@yackey-labs/yauth-ui-solidjs 0.12.2 → 0.12.4

package/dist/index.js

@@ -1,17 +1,259 @@
-import { Show as e, addEventListener as t, createComponent as n, delegateEvents as r, effect as i, insert as a, memo as o, template as s } from "solid-js/web";
-import { For as c, Show as l, createContext as u, createEffect as d, createResource as f, createSignal as p, useContext as m } from "solid-js";
-import { startAuthentication as h, startRegistration as g } from "@simplewebauthn/browser";
+import { Show as e, addEventListener as t, classList as n, className as r, createComponent as i, delegateEvents as a, effect as o, insert as s, memo as c, setAttribute as l, template as u, use as d } from "solid-js/web";
+import { For as f, Show as p, createContext as m, createEffect as h, createMemo as g, createResource as _, createSignal as v, onCleanup as y, useContext as b } from "solid-js";
+import { auditExportCreateDestination as x, auditExportDeleteDestination as S, auditExportListDestinationOutbox as C, auditExportListDestinations as w, auditExportUpdateDestination as T } from "@yackey-labs/yauth-client";
+import { startAuthentication as E, startRegistration as D } from "@simplewebauthn/browser";
+//#region src/hooks/create-audit-destinations.ts
+function O(e, t = {}) {
+	let [n, r] = v([]), [i, a] = v(!1), [o, s] = v(!1), [c, l] = v(null), u = async () => {
+		a(!0), l(null);
+		try {
+			let t = e?.();
+			r(await w(t ? { organization_id: t } : { scope: "deployment" }));
+		} catch (e) {
+			l(e instanceof Error ? e.message : "failed to load destinations"), r([]);
+		} finally {
+			a(!1);
+		}
+	};
+	return h(() => {
+		e?.(), u();
+	}), {
+		destinations: n,
+		loading: i,
+		submitting: o,
+		error: c,
+		refresh: u,
+		create: async (e) => {
+			s(!0), l(null);
+			try {
+				let t = await x(e);
+				return await u(), t;
+			} catch (e) {
+				return l(e instanceof Error ? e.message : "create failed"), null;
+			} finally {
+				s(!1);
+			}
+		},
+		disable: async (e) => {
+			s(!0);
+			try {
+				await T(e, { status: "disabled" }), await u();
+			} finally {
+				s(!1);
+			}
+		},
+		remove: async (e) => {
+			s(!0);
+			try {
+				await S(e), await u();
+			} finally {
+				s(!1);
+			}
+		},
+		outbox: async (e, t = 50) => await C(e, { limit: String(t) })
+	};
+}
+//#endregion
+//#region src/components/audit-destination-create.tsx
+var k = /* @__PURE__ */ u("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\"role=alert aria-live=polite>"), ee = /* @__PURE__ */ u("<fieldset class=space-y-2><label class=block><span class=\"text-xs font-medium\">URL</span><input type=url required placeholder=https://hooks.example.com/yauth-audit class=\"mt-1 block w-full rounded-md border border-input bg-transparent px-3 py-1.5 text-sm shadow-sm\"></label><label class=block><span class=\"text-xs font-medium\">Format</span><select class=\"mt-1 block w-full rounded-md border border-input bg-transparent px-3 py-1.5 text-sm shadow-sm\"><option value=json>JSON</option><option value=cef>CEF</option><option value=rfc5424>RFC 5424 syslog body</option></select></label><label class=block><span class=\"text-xs font-medium\">HMAC secret (optional)</span><input type=password placeholder=\"cryptographic random, 32 bytes recommended\"class=\"mt-1 block w-full rounded-md border border-input bg-transparent px-3 py-1.5 text-sm shadow-sm\"><p class=\"mt-1 text-xs text-muted-foreground\">When set, each request carries <code class=font-mono>X-Yauth-Signature: t=&lt;unix&gt;,v1=&lt;hex&gt;</code>. See <code>docs/audit-export/webhook.md</code> for the verifier helper (Node + Python)."), A = /* @__PURE__ */ u("<fieldset class=space-y-2><label class=block><span class=\"text-xs font-medium\">Host</span><input type=text required placeholder=siem.example.internal class=\"mt-1 block w-full rounded-md border border-input bg-transparent px-3 py-1.5 text-sm shadow-sm\"></label><label class=block><span class=\"text-xs font-medium\">Port</span><input type=number required min=1 max=65535 class=\"mt-1 block w-full rounded-md border border-input bg-transparent px-3 py-1.5 text-sm shadow-sm\"></label><label class=block><span class=\"text-xs font-medium\">Transport</span><select class=\"mt-1 block w-full rounded-md border border-input bg-transparent px-3 py-1.5 text-sm shadow-sm\"><option value=tcp>TCP (RFC 6587 octet-counted)</option><option value=udp>UDP (unauthenticated, not recommended)</option><option value=tls>TCP + TLS (port 6514)</option></select></label><label class=block><span class=\"text-xs font-medium\">Facility (0–23)</span><input type=number required min=0 max=23 class=\"mt-1 block w-full rounded-md border border-input bg-transparent px-3 py-1.5 text-sm shadow-sm\">"), j = /* @__PURE__ */ u("<fieldset class=space-y-2><label class=block><span class=\"text-xs font-medium\">Bucket</span><input type=text required class=\"mt-1 block w-full rounded-md border border-input bg-transparent px-3 py-1.5 text-sm shadow-sm\"></label><label class=block><span class=\"text-xs font-medium\">Prefix</span><input type=text class=\"mt-1 block w-full rounded-md border border-input bg-transparent px-3 py-1.5 text-sm shadow-sm\"></label><label class=block><span class=\"text-xs font-medium\">Region</span><input type=text required class=\"mt-1 block w-full rounded-md border border-input bg-transparent px-3 py-1.5 text-sm shadow-sm\"></label><label class=block><span class=\"text-xs font-medium\">Partition</span><select class=\"mt-1 block w-full rounded-md border border-input bg-transparent px-3 py-1.5 text-sm shadow-sm\"><option value=by_date>By date</option><option value=by_org>By org</option><option value=by_date_and_org>By date and org"), te = /* @__PURE__ */ u("<fieldset class=space-y-2><label class=block><span class=\"text-xs font-medium\">HEC URL</span><input type=url required placeholder=https://splunk.example.com:8088 class=\"mt-1 block w-full rounded-md border border-input bg-transparent px-3 py-1.5 text-sm shadow-sm\"></label><label class=block><span class=\"text-xs font-medium\">HEC token</span><input type=password required class=\"mt-1 block w-full rounded-md border border-input bg-transparent px-3 py-1.5 text-sm shadow-sm\">"), M = /* @__PURE__ */ u("<fieldset class=space-y-2><label class=block><span class=\"text-xs font-medium\">Site</span><select class=\"mt-1 block w-full rounded-md border border-input bg-transparent px-3 py-1.5 text-sm shadow-sm\"><option value=datadoghq.com>datadoghq.com (US1)</option><option value=us3.datadoghq.com>us3.datadoghq.com (US3)</option><option value=us5.datadoghq.com>us5.datadoghq.com (US5)</option><option value=datadoghq.eu>datadoghq.eu (EU)</option><option value=ap1.datadoghq.com>ap1.datadoghq.com (AP1)</option><option value=ddog-gov.com>ddog-gov.com (US1-FED)</option></select></label><label class=block><span class=\"text-xs font-medium\">API key</span><input type=password required class=\"mt-1 block w-full rounded-md border border-input bg-transparent px-3 py-1.5 text-sm shadow-sm\">"), N = /* @__PURE__ */ u("<form class=\"space-y-3 rounded-md border border-border p-4\"><h3 class=\"text-base font-semibold\">Add destination</h3><label class=block><span class=\"text-xs font-medium\">Name</span><input type=text required class=\"mt-1 block w-full rounded-md border border-input bg-transparent px-3 py-1.5 text-sm shadow-sm focus:outline-none focus:ring-1 focus:ring-ring\"></label><label class=block><span class=\"text-xs font-medium\">Kind</span><select class=\"mt-1 block w-full rounded-md border border-input bg-transparent px-3 py-1.5 text-sm shadow-sm focus:outline-none focus:ring-1 focus:ring-ring\"><option value=webhook>Webhook (HTTPS POST)</option><option value=syslog>Syslog (RFC 5424)</option><option value=s3>S3-compatible object storage</option><option value=splunk>Splunk HEC</option><option value=datadog>Datadog logs</option></select></label><button type=submit class=\"inline-flex h-9 cursor-pointer items-center justify-center rounded-md bg-primary px-4 text-sm font-medium text-primary-foreground shadow hover:bg-primary/90 disabled:pointer-events-none disabled:opacity-50\">Add destination");
+function P(e) {
+	let { create: t, submitting: n, error: r } = O(() => e.organizationId ?? null), [a, c] = v("webhook"), [l, u] = v(""), [d, f] = v(""), [m, h] = v("json"), [g, _] = v(""), [y, b] = v(""), [x, S] = v(6514), [C, w] = v("tcp"), [T, E] = v(13), [D, P] = v(""), [F, I] = v("audit"), [L, R] = v("us-east-1"), [z, B] = v("by_date"), [V, H] = v(""), [U, W] = v(""), [G, K] = v("datadoghq.com"), [q, J] = v(""), ne = async (n) => {
+		n.preventDefault();
+		let r;
+		switch (a()) {
+			case "webhook":
+				r = {
+					type: "webhook",
+					url: d().trim(),
+					format: m(),
+					hmac_secret: g().trim() || void 0
+				};
+				break;
+			case "syslog":
+				r = {
+					type: "syslog",
+					host: y().trim(),
+					port: x(),
+					transport: C(),
+					facility: T()
+				};
+				break;
+			case "s3":
+				r = {
+					type: "s3",
+					bucket: D().trim(),
+					prefix: F().trim(),
+					region: L().trim(),
+					partition: z()
+				};
+				break;
+			case "splunk":
+				r = {
+					type: "splunk",
+					hec_url: V().trim(),
+					hec_token: U().trim()
+				};
+				break;
+			case "datadog":
+				r = {
+					type: "datadog",
+					site: G().trim(),
+					api_key: q().trim()
+				};
+				break;
+		}
+		await t({
+			name: l().trim(),
+			organization_id: e.organizationId ?? null,
+			kind: r
+		}) && (e.onCreated?.(), u(""), f(""), _(""), b(""), P(""), H(""), W(""), J(""));
+	};
+	return (() => {
+		var e = N(), t = e.firstChild.nextSibling, v = t.firstChild.nextSibling, O = t.nextSibling, Y = O.firstChild.nextSibling, X = O.nextSibling;
+		return e.addEventListener("submit", ne), s(e, i(p, {
+			get when() {
+				return r();
+			},
+			get children() {
+				var e = k();
+				return s(e, r), e;
+			}
+		}), t), v.$$input = (e) => u(e.currentTarget.value), Y.addEventListener("change", (e) => c(e.currentTarget.value)), s(e, i(p, {
+			get when() {
+				return a() === "webhook";
+			},
+			get children() {
+				var e = ee(), t = e.firstChild, n = t.firstChild.nextSibling, r = t.nextSibling, i = r.firstChild.nextSibling, a = r.nextSibling.firstChild.nextSibling;
+				return n.$$input = (e) => f(e.currentTarget.value), i.addEventListener("change", (e) => h(e.currentTarget.value)), a.$$input = (e) => _(e.currentTarget.value), o(() => n.value = d()), o(() => i.value = m()), o(() => a.value = g()), e;
+			}
+		}), X), s(e, i(p, {
+			get when() {
+				return a() === "syslog";
+			},
+			get children() {
+				var e = A(), t = e.firstChild, n = t.firstChild.nextSibling, r = t.nextSibling, i = r.firstChild.nextSibling, a = r.nextSibling, s = a.firstChild.nextSibling, c = a.nextSibling.firstChild.nextSibling;
+				return n.$$input = (e) => b(e.currentTarget.value), i.$$input = (e) => S(Number(e.currentTarget.value) || 0), s.addEventListener("change", (e) => w(e.currentTarget.value)), c.$$input = (e) => E(Number(e.currentTarget.value) || 0), o(() => n.value = y()), o(() => i.value = x()), o(() => s.value = C()), o(() => c.value = T()), e;
+			}
+		}), X), s(e, i(p, {
+			get when() {
+				return a() === "s3";
+			},
+			get children() {
+				var e = j(), t = e.firstChild, n = t.firstChild.nextSibling, r = t.nextSibling, i = r.firstChild.nextSibling, a = r.nextSibling, s = a.firstChild.nextSibling, c = a.nextSibling.firstChild.nextSibling;
+				return n.$$input = (e) => P(e.currentTarget.value), i.$$input = (e) => I(e.currentTarget.value), s.$$input = (e) => R(e.currentTarget.value), c.addEventListener("change", (e) => B(e.currentTarget.value)), o(() => n.value = D()), o(() => i.value = F()), o(() => s.value = L()), o(() => c.value = z()), e;
+			}
+		}), X), s(e, i(p, {
+			get when() {
+				return a() === "splunk";
+			},
+			get children() {
+				var e = te(), t = e.firstChild, n = t.firstChild.nextSibling, r = t.nextSibling.firstChild.nextSibling;
+				return n.$$input = (e) => H(e.currentTarget.value), r.$$input = (e) => W(e.currentTarget.value), o(() => n.value = V()), o(() => r.value = U()), e;
+			}
+		}), X), s(e, i(p, {
+			get when() {
+				return a() === "datadog";
+			},
+			get children() {
+				var e = M(), t = e.firstChild, n = t.firstChild.nextSibling, r = t.nextSibling.firstChild.nextSibling;
+				return n.addEventListener("change", (e) => K(e.currentTarget.value)), r.$$input = (e) => J(e.currentTarget.value), o(() => n.value = G()), o(() => r.value = q()), e;
+			}
+		}), X), o(() => X.disabled = n()), o(() => v.value = l()), o(() => Y.value = a()), e;
+	})();
+}
+a(["input"]);
+//#endregion
+//#region src/components/audit-destination-list.tsx
+var F = /* @__PURE__ */ u("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\"role=alert aria-live=polite>"), I = /* @__PURE__ */ u("<p class=\"text-sm text-muted-foreground\">Loading…"), L = /* @__PURE__ */ u("<ul class=\"divide-y divide-border\">"), R = /* @__PURE__ */ u("<section class=space-y-4><header class=\"flex items-center justify-between\"><h2 class=\"text-lg font-semibold\"></h2><button type=button class=\"inline-flex h-8 cursor-pointer items-center justify-center rounded-md border border-input bg-transparent px-3 text-xs font-medium shadow-sm transition-colors hover:bg-accent hover:text-accent-foreground disabled:pointer-events-none disabled:opacity-50\">Refresh"), z = /* @__PURE__ */ u("<p class=\"text-sm text-muted-foreground\">No destinations configured. Use the “Add destination” form below."), B = /* @__PURE__ */ u("<button type=button class=\"inline-flex h-8 cursor-pointer items-center justify-center rounded-md border border-input bg-transparent px-3 text-xs font-medium shadow-sm hover:bg-accent disabled:pointer-events-none disabled:opacity-50\">Disable"), V = /* @__PURE__ */ u("<li class=\"flex items-start justify-between gap-3 py-3\"><div class=\"min-w-0 flex-1 space-y-1\"><div class=\"flex flex-wrap items-center gap-2\"><span class=font-medium></span><span class=\"rounded-full bg-muted px-2 py-0.5 text-xs uppercase text-muted-foreground\"></span><span></span></div><pre class=\"overflow-x-auto rounded-md bg-muted/50 p-2 text-xs leading-snug\"></pre><p class=\"text-xs text-muted-foreground\">Last success: <!> · Last failure: </p></div><div class=\"flex flex-col gap-2\"><button type=button class=\"inline-flex h-8 cursor-pointer items-center justify-center rounded-md border border-destructive bg-transparent px-3 text-xs font-medium text-destructive shadow-sm hover:bg-destructive/10 disabled:pointer-events-none disabled:opacity-50\">Delete");
+function H(e) {
+	if (!e) return "—";
+	try {
+		return new Date(e).toLocaleString();
+	} catch {
+		return e;
+	}
+}
+function U(e) {
+	let t = g(() => e.organizationId ?? null), { destinations: r, loading: a, error: l, disable: u, remove: d, submitting: m, refresh: h } = O(() => t());
+	return (() => {
+		var t = R(), g = t.firstChild.firstChild, _ = g.nextSibling;
+		return s(g, () => e.organizationId ? "Per-org SIEM destinations" : "Deployment-wide SIEM destinations"), _.$$click = () => void h(), s(t, i(p, {
+			get when() {
+				return l();
+			},
+			get children() {
+				var e = F();
+				return s(e, l), e;
+			}
+		}), null), s(t, i(p, {
+			get when() {
+				return a();
+			},
+			get children() {
+				return I();
+			}
+		}), null), s(t, i(p, {
+			get when() {
+				return c(() => !a())() && r().length > 0;
+			},
+			get fallback() {
+				return i(p, {
+					get when() {
+						return !a();
+					},
+					get children() {
+						return z();
+					}
+				});
+			},
+			get children() {
+				var e = L();
+				return s(e, i(f, {
+					get each() {
+						return r();
+					},
+					children: (e) => (() => {
+						var t = V(), r = t.firstChild, a = r.firstChild, c = a.firstChild, l = c.nextSibling, f = l.nextSibling, h = a.nextSibling, g = h.nextSibling, _ = g.firstChild.nextSibling;
+						_.nextSibling;
+						var v = r.nextSibling, y = v.firstChild;
+						return s(c, () => e.name), s(l, () => e.kind_tag), s(f, () => e.status), s(h, () => JSON.stringify(e.kind, null, 2)), s(g, () => H(e.last_success_at), _), s(g, () => H(e.last_failure_at), null), s(v, i(p, {
+							get when() {
+								return e.status === "active";
+							},
+							get children() {
+								var t = B();
+								return t.$$click = () => void u(e.id), o(() => t.disabled = m()), t;
+							}
+						}), y), y.$$click = () => void d(e.id), o((t) => {
+							var r = {
+								"rounded-full px-2 py-0.5 text-xs": !0,
+								"bg-emerald-500/10 text-emerald-700": e.status === "active",
+								"bg-muted text-muted-foreground": e.status === "disabled"
+							}, i = m();
+							return t.e = n(f, r, t.e), i !== t.t && (y.disabled = t.t = i), t;
+						}, {
+							e: void 0,
+							t: void 0
+						}), t;
+					})()
+				})), e;
+			}
+		}), null), o(() => _.disabled = a() || m()), t;
+	})();
+}
+a(["click"]);
+//#endregion
 //#region src/provider.tsx
-var _ = u(), v = (e) => {
+var W = m(), G = (e) => {
 	if (!e.client && !e.baseUrl) throw Error("YAuthProvider requires either a `client` or `baseUrl` prop");
-	let [t, r] = p(e.client ?? null);
+	let [t, n] = v(e.client ?? null);
 	if (!e.client && e.baseUrl) {
 		let t = e.baseUrl;
 		import("@yackey-labs/yauth-client").then((e) => {
-			r(() => e.createYAuthClient({ baseUrl: t }));
+			n(() => e.createYAuthClient({ baseUrl: t }));
 		});
 	}
-	let i = null, [a, { refetch: o }] = f(async () => {
+	let r = null, [a, { refetch: o }] = _(async () => {
 		let e = t();
 		if (!e) return null;
 		try {
@@ -20,23 +262,23 @@ var _ = u(), v = (e) => {
 			return null;
 		}
 	});
-	d(() => {
+	h(() => {
 		t() && o();
-	}), d(() => {
-		if (!a.loading && i) {
-			let e = i;
-			i = null, e(a() ?? null);
+	}), h(() => {
+		if (!a.loading && r) {
+			let e = r;
+			r = null, e(a() ?? null);
 		}
 	});
 	let s = () => new Promise((e) => {
-		i = e, o();
+		r = e, o();
 	});
-	return n(l, {
+	return i(p, {
 		get when() {
 			return t();
 		},
 		fallback: null,
-		children: (t) => n(_.Provider, {
+		children: (t) => i(W.Provider, {
 			get value() {
 				return {
 					client: t(),
@@ -51,70 +293,70 @@ var _ = u(), v = (e) => {
 		})
 	});
 };
-function y() {
-	let e = m(_);
+function K() {
+	let e = b(W);
 	if (!e) throw Error("useYAuth must be used within a <YAuthProvider>");
 	return e;
 }
 //#endregion
 //#region src/components/change-password-form.tsx
-var b = /* @__PURE__ */ s("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\">"), x = /* @__PURE__ */ s("<div class=\"rounded-md bg-emerald-500/10 px-3 py-2 text-sm text-emerald-600 dark:text-emerald-400\">Password changed successfully."), S = /* @__PURE__ */ s("<form class=space-y-4><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-current-password>Current password</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-current-password name=current_password type=password required autocomplete=current-password></div><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-new-password>New password</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-new-password name=new_password type=password required autocomplete=new-password></div><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-confirm-password>Confirm new password</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-confirm-password name=confirm_password type=password required autocomplete=new-password></div><button class=\"inline-flex h-9 w-full cursor-pointer items-center justify-center rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=submit>"), C = (t) => {
-	let { client: r } = y(), o = r?.emailPassword;
-	if (!o) return null;
-	let [s, c] = p(""), [l, u] = p(""), [d, f] = p(""), [m, h] = p(null), [g, _] = p(!1), [v, C] = p(!1), w = async (e) => {
-		e.preventDefault(), h(null), _(!1);
-		let n = e.currentTarget, r = new FormData(n), i = r.get("current_password") || s(), a = r.get("new_password") || l();
-		if (a !== (r.get("confirm_password") || d())) {
-			h("Passwords do not match");
