From a2e02efa2c828b762919c147f2c86228e9e647ca Mon Sep 17 00:00:00 2001
From: David Hordiienko <shiraz0david@gmail.com>
Date: Wed, 24 Sep 2025 10:26:27 +0300
Subject: [PATCH 01/48] improve: sentry initialization

---
 backend/src/index.ts               |  1 +
 frontend/src/api.gen/client.gen.ts | 12 ++++++------
 frontend/src/api.gen/index.ts      |  2 +-
 frontend/src/api.gen/sdk.gen.ts    |  4 ++--
 frontend/src/api.gen/types.gen.ts  |  8 ++++----
 frontend/src/lib/sentry.ts         | 16 ++++------------
 frontend/src/main.tsx              |  4 ++--
 7 files changed, 20 insertions(+), 27 deletions(-)

diff --git a/backend/src/index.ts b/backend/src/index.ts
index 080d3a5a7..49c314d0b 100644
--- a/backend/src/index.ts
+++ b/backend/src/index.ts
@@ -26,6 +26,7 @@ docs(app);
 Sentry.init({
   enabled: !!appConfig.sentryDsn,
   dsn: appConfig.sentryDsn,
+  debug: appConfig.debug,
   environment: appConfig.mode,
   integrations: [nodeProfilingIntegration()],
   // Tracing to capture 100% of transactions
diff --git a/frontend/src/api.gen/client.gen.ts b/frontend/src/api.gen/client.gen.ts
index 71590bf9f..eabdfc7f0 100644
--- a/frontend/src/api.gen/client.gen.ts
+++ b/frontend/src/api.gen/client.gen.ts
@@ -1,8 +1,8 @@
 // This file is auto-generated by @hey-api/openapi-ts
 
 import { createClientConfig } from '../api-config';
-import { type ClientOptions, type Config, createClient, createConfig } from './client';
-import type { ClientOptions as ClientOptions2 } from './types.gen';
+import { type Config, createClient, createConfig, type ClientOptions as DefaultClientOptions } from './client';
+import type { ClientOptions } from './types.gen';
 
 /**
  * The `createClientConfig()` function will be called on client initialization
@@ -12,13 +12,13 @@ import type { ClientOptions as ClientOptions2 } from './types.gen';
  * `setConfig()`. This is useful for example if you're using Next.js
  * to ensure your client always has the correct values.
  */
-export type CreateClientConfig<T extends ClientOptions = ClientOptions2> = (
-  override?: Config<ClientOptions & T>,
-) => Config<Required<ClientOptions> & T>;
+export type CreateClientConfig<T extends DefaultClientOptions = ClientOptions> = (
+  override?: Config<DefaultClientOptions & T>,
+) => Config<Required<DefaultClientOptions> & T>;
 
 export const client = createClient(
   createClientConfig(
-    createConfig<ClientOptions2>({
+    createConfig<ClientOptions>({
       baseUrl: 'http://localhost:4000',
       throwOnError: true,
     }),
diff --git a/frontend/src/api.gen/index.ts b/frontend/src/api.gen/index.ts
index 57ed02bf5..f796d2cc8 100644
--- a/frontend/src/api.gen/index.ts
+++ b/frontend/src/api.gen/index.ts
@@ -1,4 +1,4 @@
 // This file is auto-generated by @hey-api/openapi-ts
 
 export * from './sdk.gen';
-export type * from './types.gen';
+export * from './types.gen';
diff --git a/frontend/src/api.gen/sdk.gen.ts b/frontend/src/api.gen/sdk.gen.ts
index 38e011960..d2028bd8b 100644
--- a/frontend/src/api.gen/sdk.gen.ts
+++ b/frontend/src/api.gen/sdk.gen.ts
@@ -1,6 +1,6 @@
 // This file is auto-generated by @hey-api/openapi-ts
 
-import type { Client, Options as Options2, TDataShape } from './client';
+import type { Client, Options as ClientOptions, TDataShape } from './client';
 import { client } from './client.gen';
 import type {
   AcceptEntityInviteData,
@@ -210,7 +210,7 @@ import type {
   VerifyEmailErrors,
 } from './types.gen';
 
-export type Options<TData extends TDataShape = TDataShape, ThrowOnError extends boolean = boolean> = Options2<TData, ThrowOnError> & {
+export type Options<TData extends TDataShape = TDataShape, ThrowOnError extends boolean = boolean> = ClientOptions<TData, ThrowOnError> & {
   /**
    * You can provide a client instance returned by `createClient()` instead of
    * individual options. This might be also useful if you want to implement a
diff --git a/frontend/src/api.gen/types.gen.ts b/frontend/src/api.gen/types.gen.ts
index 8590b4f30..11fc47d3c 100644
--- a/frontend/src/api.gen/types.gen.ts
+++ b/frontend/src/api.gen/types.gen.ts
@@ -1,9 +1,5 @@
 // This file is auto-generated by @hey-api/openapi-ts
 
-export type ClientOptions = {
-  baseUrl: 'http://localhost:4000' | (string & {});
-};
-
 export type User = {
   createdAt: string;
   id: string;
@@ -4281,3 +4277,7 @@ export type ResendInvitationResponses = {
 };
 
 export type ResendInvitationResponse = ResendInvitationResponses[keyof ResendInvitationResponses];
+
+export type ClientOptions = {
+  baseUrl: 'http://localhost:4000' | (string & {});
+};
diff --git a/frontend/src/lib/sentry.ts b/frontend/src/lib/sentry.ts
index b3650ce3f..fb38eb03a 100644
--- a/frontend/src/lib/sentry.ts
+++ b/frontend/src/lib/sentry.ts
@@ -1,23 +1,15 @@
 import * as Sentry from '@sentry/react';
 import { appConfig } from 'config';
 
-// Initialize Sentry
-window.ononline = () => {
-  initSentry();
-};
-
-// Close Sentry when offline to avoid sending errors
-window.onoffline = () => {
-  console.info('You went offline. Closing Sentry.');
-  Sentry.close();
-};
-
 export const initSentry = () => {
+  if (!appConfig.sentryDsn) return;
+
   // Send errors to Sentry
   Sentry.init({
-    enabled: !!appConfig.sentryDsn,
     dsn: appConfig.sentryDsn,
+    debug: appConfig.debug,
     environment: appConfig.mode,
+    transport: Sentry.makeBrowserOfflineTransport(Sentry.makeFetchTransport),
     // Set tracesSampleRate to 1.0 to capture 100% of transactions for performance monitoring.
     tracesSampleRate: 1.0,
     // Set `tracePropagationTargets` to control for which URLs distributed tracing should be enabled
diff --git a/frontend/src/main.tsx b/frontend/src/main.tsx
index b23ee5347..1e6abd44c 100644
--- a/frontend/src/main.tsx
+++ b/frontend/src/main.tsx
@@ -25,8 +25,8 @@ renderAscii();
 // Add badge to favicon based on config mode
 addBadgeToFavicon(appConfig.mode as ConfigMode);
 
-// Initialize Sentry if online
-if (navigator.onLine) initSentry();
+// Initialize Sentry
+initSentry();
 
 ReactDOM.createRoot(root).render(
   <StrictMode>

From 4d5eeb86c2c5168621aa92920f27a3611eade1f7 Mon Sep 17 00:00:00 2001
From: David Hordiienko <shiraz0david@gmail.com>
Date: Wed, 24 Sep 2025 12:21:39 +0300
Subject: [PATCH 02/48] fix: offline name update

---
 .../attachments/helpers/local-file-storage.ts | 30 +++++++++++++++++++
 .../{ => hooks}/use-attachment-url.tsx        |  0
 .../use-electric-sync-attachments.ts          |  0
 .../use-local-sync-attachments.tsx            |  0
 .../use-merge-local-attachments.ts            | 10 ++++---
 .../modules/attachments/query-mutations.ts    | 30 ++++++++++++++++++-
 .../src/modules/attachments/render/index.tsx  |  2 +-
 .../src/modules/attachments/table/index.tsx   |  8 +++--
 .../attachments/table/preview/index.tsx       |  2 +-
 frontend/src/modules/attachments/types.ts     |  2 +-
 10 files changed, 73 insertions(+), 11 deletions(-)
 rename frontend/src/modules/attachments/{ => hooks}/use-attachment-url.tsx (100%)
 rename frontend/src/modules/attachments/{ => hooks}/use-electric-sync-attachments.ts (100%)
 rename frontend/src/modules/attachments/{ => hooks}/use-local-sync-attachments.tsx (100%)
 rename frontend/src/modules/attachments/{ => hooks}/use-merge-local-attachments.ts (89%)

diff --git a/frontend/src/modules/attachments/helpers/local-file-storage.ts b/frontend/src/modules/attachments/helpers/local-file-storage.ts
index 4402cef72..6bdc31458 100644
--- a/frontend/src/modules/attachments/helpers/local-file-storage.ts
+++ b/frontend/src/modules/attachments/helpers/local-file-storage.ts
@@ -84,6 +84,36 @@ export const LocalFileStorage = {
     }
   },
 
+  async updateFileName(fileId: string, newName: string): Promise<CustomUppyFile | undefined> {
+    try {
+      const storageKeys = await keys();
+      if (!storageKeys.length) return undefined;
+
+      for (const groupKey of storageKeys) {
+        const group = await get<StoredOfflineData>(groupKey);
+        if (!group || !group.files) continue;
+
+        const file = group.files[fileId];
+        if (file) {
+          // Update the name
+          const updatedFile = { ...file, name: newName };
+          group.files[fileId] = updatedFile;
+
+          // Save back to IndexedDB
+          await set(groupKey, group);
+
+          return updatedFile;
+        }
+      }
+
+      return undefined; // file not found
+    } catch (error) {
+      Sentry.captureException(error);
+      console.error(`Failed to update file name (${fileId}):`, error);
+      return undefined;
+    }
+  },
+
   async removeFiles(fileIds: string[]): Promise<void> {
     try {
       const storageKeys = await keys();
diff --git a/frontend/src/modules/attachments/use-attachment-url.tsx b/frontend/src/modules/attachments/hooks/use-attachment-url.tsx
similarity index 100%
rename from frontend/src/modules/attachments/use-attachment-url.tsx
rename to frontend/src/modules/attachments/hooks/use-attachment-url.tsx
diff --git a/frontend/src/modules/attachments/use-electric-sync-attachments.ts b/frontend/src/modules/attachments/hooks/use-electric-sync-attachments.ts
similarity index 100%
rename from frontend/src/modules/attachments/use-electric-sync-attachments.ts
rename to frontend/src/modules/attachments/hooks/use-electric-sync-attachments.ts
diff --git a/frontend/src/modules/attachments/use-local-sync-attachments.tsx b/frontend/src/modules/attachments/hooks/use-local-sync-attachments.tsx
similarity index 100%
rename from frontend/src/modules/attachments/use-local-sync-attachments.tsx
rename to frontend/src/modules/attachments/hooks/use-local-sync-attachments.tsx
diff --git a/frontend/src/modules/attachments/use-merge-local-attachments.ts b/frontend/src/modules/attachments/hooks/use-merge-local-attachments.ts
similarity index 89%
rename from frontend/src/modules/attachments/use-merge-local-attachments.ts
rename to frontend/src/modules/attachments/hooks/use-merge-local-attachments.ts
index 650d983cd..afcebd677 100644
--- a/frontend/src/modules/attachments/use-merge-local-attachments.ts
+++ b/frontend/src/modules/attachments/hooks/use-merge-local-attachments.ts
@@ -9,6 +9,7 @@ import { formatUpdatedCacheData, getQueryItems } from '~/query/utils/mutate-quer
 import { nanoid } from '~/utils/nanoid';
 
 const limit = appConfig.requestLimits.attachments;
+
 export const useMergeLocalAttachments = (organizationId: string, { q, sort, order }: AttachmentsRouteSearchParams) => {
   const { getData: fetchStoredFiles } = LocalFileStorage;
 
@@ -26,15 +27,16 @@ export const useMergeLocalAttachments = (organizationId: string, { q, sort, orde
 
       const groupId = files.length > 1 ? nanoid() : null;
 
-      const localAttachments: Attachment[] = files.map(({ size, preview, id, type, data, meta }) => ({
+      // TODO(IMPROVE)local file info(add createdAt/By, groupId into the file?)
+      const localAttachments: Attachment[] = files.map(({ size, preview, id, type, data, name, meta }) => ({
         id,
-        size: size ? String(size) : String(data.size),
+        size: String(size || data.size),
         url: preview || '',
         thumbnailUrl: null,
         convertedUrl: null,
         contentType: type,
         convertedContentType: null,
-        name: meta.name,
+        name: name || meta.name, // to handle offline name update, not updating orig fileName from meta
         public: meta.public,
         bucketName: meta.bucketName,
         entityType: 'attachment',
@@ -43,7 +45,7 @@ export const useMergeLocalAttachments = (organizationId: string, { q, sort, orde
         modifiedAt: null,
         modifiedBy: null,
         groupId,
-        filename: meta?.name || 'Unnamed file',
+        filename: meta.name || 'Unnamed file',
         organizationId,
       }));
 
diff --git a/frontend/src/modules/attachments/query-mutations.ts b/frontend/src/modules/attachments/query-mutations.ts
index 2a6f2d389..9cdf8d5b1 100644
--- a/frontend/src/modules/attachments/query-mutations.ts
+++ b/frontend/src/modules/attachments/query-mutations.ts
@@ -157,7 +157,35 @@ export const useAttachmentCreateMutation = () =>
 export const useAttachmentUpdateMutation = () =>
   useMutation<Attachment, Error, UpdateAttachmentParams, AttachmentContextProp[]>({
     mutationKey: attachmentsKeys.update,
-    mutationFn: async ({ id, orgIdOrSlug, ...body }) => {
+    mutationFn: async ({ id, orgIdOrSlug, localUpdate, ...body }) => {
+      if (localUpdate && body.name) {
+        const file = await LocalFileStorage.updateFileName(id, body.name);
+
+        if (!file) throw new Error(`Failed to update file name (${id}):`);
+
+        // TODO(IMPROVE)offline update responce(add createdAt/By, groupId into the file?)
+        const localAttachment: Attachment = {
+          id: file.id,
+          size: String(file.data.size ?? 0),
+          url: file.preview || '',
+          thumbnailUrl: null,
+          convertedUrl: null,
+          contentType: file.type,
+          convertedContentType: null,
+          name: file.name || file.meta.name,
+          public: file.meta.public ?? false,
+          bucketName: file.meta.bucketName,
+          entityType: 'attachment',
+          createdAt: new Date().toISOString(),
+          createdBy: null,
+          modifiedAt: new Date().toISOString(),
+          modifiedBy: null,
+          groupId: '',
+          filename: file.meta.name || 'Unnamed file',
+          organizationId: orgIdOrSlug,
+        };
+        return localAttachment;
+      }
       return await updateAttachment({ body, path: { id, orgIdOrSlug } });
     },
     onMutate: async (variables: UpdateAttachmentParams) => {
diff --git a/frontend/src/modules/attachments/render/index.tsx b/frontend/src/modules/attachments/render/index.tsx
index ecabbd113..a6f76ea79 100644
--- a/frontend/src/modules/attachments/render/index.tsx
+++ b/frontend/src/modules/attachments/render/index.tsx
@@ -1,6 +1,6 @@
 import { lazy, Suspense } from 'react';
 import { useBreakpoints } from '~/hooks/use-breakpoints';
-import { useAttachmentUrl } from '~/modules/attachments/use-attachment-url';
+import { useAttachmentUrl } from '~/modules/attachments/hooks/use-attachment-url';
 import Spinner from '~/modules/common/spinner';
 
 // Lazy-loaded components
diff --git a/frontend/src/modules/attachments/table/index.tsx b/frontend/src/modules/attachments/table/index.tsx
index b9eb84cba..fbae45c8e 100644
--- a/frontend/src/modules/attachments/table/index.tsx
+++ b/frontend/src/modules/attachments/table/index.tsx
@@ -7,17 +7,18 @@ import { useTranslation } from 'react-i18next';
 import type { Attachment } from '~/api.gen';
 import useOfflineTableSearch from '~/hooks/use-offline-table-search';
 import useSearchParams from '~/hooks/use-search-params';
+import { useElectricSyncAttachments } from '~/modules/attachments/hooks/use-electric-sync-attachments';
+import { useLocalSyncAttachments } from '~/modules/attachments/hooks/use-local-sync-attachments';
+import { useMergeLocalAttachments } from '~/modules/attachments/hooks/use-merge-local-attachments';
 import { attachmentsQueryOptions } from '~/modules/attachments/query';
 import { useAttachmentUpdateMutation } from '~/modules/attachments/query-mutations';
 import { AttachmentsTableBar } from '~/modules/attachments/table/bar';
 import { useColumns } from '~/modules/attachments/table/columns';
-import { useElectricSyncAttachments } from '~/modules/attachments/use-electric-sync-attachments';
-import { useLocalSyncAttachments } from '~/modules/attachments/use-local-sync-attachments';
-import { useMergeLocalAttachments } from '~/modules/attachments/use-merge-local-attachments';
 import ContentPlaceholder from '~/modules/common/content-placeholder';
 import { DataTable } from '~/modules/common/data-table';
 import { useSortColumns } from '~/modules/common/data-table/sort-columns';
 import type { EntityPage } from '~/modules/entities/types';
+import { isCDNUrl } from '~/utils/is-cdn-url';
 import type { AttachmentsRouteSearchParams } from '../types';
 
 const LIMIT = appConfig.requestLimits.attachments;
@@ -80,6 +81,7 @@ const AttachmentsTable = ({ entity, canUpload = true, isSheet = false }: Attachm
         id: attachment.id,
         orgIdOrSlug: entity.id,
         name: attachment.name,
+        localUpdate: !isCDNUrl(attachment.url),
       });
     }
   };
diff --git a/frontend/src/modules/attachments/table/preview/index.tsx b/frontend/src/modules/attachments/table/preview/index.tsx
index 6bfdd6605..8d8c57e3f 100644
--- a/frontend/src/modules/attachments/table/preview/index.tsx
+++ b/frontend/src/modules/attachments/table/preview/index.tsx
@@ -1,5 +1,5 @@
+import { useAttachmentUrl } from '~/modules/attachments/hooks/use-attachment-url';
 import FilePlaceholder from '~/modules/attachments/table/preview/placeholder';
-import { useAttachmentUrl } from '~/modules/attachments/use-attachment-url';
 
 interface Props {
   id: string;
diff --git a/frontend/src/modules/attachments/types.ts b/frontend/src/modules/attachments/types.ts
index d91408c1b..538347ee9 100644
--- a/frontend/src/modules/attachments/types.ts
+++ b/frontend/src/modules/attachments/types.ts
@@ -12,5 +12,5 @@ export type AttachmentInfiniteQueryData = InfiniteQueryData<Attachment>;
 export type AttachmentContextProp = ContextQueryProp<Attachment, string[] | null>;
 
 export type CreateAttachmentParams = { localCreation: boolean; attachments: CreateAttachmentData['body'] } & CreateAttachmentData['path'];
-export type UpdateAttachmentParams = UpdateAttachmentData['body'] & UpdateAttachmentData['path'];
+export type UpdateAttachmentParams = UpdateAttachmentData['body'] & UpdateAttachmentData['path'] & { localUpdate: boolean };
 export type DeleteAttachmentsParams = { localDeletionIds: string[]; serverDeletionIds: string[] } & DeleteAttachmentsData['path'];

From 6ed7bea6229478b01d158526813ba2bc94f57ad3 Mon Sep 17 00:00:00 2001
From: David Hordiienko <shiraz0david@gmail.com>
Date: Wed, 24 Sep 2025 12:53:14 +0300
Subject: [PATCH 03/48] fix: uppy preview

---
 frontend/src/api.gen/client.gen.ts                   | 12 ++++++------
 frontend/src/api.gen/index.ts                        |  2 +-
 frontend/src/api.gen/sdk.gen.ts                      |  4 ++--
 frontend/src/api.gen/types.gen.ts                    |  8 ++++----
 .../attachments/hooks/use-local-sync-attachments.tsx |  1 +
 .../src/modules/common/uploader/helpers/index.ts     |  4 ----
 6 files changed, 14 insertions(+), 17 deletions(-)

diff --git a/frontend/src/api.gen/client.gen.ts b/frontend/src/api.gen/client.gen.ts
index eabdfc7f0..71590bf9f 100644
--- a/frontend/src/api.gen/client.gen.ts
+++ b/frontend/src/api.gen/client.gen.ts
@@ -1,8 +1,8 @@
 // This file is auto-generated by @hey-api/openapi-ts
 
 import { createClientConfig } from '../api-config';
-import { type Config, createClient, createConfig, type ClientOptions as DefaultClientOptions } from './client';
-import type { ClientOptions } from './types.gen';
+import { type ClientOptions, type Config, createClient, createConfig } from './client';
+import type { ClientOptions as ClientOptions2 } from './types.gen';
 
 /**
  * The `createClientConfig()` function will be called on client initialization
@@ -12,13 +12,13 @@ import type { ClientOptions } from './types.gen';
  * `setConfig()`. This is useful for example if you're using Next.js
  * to ensure your client always has the correct values.
  */
-export type CreateClientConfig<T extends DefaultClientOptions = ClientOptions> = (
-  override?: Config<DefaultClientOptions & T>,
-) => Config<Required<DefaultClientOptions> & T>;
+export type CreateClientConfig<T extends ClientOptions = ClientOptions2> = (
+  override?: Config<ClientOptions & T>,
+) => Config<Required<ClientOptions> & T>;
 
 export const client = createClient(
   createClientConfig(
-    createConfig<ClientOptions>({
+    createConfig<ClientOptions2>({
       baseUrl: 'http://localhost:4000',
       throwOnError: true,
     }),
diff --git a/frontend/src/api.gen/index.ts b/frontend/src/api.gen/index.ts
index f796d2cc8..57ed02bf5 100644
--- a/frontend/src/api.gen/index.ts
+++ b/frontend/src/api.gen/index.ts
@@ -1,4 +1,4 @@
 // This file is auto-generated by @hey-api/openapi-ts
 
 export * from './sdk.gen';
-export * from './types.gen';
+export type * from './types.gen';
diff --git a/frontend/src/api.gen/sdk.gen.ts b/frontend/src/api.gen/sdk.gen.ts
index d2028bd8b..38e011960 100644
--- a/frontend/src/api.gen/sdk.gen.ts
+++ b/frontend/src/api.gen/sdk.gen.ts
@@ -1,6 +1,6 @@
 // This file is auto-generated by @hey-api/openapi-ts
 
-import type { Client, Options as ClientOptions, TDataShape } from './client';
+import type { Client, Options as Options2, TDataShape } from './client';
 import { client } from './client.gen';
 import type {
   AcceptEntityInviteData,
@@ -210,7 +210,7 @@ import type {
   VerifyEmailErrors,
 } from './types.gen';
 
-export type Options<TData extends TDataShape = TDataShape, ThrowOnError extends boolean = boolean> = ClientOptions<TData, ThrowOnError> & {
+export type Options<TData extends TDataShape = TDataShape, ThrowOnError extends boolean = boolean> = Options2<TData, ThrowOnError> & {
   /**
    * You can provide a client instance returned by `createClient()` instead of
    * individual options. This might be also useful if you want to implement a
diff --git a/frontend/src/api.gen/types.gen.ts b/frontend/src/api.gen/types.gen.ts
index 11fc47d3c..8590b4f30 100644
--- a/frontend/src/api.gen/types.gen.ts
+++ b/frontend/src/api.gen/types.gen.ts
@@ -1,5 +1,9 @@
 // This file is auto-generated by @hey-api/openapi-ts
 
+export type ClientOptions = {
+  baseUrl: 'http://localhost:4000' | (string & {});
+};
+
 export type User = {
   createdAt: string;
   id: string;
@@ -4277,7 +4281,3 @@ export type ResendInvitationResponses = {
 };
 
 export type ResendInvitationResponse = ResendInvitationResponses[keyof ResendInvitationResponses];
-
-export type ClientOptions = {
-  baseUrl: 'http://localhost:4000' | (string & {});
-};
diff --git a/frontend/src/modules/attachments/hooks/use-local-sync-attachments.tsx b/frontend/src/modules/attachments/hooks/use-local-sync-attachments.tsx
index 2815a489d..56b55d1f5 100644
--- a/frontend/src/modules/attachments/hooks/use-local-sync-attachments.tsx
+++ b/frontend/src/modules/attachments/hooks/use-local-sync-attachments.tsx
@@ -8,6 +8,7 @@ import type { AttachmentToInsert } from '~/modules/attachments/types';
 import { createBaseTransloaditUppy } from '~/modules/common/uploader/helpers';
 import type { UploadedUppyFile } from '~/modules/common/uploader/types';
 
+// TODO(improvement) make uploaded attachment naming right, if it was changed during offline update it on upload
 export const useLocalSyncAttachments = (organizationId: string) => {
   const { isOnline } = useOnlineManager();
   const { mutate: createAttachments } = useAttachmentCreateMutation();
diff --git a/frontend/src/modules/common/uploader/helpers/index.ts b/frontend/src/modules/common/uploader/helpers/index.ts
index d9bc84f1d..7f59ab596 100644
--- a/frontend/src/modules/common/uploader/helpers/index.ts
+++ b/frontend/src/modules/common/uploader/helpers/index.ts
@@ -69,9 +69,5 @@ export const createBaseTransloaditUppy = async (uppyOptions: CustomUppyOpt, toke
 const onBeforeFileAdded = (file: CustomUppyFile) => {
   // Simplify file ID and add content type to meta
   file.id = nanoid();
-
-  // Generate preview for all file types using blob URL
-  if (!file.preview && file.data instanceof Blob) file.preview = URL.createObjectURL(file.data);
-
   return file;
 };

From 0fbfc3861c3344100b8989b98272b84ca666e4d0 Mon Sep 17 00:00:00 2001
From: David Hordiienko <shiraz0david@gmail.com>
Date: Wed, 24 Sep 2025 14:15:58 +0300
Subject: [PATCH 04/48] fix: preview render

---
 .../src/modules/attachments/hooks/use-attachment-url.tsx | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/frontend/src/modules/attachments/hooks/use-attachment-url.tsx b/frontend/src/modules/attachments/hooks/use-attachment-url.tsx
index 4d113ecba..4bca8509c 100644
--- a/frontend/src/modules/attachments/hooks/use-attachment-url.tsx
+++ b/frontend/src/modules/attachments/hooks/use-attachment-url.tsx
@@ -31,9 +31,10 @@ export const useAttachmentUrl = (id: string, baseUrl: string, type: string) => {
   useEffect(() => {
     isMounted.current = true;
 
