se = pe()) == null ? void 0 : se.tenant) ?? null, l = { ...Tr, ...r }, h = Fe("#f59e0b", e), A = Te({
+    defaultErrorMessage: l.errorMessage,
+    validate: () => E.trim() ? w != null && w.id ? !0 : (A.setError(l.tenantNotFoundError), !1) : (A.setFieldError("email", !0), !1),
     submit: async () => {
-      m(""), await g({ email: k, tenantId: C.id }), m(o.successMessage);
+      m(""), await g({ email: E, tenantId: w.id }), m(l.successMessage);
     },
     onSuccess: () => i == null ? void 0 : i(),
-    onError: a
-  }), y = ve({
-    defaultErrorMessage: o.errorMessage,
+    onError: o
+  }), y = Te({
+    defaultErrorMessage: l.errorMessage,
     validate: () => {
-      const F = [];
-      return c.trim() || F.push("token"), A.trim() || F.push("newPassword"), I.trim() || F.push("confirmPassword"), F.forEach((H) => y.setFieldError(H, !0)), F.length > 0 ? !1 : A !== I ? (y.setError(o.passwordMismatchError), y.setFieldError("confirmPassword", !0), !1) : !0;
+      const N = [];
+      return c.trim() || N.push("token"), x.trim() || N.push("newPassword"), L.trim() || N.push("confirmPassword"), N.forEach((W) => y.setFieldError(W, !0)), N.length > 0 ? !1 : x !== L ? (y.setError(l.passwordMismatchError), y.setFieldError("confirmPassword", !0), !1) : !0;
     },
     submit: async () => {
-      m(""), await b({ token: c, newPassword: A }), m(o.resetSuccessMessage);
+      m(""), await b({ token: c, newPassword: x }), m(l.resetSuccessMessage);
     },
     onSuccess: () => i == null ? void 0 : i(),
-    onError: a
+    onError: o
   });
   if (t === "reset") {
-    const F = ($) => ({
-      ...p.input,
-      ...y.fieldErrors[$] ? p.inputError : {}
-    }), j = !(!!c && !!A && !!I) || y.loading, K = {
-      ...p.button,
-      ...y.loading ? p.buttonLoading : {},
-      ...j ? p.buttonDisabled : {}
+    const N = (K) => ({
+      ...h.input,
+      ...y.fieldErrors[K] ? h.inputError : {}
+    }), z = !(!!c && !!x && !!L) || y.loading, Z = {
+      ...h.button,
+      ...y.loading ? h.buttonLoading : {},
+      ...z ? h.buttonDisabled : {}
     };
-    return /* @__PURE__ */ f("div", { className: S, style: p.container, children: [
-      /* @__PURE__ */ s("h2", { style: p.title, children: o.resetTitle }),
-      /* @__PURE__ */ s("p", { style: p.subtitle, children: o.resetSubtitle }),
-      /* @__PURE__ */ f("form", { onSubmit: y.handleSubmit, style: p.form, children: [
-        /* @__PURE__ */ f("div", { style: p.fieldGroup, children: [
-          /* @__PURE__ */ s("label", { style: p.label, children: o.tokenLabel }),
+    return /* @__PURE__ */ f("div", { className: k, style: h.container, children: [
+      /* @__PURE__ */ s("h2", { style: h.title, children: l.resetTitle }),
+      /* @__PURE__ */ s("p", { style: h.subtitle, children: l.resetSubtitle }),
+      /* @__PURE__ */ f("form", { onSubmit: y.handleSubmit, style: h.form, children: [
+        /* @__PURE__ */ f("div", { style: h.fieldGroup, children: [
+          /* @__PURE__ */ s("label", { style: h.label, children: l.tokenLabel }),
           /* @__PURE__ */ s(
             "input",
             {
               type: "text",
               value: c,
-              onChange: ($) => {
-                d($.target.value), y.clearFieldError("token");
+              onChange: (K) => {
+                d(K.target.value), y.clearFieldError("token");
               },
-              placeholder: o.tokenPlaceholder,