+var q = /* @__PURE__ */ u("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\">"), J = /* @__PURE__ */ u("<div class=\"rounded-md bg-emerald-500/10 px-3 py-2 text-sm text-emerald-600 dark:text-emerald-400\">Password changed successfully."), ne = /* @__PURE__ */ u("<form class=space-y-4><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-current-password>Current password</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-current-password name=current_password type=password required autocomplete=current-password></div><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-new-password>New password</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-new-password name=new_password type=password required autocomplete=new-password></div><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-confirm-password>Confirm new password</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-confirm-password name=confirm_password type=password required autocomplete=new-password></div><button class=\"inline-flex h-9 w-full cursor-pointer items-center justify-center rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=submit>"), Y = (t) => {
+	let { client: n } = K(), r = n?.emailPassword;
+	if (!r) return null;
+	let [a, c] = v(""), [l, u] = v(""), [d, f] = v(""), [p, m] = v(null), [h, g] = v(!1), [_, y] = v(!1), b = async (e) => {
+		e.preventDefault(), m(null), g(!1);
+		let n = e.currentTarget, i = new FormData(n), o = i.get("current_password") || a(), s = i.get("new_password") || l();
+		if (s !== (i.get("confirm_password") || d())) {
+			m("Passwords do not match");
 			return;
 		}
-		C(!0);
+		y(!0);
 		try {
-			await o.changePassword({
-				current_password: i,
-				new_password: a
-			}), _(!0), c(""), u(""), f(""), t.onSuccess?.();
+			await r.changePassword({
+				current_password: o,
+				new_password: s
+			}), g(!0), c(""), u(""), f(""), t.onSuccess?.();
 		} catch (e) {
 			let n = e instanceof Error ? e : Error(String(e));
-			h(n.message), t.onError?.(n);
+			m(n.message), t.onError?.(n);
 		} finally {
-			C(!1);
+			y(!1);
 		}
 	};
 	return (() => {
-		var t = S(), r = t.firstChild, o = r.firstChild.nextSibling, p = r.nextSibling, h = p.firstChild.nextSibling, _ = p.nextSibling, y = _.firstChild.nextSibling, C = _.nextSibling;
-		return t.addEventListener("submit", w), a(t, n(e, {
+		var t = ne(), n = t.firstChild, r = n.firstChild.nextSibling, m = n.nextSibling, g = m.firstChild.nextSibling, v = m.nextSibling, y = v.firstChild.nextSibling, x = v.nextSibling;
+		return t.addEventListener("submit", b), s(t, i(e, {
 			get when() {
-				return m();
+				return p();
 			},
 			get children() {
-				var e = b();
-				return a(e, m), e;
+				var e = q();
+				return s(e, p), e;
 			}
-		}), r), a(t, n(e, {
+		}), n), s(t, i(e, {
 			get when() {
-				return g();
+				return h();
 			},
 			get children() {
-				return x();
+				return J();
 			}
-		}), r), o.$$input = (e) => c(e.currentTarget.value), h.$$input = (e) => u(e.currentTarget.value), y.$$input = (e) => f(e.currentTarget.value), a(C, () => v() ? "Changing password..." : "Change password"), i((e) => {
-			var t = v(), n = v(), r = v(), i = v();
-			return t !== e.e && (o.disabled = e.e = t), n !== e.t && (h.disabled = e.t = n), r !== e.a && (y.disabled = e.a = r), i !== e.o && (C.disabled = e.o = i), e;
+		}), n), r.$$input = (e) => c(e.currentTarget.value), g.$$input = (e) => u(e.currentTarget.value), y.$$input = (e) => f(e.currentTarget.value), s(x, () => _() ? "Changing password..." : "Change password"), o((e) => {
+			var t = _(), n = _(), i = _(), a = _();
+			return t !== e.e && (r.disabled = e.e = t), n !== e.t && (g.disabled = e.t = n), i !== e.a && (y.disabled = e.a = i), a !== e.o && (x.disabled = e.o = a), e;
 		}, {
 			e: void 0,
 			t: void 0,
 			a: void 0,
 			o: void 0
-		}), i(() => o.value = s()), i(() => h.value = l()), i(() => y.value = d()), t;
+		}), o(() => r.value = a()), o(() => g.value = l()), o(() => y.value = d()), t;
 	})();
 };
-r(["input"]);
+a(["input"]);
 //#endregion
 //#region src/components/consent-screen.tsx
-var w = /* @__PURE__ */ s("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\">"), T = /* @__PURE__ */ s("<div class=\"rounded-md border p-4 space-y-3\"><p class=\"text-sm font-medium\">This application is requesting the following permissions:</p><ul class=space-y-2>"), E = /* @__PURE__ */ s("<div class=\"mx-auto max-w-md space-y-6 p-6\"><div class=\"space-y-2 text-center\"><h2 class=\"text-2xl font-semibold tracking-tight\">Authorize </h2><p class=\"text-sm text-muted-foreground\"><strong></strong> is requesting access to your account.</p></div><div class=\"flex gap-3\"><button class=\"inline-flex h-9 flex-1 cursor-pointer items-center justify-center rounded-md border border-input bg-background px-4 py-2 text-sm font-medium shadow-sm transition-colors hover:bg-accent hover:text-accent-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=button>Deny</button><button class=\"inline-flex h-9 flex-1 cursor-pointer items-center justify-center rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=button></button></div><p class=\"text-center text-xs text-muted-foreground\">By authorizing, you allow this application to access your account with the permissions listed above."), D = /* @__PURE__ */ s("<li class=\"flex items-center gap-2 text-sm\"><svg class=\"h-4 w-4 text-primary\"fill=none stroke=currentColor viewBox=\"0 0 24 24\"aria-label=Checkmark role=img><path stroke-linecap=round stroke-linejoin=round stroke-width=2 d=\"M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118 0z\"></path></svg><span>"), O = (t) => {
-	let [r, s] = p(!1), [l, u] = p(null), d = async (e) => {
-		u(null), s(!0);
+var X = /* @__PURE__ */ u("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\">"), re = /* @__PURE__ */ u("<div class=\"rounded-md border p-4 space-y-3\"><p class=\"text-sm font-medium\">This application is requesting the following permissions:</p><ul class=space-y-2>"), ie = /* @__PURE__ */ u("<div class=\"mx-auto max-w-md space-y-6 p-6\"><div class=\"space-y-2 text-center\"><h2 class=\"text-2xl font-semibold tracking-tight\">Authorize </h2><p class=\"text-sm text-muted-foreground\"><strong></strong> is requesting access to your account.</p></div><div class=\"flex gap-3\"><button class=\"inline-flex h-9 flex-1 cursor-pointer items-center justify-center rounded-md border border-input bg-background px-4 py-2 text-sm font-medium shadow-sm transition-colors hover:bg-accent hover:text-accent-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=button>Deny</button><button class=\"inline-flex h-9 flex-1 cursor-pointer items-center justify-center rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=button></button></div><p class=\"text-center text-xs text-muted-foreground\">By authorizing, you allow this application to access your account with the permissions listed above."), ae = /* @__PURE__ */ u("<li class=\"flex items-center gap-2 text-sm\"><svg class=\"h-4 w-4 text-primary\"fill=none stroke=currentColor viewBox=\"0 0 24 24\"aria-label=Checkmark role=img><path stroke-linecap=round stroke-linejoin=round stroke-width=2 d=\"M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118 0z\"></path></svg><span>"), oe = (t) => {
+	let [n, r] = v(!1), [a, l] = v(null), u = async (e) => {
+		l(null), r(!0);
 		try {
 			let n = t.authBaseUrl ?? "/api/auth", r = await fetch(`${n}/authorize`, {
 				method: "POST",
@@ -147,116 +389,623 @@ var w = /* @__PURE__ */ s("<div class=\"rounded-md bg-destructive/10 px-3 py-2 t
 			t.onSubmit?.(e);
 		} catch (e) {
 			let n = e instanceof Error ? e : Error(String(e));
-			u(n.message), t.onError?.(n);
+			l(n.message), t.onError?.(n);
 		} finally {
-			s(!1);
+			r(!1);
 		}
-	}, f = () => t.clientName ?? t.clientId;
+	}, d = () => t.clientName ?? t.clientId;
 	return (() => {
-		var s = E(), u = s.firstChild, p = u.firstChild;
+		var r = ie(), l = r.firstChild, p = l.firstChild;
 		p.firstChild;
-		var m = p.nextSibling.firstChild, h = u.nextSibling, g = h.firstChild, _ = g.nextSibling;
-		return a(p, f, null), a(m, f), a(s, n(e, {
+		var m = p.nextSibling.firstChild, h = l.nextSibling, g = h.firstChild, _ = g.nextSibling;
+		return s(p, d, null), s(m, d), s(r, i(e, {
 			get when() {
-				return l();
+				return a();
 			},
 			get children() {
-				var e = w();
-				return a(e, l), e;
+				var e = X();
+				return s(e, a), e;
 			}
-		}), h), a(s, n(e, {
+		}), h), s(r, i(e, {
 			get when() {
-				return o(() => !!t.scopes)() && t.scopes.length > 0;
+				return c(() => !!t.scopes)() && t.scopes.length > 0;
 			},
 			get children() {
-				var e = T(), r = e.firstChild.nextSibling;
-				return a(r, n(c, {
+				var e = re(), n = e.firstChild.nextSibling;
+				return s(n, i(f, {
 					get each() {
 						return t.scopes;
 					},
 					children: (e) => (() => {
-						var t = D(), n = t.firstChild.nextSibling;
-						return a(n, e), t;
+						var t = ae(), n = t.firstChild.nextSibling;
+						return s(n, e), t;
 					})()
 				})), e;
 			}
-		}), h), g.$$click = () => d(!1), _.$$click = () => d(!0), a(_, () => r() ? "Authorizing..." : "Authorize"), i((e) => {
-			var t = r(), n = r();
-			return t !== e.e && (g.disabled = e.e = t), n !== e.t && (_.disabled = e.t = n), e;
+		}), h), g.$$click = () => u(!1), _.$$click = () => u(!0), s(_, () => n() ? "Authorizing..." : "Authorize"), o((e) => {
+			var t = n(), r = n();
+			return t !== e.e && (g.disabled = e.e = t), r !== e.t && (_.disabled = e.t = r), e;
 		}, {
 			e: void 0,
 			t: void 0
-		}), s;
+		}), r;
 	})();
 };
-r(["click"]);
+a(["click"]);
+//#endregion
+//#region src/hooks/create-organizations.ts
+function Z(e) {
+	return e.toLowerCase().trim().replace(/[^a-z0-9\s-]/g, "").replace(/\s+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "").slice(0, 64);
+}
+function Q() {
+	let { client: e } = K(), [t, n] = v([]), [r, i] = v(!1), [a, o] = v(null), s = async () => {
+		if (!e?.organizations) {
+			o("Organizations feature is not enabled on this server.");
+			return;
+		}
+		i(!0), o(null);
+		try {
+			n(await e.organizations.list());
+		} catch (e) {
+			o(e instanceof Error ? e.message : String(e));
+		} finally {
+			i(!1);
+		}
+	};
+	return s(), {
+		organizations: t,
+		loading: r,
+		error: a,
+		refetch: s,
+		create: async (r) => {
+			if (!e?.organizations) return o("Organizations feature is not enabled on this server."), null;
+			o(null);
+			try {
+				let i = await e.organizations.create(r);
+				return n([...t(), i]), i;
+			} catch (e) {
+				return o(e instanceof Error ? e.message : String(e)), null;
+			}
+		},
+		remove: async (r) => {
+			if (!e?.organizations) return o("Organizations feature is not enabled on this server."), !1;
+			o(null);
+			try {
+				return await e.organizations.delete(r), n(t().filter((e) => e.id !== r)), !0;
+			} catch (e) {
+				return o(e instanceof Error ? e.message : String(e)), !1;
+			}
+		}
+	};
+}
+function se(e) {
+	let { client: t } = K(), [n, r] = v(null), [i, a] = v(!1), [o, s] = v(null), c = async () => {
+		let n = e();
+		if (!n) {
+			r(null);
+			return;
+		}
+		if (!t?.organizations) {
+			s("Organizations feature is not enabled on this server.");
+			return;
+		}
+		a(!0), s(null);
+		try {
+			r(await t.organizations.get(n));
+		} catch (e) {
+			s(e instanceof Error ? e.message : String(e)), r(null);
+		} finally {
+			a(!1);
+		}
+	};
+	return c(), {
+		organization: n,
+		loading: i,
+		error: o,
+		refetch: c,
+		update: async (n) => {
+			let i = e();
+			if (!i || !t?.organizations) return null;
+			s(null);
+			try {
+				let e = await t.organizations.update(i, n);
+				return r(e), e;
+			} catch (e) {
+				return s(e instanceof Error ? e.message : String(e)), null;
+			}
+		}
+	};
+}
+function ce(e) {
+	let { client: t } = K(), [n, r] = v([]), [i, a] = v(!1), [o, s] = v(null), c = async () => {
+		let n = e();
+		if (!n) {
+			r([]);
+			return;
+		}
+		if (!t?.organizations) {
+			s("Organizations feature is not enabled on this server.");
+			return;
+		}
+		a(!0), s(null);
+		try {
+			r(await t.organizations.listMembers(n));
+		} catch (e) {
+			s(e instanceof Error ? e.message : String(e));
+		} finally {
+			a(!1);
+		}
+	};
+	return c(), {
+		members: n,
+		loading: i,
+		error: o,
+		refetch: c,
+		invite: async (n) => {
+			let r = e();
+			if (!r || !t?.organizations) return null;
+			s(null);
+			try {
+				return await t.organizations.createInvitation(r, n);
+			} catch (e) {
+				return s(e instanceof Error ? e.message : String(e)), null;
+			}
+		}
+	};
+}
+function le() {
+	let { client: e } = K(), [t, n] = v(!1), [r, i] = v(null);
+	return {
+		submitting: t,
+		error: r,
+		accept: async (t) => {
+			if (!e?.organizations) return i("Organizations feature is not enabled on this server."), null;
+			if (!t.trim()) return i("Invitation token is required."), null;
+			n(!0), i(null);
+			try {
+				return await e.organizations.acceptInvitation({ token: t });
+			} catch (e) {
+				return i(e instanceof Error ? e.message : String(e)), null;
+			} finally {
+				n(!1);
+			}
+		}
+	};
+}
+var $ = {
+	OWNER: "owner",
+	ADMIN: "admin",
+	BILLING_ADMIN: "billing_admin",
+	MEMBER: "member",
+	VIEWER: "viewer"
+};
+function ue(e) {
+	let { client: t } = K(), [n, r] = v(null), [i, a] = v(!1), [o, s] = v(null), c = async () => {
+		let n = e();
+		if (!n) {
+			r(null);
+			return;
+		}
+		if (!t?.organizations) {
+			s("Organizations feature is not enabled on this server.");
+			return;
+		}
+		a(!0), s(null);
+		try {
+			r(await t.organizations.listPermissions(n));
+		} catch (e) {
+			s(e instanceof Error ? e.message : String(e));
+		} finally {
+			a(!1);
+		}
+	};
+	return h(() => {
+		e(), c();
+	}), {
+		permissions: n,
+		loading: i,
+		error: o,
+		refetch: c,
+		hasPermission: (e) => n()?.permissions.includes(e) ?? !1,
+		isRole: (e) => n()?.role === e
+	};
+}
+function de(e) {
+	let { client: t } = K(), [n, r] = v(!1), [i, a] = v(null);
+	return {
+		submitting: n,
+		error: i,
+		changeRole: async (n, i) => {
+			let o = e();
+			if (!o || !t?.organizations) return null;
+			r(!0), a(null);
+			try {
+				return await t.organizations.changeRole(o, n, i);
+			} catch (e) {
+				return a(e instanceof Error ? e.message : String(e)), null;
+			} finally {
+				r(!1);
+			}
+		},
+		removeMember: async (n) => {
+			let i = e();
+			if (!i || !t?.organizations) return !1;
+			r(!0), a(null);
+			try {
+				return await t.organizations.removeMember(i, n), !0;
+			} catch (e) {
+				return a(e instanceof Error ? e.message : String(e)), !1;
+			} finally {
+				r(!1);
+			}
+		},
+		transferOwnership: async (n) => {
+			let i = e();
+			if (!i || !t?.organizations) return !1;
+			r(!0), a(null);
+			try {
+				return await t.organizations.transferOwnership(i, n), !0;
+			} catch (e) {
+				return a(e instanceof Error ? e.message : String(e)), !1;
+			} finally {
+				r(!1);
+			}
+		}
+	};
+}
+function fe(e) {
+	let { client: t } = K(), [n, r] = v([]), [i, a] = v(!1), [o, s] = v(!1), [c, l] = v(null), [u, d] = v(null), f = async () => {
+		let n = e();
+		if (!n) {
+			r([]);
+			return;
+		}
+		if (!t?.organizations) {
+			l("Organizations feature is not enabled on this server.");
+			return;
+		}
+		a(!0), l(null);
+		try {
+			r(await t.organizations.listDomains(n));
+		} catch (e) {
+			l(e instanceof Error ? e.message : String(e));
+		} finally {
+			a(!1);
+		}
+	};
+	return h(() => {
+		e(), f();
+	}), {
+		domains: n,
+		loading: i,
+		submitting: o,
+		error: c,
+		lastCreated: u,
+		refetch: f,
+		claim: async (n) => {
+			let r = e();
+			if (!r || !t?.organizations) return null;
+			s(!0), l(null);
+			try {
+				let e = await t.organizations.createDomain(r, n);
+				return d(e), await f(), e;
+			} catch (e) {
+				return l(e instanceof Error ? e.message : String(e)), null;
+			} finally {
+				s(!1);
+			}
+		},
+		verify: async (n) => {
+			let r = e();
+			if (!r || !t?.organizations) return null;
+			s(!0), l(null);
+			try {
+				let e = await t.organizations.verifyDomain(r, n);
+				return await f(), e;
+			} catch (e) {
+				return l(e instanceof Error ? e.message : String(e)), null;
+			} finally {
+				s(!1);
+			}
+		},
+		update: async (n, r) => {
+			let i = e();
+			if (!i || !t?.organizations) return null;
+			s(!0), l(null);
+			try {
+				let e = await t.organizations.updateDomain(i, n, r);
+				return await f(), e;
+			} catch (e) {
+				return l(e instanceof Error ? e.message : String(e)), null;
+			} finally {
+				s(!1);
+			}
+		},
+		remove: async (n) => {
+			let r = e();
+			if (!r || !t?.organizations) return !1;
+			s(!0), l(null);
+			try {
+				return await t.organizations.deleteDomain(r, n), await f(), !0;
+			} catch (e) {
+				return l(e instanceof Error ? e.message : String(e)), !1;
+			} finally {
+				s(!1);
+			}
+		}
+	};
+}
 //#endregion
-//#region src/components/forgot-password-form.tsx
-var k = /* @__PURE__ */ s("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\">"), A = /* @__PURE__ */ s("<div class=\"rounded-md bg-emerald-500/10 px-3 py-2 text-sm text-emerald-600 dark:text-emerald-400\">"), j = /* @__PURE__ */ s("<form class=space-y-4><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-forgot-password-email>Email</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-forgot-password-email name=email type=email required autocomplete=email></div><button class=\"inline-flex h-9 w-full cursor-pointer items-center justify-center rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=submit>"), M = (t) => {
-	let { client: r } = y(), o = r?.emailPassword;
-	if (!o) return null;
-	let [s, c] = p(""), [l, u] = p(null), [d, f] = p(null), [m, h] = p(!1), g = async (e) => {
-		e.preventDefault(), u(null), f(null), h(!0);
+//#region src/components/domain-claim.tsx
+var pe = /* @__PURE__ */ u("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\"role=alert aria-live=polite>"), me = /* @__PURE__ */ u("<form class=space-y-4><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-domain-input>Domain</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-domain-input name=domain type=text placeholder=acme.com required autocomplete=off></div><label class=\"flex items-center gap-2 text-sm\"><input type=checkbox>Auto-join matching users on signup</label><label class=\"flex items-center gap-2 text-sm\"><input type=checkbox>Require verified email before auto-join</label><button class=\"inline-flex h-9 w-full cursor-pointer items-center justify-center rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=submit>"), he = /* @__PURE__ */ u("<div class=\"rounded-md border border-input bg-muted/40 p-3 space-y-2\"><p class=\"text-xs text-muted-foreground\">Publish the following DNS TXT record to verify ownership. The token is shown ONCE — copy it now.</p><div><span class=\"text-xs font-medium\">Record</span><code class=\"mt-1 block break-all font-mono text-xs\"></code></div><div><span class=\"text-xs font-medium\">Value</span><code class=\"mt-1 block break-all font-mono text-xs\">"), ge = (e) => /^[a-z0-9.-]+\.[a-z]{2,}$/i.test(e.trim()), _e = (e) => {
+	let { claim: n, lastCreated: r, error: a, submitting: c } = fe(() => e.organizationId), [l, u] = v(""), [d, f] = v(!1), [m, h] = v(!0), g = async (t) => {
+		t.preventDefault();
+		let r = l().trim().toLowerCase();
+		if (!ge(r)) return;
+		let i = await n({
+			domain: r,
+			auto_join_on_signup: d(),
+			require_email_verified: m()
+		});
+		i ? (u(""), e.onSuccess?.(i)) : a() && e.onError?.(Error(a()));
+	};
+	return (() => {
+		var e = me(), n = e.firstChild, _ = n.firstChild.nextSibling, v = n.nextSibling, y = v.firstChild, b = v.nextSibling, x = b.firstChild, S = b.nextSibling;
+		return t(e, "submit", g), s(e, i(p, {
+			get when() {
+				return a();
+			},
+			get children() {
+				var e = pe();
+				return s(e, a), e;
+			}
+		}), n), t(_, "input", (e) => u(e.currentTarget.value)), t(y, "change", (e) => f(e.currentTarget.checked)), t(x, "change", (e) => h(e.currentTarget.checked)), s(S, () => c() ? "Claiming…" : "Claim domain"), s(e, i(p, {
+			get when() {
+				return r();
+			},
+			children: (e) => (() => {
+				var t = he(), n = t.firstChild.nextSibling, r = n.firstChild.nextSibling, i = n.nextSibling.firstChild.nextSibling;
+				return s(r, () => e().dns_record_name), s(i, () => e().verification_token), t;
+			})()
+		}), null), o((e) => {
+			var t = c(), n = c(), r = c(), i = c() || !ge(l().trim());
+			return t !== e.e && (_.disabled = e.e = t), n !== e.t && (y.disabled = e.t = n), r !== e.a && (x.disabled = e.a = r), i !== e.o && (S.disabled = e.o = i), e;
+		}, {