-    // Use direct URL for static images either for remote URL
+    // Use direct URL for static images or remote CDN URL
     if (sanitizedUrl.startsWith('/static/') || isCDNUrl(sanitizedUrl)) {
       setUrl(sanitizedUrl);
+      setError(null); // Clear any previous error
       return;
     }
 
@@ -41,28 +42,32 @@ export const useAttachmentUrl = (id: string, baseUrl: string, type: string) => {
     const cachedUrl = useBlobStore.getState().getBlobUrl(id);
     if (cachedUrl) {
       setUrl(cachedUrl);
+      setError(null); // Clear any previous error
       return;
     }
 
-    // If  URL is not a remote static path, we assume it's a local file
     const fetchLocal = async () => {
       try {
         const file = await LocalFileStorage.getFile(id);
         if (!file) {
           setError(i18n.t('error:local_file_not_found'));
+          setUrl(null); // Make sure URL is null if file not found
           return;
         }
+
         if (isMounted.current) {
           const blob = new Blob([file.data], { type: type || 'application/octet-stream' });
           const objectUrl = URL.createObjectURL(blob);
           useBlobStore.getState().setBlobUrl(id, objectUrl);
           setUrl(objectUrl);
+          setError(null); // Clear error on success
         }
       } catch (e) {
         console.error(e);
         if (e instanceof Error) {
           Sentry.captureException(e);
           setError(`Failed to load file: ${e.message}`);
+          setUrl(null); // Ensure URL is null on error
         }
       }
     };

From 2e88f0e5af8f62299b561fa4ce671404d739e0a1 Mon Sep 17 00:00:00 2001
From: flipvanhaaren <flip@shareworks.nl>
Date: Wed, 24 Sep 2025 15:20:55 +0200
Subject: [PATCH 05/48] progress: auth code improvements

---
 backend/emails/email-verification.tsx         |  5 +-
 backend/emails/oauth-verification.tsx         | 45 +++++++++++
 backend/src/db/schema/oauth-accounts.ts       |  6 +-
 backend/src/lib/mailer.ts                     |  4 +-
 backend/src/middlewares/has-valid-token.ts    |  4 +-
 backend/src/middlewares/is-no-bot.ts          |  4 +-
 .../src/middlewares/rate-limiter/limiters.ts  |  6 +-
 backend/src/modules/attachments/routes.ts     |  8 ++
 backend/src/modules/auth/handlers.ts          | 50 +++++++------
 .../oauth/{callback-flow.ts => callback.ts}   | 53 +++++++------
 .../oauth/{session.ts => initiation.ts}       | 71 +++++++++---------
 .../auth/helpers/send-verification-email.ts   | 23 ++++--
 backend/src/modules/auth/routes.ts            | 29 +++----
 backend/src/modules/auth/schema.ts            |  7 +-
 backend/src/modules/me/handlers.ts            |  6 +-
 backend/src/modules/me/routes.ts              | 75 +++++++++----------
 backend/src/modules/system/routes.ts          |  1 +
 backend/src/utils/validate-token.ts           | 33 +++++---
 config/default.ts                             |  2 +-
 frontend/src/api.gen/sdk.gen.ts               | 42 ++++++-----
 frontend/src/api.gen/types.gen.ts             | 23 +++---
 frontend/src/api.gen/zod.gen.ts               | 15 ++--
 .../src/modules/auth/accept-entity-invite.tsx |  5 +-
 .../src/modules/auth/email-verification.tsx   |  7 +-
 frontend/src/modules/auth/types.ts            |  4 +-
 frontend/src/modules/auth/use-token-check.tsx | 12 +--
 frontend/src/modules/me/settings-page.tsx     |  2 +-
 .../src/routes/{auth.tsx => auth-routes.tsx}  | 16 +++-
 .../src/routes/{base.tsx => base-routes.tsx}  |  0
 .../src/routes/{home.tsx => home-routes.tsx}  |  2 +-
 .../{marketing.tsx => marketing-routes.tsx}   |  2 +-
 ...anizations.tsx => organization-routes.tsx} |  2 +-
 frontend/src/routes/route-tree.tsx            | 14 ++--
 .../routes/{system.tsx => system-routes.tsx}  |  2 +-
 .../src/routes/{users.tsx => user-routes.tsx} |  2 +-
 locales/en/backend.json                       |  6 +-
 locales/en/common.json                        |  4 +-
 locales/en/errors.json                        | 13 ++--
 38 files changed, 364 insertions(+), 241 deletions(-)
 create mode 100644 backend/emails/oauth-verification.tsx
 rename backend/src/modules/auth/helpers/oauth/{callback-flow.ts => callback.ts} (88%)
 rename backend/src/modules/auth/helpers/oauth/{session.ts => initiation.ts} (65%)
 rename frontend/src/routes/{auth.tsx => auth-routes.tsx} (90%)
 rename frontend/src/routes/{base.tsx => base-routes.tsx} (100%)
 rename frontend/src/routes/{home.tsx => home-routes.tsx} (96%)
 rename frontend/src/routes/{marketing.tsx => marketing-routes.tsx} (95%)
 rename frontend/src/routes/{organizations.tsx => organization-routes.tsx} (98%)
 rename frontend/src/routes/{system.tsx => system-routes.tsx} (98%)
 rename frontend/src/routes/{users.tsx => user-routes.tsx} (98%)

diff --git a/backend/emails/email-verification.tsx b/backend/emails/email-verification.tsx
index 63de04942..77a31f41f 100644
--- a/backend/emails/email-verification.tsx
+++ b/backend/emails/email-verification.tsx
@@ -12,11 +12,12 @@ import { Footer } from './components/footer';
 const appName = appConfig.name;
 
 export interface EmailVerificationEmailProps extends BasicTemplateType {
+  name: string;
   verificationLink: string;
   email: string;
 }
 
-export const EmailVerificationEmail = ({ lng, verificationLink, email }: EmailVerificationEmailProps) => {
+export const EmailVerificationEmail = ({ lng, verificationLink, email, name }: EmailVerificationEmailProps) => {
   return (
     <EmailContainer previewText={i18n.t('backend:email.email_verification.preview', { appName, lng })}>
       <EmailHeader headerText={i18n.t('backend:email.email_verification.preview', { appName, lng })} />
@@ -25,7 +26,7 @@ export const EmailVerificationEmail = ({ lng, verificationLink, email }: EmailVe
           <span
             // biome-ignore lint/security/noDangerouslySetInnerHtml: trusted HTML content from a secure source
             dangerouslySetInnerHTML={{
-              __html: i18n.t('backend:email.email_verification.text', { lng, appName, email }),
+              __html: i18n.t('backend:email.email_verification.text', { lng, appName, email, name }),
             }}
           />
         </Text>
diff --git a/backend/emails/oauth-verification.tsx b/backend/emails/oauth-verification.tsx
new file mode 100644
index 000000000..0f5bd7c7f
--- /dev/null
+++ b/backend/emails/oauth-verification.tsx
@@ -0,0 +1,45 @@
+import { appConfig } from 'config';
+import i18n from 'i18next';
+import { Text } from 'jsx-email';
+import type { BasicTemplateType } from '../src/lib/mailer';
+import { AppLogo } from './components/app-logo';
+import { EmailContainer } from './components/container';
+import { EmailBody } from './components/email-body';
+import { EmailButton } from './components/email-button';
+import { EmailHeader } from './components/email-header';
+import { Footer } from './components/footer';
+
+const appName = appConfig.name;
+
+export interface OAuthVerificationEmailProps extends BasicTemplateType {
+  name: string;
+  verificationLink: string;
+  email: string;
+  providerEmail: string;
+  providerName: string;
+}
+
+export const OAuthVerificationEmail = ({ lng, verificationLink, email, name, providerEmail, providerName }: OAuthVerificationEmailProps) => {
+  return (
+    <EmailContainer previewText={i18n.t('backend:email.oauth_verification.preview', { appName, lng, providerName })}>
+      <EmailHeader headerText={i18n.t('backend:email.oauth_verification.preview', { appName, lng, providerName })} />
+      <EmailBody>
+        <Text>
+          <span
+            // biome-ignore lint/security/noDangerouslySetInnerHtml: trusted HTML content from a secure source
+            dangerouslySetInnerHTML={{
+              __html: i18n.t('backend:email.oauth_verification.text', { lng, appName, email, providerEmail, providerName, name }),
+            }}
+          />
+        </Text>
+
+        <EmailButton ButtonText={i18n.t('backend:email.oauth_verification.verify', { lng, providerName })} href={verificationLink} />
+      </EmailBody>
+      <AppLogo />
+      <Footer />
+    </EmailContainer>
+  );
+};
+
+// Template export
+export const Template = OAuthVerificationEmail;
diff --git a/backend/src/db/schema/oauth-accounts.ts b/backend/src/db/schema/oauth-accounts.ts
index 6957f4c47..79a5e903f 100644
--- a/backend/src/db/schema/oauth-accounts.ts
+++ b/backend/src/db/schema/oauth-accounts.ts
@@ -10,6 +10,7 @@ export const oauthAccountsTable = pgTable(
   {
     createdAt: timestampColumns.createdAt,
     id: varchar().primaryKey().$defaultFn(nanoid),
+    // TODO rename to 'provider'
     providerId: varchar({ enum: supportedOAuthProviders }).notNull(),
     providerUserId: varchar().notNull(),
     email: varchar().notNull(),
@@ -20,10 +21,7 @@ export const oauthAccountsTable = pgTable(
       .notNull()
       .references(() => usersTable.id, { onDelete: 'cascade' }),
   },
-  (table) => ({
-    // Composite unique constraint on (providerId, providerUserId, email)
-    uniqueProviderUserCombo: unique().on(table.providerId, table.providerUserId, table.email),
-  }),
+  (table) => [unique().on(table.providerId, table.providerUserId, table.email)],
 );
 
 export type OAuthAccountModel = typeof oauthAccountsTable.$inferInsert;
diff --git a/backend/src/lib/mailer.ts b/backend/src/lib/mailer.ts
index 54edcbe75..6417c5e12 100644
--- a/backend/src/lib/mailer.ts
+++ b/backend/src/lib/mailer.ts
@@ -34,7 +34,7 @@ type Mailer = {
 
 export const mailer: Mailer = {
   /**
-   * Prepare and send emails to multiple recipients using a provided template.
+   * Prepare to send emails to multiple recipients using a provided template.
    * It will render the template for each recipient and send the email.
    *
    * @param template - React component template that will be used to render the email content.
@@ -63,7 +63,7 @@ export const mailer: Mailer = {
   },
 
   /**
-   * Send an email using the Brevo service.
+   * Send an email using the email service.
    *
    * @param to - Recipient email address.
    * @param subject - Subject of the email.
diff --git a/backend/src/middlewares/has-valid-token.ts b/backend/src/middlewares/has-valid-token.ts
index dcdba4e01..0e92ab4b2 100644
--- a/backend/src/middlewares/has-valid-token.ts
+++ b/backend/src/middlewares/has-valid-token.ts
@@ -18,12 +18,14 @@ export const hasValidToken = (requiredType: TokenModel['type']): MiddlewareHandl
     // For email verification, redirect to frontend
     const isRedirect = requiredType === 'email_verification';
 
+    console.log('Validating token of type', requiredType, isRedirect);
+
     // Find token in request
     const token = ctx.req.param('token');
     if (!token) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error', isRedirect });
 
     // Check if token exists
-    const tokenRecord = await getValidToken({ requiredType, token });
+    const tokenRecord = await getValidToken({ requiredType, token, isRedirect });
 
     // Set token in context
     ctx.set('token', tokenRecord);
diff --git a/backend/src/middlewares/is-no-bot.ts b/backend/src/middlewares/is-no-bot.ts
index 448a0fb71..e42ef4aa4 100644
--- a/backend/src/middlewares/is-no-bot.ts
+++ b/backend/src/middlewares/is-no-bot.ts
@@ -6,12 +6,12 @@ import { AppError } from '#/lib/errors';
 
 /**
  * Middleware to block bot requests based on the User-Agent header.
- * If the request comes from a bot, a 403 error is returned. Otherwise, the request proceeds.
+ * If the request comes from a bot, a 400 error is returned. Otherwise, the request proceeds.
  */
 export const isNoBot: MiddlewareHandler<Env> = createMiddleware<Env>(async (ctx, next) => {
   const userAgent = ctx.req.header('user-agent');
 
   // Prevent crawlers from causing spam
   if (!isbot(userAgent)) await next();
-  else throw new AppError({ status: 403, type: 'maybe_bot', severity: 'warn' });
+  else throw new AppError({ status: 400, type: 'maybe_bot', severity: 'warn' });
 });
diff --git a/backend/src/middlewares/rate-limiter/limiters.ts b/backend/src/middlewares/rate-limiter/limiters.ts
index 1dd88373e..05982ae8e 100644
--- a/backend/src/middlewares/rate-limiter/limiters.ts
+++ b/backend/src/middlewares/rate-limiter/limiters.ts
@@ -4,7 +4,7 @@ import { registerMiddlewareDescription } from '#/lib/openapi-describer';
 import { rateLimiter } from '#/middlewares/rate-limiter/core';
 
 /**
- * Email spam limit for endpoints where emails are sent to others. Max 10 requests per hour. For sign up with password, reset password, public requests etc.
+ * Email spam limit for endpoints where emails are sent to others. Identifier: IP. Max 10 requests per hour. For sign up with password, reset password, public requests etc.
  */
 export const spamLimiter: MiddlewareHandler<Env> = rateLimiter('success', 'spam', ['ip'], { points: 10, blockDuration: 60 * 60 });
 
@@ -14,9 +14,9 @@ export const spamLimiter: MiddlewareHandler<Env> = rateLimiter('success', 'spam'
 export const emailEnumLimiter: MiddlewareHandler<Env> = rateLimiter('failseries', 'email_enum', ['ip']);
 
 /**
- * Password limiter to prevent users from guessing passwords. Blocks user sign in for 30 min after 5 consecutive failed requests in 1 hour
+ * Password limiter to prevent users from guessing passwords. Blocks email or else ip for 30 min after 5 consecutive failed requests in 1 hour
  */
-export const passwordLimiter: MiddlewareHandler<Env> = rateLimiter('failseries', 'password', ['ip', 'email']);
+export const passwordLimiter: MiddlewareHandler<Env> = rateLimiter('failseries', 'password', ['email', 'ip']);
 
 /**
  * Prevent brute force attacks by systematically trying tokens or secrets. Blocks IP for 30 minutes after 5 consecutive failed requests in 1 hour
diff --git a/backend/src/modules/attachments/routes.ts b/backend/src/modules/attachments/routes.ts
index 0726d59c3..2d7416970 100644
--- a/backend/src/modules/attachments/routes.ts
+++ b/backend/src/modules/attachments/routes.ts
@@ -1,6 +1,7 @@
 import { z } from '@hono/zod-openapi';
 import { createCustomRoute } from '#/lib/custom-routes';
 import { hasOrgAccess, isAuthenticated, isPublicAccess } from '#/middlewares/guard';
+import { tokenLimiter } from '#/middlewares/rate-limiter/limiters';
 import { attachmentCreateManySchema, attachmentListQuerySchema, attachmentSchema, attachmentUpdateBodySchema } from '#/modules/attachments/schema';
 import { baseElectrycSyncQuery, idInOrgParamSchema, idSchema, idsBodySchema, inOrgParamSchema } from '#/utils/schema/common';
 import { errorResponses, paginationSchema, successWithRejectedItemsSchema } from '#/utils/schema/responses';
@@ -37,6 +38,7 @@ const attachmentRoutes = {
       ...errorResponses,
     },
   }),
+
   getAttachments: createCustomRoute({
     operationId: 'getAttachments',
     method: 'get',
@@ -61,6 +63,7 @@ const attachmentRoutes = {
       ...errorResponses,
     },
   }),
+
   getAttachment: createCustomRoute({
     operationId: 'getAttachment',
     method: 'get',
@@ -84,6 +87,7 @@ const attachmentRoutes = {
       ...errorResponses,
     },
   }),
+
   updateAttachment: createCustomRoute({
     operationId: 'updateAttachment',
     method: 'put',
@@ -114,6 +118,7 @@ const attachmentRoutes = {
       ...errorResponses,
     },
   }),
+
   deleteAttachments: createCustomRoute({
     operationId: 'deleteAttachments',
     method: 'delete',
@@ -144,6 +149,7 @@ const attachmentRoutes = {
       ...errorResponses,
     },
   }),
+
   shapeProxy: createCustomRoute({
     operationId: 'shapeProxy',
     method: 'get',
@@ -162,11 +168,13 @@ const attachmentRoutes = {
       ...errorResponses,
     },
   }),
+
   redirectToAttachment: createCustomRoute({
     operationId: 'redirectToAttachment',
     method: 'get',
     path: '/{id}/link',
     guard: isPublicAccess,
+    middleware: [tokenLimiter('attachment_redirect')],
     tags: ['attachments'],
     summary: 'Redirect to attachment',
     description: "Redirects to the file's public or presigned URL, depending on storage visibility.",
diff --git a/backend/src/modules/auth/handlers.ts b/backend/src/modules/auth/handlers.ts
index 08152c5c9..dc5237f1a 100644
--- a/backend/src/modules/auth/handlers.ts
+++ b/backend/src/modules/auth/handlers.ts
@@ -24,7 +24,8 @@ import { mailer } from '#/lib/mailer';
 import { hashPassword, verifyPasswordHash } from '#/modules/auth/helpers/argon2id';
 import { deleteAuthCookie, getAuthCookie, setAuthCookie } from '#/modules/auth/helpers/cookie';
 import { consumeMfaToken, initiateMfa, validateConfirmMfaToken } from '#/modules/auth/helpers/mfa';
-import { handleOAuthFlow } from '#/modules/auth/helpers/oauth/callback-flow';
+import { handleOAuthCallback } from '#/modules/auth/helpers/oauth/callback';
+import { handleOAuthInitiation, type OAuthCookiePayload } from '#/modules/auth/helpers/oauth/initiation';
 import {
   type GithubUserEmailProps,
   type GithubUserProps,
@@ -34,7 +35,6 @@ import {
   type MicrosoftUserProps,
   microsoftAuth,
 } from '#/modules/auth/helpers/oauth/providers';
-import { type OAuthCookiePayload, storeOAuthContext } from '#/modules/auth/helpers/oauth/session';
 import { transformGithubUserData, transformSocialUserData } from '#/modules/auth/helpers/oauth/transform-user-data';
 import { verifyPassKeyPublic } from '#/modules/auth/helpers/passkey';
 import { sendVerificationEmail } from '#/modules/auth/helpers/send-verification-email';
@@ -362,15 +362,15 @@ const authRouteHandlers = app
     return ctx.json({ shouldRedirect: false }, 200);
   })
   /*
-   * Check token (token validation)
+   * Check token by id (without consuming it)
    */
-  .openapi(authRoutes.validateToken, async (ctx) => {
+  .openapi(authRoutes.checkToken, async (ctx) => {
     // Find token in request
-    const { token } = ctx.req.valid('param');
+    const { tokenId } = ctx.req.valid('param');
     const { type: requiredType } = ctx.req.valid('query');
 
     // Check if token exists
-    const tokenRecord = await getValidToken({ requiredType, token, consumeToken: false });
+    const tokenRecord = await getValidToken({ requiredType, tokenId, consumeToken: false });
 
     const baseData = {
       email: tokenRecord.email,
@@ -463,21 +463,22 @@ const authRouteHandlers = app
     const { sessionToken, adminUserId } = await getParsedSessionCookie(ctx, { deleteAfterAttempt: true });
     const { session } = await validateSession(sessionToken);
 
-    if (adminUserId) {
-      const [adminsLastSession] = await db
-        .select()
-        .from(sessionsTable)
-        .where(eq(sessionsTable.userId, adminUserId))
-        .orderBy(desc(sessionsTable.expiresAt))
-        .limit(1);
+    // Only continue if session is impersonation
+    if (!adminUserId) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error' });
 
-      if (isExpiredDate(adminsLastSession.expiresAt)) throw new AppError({ status: 401, type: 'unauthorized', severity: 'warn' });
+    const [adminsLastSession] = await db
+      .select()
+      .from(sessionsTable)
+      .where(eq(sessionsTable.userId, adminUserId))
+      .orderBy(desc(sessionsTable.expiresAt))
+      .limit(1);
 
-      const expireTimeSpan = new TimeSpan(adminsLastSession.expiresAt.getTime() - Date.now(), 'ms');
-      const cookieContent = `${adminsLastSession.token}.${adminsLastSession.userId ?? ''}`;
+    if (isExpiredDate(adminsLastSession.expiresAt)) throw new AppError({ status: 401, type: 'unauthorized', severity: 'warn' });
 
-      await setAuthCookie(ctx, 'session', cookieContent, expireTimeSpan);
-    }
+    const expireTimeSpan = new TimeSpan(adminsLastSession.expiresAt.getTime() - Date.now(), 'ms');
+    const cookieContent = `${adminsLastSession.token}.${adminsLastSession.userId ?? ''}`;
+
+    await setAuthCookie(ctx, 'session', cookieContent, expireTimeSpan);
 
     logEvent('info', 'Stopped impersonation', { adminId: adminUserId || 'na', targetUserId: session.userId });
 
@@ -517,7 +518,7 @@ const authRouteHandlers = app
     const url = githubAuth.createAuthorizationURL(state, githubScopes);
 
     // Start the OAuth session & flow (Persist `state`)
-    return await storeOAuthContext(ctx, 'github', url, state);
+    return await handleOAuthInitiation(ctx, 'github', url, state);
   })
   /*
    * Initiates Google OAuth authentication flow
@@ -529,7 +530,7 @@ const authRouteHandlers = app
     const url = googleAuth.createAuthorizationURL(state, codeVerifier, googleScopes);
 
     // Start the OAuth session & flow (Persist `state` and `codeVerifier`)
-    return await storeOAuthContext(ctx, 'google', url, state, codeVerifier);
+    return await handleOAuthInitiation(ctx, 'google', url, state, codeVerifier);
   })
   /*
    * Initiates Microsoft OAuth authentication flow
@@ -541,7 +542,7 @@ const authRouteHandlers = app
     const url = microsoftAuth.createAuthorizationURL(state, codeVerifier, microsoftScopes);
 
     // Start the OAuth session & flow (Persist `state` and `codeVerifier`)
-    return await storeOAuthContext(ctx, 'microsoft', url, state, codeVerifier);
+    return await handleOAuthInitiation(ctx, 'microsoft', url, state, codeVerifier);
   })
 
   /*
@@ -597,7 +598,8 @@ const authRouteHandlers = app
       const githubUserEmails = (await githubUserEmailsResponse.json()) as GithubUserEmailProps[];
       const providerUser = transformGithubUserData(githubUser, githubUserEmails);
 
-      return await handleOAuthFlow(ctx, providerUser, strategy, cookiePayload);
+      // TODO is it a good idea to have this inside the try catch too?
+      return await handleOAuthCallback(ctx, providerUser, strategy, cookiePayload);
     } catch (error) {
       if (error instanceof AppError) throw error;
 
@@ -644,7 +646,7 @@ const authRouteHandlers = app
       const googleUser = (await response.json()) as GoogleUserProps;
       const providerUser = transformSocialUserData(googleUser);
 
-      return await handleOAuthFlow(ctx, providerUser, strategy, cookiePayload);
+      return await handleOAuthCallback(ctx, providerUser, strategy, cookiePayload);
     } catch (error) {
       if (error instanceof AppError) throw error;
 
@@ -690,7 +692,7 @@ const authRouteHandlers = app
       const microsoftUser = (await response.json()) as MicrosoftUserProps;
       const providerUser = transformSocialUserData(microsoftUser);
 
-      return await handleOAuthFlow(ctx, providerUser, strategy, cookiePayload);
+      return await handleOAuthCallback(ctx, providerUser, strategy, cookiePayload);
     } catch (error) {
       if (error instanceof AppError) throw error;
 
diff --git a/backend/src/modules/auth/helpers/oauth/callback-flow.ts b/backend/src/modules/auth/helpers/oauth/callback.ts
similarity index 88%
rename from backend/src/modules/auth/helpers/oauth/callback-flow.ts
rename to backend/src/modules/auth/helpers/oauth/callback.ts
index 860ae5bbf..67719ce35 100644
--- a/backend/src/modules/auth/helpers/oauth/callback-flow.ts
+++ b/backend/src/modules/auth/helpers/oauth/callback.ts
@@ -9,8 +9,8 @@ import { type UserModel, usersTable } from '#/db/schema/users';
 import { AppError } from '#/lib/errors';
 import { getAuthCookie } from '#/modules/auth/helpers/cookie';
 import { initiateMfa } from '#/modules/auth/helpers/mfa';
+import type { OAuthCookiePayload } from '#/modules/auth/helpers/oauth/initiation';
 import type { Provider } from '#/modules/auth/helpers/oauth/providers';
-import type { OAuthCookiePayload } from '#/modules/auth/helpers/oauth/session';
 import type { TransformedUser } from '#/modules/auth/helpers/oauth/transform-user-data';
 import { sendVerificationEmail } from '#/modules/auth/helpers/send-verification-email';
 import { setUserSession } from '#/modules/auth/helpers/session';
@@ -31,7 +31,7 @@ import { getValidToken } from '#/utils/validate-token';
  *
  * @returns A redirect response.
  */
-export const handleOAuthFlow = async (
+export const handleOAuthCallback = async (
   ctx: Context,
   providerUser: TransformedUser,
   provider: EnabledOAuthProvider,
@@ -42,32 +42,37 @@ export const handleOAuthFlow = async (
 
   const { connectUserId, inviteTokenId, verifyTokenId } = cookiePayload;
 
-  // Handle different OAuth flows based on context
+  // Handle OAuth callback flows based on cookie
   if (connectUserId) return await connectFlow(ctx, providerUser, provider, connectUserId, oauthAccount);
   if (inviteTokenId) return await inviteFlow(ctx, providerUser, provider, inviteTokenId, oauthAccount);
   if (verifyTokenId) return await verifyFlow(ctx, providerUser, provider, verifyTokenId, oauthAccount);
 
-  // User already has a verified OAuth account → log them in
+  // User already has a verified OAuth account → sign in
   if (oauthAccount?.verified) {
     const [user] = await usersBaseQuery().where(eq(usersTable.id, oauthAccount.userId));
     return await handleVerifiedOAuthAccount(ctx, user, oauthAccount);
   }
 