-              style: F("token"),
+              placeholder: l.tokenPlaceholder,
+              style: N("token"),
               disabled: y.loading
             }
           )
         ] }),
-        /* @__PURE__ */ f("div", { style: p.fieldGroup, children: [
-          /* @__PURE__ */ s("label", { style: p.label, children: o.newPasswordLabel }),
+        /* @__PURE__ */ f("div", { style: h.fieldGroup, children: [
+          /* @__PURE__ */ s("label", { style: h.label, children: l.newPasswordLabel }),
           /* @__PURE__ */ s(
             "input",
             {
               type: "password",
-              value: A,
-              onChange: ($) => {
-                P($.target.value), y.clearFieldError("newPassword");
+              value: x,
+              onChange: (K) => {
+                I(K.target.value), y.clearFieldError("newPassword");
               },
-              placeholder: o.newPasswordPlaceholder,
-              style: F("newPassword"),
+              placeholder: l.newPasswordPlaceholder,
+              style: N("newPassword"),
               disabled: y.loading
             }
           )
         ] }),
-        /* @__PURE__ */ f("div", { style: p.fieldGroup, children: [
-          /* @__PURE__ */ s("label", { style: p.label, children: o.confirmPasswordLabel }),
+        /* @__PURE__ */ f("div", { style: h.fieldGroup, children: [
+          /* @__PURE__ */ s("label", { style: h.label, children: l.confirmPasswordLabel }),
           /* @__PURE__ */ s(
             "input",
             {
               type: "password",
-              value: I,
-              onChange: ($) => {
-                R($.target.value), y.clearFieldError("confirmPassword"), y.error === o.passwordMismatchError && y.setError("");
+              value: L,
+              onChange: (K) => {
+                P(K.target.value), y.clearFieldError("confirmPassword"), y.error === l.passwordMismatchError && y.setError("");
               },
-              placeholder: o.confirmPasswordPlaceholder,
-              style: F("confirmPassword"),
+              placeholder: l.confirmPasswordPlaceholder,
+              style: N("confirmPassword"),
               disabled: y.loading
             }
           )
         ] }),
-        /* @__PURE__ */ s("button", { type: "submit", disabled: j, style: K, children: y.loading ? o.resetLoadingText : o.resetSubmitButton }),
-        y.error && /* @__PURE__ */ s("div", { style: p.errorText, children: y.error }),
-        E && /* @__PURE__ */ s("div", { style: p.successText, children: E })
+        /* @__PURE__ */ s("button", { type: "submit", disabled: z, style: Z, children: y.loading ? l.resetLoadingText : l.resetSubmitButton }),
+        y.error && /* @__PURE__ */ s("div", { style: h.errorText, children: y.error }),
+        R && /* @__PURE__ */ s("div", { style: h.successText, children: R })
       ] }),
-      /* @__PURE__ */ f("div", { style: p.linkContainer, children: [
-        /* @__PURE__ */ s("a", { onClick: l, style: p.link, children: o.backToLoginLink }),
-        h && /* @__PURE__ */ f(U, { children: [
-          /* @__PURE__ */ s("span", { style: p.modeSwitchDivider, children: o.dividerBullet }),
-          /* @__PURE__ */ s("a", { onClick: () => h("request"), style: p.link, children: o.requestNewLinkLink })
+      /* @__PURE__ */ f("div", { style: h.linkContainer, children: [