+			e: void 0,
+			t: void 0,
+			a: void 0,
+			o: void 0
+		}), o(() => _.value = l()), o(() => y.checked = d()), o(() => x.checked = m()), e;
+	})();
+}, ve = /* @__PURE__ */ u("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\"role=alert aria-live=polite>"), ye = /* @__PURE__ */ u("<p class=\"text-sm text-muted-foreground\">Loading domains…"), be = /* @__PURE__ */ u("<p class=\"text-sm text-muted-foreground\">No domains claimed yet."), xe = /* @__PURE__ */ u("<div class=space-y-3><ul class=\"divide-y divide-border\">"), Se = /* @__PURE__ */ u("<button type=button class=\"inline-flex h-8 cursor-pointer items-center justify-center rounded-md border border-input bg-transparent px-3 text-xs font-medium shadow-sm transition-colors hover:bg-accent hover:text-accent-foreground disabled:pointer-events-none disabled:opacity-50\">Verify"), Ce = /* @__PURE__ */ u("<li class=\"flex items-center justify-between gap-3 py-2\"><div class=\"min-w-0 flex-1\"><div class=\"flex items-center gap-2\"><code class=\"font-mono text-sm\"></code><span></span></div><p class=\"text-xs text-muted-foreground\">Auto-join <!> · default role </p></div><div class=\"flex gap-2\"><button type=button class=\"inline-flex h-8 cursor-pointer items-center justify-center rounded-md border border-input bg-transparent px-3 text-xs font-medium text-destructive shadow-sm transition-colors hover:bg-destructive/10 disabled:pointer-events-none disabled:opacity-50\">Remove"), we = {
+	pending: "Pending verification",
+	verified: "Verified",
+	failed: "Verification failed"
+}, Te = (e) => {
+	let { domains: n, loading: a, error: l, verify: u, remove: d, submitting: m } = fe(() => e.organizationId);
+	return (() => {
+		var e = xe(), h = e.firstChild;
+		return s(e, i(p, {
+			get when() {
+				return l();
+			},
+			get children() {
+				var e = ve();
+				return s(e, l), e;
+			}
+		}), h), s(e, i(p, {
+			get when() {
+				return a();
+			},
+			get children() {
+				return ye();
+			}
+		}), h), s(e, i(p, {
+			get when() {
+				return c(() => !a())() && n().length === 0;
+			},
+			get children() {
+				return be();
+			}
+		}), h), s(h, i(f, {
+			get each() {
+				return n();
+			},
+			children: (e) => (() => {
+				var n = Ce(), a = n.firstChild, c = a.firstChild, l = c.firstChild, f = l.nextSibling, h = c.nextSibling, g = h.firstChild.nextSibling;
+				g.nextSibling;
+				var _ = a.nextSibling, v = _.firstChild;
+				return s(l, () => e.domain), s(f, () => we[e.status] ?? e.status), s(h, () => e.auto_join_on_signup ? "on" : "off", g), s(h, () => e.default_role_on_auto_join, null), s(_, i(p, {
+					get when() {
+						return e.status !== "verified";
+					},
+					get children() {
+						var n = Se();
+						return t(n, "click", () => u(e.id)), o(() => n.disabled = m()), n;
+					}
+				}), v), t(v, "click", () => d(e.id)), o((t) => {
+					var n = `rounded-full px-2 py-0.5 text-xs ${e.status === "verified" ? "bg-emerald-500/10 text-emerald-700" : e.status === "failed" ? "bg-destructive/10 text-destructive" : "bg-muted text-muted-foreground"}`, i = m();
+					return n !== t.e && r(f, t.e = n), i !== t.t && (v.disabled = t.t = i), t;
+				}, {
+					e: void 0,
+					t: void 0
+				}), n;
+			})()
+		})), e;
+	})();
+}, Ee = /* @__PURE__ */ u("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\"role=alert aria-live=polite>"), De = /* @__PURE__ */ u("<div class=\"rounded-md bg-amber-500/10 px-3 py-2 text-sm text-amber-700\">Verification did not find the expected DNS TXT record. Double-check the record name + value, then retry."), Oe = /* @__PURE__ */ u("<div class=\"rounded-md bg-emerald-500/10 px-3 py-2 text-sm text-emerald-700\">Domain verified. JIT auto-join is now active for matching users."), ke = /* @__PURE__ */ u("<div class=space-y-3><div class=\"rounded-md border border-input bg-muted/40 p-3 space-y-2\"><p class=\"text-xs text-muted-foreground\">Publish the following DNS TXT record at your DNS provider, then click \"Run verification\". Some DNS providers can take up to 60 seconds to propagate.</p><div><span class=\"text-xs font-medium\">Record</span><code class=\"mt-1 block break-all font-mono text-xs\"></code></div><div><span class=\"text-xs font-medium\">Value</span><code class=\"mt-1 block break-all font-mono text-xs\"></code></div></div><button type=button class=\"inline-flex h-9 w-full cursor-pointer items-center justify-center rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 disabled:pointer-events-none disabled:opacity-50\">"), Ae = (e) => {
+	let { verify: n, error: r, submitting: a } = fe(() => e.organizationId), [l, u] = v(null), d = async () => {
+		let t = await n(e.claim.domain.id);
+		u(t), t?.verified && e.onVerified?.(t);
+	};
+	return (() => {
+		var n = ke(), u = n.firstChild, f = u.firstChild.nextSibling, m = f.firstChild.nextSibling, h = f.nextSibling.firstChild.nextSibling, g = u.nextSibling;
+		return s(m, () => e.claim.dns_record_name), s(h, () => e.claim.verification_token), s(n, i(p, {
+			get when() {
+				return r();
+			},
+			get children() {
+				var e = Ee();
+				return s(e, r), e;
+			}
+		}), g), s(n, i(p, {
+			get when() {
+				return c(() => !!l())() && !l()?.verified;
+			},
+			get children() {
+				return De();
+			}
+		}), g), s(n, i(p, {
+			get when() {
+				return l()?.verified;
+			},
+			get children() {
+				return Oe();
+			}
+		}), g), t(g, "click", d), s(g, () => a() ? "Verifying…" : "Run verification"), o(() => g.disabled = a()), n;
+	})();
+}, je = /* @__PURE__ */ u("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\">"), Me = /* @__PURE__ */ u("<div class=\"rounded-md bg-emerald-500/10 px-3 py-2 text-sm text-emerald-600 dark:text-emerald-400\">"), Ne = /* @__PURE__ */ u("<form class=space-y-4><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-forgot-password-email>Email</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-forgot-password-email name=email type=email required autocomplete=email></div><button class=\"inline-flex h-9 w-full cursor-pointer items-center justify-center rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=submit>"), Pe = (t) => {
+	let { client: n } = K(), r = n?.emailPassword;
+	if (!r) return null;
+	let [a, c] = v(""), [l, u] = v(null), [d, f] = v(null), [p, m] = v(!1), h = async (e) => {
+		e.preventDefault(), u(null), f(null), m(!0);
 		try {
-			let n = e.currentTarget, r = new FormData(n), i = await o.forgotPassword({ email: r.get("email") || s() });
-			f(i.message), t.onSuccess?.(i.message);
+			let n = e.currentTarget, i = new FormData(n), o = await r.forgotPassword({ email: i.get("email") || a() });
+			f(o.message), t.onSuccess?.(o.message);
 		} catch (e) {
 			u((e instanceof Error ? e : Error(String(e))).message);
 		} finally {
-			h(!1);
+			m(!1);
 		}
 	};
 	return (() => {
-		var t = j(), r = t.firstChild, o = r.firstChild.nextSibling, u = r.nextSibling;
-		return t.addEventListener("submit", g), a(t, n(e, {
+		var t = Ne(), n = t.firstChild, r = n.firstChild.nextSibling, u = n.nextSibling;
+		return t.addEventListener("submit", h), s(t, i(e, {
 			get when() {
 				return l();
 			},
 			get children() {
-				var e = k();
-				return a(e, l), e;
+				var e = je();
+				return s(e, l), e;
 			}
-		}), r), a(t, n(e, {
+		}), n), s(t, i(e, {
 			get when() {
 				return d();
 			},
 			get children() {
-				var e = A();
-				return a(e, d), e;
+				var e = Me();
+				return s(e, d), e;
 			}
-		}), r), o.$$input = (e) => c(e.currentTarget.value), a(u, () => m() ? "Sending..." : "Send reset link"), i((e) => {
-			var t = m(), n = m();
-			return t !== e.e && (o.disabled = e.e = t), n !== e.t && (u.disabled = e.t = n), e;
+		}), n), r.$$input = (e) => c(e.currentTarget.value), s(u, () => p() ? "Sending..." : "Send reset link"), o((e) => {
+			var t = p(), n = p();
+			return t !== e.e && (r.disabled = e.e = t), n !== e.t && (u.disabled = e.t = n), e;
 		}, {
 			e: void 0,
 			t: void 0
-		}), i(() => o.value = s()), t;
+		}), o(() => r.value = a()), t;
 	})();
 };
-r(["input"]);
+a(["input"]);
 //#endregion
-//#region src/components/passkey-button.tsx
-var N = /* @__PURE__ */ s("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\">"), P = /* @__PURE__ */ s("<div class=space-y-2><button class=\"inline-flex h-9 w-full cursor-pointer items-center justify-center rounded-md border border-input bg-background px-4 py-2 text-sm font-medium shadow-sm transition-colors hover:bg-accent hover:text-accent-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=button>"), F = (t) => {
-	let { client: r } = y(), s = r?.passkey;
-	if (!s) return null;
-	let [c, l] = p(null), [u, d] = p(!1), f = async () => {
-		let e = await s.loginBegin({ email: t.email ?? void 0 }), n = await h({ optionsJSON: e.options.publicKey });
-		await s.loginFinish({
+//#region src/components/invitation-accept.tsx
+var Fe = /* @__PURE__ */ u("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\"role=alert aria-live=polite>"), Ie = /* @__PURE__ */ u("<div class=\"rounded-md bg-primary/10 px-3 py-2 text-sm\"role=status aria-live=polite>Invitation accepted. Welcome to the organization!"), Le = /* @__PURE__ */ u("<div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-invitation-accept-token>Invitation token</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 font-mono text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-invitation-accept-token name=token type=text required autocomplete=off>"), Re = /* @__PURE__ */ u("<button class=\"inline-flex h-9 w-full cursor-pointer items-center justify-center rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=submit>"), ze = /* @__PURE__ */ u("<form class=space-y-4>"), Be = (n) => {
+	let { accept: r, submitting: a, error: c } = le(), [l, u] = v(n.token ?? ""), [d, f] = v(null), p = async (e) => {
+		e.preventDefault();
+		let t = await r(l().trim());
+		t ? (f(t), n.onSuccess?.(t)) : c() && n.onError?.(Error(c()));
+	};
+	return (() => {
+		var n = ze();
+		return t(n, "submit", p), s(n, i(e, {
+			get when() {
+				return c();
+			},
+			get children() {
+				var e = Fe();
+				return s(e, c), e;
+			}
+		}), null), s(n, i(e, {
+			get when() {
+				return d();
+			},
+			get children() {
+				return Ie();
+			}
+		}), null), s(n, i(e, {
+			get when() {
+				return !d();
+			},
+			get children() {
+				return [(() => {
+					var e = Le(), n = e.firstChild.nextSibling;
+					return t(n, "input", (e) => u(e.currentTarget.value)), o(() => n.disabled = a()), o(() => n.value = l()), e;
+				})(), (() => {
+					var e = Re();
+					return s(e, () => a() ? "Accepting…" : "Accept invitation"), o(() => e.disabled = a() || !l().trim()), e;
+				})()];
+			}
+		}), null), n;
+	})();
+}, Ve = /* @__PURE__ */ u("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\"role=alert aria-live=polite>"), He = /* @__PURE__ */ u("<div class=\"rounded-md border border-input bg-muted/40 p-3\"><p class=\"text-xs text-muted-foreground\">Invitation created. Deliver this token to the invitee — it will not be shown again.</p><code class=\"mt-2 block break-all font-mono text-xs\">"), Ue = /* @__PURE__ */ u("<form class=space-y-4><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-invite-email>Email</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-invite-email name=email type=email required autocomplete=email></div><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-invite-role>Role</label><select class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-invite-role name=role><option value=member>Member</option><option value=admin>Admin</option></select></div><button class=\"inline-flex h-9 w-full cursor-pointer items-center justify-center rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=submit>"), We = (e) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(e), Ge = (n) => {
+	let { invite: r, error: a } = ce(() => n.organizationId), [c, l] = v(""), [u, d] = v("member"), [f, p] = v(!1), [m, h] = v(null), g = async (e) => {
+		e.preventDefault();
+		let t = c().trim();
+		if (!We(t)) return;
+		p(!0);
+		let i = await r({
+			email: t,
+			role: u()
+		});
+		p(!1), i ? (h(i.token), l(""), n.onSuccess?.(i)) : a() && n.onError?.(Error(a()));
+	};
+	return (() => {
+		var n = Ue(), r = n.firstChild, p = r.firstChild.nextSibling, h = r.nextSibling, _ = h.firstChild.nextSibling, v = h.nextSibling;
+		return t(n, "submit", g), s(n, i(e, {
+			get when() {
+				return a();
+			},
+			get children() {
+				var e = Ve();
+				return s(e, a), e;
+			}
+		}), r), t(p, "input", (e) => l(e.currentTarget.value)), t(_, "change", (e) => d(e.currentTarget.value)), s(v, () => f() ? "Sending…" : "Send invitation"), s(n, i(e, {
+			get when() {
+				return m();
+			},
+			get children() {
+				var e = He(), t = e.firstChild.nextSibling;
+				return s(t, m), e;
+			}
+		}), null), o((e) => {
+			var t = f(), n = f(), r = f() || !We(c().trim());
+			return t !== e.e && (p.disabled = e.e = t), n !== e.t && (_.disabled = e.t = n), r !== e.a && (v.disabled = e.a = r), e;
+		}, {
+			e: void 0,
+			t: void 0,
+			a: void 0
+		}), o(() => p.value = c()), o(() => _.value = u()), n;
+	})();
+}, Ke = /* @__PURE__ */ u("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\">"), qe = /* @__PURE__ */ u("<div class=space-y-2><button class=\"inline-flex h-9 w-full cursor-pointer items-center justify-center rounded-md border border-input bg-background px-4 py-2 text-sm font-medium shadow-sm transition-colors hover:bg-accent hover:text-accent-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=button>"), Je = (t) => {
+	let { client: n } = K(), r = n?.passkey;
+	if (!r) return null;
+	let [a, l] = v(null), [u, d] = v(!1), f = async () => {
+		let e = await r.loginBegin({ email: t.email ?? void 0 }), i = await E({ optionsJSON: e.options.publicKey });
+		await r.loginFinish({
 			challenge_id: e.challenge_id,
-			credential: n
+			credential: i
 		});
-		let i = await r.getSession();
-		t.onSuccess?.(i.user);
-	}, m = async () => {
-		let e = await g({ optionsJSON: (await s.registerBegin()).publicKey });
-		await s.registerFinish({
+		let a = await n.getSession();
+		t.onSuccess?.(a.user);
+	}, p = async () => {
+		let e = await D({ optionsJSON: (await r.registerBegin()).publicKey });
+		await r.registerFinish({
 			credential: e,
 			name: "Passkey"
 		}), t.onSuccess?.(void 0);
-	}, _ = async () => {
+	}, m = async () => {
 		l(null), d(!0);
 		try {
-			t.mode === "login" ? await f() : await m();
+			t.mode === "login" ? await f() : await p();
 		} catch (e) {
 			let n = e instanceof Error ? e : Error(String(e));
 			console.error("[yauth] Passkey error:", n), l(n.name === "NotAllowedError" ? "Passkey authentication was cancelled or not available on this device." : n.message), t.onError?.(n);
@@ -265,145 +1014,285 @@ var N = /* @__PURE__ */ s("<div class=\"rounded-md bg-destructive/10 px-3 py-2 t
 		}
 	};
 	return (() => {
-		var r = P(), s = r.firstChild;
-		return a(r, n(e, {
+		var n = qe(), r = n.firstChild;
+		return s(n, i(e, {
 			get when() {
-				return c();
+				return a();
 			},
 			get children() {
-				var e = N();
-				return a(e, c), e;
+				var e = Ke();
+				return s(e, a), e;
 			}
-		}), s), s.$$click = _, a(s, (() => {
-			var e = o(() => !!u());
+		}), r), r.$$click = m, s(r, (() => {
+			var e = c(() => !!u());
 			return () => e() ? t.mode === "login" ? "Authenticating..." : "Registering..." : t.mode === "login" ? "Sign in with passkey" : "Register passkey";
-		})()), i(() => s.disabled = u()), r;
+		})()), o(() => r.disabled = u()), n;
 	})();
 };
-r(["click"]);
+a(["click"]);
 //#endregion
 //#region src/components/login-form.tsx
-var I = /* @__PURE__ */ s("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\">"), L = /* @__PURE__ */ s("<div class=relative><div class=\"absolute inset-0 flex items-center\"style=pointer-events:none><span class=\"w-full border-t\"></span></div><div class=\"relative flex justify-center text-xs uppercase\"><span class=\"bg-background px-2 text-muted-foreground\">or"), R = /* @__PURE__ */ s("<form class=space-y-6><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-login-email>Email</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-login-email name=email type=email required autocomplete=email></div><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-login-password>Password</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-login-password name=password type=password required autocomplete=current-password></div><button class=\"inline-flex h-9 w-full cursor-pointer items-center justify-center rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=submit>"), z = (r) => {
-	let { client: o, refetch: s } = y(), c = o?.emailPassword;
+var Ye = /* @__PURE__ */ u("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\">"), Xe = /* @__PURE__ */ u("<div class=relative><div class=\"absolute inset-0 flex items-center\"style=pointer-events:none><span class=\"w-full border-t\"></span></div><div class=\"relative flex justify-center text-xs uppercase\"><span class=\"bg-background px-2 text-muted-foreground\">or"), Ze = /* @__PURE__ */ u("<form class=space-y-6><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-login-email>Email</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-login-email name=email type=email required autocomplete=email></div><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-login-password>Password</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-login-password name=password type=password required autocomplete=current-password></div><button class=\"inline-flex h-9 w-full cursor-pointer items-center justify-center rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=submit>"), Qe = (n) => {
+	let { client: r, refetch: a } = K(), c = r?.emailPassword;
 	if (!c) return null;
-	let [l, u] = p(""), [d, f] = p(""), [m, h] = p(null), [g, _] = p(!1), v = async (e) => {
-		e.preventDefault(), h(null), _(!0);
+	let [l, u] = v(""), [d, f] = v(""), [p, m] = v(null), [h, g] = v(!1), _ = async (e) => {
+		e.preventDefault(), m(null), g(!0);
 		try {
-			let t = e.currentTarget, n = new FormData(t);
+			let t = e.currentTarget, r = new FormData(t);
 			await c.login({
-				email: n.get("email") || l(),
-				password: n.get("password") || d()
+				email: r.get("email") || l(),
+				password: r.get("password") || d()
 			});
-			let i = await s();
-			r.onSuccess?.(i);
+			let i = await a();
+			n.onSuccess?.(i);
 		} catch (e) {
 			let t = e instanceof Error ? e : Error(String(e));
-			h(t.message), r.onError?.(t);
+			m(t.message), n.onError?.(t);
 		} finally {
-			_(!1);
+			g(!1);
 		}
 	};
 	return (() => {
-		var o = R(), c = o.firstChild, p = c.firstChild.nextSibling, h = c.nextSibling, _ = h.firstChild.nextSibling, y = h.nextSibling;
-		return t(o, "submit", v), a(o, n(e, {
+		var r = Ze(), c = r.firstChild, m = c.firstChild.nextSibling, g = c.nextSibling, v = g.firstChild.nextSibling, y = g.nextSibling;
+		return t(r, "submit", _), s(r, i(e, {
 			get when() {
-				return m();
+				return p();
 			},
 			get children() {
-				var e = I();
-				return a(e, m), e;
+				var e = Ye();
+				return s(e, p), e;
 			}
-		}), c), t(p, "input", (e) => u(e.currentTarget.value)), t(_, "input", (e) => f(e.currentTarget.value)), a(y, () => g() ? "Signing in..." : "Sign in"), a(o, n(e, {
+		}), c), t(m, "input", (e) => u(e.currentTarget.value)), t(v, "input", (e) => f(e.currentTarget.value)), s(y, () => h() ? "Signing in..." : "Sign in"), s(r, i(e, {
 			get when() {
-				return r.showPasskey;
+				return n.showPasskey;
 			},
 			get children() {
-				return [L(), n(F, {
+				return [Xe(), i(Je, {
 					mode: "login",
 					get email() {
 						return l();
 					},
 					onSuccess: (e) => {
-						s(), r.onSuccess?.(e);
+						a(), n.onSuccess?.(e);
 					},
 					get onError() {
-						return r.onError;
+						return n.onError;
 					}
 				})];
 			}
-		}), null), i((e) => {
-			var t = g(), n = g(), r = g();
-			return t !== e.e && (p.disabled = e.e = t), n !== e.t && (_.disabled = e.t = n), r !== e.a && (y.disabled = e.a = r), e;
+		}), null), o((e) => {
+			var t = h(), n = h(), r = h();
+			return t !== e.e && (m.disabled = e.e = t), n !== e.t && (v.disabled = e.t = n), r !== e.a && (y.disabled = e.a = r), e;
 		}, {
 			e: void 0,
 			t: void 0,
 			a: void 0
-		}), i(() => p.value = l()), i(() => _.value = d()), o;