-  // User has an unverified OAuth account → prompt email verification
+  // User has an unverified OAuth account → prompt oauth (re-)verification
   if (oauthAccount) {
-    return await handleUnverifiedOAuthAccount(ctx, oauthAccount, 'signin');
+    const [user] = await usersBaseQuery().where(eq(usersTable.id, oauthAccount.userId));
+    const type = user.lastSignInAt ? 'connect' : 'signup';
+    return await handleUnverifiedOAuthAccount(ctx, oauthAccount, type);
   }
 
-  // No linked OAuth account and more than one user with same email
-  const users = await usersBaseQuery().leftJoin(emailsTable, eq(usersTable.id, emailsTable.userId)).where(eq(emailsTable.email, providerUser.email));
-  if (users.length > 1) throw new AppError({ status: 409, type: 'oauth_mismatch', severity: 'warn', isRedirect: true });
+  // Get users with the same email
+  const users = await db
+    .select({ userId: usersTable.id })
+    .from(emailsTable)
+    .innerJoin(usersTable, eq(usersTable.id, emailsTable.userId))
+    .where(eq(emailsTable.email, providerUser.email))
+    .limit(2);
 
-  // One user match → link to new OAuth account and prompt email verification
-  if (users.length === 1) {
-    const newOAuthAccount = await createOAuthAccount(users[0].id, providerUser.id, provider, providerUser.email);
+  // Multiple users with the same email → conflict
+  if (users.length > 1) throw new AppError({ status: 409, type: 'oauth_conflict', severity: 'error', isRedirect: true });
 
-    return await handleUnverifiedOAuthAccount(ctx, newOAuthAccount, 'signin');
-  }
+  // Existing user (by email) found -> suggest sign in and connect
+  if (users.length === 1) throw new AppError({ status: 409, type: 'oauth_email_exists', severity: 'warn', isRedirect: true });
 
   // No user found and registration is disabled
   if (!appConfig.has.registrationEnabled) {
@@ -106,7 +111,7 @@ const connectFlow = async (
   if (oauthAccount) {
     // OAuth account is linked to a different user
     if (oauthAccount.userId !== connectUserId) {
-      throw new AppError({ status: 409, type: 'oauth_mismatch', severity: 'warn', isRedirect: true });
+      throw new AppError({ status: 409, type: 'oauth_conflict', severity: 'error', isRedirect: true });
     }
 
     // Already linked + verified → log in the user
@@ -122,7 +127,7 @@ const connectFlow = async (
   // New OAuth account connection → validate email isn't used by another user
   const users = await usersBaseQuery().leftJoin(emailsTable, eq(usersTable.id, emailsTable.userId)).where(eq(emailsTable.email, providerUser.email));
   if (users.some((u) => u.id !== connectUserId)) {
-    throw new AppError({ status: 409, type: 'oauth_mismatch', severity: 'warn', isRedirect: true });
+    throw new AppError({ status: 409, type: 'oauth_conflict', severity: 'error', isRedirect: true });
   }
 
   // Safe to connect → create and link OAuth account to current user
@@ -153,7 +158,7 @@ const inviteFlow = async (
   const invitationToken = await getValidToken({
     requiredType: 'invitation',
     tokenId: inviteTokenId,
-    missedTokenError: { status: 403, type: 'oauth_token_missing', severity: 'warn', isRedirect: true },
+    isRedirect: true,
   });
 
   // Email in token doesn't match provider email
@@ -162,13 +167,13 @@ const inviteFlow = async (
   }
 
   // OAuth account already linked
-  if (oauthAccount) throw new AppError({ status: 409, type: 'oauth_mismatch', severity: 'warn', isRedirect: true });
+  if (oauthAccount) throw new AppError({ status: 409, type: 'oauth_conflict', severity: 'error', isRedirect: true });
 
   // No linked OAuth account and email already in use by an existing user
   const users = await usersBaseQuery().leftJoin(emailsTable, eq(usersTable.id, emailsTable.userId)).where(eq(emailsTable.email, providerUser.email));
-  if (users.length) throw new AppError({ status: 409, type: 'oauth_mismatch', severity: 'warn', isRedirect: true });
+  if (users.length) throw new AppError({ status: 409, type: 'oauth_email_exists', severity: 'error', isRedirect: true });
 
-  // User already signed up meanwhile
+  // TODO User already signed up meanwhile?
 
   // No user match → create a new user
   const user = await handleCreateUser({
@@ -193,11 +198,11 @@ const verifyFlow = async (
   const verifyToken = await getValidToken({
     requiredType: 'email_verification',
     tokenId: verifyTokenId,
-    missedTokenError: { status: 403, type: 'oauth_token_missing', severity: 'warn', isRedirect: true },
+    isRedirect: true,
   });
 
   // No OauthAccount → invalid verification
-  if (!oauthAccount) throw new AppError({ status: 409, type: 'oauth_mismatch', severity: 'warn', isRedirect: true });
+  if (!oauthAccount) throw new AppError({ status: 400, type: 'oauth_failed', severity: 'error', isRedirect: true });
 
   // Invalid token settings → invalid verification
   if (
@@ -206,7 +211,7 @@ const verifyFlow = async (
     verifyToken.oauthAccountId !== oauthAccount.id ||
     oauthAccount.providerId !== provider
   ) {
-    throw new AppError({ status: 409, type: 'oauth_mismatch', severity: 'warn', isRedirect: true });
+    throw new AppError({ status: 400, type: 'oauth_failed', severity: 'error', isRedirect: true });
   }
 
   const [user] = await usersBaseQuery().where(eq(usersTable.id, oauthAccount.userId));
@@ -343,7 +348,7 @@ const handleUnverifiedOAuthAccount = async (
 
   sendVerificationEmail({ userId: oauthAccount.userId, oauthAccountId: oauthAccount.id, redirectPath });
 
-  const redirectUrl = new URL(`/auth/email-verification/${reason}`, appConfig.frontendUrl);
+  const redirectUrl = new URL(`/auth/email-verification/${reason}?provider=${oauthAccount.providerId}`, appConfig.frontendUrl);
 
   return ctx.redirect(redirectUrl, 302);
 };
diff --git a/backend/src/modules/auth/helpers/oauth/session.ts b/backend/src/modules/auth/helpers/oauth/initiation.ts
similarity index 65%
rename from backend/src/modules/auth/helpers/oauth/session.ts
rename to backend/src/modules/auth/helpers/oauth/initiation.ts
index c6017e18e..a2e5e8950 100644
--- a/backend/src/modules/auth/helpers/oauth/session.ts
+++ b/backend/src/modules/auth/helpers/oauth/initiation.ts
@@ -30,7 +30,7 @@ export interface OAuthCookiePayload {
  * @param codeVerifier - PKCE code verifier (optional)
  * @returns redirect response
  */
-export const storeOAuthContext = async (ctx: Context, provider: string, url: URL, state: string, codeVerifier?: string) => {
+export const handleOAuthInitiation = async (ctx: Context, provider: string, url: URL, state: string, codeVerifier?: string) => {
   const { type } = ctx.req.query();
 
   const payload = await getOAuthPayload(ctx);
@@ -44,12 +44,13 @@ export const storeOAuthContext = async (ctx: Context, provider: string, url: URL
 };
 
 /**
- * Stores OAuth context (invite/connect/verify) so that the callback
+ * Stores OAuth context (invite/connect/verify/auth) so that the callback
  * can resume the correct flow. Called at the start of an OAuth process.
  *
  * - invite → validates invitation token, sets invite cookie, stores redirect
  * - connect → validates connecting user, sets connection cookie
- * - verify → validates verification token, sets verify cookie, stores redirect
+ * - verify → validates email verification token, sets verify cookie, stores redirect
+ * - auth (default) → sets default redirect
  *
  * Always returns a normalized payload describing the flow.
  *
@@ -67,33 +68,22 @@ const getOAuthPayload = async (ctx: Context) => {
 
   switch (type) {
     case 'invite': {
-      const { tokenId, redirectPath: inviteRedirect } = await handleOAuthInvitation(ctx);
-      inviteTokenId = tokenId;
-      redirectPath = inviteRedirect;
+      ({ inviteTokenId, redirectPath } = await prepareOAuthAcceptInvite(ctx));
       break;
     }
     case 'connect': {
-      const userId = await handleOAuthConnection(ctx);
-      connectUserId = userId;
+      ({ connectUserId, redirectPath } = await prepareOAuthConnect(ctx));
       break;
     }
     case 'verify': {
-      const { tokenId, redirectPath: verifyRedirect } = await handleOAuthVerify(ctx);
-      verifyTokenId = tokenId;
-      redirectPath = verifyRedirect;
+      ({ verifyTokenId, redirectPath } = await prepareOAuthVerify(ctx));
       break;
     }
     default:
-      // no special flow, just redirect
       break;
   }
 
-  return {
-    redirectPath,
-    inviteTokenId,
-    connectUserId,
-    verifyTokenId,
-  };
+  return { redirectPath, inviteTokenId, connectUserId, verifyTokenId };
 };
 /**
  * Resolves and validates the redirect path used after OAuth.
@@ -123,40 +113,46 @@ const resolveOAuthRedirect = (redirect?: string): string => {
  * @returns tokenId + redirectPath
  * @throws AppError if token is missing or invalid
  */
-const handleOAuthInvitation = async (ctx: Context) => {
-  const token = ctx.req.query('token');
-  if (!token) throw new AppError({ status: 404, type: 'invitation_not_found', severity: 'warn', isRedirect: true });
+const prepareOAuthAcceptInvite = async (ctx: Context) => {
+  const { tokenId, token } = ctx.req.query();
 
-  const tokenRecord = await getValidToken({ requiredType: 'invitation', token, consumeToken: false });
+  // Must provide a token and tokenId
+  if (!token || !tokenId) throw new AppError({ status: 400, type: 'invalid_request', severity: 'warn', isRedirect: true });
+
+  const tokenRecord = await getValidToken({ requiredType: 'invitation', tokenId, consumeToken: false });
+  if (!tokenRecord) throw new AppError({ status: 404, type: 'invitation_not_found', severity: 'warn', isRedirect: true });
 
   const redirectPath = tokenRecord.entityType ? `/invitation/${tokenRecord.token}` : appConfig.defaultRedirectPath;
 
-  return { tokenId: tokenRecord.id, redirectPath };
+  return { inviteTokenId: tokenRecord.id, redirectPath };
 };
 
 /**
- * Validates and extracts connection context for an OAuth flow.
+ * Validates and extracts connection context for an OAuth flow. Operates in authenticated context.
  *
  * - Ensures `connect` param exists
  * - Validates logged-in user matches `connect` param
  *
  * @param ctx - Hono context
- * @returns tokenId (the user id)
+ * @returns connectUserId and redirectPath
  * @throws AppError if missing param or user mismatch
  */
-const handleOAuthConnection = async (ctx: Context) => {
-  const connectingUserId = ctx.req.query('connect');
+const prepareOAuthConnect = async (ctx: Context) => {
+  const connectUserId = ctx.req.query('connectUserId');
 
-  if (!connectingUserId) {
-    throw new AppError({ status: 404, type: 'oauth_connection_not_found', severity: 'error', isRedirect: true });
+  if (!connectUserId) {
+    throw new AppError({ status: 400, type: 'connect_user_not_found', severity: 'error', isRedirect: true });
   }
 
   const { sessionToken } = await getParsedSessionCookie(ctx, { redirectOnError: true });
   const { user } = await validateSession(sessionToken);
 
-  if (user.id !== connectingUserId) throw new AppError({ status: 403, type: 'user_mismatch', severity: 'warn', isRedirect: true });
+  if (!user) throw new AppError({ status: 404, type: 'not_found', entityType: 'user', severity: 'warn', isRedirect: true });
+  if (user.id !== connectUserId) throw new AppError({ status: 403, type: 'user_mismatch', severity: 'warn', isRedirect: true });
+
+  const redirectPath = '/settings#authentication';
 
-  return connectingUserId;
+  return { connectUserId, redirectPath };
 };
 /**
  * Validates and extracts verification context for an OAuth flow.
@@ -169,13 +165,16 @@ const handleOAuthConnection = async (ctx: Context) => {
  * @returns tokenId + redirectPath
  * @throws AppError if missing or invalid token
  */
-const handleOAuthVerify = async (ctx: Context) => {
-  const token = ctx.req.query('token');
-  if (!token) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error', isRedirect: true });
+const prepareOAuthVerify = async (ctx: Context) => {
+  const { tokenId, token } = ctx.req.query();
+
+  // Must provide a token and tokenId
+  if (!token || !tokenId) throw new AppError({ status: 400, type: 'invalid_request', severity: 'warn', isRedirect: true });
 
-  const tokenRecord = await getValidToken({ requiredType: 'email_verification', token, consumeToken: false });
+  const tokenRecord = await getValidToken({ requiredType: 'email_verification', tokenId, consumeToken: false, isRedirect: true });
 
+  // If entityType exists, proceed to invitation flow
   const redirectPath = tokenRecord.entityType ? `/invitation/${tokenRecord.token}` : appConfig.defaultRedirectPath;
 
-  return { tokenId: tokenRecord.id, redirectPath };
+  return { verifyTokenId: tokenRecord.id, redirectPath };
 };
diff --git a/backend/src/modules/auth/helpers/send-verification-email.ts b/backend/src/modules/auth/helpers/send-verification-email.ts
index 5970a1830..c6ffb0134 100644
--- a/backend/src/modules/auth/helpers/send-verification-email.ts
+++ b/backend/src/modules/auth/helpers/send-verification-email.ts
@@ -13,6 +13,7 @@ import { logEvent } from '#/utils/logger';
 import { nanoid } from '#/utils/nanoid';
 import { createDate, TimeSpan } from '#/utils/time-span';
 import { EmailVerificationEmail, type EmailVerificationEmailProps } from '../../../../emails/email-verification';
+import { OAuthVerificationEmail, OAuthVerificationEmailProps } from '../../../../emails/oauth-verification';
 
 interface Props {
   userId: string;
@@ -21,7 +22,9 @@ interface Props {
 }
 
 /**
- * Send a verification email to user.
+ * Send a verification email to user. There are two scenarios:
+ * 1. Regular email verification (no oauthAccountId): user verifies their email address
+ * 2. OAuth email verification (with oauthAccountId): user verifies by email to connect an OAuth account
  */
 export const sendVerificationEmail = async ({ userId, oauthAccountId, redirectPath }: Props) => {
   const [user] = await usersBaseQuery().where(eq(usersTable.id, userId)).limit(1);
@@ -59,6 +62,7 @@ export const sendVerificationEmail = async ({ userId, oauthAccountId, redirectPa
   const token = nanoid(40);
   const email = oauthAccount?.email ?? user.email;
 
+  // Create new token
   const [tokenRecord] = await db
     .insert(tokensTable)
     .values({
@@ -90,24 +94,31 @@ export const sendVerificationEmail = async ({ userId, oauthAccountId, redirectPa
   // Send email
   const lng = user.language;
 
-  // Create verification link
+  // Create verification link: go to
   const verifyPath = !oauthAccount ? `/auth/verify-email/${tokenRecord.token}` : `/auth/${oauthAccount.providerId}`;
   const verificationURL = new URL(verifyPath, appConfig.backendAuthUrl);
 
+  // Add query params to pass through OAuth verification
   if (oauthAccount) {
+    verificationURL.searchParams.set('tokenId', tokenRecord.id);
     verificationURL.searchParams.set('token', tokenRecord.token);
     verificationURL.searchParams.set('type', 'verify');
   }
   if (redirectPath) verificationURL.searchParams.set('redirect', encodeURIComponent(redirectPath));
 
   // Prepare & send email
-  const subject = i18n.t('backend:email.email_verification.subject', { lng, appName: appConfig.name });
-  const staticProps = { verificationLink: verificationURL.toString(), subject, lng };
+  const subjectText = oauthAccount ? 'backend:email.oauth_verification.subject' : 'backend:email.email_verification.subject';
+  const subject = i18n.t(subjectText, { lng, appName: appConfig.name });
+  const staticProps = { verificationLink: verificationURL.toString(), subject, lng, name: user.name };
   const recipients = [{ email }];
-
   type Recipient = { email: string };
 
-  mailer.prepareEmails<EmailVerificationEmailProps, Recipient>(EmailVerificationEmail, staticProps, recipients);
+  if (oauthAccount) {
+    const staticOAuthProps = { ...staticProps, providerEmail: oauthAccount.email, providerName: oauthAccount.providerId };
+    mailer.prepareEmails<OAuthVerificationEmailProps, Recipient>(OAuthVerificationEmail, staticOAuthProps, recipients);
+  } else {
+    mailer.prepareEmails<EmailVerificationEmailProps, Recipient>(EmailVerificationEmail, staticProps, recipients);
+  }
 
   logEvent('info', 'Verification email sent', { userId: user.id });
 };
diff --git a/backend/src/modules/auth/routes.ts b/backend/src/modules/auth/routes.ts
index 3f2c37584..ac8b5ce12 100644
--- a/backend/src/modules/auth/routes.ts
+++ b/backend/src/modules/auth/routes.ts
@@ -3,6 +3,7 @@ import { appConfig } from 'config';
 import { createCustomRoute } from '#/lib/custom-routes';
 import { hasSystemAccess, isAuthenticated, isPublicAccess } from '#/middlewares/guard';
 import { hasValidToken } from '#/middlewares/has-valid-token';
+import { isNoBot } from '#/middlewares/is-no-bot';
 import { emailEnumLimiter, passwordLimiter, spamLimiter, tokenLimiter } from '#/middlewares/rate-limiter/limiters';
 import {
   emailBodySchema,
@@ -49,7 +50,7 @@ const authRoutes = {
     operationId: 'stopImpersonation',
     method: 'get',
     path: '/impersonation/stop',
-    guard: isPublicAccess,
+    guard: isAuthenticated,
     tags: ['auth'],
     summary: 'Stop impersonating',
     description: 'Ends impersonation by clearing the current impersonation session and restoring the admin context.',
@@ -71,7 +72,7 @@ const authRoutes = {
     method: 'post',
     path: '/check-email',
     guard: isPublicAccess,
-    middleware: [emailEnumLimiter],
+    middleware: [isNoBot, emailEnumLimiter],
     tags: ['auth'],
     summary: 'Check if email exists',
     description: 'Checks if a user with the specified email address exists in the system.',
@@ -103,7 +104,7 @@ const authRoutes = {
     method: 'post',
     path: '/sign-up',
     guard: isPublicAccess,
-    middleware: [spamLimiter, emailEnumLimiter],
+    middleware: [isNoBot, spamLimiter, emailEnumLimiter],
     tags: ['auth'],
     summary: 'Sign up with password',
     description: 'Registers a new user using an email and password. Sends a verification email upon successful sign up.',
@@ -132,7 +133,7 @@ const authRoutes = {
     method: 'post',
     path: '/sign-up/{token}',
     guard: isPublicAccess,
-    middleware: [spamLimiter, emailEnumLimiter, hasValidToken('invitation')],
+    middleware: [tokenLimiter('signup_invitation'), emailEnumLimiter, hasValidToken('invitation')],
     tags: ['auth'],
     summary: 'Sign up to accept invite',
     description: 'Registers a user using an email and password in response to a system or organization invitation.',
@@ -309,16 +310,18 @@ const authRoutes = {
     },
   }),
 
-  validateToken: createCustomRoute({
-    operationId: 'validateToken',
+  checkToken: createCustomRoute({
+    operationId: 'checkToken',
     method: 'post',
-    path: '/validate-token/{token}',
+    path: '/check-token/{tokenId}',
     guard: isPublicAccess,
+    middleware: isNoBot,
     tags: ['auth'],
-    summary: 'Validate token',
-    description: 'Checks if a token (e.g. for password reset, email verification, or invite) is still valid and returns basic data if valid.',
+    summary: 'Check token',
+    description:
+      'Checks by token id - NOT token itself - if a token (e.g. for password reset, email verification, or invite) is still valid and returns basic data if valid.',
     request: {
-      params: tokenParamSchema,
+      params: z.object({ tokenId: z.string() }),
       query: z.object({ type: z.enum(appConfig.tokenTypes) }),
     },
     responses: {
@@ -361,7 +364,7 @@ const authRoutes = {
     tags: ['auth'],
     summary: 'Authenticate with GitHub',
     description:
-      'Starts OAuth authentication with GitHub. Supports account connection (`connect`), redirect (`redirect`), or invite token (`token`).',
+      'Starts OAuth authentication with GitHub. Can be used for account connection, email verification, invitation process, defaults to authentication.',
     security: [],
     request: { query: oauthQuerySchema },
     responses: {
@@ -407,7 +410,7 @@ const authRoutes = {
     tags: ['auth'],
     summary: 'Authenticate with Google',
     description:
-      'Starts OAuth authentication with Google. Supports account connection (`connect`), redirect (`redirect`), or invite token (`token`).',
+      'Starts OAuth authentication with Google. Can be used for account connection, email verification, invitation process, defaults to authentication.',
     security: [],
     request: { query: oauthQuerySchema },
     responses: {
@@ -447,7 +450,7 @@ const authRoutes = {
     tags: ['auth'],
     summary: 'Authenticate with Microsoft',
     description:
-      'Starts OAuth authentication with Microsoft. Supports account connection (`connect`), redirect (`redirect`), or invite token (`token`).',
+      'Starts OAuth authentication with Microsoft. Can be used for account connection, email verification, invitation process, defaults to authentication.',
     security: [],
     request: { query: oauthQuerySchema },
     responses: {
diff --git a/backend/src/modules/auth/schema.ts b/backend/src/modules/auth/schema.ts
index ba68ab601..e1f274405 100644
--- a/backend/src/modules/auth/schema.ts
+++ b/backend/src/modules/auth/schema.ts
@@ -56,13 +56,14 @@ export const oauthQuerySchema = z
   .object({
     type: z.enum(['auth', 'connect', 'invite', 'verify']),
     redirect: z.string().optional(),
-    connect: z.string().optional(),
+    connectUserId: z.string().optional(),
     token: z.string().optional(),
+    tokenId: z.string().optional(),
   })
   .refine(
     (data) => {
-      if (data.type === 'connect') return !!data.connect;
-      if (data.type === 'invite') return !!data.token;
+      if (data.type === 'connect') return !!data.connectUserId;
+      if (data.type === 'invite') return !!data.tokenId && !!data.token;
       return true; // No extra requirements for signIn & signUp
     },
     { message: "Missing required field based on 'type'" },
diff --git a/backend/src/modules/me/handlers.ts b/backend/src/modules/me/handlers.ts
index 1ed1e9cf0..4f8e15dda 100644
--- a/backend/src/modules/me/handlers.ts
+++ b/backend/src/modules/me/handlers.ts
@@ -145,7 +145,11 @@ const meRouteHandlers = app
 
     const getTotp = db.select().from(totpsTable).where(eq(totpsTable.userId, user.id));
 
-    const getOAuth = db.select({ providerId: oauthAccountsTable.providerId }).from(oauthAccountsTable).where(eq(oauthAccountsTable.userId, user.id));
+    // Query to get verified OAuth accounts
+    const getOAuth = db
+      .select({ providerId: oauthAccountsTable.providerId })
+      .from(oauthAccountsTable)
+      .where(and(eq(oauthAccountsTable.userId, user.id), eq(oauthAccountsTable.verified, true)));
 
     // Run all queries + fetch user sessions in parallel
     const [passkeys, password, totps, oauthAccounts, sessions] = await Promise.all([
diff --git a/backend/src/modules/me/routes.ts b/backend/src/modules/me/routes.ts
index 18f6b045b..6dd6506a9 100644
--- a/backend/src/modules/me/routes.ts
+++ b/backend/src/modules/me/routes.ts
@@ -35,23 +35,6 @@ const meRoutes = {
     },
   }),
 
-  getMyAuth: createCustomRoute({
-    operationId: 'getMyAuth',
-    method: 'get',
-    path: '/auth',
-    guard: isAuthenticated,
-    tags: ['me'],
-    summary: 'Get auth data',
-    description: 'Returns authentication related data of *current user*, including sessions, OAuth accounts, and sign in options.',
-    responses: {
-      200: {
-        description: 'User sign-up info',
-        content: { 'application/json': { schema: meAuthDataSchema } },
-      },
-      ...errorResponses,
-    },
-  }),
-
   getMyMenu: createCustomRoute({
     operationId: 'getMyMenu',
     method: 'get',
@@ -111,40 +94,36 @@ const meRoutes = {
     },
   }),
 
-  toggleMfa: createCustomRoute({
-    operationId: 'toggleMfa',
-    method: 'put',
-    path: '/mfa',
+  deleteMe: createCustomRoute({
+    operationId: 'deleteMe',
+    method: 'delete',
+    path: '/',
     guard: isAuthenticated,
     tags: ['me'],
-    summary: 'Toggle MFA',
+    summary: 'Delete self',
     description:
-      'Enable or disable multifactor authentication for the *current user*. Requires passkey or TOTP reauthentication if session is older than 1 hour.',
-    request: {
-      body: { content: { 'application/json': { schema: toggleMfaStateBody } } },
-    },
+      "Deletes the *current user*. This also removes the user's memberships (cascade) and sets references to the user to `null` where applicable.",
     responses: {
       200: {
-        description: 'User',
-        content: { 'application/json': { schema: userSchema } },
+        description: 'User deleted',
+        content: { 'application/json': { schema: successWithoutDataSchema } },
       },
       ...errorResponses,
     },
   }),
 
-  deleteMe: createCustomRoute({
-    operationId: 'deleteMe',
-    method: 'delete',
-    path: '/',
+  getMyAuth: createCustomRoute({
+    operationId: 'getMyAuth',
+    method: 'get',
+    path: '/auth',
     guard: isAuthenticated,
     tags: ['me'],
-    summary: 'Delete self',
-    description:
-      "Deletes the *current user*. This also removes the user's memberships (cascade) and sets references to the user to `null` where applicable.",
+    summary: 'Get auth data',
+    description: 'Returns authentication related data of *current user*, including sessions, OAuth accounts, and sign in options.',
     responses: {
       200: {
-        description: 'User deleted',
-        content: { 'application/json': { schema: successWithoutDataSchema } },
+        description: 'User sign-up info',
+        content: { 'application/json': { schema: meAuthDataSchema } },
       },
       ...errorResponses,
     },
@@ -235,6 +214,27 @@ const meRoutes = {
     },
   }),
 