+        /* @__PURE__ */ s("a", { onClick: a, style: h.link, children: l.backToLoginLink }),
+        p && /* @__PURE__ */ f(U, { children: [
+          /* @__PURE__ */ s("span", { style: h.modeSwitchDivider, children: l.dividerBullet }),
+          /* @__PURE__ */ s("a", { onClick: () => p("request"), style: h.link, children: l.requestNewLinkLink })
         ] })
       ] })
     ] });
   }
-  const u = (F) => ({
-    ...p.input,
-    ...x.fieldErrors[F] ? p.inputError : {}
-  }), v = !k || x.loading, D = {
-    ...p.button,
-    ...x.loading ? p.buttonLoading : {},
-    ...v ? p.buttonDisabled : {}
+  const u = (N) => ({
+    ...h.input,
+    ...A.fieldErrors[N] ? h.inputError : {}
+  }), T = !E || A.loading, M = {
+    ...h.button,
+    ...A.loading ? h.buttonLoading : {},
+    ...T ? h.buttonDisabled : {}
   };
-  return /* @__PURE__ */ f("div", { className: S, style: p.container, children: [
-    /* @__PURE__ */ s("h2", { style: p.title, children: o.title }),
-    /* @__PURE__ */ s("p", { style: p.subtitle, children: o.subtitle }),
-    /* @__PURE__ */ f("form", { onSubmit: x.handleSubmit, style: p.form, children: [
-      /* @__PURE__ */ f("div", { style: p.fieldGroup, children: [
-        /* @__PURE__ */ s("label", { style: p.label, children: o.emailLabel }),
+  return /* @__PURE__ */ f("div", { className: k, style: h.container, children: [
+    /* @__PURE__ */ s("h2", { style: h.title, children: l.title }),
+    /* @__PURE__ */ s("p", { style: h.subtitle, children: l.subtitle }),
+    /* @__PURE__ */ f("form", { onSubmit: A.handleSubmit, style: h.form, children: [
+      /* @__PURE__ */ f("div", { style: h.fieldGroup, children: [
+        /* @__PURE__ */ s("label", { style: h.label, children: l.emailLabel }),
         /* @__PURE__ */ s(
           "input",
           {
             type: "email",
-            value: k,
-            onChange: (F) => {
-              T(F.target.value), x.clearFieldError("email");
+            value: E,
+            onChange: (N) => {
+              S(N.target.value), A.clearFieldError("email");
             },
-            placeholder: o.emailPlaceholder,
+            placeholder: l.emailPlaceholder,
             style: u("email"),
-            disabled: x.loading
+            disabled: A.loading
           }
         )
       ] }),
-      /* @__PURE__ */ s("button", { type: "submit", disabled: v, style: D, children: x.loading ? o.loadingText : o.submitButton }),
-      x.error && /* @__PURE__ */ s("div", { style: p.errorText, children: x.error }),
-      E && /* @__PURE__ */ s("div", { style: p.successText, children: E })
+      /* @__PURE__ */ s("button", { type: "submit", disabled: T, style: M, children: A.loading ? l.loadingText : l.submitButton }),
+      A.error && /* @__PURE__ */ s("div", { style: h.errorText, children: A.error }),
+      R && /* @__PURE__ */ s("div", { style: h.successText, children: R })
     ] }),
-    /* @__PURE__ */ f("div", { style: p.linkContainer, children: [
-      /* @__PURE__ */ s("a", { onClick: l, style: p.link, children: o.backToLoginLink }),
-      h && /* @__PURE__ */ f(U, { children: [
-        /* @__PURE__ */ s("span", { style: p.modeSwitchDivider, children: o.dividerBullet }),
-        /* @__PURE__ */ s("a", { onClick: () => h("reset"), style: p.link, children: o.haveTokenLink })
+    /* @__PURE__ */ f("div", { style: h.linkContainer, children: [