+		}), o(() => m.value = l()), o(() => v.value = d()), r;
 	})();
-}, B = /* @__PURE__ */ s("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\">"), V = /* @__PURE__ */ s("<div class=\"rounded-md bg-emerald-500/10 px-3 py-2 text-sm text-emerald-600 dark:text-emerald-400\">"), H = /* @__PURE__ */ s("<div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-magic-link-email>Email</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-magic-link-email name=email type=email required autocomplete=email placeholder=you@example.com>"), U = /* @__PURE__ */ s("<button class=\"inline-flex h-9 w-full cursor-pointer items-center justify-center rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=submit>"), W = /* @__PURE__ */ s("<form class=space-y-4>"), G = (t) => {
-	let { client: r } = y(), o = r?.magicLink;
-	if (!o) return null;
-	let [s, c] = p(""), [l, u] = p(null), [d, f] = p(null), [m, h] = p(!1), g = async (e) => {
-		e.preventDefault(), u(null), f(null), h(!0);
+}, $e = /* @__PURE__ */ u("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\">"), et = /* @__PURE__ */ u("<div class=\"rounded-md bg-emerald-500/10 px-3 py-2 text-sm text-emerald-600 dark:text-emerald-400\">"), tt = /* @__PURE__ */ u("<div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-magic-link-email>Email</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-magic-link-email name=email type=email required autocomplete=email placeholder=you@example.com>"), nt = /* @__PURE__ */ u("<button class=\"inline-flex h-9 w-full cursor-pointer items-center justify-center rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=submit>"), rt = /* @__PURE__ */ u("<form class=space-y-4>"), it = (t) => {
+	let { client: n } = K(), r = n?.magicLink;
+	if (!r) return null;
+	let [a, c] = v(""), [l, u] = v(null), [d, f] = v(null), [p, m] = v(!1), h = async (e) => {
+		e.preventDefault(), u(null), f(null), m(!0);
 		try {
-			let n = e.currentTarget, r = new FormData(n), i = await o.send({ email: r.get("email") || s() });
-			f(i.message), t.onSuccess?.(i.message);
+			let n = e.currentTarget, i = new FormData(n), o = await r.send({ email: i.get("email") || a() });
+			f(o.message), t.onSuccess?.(o.message);
 		} catch (e) {
 			u((e instanceof Error ? e : Error(String(e))).message);
 		} finally {
-			h(!1);
+			m(!1);
 		}
 	};
 	return (() => {
-		var t = W();
-		return t.addEventListener("submit", g), a(t, n(e, {
+		var t = rt();
+		return t.addEventListener("submit", h), s(t, i(e, {
 			get when() {
 				return l();
 			},
 			get children() {
-				var e = B();
-				return a(e, l), e;
+				var e = $e();
+				return s(e, l), e;
 			}
-		}), null), a(t, n(e, {
+		}), null), s(t, i(e, {
 			get when() {
 				return d();
 			},
 			get children() {
-				var e = V();
-				return a(e, d), e;
+				var e = et();
+				return s(e, d), e;
+			}
+		}), null), s(t, i(e, {
+			get when() {
+				return !d();
+			},
+			get children() {
+				return [(() => {
+					var e = tt(), t = e.firstChild.nextSibling;
+					return t.$$input = (e) => c(e.currentTarget.value), o(() => t.disabled = p()), o(() => t.value = a()), e;
+				})(), (() => {
+					var e = nt();
+					return s(e, () => p() ? "Sending..." : "Send magic link"), o(() => e.disabled = p()), e;
+				})()];
+			}
+		}), null), t;
+	})();
+};
+a(["input"]);
+//#endregion
+//#region src/components/role-selector.tsx
+var at = /* @__PURE__ */ u("<select class=\"rounded-md border border-input bg-background px-3 py-1.5 text-sm focus:outline-none focus:ring-2 focus:ring-ring\"aria-label=\"Member role\"><option>Admin</option><option>Billing admin</option><option>Member</option><option>Viewer"), ot = (e) => (() => {
+	var t = at(), n = t.firstChild, r = n.nextSibling, i = r.nextSibling, a = i.nextSibling;
+	return t.addEventListener("change", (t) => e.onChange(t.currentTarget.value)), o(() => t.disabled = e.disabled), o(() => n.value = $.ADMIN), o(() => r.value = $.BILLING_ADMIN), o(() => i.value = $.MEMBER), o(() => a.value = $.VIEWER), o(() => t.value = e.value), t;
+})(), st = /* @__PURE__ */ u("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\"role=alert aria-live=polite>"), ct = /* @__PURE__ */ u("<div class=\"text-sm text-muted-foreground\">Loading members…"), lt = /* @__PURE__ */ u("<th scope=col class=\"py-2 pr-4 text-right\">Actions"), ut = /* @__PURE__ */ u("<table class=\"w-full text-sm\"aria-label=\"Organization members\"><thead><tr class=\"border-b border-input text-left text-xs font-medium text-muted-foreground\"><th scope=col class=\"py-2 pr-4\">User</th><th scope=col class=\"py-2 pr-4\">Role</th><th scope=col class=\"py-2 pr-4\">Status</th><th scope=col class=\"py-2 pr-4\">Joined</th></tr></thead><tbody>"), dt = /* @__PURE__ */ u("<div class=\"rounded-md border border-dashed border-input px-4 py-6 text-center text-sm text-muted-foreground\">No members yet."), ft = /* @__PURE__ */ u("<div class=space-y-3>"), pt = /* @__PURE__ */ u("<span>"), mt = /* @__PURE__ */ u("<button type=button class=\"rounded-md bg-primary px-2 py-1 text-xs font-medium text-primary-foreground hover:bg-primary/90 disabled:opacity-50\">Save"), ht = /* @__PURE__ */ u("<button type=button class=\"rounded-md border border-input px-2 py-1 text-xs hover:bg-secondary\">Cancel"), gt = /* @__PURE__ */ u("<td class=\"py-2 pr-4 text-right\"><div class=\"inline-flex gap-2\">"), _t = /* @__PURE__ */ u("<tr class=\"border-b border-input/40\"><td class=\"py-2 pr-4 font-mono text-xs\"></td><td class=\"py-2 pr-4\"></td><td class=\"py-2 pr-4 text-xs text-muted-foreground\"></td><td class=\"py-2 pr-4 text-xs text-muted-foreground\">"), vt = /* @__PURE__ */ u("<button type=button class=\"rounded-md border border-input px-2 py-1 text-xs hover:bg-secondary\">Change role"), yt = /* @__PURE__ */ u("<button type=button class=\"rounded-md border border-destructive/40 px-2 py-1 text-xs text-destructive hover:bg-destructive/10\">Remove"), bt = (e) => {
+	if (!e) return "—";
+	let t = new Date(e);
+	return Number.isNaN(t.getTime()) ? "—" : t.toLocaleDateString();
+}, xt = (e) => {
+	switch (e) {
+		case $.OWNER: return "bg-amber-500/15 text-amber-700 dark:text-amber-300";
+		case $.ADMIN: return "bg-blue-500/15 text-blue-700 dark:text-blue-300";
+		case $.BILLING_ADMIN: return "bg-purple-500/15 text-purple-700 dark:text-purple-300";
+		case $.MEMBER: return "bg-secondary text-secondary-foreground";
+		case $.VIEWER: return "bg-muted text-muted-foreground";
+		default: return "bg-secondary text-secondary-foreground";
+	}
+}, St = (e) => {
+	let { members: t, loading: n, error: a, refetch: l } = ce(() => e.organizationId), { hasPermission: u } = ue(() => e.organizationId), { submitting: d, error: m, changeRole: h, removeMember: g } = de(() => e.organizationId), [_, y] = v(null), [b, x] = v(""), S = (e, t) => {
+		y(e), x(t);
+	}, C = () => {
+		y(null), x("");
+	}, w = async (e) => {
+		await h(e, { role: b() }) && (await l(), C());
+	}, T = async (e) => {
+		confirm("Remove this member from the organization?") && await g(e) && await l();
+	}, E = () => u("members:change_role") || u("members:remove");
+	return (() => {
+		var e = ft();
+		return s(e, i(p, {
+			get when() {
+				return a() || m();
+			},
+			get children() {
+				var e = st();
+				return s(e, () => a() || m()), e;
+			}
+		}), null), s(e, i(p, {
+			get when() {
+				return c(() => !!n())() && t().length === 0;
+			},
+			get children() {
+				return ct();
+			}
+		}), null), s(e, i(p, {
+			get when() {
+				return t().length > 0;
+			},
+			get children() {
+				var e = ut(), n = e.firstChild, a = n.firstChild;
+				a.firstChild.nextSibling.nextSibling.nextSibling;
+				var l = n.nextSibling;
+				return s(a, i(p, {
+					get when() {
+						return E();
+					},
+					get children() {
+						return lt();
+					}
+				}), null), s(l, i(f, {
+					get each() {
+						return t();
+					},
+					children: (e) => (() => {
+						var t = _t(), n = t.firstChild, a = n.nextSibling, l = a.nextSibling, f = l.nextSibling;
+						return s(n, () => e.user_id), s(a, i(p, {
+							get when() {
+								return _() !== e.user_id;
+							},
+							get fallback() {
+								return i(ot, {
+									get value() {
+										return b();
+									},
+									get disabled() {
+										return d();
+									},
+									onChange: x
+								});
+							},
+							get children() {
+								var t = pt();
+								return s(t, () => e.role), o(() => r(t, `inline-flex items-center rounded-full px-2 py-0.5 text-xs font-medium ${xt(e.role)}`)), t;
+							}
+						})), s(l, () => e.status), s(f, () => bt(e.joined_at)), s(t, i(p, {
+							get when() {
+								return E();
+							},
+							get children() {
+								var t = gt(), n = t.firstChild;
+								return s(n, i(p, {
+									get when() {
+										return _() === e.user_id;
+									},
+									get fallback() {
+										return [i(p, {
+											get when() {
+												return c(() => !!u("members:change_role"))() && e.role !== $.OWNER;
+											},
+											get children() {
+												var t = vt();
+												return t.$$click = () => S(e.user_id, e.role), t;
+											}
+										}), i(p, {
+											get when() {
+												return c(() => !!u("members:remove"))() && e.role !== $.OWNER;
+											},
+											get children() {
+												var t = yt();
+												return t.$$click = () => T(e.user_id), o(() => t.disabled = d()), t;
+											}
+										})];
+									},
+									get children() {
+										return [(() => {
+											var t = mt();
+											return t.$$click = () => w(e.user_id), o(() => t.disabled = d()), t;
+										})(), (() => {
+											var e = ht();
+											return e.$$click = C, o(() => e.disabled = d()), e;
+										})()];
+									}
+								})), t;
+							}
+						}), null), t;
+					})()
+				})), e;
 			}
-		}), null), a(t, n(e, {
+		}), null), s(e, i(p, {
 			get when() {
-				return !d();
+				return c(() => !n())() && t().length === 0;
 			},
 			get children() {
-				return [(() => {
-					var e = H(), t = e.firstChild.nextSibling;
-					return t.$$input = (e) => c(e.currentTarget.value), i(() => t.disabled = m()), i(() => t.value = s()), e;
-				})(), (() => {
-					var e = U();
-					return a(e, () => m() ? "Sending..." : "Send magic link"), i(() => e.disabled = m()), e;
-				})()];
+				return dt();
 			}
-		}), null), t;
+		}), null), e;
 	})();
 };
-r(["input"]);
+a(["click"]);
 //#endregion
 //#region src/components/mfa-challenge.tsx
-var K = /* @__PURE__ */ s("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\">"), q = /* @__PURE__ */ s("<form class=space-y-4><p class=\"text-sm text-muted-foreground\">Enter the code from your authenticator app, or use a backup code.</p><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-mfa-challenge-code>Verification code</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-mfa-challenge-code name=code type=text inputmode=numeric autocomplete=one-time-code required></div><button class=\"inline-flex h-9 w-full cursor-pointer items-center justify-center rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=submit>"), ee = (t) => {
-	let { client: r } = y(), o = r?.mfa;
-	if (!o) return null;
-	let [s, c] = p(""), [l, u] = p(null), [d, f] = p(!1), m = async (e) => {
+var Ct = /* @__PURE__ */ u("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\">"), wt = /* @__PURE__ */ u("<form class=space-y-4><p class=\"text-sm text-muted-foreground\">Enter the code from your authenticator app, or use a backup code.</p><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-mfa-challenge-code>Verification code</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-mfa-challenge-code name=code type=text inputmode=numeric autocomplete=one-time-code required></div><button class=\"inline-flex h-9 w-full cursor-pointer items-center justify-center rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=submit>"), Tt = (t) => {
+	let { client: n } = K(), r = n?.mfa;
+	if (!r) return null;
+	let [a, c] = v(""), [l, u] = v(null), [d, f] = v(!1), p = async (e) => {
 		e.preventDefault(), u(null), f(!0);
 		try {
-			let n = e.currentTarget, i = new FormData(n);
-			await o.verify({
+			let i = e.currentTarget, o = new FormData(i);
+			await r.verify({
 				pending_session_id: t.pendingSessionId,
-				code: i.get("code") || s()
+				code: o.get("code") || a()
 			});
-			let a = await r.getSession();
-			t.onSuccess?.(a.user);
+			let s = await n.getSession();
+			t.onSuccess?.(s.user);
 		} catch (e) {
 			let n = e instanceof Error ? e : Error(String(e));
 			u(n.message), t.onError?.(n);
@@ -412,259 +1301,528 @@ var K = /* @__PURE__ */ s("<div class=\"rounded-md bg-destructive/10 px-3 py-2 t
 		}
 	};
 	return (() => {
-		var t = q(), r = t.firstChild, o = r.nextSibling, u = o.firstChild.nextSibling, f = o.nextSibling;
-		return t.addEventListener("submit", m), a(t, n(e, {
+		var t = wt(), n = t.firstChild, r = n.nextSibling, u = r.firstChild.nextSibling, f = r.nextSibling;
+		return t.addEventListener("submit", p), s(t, i(e, {
 			get when() {
 				return l();
 			},
 			get children() {
-				var e = K();
-				return a(e, l), e;
+				var e = Ct();
+				return s(e, l), e;
 			}
-		}), r), u.$$input = (e) => c(e.currentTarget.value), a(f, () => d() ? "Verifying..." : "Verify"), i((e) => {
+		}), n), u.$$input = (e) => c(e.currentTarget.value), s(f, () => d() ? "Verifying..." : "Verify"), o((e) => {
 			var t = d(), n = d();
 			return t !== e.e && (u.disabled = e.e = t), n !== e.t && (f.disabled = e.t = n), e;
 		}, {
 			e: void 0,
 			t: void 0
-		}), i(() => u.value = s()), t;
+		}), o(() => u.value = a()), t;
 	})();
 };
-r(["input"]);
+a(["input"]);
 //#endregion
 //#region src/components/mfa-setup.tsx
-var te = /* @__PURE__ */ s("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\">"), ne = /* @__PURE__ */ s("<div class=space-y-4><p class=\"text-sm text-muted-foreground\">Set up two-factor authentication to secure your account.</p><button class=\"inline-flex h-9 w-full cursor-pointer items-center justify-center rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=button>"), re = /* @__PURE__ */ s("<div class=space-y-4><p class=\"text-sm text-muted-foreground\">Add this account to your authenticator app using the URI below, then enter the verification code.</p><div class=space-y-1><span class=\"text-sm font-medium leading-none\">OTP Auth URI</span><code class=\"block w-full break-all rounded-md border border-input bg-muted px-3 py-2 text-xs\"></code></div><div class=space-y-1><span class=\"text-sm font-medium leading-none\">Manual entry key</span><code class=\"block w-full break-all rounded-md border border-input bg-muted px-3 py-2 text-xs font-mono tracking-wider\"></code></div><form class=space-y-4><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-mfa-setup-code>Verification code</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-mfa-setup-code name=code type=text inputmode=numeric autocomplete=one-time-code required></div><button class=\"inline-flex h-9 w-full cursor-pointer items-center justify-center rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=submit>"), J = /* @__PURE__ */ s("<div class=space-y-4><div class=\"rounded-md bg-emerald-500/10 px-3 py-2 text-sm text-emerald-600 dark:text-emerald-400\">Two-factor authentication has been enabled. Save these backup codes in a safe place. Each code can only be used once.</div><ul class=space-y-1>"), Y = /* @__PURE__ */ s("<div class=space-y-4>"), X = /* @__PURE__ */ s("<li class=\"rounded-md border border-input bg-muted px-3 py-1.5 text-center font-mono text-sm tracking-wider\">"), ie = (t) => {
-	let { client: r } = y(), o = r?.mfa;
-	if (!o) return null;
-	let [s, l] = p("begin"), [u, d] = p(""), [f, m] = p(""), [h, g] = p(""), [_, v] = p([]), [b, x] = p(null), [S, C] = p(!1), w = async () => {
-		x(null), C(!0);
+var Et = /* @__PURE__ */ u("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\">"), Dt = /* @__PURE__ */ u("<div class=space-y-4><p class=\"text-sm text-muted-foreground\">Set up two-factor authentication to secure your account.</p><button class=\"inline-flex h-9 w-full cursor-pointer items-center justify-center rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=button>"), Ot = /* @__PURE__ */ u("<div class=space-y-4><p class=\"text-sm text-muted-foreground\">Add this account to your authenticator app using the URI below, then enter the verification code.</p><div class=space-y-1><span class=\"text-sm font-medium leading-none\">OTP Auth URI</span><code class=\"block w-full break-all rounded-md border border-input bg-muted px-3 py-2 text-xs\"></code></div><div class=space-y-1><span class=\"text-sm font-medium leading-none\">Manual entry key</span><code class=\"block w-full break-all rounded-md border border-input bg-muted px-3 py-2 text-xs font-mono tracking-wider\"></code></div><form class=space-y-4><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-mfa-setup-code>Verification code</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-mfa-setup-code name=code type=text inputmode=numeric autocomplete=one-time-code required></div><button class=\"inline-flex h-9 w-full cursor-pointer items-center justify-center rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=submit>"), kt = /* @__PURE__ */ u("<div class=space-y-4><div class=\"rounded-md bg-emerald-500/10 px-3 py-2 text-sm text-emerald-600 dark:text-emerald-400\">Two-factor authentication has been enabled. Save these backup codes in a safe place. Each code can only be used once.</div><ul class=space-y-1>"), At = /* @__PURE__ */ u("<div class=space-y-4>"), jt = /* @__PURE__ */ u("<li class=\"rounded-md border border-input bg-muted px-3 py-1.5 text-center font-mono text-sm tracking-wider\">"), Mt = (t) => {
+	let { client: n } = K(), r = n?.mfa;
+	if (!r) return null;
+	let [a, c] = v("begin"), [l, u] = v(""), [d, p] = v(""), [m, h] = v(""), [g, _] = v([]), [y, b] = v(null), [x, S] = v(!1), C = async () => {
+		b(null), S(!0);
 		try {
-			let e = await o.setup();
-			d(e.otpauth_url), m(e.secret), v(e.backup_codes), l("confirm");
+			let e = await r.setup();
+			u(e.otpauth_url), p(e.secret), _(e.backup_codes), c("confirm");
 		} catch (e) {
-			x((e instanceof Error ? e : Error(String(e))).message);
+			b((e instanceof Error ? e : Error(String(e))).message);
 		} finally {
-			C(!1);
+			S(!1);
 		}
-	}, T = async (e) => {
-		e.preventDefault(), x(null), C(!0);
+	}, w = async (e) => {
+		e.preventDefault(), b(null), S(!0);
 		try {
-			let n = e.currentTarget, r = new FormData(n);
-			await o.confirm({ code: r.get("code") || h() }), l("done"), t.onComplete?.(_());
+			let n = e.currentTarget, i = new FormData(n);
+			await r.confirm({ code: i.get("code") || m() }), c("done"), t.onComplete?.(g());
 		} catch (e) {
-			x((e instanceof Error ? e : Error(String(e))).message);
+			b((e instanceof Error ? e : Error(String(e))).message);
 		} finally {
-			C(!1);
+			S(!1);
 		}
 	};
 	return (() => {
-		var t = Y();
-		return a(t, n(e, {
+		var t = At();
+		return s(t, i(e, {
 			get when() {
-				return b();
+				return y();
 			},
 			get children() {
-				var e = te();
-				return a(e, b), e;
+				var e = Et();
+				return s(e, y), e;
 			}
-		}), null), a(t, n(e, {
+		}), null), s(t, i(e, {
 			get when() {
-				return s() === "begin";
+				return a() === "begin";
 			},
 			get children() {
-				var e = ne(), t = e.firstChild.nextSibling;
-				return t.$$click = w, a(t, () => S() ? "Setting up..." : "Set up 2FA"), i(() => t.disabled = S()), e;
+				var e = Dt(), t = e.firstChild.nextSibling;
+				return t.$$click = C, s(t, () => x() ? "Setting up..." : "Set up 2FA"), o(() => t.disabled = x()), e;
 			}
-		}), null), a(t, n(e, {
+		}), null), s(t, i(e, {
 			get when() {
-				return s() === "confirm";
+				return a() === "confirm";
 			},
 			get children() {
-				var e = re(), t = e.firstChild.nextSibling, n = t.firstChild.nextSibling, r = t.nextSibling, o = r.firstChild.nextSibling, s = r.nextSibling, c = s.firstChild, l = c.firstChild.nextSibling, d = c.nextSibling;
-				return a(n, u), a(o, f), s.addEventListener("submit", T), l.$$input = (e) => g(e.currentTarget.value), a(d, () => S() ? "Verifying..." : "Verify and enable"), i((e) => {
-					var t = S(), n = S();