+  toggleMfa: createCustomRoute({
+    operationId: 'toggleMfa',
+    method: 'put',
+    path: '/mfa',
+    guard: isAuthenticated,
+    tags: ['me'],
+    summary: 'Toggle MFA',
+    description:
+      'Enable or disable multifactor authentication for the *current user*. Requires passkey or TOTP reauthentication if session is older than 1 hour.',
+    request: {
+      body: { content: { 'application/json': { schema: toggleMfaStateBody } } },
+    },
+    responses: {
+      200: {
+        description: 'User',
+        content: { 'application/json': { schema: userSchema } },
+      },
+      ...errorResponses,
+    },
+  }),
+
   createPasskey: createCustomRoute({
     operationId: 'createPasskey',
     method: 'post',
@@ -286,7 +286,6 @@ const meRoutes = {
     method: 'post',
     path: '/totp/register',
     guard: isAuthenticated,
-    // TODO look into rate limit customized for totp
     tags: ['me'],
     summary: 'Register TOTP',
     description: 'Generates a new TOTP secret for the current user and returns a provisioning URI and Base32 manual key.',
diff --git a/backend/src/modules/system/routes.ts b/backend/src/modules/system/routes.ts
index 90cadce1a..6c9f13bdd 100644
--- a/backend/src/modules/system/routes.ts
+++ b/backend/src/modules/system/routes.ts
@@ -70,6 +70,7 @@ const systemRoutes = {
     method: 'get',
     path: '/presigned-url',
     guard: [isPublicAccess],
+    // TODO rate limiting this endpoint, try first authenticated users by id, fallback to ip address
     tags: ['system'],
     summary: 'Get presigned URL',
     description: 'Generates and returns a presigned URL for uploading files to an S3 bucket.',
diff --git a/backend/src/utils/validate-token.ts b/backend/src/utils/validate-token.ts
index 5e8d465eb..43446ed83 100644
--- a/backend/src/utils/validate-token.ts
+++ b/backend/src/utils/validate-token.ts
@@ -1,23 +1,35 @@
 import { and, eq, gt, isNull } from 'drizzle-orm';
 import { db } from '#/db/db';
 import { type TokenModel, tokensTable } from '#/db/schema/tokens';
-import { AppError, type ConstructedError } from '#/lib/errors';
+import { AppError } from '#/lib/errors';
 import { isExpiredDate } from '#/utils/is-expired-date';
 
 type BaseProps = {
   requiredType: TokenModel['type'];
   consumeToken?: boolean;
-  missedTokenError?: ConstructedError;
+  isRedirect?: boolean;
 };
-type FokenInedtifierProps = { token: string; tokenId?: never } | { tokenId: string; token?: never };
-
+type TokenIdentifierProps = { token: string; tokenId?: never; consumeToken?: true } | { tokenId: string; token?: never; consumeToken?: boolean };
+
+/**
+ * Validates a token by its value or ID, ensuring it matches the required type and is neither expired nor consumed.
+ * By default, it consumes the token upon successful validation.
+ *
+ * @param token The token string to validate.
+ * @param tokenId The token ID to validate.
+ * @param requiredType The required type of the token (e.g., 'password_reset', 'email_verification').
+ * @param consumeToken (Default: true) Whether to mark the token as consumed after validation.
+ * @param isRedirect - Whether error requests should be redirects.
+ * @returns The valid token record from the database.
+ * @throws AppError if the token is not found, expired, or of an invalid type.
+ */
 export const getValidToken = async ({
   token,
   tokenId,
   requiredType,
   consumeToken = true,
-  missedTokenError,
-}: BaseProps & FokenInedtifierProps): Promise<TokenModel> => {
+  isRedirect = false,
+}: BaseProps & TokenIdentifierProps): Promise<TokenModel> => {
   const condition = [
     isNull(tokensTable.consumedAt), // Token not yet consumed
     gt(tokensTable.expiresAt, new Date()), // Token not expired
@@ -34,12 +46,15 @@ export const getValidToken = async ({
 
   const meta = { requiredType };
 
-  if (!tokenRecord) throw new AppError(missedTokenError ?? { status: 404, type: `${requiredType}_not_found`, severity: 'warn', meta });
+  if (!tokenRecord) throw new AppError({ status: 404, type: `${requiredType}_not_found`, severity: 'warn', meta, isRedirect });
 
-  if (isExpiredDate(tokenRecord.expiresAt)) throw new AppError({ status: 401, type: `${requiredType}_expired`, severity: 'warn', meta });
+  // Token expired
+  if (isExpiredDate(tokenRecord.expiresAt)) throw new AppError({ status: 401, type: `${requiredType}_expired`, severity: 'warn', meta, isRedirect });
 
-  if (tokenRecord.type !== requiredType) throw new AppError({ status: 401, type: 'invalid_token', severity: 'warn', meta });
+  // Sanity check
+  if (tokenRecord.type !== requiredType) throw new AppError({ status: 401, type: 'invalid_token', severity: 'error', meta, isRedirect });
 
+  // Consume token after validation
   if (consumeToken) await db.update(tokensTable).set({ consumedAt: new Date() }).where(eq(tokensTable.id, tokenRecord.id));
   return tokenRecord;
 };
diff --git a/config/default.ts b/config/default.ts
index 9a7cf9163..d0f2ec557 100644
--- a/config/default.ts
+++ b/config/default.ts
@@ -131,7 +131,7 @@ enabledOAuthProviders: ['github'] as const,
   has: {
     pwa: true, // Progressive Web App support for preloading static assets and offline support
     sync: true, // Realtime updates and sync using Electric Sync
-    registrationEnabled: false, // Allow users to sign up. If false, the app is by invitation only
+    registrationEnabled: true, // Allow users to sign up. If false, the app is by invitation only
     waitlist: true, // Suggest a waitlist for unknown emails when sign up is disabled,
     uploadEnabled: true, // s3 fully configured, if false, files will be stored in local browser (indexedDB)
   },
diff --git a/frontend/src/api.gen/sdk.gen.ts b/frontend/src/api.gen/sdk.gen.ts
index 38e011960..af44f0703 100644
--- a/frontend/src/api.gen/sdk.gen.ts
+++ b/frontend/src/api.gen/sdk.gen.ts
@@ -15,6 +15,9 @@ import type {
   CheckSlugData,
   CheckSlugErrors,
   CheckSlugResponses,
+  CheckTokenData,
+  CheckTokenErrors,
+  CheckTokenResponses,
   CreateAttachmentData,
   CreateAttachmentErrors,
   CreateAttachmentResponses,
@@ -203,9 +206,6 @@ import type {
   UpdateUserData,
   UpdateUserErrors,
   UpdateUserResponses,
-  ValidateTokenData,
-  ValidateTokenErrors,
-  ValidateTokenResponses,
   VerifyEmailData,
   VerifyEmailErrors,
 } from './types.gen';
@@ -278,7 +278,7 @@ export const signUp = <ThrowOnError extends boolean = true>(options?: Options<Si
 /**
  * Sign up to accept invite
  * 🌐 Public access
- * ⏳ Spam (10/h), Email (5/h)
+ * ⏳ token_signup_invitation (5/h), Email (5/h)
  *
  * Registers a user using an email and password in response to a system or organization invitation.
  *
@@ -402,20 +402,20 @@ export const signIn = <ThrowOnError extends boolean = true>(options?: Options<Si
 };
 
 /**
- * Validate token
+ * Check token
  * 🌐 Public access
  *
- * Checks if a token (e.g. for password reset, email verification, or invite) is still valid and returns basic data if valid.
+ * Checks by token id - NOT token itself - if a token (e.g. for password reset, email verification, or invite) is still valid and returns basic data if valid.
  *
- * **POST /auth/validate-token/{token}** ·· [validateToken](http://localhost:4000/docs#tag/auth/post/auth/validate-token/{token}) ·· _auth_
+ * **POST /auth/check-token/{tokenId}** ·· [checkToken](http://localhost:4000/docs#tag/auth/post/auth/check-token/{tokenId}) ·· _auth_
  *
- * @param {validateTokenData} options
- * @param {string} options.path.token - `string`
+ * @param {checkTokenData} options
+ * @param {string} options.path.tokenid - `string`
  * @param {enum} options.query.type - `enum`
  * @returns Possible status codes: 200, 400, 401, 403, 404, 429
  */
-export const validateToken = <ThrowOnError extends boolean = true>(options: Options<ValidateTokenData, ThrowOnError>) => {
-  return (options.client ?? client).post<ValidateTokenResponses, ValidateTokenErrors, ThrowOnError, 'data'>({
+export const checkToken = <ThrowOnError extends boolean = true>(options: Options<CheckTokenData, ThrowOnError>) => {
+  return (options.client ?? client).post<CheckTokenResponses, CheckTokenErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
     security: [
       {
@@ -424,7 +424,7 @@ export const validateToken = <ThrowOnError extends boolean = true>(options: Opti
         type: 'apiKey',
       },
     ],
-    url: '/auth/validate-token/{token}',
+    url: '/auth/check-token/{tokenId}',
     ...options,
   });
 };
@@ -486,7 +486,7 @@ export const startImpersonation = <ThrowOnError extends boolean = true>(options:
 
 /**
  * Stop impersonating
- * 🌐 Public access
+ * 🛡️ Requires authentication
  *
  * Ends impersonation by clearing the current impersonation session and restoring the admin context.
  *
@@ -540,15 +540,16 @@ export const signOut = <ThrowOnError extends boolean = true>(options?: Options<S
  * Authenticate with GitHub
  * 🌐 Public access
  *
- * Starts OAuth authentication with GitHub. Supports account connection (`connect`), redirect (`redirect`), or invite token (`token`).
+ * Starts OAuth authentication with GitHub. Can be used for account connection, email verification, invitation process, defaults to authentication.
  *
  * **GET /auth/github** ·· [github](http://localhost:4000/docs#tag/auth/get/auth/github) ·· _auth_
  *
  * @param {githubData} options
  * @param {enum} options.query.type - `enum`
  * @param {string=} options.query.redirect - `string` (optional)
- * @param {string=} options.query.connect - `string` (optional)
+ * @param {string=} options.query.connectuserid - `string` (optional)
  * @param {string=} options.query.token - `string` (optional)
+ * @param {string=} options.query.tokenid - `string` (optional)
  * @returns Possible status codes: 302, 400, 401, 403, 404, 429
  */
 export const github = <ThrowOnError extends boolean = true>(options: Options<GithubData, ThrowOnError>) => {
@@ -563,15 +564,16 @@ export const github = <ThrowOnError extends boolean = true>(options: Options<Git
  * Authenticate with Google
  * 🌐 Public access
  *
- * Starts OAuth authentication with Google. Supports account connection (`connect`), redirect (`redirect`), or invite token (`token`).
+ * Starts OAuth authentication with Google. Can be used for account connection, email verification, invitation process, defaults to authentication.
  *
  * **GET /auth/google** ·· [google](http://localhost:4000/docs#tag/auth/get/auth/google) ·· _auth_
  *
  * @param {googleData} options
  * @param {enum} options.query.type - `enum`
  * @param {string=} options.query.redirect - `string` (optional)
- * @param {string=} options.query.connect - `string` (optional)
+ * @param {string=} options.query.connectuserid - `string` (optional)
  * @param {string=} options.query.token - `string` (optional)
+ * @param {string=} options.query.tokenid - `string` (optional)
  * @returns Possible status codes: 302, 400, 401, 403, 404, 429
  */
 export const google = <ThrowOnError extends boolean = true>(options: Options<GoogleData, ThrowOnError>) => {
@@ -586,15 +588,16 @@ export const google = <ThrowOnError extends boolean = true>(options: Options<Goo
  * Authenticate with Microsoft
  * 🌐 Public access
  *
- * Starts OAuth authentication with Microsoft. Supports account connection (`connect`), redirect (`redirect`), or invite token (`token`).
+ * Starts OAuth authentication with Microsoft. Can be used for account connection, email verification, invitation process, defaults to authentication.
  *
  * **GET /auth/microsoft** ·· [microsoft](http://localhost:4000/docs#tag/auth/get/auth/microsoft) ·· _auth_
  *
  * @param {microsoftData} options
  * @param {enum} options.query.type - `enum`
  * @param {string=} options.query.redirect - `string` (optional)
- * @param {string=} options.query.connect - `string` (optional)
+ * @param {string=} options.query.connectuserid - `string` (optional)
  * @param {string=} options.query.token - `string` (optional)
+ * @param {string=} options.query.tokenid - `string` (optional)
  * @returns Possible status codes: 302, 400, 401, 403, 404, 429
  */
 export const microsoft = <ThrowOnError extends boolean = true>(options: Options<MicrosoftData, ThrowOnError>) => {
@@ -2053,6 +2056,7 @@ export const updateAttachment = <ThrowOnError extends boolean = true>(options: O
 /**
  * Redirect to attachment
  * 🌐 Public access
+ * ⏳ token_attachment_redirect (5/h)
  *
  * Redirects to the file's public or presigned URL, depending on storage visibility.
  *
diff --git a/frontend/src/api.gen/types.gen.ts b/frontend/src/api.gen/types.gen.ts
index 8590b4f30..3a96bd343 100644
--- a/frontend/src/api.gen/types.gen.ts
+++ b/frontend/src/api.gen/types.gen.ts
@@ -584,18 +584,18 @@ export type SignInResponses = {
 
 export type SignInResponse = SignInResponses[keyof SignInResponses];
 
-export type ValidateTokenData = {
+export type CheckTokenData = {
   body?: never;
   path: {
-    token: string;
+    tokenId: string;
   };
   query: {
     type: 'email_verification' | 'password_reset' | 'invitation' | 'confirm_mfa';
   };
-  url: '/auth/validate-token/{token}';
+  url: '/auth/check-token/{tokenId}';
 };
 
-export type ValidateTokenErrors = {
+export type CheckTokenErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -628,9 +628,9 @@ export type ValidateTokenErrors = {
   };
 };
 
-export type ValidateTokenError = ValidateTokenErrors[keyof ValidateTokenErrors];
+export type CheckTokenError = CheckTokenErrors[keyof CheckTokenErrors];
 
-export type ValidateTokenResponses = {
+export type CheckTokenResponses = {
   /**
    * Token is valid
    */
@@ -644,7 +644,7 @@ export type ValidateTokenResponses = {
   };
 };
 
-export type ValidateTokenResponse = ValidateTokenResponses[keyof ValidateTokenResponses];
+export type CheckTokenResponse = CheckTokenResponses[keyof CheckTokenResponses];
 
 export type AcceptEntityInviteData = {
   body?: never;
@@ -865,8 +865,9 @@ export type GithubData = {
   query: {
     type: 'auth' | 'connect' | 'invite' | 'verify';
     redirect?: string;
-    connect?: string;
+    connectUserId?: string;
     token?: string;
+    tokenId?: string;
   };
   url: '/auth/github';
 };
@@ -912,8 +913,9 @@ export type GoogleData = {
   query: {
     type: 'auth' | 'connect' | 'invite' | 'verify';
     redirect?: string;
-    connect?: string;
+    connectUserId?: string;
     token?: string;
+    tokenId?: string;
   };
   url: '/auth/google';
 };
@@ -959,8 +961,9 @@ export type MicrosoftData = {
   query: {
     type: 'auth' | 'connect' | 'invite' | 'verify';
     redirect?: string;
-    connect?: string;
+    connectUserId?: string;
     token?: string;
+    tokenId?: string;
   };
   url: '/auth/microsoft';
 };
diff --git a/frontend/src/api.gen/zod.gen.ts b/frontend/src/api.gen/zod.gen.ts
index 4c98a0daa..8a4401553 100644
--- a/frontend/src/api.gen/zod.gen.ts
+++ b/frontend/src/api.gen/zod.gen.ts
@@ -326,10 +326,10 @@ export const zSignInResponse = z.object({
   redirectPath: z.optional(z.string()),
 });
 
-export const zValidateTokenData = z.object({
+export const zCheckTokenData = z.object({
   body: z.optional(z.never()),
   path: z.object({
-    token: z.string(),
+    tokenId: z.string(),
   }),
   query: z.object({
     type: z.enum(['email_verification', 'password_reset', 'invitation', 'confirm_mfa']),
@@ -339,7 +339,7 @@ export const zValidateTokenData = z.object({
 /**
  * Token is valid
  */
-export const zValidateTokenResponse = z.object({
+export const zCheckTokenResponse = z.object({
   email: z.email(),
   role: z.union([z.enum(['member', 'admin']), z.null()]),
   userId: z.optional(z.string()),
@@ -407,8 +407,9 @@ export const zGithubData = z.object({
   query: z.object({
     type: z.enum(['auth', 'connect', 'invite', 'verify']),
     redirect: z.optional(z.string()),
-    connect: z.optional(z.string()),
+    connectUserId: z.optional(z.string()),
     token: z.optional(z.string()),
+    tokenId: z.optional(z.string()),
   }),
 });
 
@@ -418,8 +419,9 @@ export const zGoogleData = z.object({
   query: z.object({
     type: z.enum(['auth', 'connect', 'invite', 'verify']),
     redirect: z.optional(z.string()),
-    connect: z.optional(z.string()),
+    connectUserId: z.optional(z.string()),
     token: z.optional(z.string()),
+    tokenId: z.optional(z.string()),
   }),
 });
 
@@ -429,8 +431,9 @@ export const zMicrosoftData = z.object({
   query: z.object({
     type: z.enum(['auth', 'connect', 'invite', 'verify']),
     redirect: z.optional(z.string()),
-    connect: z.optional(z.string()),
+    connectUserId: z.optional(z.string()),
     token: z.optional(z.string()),
+    tokenId: z.optional(z.string()),
   }),
 });
 
diff --git a/frontend/src/modules/auth/accept-entity-invite.tsx b/frontend/src/modules/auth/accept-entity-invite.tsx
index 59b4c761f..179593014 100644
--- a/frontend/src/modules/auth/accept-entity-invite.tsx
+++ b/frontend/src/modules/auth/accept-entity-invite.tsx
@@ -1,5 +1,5 @@
 import { useMutation } from '@tanstack/react-query';
-import { Link, useNavigate, useParams } from '@tanstack/react-router';
+import { Link, useNavigate, useParams, useSearch } from '@tanstack/react-router';
 import { appConfig } from 'config';
 import { Ban, Check } from 'lucide-react';
 import { useTranslation } from 'react-i18next';
@@ -20,10 +20,11 @@ const AcceptEntityInvite = () => {
   const navigate = useNavigate();
 
   const { token } = useParams({ from: '/publicLayout/authLayout/invitation/$token' });
+  const { tokenId } = useSearch({ from: '/publicLayout/authLayout/invitation/$token' });
 
   const { user: currentUser } = useUserStore();
 
-  const { data, isLoading, error } = useCheckToken('invitation', token);
+  const { data, isLoading, error } = useCheckToken('invitation', tokenId);
 
   const {
     mutate: _acceptEntityInvite,
diff --git a/frontend/src/modules/auth/email-verification.tsx b/frontend/src/modules/auth/email-verification.tsx
index 293337e8c..6270c33f6 100644
--- a/frontend/src/modules/auth/email-verification.tsx
+++ b/frontend/src/modules/auth/email-verification.tsx
@@ -1,4 +1,4 @@
-import { useParams } from '@tanstack/react-router';
+import { useParams, useSearch } from '@tanstack/react-router';
 import { useTranslation } from 'react-i18next';
 import { LegalNotice } from '~/modules/auth/steps/legal-notice';
 
@@ -6,11 +6,14 @@ const EmailVerification = () => {
   const { t } = useTranslation();
 
   const { reason } = useParams({ from: '/publicLayout/authLayout/auth/email-verification/$reason' });
+  const { provider } = useSearch({ from: '/publicLayout/authLayout/auth/email-verification/$reason' });
 
   return (
     <div className="text-center">
       <h1 className="text-2xl">{t('common:almost_there')}</h1>
-      <p className="font-light my-4">{t('common:request_verification.text', { reason: t(`common:request_verification.${reason}`) })}</p>
+      <p className="font-light my-4">
+        {t('common:request_verification.text', { reason: t(`common:request_verification.${reason}`, { providerName: provider }) })}
+      </p>
 
       {reason === 'signup' && <LegalNotice mode="verify" />}
     </div>
diff --git a/frontend/src/modules/auth/types.ts b/frontend/src/modules/auth/types.ts
index d5c0a847f..0174d8d3b 100644
--- a/frontend/src/modules/auth/types.ts
+++ b/frontend/src/modules/auth/types.ts
@@ -1,4 +1,4 @@
-import type { CreatePasskeyChallengeData, ValidateTokenResponse } from '~/api.gen';
+import type { CheckTokenResponse, CreatePasskeyChallengeData } from '~/api.gen';
 
 type PasskeyChallengeType = NonNullable<CreatePasskeyChallengeData['body']>['type'];
 
@@ -7,6 +7,6 @@ export interface PasskeyCredentialProps {
   type: PasskeyChallengeType;
 }
 
-export type TokenData = ValidateTokenResponse;
+export type TokenData = CheckTokenResponse;
 
 export type AuthStep = 'checkEmail' | 'signIn' | 'signUp' | 'inviteOnly' | 'waitlist' | 'error' | 'mfa';
diff --git a/frontend/src/modules/auth/use-token-check.tsx b/frontend/src/modules/auth/use-token-check.tsx
index 51559be2f..a6338136d 100644
--- a/frontend/src/modules/auth/use-token-check.tsx
+++ b/frontend/src/modules/auth/use-token-check.tsx
@@ -1,24 +1,24 @@
 import { type UseQueryResult, useQuery } from '@tanstack/react-query';
 import type { appConfig } from 'config';
-import { validateToken } from '~/api.gen';
+import { checkToken } from '~/api.gen';
 import type { ApiError } from '~/lib/api';
 import type { TokenData } from '~/modules/auth/types';
 
 type TokenType = (typeof appConfig.tokenTypes)[number];
 
 /**
- *  Get token data by ID and get a nonce.
+ *  Get token data by ID.
  *
  * @param type Type of the token (`"email_verification" | "password_reset" | "invitation"`)
- * @param id Token ID to check
+ * @param tokenId Token ID to check
  * @param enabled (Default true) Enable the query
  */
-export const useCheckToken = (type: TokenType, token?: string, enabled = true): UseQueryResult<TokenData | undefined, ApiError> => {
+export const useCheckToken = (type: TokenType, tokenId?: string, enabled = true): UseQueryResult<TokenData | undefined, ApiError> => {
   return useQuery({
     queryKey: [],
     queryFn: async () => {
-      if (!token) throw new Error('Token is required');
-      return validateToken({ path: { token }, query: { type } });
+      if (!tokenId) throw new Error('Token ID is required');
+      return checkToken({ path: { tokenId }, query: { type } });
     },
     enabled,
     staleTime: 0, // Important to always get latest token status
diff --git a/frontend/src/modules/me/settings-page.tsx b/frontend/src/modules/me/settings-page.tsx
index b69c0db84..7321c8e53 100644
--- a/frontend/src/modules/me/settings-page.tsx
+++ b/frontend/src/modules/me/settings-page.tsx
@@ -84,7 +84,7 @@ const UserSettingsPage = () => {
     // Proceed to OAuth URL with redirect and connect
     try {
       const baseUrl = `${appConfig.backendAuthUrl}/${provider}`;
-      const params = new URLSearchParams({ connect: user.id, type: 'connect', redirect: encodeURIComponent(window.location.pathname) });
+      const params = new URLSearchParams({ connectUserId: user.id, type: 'connect', redirect: encodeURIComponent(window.location.pathname) });
 
       const providerUrl = `${baseUrl}?${params.toString()}`;
       window.location.assign(providerUrl);
diff --git a/frontend/src/routes/auth.tsx b/frontend/src/routes/auth-routes.tsx
similarity index 90%
rename from frontend/src/routes/auth.tsx
rename to frontend/src/routes/auth-routes.tsx
index 410e0f195..bdc84b648 100644
--- a/frontend/src/routes/auth.tsx
+++ b/frontend/src/routes/auth-routes.tsx
@@ -13,16 +13,21 @@ import { AuthStepsProvider } from '~/modules/auth/steps/provider';
 import Unsubscribed from '~/modules/auth/unsubscribed';
 import { meQueryOptions } from '~/modules/me/query';
 import { queryClient } from '~/query/query-client';
-import { PublicRoute } from '~/routes/base';
+import { PublicRoute } from '~/routes/base-routes';
 import { useUserStore } from '~/store/user';
 import appTitle from '~/utils/app-title';
 
 const authenticateRouteSearch = z.object({
-  redirect: z.string().optional(),
+  tokenId: z.string().optional(),
   token: z.string().optional(),
+  redirect: z.string().optional(),
   fromRoot: z.boolean().optional(),
 });
 