+      /* @__PURE__ */ s("a", { onClick: a, style: h.link, children: l.backToLoginLink }),
+      p && /* @__PURE__ */ f(U, { children: [
+        /* @__PURE__ */ s("span", { style: h.modeSwitchDivider, children: l.dividerBullet }),
+        /* @__PURE__ */ s("a", { onClick: () => p("reset"), style: h.link, children: l.haveTokenLink })
       ] })
     ] })
   ] });
 }
-const yr = () => /* @__PURE__ */ s(
+const Sr = () => /* @__PURE__ */ s(
   "div",
   {
     style: {
@@ -3606,7 +3755,7 @@ const yr = () => /* @__PURE__ */ s(
     },
     children: /* @__PURE__ */ s("div", { children: "Loading..." })
   }
-), br = ({ error: r, retry: e }) => /* @__PURE__ */ f(
+), kr = ({ error: r, retry: e }) => /* @__PURE__ */ f(
   "div",
   {
     style: {
@@ -3640,43 +3789,43 @@ const yr = () => /* @__PURE__ */ s(
     ]
   }
 );
-function rn({
+function ln({
   children: r,
   loadingFallback: e,
   errorFallback: t,
   requireTenant: n = !0
 }) {
-  const { isAppLoading: i, appError: a, retryApp: l } = Ae(), h = pe(), S = Oe(), k = at(), T = lt(), c = (h == null ? void 0 : h.isTenantLoading) ?? !1, d = (h == null ? void 0 : h.tenantError) ?? null, A = (h == null ? void 0 : h.tenantSlug) ?? null, P = (h == null ? void 0 : h.retryTenant) ?? (() => {
-  }), I = (S == null ? void 0 : S.isAuthReady) ?? !0, R = (k == null ? void 0 : k.isReady) ?? !0, E = (T == null ? void 0 : T.isReady) ?? !0, m = n && h && A, o = i || m && c || S && !I || k && !R || T && !E, p = a || (m ? d : null), x = () => {
-    a && l(), d && h && P();
+  const { isAppLoading: i, appError: o, retryApp: a } = Ae(), p = pe(), k = qe(), E = ut(), S = dt(), c = (p == null ? void 0 : p.isTenantLoading) ?? !1, d = (p == null ? void 0 : p.tenantError) ?? null, x = (p == null ? void 0 : p.tenantSlug) ?? null, I = (p == null ? void 0 : p.retryTenant) ?? (() => {
+  }), L = (k == null ? void 0 : k.isAuthReady) ?? !0, P = (E == null ? void 0 : E.isReady) ?? !0, R = (S == null ? void 0 : S.isReady) ?? !0, m = n && p && x, l = i || m && c || k && !L || E && !P || S && !R, h = o || (m ? d : null), A = () => {
+    o && a(), d && p && I();
   };
-  if (o)
-    return /* @__PURE__ */ s(U, { children: e || /* @__PURE__ */ s(yr, {}) });
-  if (p) {
-    const y = typeof t == "function" ? t(p, x) : t || /* @__PURE__ */ s(br, { error: p, retry: x });
+  if (l)
+    return /* @__PURE__ */ s(U, { children: e || /* @__PURE__ */ s(Sr, {}) });
+  if (h) {
+    const y = typeof t == "function" ? t(h, A) : t || /* @__PURE__ */ s(kr, { error: h, retry: A });
     return /* @__PURE__ */ s(U, { children: y });
   }
   return /* @__PURE__ */ s(U, { children: r });
 }
-function nn(r = !0) {
-  const { isAppLoading: e, appError: t, retryApp: n, appInfo: i } = Ae(), a = pe(), l = Oe(), h = at(), S = lt(), k = (a == null ? void 0 : a.isTenantLoading) ?? !1, T = (a == null ? void 0 : a.tenantError) ?? null, c = (a == null ? void 0 : a.tenant) ?? null, d = (a == null ? void 0 : a.tenantSlug) ?? null, A = (a == null ? void 0 : a.retryTenant) ?? (() => {
-  }), P = (l == null ? void 0 : l.isAuthReady) ?? !0, I = (h == null ? void 0 : h.isReady) ?? !0, R = (S == null ? void 0 : S.isReady) ?? !0, E = r && a && d, C = e || E && k || l && !P || h && !I || S && !R, o = t || (E ? T : null);
+function cn(r = !0) {