-					return t !== e.e && (l.disabled = e.e = t), n !== e.t && (d.disabled = e.t = n), e;
+				var e = Ot(), t = e.firstChild.nextSibling, n = t.firstChild.nextSibling, r = t.nextSibling, i = r.firstChild.nextSibling, a = r.nextSibling, c = a.firstChild, u = c.firstChild.nextSibling, f = c.nextSibling;
+				return s(n, l), s(i, d), a.addEventListener("submit", w), u.$$input = (e) => h(e.currentTarget.value), s(f, () => x() ? "Verifying..." : "Verify and enable"), o((e) => {
+					var t = x(), n = x();
+					return t !== e.e && (u.disabled = e.e = t), n !== e.t && (f.disabled = e.t = n), e;
 				}, {
 					e: void 0,
 					t: void 0
-				}), i(() => l.value = h()), e;
+				}), o(() => u.value = m()), e;
 			}
-		}), null), a(t, n(e, {
+		}), null), s(t, i(e, {
 			get when() {
-				return s() === "done";
+				return a() === "done";
 			},
 			get children() {
-				var e = J(), t = e.firstChild.nextSibling;
-				return a(t, n(c, {
+				var e = kt(), t = e.firstChild.nextSibling;
+				return s(t, i(f, {
 					get each() {
-						return _();
+						return g();
 					},
 					children: (e) => (() => {
-						var t = X();
-						return a(t, e), t;
+						var t = jt();
+						return s(t, e), t;
 					})()
 				})), e;
 			}
 		}), null), t;
 	})();
 };
-r(["click", "input"]);
+a(["click", "input"]);
 //#endregion
 //#region src/components/oauth-buttons.tsx
-var ae = /* @__PURE__ */ s("<div class=space-y-2>"), oe = /* @__PURE__ */ s("<button class=\"inline-flex h-9 w-full cursor-pointer items-center justify-center rounded-md border border-input bg-background px-4 py-2 text-sm font-medium shadow-sm transition-colors hover:bg-accent hover:text-accent-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=button>Sign in with "), se = (e) => {
-	let { client: t } = y(), r = t?.oauth;
-	if (!r) return null;
-	let i = (e) => {
-		window.location.href = r.authorize(e);
+var Nt = /* @__PURE__ */ u("<div class=space-y-2>"), Pt = /* @__PURE__ */ u("<button class=\"inline-flex h-9 w-full cursor-pointer items-center justify-center rounded-md border border-input bg-background px-4 py-2 text-sm font-medium shadow-sm transition-colors hover:bg-accent hover:text-accent-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=button>Sign in with "), Ft = (e) => {
+	let { client: t } = K(), n = t?.oauth;
+	if (!n) return null;
+	let r = (e) => {
+		window.location.href = n.authorize(e);
 	};
 	return (() => {
-		var t = ae();
-		return a(t, n(c, {
+		var t = Nt();
+		return s(t, i(f, {
 			get each() {
 				return e.providers;
 			},
 			children: (e) => (() => {
-				var t = oe();
-				return t.firstChild, t.$$click = () => i(e), a(t, () => e.charAt(0).toUpperCase() + e.slice(1), null), t;
+				var t = Pt();
+				return t.firstChild, t.$$click = () => r(e), s(t, () => e.charAt(0).toUpperCase() + e.slice(1), null), t;
 			})()
 		})), t;
 	})();
 };
-r(["click"]);
+a(["click"]);
+//#endregion
+//#region src/components/organization-card.tsx
+var It = /* @__PURE__ */ u("<span class=\"rounded-full bg-secondary px-2 py-0.5 text-xs font-medium text-secondary-foreground\">"), Lt = /* @__PURE__ */ u("<div class=\"shrink-0 text-xs text-muted-foreground\"> "), Rt = /* @__PURE__ */ u("<button class=\"flex w-full items-start justify-between gap-4 rounded-md border border-input bg-card px-4 py-3 text-left text-card-foreground shadow-sm transition-colors hover:bg-accent focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring\"type=button><div class=\"min-w-0 flex-1\"><div class=\"flex items-center gap-2\"><span class=\"truncate text-sm font-medium\"></span></div><div class=\"mt-1 truncate text-xs text-muted-foreground\">@"), zt = (n) => (() => {
+	var r = Rt(), a = r.firstChild.firstChild, o = a.firstChild, l = a.nextSibling;
+	return l.firstChild, t(r, "click", () => n.onSelect?.(n.organization)), s(o, () => n.organization.display_name || n.organization.name), s(a, i(e, {
+		get when() {
+			return n.role;
+		},
+		get children() {
+			var e = It();
+			return s(e, () => n.role), e;
+		}
+	}), null), s(l, () => n.organization.slug, null), s(r, i(e, {
+		get when() {
+			return c(() => n.memberCount !== null)() && n.memberCount !== void 0;
+		},
+		get children() {
+			var e = Lt(), t = e.firstChild;
+			return s(e, () => n.memberCount, t), s(e, () => n.memberCount === 1 ? "member" : "members", null), e;
+		}
+	}), null), r;
+})(), Bt = /* @__PURE__ */ u("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\"role=alert aria-live=polite>"), Vt = /* @__PURE__ */ u("<form class=space-y-6><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-org-create-name>Organization name</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-org-create-name name=name type=text required maxlength=120 autocomplete=organization></div><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-org-create-slug>Slug</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 font-mono text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-org-create-slug name=slug type=text required pattern=[a-z0-9-]+ maxlength=64 aria-describedby=yauth-org-create-slug-hint><p id=yauth-org-create-slug-hint class=\"text-xs text-muted-foreground\">URL-safe identifier. Lowercase letters, numbers, and hyphens only.</p></div><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-org-create-display-name>Display name (optional)</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-org-create-display-name name=display_name type=text maxlength=120></div><button class=\"inline-flex h-9 w-full cursor-pointer items-center justify-center rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=submit>"), Ht = (n) => {
+	let { create: r, error: a } = Q(), [c, l] = v(""), [u, d] = v(""), [f, p] = v(""), [m, g] = v(!1), [_, y] = v(!1);
+	h(() => {
+		let e = Z(c());
+		m() || p(e);
+	});
+	let b = (e) => {
+		g(!0), p(Z(e.currentTarget.value));
+	}, x = async (e) => {
+		if (e.preventDefault(), !c().trim() || !f().trim()) return;
+		y(!0);
+		let t = await r({
+			name: c().trim(),
+			slug: f().trim(),
+			display_name: u().trim() || void 0
+		});
+		y(!1), t ? (n.onSuccess?.(t), l(""), d(""), p(""), g(!1)) : a() && n.onError?.(Error(a()));
+	};
+	return (() => {
+		var n = Vt(), r = n.firstChild, p = r.firstChild.nextSibling, m = r.nextSibling, h = m.firstChild.nextSibling, g = m.nextSibling, v = g.firstChild.nextSibling, y = g.nextSibling;
+		return t(n, "submit", x), s(n, i(e, {
+			get when() {
+				return a();
+			},
+			get children() {
+				var e = Bt();
+				return s(e, a), e;
+			}
+		}), r), t(p, "input", (e) => l(e.currentTarget.value)), t(h, "input", b), t(v, "input", (e) => d(e.currentTarget.value)), s(y, () => _() ? "Creating…" : "Create organization"), o((e) => {
+			var t = _(), n = _(), r = _(), i = _() || !c().trim() || !f().trim();
+			return t !== e.e && (p.disabled = e.e = t), n !== e.t && (h.disabled = e.t = n), r !== e.a && (v.disabled = e.a = r), i !== e.o && (y.disabled = e.o = i), e;
+		}, {
+			e: void 0,
+			t: void 0,
+			a: void 0,
+			o: void 0
+		}), o(() => p.value = c()), o(() => h.value = f()), o(() => v.value = u()), n;
+	})();
+}, Ut = /* @__PURE__ */ u("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\"role=alert aria-live=polite>"), Wt = /* @__PURE__ */ u("<div class=\"text-sm text-muted-foreground\">Loading organization…"), Gt = /* @__PURE__ */ u("<section class=space-y-6>"), Kt = /* @__PURE__ */ u("<div class=space-y-2><h2 class=\"text-lg font-semibold\"></h2><p class=\"font-mono text-xs text-muted-foreground\">@"), qt = /* @__PURE__ */ u("<div class=space-y-3><h3 class=\"text-sm font-semibold uppercase tracking-wide text-muted-foreground\">Members"), Jt = /* @__PURE__ */ u("<div class=space-y-3><h3 class=\"text-sm font-semibold uppercase tracking-wide text-muted-foreground\">Invite a member"), Yt = (t) => {
+	let { organization: n, loading: r, error: a } = se(() => t.organizationId);
+	return (() => {
+		var o = Gt();
+		return s(o, i(e, {
+			get when() {
+				return a();
+			},
+			get children() {
+				var e = Ut();
+				return s(e, a), e;
+			}
+		}), null), s(o, i(e, {
+			get when() {
+				return c(() => !!r())() && !n();
+			},
+			get children() {
+				return Wt();
+			}
+		}), null), s(o, i(e, {
+			get when() {
+				return n();
+			},
+			children: (n) => [
+				(() => {
+					var e = Kt(), t = e.firstChild, r = t.nextSibling;
+					return r.firstChild, s(t, () => n().display_name || n().name), s(r, () => n().slug, null), e;
+				})(),
+				(() => {
+					var e = qt();
+					return e.firstChild, s(e, i(St, { get organizationId() {
+						return n().id;
+					} }), null), e;
+				})(),
+				i(e, {
+					get when() {
+						return t.canInvite !== !1;
+					},
+					get children() {
+						var e = Jt();
+						return e.firstChild, s(e, i(Ge, { get organizationId() {
+							return n().id;
+						} }), null), e;
+					}
+				})
+			]
+		}), null), o;
+	})();
+}, Xt = /* @__PURE__ */ u("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\"role=alert aria-live=polite>"), Zt = /* @__PURE__ */ u("<div class=\"text-sm text-muted-foreground\">Loading organizations…"), Qt = /* @__PURE__ */ u("<div class=\"rounded-md border border-dashed border-input px-4 py-6 text-center text-sm text-muted-foreground\">You're not in any organizations yet."), $t = /* @__PURE__ */ u("<ul class=space-y-2>"), en = /* @__PURE__ */ u("<div class=space-y-3>"), tn = /* @__PURE__ */ u("<li>"), nn = (t) => {
+	let { organizations: n, loading: r, error: a } = Q();
+	return (() => {
+		var o = en();
+		return s(o, i(e, {
+			get when() {
+				return a();
+			},
+			get children() {
+				var e = Xt();
+				return s(e, a), e;
+			}
+		}), null), s(o, i(e, {
+			get when() {
+				return c(() => !!r())() && n().length === 0;
+			},
+			get children() {
+				return Zt();
+			}
+		}), null), s(o, i(e, {
+			get when() {
+				return c(() => !r())() && n().length === 0;
+			},
+			get children() {
+				return Qt();
+			}
+		}), null), s(o, i(e, {
+			get when() {
+				return n().length > 0;
+			},
+			get children() {
+				var e = $t();
+				return s(e, i(f, {
+					get each() {
+						return n();
+					},
+					children: (e) => (() => {
+						var n = tn();
+						return s(n, i(zt, {
+							organization: e,
+							get onSelect() {
+								return t.onSelect;
+							}
+						})), n;
+					})()
+				})), e;
+			}
+		}), null), o;
+	})();
+};
+//#endregion
+//#region src/hooks/create-active-org.ts
+function rn() {
+	let { client: e } = K(), [t, n] = v(null), [r, i] = v([]), [a, o] = v(!1), [s, c] = v(null), l = (e) => {
+		n(e.active_org_id ?? null), i(e.orgs);
+	}, u = async () => {
+		if (!e?.organizations) {
+			c("Organizations feature is not enabled on this server.");
+			return;
+		}
+		o(!0), c(null);
+		try {
+			l(await e.organizations.getActiveOrg());
+		} catch (e) {
+			c(e instanceof Error ? e.message : String(e));
+		} finally {
+			o(!1);
+		}
+	};
+	return u(), {
+		activeOrgId: t,
+		orgs: r,
+		loading: a,
+		error: s,
+		refetch: u,
+		switchTo: async (t) => {
+			if (!e?.organizations) return c("Organizations feature is not enabled on this server."), null;
+			o(!0), c(null);
+			try {
+				let n = { organization_id: t }, r = await e.organizations.setActiveOrg(n);
+				return l(r), r.bearer_access_token ?? null;
+			} catch (e) {
+				return c(e instanceof Error ? e.message : String(e)), null;
+			} finally {
+				o(!1);
+			}
+		},
+		clear: async () => {
+			if (!e?.organizations) return c("Organizations feature is not enabled on this server."), null;
+			o(!0), c(null);
+			try {
+				let t = await e.organizations.clearActiveOrg();
+				return l(t), t.bearer_access_token ?? null;
+			} catch (e) {
+				return c(e instanceof Error ? e.message : String(e)), null;
+			} finally {
+				o(!1);
+			}
+		}
+	};
+}
 //#endregion
-//#region src/components/profile-settings.tsx
-var ce = /* @__PURE__ */ s("<div class=\"text-sm text-muted-foreground\">Loading profile..."), le = /* @__PURE__ */ s("<div class=space-y-8>"), ue = /* @__PURE__ */ s("<dt class=\"font-medium text-muted-foreground\">Display name"), de = /* @__PURE__ */ s("<dd>"), fe = /* @__PURE__ */ s("<section class=space-y-4><h2 class=\"text-lg font-semibold tracking-tight\">Profile</h2><dl class=\"grid grid-cols-[auto_1fr] gap-x-4 gap-y-2 text-sm\"><dt class=\"font-medium text-muted-foreground\">Email</dt><dd></dd><dt class=\"font-medium text-muted-foreground\">Email verified</dt><dd></dd><dt class=\"font-medium text-muted-foreground\">Role</dt><dd>"), Z = /* @__PURE__ */ s("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\">"), pe = /* @__PURE__ */ s("<div class=\"text-sm text-muted-foreground\">Loading passkeys..."), me = /* @__PURE__ */ s("<section class=space-y-4><h2 class=\"text-lg font-semibold tracking-tight\">Passkeys"), he = /* @__PURE__ */ s("<div class=\"text-sm text-muted-foreground\">Loading accounts..."), ge = /* @__PURE__ */ s("<section class=space-y-4><h2 class=\"text-lg font-semibold tracking-tight\">Connected accounts"), _e = /* @__PURE__ */ s("<div class=\"flex gap-2\"><button class=\"inline-flex h-9 cursor-pointer items-center justify-center rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=button></button><button class=\"inline-flex h-9 cursor-pointer items-center justify-center rounded-md border border-input bg-background px-4 py-2 text-sm font-medium shadow-sm transition-colors hover:bg-destructive hover:text-destructive-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=button>"), ve = /* @__PURE__ */ s("<div class=space-y-4><p class=\"text-sm text-muted-foreground\">Add this account to your authenticator app, then enter the verification code.</p><div class=space-y-1><span class=\"text-sm font-medium leading-none\">OTP Auth URI</span><code class=\"block w-full break-all rounded-md border border-input bg-muted px-3 py-2 text-xs\"></code></div><div class=space-y-1><span class=\"text-sm font-medium leading-none\">Manual entry key</span><code class=\"block w-full break-all rounded-md border border-input bg-muted px-3 py-2 text-xs font-mono tracking-wider\"></code></div><form class=space-y-4><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-profile-mfa-code>Verification code</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-profile-mfa-code name=mfa_code type=text inputmode=numeric autocomplete=one-time-code required></div><button class=\"inline-flex h-9 w-full cursor-pointer items-center justify-center rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=submit>"), ye = /* @__PURE__ */ s("<div class=space-y-4><div class=\"rounded-md bg-emerald-500/10 px-3 py-2 text-sm text-emerald-600 dark:text-emerald-400\">Two-factor authentication is enabled. Save these backup codes in a safe place.</div><ul class=space-y-1>"), be = /* @__PURE__ */ s("<section class=space-y-4><h2 class=\"text-lg font-semibold tracking-tight\">Two-factor authentication"), Q = /* @__PURE__ */ s("<ul class=space-y-2>"), xe = /* @__PURE__ */ s("<p class=\"text-sm text-muted-foreground\">No passkeys registered."), Se = /* @__PURE__ */ s("<li class=\"flex items-center justify-between rounded-md border border-input px-3 py-2\"><div class=space-y-0.5><span class=\"text-sm font-medium\"></span><span class=\"block text-xs text-muted-foreground\">Added </span></div><button class=\"inline-flex h-8 cursor-pointer items-center justify-center rounded-md border border-input bg-background px-3 text-xs font-medium shadow-sm transition-colors hover:bg-destructive hover:text-destructive-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=button>"), Ce = /* @__PURE__ */ s("<p class=\"text-sm text-muted-foreground\">No connected accounts."), we = /* @__PURE__ */ s("<li class=\"flex items-center justify-between rounded-md border border-input px-3 py-2\"><div class=space-y-0.5><span class=\"text-sm font-medium\"></span><span class=\"block text-xs text-muted-foreground\">Connected </span></div><button class=\"inline-flex h-8 cursor-pointer items-center justify-center rounded-md border border-input bg-background px-3 text-xs font-medium shadow-sm transition-colors hover:bg-destructive hover:text-destructive-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=button>"), Te = /* @__PURE__ */ s("<li class=\"rounded-md border border-input bg-muted px-3 py-1.5 text-center font-mono text-sm tracking-wider\">"), Ee = () => {
-	let { client: t, user: r, loading: o } = y(), s = t?.passkey, l = t?.oauth, u = t?.mfa, d = !!s, m = !!l, h = !!u, [g, { refetch: _ }] = f(async () => {
-		if (!s) return [];
+//#region src/components/organization-switcher.tsx
+var an = /* @__PURE__ */ u("<div class=\"px-3 py-2 text-sm text-muted-foreground\">No organizations."), on = /* @__PURE__ */ u("<div class=\"absolute z-50 mt-1 max-h-64 w-full overflow-auto rounded-md border border-input bg-popover text-popover-foreground shadow-md\"role=listbox>"), sn = /* @__PURE__ */ u("<div class=\"relative inline-block w-full\"><button class=\"inline-flex h-9 w-full cursor-pointer items-center justify-between gap-2 rounded-md border border-input bg-transparent px-3 py-1 text-sm shadow-sm transition-colors hover:bg-accent focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring\"type=button aria-haspopup=listbox aria-label=\"Switch organization\"><span class=truncate></span><svg class=\"h-4 w-4 shrink-0 opacity-50\"viewBox=\"0 0 24 24\"fill=none stroke=currentColor stroke-width=2 aria-hidden=true><polyline points=\"6 9 12 15 18 9\">"), cn = /* @__PURE__ */ u("<div class=\"truncate font-mono text-xs text-muted-foreground\">@"), ln = /* @__PURE__ */ u("<svg class=\"h-4 w-4 shrink-0\"viewBox=\"0 0 24 24\"fill=none stroke=currentColor stroke-width=2 aria-hidden=true><polyline points=\"20 6 9 17 4 12\">"), un = /* @__PURE__ */ u("<button class=\"flex w-full cursor-pointer items-center justify-between gap-2 px-3 py-2 text-left text-sm hover:bg-accent focus-visible:bg-accent focus-visible:outline-none\"type=button role=option><div class=\"min-w-0 flex-1\"><div class=\"truncate font-medium\">"), dn = (n) => {
+	let { activeOrgId: r, orgs: a, loading: c, switchTo: u } = rn(), [p, m] = v(!1), h, g = () => n.activeId === void 0 ? r() : n.activeId, _ = () => a().find((e) => e.organization_id === g()) ?? null, b = (e) => {
+		h && (h.contains(e.target) || (m(!1), document.removeEventListener("mousedown", b)));
+	}, x = () => {
+		let e = !p();
+		m(e), e ? document.addEventListener("mousedown", b) : document.removeEventListener("mousedown", b);
+	}, S = async (e) => {
+		m(!1), document.removeEventListener("mousedown", b);
+		let t = await u(e.organization_id);
+		n.onSwitch?.(e, t);
+	};
+	return y(() => {
+		document.removeEventListener("mousedown", b);
+	}), (() => {
+		var n = sn(), r = n.firstChild, u = r.firstChild, m = h;
+		return typeof m == "function" ? d(m, n) : h = n, t(r, "click", x), s(u, () => _()?.display_name || _()?.slug || (c() ? "Loading…" : "Select organization")), s(n, i(e, {
+			get when() {
+				return p();
+			},
+			get children() {
+				var n = on();
+				return s(n, i(f, {
+					get each() {
+						return a();
+					},
+					children: (n) => (() => {
+						var r = un(), a = r.firstChild, c = a.firstChild;
+						return t(r, "click", () => void S(n)), s(c, () => n.display_name || n.slug || n.organization_id), s(a, i(e, {
+							get when() {
+								return n.slug;
+							},
+							get children() {
+								var e = cn();
+								return e.firstChild, s(e, () => n.slug, null), e;
+							}
+						}), null), s(r, i(e, {
+							get when() {
+								return n.organization_id === g();
+							},
+							get children() {
+								return ln();
+							}
+						}), null), o(() => l(r, "aria-selected", n.organization_id === g())), r;
+					})()
+				}), null), s(n, i(e, {
+					get when() {
+						return a().length === 0;
+					},
+					get children() {
+						return an();
+					}
+				}), null), n;
+			}
+		}), null), o((e) => {
+			var t = p(), n = c() && a().length === 0;
+			return t !== e.e && l(r, "aria-expanded", e.e = t), n !== e.t && (r.disabled = e.t = n), e;
+		}, {
+			e: void 0,
+			t: void 0
+		}), n;
+	})();