+const invitationRouteSearch = authenticateRouteSearch.extend({
+  tokenId: z.string(),
+});
+
 export const AuthLayoutRoute = createRoute({
   id: 'authLayout',
   staticData: { isAuth: false },
@@ -79,6 +84,7 @@ export const CreatePasswordWithTokenRoute = createRoute({
 
 export const EmailVerificationRoute = createRoute({
   path: '/auth/email-verification/$reason',
+  validateSearch: z.object({ provider: z.string().optional() }),
   staticData: { isAuth: false },
   head: () => ({ meta: [{ title: appTitle('Email verification') }] }),
   getParentRoute: () => AuthLayoutRoute,
@@ -87,16 +93,18 @@ export const EmailVerificationRoute = createRoute({
 
 export const AcceptEntityInviteRoute = createRoute({
   path: '/invitation/$token',
+  validateSearch: invitationRouteSearch,
   staticData: { isAuth: true },
   head: () => ({ meta: [{ title: appTitle('Join') }] }),
-  beforeLoad: async ({ params }) => {
+  beforeLoad: async ({ params, search }) => {
     try {
       const queryOptions = meQueryOptions();
       const options = { ...queryOptions, revalidateIfStale: true };
       await queryClient.ensureQueryData(options);
     } catch {
+      // When user is new, authentication will process the user first, then redirect back here
       console.info('Not authenticated (silent check) -> redirect to sign in');
-      throw redirect({ to: '/auth/authenticate', search: { token: params.token } });
+      throw redirect({ to: '/auth/authenticate', search: { tokenId: search.tokenId, token: params.token } });
     }
   },
   getParentRoute: () => AuthLayoutRoute,
diff --git a/frontend/src/routes/base.tsx b/frontend/src/routes/base-routes.tsx
similarity index 100%
rename from frontend/src/routes/base.tsx
rename to frontend/src/routes/base-routes.tsx
diff --git a/frontend/src/routes/home.tsx b/frontend/src/routes/home-routes.tsx
similarity index 96%
rename from frontend/src/routes/home.tsx
rename to frontend/src/routes/home-routes.tsx
index d552f6e0a..fc2db3450 100644
--- a/frontend/src/routes/home.tsx
+++ b/frontend/src/routes/home-routes.tsx
@@ -1,7 +1,7 @@
 import { createRoute, redirect } from '@tanstack/react-router';
 import { lazy, Suspense } from 'react';
 import Home from '~/modules/home';
-import { AppRoute } from '~/routes/base';
+import { AppRoute } from '~/routes/base-routes';
 import { useUserStore } from '~/store/user';
 import appTitle from '~/utils/app-title';
 
diff --git a/frontend/src/routes/marketing.tsx b/frontend/src/routes/marketing-routes.tsx
similarity index 95%
rename from frontend/src/routes/marketing.tsx
rename to frontend/src/routes/marketing-routes.tsx
index bc60344cc..410b0826e 100644
--- a/frontend/src/routes/marketing.tsx
+++ b/frontend/src/routes/marketing-routes.tsx
@@ -3,7 +3,7 @@ import AboutPage from '~/modules/marketing/about/about-page';
 import AccessibilityPage from '~/modules/marketing/accessibility-page';
 import ContactPage from '~/modules/marketing/contact-page';
 import { LegalPage } from '~/modules/marketing/legal-page';
-import { PublicRoute, rootRoute } from '~/routes/base';
+import { PublicRoute, rootRoute } from '~/routes/base-routes';
 import appTitle from '~/utils/app-title';
 
 export const AboutRoute = createRoute({
diff --git a/frontend/src/routes/organizations.tsx b/frontend/src/routes/organization-routes.tsx
similarity index 98%
rename from frontend/src/routes/organizations.tsx
rename to frontend/src/routes/organization-routes.tsx
index af57e4c19..62635512d 100644
--- a/frontend/src/routes/organizations.tsx
+++ b/frontend/src/routes/organization-routes.tsx
@@ -5,7 +5,7 @@ import { lazy, Suspense } from 'react';
 import ErrorNotice from '~/modules/common/error-notice';
 import { organizationQueryOptions } from '~/modules/organizations/query';
 import { queryClient } from '~/query/query-client';
-import { AppRoute } from '~/routes/base';
+import { AppRoute } from '~/routes/base-routes';
 import { useToastStore } from '~/store/toast';
 import appTitle from '~/utils/app-title';
 import { noDirectAccess } from '~/utils/no-direct-access';
diff --git a/frontend/src/routes/route-tree.tsx b/frontend/src/routes/route-tree.tsx
index 3a675f216..20e0a46f3 100644
--- a/frontend/src/routes/route-tree.tsx
+++ b/frontend/src/routes/route-tree.tsx
@@ -9,13 +9,13 @@ import {
   RequestPasswordRoute,
   SignOutRoute,
   UnsubscribedRoute,
-} from '~/routes/auth';
-import { AppRoute, ErrorNoticeRoute, PublicRoute, rootRoute } from '~/routes/base';
-import { HomeAliasRoute, HomeRoute, WelcomeRoute } from '~/routes/home';
-import { AboutRoute, AccessibilityRoute, ContactRoute, LegalRoute } from '~/routes/marketing';
-import { OrganizationAttachmentsRoute, OrganizationMembersRoute, OrganizationRoute, OrganizationSettingsRoute } from '~/routes/organizations';
-import { MetricsRoute, OrganizationsTableRoute, RequestsTableRoute, SystemRoute, UsersTableRoute } from '~/routes/system';
-import { UserInOrganizationProfileRoute, UserProfileRoute, UserSettingsRoute } from '~/routes/users';
+} from '~/routes/auth-routes';
+import { AppRoute, ErrorNoticeRoute, PublicRoute, rootRoute } from '~/routes/base-routes';
+import { HomeAliasRoute, HomeRoute, WelcomeRoute } from '~/routes/home-routes';
+import { AboutRoute, AccessibilityRoute, ContactRoute, LegalRoute } from '~/routes/marketing-routes';
+import { OrganizationAttachmentsRoute, OrganizationMembersRoute, OrganizationRoute, OrganizationSettingsRoute } from '~/routes/organization-routes';
+import { MetricsRoute, OrganizationsTableRoute, RequestsTableRoute, SystemRoute, UsersTableRoute } from '~/routes/system-routes';
+import { UserInOrganizationProfileRoute, UserProfileRoute, UserSettingsRoute } from '~/routes/user-routes';
 
 //App-specific route imports here
 //...
diff --git a/frontend/src/routes/system.tsx b/frontend/src/routes/system-routes.tsx
similarity index 98%
rename from frontend/src/routes/system.tsx
rename to frontend/src/routes/system-routes.tsx
index 7ad14d559..4c84d9a3f 100644
--- a/frontend/src/routes/system.tsx
+++ b/frontend/src/routes/system-routes.tsx
@@ -2,7 +2,7 @@ import { createRoute } from '@tanstack/react-router';
 import { lazy, Suspense } from 'react';
 import ErrorNotice from '~/modules/common/error-notice';
 import SystemPage from '~/modules/system/system-page';
-import { AppRoute } from '~/routes/base';
+import { AppRoute } from '~/routes/base-routes';
 import appTitle from '~/utils/app-title';
 import { noDirectAccess } from '~/utils/no-direct-access';
 import { organizationsRouteSearchParamsSchema, requestsRouteSearchParamsSchema, usersRouteSearchParamsSchema } from './search-params-schemas';
diff --git a/frontend/src/routes/users.tsx b/frontend/src/routes/user-routes.tsx
similarity index 98%
rename from frontend/src/routes/users.tsx
rename to frontend/src/routes/user-routes.tsx
index bd453c5d8..8b1a30635 100644
--- a/frontend/src/routes/users.tsx
+++ b/frontend/src/routes/user-routes.tsx
@@ -5,7 +5,7 @@ import Spinner from '~/modules/common/spinner';
 import { meAuthQueryOptions } from '~/modules/me/query';
 import { userQueryOptions } from '~/modules/users/query';
 import { queryClient } from '~/query/query-client';
-import { AppRoute } from '~/routes/base';
+import { AppRoute } from '~/routes/base-routes';
 import appTitle from '~/utils/app-title';
 
 const UserProfilePage = lazy(() => import('~/modules/users/profile-page'));
diff --git a/locales/en/backend.json b/locales/en/backend.json
index 02073c7f9..fd8e7a6d2 100644
--- a/locales/en/backend.json
+++ b/locales/en/backend.json
@@ -7,7 +7,11 @@
   "email.create_password.text": "A password reset link has been requested for your <strong>{{appName}}</strong> account.",
   "email.email_verification.preview": "Verify your email for {{appName}}",
   "email.email_verification.subject": "Verify email",
-  "email.email_verification.text": "Hi, you are almost ready to start on {{appName}}! Click the link below to verify your email address '{{email}}' and get started. The link expires in 2 hours.",
+  "email.email_verification.text": "Hi {{name}}, you are almost ready to start on {{appName}}! Click the link below to verify your email address '{{email}}' and get started. The link expires in 2 hours.",
+  "email.oauth_verification.preview": "Verify connecting your {{ providerName}} to {{appName}}",
+  "email.oauth_verification.subject": "Verify to connect",
+  "email.oauth_verification.text": "Hi {{name}}, to confirm linking your {{providerName}} account with email {{providerEmail}} to {{appName}} with email {{email}}, click the link below. The link expires in 2 hours.",
+  "email.oauth_verification.verify": "Connect {{providerName}}",
   "email.hi": "Hi {{name}},",
   "email.invite_expires": "This link will expire in 7 days.",
   "email.member_invite.preview": "Invited to {{entityName}} on {{appName}}",
diff --git a/locales/en/common.json b/locales/en/common.json
index 22ca18225..bd07fa8a0 100644
--- a/locales/en/common.json
+++ b/locales/en/common.json
@@ -301,12 +301,12 @@
   "request_other": "Requests",
   "request_password.text": "Reset your password by sending a reset link to your email address.",
   "request_type": "Request type",
-  "request_verification.connect": "to connect your account",
+  "request_verification.connect": "to connect your {{providerName}} account",
   "request_verification.invite": "so you can proceed with your invitation",
   "request_verification.legal_notice": "By verifying your email, you agree to the",
   "request_verification.signin": "to sign in",
   "request_verification.signup": "to complete your sign up",
-  "request_verification.text": "We sent you an email {{reason}}. Please check your inbox and click on the link to verify your email address.",
+  "request_verification.text": "We sent you an email {{reason}}. Please check your inbox and click on the link to complete email verification.",
   "requests": "Requests",
   "requests.text": "Requests per minute",
   "resend": "Resend",
diff --git a/locales/en/errors.json b/locales/en/errors.json
index 132c3cc13..e2b6cd0ad 100644
--- a/locales/en/errors.json
+++ b/locales/en/errors.json
@@ -111,15 +111,18 @@
   "not_found": "Not found",
   "not_found.text": "This resource does not exist or has been deleted.",
   "not_found.token": "Token is invalid. Please request a new one.",
-  "oauth_connection_not_found": "Failed to connect, required data missing.",
-  "oauth_token_missing": "Token missing",
-  "oauth_token_missing.text": "The token you provided is missing or invalid. Please try again or use another method.",
+  "connect_user_not_found": "Failed to connect account, user data missing.",
+  "verification_not_found": "Failed to verify email, token missing or invalid.",
   "oauth_failed": "OAuth failed",
   "oauth_failed.text": "OAuth authentication failed. Please try again or use another method.",
   "oauth_wrong_email": "Email doesn't match",
   "oauth_wrong_email.text": "It's not possible to link accounts with different emails while accepting an invitation. Please use another authentication method or contact support.",
-  "oauth_mismatch": "Not allowed to connect.",
-  "oauth_mismatch.text": "The account you tried to connect is already linked to a different user.",
+  "oauth_taken": "Not allowed to connect.",
+  "oauth_taken.text": "The account you tried to connect is already linked to a different user.",
+  "oauth_email_exists": "Not allowed to connect.",
+  "oauth_email_exists.text": "The email of the account you tried to connect, already belongs to an existing user. If that's you, please sign first and go to settings to connect your this account.",
+  "oauth_conflict": "OAuth conflict",
+  "oauth_conflict.text": "There is a conflict with the OAuth account you tried to connect. Please contact support.",
   "organization_missing": "Organization missing",
   "organization_missing.text": "Organization slug or id is required to perform this action.",
   "page_not_found": "Page not found",

From fb816b532065368be7d63ec6ed8e0646ed86e9cb Mon Sep 17 00:00:00 2001
From: David Hordiienko <shiraz0david@gmail.com>
Date: Wed, 24 Sep 2025 16:55:27 +0300
Subject: [PATCH 06/48] improve: PendingInvitations on offline

---
 .../pending-table/pending-invitations.tsx        | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/frontend/src/modules/memberships/pending-table/pending-invitations.tsx b/frontend/src/modules/memberships/pending-table/pending-invitations.tsx
index 8a8678e94..10f180a4b 100644
--- a/frontend/src/modules/memberships/pending-table/pending-invitations.tsx
+++ b/frontend/src/modules/memberships/pending-table/pending-invitations.tsx
@@ -1,5 +1,8 @@
+import { onlineManager } from '@tanstack/react-query';
+import { WifiOff } from 'lucide-react';
 import { lazy, Suspense, useRef } from 'react';
 import { useTranslation } from 'react-i18next';
+import ContentPlaceholder from '~/modules/common/content-placeholder';
 import { useSheeter } from '~/modules/common/sheeter/use-sheeter';
 import type { EntityPage } from '~/modules/entities/types';
 import type { PendingInvitationsTableProps } from '~/modules/memberships/pending-table';
@@ -13,11 +16,14 @@ export const PendingInvitations = ({ entity }: PendingInvitationsTableProps) =>
   const createSheet = useSheeter((state) => state.create);
 
   const openSheet = () => {
-    const SheetComponent = ({ entity }: { entity: EntityPage }) => (
-      <Suspense>
-        <PendingTable entity={entity} />
-      </Suspense>
-    );
+    const SheetComponent = ({ entity }: { entity: EntityPage }) =>
+      onlineManager.isOnline() ? (
+        <Suspense>
+          <PendingTable entity={entity} />
+        </Suspense>
+      ) : (
+        <ContentPlaceholder icon={WifiOff} title={t(`${'common:offline.text'}`)} />
+      );
 
     createSheet(<SheetComponent entity={entity} />, {
       id: 'pending-invites',

From 13da638c32d361fc75f772f8fcbf4455688901e3 Mon Sep 17 00:00:00 2001
From: flipvanhaaren <flip@shareworks.nl>
Date: Wed, 24 Sep 2025 17:05:56 +0200
Subject: [PATCH 07/48] improve: more progress on auth improvements

---
 backend/src/lib/i18n.ts                          |  3 +++
 backend/src/lib/mailer.ts                        |  4 +++-
 backend/src/middlewares/has-valid-token.ts       |  2 --
 backend/src/modules/auth/handlers.ts             |  3 ++-
 .../src/modules/auth/helpers/oauth/callback.ts   |  2 +-
 .../src/modules/auth/helpers/oauth/initiation.ts | 16 ++++++++--------
 backend/src/modules/auth/schema.ts               |  2 ++
 backend/src/modules/memberships/handlers.ts      |  8 ++++----
 backend/src/utils/sanitize-email-subject.ts      | 13 +++++++++++++
 .../src/modules/auth/create-password-form.tsx    |  5 +++--
 frontend/src/modules/auth/oauth-providers.tsx    |  5 +++--
 frontend/src/modules/auth/steps/provider.tsx     | 11 ++++++-----
 frontend/src/modules/auth/steps/sign-in.tsx      |  6 ++++--
 frontend/src/routes/auth-routes.tsx              |  7 ++-----
 locales/en/common.json                           |  2 +-
 locales/en/errors.json                           |  8 +++++---
 16 files changed, 60 insertions(+), 37 deletions(-)
 create mode 100644 backend/src/utils/sanitize-email-subject.ts

diff --git a/backend/src/lib/i18n.ts b/backend/src/lib/i18n.ts
index d44528afa..d4cc42e11 100644
--- a/backend/src/lib/i18n.ts
+++ b/backend/src/lib/i18n.ts
@@ -15,6 +15,9 @@ const initOptions: InitOptions = {
   supportedLngs: appConfig.languages,
   load: 'languageOnly',
   fallbackLng: appConfig.defaultLanguage,
+  interpolation: {
+    escapeValue: false, // React escapes by default
+  },
   defaultNS: 'backend',
 };
 
diff --git a/backend/src/lib/mailer.ts b/backend/src/lib/mailer.ts
index 6417c5e12..daea7597e 100644
--- a/backend/src/lib/mailer.ts
+++ b/backend/src/lib/mailer.ts
@@ -3,6 +3,7 @@ import { appConfig } from 'config';
 import { render } from 'jsx-email';
 import type { ReactElement } from 'react';
 import { env } from '#/env';
+import { sanitizeEmailSubject } from '#/utils/sanitize-email-subject';
 
 const apiInstance = new brevo.TransactionalEmailsApi();
 
@@ -77,8 +78,9 @@ export const mailer: Mailer = {
     }
 
     const sendSmtpEmail = new brevo.SendSmtpEmail();
+    const sanitizedSubject = sanitizeEmailSubject(subject || `${appConfig.name} message`);
 
-    sendSmtpEmail.subject = subject || `${appConfig.name} message`;
+    sendSmtpEmail.subject = sanitizedSubject;
     sendSmtpEmail.htmlContent = html;
     sendSmtpEmail.to = [{ email: env.SEND_ALL_TO_EMAIL || to }];
     sendSmtpEmail.replyTo = { email: replyTo || appConfig.supportEmail };
diff --git a/backend/src/middlewares/has-valid-token.ts b/backend/src/middlewares/has-valid-token.ts
index 0e92ab4b2..84b17e1ab 100644
--- a/backend/src/middlewares/has-valid-token.ts
+++ b/backend/src/middlewares/has-valid-token.ts
@@ -18,8 +18,6 @@ export const hasValidToken = (requiredType: TokenModel['type']): MiddlewareHandl
     // For email verification, redirect to frontend
     const isRedirect = requiredType === 'email_verification';
 
-    console.log('Validating token of type', requiredType, isRedirect);
-
     // Find token in request
     const token = ctx.req.param('token');
     if (!token) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error', isRedirect });
diff --git a/backend/src/modules/auth/handlers.ts b/backend/src/modules/auth/handlers.ts
index dc5237f1a..cbe8d5844 100644
--- a/backend/src/modules/auth/handlers.ts
+++ b/backend/src/modules/auth/handlers.ts
@@ -261,7 +261,7 @@ const authRouteHandlers = app
 
     // Send email
     const lng = user.language;
-    const createPasswordLink = `${appConfig.frontendUrl}/auth/create-password/${tokenRecord.token}`;
+    const createPasswordLink = `${appConfig.frontendUrl}/auth/create-password/${tokenRecord.token}?tokenId=${tokenRecord.id}`;
     const subject = i18n.t('backend:email.create_password.subject', { lng, appName: appConfig.name });
     const staticProps = { createPasswordLink, subject, lng };
     const recipients = [{ email: user.email }];
@@ -428,6 +428,7 @@ const authRouteHandlers = app
       .returning();
 
     const [targetMembership] = activatedMemberships.sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());
+    if (!targetMembership) throw new AppError({ status: 500, type: 'membership_not_found', severity: 'error', entityType: token.entityType });
 
     const entityIdField = appConfig.entityIdFields[token.entityType];
     if (!targetMembership[entityIdField]) throw new AppError({ status: 404, type: 'not_found', severity: 'warn', entityType: token.entityType });
diff --git a/backend/src/modules/auth/helpers/oauth/callback.ts b/backend/src/modules/auth/helpers/oauth/callback.ts
index 67719ce35..b15941adb 100644
--- a/backend/src/modules/auth/helpers/oauth/callback.ts
+++ b/backend/src/modules/auth/helpers/oauth/callback.ts
@@ -163,7 +163,7 @@ const inviteFlow = async (
 
   // Email in token doesn't match provider email
   if (invitationToken.email !== providerUser.email) {
-    throw new AppError({ status: 409, type: 'oauth_wrong_email', severity: 'warn', isRedirect: true });
+    throw new AppError({ status: 409, type: 'oauth_wrong_email', severity: 'error', isRedirect: true });
   }
 
   // OAuth account already linked
diff --git a/backend/src/modules/auth/helpers/oauth/initiation.ts b/backend/src/modules/auth/helpers/oauth/initiation.ts
index a2e5e8950..cdd1d4095 100644
--- a/backend/src/modules/auth/helpers/oauth/initiation.ts
+++ b/backend/src/modules/auth/helpers/oauth/initiation.ts
@@ -34,11 +34,11 @@ export const handleOAuthInitiation = async (ctx: Context, provider: string, url:
   const { type } = ctx.req.query();
 
   const payload = await getOAuthPayload(ctx);
-  const cookieValue = JSON.stringify({ ...payload, codeVerifier });
+  const cookieContent = JSON.stringify({ ...payload, codeVerifier });
 
-  await setAuthCookie(ctx, `oauth-${state}`, cookieValue, new TimeSpan(5, 'm'));
+  await setAuthCookie(ctx, `oauth-${state}`, cookieContent, new TimeSpan(5, 'm'));
 
-  logEvent('info', 'User redirected to provider', { strategy: 'oauth', provider, type });
+  logEvent('info', 'User redirected to OAuth provider', { strategy: 'oauth', provider, type });
 
   return ctx.redirect(url.toString(), 302);
 };
@@ -57,6 +57,7 @@ export const handleOAuthInitiation = async (ctx: Context, provider: string, url:
  * @param ctx - Hono request/response context.
  *
  */
+// TODO this doesnt look very clean in the cookie, maybe hash it or encode it?
 const getOAuthPayload = async (ctx: Context) => {
   const { type, redirect } = ctx.req.query();
 
@@ -117,10 +118,9 @@ const prepareOAuthAcceptInvite = async (ctx: Context) => {
   const { tokenId, token } = ctx.req.query();
 
   // Must provide a token and tokenId
-  if (!token || !tokenId) throw new AppError({ status: 400, type: 'invalid_request', severity: 'warn', isRedirect: true });
+  if (!token || !tokenId) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error', isRedirect: true });
 
   const tokenRecord = await getValidToken({ requiredType: 'invitation', tokenId, consumeToken: false });
-  if (!tokenRecord) throw new AppError({ status: 404, type: 'invitation_not_found', severity: 'warn', isRedirect: true });
 
   const redirectPath = tokenRecord.entityType ? `/invitation/${tokenRecord.token}` : appConfig.defaultRedirectPath;
 
@@ -147,8 +147,8 @@ const prepareOAuthConnect = async (ctx: Context) => {
   const { sessionToken } = await getParsedSessionCookie(ctx, { redirectOnError: true });
   const { user } = await validateSession(sessionToken);
 
-  if (!user) throw new AppError({ status: 404, type: 'not_found', entityType: 'user', severity: 'warn', isRedirect: true });
-  if (user.id !== connectUserId) throw new AppError({ status: 403, type: 'user_mismatch', severity: 'warn', isRedirect: true });
+  if (!user) throw new AppError({ status: 404, type: 'not_found', entityType: 'user', severity: 'error', isRedirect: true });
+  if (user.id !== connectUserId) throw new AppError({ status: 403, type: 'user_mismatch', severity: 'error', isRedirect: true });
 
   const redirectPath = '/settings#authentication';
 
@@ -169,7 +169,7 @@ const prepareOAuthVerify = async (ctx: Context) => {
   const { tokenId, token } = ctx.req.query();
 
   // Must provide a token and tokenId
-  if (!token || !tokenId) throw new AppError({ status: 400, type: 'invalid_request', severity: 'warn', isRedirect: true });
+  if (!token || !tokenId) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error', isRedirect: true });
 
   const tokenRecord = await getValidToken({ requiredType: 'email_verification', tokenId, consumeToken: false, isRedirect: true });
 
diff --git a/backend/src/modules/auth/schema.ts b/backend/src/modules/auth/schema.ts
index e1f274405..98da8cde3 100644
--- a/backend/src/modules/auth/schema.ts
+++ b/backend/src/modules/auth/schema.ts
@@ -66,6 +66,8 @@ export const oauthQuerySchema = z
       if (data.type === 'invite') return !!data.tokenId && !!data.token;
       return true; // No extra requirements for signIn & signUp
     },
+    // TODO message is deprecated in favor of 'error'? replace everywhere
+    // TODO2 this doesnt work well when we need a redirect error, what to do?
     { message: "Missing required field based on 'type'" },
   );
 
diff --git a/backend/src/modules/memberships/handlers.ts b/backend/src/modules/memberships/handlers.ts
index 840f0e89a..026996a10 100644
--- a/backend/src/modules/memberships/handlers.ts
+++ b/backend/src/modules/memberships/handlers.ts
@@ -208,7 +208,7 @@ const membershipRouteHandlers = app
     const insertedTokens = await db
       .insert(tokensTable)
       .values(tokens)
-      .returning({ userId: tokensTable.userId, email: tokensTable.email, token: tokensTable.token });
+      .returning({ userId: tokensTable.userId, email: tokensTable.email, token: tokensTable.token, id: tokensTable.id });
 
     // Generate inactive memberships after tokens are inserted
     await Promise.all(
@@ -216,10 +216,10 @@ const membershipRouteHandlers = app
     );
 
     // Prepare and send invitation emails
-    const recipients = insertedTokens.map(({ email, token }) => ({
+    const recipients = insertedTokens.map(({ email, token, id }) => ({
       email,
       name: slugFromEmail(email),
-      memberInviteLink: `${appConfig.frontendUrl}/invitation/${token}`,
+      memberInviteLink: `${appConfig.frontendUrl}/invitation/${token}?tokenId=${id}`,
     }));
 
     const emailProps = {
@@ -526,7 +526,7 @@ const membershipRouteHandlers = app
     const recipient = {
       email: userEmail,
       name: slugFromEmail(userEmail),
-      memberInviteLink: `${appConfig.frontendUrl}/invitation/${newToken}`,
+      memberInviteLink: `${appConfig.frontendUrl}/invitation/${newToken}?tokenId=${newTokenId}`,
     };
 
     const emailProps = {
diff --git a/backend/src/utils/sanitize-email-subject.ts b/backend/src/utils/sanitize-email-subject.ts
new file mode 100644
index 000000000..36f973a4a
--- /dev/null
+++ b/backend/src/utils/sanitize-email-subject.ts
@@ -0,0 +1,13 @@
+export function sanitizeEmailSubject(value: string, max = 150): string {
+  if (!value) return '';
+  // Normalize unicode and remove CR/LF + control chars
+  let s = value
+    .normalize('NFC')
+    .replace(/[\r\n]+/g, ' ') // no newlines in headers
+    .replace(/[\u0000-\u001F\u007F]/g, ' ') // strip control chars
+    .replace(/\s{2,}/g, ' ') // collapse whitespace
+    .trim();
+
+  if (s.length > max) s = s.slice(0, max - 1) + '…';
+  return s;
+}
diff --git a/frontend/src/modules/auth/create-password-form.tsx b/frontend/src/modules/auth/create-password-form.tsx
index 5c24a385f..03f3e70d2 100644
--- a/frontend/src/modules/auth/create-password-form.tsx
+++ b/frontend/src/modules/auth/create-password-form.tsx
@@ -1,6 +1,6 @@
 import { zodResolver } from '@hookform/resolvers/zod';
 import { useMutation } from '@tanstack/react-query';
-import { useNavigate, useParams } from '@tanstack/react-router';
+import { useNavigate, useParams, useSearch } from '@tanstack/react-router';
 import { appConfig } from 'config';
 import { ArrowRight } from 'lucide-react';
 import { lazy, Suspense, useRef } from 'react';
@@ -31,8 +31,9 @@ const CreatePasswordForm = () => {
   const requestButtonRef = useRef(null);
 
   const { token } = useParams({ from: '/publicLayout/authLayout/auth/create-password/$token' });
+  const { tokenId } = useSearch({ from: '/publicLayout/authLayout/auth/create-password/$token' });
 
-  const { data, isLoading, error } = useCheckToken('password_reset', token);
+  const { data, isLoading, error } = useCheckToken('password_reset', tokenId);
   const isMobile = window.innerWidth < 640;
 