+  const { isAppLoading: e, appError: t, retryApp: n, appInfo: i } = Ae(), o = pe(), a = qe(), p = ut(), k = dt(), E = (o == null ? void 0 : o.isTenantLoading) ?? !1, S = (o == null ? void 0 : o.tenantError) ?? null, c = (o == null ? void 0 : o.tenant) ?? null, d = (o == null ? void 0 : o.tenantSlug) ?? null, x = (o == null ? void 0 : o.retryTenant) ?? (() => {
+  }), I = (a == null ? void 0 : a.isAuthReady) ?? !0, L = (p == null ? void 0 : p.isReady) ?? !0, P = (k == null ? void 0 : k.isReady) ?? !0, R = r && o && d, w = e || R && E || a && !I || p && !L || k && !P, l = t || (R ? S : null);
   return {
-    isLoading: C,
-    error: o,
-    isReady: !C && !o && i !== null && (!E || c !== null),
+    isLoading: w,
+    error: l,
+    isReady: !w && !l && i !== null && (!R || c !== null),
     retry: () => {
-      t && n(), T && a && A();
+      t && n(), S && o && x();
     },
     // Individual states
     app: { isLoading: e, error: t, data: i },
-    tenant: a ? { isLoading: k, error: T, data: c } : null,
-    auth: l ? { isReady: P } : null,
-    featureFlags: h ? { isReady: I } : null,
-    subscription: S ? { isReady: R } : null
+    tenant: o ? { isLoading: E, error: S, data: c } : null,
+    auth: a ? { isReady: I } : null,
+    featureFlags: p ? { isReady: L } : null,
+    subscription: k ? { isReady: P } : null
   };
 }
-const wr = {
+const Er = {
   wrapper: {
     position: "relative"
   },
@@ -3720,89 +3869,89 @@ const wr = {
     marginLeft: 8
   }
 };
-function sn({
+function un({
   tenants: r,
   currentTenantId: e,
   onSelect: t,
   styles: n = {},
   className: i = "",
-  dropdownClassName: a = "",
-  itemClassName: l = "",
-  renderItem: h,
-  placeholder: S = "Select tenant",
-  disabled: k = !1,
-  showCurrentTenant: T = !0
+  dropdownClassName: o = "",
+  itemClassName: a = "",
+  renderItem: p,
+  placeholder: k = "Select tenant",
+  disabled: E = !1,
+  showCurrentTenant: S = !0
 }) {
-  var C;
-  const c = { ...wr, ...n }, d = Oe(), [A, P] = N(!1), I = ye(null), R = r ?? (d == null ? void 0 : d.userTenants) ?? [], E = e ?? ((C = d == null ? void 0 : d.currentUser) == null ? void 0 : C.tenantId) ?? null, m = async (o) => {
-    P(!1), t ? t(o) : d != null && d.switchToTenant && await d.switchToTenant(o);
+  var w;
+  const c = { ...Er, ...n }, d = qe(), [x, I] = C(!1), L = be(null), P = r ?? (d == null ? void 0 : d.userTenants) ?? [], R = e ?? ((w = d == null ? void 0 : d.currentUser) == null ? void 0 : w.tenantId) ?? null, m = async (l) => {
+    I(!1), t ? t(l) : d != null && d.switchToTenant && await d.switchToTenant(l);
   };
   re(() => {
-    const o = (p) => {
-      I.current && !I.current.contains(p.target) && P(!1);
+    const l = (h) => {
+      L.current && !L.current.contains(h.target) && I(!1);
     };
-    return document.addEventListener("mousedown", o), () => document.removeEventListener("mousedown", o);
+    return document.addEventListener("mousedown", l), () => document.removeEventListener("mousedown", l);
   }, []);
-  const g = R.find((o) => o.id === E);
-  if (R.length === 0)
+  const g = P.find((l) => l.id === R);
+  if (P.length === 0)
     return null;
-  if (R.length === 1 && T)
-    return /* @__PURE__ */ s("div", { className: i, children: /* @__PURE__ */ s("span", { children: R[0].name }) });
-  const b = (o, p) => /* @__PURE__ */ f("span", { style: { fontWeight: p ? "bold" : "normal" }, children: [
-    o.name,
-    o.role && /* @__PURE__ */ f("span", { style: c.itemRole, children: [
+  if (P.length === 1 && S)