+}, fn = /* @__PURE__ */ u("<div class=\"text-sm text-muted-foreground\">Loading profile..."), pn = /* @__PURE__ */ u("<div class=space-y-8>"), mn = /* @__PURE__ */ u("<dt class=\"font-medium text-muted-foreground\">Display name"), hn = /* @__PURE__ */ u("<dd>"), gn = /* @__PURE__ */ u("<section class=space-y-4><h2 class=\"text-lg font-semibold tracking-tight\">Profile</h2><dl class=\"grid grid-cols-[auto_1fr] gap-x-4 gap-y-2 text-sm\"><dt class=\"font-medium text-muted-foreground\">Email</dt><dd></dd><dt class=\"font-medium text-muted-foreground\">Email verified</dt><dd></dd><dt class=\"font-medium text-muted-foreground\">Role</dt><dd>"), _n = /* @__PURE__ */ u("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\">"), vn = /* @__PURE__ */ u("<div class=\"text-sm text-muted-foreground\">Loading passkeys..."), yn = /* @__PURE__ */ u("<section class=space-y-4><h2 class=\"text-lg font-semibold tracking-tight\">Passkeys"), bn = /* @__PURE__ */ u("<div class=\"text-sm text-muted-foreground\">Loading accounts..."), xn = /* @__PURE__ */ u("<section class=space-y-4><h2 class=\"text-lg font-semibold tracking-tight\">Connected accounts"), Sn = /* @__PURE__ */ u("<div class=\"flex gap-2\"><button class=\"inline-flex h-9 cursor-pointer items-center justify-center rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=button></button><button class=\"inline-flex h-9 cursor-pointer items-center justify-center rounded-md border border-input bg-background px-4 py-2 text-sm font-medium shadow-sm transition-colors hover:bg-destructive hover:text-destructive-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=button>"), Cn = /* @__PURE__ */ u("<div class=space-y-4><p class=\"text-sm text-muted-foreground\">Add this account to your authenticator app, then enter the verification code.</p><div class=space-y-1><span class=\"text-sm font-medium leading-none\">OTP Auth URI</span><code class=\"block w-full break-all rounded-md border border-input bg-muted px-3 py-2 text-xs\"></code></div><div class=space-y-1><span class=\"text-sm font-medium leading-none\">Manual entry key</span><code class=\"block w-full break-all rounded-md border border-input bg-muted px-3 py-2 text-xs font-mono tracking-wider\"></code></div><form class=space-y-4><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-profile-mfa-code>Verification code</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-profile-mfa-code name=mfa_code type=text inputmode=numeric autocomplete=one-time-code required></div><button class=\"inline-flex h-9 w-full cursor-pointer items-center justify-center rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=submit>"), wn = /* @__PURE__ */ u("<div class=space-y-4><div class=\"rounded-md bg-emerald-500/10 px-3 py-2 text-sm text-emerald-600 dark:text-emerald-400\">Two-factor authentication is enabled. Save these backup codes in a safe place.</div><ul class=space-y-1>"), Tn = /* @__PURE__ */ u("<section class=space-y-4><h2 class=\"text-lg font-semibold tracking-tight\">Two-factor authentication"), En = /* @__PURE__ */ u("<ul class=space-y-2>"), Dn = /* @__PURE__ */ u("<p class=\"text-sm text-muted-foreground\">No passkeys registered."), On = /* @__PURE__ */ u("<li class=\"flex items-center justify-between rounded-md border border-input px-3 py-2\"><div class=space-y-0.5><span class=\"text-sm font-medium\"></span><span class=\"block text-xs text-muted-foreground\">Added </span></div><button class=\"inline-flex h-8 cursor-pointer items-center justify-center rounded-md border border-input bg-background px-3 text-xs font-medium shadow-sm transition-colors hover:bg-destructive hover:text-destructive-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=button>"), kn = /* @__PURE__ */ u("<p class=\"text-sm text-muted-foreground\">No connected accounts."), An = /* @__PURE__ */ u("<li class=\"flex items-center justify-between rounded-md border border-input px-3 py-2\"><div class=space-y-0.5><span class=\"text-sm font-medium\"></span><span class=\"block text-xs text-muted-foreground\">Connected </span></div><button class=\"inline-flex h-8 cursor-pointer items-center justify-center rounded-md border border-input bg-background px-3 text-xs font-medium shadow-sm transition-colors hover:bg-destructive hover:text-destructive-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=button>"), jn = /* @__PURE__ */ u("<li class=\"rounded-md border border-input bg-muted px-3 py-1.5 text-center font-mono text-sm tracking-wider\">"), Mn = () => {
+	let { client: t, user: n, loading: r } = K(), a = t?.passkey, c = t?.oauth, l = t?.mfa, u = !!a, d = !!c, p = !!l, [m, { refetch: h }] = _(async () => {
+		if (!a) return [];
 		try {
-			return (await s.list()).items;
+			return (await a.list()).items;
 		} catch {
 			return [];
 		}
-	}), [v, b] = p(null), [x, S] = p(null), [C, { refetch: w }] = f(async () => {
-		if (!l) return [];
+	}), [g, y] = v(null), [b, x] = v(null), [S, { refetch: C }] = _(async () => {
+		if (!c) return [];
 		try {
-			return (await l.accounts()).items;
+			return (await c.accounts()).items;
 		} catch {
 			return [];
 		}
-	}), [T, E] = p(null), [D, O] = p(null), [k, A] = p(""), [j, M] = p(""), [N, P] = p(""), [F, I] = p([]), [L, R] = p("idle"), [z, B] = p(null), [V, H] = p(!1), U = async (e) => {
-		b(null), S(e);
+	}), [w, T] = v(null), [E, D] = v(null), [O, k] = v(""), [ee, A] = v(""), [j, te] = v(""), [M, N] = v([]), [P, F] = v("idle"), [I, L] = v(null), [R, z] = v(!1), B = async (e) => {
+		y(null), x(e);
 		try {
-			await s.delete(e), _();
+			await a.delete(e), h();
 		} catch (e) {
-			b((e instanceof Error ? e : Error(String(e))).message);
+			y((e instanceof Error ? e : Error(String(e))).message);
 		} finally {
-			S(null);
+			x(null);
 		}
-	}, W = async (e) => {
-		E(null), O(e);
+	}, V = async (e) => {
+		T(null), D(e);
 		try {
-			await l.unlink(e), w();
+			await c.unlink(e), C();
 		} catch (e) {
-			E((e instanceof Error ? e : Error(String(e))).message);
+			T((e instanceof Error ? e : Error(String(e))).message);
 		} finally {
-			O(null);
+			D(null);
 		}
-	}, G = async () => {
-		B(null), H(!0);
+	}, H = async () => {
+		L(null), z(!0);
 		try {
-			let e = await u.setup();
-			A(e.otpauth_url), M(e.secret), I(e.backup_codes), R("confirm");
+			let e = await l.setup();
+			k(e.otpauth_url), A(e.secret), N(e.backup_codes), F("confirm");
 		} catch (e) {
-			B((e instanceof Error ? e : Error(String(e))).message);
+			L((e instanceof Error ? e : Error(String(e))).message);
 		} finally {
-			H(!1);
+			z(!1);
 		}
-	}, K = async (e) => {
-		e.preventDefault(), B(null), H(!0);
+	}, U = async (e) => {
+		e.preventDefault(), L(null), z(!0);
 		try {
 			let t = e.currentTarget, n = new FormData(t);
-			await u.confirm({ code: n.get("mfa_code") || N() }), R("done");
+			await l.confirm({ code: n.get("mfa_code") || j() }), F("done");
 		} catch (e) {
-			B((e instanceof Error ? e : Error(String(e))).message);
+			L((e instanceof Error ? e : Error(String(e))).message);
 		} finally {
-			H(!1);
+			z(!1);
 		}
-	}, q = async () => {
-		B(null), H(!0);
+	}, W = async () => {
+		L(null), z(!0);
 		try {
-			await u.disable(), R("idle"), A(""), M(""), P(""), I([]);
+			await l.disable(), F("idle"), k(""), A(""), te(""), N([]);
 		} catch (e) {
-			B((e instanceof Error ? e : Error(String(e))).message);
+			L((e instanceof Error ? e : Error(String(e))).message);
 		} finally {
-			H(!1);
+			z(!1);
 		}
 	};
 	return (() => {
-		var t = le();
-		return a(t, n(e, {
+		var t = pn();
+		return s(t, i(e, {
 			get when() {
-				return o();
+				return r();
 			},
 			get children() {
-				return ce();
+				return fn();
 			}
-		}), null), a(t, n(e, {
+		}), null), s(t, i(e, {
 			get when() {
-				return r();
+				return n();
 			},
 			children: (t) => [
 				(() => {
-					var r = fe(), i = r.firstChild.nextSibling, o = i.firstChild.nextSibling, s = o.nextSibling, c = s.nextSibling, l = c.nextSibling.nextSibling;
-					return a(o, () => t().email), a(i, n(e, {
+					var n = gn(), r = n.firstChild.nextSibling, a = r.firstChild.nextSibling, o = a.nextSibling, c = o.nextSibling, l = c.nextSibling.nextSibling;
+					return s(a, () => t().email), s(r, i(e, {
 						get when() {
 							return t().display_name;
 						},
 						get children() {
-							return [ue(), (() => {
-								var e = de();
-								return a(e, () => t().display_name), e;
+							return [mn(), (() => {
+								var e = hn();
+								return s(e, () => t().display_name), e;
 							})()];
 						}
-					}), s), a(c, () => t().email_verified ? "Yes" : "No"), a(l, () => t().role), r;
+					}), o), s(c, () => t().email_verified ? "Yes" : "No"), s(l, () => t().role), n;
 				})(),
-				n(e, {
-					when: d,
+				i(e, {
+					when: u,
 					get children() {
-						var t = me();
-						return t.firstChild, a(t, n(e, {
+						var t = yn();
+						return t.firstChild, s(t, i(e, {
 							get when() {
-								return v();
+								return g();
 							},
 							get children() {
-								var e = Z();
-								return a(e, v), e;
+								var e = _n();
+								return s(e, g), e;
 							}
-						}), null), a(t, n(e, {
+						}), null), s(t, i(e, {
 							get when() {
-								return g.loading;
+								return m.loading;
 							},
 							get children() {
-								return pe();
+								return vn();
 							}
-						}), null), a(t, n(e, {
+						}), null), s(t, i(e, {
 							get when() {
-								return g();
+								return m();
 							},
-							children: (t) => n(e, {
+							children: (t) => i(e, {
 								get when() {
 									return t().length > 0;
 								},
 								get fallback() {
-									return xe();
+									return Dn();
 								},
 								get children() {
-									var e = Q();
-									return a(e, n(c, {
+									var e = En();
+									return s(e, i(f, {
 										get each() {
 											return t();
 										},
 										children: (e) => (() => {
-											var t = Se(), n = t.firstChild, r = n.firstChild, o = r.nextSibling;
-											o.firstChild;
-											var s = n.nextSibling;
-											return a(r, () => e.name ?? "Unnamed passkey"), a(o, () => new Date(e.created_at).toLocaleDateString(), null), s.$$click = () => U(e.id), a(s, () => x() === e.id ? "Deleting..." : "Delete"), i(() => s.disabled = x() === e.id), t;
+											var t = On(), n = t.firstChild, r = n.firstChild, i = r.nextSibling;
+											i.firstChild;
+											var a = n.nextSibling;
+											return s(r, () => e.name ?? "Unnamed passkey"), s(i, () => new Date(e.created_at).toLocaleDateString(), null), a.$$click = () => B(e.id), s(a, () => b() === e.id ? "Deleting..." : "Delete"), o(() => a.disabled = b() === e.id), t;
 										})()
 									})), e;
 								}
@@ -672,47 +1830,47 @@ var ce = /* @__PURE__ */ s("<div class=\"text-sm text-muted-foreground\">Loading
 						}), null), t;
 					}
 				}),
-				n(e, {
-					when: m,
+				i(e, {
+					when: d,
 					get children() {
-						var t = ge();
-						return t.firstChild, a(t, n(e, {
+						var t = xn();
+						return t.firstChild, s(t, i(e, {
 							get when() {
-								return T();
+								return w();
 							},
 							get children() {
-								var e = Z();
-								return a(e, T), e;
+								var e = _n();
+								return s(e, w), e;
 							}
-						}), null), a(t, n(e, {
+						}), null), s(t, i(e, {
 							get when() {
-								return C.loading;
+								return S.loading;
 							},
 							get children() {
-								return he();
+								return bn();
 							}
-						}), null), a(t, n(e, {
+						}), null), s(t, i(e, {
 							get when() {
-								return C();
+								return S();
 							},
-							children: (t) => n(e, {
+							children: (t) => i(e, {
 								get when() {
 									return t().length > 0;
 								},
 								get fallback() {
-									return Ce();
+									return kn();
 								},
 								get children() {
-									var e = Q();
-									return a(e, n(c, {
+									var e = En();
+									return s(e, i(f, {
 										get each() {
 											return t();
 										},
 										children: (e) => (() => {
-											var t = we(), n = t.firstChild, r = n.firstChild, o = r.nextSibling;
-											o.firstChild;
-											var s = n.nextSibling;
-											return a(r, () => e.provider.charAt(0).toUpperCase() + e.provider.slice(1)), a(o, () => new Date(e.created_at).toLocaleDateString(), null), s.$$click = () => W(e.provider), a(s, () => D() === e.provider ? "Unlinking..." : "Unlink"), i(() => s.disabled = D() === e.provider), t;
+											var t = An(), n = t.firstChild, r = n.firstChild, i = r.nextSibling;
+											i.firstChild;
+											var a = n.nextSibling;
+											return s(r, () => e.provider.charAt(0).toUpperCase() + e.provider.slice(1)), s(i, () => new Date(e.created_at).toLocaleDateString(), null), a.$$click = () => V(e.provider), s(a, () => E() === e.provider ? "Unlinking..." : "Unlink"), o(() => a.disabled = E() === e.provider), t;
 										})()
 									})), e;
 								}
@@ -720,59 +1878,59 @@ var ce = /* @__PURE__ */ s("<div class=\"text-sm text-muted-foreground\">Loading
 						}), null), t;
 					}
 				}),
-				n(e, {
-					when: h,
+				i(e, {
+					when: p,
 					get children() {
-						var t = be();
-						return t.firstChild, a(t, n(e, {
+						var t = Tn();
+						return t.firstChild, s(t, i(e, {
 							get when() {
-								return z();
+								return I();
 							},
 							get children() {
-								var e = Z();
-								return a(e, z), e;
+								var e = _n();
+								return s(e, I), e;
 							}
-						}), null), a(t, n(e, {
+						}), null), s(t, i(e, {
 							get when() {
-								return L() === "idle";
+								return P() === "idle";
 							},
 							get children() {
-								var e = _e(), t = e.firstChild, n = t.nextSibling;
-								return t.$$click = G, a(t, () => V() ? "Setting up..." : "Set up 2FA"), n.$$click = q, a(n, () => V() ? "Disabling..." : "Disable 2FA"), i((e) => {
-									var r = V(), i = V();
+								var e = Sn(), t = e.firstChild, n = t.nextSibling;
+								return t.$$click = H, s(t, () => R() ? "Setting up..." : "Set up 2FA"), n.$$click = W, s(n, () => R() ? "Disabling..." : "Disable 2FA"), o((e) => {
+									var r = R(), i = R();
 									return r !== e.e && (t.disabled = e.e = r), i !== e.t && (n.disabled = e.t = i), e;
 								}, {
 									e: void 0,
 									t: void 0
 								}), e;
 							}
-						}), null), a(t, n(e, {
+						}), null), s(t, i(e, {
 							get when() {
-								return L() === "confirm";
+								return P() === "confirm";
 							},
 							get children() {
-								var e = ve(), t = e.firstChild.nextSibling, n = t.firstChild.nextSibling, r = t.nextSibling, o = r.firstChild.nextSibling, s = r.nextSibling, c = s.firstChild, l = c.firstChild.nextSibling, u = c.nextSibling;
-								return a(n, k), a(o, j), s.addEventListener("submit", K), l.$$input = (e) => P(e.currentTarget.value), a(u, () => V() ? "Verifying..." : "Verify and enable"), i((e) => {
-									var t = V(), n = V();
+								var e = Cn(), t = e.firstChild.nextSibling, n = t.firstChild.nextSibling, r = t.nextSibling, i = r.firstChild.nextSibling, a = r.nextSibling, c = a.firstChild, l = c.firstChild.nextSibling, u = c.nextSibling;
+								return s(n, O), s(i, ee), a.addEventListener("submit", U), l.$$input = (e) => te(e.currentTarget.value), s(u, () => R() ? "Verifying..." : "Verify and enable"), o((e) => {
+									var t = R(), n = R();
 									return t !== e.e && (l.disabled = e.e = t), n !== e.t && (u.disabled = e.t = n), e;
 								}, {
 									e: void 0,
 									t: void 0
-								}), i(() => l.value = N()), e;
+								}), o(() => l.value = j()), e;
 							}
-						}), null), a(t, n(e, {
+						}), null), s(t, i(e, {
 							get when() {
-								return L() === "done";
+								return P() === "done";
 							},
 							get children() {
-								var e = ye(), t = e.firstChild.nextSibling;
-								return a(t, n(c, {
+								var e = wn(), t = e.firstChild.nextSibling;
+								return s(t, i(f, {
 									get each() {
-										return F();
+										return M();
 									},
 									children: (e) => (() => {
-										var t = Te();
-										return a(t, e), t;
+										var t = jn();
+										return s(t, e), t;
 									})()
 								})), e;
 							}
@@ -783,137 +1941,565 @@ var ce = /* @__PURE__ */ s("<div class=\"text-sm text-muted-foreground\">Loading
 		}), null), t;
 	})();
 };
-r(["click", "input"]);
+a(["click", "input"]);
 //#endregion
 //#region src/components/register-form.tsx
-var De = /* @__PURE__ */ s("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\">"), $ = /* @__PURE__ */ s("<form class=space-y-6><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-register-email>Email</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-register-email name=email type=email required autocomplete=email></div><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-register-password>Password</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-register-password name=password type=password required autocomplete=new-password></div><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-register-display-name>Display name (optional)</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-register-display-name name=display_name type=text autocomplete=name></div><button class=\"inline-flex h-9 w-full cursor-pointer items-center justify-center rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=submit>"), Oe = (t) => {
-	let { client: r } = y(), o = r?.emailPassword;
-	if (!o) return null;
-	let [s, c] = p(""), [l, u] = p(""), [d, f] = p(""), [m, h] = p(null), [g, _] = p(!1), v = async (e) => {
-		e.preventDefault(), h(null), _(!0);
+var Nn = /* @__PURE__ */ u("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\">"), Pn = /* @__PURE__ */ u("<form class=space-y-6><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-register-email>Email</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-register-email name=email type=email required autocomplete=email></div><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-register-password>Password</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-register-password name=password type=password required autocomplete=new-password></div><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-register-display-name>Display name (optional)</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-register-display-name name=display_name type=text autocomplete=name></div><button class=\"inline-flex h-9 w-full cursor-pointer items-center justify-center rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=submit>"), Fn = (t) => {
+	let { client: n } = K(), r = n?.emailPassword;
+	if (!r) return null;
+	let [a, c] = v(""), [l, u] = v(""), [d, f] = v(""), [p, m] = v(null), [h, g] = v(!1), _ = async (e) => {
+		e.preventDefault(), m(null), g(!0);
 		try {
-			let n = e.currentTarget, r = new FormData(n), i = r.get("display_name") || d(), a = await o.register({
-				email: r.get("email") || s(),
-				password: r.get("password") || l(),
-				display_name: i || void 0
+			let n = e.currentTarget, i = new FormData(n), o = i.get("display_name") || d(), s = await r.register({
+				email: i.get("email") || a(),
+				password: i.get("password") || l(),
+				display_name: o || void 0
 			});
-			t.onSuccess?.(a.message ?? "");
+			t.onSuccess?.(s.message ?? "");
 		} catch (e) {
 			let n = e instanceof Error ? e : Error(String(e));
-			h(n.message), t.onError?.(n);
+			m(n.message), t.onError?.(n);
 		} finally {
-			_(!1);
+			g(!1);
 		}
 	};
 	return (() => {
-		var t = $(), r = t.firstChild, o = r.firstChild.nextSibling, p = r.nextSibling, h = p.firstChild.nextSibling, _ = p.nextSibling, y = _.firstChild.nextSibling, b = _.nextSibling;
-		return t.addEventListener("submit", v), a(t, n(e, {
+		var t = Pn(), n = t.firstChild, r = n.firstChild.nextSibling, m = n.nextSibling, g = m.firstChild.nextSibling, v = m.nextSibling, y = v.firstChild.nextSibling, b = v.nextSibling;
+		return t.addEventListener("submit", _), s(t, i(e, {
 			get when() {
-				return m();
+				return p();
 			},
 			get children() {
-				var e = De();
-				return a(e, m), e;
+				var e = Nn();
+				return s(e, p), e;
 			}
-		}), r), o.$$input = (e) => c(e.currentTarget.value), h.$$input = (e) => u(e.currentTarget.value), y.$$input = (e) => f(e.currentTarget.value), a(b, () => g() ? "Creating account..." : "Create account"), i((e) => {
-			var t = g(), n = g(), r = g(), i = g();
-			return t !== e.e && (o.disabled = e.e = t), n !== e.t && (h.disabled = e.t = n), r !== e.a && (y.disabled = e.a = r), i !== e.o && (b.disabled = e.o = i), e;