   // Reset password & sign in
diff --git a/frontend/src/modules/auth/oauth-providers.tsx b/frontend/src/modules/auth/oauth-providers.tsx
index 51b13a2ef..63ed03ddc 100644
--- a/frontend/src/modules/auth/oauth-providers.tsx
+++ b/frontend/src/modules/auth/oauth-providers.tsx
@@ -23,7 +23,7 @@ type OAuthProvider = (typeof mapOAuthProviders)[number];
 const OAuthProviders = ({ authStep = 'signIn' }: { authStep: AuthStep }) => {
   const { t } = useTranslation();
   const mode = useUIStore((state) => state.mode);
-  const { token, redirect } = useSearch({ from: '/publicLayout/authLayout/auth/authenticate' });
+  const { token, tokenId, redirect } = useSearch({ from: '/publicLayout/authLayout/auth/authenticate' });
 
   const [loadingProvider, setLoadingProvider] = useState<EnabledOAuthProvider | null>(null);
 
@@ -38,8 +38,9 @@ const OAuthProviders = ({ authStep = 'signIn' }: { authStep: AuthStep }) => {
       const params = new URLSearchParams();
 
       params.set('redirect', encodeURIComponent(redirectPath));
-      if (token) {
+      if (token && tokenId) {
         params.set('token', token);
+        params.set('tokenId', tokenId);
         params.set('type', 'invite');
       } else params.set('type', 'auth');
 
diff --git a/frontend/src/modules/auth/steps/provider.tsx b/frontend/src/modules/auth/steps/provider.tsx
index d17e21fe7..a17c2b200 100644
--- a/frontend/src/modules/auth/steps/provider.tsx
+++ b/frontend/src/modules/auth/steps/provider.tsx
@@ -6,22 +6,23 @@ import { useCheckToken } from '~/modules/auth/use-token-check';
 import { useUserStore } from '~/store/user';
 import { AuthContext } from './provider-context';
 
+// TODO refactor to store?
 export const AuthStepsProvider = ({ children }: { children: ReactNode }) => {
   const matchRoute = useMatchRoute();
   const { lastUser } = useUserStore();
-  const { token } = useSearch({ from: '/publicLayout/authLayout/auth/authenticate' });
+  const { tokenId } = useSearch({ from: '/publicLayout/authLayout/auth/authenticate' });
 
   const isMfaRoute = !!matchRoute({ to: '/auth/authenticate/mfa-confirmation' });
 
   // Initialize email and step
-  const initEmail = (!token && lastUser?.email) || '';
-  const initStep: AuthStep = !token && lastUser?.email ? 'signIn' : 'checkEmail';
+  const initEmail = (!tokenId && lastUser?.email) || '';
+  const initStep: AuthStep = !tokenId && lastUser?.email ? 'signIn' : 'checkEmail';
 
   const [email, setEmail] = useState(initEmail);
   const [step, setStepState] = useState<AuthStep>(initStep);
   const [authError, setAuthError] = useState<ApiError | null>(null);
 
-  const { data: tokenData } = useCheckToken('invitation', token, !!token);
+  const { data: tokenData } = useCheckToken('invitation', tokenId, !!tokenId);
 
   const setStep = (newStep: AuthStep, newEmail: string, error?: ApiError) => {
     setStepState(newStep);
@@ -41,7 +42,7 @@ export const AuthStepsProvider = ({ children }: { children: ReactNode }) => {
 
   // If token is provided, directly set email and step based on token data
   useEffect(() => {
-    if (!token || !tokenData?.email) return;
+    if (!tokenId || !tokenData?.email) return;
 
     setEmail(tokenData.email);
     setStepState(tokenData.userId ? 'signIn' : 'signUp');
diff --git a/frontend/src/modules/auth/steps/sign-in.tsx b/frontend/src/modules/auth/steps/sign-in.tsx
index a9a4ccace..7eb91aa6d 100644
--- a/frontend/src/modules/auth/steps/sign-in.tsx
+++ b/frontend/src/modules/auth/steps/sign-in.tsx
@@ -35,7 +35,7 @@ export const SignInStep = () => {
   const passwordRef = useRef<HTMLInputElement>(null);
 
   const { lastUser, clearUserStore } = useUserStore();
-  const { redirect: encodedRedirect, token } = useSearch({ from: '/publicLayout/authLayout/auth/authenticate' });
+  const { redirect: encodedRedirect, token, tokenId } = useSearch({ from: '/publicLayout/authLayout/auth/authenticate' });
 
   const redirect = decodeURIComponent(encodedRedirect || '');
   const isMobile = window.innerWidth < 640;
@@ -55,12 +55,13 @@ export const SignInStep = () => {
         return;
       }
 
+      // Go to invitation if token is provided, otherwise use provided redirect or default path
       const redirectPath = token ? '/invitation/$token' : redirect?.startsWith('/') ? redirect : appConfig.defaultRedirectPath;
 
       navigate({
         to: redirectPath,
         replace: true,
-        ...(token && { params: { token } }),
+        ...(token && { params: { token }, search: { tokenId } }),
       });
     },
     onError: (error: ApiError) => {
@@ -135,6 +136,7 @@ export const SignInStep = () => {
                 {t('common:sign_in')}
                 <ArrowRight size={16} className="ml-2" />
               </SubmitButton>
+              {/* TODO: add callback to reset auth steps forgot email is different from current email state */}
               <RequestPasswordDialog email={email}>
                 <Button variant="ghost" size="sm" className="w-full font-normal">
                   {t('common:forgot_password')}
diff --git a/frontend/src/routes/auth-routes.tsx b/frontend/src/routes/auth-routes.tsx
index bdc84b648..6cfdab3a0 100644
--- a/frontend/src/routes/auth-routes.tsx
+++ b/frontend/src/routes/auth-routes.tsx
@@ -24,10 +24,6 @@ const authenticateRouteSearch = z.object({
   fromRoot: z.boolean().optional(),
 });
 
-const invitationRouteSearch = authenticateRouteSearch.extend({
-  tokenId: z.string(),
-});
-
 export const AuthLayoutRoute = createRoute({
   id: 'authLayout',
   staticData: { isAuth: false },
@@ -76,6 +72,7 @@ export const RequestPasswordRoute = createRoute({
 
 export const CreatePasswordWithTokenRoute = createRoute({
   path: '/auth/create-password/$token',
+  validateSearch: z.object({ tokenId: z.string() }),
   staticData: { isAuth: false },
   head: () => ({ meta: [{ title: appTitle('Create password') }] }),
   getParentRoute: () => AuthLayoutRoute,
@@ -93,7 +90,7 @@ export const EmailVerificationRoute = createRoute({
 
 export const AcceptEntityInviteRoute = createRoute({
   path: '/invitation/$token',
-  validateSearch: invitationRouteSearch,
+  validateSearch: z.object({ tokenId: z.string() }),
   staticData: { isAuth: true },
   head: () => ({ meta: [{ title: appTitle('Join') }] }),
   beforeLoad: async ({ params, search }) => {
diff --git a/locales/en/common.json b/locales/en/common.json
index bd07fa8a0..ed60151d2 100644
--- a/locales/en/common.json
+++ b/locales/en/common.json
@@ -302,7 +302,7 @@
   "request_password.text": "Reset your password by sending a reset link to your email address.",
   "request_type": "Request type",
   "request_verification.connect": "to connect your {{providerName}} account",
-  "request_verification.invite": "so you can proceed with your invitation",
+  "request_verification.invite": "to verify your {{providerName}} account, after which you can proceed with the invitation",
   "request_verification.legal_notice": "By verifying your email, you agree to the",
   "request_verification.signin": "to sign in",
   "request_verification.signup": "to complete your sign up",
diff --git a/locales/en/errors.json b/locales/en/errors.json
index e2b6cd0ad..83155e7db 100644
--- a/locales/en/errors.json
+++ b/locales/en/errors.json
@@ -116,13 +116,15 @@
   "oauth_failed": "OAuth failed",
   "oauth_failed.text": "OAuth authentication failed. Please try again or use another method.",
   "oauth_wrong_email": "Email doesn't match",
-  "oauth_wrong_email.text": "It's not possible to link accounts with different emails while accepting an invitation. Please use another authentication method or contact support.",
+  "oauth_wrong_email.text": "It's not possible to link accounts with different emails while accepting an invitation. Please use another authentication method.",
   "oauth_taken": "Not allowed to connect.",
+  "membership_not_found": "Membership not found",
+  "membership_not_found.text": "The membership you are trying to access does not exist or has been deleted.",
   "oauth_taken.text": "The account you tried to connect is already linked to a different user.",
   "oauth_email_exists": "Not allowed to connect.",
-  "oauth_email_exists.text": "The email of the account you tried to connect, already belongs to an existing user. If that's you, please sign first and go to settings to connect your this account.",
+  "oauth_email_exists.text": "The email of the account you tried to connect, already belongs to an existing user. If that's you, please sign first and go to settings to connect this account.",
   "oauth_conflict": "OAuth conflict",
-  "oauth_conflict.text": "There is a conflict with the OAuth account you tried to connect. Please contact support.",
+  "oauth_conflict.text": "There is a conflict with the OAuth account you tried to connect.",
   "organization_missing": "Organization missing",
   "organization_missing.text": "Organization slug or id is required to perform this action.",
   "page_not_found": "Page not found",

From a5f50fc9e68d391f4f9a970cbe9434949080c36d Mon Sep 17 00:00:00 2001
From: flipvanhaaren <flip@shareworks.nl>
Date: Wed, 24 Sep 2025 18:55:32 +0200
Subject: [PATCH 08/48] improve: invite flow

---
 backend/src/db/schema/oauth-accounts.ts              |  1 +
 backend/src/modules/auth/handlers.ts                 |  2 +-
 backend/src/modules/auth/helpers/oauth/initiation.ts |  2 +-
 backend/src/modules/memberships/handlers.ts          |  4 +++-
 frontend/src/modules/auth/error-notice.tsx           | 12 ++++++++----
 frontend/src/modules/common/error-notice.tsx         |  8 +++++---
 frontend/src/modules/common/page/header.tsx          |  5 ++++-
 frontend/src/modules/entities/entity-grid/tile.tsx   |  5 +++--
 frontend/src/modules/home/index.tsx                  |  4 ++--
 frontend/src/modules/me/entity-invitations.tsx       |  5 ++++-
 frontend/src/routes/auth-routes.tsx                  |  8 ++++----
 frontend/src/routes/base-routes.tsx                  | 12 ++++++------
 frontend/src/routes/home-routes.tsx                  |  8 ++++----
 frontend/src/routes/marketing-routes.tsx             | 10 +++++-----
 frontend/src/routes/organization-routes.tsx          |  4 ++--
 frontend/src/routes/route-tree.tsx                   | 10 +++++-----
 frontend/src/routes/system-routes.tsx                |  4 ++--
 frontend/src/routes/user-routes.tsx                  |  8 ++++----
 locales/en/common.json                               |  2 +-
 19 files changed, 65 insertions(+), 49 deletions(-)

diff --git a/backend/src/db/schema/oauth-accounts.ts b/backend/src/db/schema/oauth-accounts.ts
index 79a5e903f..4cbab3118 100644
--- a/backend/src/db/schema/oauth-accounts.ts
+++ b/backend/src/db/schema/oauth-accounts.ts
@@ -16,6 +16,7 @@ export const oauthAccountsTable = pgTable(
     email: varchar().notNull(),
     verified: boolean().notNull().default(false),
     verifiedAt: timestamp({ mode: 'string' }),
+    // TODO remove, not used
     tenantId: varchar(),
     userId: varchar()
       .notNull()
diff --git a/backend/src/modules/auth/handlers.ts b/backend/src/modules/auth/handlers.ts
index cbe8d5844..9264292b2 100644
--- a/backend/src/modules/auth/handlers.ts
+++ b/backend/src/modules/auth/handlers.ts
@@ -176,7 +176,7 @@ const authRouteHandlers = app
     // Sign in user
     await setUserSession(ctx, user, strategy);
 
-    const redirectPath = membershipInvite ? `/invitation/${validToken.token}` : appConfig.defaultRedirectPath;
+    const redirectPath = membershipInvite ? `/invitation/${validToken.token}?tokenId=${validToken.id}` : appConfig.defaultRedirectPath;
     return ctx.json({ shouldRedirect: true, redirectPath }, 200);
   })
   /*
diff --git a/backend/src/modules/auth/helpers/oauth/initiation.ts b/backend/src/modules/auth/helpers/oauth/initiation.ts
index cdd1d4095..ab9b85f21 100644
--- a/backend/src/modules/auth/helpers/oauth/initiation.ts
+++ b/backend/src/modules/auth/helpers/oauth/initiation.ts
@@ -57,7 +57,7 @@ export const handleOAuthInitiation = async (ctx: Context, provider: string, url:
  * @param ctx - Hono request/response context.
  *
  */
-// TODO this doesnt look very clean in the cookie, maybe hash it or encode it?
+// TODO this doesnt look very clean in the cookie when inspecting it in devtools, maybe hash it or encode it?
 const getOAuthPayload = async (ctx: Context) => {
   const { type, redirect } = ctx.req.query();
 
diff --git a/backend/src/modules/memberships/handlers.ts b/backend/src/modules/memberships/handlers.ts
index 026996a10..8d9279eb5 100644
--- a/backend/src/modules/memberships/handlers.ts
+++ b/backend/src/modules/memberships/handlers.ts
@@ -212,7 +212,9 @@ const membershipRouteHandlers = app
 
     // Generate inactive memberships after tokens are inserted
     await Promise.all(
-      insertedTokens.filter(({ userId }) => userId !== null).map(({ userId }) => insertMembership({ userId: userId as string, role, entity })),
+      insertedTokens
+        .filter(({ userId }) => userId !== null)
+        .map(({ userId, id }) => insertMembership({ userId: userId as string, role, entity, tokenId: id })),
     );
 
     // Prepare and send invitation emails
diff --git a/frontend/src/modules/auth/error-notice.tsx b/frontend/src/modules/auth/error-notice.tsx
index e272650cb..7d86a105e 100644
--- a/frontend/src/modules/auth/error-notice.tsx
+++ b/frontend/src/modules/auth/error-notice.tsx
@@ -12,9 +12,11 @@ import { Card, CardDescription, CardFooter, CardHeader, CardTitle } from '~/modu
  * @param error - ErrorNoticeError
  * @param children - React.ReactNode (optional)
  */
+// TODO consider reducing duplication with common error notice
 const AuthErrorNotice = ({ error, children }: { error: ErrorNoticeError; children?: React.ReactNode }) => {
   const { t } = useTranslation();
   const { location } = useRouterState();
+
   const contactButtonRef = useRef(null);
 
   const { error: errorFromQuery, severity: severityFromQuery } = location.search;
@@ -24,16 +26,18 @@ const AuthErrorNotice = ({ error, children }: { error: ErrorNoticeError; childre
   const { title, message } = getErrorInfo(error, errorFromQuery);
 
   return (
-    <Card className="bg-transparent border-0 md:-mx-10 lg:-mx-32">
+    <Card className="bg-transparent border-0 md:-mx-16 lg:-mx-40">
       <CardHeader className="text-center p-0">
         <CardTitle className="text-2xl mb-2 justify-center">{title}</CardTitle>
         <CardDescription className="text-foreground/80 text-lg flex-col gap-2">
           <span className="block">{message}</span>
-          <span className="block">{severity === 'warn' && t('error:contact_mistake')}</span>
-          <span className="block">{severity === 'error' && t('error:try_again_later')}</span>
+          <p className="mt-2 font-light">
+            <span className="block">{severity === 'warn' && t('error:contact_mistake')}</span>
+            <span className="block">{severity === 'error' && t('error:try_again_later')}</span>
+          </p>
         </CardDescription>
       </CardHeader>
-      <CardFooter className="flex gap-2 max-sm:flex-col max-sm:items-stretch flex-wrap mt-4 justify-center">
+      <CardFooter className="flex gap-2 max-sm:flex-col max-sm:items-stretch flex-wrap mt-8 justify-center">
         {children}
         <Link to="/auth/authenticate" reloadDocument className={buttonVariants({ size: 'lg', variant: 'plain' })}>
           {t('common:sign_in')}
diff --git a/frontend/src/modules/common/error-notice.tsx b/frontend/src/modules/common/error-notice.tsx
index 00e26cfe0..1facac035 100644
--- a/frontend/src/modules/common/error-notice.tsx
+++ b/frontend/src/modules/common/error-notice.tsx
@@ -108,8 +108,10 @@ const ErrorNotice = ({ error, resetErrorBoundary, level }: ErrorNoticeProps) =>
               <CardTitle className="text-2xl mb-2 justify-center">{title}</CardTitle>
               <CardDescription className="text-foreground/80 text-lg flex-col gap-2">
                 <span className="block">{message}</span>
-                <span className="block">{severity === 'warn' && t('error:contact_mistake')}</span>
-                <span className="block">{severity === 'error' && t('error:try_again_later')}</span>
+                <p className="mt-2 font-light">
+                  <span className="block">{severity === 'warn' && t('error:contact_mistake')}</span>
+                  <span className="block">{severity === 'error' && t('error:try_again_later')}</span>
+                </p>
               </CardDescription>
             </CardHeader>
             {error && 'status' in error && (
@@ -160,7 +162,7 @@ const ErrorNotice = ({ error, resetErrorBoundary, level }: ErrorNoticeProps) =>
                 </AnimatePresence>
               </CardContent>
             )}
-            <CardFooter className="flex gap-2 max-sm:flex-col max-sm:items-stretch flex-wrap mt-4 justify-center">
+            <CardFooter className="flex gap-2 max-sm:flex-col max-sm:items-stretch flex-wrap mt-8 justify-center">
               <Button onClick={handleGoToHome} variant="secondary">
                 <Home size={16} className="mr-2" />
                 {t('common:home')}
diff --git a/frontend/src/modules/common/page/header.tsx b/frontend/src/modules/common/page/header.tsx
index a75167c6b..db8748390 100644
--- a/frontend/src/modules/common/page/header.tsx
+++ b/frontend/src/modules/common/page/header.tsx
@@ -2,6 +2,7 @@ import { Link } from '@tanstack/react-router';
 import { appConfig, ContextEntityType } from 'config';
 import { ChevronRight, Home } from 'lucide-react';
 import { useRef } from 'react';
+import { useTranslation } from 'react-i18next';
 import type { UserBaseSchema } from '~/api.gen';
 import useScrollTo from '~/hooks/use-scroll-to';
 import { AvatarWrap } from '~/modules/common/avatar-wrap';
@@ -20,6 +21,8 @@ type PageHeaderProps = Omit<PageCoverProps, 'id' | 'url'> & {
 };
 
 const PageHeader = ({ entity, panel, parent, disableScroll, ...coverProps }: PageHeaderProps) => {
+  const { t } = useTranslation();
+
   const scrollToRef = useRef<HTMLDivElement>(null);
 
   const parentData = parent ? useGetEntityBaseData(parent) : null;
@@ -52,7 +55,7 @@ const PageHeader = ({ entity, panel, parent, disableScroll, ...coverProps }: Pag
             {'membership' in entity && entity.membership && (
               <>
                 <Badge className="opacity-70" variant="plain">
-                  {entity.membership.role}
+                  {t(entity.membership.role, { ns: ['app', 'common'] })}
                 </Badge>
                 <div className="opacity-70 max-sm:hidden">&middot;</div>
               </>
diff --git a/frontend/src/modules/entities/entity-grid/tile.tsx b/frontend/src/modules/entities/entity-grid/tile.tsx
index 09e8daaf4..3a19d823e 100644
--- a/frontend/src/modules/entities/entity-grid/tile.tsx
+++ b/frontend/src/modules/entities/entity-grid/tile.tsx
@@ -3,6 +3,7 @@ import { t } from 'i18next';
 import { User } from 'lucide-react';
 import { AvatarWrap } from '~/modules/common/avatar-wrap';
 import type { EntityGridItem } from '~/modules/entities/types';
+import { Badge } from '~/modules/ui/badge';
 import { Card, CardContent } from '~/modules/ui/card';
 import { getEntityRoute } from '~/routes-resolver';
 import { dateShort } from '~/utils/date-short';
@@ -26,9 +27,9 @@ export const EntityTile = ({ entity }: { entity: EntityGridItem }) => {
                 <AvatarWrap className="h-10 w-10" type="organization" id={entity.id} name={entity.name} url={entity.thumbnailUrl} />
                 <div className="flex flex-col grow gap-1 truncate">
                   <div className="font-semibold truncate leading-4">{entity.name}</div>
-                  <div className="text-sm font-light opacity-70 group-hover:opacity-85 transition-opacity">
+                  <div className="text-sm font-light inline-flex items-center gap-2">
                     {dateShort(entity.createdAt)}
-                    {entity.membership?.role ? ` | ${t(entity.membership.role, { ns: ['app', 'common'] })}` : ''}
+                    {entity.membership?.role && <Badge variant="plain">{t(entity.membership.role, { ns: ['app', 'common'] })}</Badge>}
                   </div>
                 </div>
               </div>
diff --git a/frontend/src/modules/home/index.tsx b/frontend/src/modules/home/index.tsx
index 8cc8988fe..5d9a5d8f7 100644
--- a/frontend/src/modules/home/index.tsx
+++ b/frontend/src/modules/home/index.tsx
@@ -3,7 +3,7 @@ import { useEffect } from 'react';
 import { useTranslation } from 'react-i18next';
 import { getContextEntities } from '~/api.gen';
 import { SimpleHeader } from '~/modules/common/simple-header';
-import { EntityInvites } from '~/modules/me/entity-invitations';
+import { EntityInvitations } from '~/modules/me/entity-invitations';
 import { useAlertStore } from '~/store/alert';
 import { useUserStore } from '~/store/user';
 
@@ -22,7 +22,7 @@ const Home = () => {
   return (
     <div className="px-3 md:px-6">
       <SimpleHeader heading={t('common:home')} text={t('common:home.text', { appName: appConfig.name })} className="container pt-4 md:pt-6" />
-      <EntityInvites />
+      <EntityInvitations />
     </div>
   );
 };
diff --git a/frontend/src/modules/me/entity-invitations.tsx b/frontend/src/modules/me/entity-invitations.tsx
index 848134f13..b1aae1b31 100644
--- a/frontend/src/modules/me/entity-invitations.tsx
+++ b/frontend/src/modules/me/entity-invitations.tsx
@@ -16,7 +16,10 @@ import { getEntityRoute } from '~/routes-resolver';
 import { useUserStore } from '~/store/user';
 import { dateShort } from '~/utils/date-short';
 
-export const EntityInvites = () => {
+/**
+ * Component to show a list of pending entity invitations for the current user
+ */
+export const EntityInvitations = () => {
   const { t } = useTranslation();
   const { user } = useUserStore();
 
diff --git a/frontend/src/routes/auth-routes.tsx b/frontend/src/routes/auth-routes.tsx
index 6cfdab3a0..168ed8040 100644
--- a/frontend/src/routes/auth-routes.tsx
+++ b/frontend/src/routes/auth-routes.tsx
@@ -13,7 +13,7 @@ import { AuthStepsProvider } from '~/modules/auth/steps/provider';
 import Unsubscribed from '~/modules/auth/unsubscribed';
 import { meQueryOptions } from '~/modules/me/query';
 import { queryClient } from '~/query/query-client';
-import { PublicRoute } from '~/routes/base-routes';
+import { PublicLayoutRoute } from '~/routes/base-routes';
 import { useUserStore } from '~/store/user';
 import appTitle from '~/utils/app-title';
 
@@ -27,7 +27,7 @@ const authenticateRouteSearch = z.object({
 export const AuthLayoutRoute = createRoute({
   id: 'authLayout',
   staticData: { isAuth: false },
-  getParentRoute: () => PublicRoute,
+  getParentRoute: () => PublicLayoutRoute,
   component: () => <AuthPage />,
 });
 
@@ -100,7 +100,7 @@ export const AcceptEntityInviteRoute = createRoute({
       await queryClient.ensureQueryData(options);
     } catch {
       // When user is new, authentication will process the user first, then redirect back here
-      console.info('Not authenticated (silent check) -> redirect to sign in');
+      console.info('Not authenticated while trying to handle invitation (silent check) -> redirect to sign in with invite data');
       throw redirect({ to: '/auth/authenticate', search: { tokenId: search.tokenId, token: params.token } });
     }
   },
@@ -121,6 +121,6 @@ export const SignOutRoute = createRoute({
   validateSearch: z.object({ force: z.boolean().optional() }),
   staticData: { isAuth: false },
   head: () => ({ meta: [{ title: appTitle('Sign out') }] }),
-  getParentRoute: () => PublicRoute,
+  getParentRoute: () => PublicLayoutRoute,
   component: () => <SignOut />,
 });
diff --git a/frontend/src/routes/base-routes.tsx b/frontend/src/routes/base-routes.tsx
index b970bfde7..68c3de88a 100644
--- a/frontend/src/routes/base-routes.tsx
+++ b/frontend/src/routes/base-routes.tsx
@@ -24,7 +24,7 @@ const errorSearchSchema = z.object({
   severity: zApiError.shape.severity.optional(),
 });
 
-export const rootRoute = createRootRouteWithContext()({
+export const RootRoute = createRootRouteWithContext()({
   staticData: { isAuth: false },
   component: () => <Root />,
   errorComponent: ({ error }) => <ErrorNotice level="root" error={error} />,
@@ -44,10 +44,10 @@ export const rootRoute = createRootRouteWithContext()({
   },
 });
 
-export const PublicRoute = createRoute({
+export const PublicLayoutRoute = createRoute({
   id: 'publicLayout',
   staticData: { isAuth: false },
-  getParentRoute: () => rootRoute,
+  getParentRoute: () => RootRoute,
   component: () => <PublicLayout />,
   beforeLoad: async ({ location, cause }) => {
     if (cause !== 'enter' || location.pathname === '/sign-out') return;
@@ -66,10 +66,10 @@ export const PublicRoute = createRoute({
   },
 });
 