+    return /* @__PURE__ */ s("div", { className: i, children: /* @__PURE__ */ s("span", { children: P[0].name }) });
+  const b = (l, h) => /* @__PURE__ */ f("span", { style: { fontWeight: h ? "bold" : "normal" }, children: [
+    l.name,
+    l.role && /* @__PURE__ */ f("span", { style: c.itemRole, children: [
       "(",
-      o.role,
+      l.role,
       ")"
     ] })
   ] });
-  return /* @__PURE__ */ f("div", { ref: I, className: i, style: c.wrapper, children: [
+  return /* @__PURE__ */ f("div", { ref: L, className: i, style: c.wrapper, children: [
     /* @__PURE__ */ f(
       "button",
       {
         type: "button",
-        onClick: () => !k && P(!A),
-        disabled: k,
+        onClick: () => !E && I(!x),
+        disabled: E,
         style: {
           ...c.button,
-          ...k ? c.buttonDisabled : {}
+          ...E ? c.buttonDisabled : {}
         },
         children: [
-          g ? g.name : S,
-          /* @__PURE__ */ s("span", { style: c.arrow, children: A ? "▲" : "▼" })
+          g ? g.name : k,
+          /* @__PURE__ */ s("span", { style: c.arrow, children: x ? "▲" : "▼" })
         ]
       }
     ),
-    A && /* @__PURE__ */ s("div", { className: a, style: c.dropdown, children: R.map((o) => {
-      const p = o.id === E;
+    x && /* @__PURE__ */ s("div", { className: o, style: c.dropdown, children: P.map((l) => {
+      const h = l.id === R;
       return /* @__PURE__ */ s(
         "div",
         {
-          className: l,
-          onClick: () => m(o.id),
+          className: a,
+          onClick: () => m(l.id),
           style: {
             ...c.item,
-            ...p ? c.itemSelected : {}
+            ...h ? c.itemSelected : {}
           },
-          onMouseEnter: (x) => {
-            p || Object.assign(x.currentTarget.style, c.itemHover);
+          onMouseEnter: (A) => {
+            h || Object.assign(A.currentTarget.style, c.itemHover);
           },
-          onMouseLeave: (x) => {
-            if (!p) {
+          onMouseLeave: (A) => {
+            if (!h) {
               const y = c.item || {};
               Object.keys(c.itemHover || {}).forEach((u) => {
-                x.currentTarget.style[u] = y[u] ?? "";
+                A.currentTarget.style[u] = y[u] ?? "";
               });
             }
           },
-          children: h ? h(o, p) : b(o, p)
+          children: p ? p(l, h) : b(l, h)
         },
-        o.id
+        l.id
       );
     }) })
   ] });
 }
-class on {
+class dn {
   constructor(e) {
     this.httpService = e;
   }
@@ -3811,7 +3960,7 @@ class on {
   }
   async getPermissions(e) {
     const t = await this.httpService.get(
-      `/permissions/${ce(e)}`
+      `/permissions/${le(e)}`
     );
     return { permissions: t.data, meta: t.meta };
   }
@@ -3829,13 +3978,13 @@ class on {
   }
   async getAppPermissions(e, t) {
     const n = await this.httpService.get(
-      `/permissions/apps/${e}${ce(t)}`,
+      `/permissions/apps/${e}${le(t)}`,
       { skipAuth: !0 }
     );
     return { permissions: n.data, meta: n.meta };
   }
 }
-class an {
+class hn {
   constructor(e) {
     this.httpService = e;
   }
@@ -3847,7 +3996,7 @@ class an {
   }
   async getSubscriptionPlans(e) {
     const t = await this.httpService.get(
-      `/subscription-plans/${ce(e)}`
+      `/subscription-plans/${le(e)}`
     );
     return { plans: t.data, meta: t.meta };
   }
@@ -3866,7 +4015,7 @@ class an {