+		}), n), r.$$input = (e) => c(e.currentTarget.value), g.$$input = (e) => u(e.currentTarget.value), y.$$input = (e) => f(e.currentTarget.value), s(b, () => h() ? "Creating account..." : "Create account"), o((e) => {
+			var t = h(), n = h(), i = h(), a = h();
+			return t !== e.e && (r.disabled = e.e = t), n !== e.t && (g.disabled = e.t = n), i !== e.a && (y.disabled = e.a = i), a !== e.o && (b.disabled = e.o = a), e;
 		}, {
 			e: void 0,
 			t: void 0,
 			a: void 0,
 			o: void 0
-		}), i(() => o.value = s()), i(() => h.value = l()), i(() => y.value = d()), t;
+		}), o(() => r.value = a()), o(() => g.value = l()), o(() => y.value = d()), t;
 	})();
 };
-r(["input"]);
+a(["input"]);
 //#endregion
 //#region src/components/reset-password-form.tsx
-var ke = /* @__PURE__ */ s("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\">"), Ae = /* @__PURE__ */ s("<div class=\"rounded-md bg-emerald-500/10 px-3 py-2 text-sm text-emerald-600 dark:text-emerald-400\">"), je = /* @__PURE__ */ s("<form class=space-y-4><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-reset-password-input>New password</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-reset-password-input name=password type=password required autocomplete=new-password></div><button class=\"inline-flex h-9 w-full cursor-pointer items-center justify-center rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=submit>"), Me = (t) => {
-	let { client: r } = y(), o = r?.emailPassword;
-	if (!o) return null;
-	let [s, c] = p(""), [l, u] = p(null), [d, f] = p(null), [m, h] = p(!1), g = async (e) => {
-		e.preventDefault(), u(null), f(null), h(!0);
+var In = /* @__PURE__ */ u("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\">"), Ln = /* @__PURE__ */ u("<div class=\"rounded-md bg-emerald-500/10 px-3 py-2 text-sm text-emerald-600 dark:text-emerald-400\">"), Rn = /* @__PURE__ */ u("<form class=space-y-4><div class=space-y-2><label class=\"text-sm font-medium leading-none\"for=yauth-reset-password-input>New password</label><input class=\"flex h-9 w-full rounded-md border border-input bg-transparent px-3 py-1 text-base shadow-sm transition-colors placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:cursor-not-allowed disabled:opacity-50 md:text-sm\"id=yauth-reset-password-input name=password type=password required autocomplete=new-password></div><button class=\"inline-flex h-9 w-full cursor-pointer items-center justify-center rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground shadow transition-colors hover:bg-primary/90 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-ring disabled:pointer-events-none disabled:opacity-50\"type=submit>"), zn = (t) => {
+	let { client: n } = K(), r = n?.emailPassword;
+	if (!r) return null;
+	let [a, c] = v(""), [l, u] = v(null), [d, f] = v(null), [p, m] = v(!1), h = async (e) => {
+		e.preventDefault(), u(null), f(null), m(!0);
 		try {
-			let n = e.currentTarget, r = new FormData(n), i = await o.resetPassword({
+			let n = e.currentTarget, i = new FormData(n), o = await r.resetPassword({
 				token: t.token,
-				password: r.get("password") || s()
+				password: i.get("password") || a()
 			});
-			f(i.message), t.onSuccess?.(i.message);
+			f(o.message), t.onSuccess?.(o.message);
 		} catch (e) {
 			u((e instanceof Error ? e : Error(String(e))).message);
 		} finally {
-			h(!1);
+			m(!1);
 		}
 	};
 	return (() => {
-		var t = je(), r = t.firstChild, o = r.firstChild.nextSibling, u = r.nextSibling;
-		return t.addEventListener("submit", g), a(t, n(e, {
+		var t = Rn(), n = t.firstChild, r = n.firstChild.nextSibling, u = n.nextSibling;
+		return t.addEventListener("submit", h), s(t, i(e, {
 			get when() {
 				return l();
 			},
 			get children() {
-				var e = ke();
-				return a(e, l), e;
+				var e = In();
+				return s(e, l), e;
 			}
-		}), r), a(t, n(e, {
+		}), n), s(t, i(e, {
 			get when() {
 				return d();
 			},
 			get children() {
-				var e = Ae();
-				return a(e, d), e;
+				var e = Ln();
+				return s(e, d), e;
 			}
-		}), r), o.$$input = (e) => c(e.currentTarget.value), a(u, () => m() ? "Resetting..." : "Reset password"), i((e) => {
-			var t = m(), n = m();
-			return t !== e.e && (o.disabled = e.e = t), n !== e.t && (u.disabled = e.t = n), e;
+		}), n), r.$$input = (e) => c(e.currentTarget.value), s(u, () => p() ? "Resetting..." : "Reset password"), o((e) => {
+			var t = p(), n = p();
+			return t !== e.e && (r.disabled = e.e = t), n !== e.t && (u.disabled = e.t = n), e;
 		}, {
 			e: void 0,
 			t: void 0
-		}), i(() => o.value = s()), t;
+		}), o(() => r.value = a()), t;
+	})();
+};
+a(["input"]);
+//#endregion
+//#region src/hooks/create-sso-connections.ts
+function Bn(e) {
+	let { client: t } = K(), [n, r] = v([]), [i, a] = v(!1), [o, s] = v(null), c = async () => {
+		let n = e();
+		if (!n || !t?.organizations) {
+			r([]);
+			return;
+		}
+		a(!0), s(null);
+		try {
+			r(await t.organizations.listSsoConnections(n));
+		} catch (e) {
+			s(e instanceof Error ? e.message : "failed to load connections"), r([]);
+		} finally {
+			a(!1);
+		}
+	};
+	h(() => {
+		e(), c();
+	});
+	let l = async (n) => {
+		let i = e();
+		if (!i || !t?.organizations) return null;
+		s(null);
+		try {
+			let e = await t.organizations.createSsoConnection(i, n);
+			return r((t) => [...t, e]), e;
+		} catch (e) {
+			return s(e instanceof Error ? e.message : "create failed"), null;
+		}
+	}, u = async (n, i) => {
+		let a = e();
+		if (!a || !t?.organizations) return null;
+		s(null);
+		try {
+			let e = await t.organizations.updateSsoConnection(a, n, i);
+			return r((t) => t.map((t) => t.id === e.id ? e : t)), e;
+		} catch (e) {
+			return s(e instanceof Error ? e.message : "update failed"), null;
+		}
+	};
+	return {
+		connections: n,
+		loading: i,
+		error: o,
+		refetch: c,
+		create: l,
+		update: u,
+		disable: (e) => u(e, { status: "disabled" }),
+		enable: (e) => u(e, { status: "active" }),
+		remove: async (n) => {
+			let i = e();
+			if (!i || !t?.organizations) return !1;
+			s(null);
+			try {
+				return await t.organizations.deleteSsoConnection(i, n), r((e) => e.filter((e) => e.id !== n)), !0;
+			} catch (e) {
+				return s(e instanceof Error ? e.message : "delete failed"), !1;
+			}
+		},
+		test: async (n) => {
+			let r = e();
+			if (!r || !t?.organizations) return null;
+			s(null);
+			try {
+				return await t.organizations.testSsoConnection(r, n);
+			} catch (e) {
+				return s(e instanceof Error ? e.message : "test failed"), null;
+			}
+		}
+	};
+}
+//#endregion
+//#region src/components/saml-connection-form.tsx
+var Vn = /* @__PURE__ */ u("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\"role=alert>"), Hn = /* @__PURE__ */ u("<form class=space-y-4><div class=\"grid gap-3 md:grid-cols-2\"><label class=block><span class=\"text-xs font-medium\">Name</span><input required class=\"mt-1 w-full rounded-md border bg-background px-3 py-2\"placeholder=\"Acme Okta SAML\"></label><label class=block><span class=\"text-xs font-medium\">IdP Entity ID</span><input required class=\"mt-1 w-full rounded-md border bg-background px-3 py-2 font-mono text-xs\"placeholder=\"urn:idp:acme:saml or https://acme.okta.com/...\"></label><label class=\"block md:col-span-2\"><span class=\"text-xs font-medium\">IdP Single Sign-On URL</span><input required class=\"mt-1 w-full rounded-md border bg-background px-3 py-2 font-mono text-xs\"placeholder=https://acme.okta.com/app/.../sso/saml></label><label class=\"block md:col-span-2\"><span class=\"text-xs font-medium\">IdP Single Logout URL (optional)</span><input class=\"mt-1 w-full rounded-md border bg-background px-3 py-2 font-mono text-xs\"placeholder=https://acme.okta.com/app/.../slo/saml></label><label class=\"block md:col-span-2\"><span class=\"text-xs font-medium\">IdP X.509 Signing Certificate (PEM)</span><textarea required rows=6 class=\"mt-1 w-full rounded-md border bg-background px-3 py-2 font-mono text-xs\"placeholder=\"-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----\"></textarea></label><label class=\"block md:col-span-2\"><span class=\"text-xs font-medium\">SP Private Key (PEM) — optional, only for SP signing or encrypted assertions</span><textarea rows=4 class=\"mt-1 w-full rounded-md border bg-background px-3 py-2 font-mono text-xs\"placeholder=\"-----BEGIN PRIVATE KEY-----\"></textarea></label></div><fieldset class=\"rounded-md border p-3\"><legend class=\"px-1 text-xs font-medium\">Attribute mappings</legend><div class=\"grid gap-3 md:grid-cols-2\"><label class=block><span class=text-xs>email attribute</span><input class=\"mt-1 w-full rounded-md border bg-background px-3 py-2 font-mono text-xs\"></label><label class=block><span class=text-xs>display_name attribute</span><input class=\"mt-1 w-full rounded-md border bg-background px-3 py-2 font-mono text-xs\"></label><label class=block><span class=text-xs>external_id (default: NameID)</span><input class=\"mt-1 w-full rounded-md border bg-background px-3 py-2 font-mono text-xs\"></label><label class=block><span class=text-xs>groups attribute</span><input class=\"mt-1 w-full rounded-md border bg-background px-3 py-2 font-mono text-xs\"></label></div><div class=\"mt-3 space-y-2\"><div class=\"text-xs font-medium\">group → role</div><button type=button class=\"rounded-md border px-3 py-1 text-xs\">+ Add mapping</button></div></fieldset><fieldset class=\"rounded-md border p-3\"><legend class=\"px-1 text-xs font-medium\">Signing requirements</legend><div class=space-y-2><label class=\"flex items-center gap-2 text-xs\"><input type=checkbox>Require assertion signature (recommended)</label><label class=\"flex items-center gap-2 text-xs\"><input type=checkbox>Require response signature (recommended)</label><label class=\"flex items-center gap-2 text-xs\"><input type=checkbox>Require encrypted assertions (requires SP private key)</label><label class=\"flex items-center gap-2 text-xs\"><input type=checkbox>Allow IdP-initiated SSO (cross-tenant footgun — leave OFF unless the IdP sets <code>RelayState=cid:&lt;uuid&gt;</code>)</label></div></fieldset><div class=\"flex items-center gap-4\"><label class=\"flex items-center gap-2 text-xs\"><input type=checkbox>JIT provisioning</label><label class=\"flex items-center gap-2 text-xs\">Default role:<select class=\"rounded-md border bg-background px-2 py-1\"><option value=owner>owner</option><option value=admin>admin</option><option value=member>member</option></select></label></div><button type=submit class=\"rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground disabled:opacity-50\">"), Un = /* @__PURE__ */ u("<div class=\"flex items-center gap-2\"><input placeholder=\"group name\"class=\"flex-1 rounded-md border bg-background px-3 py-2 text-sm\"><select class=\"rounded-md border bg-background px-3 py-2 text-sm\"><option value=owner>owner</option><option value=admin>admin</option><option value=member>member</option></select><button type=button class=\"rounded-md border px-2 py-1 text-xs\">x");
+function Wn(e) {
+	let { create: t, error: n } = Bn(() => e.organizationId), [r, a] = v(""), [c, l] = v(""), [u, d] = v(""), [m, h] = v(""), [_, y] = v(""), [b, x] = v(""), [S, C] = v("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"), [w, T] = v("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"), [E, D] = v("NameID"), [O, k] = v("http://schemas.xmlsoap.org/claims/Group"), [ee, A] = v([{
+		group: "",
+		role: "member"
+	}]), [j, te] = v(!0), [M, N] = v(!0), [P, F] = v(!1), [I, L] = v(!1), [R, z] = v(!0), [B, V] = v("member"), [H, U] = v(!1), W = g(() => r().trim() !== "" && c().trim() !== "" && u().trim().startsWith("http") && _().includes("BEGIN CERTIFICATE")), G = (e, t) => {
+		A((n) => n.map((n, r) => r === e ? {
+			...n,
+			...t
+		} : n));
+	}, K = async (i) => {
+		if (i.preventDefault(), !W() || H()) return;
+		U(!0);
+		let a = {};
+		for (let { group: e, role: t } of ee()) {
+			let n = e.trim();
+			n && (a[n] = t);
+		}
+		let o = await t({
+			name: r().trim(),
+			kind: "saml_sp",
+			saml: {
+				idp_entity_id: c().trim(),
+				idp_sso_url: u().trim(),
+				idp_slo_url: m().trim() || null,
+				idp_x509_cert: _().trim(),
+				sp_private_key: b().trim() || null,
+				idp_initiated_sso_allowed: I(),
+				assertion_signed_required: j(),
+				response_signed_required: M(),
+				want_encrypted_assertions: P(),
+				attribute_mappings: {
+					email: S().trim(),
+					display_name: w().trim() || null,
+					external_id: E().trim() || "NameID",
+					groups: O().trim() || null,
+					group_to_role: a
+				}
+			},
+			jit_provisioning_enabled: R(),
+			default_role_on_jit: B()
+		});
+		U(!1), o ? e.onSuccess?.(o) : n() && e.onError?.(Error(n() ?? "create failed"));
+	};
+	return (() => {
+		var e = Hn(), t = e.firstChild, g = t.firstChild, v = g.firstChild.nextSibling, U = g.nextSibling, q = U.firstChild.nextSibling, J = U.nextSibling, ne = J.firstChild.nextSibling, Y = J.nextSibling, X = Y.firstChild.nextSibling, re = Y.nextSibling, ie = re.firstChild.nextSibling, ae = re.nextSibling.firstChild.nextSibling, oe = t.nextSibling, Z = oe.firstChild.nextSibling, Q = Z.firstChild, se = Q.firstChild.nextSibling, ce = Q.nextSibling, le = ce.firstChild.nextSibling, $ = ce.nextSibling, ue = $.firstChild.nextSibling, de = $.nextSibling.firstChild.nextSibling, fe = Z.nextSibling, pe = fe.firstChild.nextSibling, me = oe.nextSibling, he = me.firstChild.nextSibling.firstChild, ge = he.firstChild, _e = he.nextSibling, ve = _e.firstChild, ye = _e.nextSibling, be = ye.firstChild, xe = ye.nextSibling.firstChild, Se = me.nextSibling, Ce = Se.firstChild, we = Ce.firstChild, Te = Ce.nextSibling.firstChild.nextSibling, Ee = Se.nextSibling;
+		return e.addEventListener("submit", K), s(e, i(p, {
+			get when() {
+				return n();
+			},
+			get children() {
+				var e = Vn();
+				return s(e, n), e;
+			}
+		}), t), v.$$input = (e) => a(e.currentTarget.value), q.$$input = (e) => l(e.currentTarget.value), ne.$$input = (e) => d(e.currentTarget.value), X.$$input = (e) => h(e.currentTarget.value), ie.$$input = (e) => y(e.currentTarget.value), ae.$$input = (e) => x(e.currentTarget.value), se.$$input = (e) => C(e.currentTarget.value), le.$$input = (e) => T(e.currentTarget.value), ue.$$input = (e) => D(e.currentTarget.value), de.$$input = (e) => k(e.currentTarget.value), s(fe, i(f, {
+			get each() {
+				return ee();
+			},
+			children: (e, t) => (() => {
+				var n = Un(), r = n.firstChild, i = r.nextSibling, a = i.nextSibling;
+				return r.$$input = (e) => G(t(), { group: e.currentTarget.value }), i.addEventListener("change", (e) => G(t(), { role: e.currentTarget.value })), a.$$click = () => A((e) => e.filter((e, n) => n !== t())), o(() => r.value = e.group), o(() => i.value = e.role), n;
+			})()
+		}), pe), pe.$$click = () => A((e) => [...e, {
+			group: "",
+			role: "member"
+		}]), ge.addEventListener("change", (e) => te(e.currentTarget.checked)), ve.addEventListener("change", (e) => N(e.currentTarget.checked)), be.addEventListener("change", (e) => F(e.currentTarget.checked)), xe.addEventListener("change", (e) => L(e.currentTarget.checked)), we.addEventListener("change", (e) => z(e.currentTarget.checked)), Te.addEventListener("change", (e) => V(e.currentTarget.value)), s(Ee, () => H() ? "Saving..." : "Create SAML connection"), o(() => Ee.disabled = !W() || H()), o(() => v.value = r()), o(() => q.value = c()), o(() => ne.value = u()), o(() => X.value = m()), o(() => ie.value = _()), o(() => ae.value = b()), o(() => se.value = S()), o(() => le.value = w()), o(() => ue.value = E()), o(() => de.value = O()), o(() => ge.checked = j()), o(() => ve.checked = M()), o(() => be.checked = P()), o(() => xe.checked = I()), o(() => we.checked = R()), o(() => Te.value = B()), e;
+	})();
+}
+a(["input", "click"]);
+//#endregion
+//#region src/components/saml-login-button.tsx
+var Gn = /* @__PURE__ */ u("<a class=\"inline-flex items-center justify-center rounded-md border bg-background px-4 py-2 text-sm font-medium hover:bg-accent\"><svg class=\"mr-2 h-4 w-4\"viewBox=\"0 0 24 24\"fill=none stroke=currentColor stroke-width=2><title>SAML</title><path d=\"M21 2H3a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h18a2 2 0 0 0 2-2V4a2 2 0 0 0-2-2zM7 17l5-5-5-5M13 17h4\">");
+function Kn(e) {
+	let t = K(), n = g(() => t.client.sso.samlLoginUrl({
+		org: e.orgSlug,
+		domain: e.domain,
+		redirectTo: e.redirectTo
+	})), r = g(() => !!(e.orgSlug || e.domain));
+	return i(p, {
+		get when() {
+			return r();
+		},
+		get children() {
+			var t = Gn();
+			return t.firstChild, s(t, () => e.label ?? "Sign in via SAML", null), o(() => l(t, "href", n())), t;
+		}
+	});
+}
+//#endregion
+//#region src/components/scim-settings-panel.tsx
+var qn = /* @__PURE__ */ u("<section class=space-y-6><header><h2 class=\"text-base font-semibold\">SCIM provisioning</h2><p class=\"mt-1 text-sm text-muted-foreground\">Paste the SCIM Base URL and an org-scoped API key into your IdP (Okta, Entra ID, OneLogin) so it can provision users into this organization.</p></header><div class=space-y-2><label class=\"block text-xs font-medium uppercase tracking-wider text-muted-foreground\">SCIM Base URL</label><div class=\"flex gap-2\"><code class=\"flex-1 truncate rounded-md border bg-muted px-3 py-2 text-xs\"></code><button type=button class=\"rounded-md border px-3 py-1 text-xs\"></button></div></div><div class=\"rounded-md border bg-muted/30 p-4 text-sm\"role=region aria-label=\"API key requirement\"><div class=\"mb-2 font-medium\">Authentication</div><p class=text-muted-foreground>SCIM uses an <strong>org-scoped API key</strong> with the <code>scim:read</code> and <code>scim:write</code> scopes. The IdP sends it as <code>Authorization: Bearer &lt;key&gt;</code> on every request.</p><div class=mt-3><a class=\"inline-flex items-center rounded-md bg-primary px-3 py-1 text-xs text-primary-foreground\">Manage API keys →</a></div><p class=\"mt-3 text-xs text-muted-foreground\">The plaintext key is shown <strong>only at the moment of creation</strong>. We never display it here or in the IdP-side view — only the prefix and the  <code>scim:*</code> scopes.</p></div><div class=space-y-3><h3 class=\"text-sm font-medium\">Verify with curl</h3><p class=\"text-xs text-muted-foreground\">Replace <code>&lt;your-scim-key&gt;</code> with the plaintext API key you copied during key creation.</p><div class=space-y-2><label class=\"block text-xs font-medium uppercase tracking-wider text-muted-foreground\">List users</label><div class=\"flex gap-2\"><pre class=\"flex-1 overflow-x-auto rounded-md border bg-muted px-3 py-2 text-xs whitespace-pre\"></pre><button type=button class=\"rounded-md border px-3 py-1 text-xs self-start\"></button></div></div><div class=space-y-2><label class=\"block text-xs font-medium uppercase tracking-wider text-muted-foreground\">Discover capabilities</label><div class=\"flex gap-2\"><pre class=\"flex-1 overflow-x-auto rounded-md border bg-muted px-3 py-2 text-xs whitespace-pre\"></pre><button type=button class=\"rounded-md border px-3 py-1 text-xs self-start\"></button></div></div></div><div class=\"rounded-md border bg-muted/30 p-4 text-xs text-muted-foreground\"><div class=\"mb-1 font-medium text-foreground\">Per-IdP setup guides</div><ul class=\"ml-4 list-disc space-y-1\"><li><a class=underline href=/docs/scim/okta.md target=_blank>Okta</a></li><li><a class=underline href=/docs/scim/entra.md target=_blank>Microsoft Entra ID</a></li><li><a class=underline href=/docs/scim/onelogin.md target=_blank>OneLogin");
+function Jn(e) {
+	let t = e.length;
+	for (; t > 0 && e[t - 1] === "/";) t--;
+	return e.slice(0, t);
+}
+function Yn(e) {
+	let t = g(() => e.apiKeysRoute ?? `/organizations/${e.organizationId}/settings/api-keys`), n = g(() => `${Jn(e.baseUrl)}/api/scim/v2/organizations/${e.organizationId}`), r = g(() => `curl -H "Authorization: Bearer <your-scim-key>" \\
+     -H "Accept: application/scim+json" \\
+     "${n()}/Users?count=10"`), i = g(() => `curl -H "Authorization: Bearer <your-scim-key>" \\
+     -H "Accept: application/scim+json" \\
+     "${n()}/ServiceProviderConfig"`), [a, c] = v(null), u = async (e, t) => {
+		try {
+			await navigator.clipboard.writeText(e), c(t), setTimeout(() => {
+				a() === t && c(null);
+			}, 1500);
+		} catch {}
+	};