-export const AppRoute = createRoute({
+export const AppLayoutRoute = createRoute({
   id: 'appLayout',
   staticData: { isAuth: false },
-  getParentRoute: () => rootRoute,
+  getParentRoute: () => RootRoute,
   component: () => (
     <Suspense fallback={<Spinner className="mt-[45vh] h-10 w-10" />}>
       <AppLayout />
@@ -130,6 +130,6 @@ export const ErrorNoticeRoute = createRoute({
   validateSearch: errorSearchSchema,
   staticData: { isAuth: false },
   head: () => ({ meta: [{ title: appTitle('Error') }] }),
-  getParentRoute: () => PublicRoute,
+  getParentRoute: () => PublicLayoutRoute,
   component: () => <ErrorNotice level="public" />,
 });
diff --git a/frontend/src/routes/home-routes.tsx b/frontend/src/routes/home-routes.tsx
index fc2db3450..97a64d587 100644
--- a/frontend/src/routes/home-routes.tsx
+++ b/frontend/src/routes/home-routes.tsx
@@ -1,7 +1,7 @@
 import { createRoute, redirect } from '@tanstack/react-router';
 import { lazy, Suspense } from 'react';
 import Home from '~/modules/home';
-import { AppRoute } from '~/routes/base-routes';
+import { AppLayoutRoute } from '~/routes/base-routes';
 import { useUserStore } from '~/store/user';
 import appTitle from '~/utils/app-title';
 
@@ -10,7 +10,7 @@ const Welcome = lazy(() => import('~/modules/home/welcome-page'));
 export const HomeRoute = createRoute({
   path: '/',
   staticData: { isAuth: true },
-  getParentRoute: () => AppRoute,
+  getParentRoute: () => AppLayoutRoute,
   component: () => (
     <Suspense>
       <Home />
@@ -23,7 +23,7 @@ export const HomeAliasRoute = createRoute({
   path: '/home',
   staticData: { isAuth: true },
   head: () => ({ meta: [{ title: appTitle('Home') }] }),
-  getParentRoute: () => AppRoute,
+  getParentRoute: () => AppLayoutRoute,
   beforeLoad: () => {
     const { user } = useUserStore.getState();
     if (!user.userFlags.finishedOnboarding) throw redirect({ to: '/welcome' });
@@ -39,7 +39,7 @@ export const WelcomeRoute = createRoute({
   path: '/welcome',
   staticData: { isAuth: true },
   head: () => ({ meta: [{ title: appTitle('Welcome') }] }),
-  getParentRoute: () => AppRoute,
+  getParentRoute: () => AppLayoutRoute,
   beforeLoad: () => {
     const { user } = useUserStore.getState();
     if (user.userFlags.finishedOnboarding) throw redirect({ to: '/home' });
diff --git a/frontend/src/routes/marketing-routes.tsx b/frontend/src/routes/marketing-routes.tsx
index 410b0826e..5f28f4eeb 100644
--- a/frontend/src/routes/marketing-routes.tsx
+++ b/frontend/src/routes/marketing-routes.tsx
@@ -3,14 +3,14 @@ import AboutPage from '~/modules/marketing/about/about-page';
 import AccessibilityPage from '~/modules/marketing/accessibility-page';
 import ContactPage from '~/modules/marketing/contact-page';
 import { LegalPage } from '~/modules/marketing/legal-page';
-import { PublicRoute, rootRoute } from '~/routes/base-routes';
+import { PublicLayoutRoute, RootRoute } from '~/routes/base-routes';
 import appTitle from '~/utils/app-title';
 
 export const AboutRoute = createRoute({
   path: '/about',
   staticData: { isAuth: false },
   head: () => ({ meta: [{ title: appTitle('About') }] }),
-  getParentRoute: () => PublicRoute,
+  getParentRoute: () => PublicLayoutRoute,
   component: () => <AboutPage />,
 });
 
@@ -18,7 +18,7 @@ export const ContactRoute = createRoute({
   path: '/contact',
   staticData: { isAuth: false },
   head: () => ({ meta: [{ title: appTitle('Contact') }] }),
-  getParentRoute: () => rootRoute,
+  getParentRoute: () => RootRoute,
   component: () => <ContactPage />,
 });
 
@@ -26,7 +26,7 @@ export const LegalRoute = createRoute({
   path: '/legal',
   staticData: { isAuth: false },
   head: () => ({ meta: [{ title: appTitle('Legal') }] }),
-  getParentRoute: () => rootRoute,
+  getParentRoute: () => RootRoute,
   component: () => <LegalPage />,
 });
 
@@ -34,6 +34,6 @@ export const AccessibilityRoute = createRoute({
   path: '/accessibility',
   staticData: { isAuth: false },
   head: () => ({ meta: [{ title: appTitle('Accessibility') }] }),
-  getParentRoute: () => rootRoute,
+  getParentRoute: () => RootRoute,
   component: () => <AccessibilityPage />,
 });
diff --git a/frontend/src/routes/organization-routes.tsx b/frontend/src/routes/organization-routes.tsx
index 62635512d..0015afc5a 100644
--- a/frontend/src/routes/organization-routes.tsx
+++ b/frontend/src/routes/organization-routes.tsx
@@ -5,7 +5,7 @@ import { lazy, Suspense } from 'react';
 import ErrorNotice from '~/modules/common/error-notice';
 import { organizationQueryOptions } from '~/modules/organizations/query';
 import { queryClient } from '~/query/query-client';
-import { AppRoute } from '~/routes/base-routes';
+import { AppLayoutRoute } from '~/routes/base-routes';
 import { useToastStore } from '~/store/toast';
 import appTitle from '~/utils/app-title';
 import { noDirectAccess } from '~/utils/no-direct-access';
@@ -41,7 +41,7 @@ export const OrganizationRoute = createRoute({
     const organization = ctx.match.loaderData;
     return { meta: [{ title: appTitle(organization?.name) }] };
   },
-  getParentRoute: () => AppRoute,
+  getParentRoute: () => AppLayoutRoute,
   errorComponent: ({ error }) => <ErrorNotice level="app" error={error} />,
   component: () => {
     const { idOrSlug } = useParams({ from: OrganizationRoute.id });
diff --git a/frontend/src/routes/route-tree.tsx b/frontend/src/routes/route-tree.tsx
index 20e0a46f3..298e5e6e2 100644
--- a/frontend/src/routes/route-tree.tsx
+++ b/frontend/src/routes/route-tree.tsx
@@ -10,7 +10,7 @@ import {
   SignOutRoute,
   UnsubscribedRoute,
 } from '~/routes/auth-routes';
-import { AppRoute, ErrorNoticeRoute, PublicRoute, rootRoute } from '~/routes/base-routes';
+import { AppLayoutRoute, ErrorNoticeRoute, PublicLayoutRoute, RootRoute } from '~/routes/base-routes';
 import { HomeAliasRoute, HomeRoute, WelcomeRoute } from '~/routes/home-routes';
 import { AboutRoute, AccessibilityRoute, ContactRoute, LegalRoute } from '~/routes/marketing-routes';
 import { OrganizationAttachmentsRoute, OrganizationMembersRoute, OrganizationRoute, OrganizationSettingsRoute } from '~/routes/organization-routes';
@@ -23,15 +23,14 @@ import { UserInOrganizationProfileRoute, UserProfileRoute, UserSettingsRoute } f
 /**
  * The route tree for the entire app
  */
-export const routeTree = rootRoute.addChildren([
-  PublicRoute.addChildren([
+export const routeTree = RootRoute.addChildren([
+  PublicLayoutRoute.addChildren([
     AboutRoute,
     ContactRoute,
     LegalRoute,
     AccessibilityRoute,
     ErrorNoticeRoute,
     SignOutRoute,
-    AcceptEntityInviteRoute,
     AuthLayoutRoute.addChildren([
       AuthenticateRoute.addChildren([MfaRoute]),
       RequestPasswordRoute,
@@ -40,9 +39,10 @@ export const routeTree = rootRoute.addChildren([
       UnsubscribedRoute,
     ]),
   ]),
-  AppRoute.addChildren([
+  AppLayoutRoute.addChildren([
     HomeRoute,
     HomeAliasRoute,
+    AcceptEntityInviteRoute,
     WelcomeRoute,
     SystemRoute.addChildren([UsersTableRoute, OrganizationsTableRoute, RequestsTableRoute, MetricsRoute]),
     UserProfileRoute,
diff --git a/frontend/src/routes/system-routes.tsx b/frontend/src/routes/system-routes.tsx
index 4c84d9a3f..bc2bc6530 100644
--- a/frontend/src/routes/system-routes.tsx
+++ b/frontend/src/routes/system-routes.tsx
@@ -2,7 +2,7 @@ import { createRoute } from '@tanstack/react-router';
 import { lazy, Suspense } from 'react';
 import ErrorNotice from '~/modules/common/error-notice';
 import SystemPage from '~/modules/system/system-page';
-import { AppRoute } from '~/routes/base-routes';
+import { AppLayoutRoute } from '~/routes/base-routes';
 import appTitle from '~/utils/app-title';
 import { noDirectAccess } from '~/utils/no-direct-access';
 import { organizationsRouteSearchParamsSchema, requestsRouteSearchParamsSchema, usersRouteSearchParamsSchema } from './search-params-schemas';
@@ -19,7 +19,7 @@ export const SystemRoute = createRoute({
   beforeLoad: () => {
     noDirectAccess(SystemRoute.to, UsersTableRoute.to);
   },
-  getParentRoute: () => AppRoute,
+  getParentRoute: () => AppLayoutRoute,
   component: () => <SystemPage />,
   errorComponent: ({ error }) => <ErrorNotice level="app" error={error} />,
 });
diff --git a/frontend/src/routes/user-routes.tsx b/frontend/src/routes/user-routes.tsx
index 8b1a30635..c95c10060 100644
--- a/frontend/src/routes/user-routes.tsx
+++ b/frontend/src/routes/user-routes.tsx
@@ -5,7 +5,7 @@ import Spinner from '~/modules/common/spinner';
 import { meAuthQueryOptions } from '~/modules/me/query';
 import { userQueryOptions } from '~/modules/users/query';
 import { queryClient } from '~/query/query-client';
-import { AppRoute } from '~/routes/base-routes';
+import { AppLayoutRoute } from '~/routes/base-routes';
 import appTitle from '~/utils/app-title';
 
 const UserProfilePage = lazy(() => import('~/modules/users/profile-page'));
@@ -14,7 +14,7 @@ const UserSettingsPage = lazy(() => import('~/modules/me/settings-page'));
 export const UserProfileRoute = createRoute({
   path: '/users/$idOrSlug',
   staticData: { isAuth: true },
-  getParentRoute: () => AppRoute,
+  getParentRoute: () => AppLayoutRoute,
   loader: async ({ params: { idOrSlug } }) => {
     const userOptions = userQueryOptions(idOrSlug);
     const options = { ...userOptions, revalidateIfStale: true };
@@ -38,7 +38,7 @@ export const UserProfileRoute = createRoute({
 export const UserInOrganizationProfileRoute = createRoute({
   path: '/$orgIdOrSlug/users/$idOrSlug',
   staticData: { isAuth: true },
-  getParentRoute: () => AppRoute,
+  getParentRoute: () => AppLayoutRoute,
   loader: async ({ params: { idOrSlug } }) => {
     const userOptions = userQueryOptions(idOrSlug);
     const options = { ...userOptions, revalidateIfStale: true };
@@ -63,7 +63,7 @@ export const UserSettingsRoute = createRoute({
   path: '/settings',
   staticData: { isAuth: true },
   head: () => ({ meta: [{ title: appTitle('Settings') }] }),
-  getParentRoute: () => AppRoute,
+  getParentRoute: () => AppLayoutRoute,
   loader: async () => {
     const userAuthOptions = meAuthQueryOptions();
     const options = { ...userAuthOptions, revalidateIfStale: true };
diff --git a/locales/en/common.json b/locales/en/common.json
index ed60151d2..0cec7f86a 100644
--- a/locales/en/common.json
+++ b/locales/en/common.json
@@ -302,7 +302,7 @@
   "request_password.text": "Reset your password by sending a reset link to your email address.",
   "request_type": "Request type",
   "request_verification.connect": "to connect your {{providerName}} account",
-  "request_verification.invite": "to verify your {{providerName}} account, after which you can proceed with the invitation",
+  "request_verification.invite": "to verify ownership of the {{providerName}} account, after which you can proceed with the invitation",
   "request_verification.legal_notice": "By verifying your email, you agree to the",
   "request_verification.signin": "to sign in",
   "request_verification.signup": "to complete your sign up",

From 953cc27bf5ee4c7c3b53498d11fd60f4e8b503d0 Mon Sep 17 00:00:00 2001
From: David Hordiienko <shiraz0david@gmail.com>
Date: Thu, 25 Sep 2025 09:42:35 +0300
Subject: [PATCH 09/48] fix: attachments publicity

---
 frontend/src/modules/attachments/helpers/parse-uploaded.ts | 6 +++---
 frontend/src/modules/attachments/types.ts                  | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/frontend/src/modules/attachments/helpers/parse-uploaded.ts b/frontend/src/modules/attachments/helpers/parse-uploaded.ts
index df5576465..e831b0a6a 100644
--- a/frontend/src/modules/attachments/helpers/parse-uploaded.ts
+++ b/frontend/src/modules/attachments/helpers/parse-uploaded.ts
@@ -1,11 +1,10 @@
 import { uploadTemplates } from 'config/templates';
-
 import type { AttachmentToInsert } from '~/modules/attachments/types';
 import type { UploadedUppyFile } from '~/modules/common/uploader/types';
 import { nanoid } from '~/utils/nanoid';
 
 export const parseUploadedAttachments = (result: UploadedUppyFile<'attachment'>, organizationId: string, groupId = nanoid()) => {
-  const uploadedAttachments: (AttachmentToInsert & { id: string })[] = [];
+  const uploadedAttachments: AttachmentToInsert[] = [];
 
   // Process original files
   const originalFiles = result[':original'] || [];
@@ -16,8 +15,9 @@ export const parseUploadedAttachments = (result: UploadedUppyFile<'attachment'>,
       size: String(size || 0),
       contentType: mime,
       filename: original_name || user_meta.name,
-      bucketName: user_meta.bucketName,
       organizationId,
+      public: user_meta.public === 'true',
+      bucketName: user_meta.bucketName,
       type: type ?? ext,
     });
   }
diff --git a/frontend/src/modules/attachments/types.ts b/frontend/src/modules/attachments/types.ts
index 538347ee9..ca82ae9d4 100644
--- a/frontend/src/modules/attachments/types.ts
+++ b/frontend/src/modules/attachments/types.ts
@@ -5,7 +5,7 @@ import type { attachmentsRouteSearchParamsSchema } from '~/routes/search-params-
 
 export type AttachmentsRouteSearchParams = z.infer<typeof attachmentsRouteSearchParamsSchema>;
 
-export type AttachmentToInsert = CreateAttachmentData['body'][number] & { type: string };
+export type AttachmentToInsert = CreateAttachmentData['body'][number] & { id: string; public: boolean; bucketName: string; type: string };
 
 export type AttachmentQueryData = QueryData<Attachment>;
 export type AttachmentInfiniteQueryData = InfiniteQueryData<Attachment>;

From 8ef08cfde2bdd8faa9e635e336bd00f812aa2993 Mon Sep 17 00:00:00 2001
From: Flip van Haaren <flip@shareworks.nl>
Date: Thu, 25 Sep 2025 16:33:36 +0200
Subject: [PATCH 10/48] Git actions (#624)

* AQdd first github actions

* Update actions/setup

* Move setup pnpm before noe

* copy/paste test environments

* Extend github action jobs

* Remove spacing in yml

* Remove dub mapp values

* linting

* Update sdk

* for now exclude biome linter sdk generated file

* Update biome.json

* Update sdk

* Update biome.json

* For now skip type checken, only linting

* Add missing env var in github actions

* Check localHost

* Check quick output to determine when server is ready

* Update match line for quick job

* Update matching pattern for VITE ready

* empty space (testing)

* update quick workflow check

* Check if all lines are grepped right

* Fix regex to match VITE ready

* Ignore the EPIPE failure

* Add storybook tests to github actions

* Undo storybook a11y and depend quick on storybook

* Add a simple release_notes.md

* Use artifactv4

* just install conventional-changelog on-the-fly

* Use conventionalcommits preset

* Add Install changelog deps

* Check for temporary changelog config (support more tags)

* add preset to changelog.config.js

* Just use default changelog

* feat: Finish the git actions (release.yml & ci.yml) + update README

* docs: origin should be enough

* test: if ci works without specifiv node&pnpm version

* test: If ci works without node-version

* build: Remove git-actions branch from push triggers

* Update pnpm lock

---------

Co-authored-by: gino1991 <ginopresilli@gmail.com>
---
 .github/workflows/ci.yml      | 205 ++++++++++++++++++++++++++++++++++
 .github/workflows/release.yml |  36 ++++++
 README.md                     |  21 ++++
 pnpm-lock.yaml                |   9 +-
 4 files changed, 266 insertions(+), 5 deletions(-)
 create mode 100644 .github/workflows/ci.yml
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 000000000..8d17da95a
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,205 @@
+name: CI
+
+# Controls which events and branches will trigger the workflow
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main, development ]
+
+# Cancel older runs of the same PR when a new push arrives
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # Install deps once and reuse for other jobs (optional optimization)
+  install:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v5
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: 24
+          cache: 'pnpm'
+
+      - name: Create .env files
+        run: |
+          cp ./backend/.env.example ./backend/.env
+          cp ./frontend/.env.example ./frontend/.env
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      # Save node_modules so other jobs can reuse
+      - name: Cache node_modules
+        uses: actions/cache@v3
+        with:
+          path: |
+            **/node_modules
+          key: ${{ runner.os }}-modules-${{ hashFiles('pnpm-lock.yaml') }}
+
+  # Runs linting
+  lint:
+    runs-on: ubuntu-latest
+    needs: install
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v5
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+        with:
+          cache: 'pnpm'
+
+      - name: Restore node_modules
+        uses: actions/cache@v3
+        with:
+          path: |
+            **/node_modules
+          key: ${{ runner.os }}-modules-${{ hashFiles('pnpm-lock.yaml') }}
+
+      - name: Run Biome
+        run: pnpm biome check .
+
+  # Runs all tests
+  test:
+    runs-on: ubuntu-latest
+    needs: install
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v5
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+        with:
+          cache: 'pnpm'
+
+      - name: Create .env files
+        run: |
+          cp ./backend/.env.example ./backend/.env
+          cp ./frontend/.env.example ./frontend/.env
+
+      - name: Restore node_modules
+        uses: actions/cache@v3
+        with:
+          path: |
+            **/node_modules
+          key: ${{ runner.os }}-modules-${{ hashFiles('pnpm-lock.yaml') }}
+      - run: pnpm test
+
+  # Runs storybook tests
+  storybook:
+    runs-on: ubuntu-latest
+    needs: install
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v5
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+
+      - name: Restore node_modules
+        uses: actions/cache@v3
+        with:
+          path: |
+            **/node_modules
+          key: ${{ runner.os }}-modules-${{ hashFiles('pnpm-lock.yaml') }}
+
+      - name: Build Storybook
+        run: pnpm --filter frontend build-storybook
+
+  # Will run a quick startup check to ensure the app starts without issues
+  quick:
+    runs-on: ubuntu-latest
+    needs: [lint, test, storybook]
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v5
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+
+      - name: Create .env files
+        run: |
+          cp ./backend/.env.example ./backend/.env
+          cp ./frontend/.env.example ./frontend/.env
+
+      - name: Restore node_modules
+        uses: actions/cache@v3
+        with:
+          path: |
+            **/node_modules
+          key: ${{ runner.os }}-modules-${{ hashFiles('pnpm-lock.yaml') }}
+
+      - name: Start quick and wait for Vite ready
+        run: |
+          timeout 120s stdbuf -oL pnpm quick 2>&1 | while IFS= read -r line; do
+            # Show all output for debugging 
+            echo "$line"
+            # Remove ANSI escape codes
+            clean_line=$(echo "$line" | sed -r "s/\x1B\[[0-9;]*[mK]//g")
+            # Match "VITE <version> ready in <ms>" anywhere in the line
+            if echo "$clean_line" | grep -E ".*VITE [^ ]+ +ready in [0-9]+ ms"; then
+              echo ">>> Vite server is ready! <<<"
+              pkill -P $$ pnpm || true
+              break
+            fi
+          done || true
+
+  # Generates draft release notes (for testing only)
+  draft-release-notes:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0 # needed so changelog sees full commit history
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 9
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+
+      - name: Install changelog deps
+        run: pnpm add -Dw conventional-changelog-cli conventional-changelog-conventionalcommits
+
+      - name: Generate draft release notes
+        run: npx conventional-changelog -p conventionalcommits -r 0 -o RELEASE_NOTES.md
+
+      - name: Upload draft release notes
+        uses: actions/upload-artifact@v4
+        with:
+          name: draft-release-notes
+          path: RELEASE_NOTES.md
\ No newline at end of file
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 000000000..16b7d5b36
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,36 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - "v*" # Runs only when pushing version tags like v1.0.0, v2.3.4
+
+jobs:
+  release-notes:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0 # so changelog sees all commit history
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+        with:
+          cache: "pnpm"
+
+      - name: Install changelog deps
+        run: pnpm add -Dw conventional-changelog-cli conventional-changelog-conventionalcommits
+
+      - name: Generate release notes
+        run: npx conventional-changelog -p conventionalcommits -r 1 -o RELEASE_NOTES.md
+
+      - name: Publish GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          body_path: RELEASE_NOTES.md
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
\ No newline at end of file
diff --git a/README.md b/README.md
index fe2b10c7f..ff27b61e9 100644
--- a/README.md
+++ b/README.md
@@ -37,6 +37,7 @@
 
 #### Contents
 - [Installation](#installation)
+- [Releasing](#releasing)
 - [Architecture](/info/ARCHITECTURE.md)
 - [Roadmap](/info/ROADMAP.md)
 - [Deployment](/info/DEPLOYMENT.md)
@@ -89,6 +90,26 @@ pnpm dev
 
 Check it out at [localhost:3000](http://localhost:3000)! Generated API docs can be found at [localhost:4000/docs](http://localhost:4000/docs). Manage your local db with [local.drizzle.studio](http:local.drizzle.studio).
 
+<p>&nbsp;</p>
+
+## Releasing
+
+We use GitHub Actions to automatically create releases when version tags are pushed.
+
+1. Make sure your changes are merged.
+2. Bump the version with pnpm (this also creates a Git tag):  
+
+```sh
+  pnpm version patch   # or minor / major
+```
+3. Push the commit and the tag:
+```sh
+  git push origin --follow-tags
+```
+Thats it, the workflow will generate RELEASE_NOTES.md from commit messages and publish a GitHub Release automatically.
+
+Release notes are grouped by commit type. The following prefixes are supported:
+- `feat:`, `fix:`, `perf:`, `refactor:`, `revert:`, `chore:`, `ci:`, `docs:` `style:`, `test:`, `build:`
 
 <br />
 <br />
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 44710d139..b5dac56b5 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -716,7 +716,7 @@ importers:
         version: 9.1.7(@types/react@19.1.13)(storybook@9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))
       '@storybook/addon-vitest':
         specifier: ^9.1.7
-        version: 9.1.7(@vitest/browser@3.2.4)(@vitest/runner@3.2.4)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))(vitest@3.2.4)
+        version: 9.1.7(@vitest/browser@3.2.4(playwright@1.55.0)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))(vitest@3.2.4))(@vitest/runner@3.2.4)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))(vitest@3.2.4(@types/debug@4.1.12)(@types/node@24.5.2)(@vitest/browser@3.2.4)(jiti@2.6.0)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
       '@storybook/react-vite':
         specifier: ^9.1.7
         version: 9.1.7(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(rollup@2.79.2)(storybook@9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))(typescript@5.9.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
@@ -758,7 +758,7 @@ importers:
         version: 3.2.4(playwright@1.55.0)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))(vitest@3.2.4)
       '@vitest/coverage-v8':
         specifier: ^3.2.4
-        version: 3.2.4(@vitest/browser@3.2.4)(vitest@3.2.4)
+        version: 3.2.4(@vitest/browser@3.2.4(playwright@1.55.0)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))(vitest@3.2.4))(vitest@3.2.4(@types/debug@4.1.12)(@types/node@24.5.2)(@vitest/browser@3.2.4)(jiti@2.6.0)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
       babel-plugin-react-compiler:
         specifier: 19.1.0-rc.3
         version: 19.1.0-rc.3
@@ -2664,7 +2664,6 @@ packages:
 
   '@evilmartians/lefthook@1.13.3':
     resolution: {integrity: sha512-vYJcf3jZq7MfSlOZzkgnP5bfVMYRW7qETiiGZ/vDkZCzcGV9hLGSic882JSh2dyAX2azfvIW5Tbq/RSHL9i7mw==}
-    cpu: [x64, arm64, ia32]
     os: [darwin, linux, win32]
     hasBin: true
 
@@ -16680,7 +16679,7 @@ snapshots:
     transitivePeerDependencies:
       - '@types/react'
 
-  '@storybook/addon-vitest@9.1.7(@vitest/browser@3.2.4)(@vitest/runner@3.2.4)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))(vitest@3.2.4)':
+  '@storybook/addon-vitest@9.1.7(@vitest/browser@3.2.4(playwright@1.55.0)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))(vitest@3.2.4))(@vitest/runner@3.2.4)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))(vitest@3.2.4(@types/debug@4.1.12)(@types/node@24.5.2)(@vitest/browser@3.2.4)(jiti@2.6.0)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))':
     dependencies:
       '@storybook/global': 5.0.0
       '@storybook/icons': 1.6.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
@@ -17752,7 +17751,7 @@ snapshots:
       - utf-8-validate
       - vite
 
-  '@vitest/coverage-v8@3.2.4(@vitest/browser@3.2.4)(vitest@3.2.4)':
+  '@vitest/coverage-v8@3.2.4(@vitest/browser@3.2.4(playwright@1.55.0)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))(vitest@3.2.4))(vitest@3.2.4(@types/debug@4.1.12)(@types/node@24.5.2)(@vitest/browser@3.2.4)(jiti@2.6.0)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))':
     dependencies:
       '@ampproject/remapping': 2.3.0
       '@bcoe/v8-coverage': 1.0.2

From 346b5c868a728478cf1c5efbae1f47e4087ef9ce Mon Sep 17 00:00:00 2001
From: gino1991 <ginopresilli@gmail.com>
Date: Thu, 25 Sep 2025 16:50:01 +0200
Subject: [PATCH 11/48] test: Do not let storybook build, but only run test in
 github

---
 .github/workflows/ci.yml | 28 +---------------------------
 1 file changed, 1 insertion(+), 27 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8d17da95a..f57e570f4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -106,36 +106,10 @@ jobs:
           key: ${{ runner.os }}-modules-${{ hashFiles('pnpm-lock.yaml') }}
       - run: pnpm test
 