     await this.httpService.delete(`/subscription-plans/${e}`);
   }
 }
-class ln {
+class pn {
   constructor(e) {
     this.httpService = e;
   }
@@ -3875,142 +4024,142 @@ class ln {
     return await this.httpService.get("/health");
   }
 }
-const dt = "returnTo", Ce = "zone_return_to", De = "zone_return_to";
-function cn(r = {}) {
+const ft = "returnTo", Me = "zone_return_to", $e = "zone_return_to";
+function fn(r = {}) {
   const {
     zoneRoots: e = {},
-    returnToParam: t = dt,
+    returnToParam: t = ft,
     returnToStorage: n = "url"
-  } = r, i = vt(), [a, l] = Tt(), { isAuthenticated: h, currentUser: S } = de(), { tenant: k } = Te(), T = V(() => ({ ...ze, ...e }), [e]), c = !!k, d = S == null ? void 0 : S.userType, A = V(() => {
+  } = r, i = xt(), [o, a] = Rt(), { isAuthenticated: p, currentUser: k } = ue(), { tenant: E } = Se(), S = O(() => ({ ...je, ...e }), [e]), c = !!E, d = k == null ? void 0 : k.userType, x = O(() => {
     switch (n) {
       case "url":
-        return a.get(t);
+        return o.get(t);
       case "session":
-        return sessionStorage.getItem(Ce);
+        return sessionStorage.getItem(Me);
       case "local":
-        return localStorage.getItem(De);
+        return localStorage.getItem($e);
       default:
         return null;
     }
-  }, [n, a, t]), P = te(() => {
+  }, [n, o, t]), I = te(() => {
     switch (n) {
       case "url": {
-        const m = new URLSearchParams(a);
-        m.delete(t), l(m, { replace: !0 });
+        const m = new URLSearchParams(o);
+        m.delete(t), a(m, { replace: !0 });
         break;
       }
       case "session":
-        sessionStorage.removeItem(Ce);
+        sessionStorage.removeItem(Me);
         break;
       case "local":
-        localStorage.removeItem(De);
+        localStorage.removeItem($e);
         break;
     }
-  }, [n, a, t, l]), I = te(
+  }, [n, o, t, a]), L = te(
     (m) => {
       switch (n) {
         case "url": {
-          const g = new URLSearchParams(a);
-          g.set(t, m), l(g, { replace: !0 });
+          const g = new URLSearchParams(o);
+          g.set(t, m), a(g, { replace: !0 });
           break;
         }
         case "session":
-          sessionStorage.setItem(Ce, m);
+          sessionStorage.setItem(Me, m);
           break;
         case "local":
-          localStorage.setItem(De, m);
+          localStorage.setItem($e, m);
           break;
       }
     },
-    [n, a, t, l]
-  ), R = te(
+    [n, o, t, a]
+  ), P = te(
     (m) => {
-      const g = T[m] || T.default;
+      const g = S[m] || S.default;
       i(g);
     },
-    [i, T]
-  ), E = te(() => c ? h ? d === ae.TENANT_ADMIN ? T.tenantAdmin : T.tenantUser : T.tenantGuest : h ? d === ae.TENANT_ADMIN ? T.publicAdmin : T.publicUser : T.publicGuest, [c, h, d, T]);
+    [i, S]
+  ), R = te(() => c ? p ? d === oe.TENANT_ADMIN ? S.tenantAdmin : S.tenantUser : S.tenantGuest : p ? d === oe.TENANT_ADMIN ? S.publicAdmin : S.publicUser : S.publicGuest, [c, p, d, S]);
   return {
-    returnToUrl: A,
-    clearReturnTo: P,
-    setReturnTo: I,
-    navigateToZone: R,
-    getSmartRedirect: E
+    returnToUrl: x,
+    clearReturnTo: I,
+    setReturnTo: L,
+    navigateToZone: P,
+    getSmartRedirect: R
   };
 }
-function un(r, e, t = dt, n = "url") {
+function mn(r, e, t = ft, n = "url") {
   if (!e || n !== "url")
     return r;
   const i = new URL(r, window.location.origin);