+	return (() => {
+		var e = qn(), c = e.firstChild.nextSibling, d = c.firstChild.nextSibling.firstChild, f = d.nextSibling, p = c.nextSibling, m = p.firstChild.nextSibling.nextSibling.firstChild, h = p.nextSibling.firstChild.nextSibling.nextSibling, g = h.firstChild.nextSibling.firstChild, _ = g.nextSibling, v = h.nextSibling.firstChild.nextSibling.firstChild, y = v.nextSibling;
+		return s(d, n), f.$$click = () => u(n(), "url"), s(f, () => a() === "url" ? "Copied" : "Copy"), s(g, r), _.$$click = () => u(r(), "curl-list"), s(_, () => a() === "curl-list" ? "Copied" : "Copy"), s(v, i), y.$$click = () => u(i(), "curl-config"), s(y, () => a() === "curl-config" ? "Copied" : "Copy"), o(() => l(m, "href", t())), e;
+	})();
+}
+a(["click"]);
+//#endregion
+//#region src/components/sso-connection-form.tsx
+var Xn = /* @__PURE__ */ u("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\"role=alert>"), Zn = /* @__PURE__ */ u("<form class=space-y-4><div class=\"grid gap-3 md:grid-cols-2\"><label class=block><span class=\"text-xs font-medium\">Name</span><input required class=\"mt-1 w-full rounded-md border bg-background px-3 py-2\"placeholder=\"Acme Okta\"></label><label class=block><span class=\"text-xs font-medium\">Discovery URL</span><input required class=\"mt-1 w-full rounded-md border bg-background px-3 py-2 font-mono text-xs\"placeholder=https://idp.example/.well-known/openid-configuration></label><label class=block><span class=\"text-xs font-medium\">Client ID</span><input required class=\"mt-1 w-full rounded-md border bg-background px-3 py-2\"></label><label class=block><span class=\"text-xs font-medium\">Client Secret</span><input type=password required class=\"mt-1 w-full rounded-md border bg-background px-3 py-2\"></label><label class=\"block md:col-span-2\"><span class=\"text-xs font-medium\">Scopes (comma-separated)</span><input class=\"mt-1 w-full rounded-md border bg-background px-3 py-2\"></label></div><fieldset class=\"rounded-md border p-3\"><legend class=\"px-1 text-xs font-medium\">Claim mappings</legend><div class=\"grid gap-3 md:grid-cols-2\"><label class=block><span class=text-xs>external_id</span><input class=\"mt-1 w-full rounded-md border bg-background px-3 py-2\"></label><label class=block><span class=text-xs>email</span><input class=\"mt-1 w-full rounded-md border bg-background px-3 py-2\"></label><label class=block><span class=text-xs>display_name</span><input class=\"mt-1 w-full rounded-md border bg-background px-3 py-2\"></label><label class=block><span class=text-xs>groups</span><input class=\"mt-1 w-full rounded-md border bg-background px-3 py-2\"></label></div><div class=\"mt-3 space-y-2\"><div class=\"text-xs font-medium\">group → role</div><button type=button class=\"rounded-md border px-3 py-1 text-xs\">+ Add mapping</button></div></fieldset><div class=\"flex items-center gap-4\"><label class=\"flex items-center gap-2 text-xs\"><input type=checkbox>JIT provisioning</label><label class=\"flex items-center gap-2 text-xs\">Default role:<select class=\"rounded-md border bg-background px-2 py-1\"><option value=owner>owner</option><option value=admin>admin</option><option value=member>member</option></select></label></div><button type=submit class=\"rounded-md bg-primary px-4 py-2 text-sm font-medium text-primary-foreground disabled:opacity-50\">"), Qn = /* @__PURE__ */ u("<div class=\"flex items-center gap-2\"><input placeholder=\"group name\"class=\"flex-1 rounded-md border bg-background px-3 py-2 text-sm\"><select class=\"rounded-md border bg-background px-3 py-2 text-sm\"><option value=owner>owner</option><option value=admin>admin</option><option value=member>member</option></select><button type=button class=\"rounded-md border px-2 py-1 text-xs\">✕");
+function $n(e) {
+	let { create: t, error: n } = Bn(() => e.organizationId), [r, a] = v(""), [c, l] = v(""), [u, d] = v(""), [m, h] = v(""), [_, y] = v("openid, email, profile"), [b, x] = v("sub"), [S, C] = v("email"), [w, T] = v("name"), [E, D] = v("groups"), [O, k] = v([{
+		group: "",
+		role: "member"
+	}]), [ee, A] = v(!0), [j, te] = v("member"), [M, N] = v(!1), P = g(() => r().trim() !== "" && c().includes(".well-known/openid-configuration") && u().trim() !== "" && m().trim() !== ""), F = (e, t) => {
+		k((n) => n.map((n, r) => r === e ? {
+			...n,
+			...t
+		} : n));
+	}, I = async (i) => {
+		if (i.preventDefault(), !P() || M()) return;
+		N(!0);
+		let a = {};
+		for (let { group: e, role: t } of O()) {
+			let n = e.trim();
+			n && (a[n] = t);
+		}
+		let o = await t({
+			name: r().trim(),
+			kind: "oidc_client",
+			oidc: {
+				discovery_url: c().trim(),
+				client_id: u().trim(),
+				client_secret: m(),
+				scopes: _().split(",").map((e) => e.trim()).filter(Boolean),
+				claim_mappings: {
+					external_id: b().trim() || "sub",
+					email: S().trim() || "email",
+					display_name: w().trim() || null,
+					groups: E().trim() || null,
+					group_to_role: a
+				}
+			},
+			jit_provisioning_enabled: ee(),
+			default_role_on_jit: j()
+		});
+		N(!1), o ? e.onSuccess?.(o) : n() && e.onError?.(Error(n() ?? "create failed"));
+	};
+	return (() => {
+		var e = Zn(), t = e.firstChild, g = t.firstChild, v = g.firstChild.nextSibling, N = g.nextSibling, L = N.firstChild.nextSibling, R = N.nextSibling, z = R.firstChild.nextSibling, B = R.nextSibling, V = B.firstChild.nextSibling, H = B.nextSibling.firstChild.nextSibling, U = t.nextSibling, W = U.firstChild.nextSibling, G = W.firstChild, K = G.firstChild.nextSibling, q = G.nextSibling, J = q.firstChild.nextSibling, ne = q.nextSibling, Y = ne.firstChild.nextSibling, X = ne.nextSibling.firstChild.nextSibling, re = W.nextSibling, ie = re.firstChild.nextSibling, ae = U.nextSibling, oe = ae.firstChild, Z = oe.firstChild, Q = oe.nextSibling.firstChild.nextSibling, se = ae.nextSibling;
+		return e.addEventListener("submit", I), s(e, i(p, {
+			get when() {
+				return n();
+			},
+			get children() {
+				var e = Xn();
+				return s(e, n), e;
+			}
+		}), t), v.$$input = (e) => a(e.currentTarget.value), L.$$input = (e) => l(e.currentTarget.value), z.$$input = (e) => d(e.currentTarget.value), V.$$input = (e) => h(e.currentTarget.value), H.$$input = (e) => y(e.currentTarget.value), K.$$input = (e) => x(e.currentTarget.value), J.$$input = (e) => C(e.currentTarget.value), Y.$$input = (e) => T(e.currentTarget.value), X.$$input = (e) => D(e.currentTarget.value), s(re, i(f, {
+			get each() {
+				return O();
+			},
+			children: (e, t) => (() => {
+				var n = Qn(), r = n.firstChild, i = r.nextSibling, a = i.nextSibling;
+				return r.$$input = (e) => F(t(), { group: e.currentTarget.value }), i.addEventListener("change", (e) => F(t(), { role: e.currentTarget.value })), a.$$click = () => k((e) => e.filter((e, n) => n !== t())), o(() => r.value = e.group), o(() => i.value = e.role), n;
+			})()
+		}), ie), ie.$$click = () => k((e) => [...e, {
+			group: "",
+			role: "member"
+		}]), Z.addEventListener("change", (e) => A(e.currentTarget.checked)), Q.addEventListener("change", (e) => te(e.currentTarget.value)), s(se, () => M() ? "Saving…" : "Create connection"), o(() => se.disabled = !P() || M()), o(() => v.value = r()), o(() => L.value = c()), o(() => z.value = u()), o(() => V.value = m()), o(() => H.value = _()), o(() => K.value = b()), o(() => J.value = S()), o(() => Y.value = w()), o(() => X.value = E()), o(() => Z.checked = ee()), o(() => Q.value = j()), e;
+	})();
+}
+a(["input", "click"]);
+//#endregion
+//#region src/components/sso-connection-list.tsx
+var er = /* @__PURE__ */ u("<div class=\"text-sm text-muted-foreground\">Loading…"), tr = /* @__PURE__ */ u("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\"role=alert>"), nr = /* @__PURE__ */ u("<ul class=space-y-3>"), rr = /* @__PURE__ */ u("<div class=space-y-4>"), ir = /* @__PURE__ */ u("<div class=\"rounded-md border border-dashed px-4 py-6 text-center text-sm text-muted-foreground\">No SSO connections yet. Add one to enable federated sign-in for this organization."), ar = /* @__PURE__ */ u("<div class=\"mt-1 text-xs text-muted-foreground\">client_id: <code>"), or = /* @__PURE__ */ u("<a class=\"rounded-md border px-3 py-1 text-xs hover:bg-accent\"data-testid=saml-metadata-download>SP metadata"), sr = /* @__PURE__ */ u("<button type=button class=\"rounded-md border px-3 py-1 text-xs\">Disable"), cr = /* @__PURE__ */ u("<li class=\"rounded-md border bg-card p-4\"><div class=\"flex items-start justify-between gap-4\"><div><div class=font-medium></div><div class=\"text-xs text-muted-foreground\"> · <span></span></div></div><div class=\"flex flex-wrap gap-2\"><button type=button class=\"rounded-md border px-3 py-1 text-xs\">Test</button><button type=button class=\"rounded-md border border-destructive px-3 py-1 text-xs text-destructive\">Delete"), lr = /* @__PURE__ */ u("<div class=\"mt-1 space-y-1\"><div class=\"text-xs text-muted-foreground\">IdP entity: <code></code></div><div class=\"text-xs text-muted-foreground\">SP entity: <code></code></div><div class=\"text-xs text-muted-foreground\">"), ur = /* @__PURE__ */ u("<button type=button class=\"rounded-md border px-3 py-1 text-xs\">Enable"), dr = (e) => {
+	let t = [];
+	return e.assertion_signed_required && t.push("assertion signed"), e.response_signed_required && t.push("response signed"), e.want_encrypted_assertions && t.push("encrypted"), e.idp_initiated_sso_allowed && t.push("IdP-init allowed"), t.length > 0 ? t.join(" · ") : "no signing required";
+};
+function fr(e) {
+	let { connections: t, loading: n, error: r, disable: a, enable: u, remove: d, test: m } = Bn(() => e.organizationId), h = K(), g = async (t) => {
+		let n = await m(t);
+		n && e.onTest?.(t, n.ok, n.detail);
+	}, _ = (e) => h.client.sso.samlMetadataUrl(e);
+	return (() => {
+		var e = rr();
+		return s(e, i(p, {
+			get when() {
+				return n();
+			},
+			get children() {
+				return er();
+			}
+		}), null), s(e, i(p, {
+			get when() {
+				return r();
+			},
+			get children() {
+				var e = tr();
+				return s(e, r), e;
+			}
+		}), null), s(e, i(p, {
+			get when() {
+				return c(() => !n())() && t().length > 0;
+			},
+			get fallback() {
+				return i(p, {
+					get when() {
+						return !n();
+					},
+					get children() {
+						return ir();
+					}
+				});
+			},
+			get children() {
+				var e = nr();
+				return s(e, i(f, {
+					get each() {
+						return t();
+					},
+					children: (e) => (() => {
+						var t = cr(), n = t.firstChild.firstChild, r = n.firstChild, c = r.nextSibling, f = c.firstChild, m = f.nextSibling, h = n.nextSibling, v = h.firstChild, y = v.nextSibling;
+						return s(r, () => e.name), s(c, () => e.kind, f), s(m, () => e.status), s(n, i(p, {
+							get when() {
+								return e.oidc;
+							},
+							get children() {
+								var t = ar(), n = t.firstChild.nextSibling;
+								return s(n, () => e.oidc?.client_id), t;
+							}
+						}), null), s(n, i(p, {
+							get when() {
+								return e.saml;
+							},
+							children: (e) => (() => {
+								var t = lr(), n = t.firstChild, r = n.firstChild.nextSibling, i = n.nextSibling, a = i.firstChild.nextSibling, o = i.nextSibling;
+								return s(r, () => e().idp_entity_id), s(a, () => e().sp_entity_id), s(o, () => dr(e())), t;
+							})()
+						}), null), s(h, i(p, {
+							get when() {
+								return e.saml;
+							},
+							get children() {
+								var t = or();
+								return o((n) => {
+									var r = _(e.id), i = `sp-metadata-${e.id}.xml`;
+									return r !== n.e && l(t, "href", n.e = r), i !== n.t && l(t, "download", n.t = i), n;
+								}, {
+									e: void 0,
+									t: void 0
+								}), t;
+							}
+						}), v), v.$$click = () => g(e.id), s(h, i(p, {
+							get when() {
+								return e.status === "active";
+							},
+							get fallback() {
+								return (() => {
+									var t = ur();
+									return t.$$click = () => u(e.id), t;
+								})();
+							},
+							get children() {
+								var t = sr();
+								return t.$$click = () => a(e.id), t;
+							}
+						}), y), y.$$click = () => d(e.id), o((t) => {
+							var n = e.status === "active", r = e.status === "draft", i = e.status === "disabled";
+							return n !== t.e && m.classList.toggle("text-emerald-600", t.e = n), r !== t.t && m.classList.toggle("text-amber-600", t.t = r), i !== t.a && m.classList.toggle("text-muted-foreground", t.a = i), t;
+						}, {
+							e: void 0,
+							t: void 0,
+							a: void 0
+						}), t;
+					})()
+				})), e;
+			}
+		}), null), e;
 	})();
+}
+a(["click"]);
+//#endregion
+//#region src/components/sso-login-button.tsx
+var pr = /* @__PURE__ */ u("<a class=\"inline-flex items-center justify-center rounded-md border bg-background px-4 py-2 text-sm font-medium hover:bg-accent\"><svg class=\"mr-2 h-4 w-4\"viewBox=\"0 0 24 24\"fill=none stroke=currentColor stroke-width=2><title>SSO</title><path d=\"M15 3h4a2 2 0 0 1 2 2v14a2 2 0 0 1-2 2h-4M10 17l5-5-5-5M15 12H3\">");
+function mr(e) {
+	let t = K(), n = g(() => t.client.sso.loginUrl({
+		org: e.orgSlug,
+		domain: e.domain,
+		redirectTo: e.redirectTo
+	})), r = g(() => !!(e.orgSlug || e.domain));
+	return i(p, {
+		get when() {
+			return r();
+		},
+		get children() {
+			var t = pr();
+			return t.firstChild, s(t, () => e.label ?? "Sign in with SSO", null), o(() => l(t, "href", n())), t;
+		}
+	});
+}
+//#endregion
+//#region src/components/transfer-ownership.tsx
+var hr = /* @__PURE__ */ u("<div class=\"mb-3 rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\"role=alert>"), gr = /* @__PURE__ */ u("<div class=\"fixed inset-0 z-50 flex items-center justify-center bg-black/50\"role=dialog aria-modal=true aria-labelledby=transfer-ownership-title><div class=\"w-full max-w-md rounded-lg border border-input bg-background p-6 shadow-lg\"><h2 id=transfer-ownership-title class=\"mb-2 text-lg font-semibold\">Transfer ownership</h2><p class=\"mb-4 text-sm text-muted-foreground\">Choose a member to promote to owner. You will be demoted to admin. This cannot be undone without another transfer.</p><label class=\"mb-2 block text-sm font-medium\"for=successor-select>New owner</label><select id=successor-select class=\"mb-4 w-full rounded-md border border-input bg-background px-3 py-1.5 text-sm focus:outline-none focus:ring-2 focus:ring-ring\"><option value disabled>Select a member…</option></select><label class=\"mb-4 flex items-start gap-2 text-sm\"><input type=checkbox class=mt-0.5><span>I understand I will lose owner privileges in this organization.</span></label><div class=\"flex justify-end gap-2\"><button type=button class=\"rounded-md border border-input px-3 py-1.5 text-sm hover:bg-secondary\">Cancel</button><button type=button class=\"rounded-md bg-primary px-3 py-1.5 text-sm font-medium text-primary-foreground hover:bg-primary/90 disabled:opacity-50\">"), _r = /* @__PURE__ */ u("<option> (<!>)"), vr = (e) => {
+	let { members: t, refetch: n } = ce(() => e.organizationId), { submitting: r, error: a, transferOwnership: c } = de(() => e.organizationId), [l, u] = v(""), [d, m] = v(!1), h = g(() => t().filter((e) => e.role !== $.OWNER)), _ = () => {
+		u(""), m(!1), e.onClose();
+	}, y = async () => {
+		!l() || !d() || await c({ new_owner_user_id: l() }) && (e.onSuccess?.(), await n(), _());
+	};
+	return i(p, {
+		get when() {
+			return e.open;
+		},
+		get children() {
+			var e = gr(), t = e.firstChild, n = t.firstChild.nextSibling.nextSibling, c = n.nextSibling;
+			c.firstChild;
+			var g = c.nextSibling, v = g.firstChild, b = g.nextSibling.firstChild, x = b.nextSibling;
+			return s(t, i(p, {
+				get when() {
+					return a();
+				},
+				get children() {
+					var e = hr();
+					return s(e, a), e;
+				}
+			}), n), c.addEventListener("change", (e) => u(e.currentTarget.value)), s(c, i(f, {
+				get each() {
+					return h();
+				},
+				children: (e) => (() => {
+					var t = _r(), n = t.firstChild, r = n.nextSibling;
+					return r.nextSibling, s(t, () => e.user_id, n), s(t, () => e.role, r), o(() => t.value = e.user_id), t;
+				})()
+			}), null), v.addEventListener("change", (e) => m(e.currentTarget.checked)), b.$$click = _, x.$$click = y, s(x, () => r() ? "Transferring…" : "Transfer ownership"), o((e) => {
+				var t = r(), n = r(), i = r(), a = !l() || !d() || r();
+				return t !== e.e && (c.disabled = e.e = t), n !== e.t && (v.disabled = e.t = n), i !== e.a && (b.disabled = e.a = i), a !== e.o && (x.disabled = e.o = a), e;
+			}, {
+				e: void 0,
+				t: void 0,
+				a: void 0,
+				o: void 0
+			}), o(() => c.value = l()), o(() => v.checked = d()), e;
+		}
+	});
 };
-r(["input"]);
+a(["click"]);
 //#endregion
 //#region src/components/verify-email.tsx
-var Ne = /* @__PURE__ */ s("<div class=\"text-sm text-muted-foreground\">Verifying your email address..."), Pe = /* @__PURE__ */ s("<div class=\"rounded-md bg-emerald-500/10 px-3 py-2 text-sm text-emerald-600 dark:text-emerald-400\">"), Fe = /* @__PURE__ */ s("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\">"), Ie = /* @__PURE__ */ s("<div class=space-y-4>"), Le = (t) => {
-	let { client: r } = y(), i = r?.emailPassword;
-	if (!i) return null;
-	let [o, s] = p("loading"), [c, l] = p(""), [u, f] = p("");
-	return d(async () => {
+var yr = /* @__PURE__ */ u("<div class=\"text-sm text-muted-foreground\">Verifying your email address..."), br = /* @__PURE__ */ u("<div class=\"rounded-md bg-emerald-500/10 px-3 py-2 text-sm text-emerald-600 dark:text-emerald-400\">"), xr = /* @__PURE__ */ u("<div class=\"rounded-md bg-destructive/10 px-3 py-2 text-sm text-destructive\">"), Sr = /* @__PURE__ */ u("<div class=space-y-4>"), Cr = (t) => {
+	let { client: n } = K(), r = n?.emailPassword;
+	if (!r) return null;
+	let [a, o] = v("loading"), [c, l] = v(""), [u, d] = v("");
+	return h(async () => {
 		try {
-			l((await i.verify({ token: t.token })).message), s("success"), t.onSuccess?.();
+			l((await r.verify({ token: t.token })).message), o("success"), t.onSuccess?.();
 		} catch (e) {
 			let n = e instanceof Error ? e : Error(String(e));
-			f(n.message), s("error"), t.onError?.(n);
+			d(n.message), o("error"), t.onError?.(n);
 		}
 	}), (() => {
-		var t = Ie();
-		return a(t, n(e, {
+		var t = Sr();
+		return s(t, i(e, {
 			get when() {
-				return o() === "loading";
+				return a() === "loading";
 			},
 			get children() {
-				return Ne();
+				return yr();
 			}
-		}), null), a(t, n(e, {
+		}), null), s(t, i(e, {
 			get when() {
-				return o() === "success";
+				return a() === "success";
 			},
 			get children() {
-				var e = Pe();
-				return a(e, c), e;
+				var e = br();
+				return s(e, c), e;
 			}
-		}), null), a(t, n(e, {
+		}), null), s(t, i(e, {
 			get when() {
-				return o() === "error";
+				return a() === "error";
 			},
 			get children() {
-				var e = Fe();
-				return a(e, u), e;
+				var e = xr();
+				return s(e, u), e;
 			}
 		}), null), t;
 	})();
 };
 //#endregion
-export { C as ChangePasswordForm, O as ConsentScreen, M as ForgotPasswordForm, z as LoginForm, G as MagicLinkForm, ee as MfaChallenge, ie as MfaSetup, se as OAuthButtons, F as PasskeyButton, Ee as ProfileSettings, Oe as RegisterForm, Me as ResetPasswordForm, Le as VerifyEmail, v as YAuthProvider, y as useYAuth };
+export { P as AuditDestinationCreate, U as AuditDestinationList, Y as ChangePasswordForm, oe as ConsentScreen, _e as DomainClaim, Te as DomainList, Ae as DomainVerifyStep, Pe as ForgotPasswordForm, Be as InvitationAccept, Ge as InviteForm, Qe as LoginForm, it as MagicLinkForm, St as MemberList, Tt as MfaChallenge, Mt as MfaSetup, Ft as OAuthButtons, zt as OrganizationCard, Ht as OrganizationCreate, Yt as OrganizationDetail, nn as OrganizationList, dn as OrganizationSwitcher, Je as PasskeyButton, Mn as ProfileSettings, $ as ROLES, Fn as RegisterForm, zn as ResetPasswordForm, ot as RoleSelector, Wn as SamlConnectionForm, Kn as SamlLoginButton, Yn as ScimSettingsPanel, $n as SsoConnectionForm, fr as SsoConnectionList, mr as SsoLoginButton, vr as TransferOwnership, Cr as VerifyEmail, G as YAuthProvider, rn as createActiveOrg, O as createAuditDestinations, fe as createDomains, le as createInvitation, ce as createMembers, ue as createOrgPermissions, de as createOrgRoles, se as createOrganization, Q as createOrganizations, Bn as createSsoConnections, Z as slugify, K as useYAuth };