   return i.searchParams.set(t, e), i.pathname + i.search;
 }
 export {
-  zr as AdminZone,
-  Je as AppApiService,
-  rn as AppLoader,
-  kr as AppProvider,
-  Ct as AuthApiService,
-  Pr as AuthProvider,
-  Vr as AuthenticatedZone,
-  oe as ConfigurationError,
-  ct as DEFAULT_ZONE_PRESETS,
-  ze as DEFAULT_ZONE_ROOTS,
-  Zr as FeatureFlag,
-  Vt as FeatureFlagApiService,
-  Fr as FeatureFlagProvider,
-  qr as GuestZone,
-  ln as HealthApiService,
+  Qr as AdminZone,
+  Ye as AppApiService,
+  ln as AppLoader,
+  Pr as AppProvider,
+  Bt as AuthApiService,
+  Cr as AuthProvider,
+  Wr as AuthenticatedZone,
+  ie as ConfigurationError,
+  ht as DEFAULT_ZONE_PRESETS,
+  je as DEFAULT_ZONE_ROOTS,
+  tn as FeatureFlag,
+  Wt as FeatureFlagApiService,
+  $r as FeatureFlagProvider,
+  Hr as GuestZone,
+  pn as HealthApiService,
   he as HttpService,
-  Br as LandingRoute,
-  Kr as LoginForm,
-  Xr as MagicLinkForm,
-  en as MagicLinkVerify,
-  Wr as OpenZone,
-  tn as PasswordRecoveryForm,
-  on as PermissionApiService,
-  Mr as Protected,
-  $r as ProtectedRoute,
-  Or as PublicZone,
-  Dt as RoleApiService,
-  Cr as RoutingProvider,
-  Z as SessionExpiredError,
-  Me as SessionManager,
-  Yr as SignupForm,
-  zt as SubscriptionApiService,
-  Jr as SubscriptionGuard,
-  an as SubscriptionPlanApiService,
-  Nr as SubscriptionProvider,
-  be as TenantApiService,
-  Gr as TenantAuthenticatedZone,
-  Qr as TenantGuestZone,
-  Hr as TenantOpenZone,
-  xr as TenantProvider,
-  Ur as TenantRoute,
-  sn as TenantSelector,
-  _r as TenantZone,
-  Et as TokenRefreshError,
-  kt as TokenRefreshTimeoutError,
-  Mt as UserApiService,
-  ae as UserType,
-  jr as UserZone,
-  ue as ZoneRoute,
-  un as buildRedirectUrl,
-  Er as useApi,
+  zr as LandingRoute,
+  rn as LoginForm,
+  sn as MagicLinkForm,
+  on as MagicLinkVerify,
+  Kr as OpenZone,
+  an as PasswordRecoveryForm,
+  dn as PermissionApiService,
+  Or as Protected,
+  Vr as ProtectedRoute,
+  jr as PublicZone,
+  _t as RoleApiService,
+  Br as RoutingProvider,
+  Q as SessionExpiredError,
+  Ue as SessionManager,
+  nn as SignupForm,
+  Qt as SubscriptionApiService,
+  en as SubscriptionGuard,
+  hn as SubscriptionPlanApiService,
+  Ur as SubscriptionProvider,
+  we as TenantApiService,
+  Zr as TenantAuthenticatedZone,
+  Xr as TenantGuestZone,
+  Yr as TenantOpenZone,
+  Lr as TenantProvider,
+  qr as TenantRoute,
+  un as TenantSelector,
+  Gr as TenantZone,
+  It as TokenRefreshError,
+  Pt as TokenRefreshTimeoutError,
+  Ot as UserApiService,
+  oe as UserType,
+  Jr as UserZone,
+  ce as ZoneRoute,
+  mn as buildRedirectUrl,
+  Ir as useApi,
   Ae as useApp,
-  nn as useAppLoaderState,
-  de as useAuth,
-  Lr as useAuthActions,
-  Oe as useAuthOptional,
-  Ir as useAuthState,
-  qt as useFeatureFlags,
-  Dr as useRouting,
-  Gt as useRoutingOptional,
-  Rr as useSettings,
-  jt as useSubscription,
-  Te as useTenant,
-  ot as useTenantInfo,
+  cn as useAppLoaderState,
+  ue as useAuth,
+  Mr as useAuthActions,
+  qe as useAuthOptional,
+  Dr as useAuthState,
+  Ht as useFeatureFlags,
+  _r as useRouting,
+  Zt as useRoutingOptional,
+  Nr as useSettings,
+  Jt as useSubscription,
+  Se as useTenant,
+  ct as useTenantInfo,
   pe as useTenantOptional,
-  Ar as useTenantSettings,
-  cn as useZoneNavigation
+  Fr as useTenantSettings,
+  fn as useZoneNavigation
 };
 //# sourceMappingURL=index.es.js.map