-  # Runs storybook tests
-  storybook:
-    runs-on: ubuntu-latest
-    needs: install
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@v5
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v4
-        with:
-          version: 9
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v5
-
-      - name: Restore node_modules
-        uses: actions/cache@v3
-        with:
-          path: |
-            **/node_modules
-          key: ${{ runner.os }}-modules-${{ hashFiles('pnpm-lock.yaml') }}
-
-      - name: Build Storybook
-        run: pnpm --filter frontend build-storybook
-
   # Will run a quick startup check to ensure the app starts without issues
   quick:
     runs-on: ubuntu-latest
-    needs: [lint, test, storybook]
+    needs: [lint, test]
     steps:
       - name: Checkout repo
         uses: actions/checkout@v5

From 2602deb8c9aef65d2c1f7b973e6df903be25ecdd Mon Sep 17 00:00:00 2001
From: Flip van Haaren <flip@shareworks.nl>
Date: Fri, 26 Sep 2025 10:19:22 +0200
Subject: [PATCH 12/48] Auth ref (#625)

* first commit

* progress

* fixes

* split auth module

* progress

* move oauth to own helpers

* refactor

* readme improvements
---
 README.md                                     |   35 +-
 ...aladin.sql => 0000_modern_black_queen.sql} |   55 +-
 backend/drizzle/0001_illegal_odin.sql         |    1 -
 backend/drizzle/0002_nosy_white_tiger.sql     |   45 -
 backend/drizzle/0003_salty_raider.sql         |    1 -
 backend/drizzle/0004_flaky_charles_xavier.sql |    2 -
 backend/drizzle/meta/0000_snapshot.json       |  331 +++-
 backend/drizzle/meta/0001_snapshot.json       | 1412 --------------
 backend/drizzle/meta/0002_snapshot.json       | 1623 ----------------
 backend/drizzle/meta/0003_snapshot.json       | 1623 ----------------
 backend/drizzle/meta/0004_snapshot.json       | 1636 -----------------
 backend/drizzle/meta/_journal.json            |   32 +-
 backend/emails/create-password.tsx            |    6 +-
 backend/emails/email-verification.tsx         |    9 +-
 backend/emails/member-invite.tsx              |   19 +-
 backend/emails/newsletter.tsx                 |    7 +-
 backend/emails/oauth-verification.tsx         |   10 +-
 backend/emails/system-invite.tsx              |   15 +-
 backend/mocks/basic.ts                        |    2 +-
 backend/package.json                          |   16 +-
 backend/src/db/schema/memberships.ts          |    2 +-
 backend/src/db/schema/oauth-accounts.ts       |    7 +-
 backend/src/db/schema/tokens.ts               |    5 +-
 backend/src/db/schema/users.ts                |    2 +-
 backend/src/lib/notifications/README.md       |   13 +
 backend/src/middlewares/README.md             |    2 +-
 backend/src/middlewares/has-valid-token.ts    |   24 +-
 backend/src/middlewares/rate-limiter/core.ts  |    2 +-
 .../src/middlewares/rate-limiter/helpers.ts   |    3 +-
 .../src/middlewares/rate-limiter/limiters.ts  |   10 +-
 backend/src/modules/auth/general/handlers.ts  |  207 +++
 backend/src/modules/auth/general/routes.ts    |  153 ++
 backend/src/modules/auth/general/schema.ts    |   16 +
 backend/src/modules/auth/handlers.ts          |  871 ---------
 backend/src/modules/auth/helpers/cookie.ts    |   21 +-
 .../auth/helpers/handle-email-verification.ts |   47 +
 backend/src/modules/auth/helpers/mfa.ts       |   34 +-
 .../auth/helpers/send-verification-email.ts   |   13 +-
 backend/src/modules/auth/helpers/session.ts   |    9 +-
 backend/src/modules/auth/helpers/totps.ts     |    2 +-
 backend/src/modules/auth/helpers/user.ts      |    2 +-
 backend/src/modules/auth/oauth/handlers.ts    |  246 +++
 .../oauth => oauth/helpers}/callback.ts       |   73 +-
 .../helpers/handle-oauth-verification.ts      |   23 +
 .../oauth => oauth/helpers}/initiation.ts     |   57 +-
 .../oauth => oauth/helpers}/providers.ts      |    0
 .../helpers}/transform-user-data.ts           |    2 +-
 backend/src/modules/auth/oauth/routes.ts      |  137 ++
 backend/src/modules/auth/oauth/schema.ts      |   25 +
 backend/src/modules/auth/passkeys/handlers.ts |  195 ++
 backend/src/modules/auth/passkeys/routes.ts   |  100 +
 backend/src/modules/auth/passkeys/schema.ts   |   37 +
 .../src/modules/auth/passwords/handlers.ts    |  255 +++
 backend/src/modules/auth/passwords/routes.ts  |  158 ++
 backend/src/modules/auth/passwords/schema.ts  |    8 +
 backend/src/modules/auth/routes.ts            |  503 -----
 backend/src/modules/auth/schema.ts            |   77 -
 backend/src/modules/auth/totps/handlers.ts    |  147 ++
 backend/src/modules/auth/totps/routes.ts      |   97 +
 backend/src/modules/auth/totps/schema.ts      |    6 +
 backend/src/modules/entities/schema.ts        |    2 +-
 backend/src/modules/me/handlers.ts            |  168 +-
 .../src/modules/me/helpers/get-sessions.ts    |    3 +-
 backend/src/modules/me/routes.ts              |  121 +-
 backend/src/modules/me/schema.ts              |   23 +-
 backend/src/modules/memberships/handlers.ts   |   59 +-
 backend/src/modules/memberships/routes.ts     |   28 +
 backend/src/modules/memberships/schema.ts     |    2 +-
 backend/src/modules/requests/handlers.ts      |    2 +-
 backend/src/modules/system/handlers.ts        |    5 +-
 backend/src/modules/system/routes.ts          |    4 +-
 backend/src/modules/system/schema.ts          |    2 +-
 backend/src/modules/users/schema.ts           |    2 +-
 backend/src/routes.ts                         |   12 +-
 .../src/utils/get-valid-single-use-token.ts   |   45 +
 backend/src/utils/get-valid-token.ts          |   60 +
 backend/src/utils/schema/common.ts            |   17 +-
 backend/src/utils/validate-token.ts           |   60 -
 backend/tests/setup.ts                        |   10 +-
 config/default.ts                             |    7 +-
 config/index.ts                               |    6 +
 frontend/package.json                         |   36 +-
 frontend/src/api.gen/sdk.gen.ts               |  741 ++++----
 frontend/src/api.gen/types.gen.ts             |  975 +++++-----
 frontend/src/api.gen/zod.gen.ts               |  369 ++--
 .../src/modules/auth/accept-entity-invite.tsx |   82 -
 .../src/modules/auth/create-password-form.tsx |   13 +-
 frontend/src/modules/auth/error-notice.tsx    |    4 +-
 frontend/src/modules/auth/oauth-providers.tsx |    5 +-
 frontend/src/modules/auth/steps/provider.tsx  |    4 +-
 frontend/src/modules/auth/steps/sign-in.tsx   |   16 +-
 frontend/src/modules/auth/steps/sign-up.tsx   |    6 +-
 .../modules/auth/totp-verify-code-form.tsx    |    4 +-
 frontend/src/modules/auth/types.ts            |    4 +-
 frontend/src/modules/auth/use-token-check.tsx |   10 +-
 .../common/data-table/select-column.tsx       |    2 +-
 frontend/src/modules/common/error-notice.tsx  |    4 +-
 .../common/form-fields/select-role-radio.tsx  |    4 +-
 .../common/form-fields/select-role.tsx        |    2 +-
 .../common/form-fields/select-roles.tsx       |    2 +-
 .../src/modules/me/entity-invitations.tsx     |   43 +-
 frontend/src/modules/me/query.ts              |    2 +-
 frontend/src/modules/me/totp/setup.tsx        |    8 +-
 .../memberships/members-table/columns.tsx     |    2 +-
 .../resend-membership-invitation.tsx          |    1 +
 .../modules/organizations/table/columns.tsx   |    2 +-
 frontend/src/routes/auth-routes.tsx           |   26 +-
 frontend/src/routes/base-routes.tsx           |    1 +
 frontend/src/routes/home-routes.tsx           |   13 +-
 frontend/src/routes/route-tree.tsx            |    2 -
 info/DEPLOYMENT.md                            |   13 +-
 info/RELEASES.md                              |   21 +
 lefthook.yaml                                 |   12 +-
 locales/en/backend.json                       |    3 +-
 locales/en/common.json                        |    9 +-
 locales/en/errors.json                        |   18 +-
 pnpm-lock.yaml                                | 1322 ++++++-------
 117 files changed, 4416 insertions(+), 10474 deletions(-)
 rename backend/drizzle/{0000_sad_paladin.sql => 0000_modern_black_queen.sql} (80%)
 delete mode 100644 backend/drizzle/0001_illegal_odin.sql
 delete mode 100644 backend/drizzle/0002_nosy_white_tiger.sql
 delete mode 100644 backend/drizzle/0003_salty_raider.sql
 delete mode 100644 backend/drizzle/0004_flaky_charles_xavier.sql
 delete mode 100644 backend/drizzle/meta/0001_snapshot.json
 delete mode 100644 backend/drizzle/meta/0002_snapshot.json
 delete mode 100644 backend/drizzle/meta/0003_snapshot.json
 delete mode 100644 backend/drizzle/meta/0004_snapshot.json
 create mode 100644 backend/src/lib/notifications/README.md
 create mode 100644 backend/src/modules/auth/general/handlers.ts
 create mode 100644 backend/src/modules/auth/general/routes.ts
 create mode 100644 backend/src/modules/auth/general/schema.ts
 delete mode 100644 backend/src/modules/auth/handlers.ts
 create mode 100644 backend/src/modules/auth/helpers/handle-email-verification.ts
 create mode 100644 backend/src/modules/auth/oauth/handlers.ts
 rename backend/src/modules/auth/{helpers/oauth => oauth/helpers}/callback.ts (87%)
 create mode 100644 backend/src/modules/auth/oauth/helpers/handle-oauth-verification.ts
 rename backend/src/modules/auth/{helpers/oauth => oauth/helpers}/initiation.ts (66%)
 rename backend/src/modules/auth/{helpers/oauth => oauth/helpers}/providers.ts (100%)
 rename backend/src/modules/auth/{helpers/oauth => oauth/helpers}/transform-user-data.ts (97%)
 create mode 100644 backend/src/modules/auth/oauth/routes.ts
 create mode 100644 backend/src/modules/auth/oauth/schema.ts
 create mode 100644 backend/src/modules/auth/passkeys/handlers.ts
 create mode 100644 backend/src/modules/auth/passkeys/routes.ts
 create mode 100644 backend/src/modules/auth/passkeys/schema.ts
 create mode 100644 backend/src/modules/auth/passwords/handlers.ts
 create mode 100644 backend/src/modules/auth/passwords/routes.ts
 create mode 100644 backend/src/modules/auth/passwords/schema.ts
 delete mode 100644 backend/src/modules/auth/routes.ts
 delete mode 100644 backend/src/modules/auth/schema.ts
 create mode 100644 backend/src/modules/auth/totps/handlers.ts
 create mode 100644 backend/src/modules/auth/totps/routes.ts
 create mode 100644 backend/src/modules/auth/totps/schema.ts
 create mode 100644 backend/src/utils/get-valid-single-use-token.ts
 create mode 100644 backend/src/utils/get-valid-token.ts
 delete mode 100644 backend/src/utils/validate-token.ts
 delete mode 100644 frontend/src/modules/auth/accept-entity-invite.tsx
 create mode 100644 info/RELEASES.md

diff --git a/README.md b/README.md
index ff27b61e9..ceffd7b47 100644
--- a/README.md
+++ b/README.md
@@ -33,11 +33,10 @@
 </div>
 
 > [!CAUTION]
-> This is a prerelease. It does NOT meet production requirements yet and large breaking changes occur regularly. Versioned releases will begin once we have solid tests for authentication, authorization and data access. Want to contribute or discuss cella with us? Let's connect! ✉️ <info@cellajs.com>
+> This is a prerelease. Versioned releases will start once we have solid tests for authentication, authorization and data access. Want to contribute or discuss cella with us? Let's connect! ✉️ <info@cellajs.com>
 
 #### Contents
-- [Installation](#installation)
-- [Releasing](#releasing)
+- [Create app](#create-app)
 - [Architecture](/info/ARCHITECTURE.md)
 - [Roadmap](/info/ROADMAP.md)
 - [Deployment](/info/DEPLOYMENT.md)
@@ -48,18 +47,18 @@
 
 <br>
 
-## Create your own app
-Want to try cella to build a new web app with sync engine? We recommend NOT TO FORK this repo directly. Instead, use the create CLI to get started:
+## Create app
+Do **not fork** this repo directly. Use the create CLI to get started:
 
 ```bash
-pnpm create @cellajs/cella@latest
+pnpm create @cellajs/cella
 ```
 
 You now have an implementation-ready web app 🤯. But ... without any unique functionality 🤓. Read the [Quickstart](/info/QUICKSTART.md) so you can build something unique quickly.
 
 <p>&nbsp;</p>
 
-## Installation
+## Contribute
 For those that (also) want to participate in development:
 
 ```bash
@@ -92,26 +91,4 @@ Check it out at [localhost:3000](http://localhost:3000)! Generated API docs can
 
 <p>&nbsp;</p>
 
-## Releasing
-
-We use GitHub Actions to automatically create releases when version tags are pushed.
-
-1. Make sure your changes are merged.
-2. Bump the version with pnpm (this also creates a Git tag):  
-
-```sh
-  pnpm version patch   # or minor / major
-```
-3. Push the commit and the tag:
-```sh
-  git push origin --follow-tags
-```
-Thats it, the workflow will generate RELEASE_NOTES.md from commit messages and publish a GitHub Release automatically.
-
-Release notes are grouped by commit type. The following prefixes are supported:
-- `feat:`, `fix:`, `perf:`, `refactor:`, `revert:`, `chore:`, `ci:`, `docs:` `style:`, `test:`, `build:`
-
-<br />
-<br />
-
 💙💛 Big thank you to [drizzle](https://github.com/drizzle-team/drizzle-orm), [hono](https://github.com/honojs/hono), [tanstack-router](https://github.com/tanstack/router) & [electric](https://github.com/electric-sql/electric).
diff --git a/backend/drizzle/0000_sad_paladin.sql b/backend/drizzle/0000_modern_black_queen.sql
similarity index 80%
rename from backend/drizzle/0000_sad_paladin.sql
rename to backend/drizzle/0000_modern_black_queen.sql
index da25da186..b28638873 100644
--- a/backend/drizzle/0000_sad_paladin.sql
+++ b/backend/drizzle/0000_modern_black_queen.sql
@@ -3,6 +3,8 @@ CREATE TABLE "attachments" (
 	"id" varchar PRIMARY KEY NOT NULL,
 	"name" varchar DEFAULT 'attachment' NOT NULL,
 	"entity_type" varchar DEFAULT 'attachment' NOT NULL,
+	"public" boolean DEFAULT false NOT NULL,
+	"bucket_name" varchar NOT NULL,
 	"group_id" varchar,
 	"filename" varchar NOT NULL,
 	"content_type" varchar NOT NULL,
@@ -48,14 +50,13 @@ CREATE TABLE "memberships" (
 CREATE TABLE "oauth_accounts" (
 	"created_at" timestamp DEFAULT now() NOT NULL,
 	"id" varchar PRIMARY KEY NOT NULL,
-	"provider_id" varchar NOT NULL,
+	"provider" varchar NOT NULL,
 	"provider_user_id" varchar NOT NULL,
 	"email" varchar NOT NULL,
 	"verified" boolean DEFAULT false NOT NULL,
 	"verified_at" timestamp,
-	"tenant_id" varchar,
 	"user_id" varchar NOT NULL,
-	CONSTRAINT "oauth_accounts_providerId_providerUserId_email_unique" UNIQUE("provider_id","provider_user_id","email")
+	CONSTRAINT "oauth_accounts_provider_providerUserId_email_unique" UNIQUE("provider","provider_user_id","email")
 );
 --> statement-breakpoint
 CREATE TABLE "organizations" (
@@ -89,12 +90,26 @@ CREATE TABLE "organizations" (
 --> statement-breakpoint
 CREATE TABLE "passkeys" (
 	"id" varchar PRIMARY KEY NOT NULL,
-	"user_email" varchar NOT NULL,
+	"user_id" varchar NOT NULL,
 	"credential_id" varchar NOT NULL,
 	"public_key" varchar NOT NULL,
+	"device_name" varchar,
+	"device_type" varchar DEFAULT 'desktop' NOT NULL,
+	"device_os" varchar,
+	"browser" varchar,
+	"name_on_device" varchar NOT NULL,
 	"created_at" timestamp DEFAULT now() NOT NULL
 );
 --> statement-breakpoint
+CREATE TABLE "passwords" (
+	"id" varchar PRIMARY KEY NOT NULL,
+	"hashed_password" varchar NOT NULL,
+	"user_id" varchar NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"modified_at" timestamp,
+	CONSTRAINT "passwords_userId_unique" UNIQUE("user_id")
+);
+--> statement-breakpoint
 CREATE TABLE "requests" (
 	"created_at" timestamp DEFAULT now() NOT NULL,
 	"id" varchar PRIMARY KEY NOT NULL,
@@ -122,6 +137,7 @@ CREATE TABLE "tokens" (
 	"created_at" timestamp DEFAULT now() NOT NULL,
 	"id" varchar PRIMARY KEY NOT NULL,
 	"token" varchar NOT NULL,
+	"single_use_token" varchar,
 	"type" varchar NOT NULL,
 	"email" varchar NOT NULL,
 	"entity_type" varchar,
@@ -130,9 +146,26 @@ CREATE TABLE "tokens" (
 	"oauth_account_id" varchar,
 	"created_by" varchar,
 	"expires_at" timestamp with time zone NOT NULL,
+	"invoked_at" timestamp with time zone,
 	"organization_id" varchar
 );
 --> statement-breakpoint
+CREATE TABLE "totps" (
+	"id" varchar PRIMARY KEY NOT NULL,
+	"user_id" varchar NOT NULL,
+	"secret" varchar NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "unsubscribe_tokens" (
+	"id" varchar PRIMARY KEY NOT NULL,
+	"user_id" varchar NOT NULL,
+	"token" varchar NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "unsubscribe_tokens_userId_unique" UNIQUE("user_id"),
+	CONSTRAINT "unsubscribe_tokens_token_unique" UNIQUE("token")
+);
+--> statement-breakpoint
 CREATE TABLE "users" (
 	"created_at" timestamp DEFAULT now() NOT NULL,
 	"id" varchar PRIMARY KEY NOT NULL,
@@ -143,21 +176,20 @@ CREATE TABLE "users" (
 	"thumbnail_url" varchar,
 	"banner_url" varchar,
 	"email" varchar NOT NULL,
-	"hashed_password" varchar,
-	"unsubscribe_token" varchar NOT NULL,
+	"mfa_required" boolean DEFAULT false NOT NULL,
 	"first_name" varchar,
 	"last_name" varchar,
 	"language" varchar DEFAULT 'en' NOT NULL,
 	"newsletter" boolean DEFAULT false NOT NULL,
 	"role" varchar DEFAULT 'user' NOT NULL,
+	"user_flags" jsonb DEFAULT '{}'::jsonb NOT NULL,
 	"modified_at" timestamp,
 	"last_seen_at" timestamp,
 	"last_started_at" timestamp,
 	"last_sign_in_at" timestamp,
 	"modified_by" varchar,
 	CONSTRAINT "users_slug_unique" UNIQUE("slug"),
-	CONSTRAINT "users_email_unique" UNIQUE("email"),
-	CONSTRAINT "users_unsubscribeToken_unique" UNIQUE("unsubscribe_token")
+	CONSTRAINT "users_email_unique" UNIQUE("email")
 );
 --> statement-breakpoint
 ALTER TABLE "attachments" ADD CONSTRAINT "attachments_created_by_users_id_fk" FOREIGN KEY ("created_by") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
@@ -173,20 +205,23 @@ ALTER TABLE "memberships" ADD CONSTRAINT "memberships_organization_id_organizati
 ALTER TABLE "oauth_accounts" ADD CONSTRAINT "oauth_accounts_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "organizations" ADD CONSTRAINT "organizations_created_by_users_id_fk" FOREIGN KEY ("created_by") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "organizations" ADD CONSTRAINT "organizations_modified_by_users_id_fk" FOREIGN KEY ("modified_by") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
-ALTER TABLE "passkeys" ADD CONSTRAINT "passkeys_user_email_users_email_fk" FOREIGN KEY ("user_email") REFERENCES "public"."users"("email") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "passkeys" ADD CONSTRAINT "passkeys_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "passwords" ADD CONSTRAINT "passwords_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "requests" ADD CONSTRAINT "requests_token_id_tokens_id_fk" FOREIGN KEY ("token_id") REFERENCES "public"."tokens"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "sessions" ADD CONSTRAINT "sessions_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "tokens" ADD CONSTRAINT "tokens_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "tokens" ADD CONSTRAINT "tokens_oauth_account_id_oauth_accounts_id_fk" FOREIGN KEY ("oauth_account_id") REFERENCES "public"."oauth_accounts"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "tokens" ADD CONSTRAINT "tokens_created_by_users_id_fk" FOREIGN KEY ("created_by") REFERENCES "public"."users"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "tokens" ADD CONSTRAINT "tokens_organization_id_organizations_id_fk" FOREIGN KEY ("organization_id") REFERENCES "public"."organizations"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "totps" ADD CONSTRAINT "totps_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "unsubscribe_tokens" ADD CONSTRAINT "unsubscribe_tokens_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
 ALTER TABLE "users" ADD CONSTRAINT "users_modified_by_users_id_fk" FOREIGN KEY ("modified_by") REFERENCES "public"."users"("id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
 CREATE INDEX "attachments_organization_id_index" ON "attachments" USING btree ("organization_id");--> statement-breakpoint
 CREATE INDEX "organizations_name_index" ON "organizations" USING btree ("name" DESC NULLS LAST);--> statement-breakpoint
 CREATE INDEX "organizations_created_at_index" ON "organizations" USING btree ("created_at" DESC NULLS LAST);--> statement-breakpoint
 CREATE INDEX "requests_emails" ON "requests" USING btree ("email" DESC NULLS LAST);--> statement-breakpoint
 CREATE INDEX "requests_created_at" ON "requests" USING btree ("created_at" DESC NULLS LAST);--> statement-breakpoint
+CREATE INDEX "users_token_index" ON "unsubscribe_tokens" USING btree ("token");--> statement-breakpoint
 CREATE INDEX "users_name_index" ON "users" USING btree ("name" DESC NULLS LAST);--> statement-breakpoint
-CREATE INDEX "users_token_index" ON "users" USING btree ("unsubscribe_token");--> statement-breakpoint
 CREATE INDEX "users_email_index" ON "users" USING btree ("email" DESC NULLS LAST);--> statement-breakpoint
 CREATE INDEX "users_created_at_index" ON "users" USING btree ("created_at" DESC NULLS LAST);
\ No newline at end of file
diff --git a/backend/drizzle/0001_illegal_odin.sql b/backend/drizzle/0001_illegal_odin.sql
deleted file mode 100644
index 0a027754e..000000000
--- a/backend/drizzle/0001_illegal_odin.sql
+++ /dev/null
@@ -1 +0,0 @@
-ALTER TABLE "users" ADD COLUMN "user_flags" jsonb DEFAULT '{}'::jsonb NOT NULL
\ No newline at end of file
diff --git a/backend/drizzle/0002_nosy_white_tiger.sql b/backend/drizzle/0002_nosy_white_tiger.sql
deleted file mode 100644
index c77c3c32c..000000000
--- a/backend/drizzle/0002_nosy_white_tiger.sql
+++ /dev/null
@@ -1,45 +0,0 @@
-CREATE TABLE "passwords" (
-	"id" varchar PRIMARY KEY NOT NULL,
-	"hashed_password" varchar NOT NULL,
-	"user_id" varchar NOT NULL,
-	"created_at" timestamp DEFAULT now() NOT NULL,
-	"modified_at" timestamp,
-	CONSTRAINT "passwords_userId_unique" UNIQUE("user_id")
-);
---> statement-breakpoint
-CREATE TABLE "totps" (
-	"id" varchar PRIMARY KEY NOT NULL,
-	"user_id" varchar NOT NULL,
-	"encoder_secret_key" varchar NOT NULL,
-	"created_at" timestamp DEFAULT now() NOT NULL
-);
---> statement-breakpoint
-CREATE TABLE "unsubscribe_tokens" (
-	"id" varchar PRIMARY KEY NOT NULL,
-	"user_id" varchar NOT NULL,
-	"token" varchar NOT NULL,
-	"created_at" timestamp DEFAULT now() NOT NULL,
-	CONSTRAINT "unsubscribe_tokens_userId_unique" UNIQUE("user_id"),
-	CONSTRAINT "unsubscribe_tokens_token_unique" UNIQUE("token")
-);
---> statement-breakpoint
-ALTER TABLE "users" DROP CONSTRAINT "users_unsubscribeToken_unique";--> statement-breakpoint
-ALTER TABLE "passkeys" DROP CONSTRAINT "passkeys_user_email_users_email_fk";
---> statement-breakpoint
-DROP INDEX "users_token_index";--> statement-breakpoint
-ALTER TABLE "passkeys" ADD COLUMN "user_id" varchar NOT NULL;--> statement-breakpoint
-ALTER TABLE "passkeys" ADD COLUMN "device_name" varchar;--> statement-breakpoint
-ALTER TABLE "passkeys" ADD COLUMN "device_type" varchar DEFAULT 'desktop' NOT NULL;--> statement-breakpoint
-ALTER TABLE "passkeys" ADD COLUMN "device_os" varchar;--> statement-breakpoint
-ALTER TABLE "passkeys" ADD COLUMN "browser" varchar;--> statement-breakpoint
-ALTER TABLE "passkeys" ADD COLUMN "name_on_device" varchar NOT NULL;--> statement-breakpoint
-ALTER TABLE "tokens" ADD COLUMN "consumed_at" timestamp with time zone;--> statement-breakpoint
-ALTER TABLE "users" ADD COLUMN "mfa_required" boolean DEFAULT false NOT NULL;--> statement-breakpoint
-ALTER TABLE "passwords" ADD CONSTRAINT "passwords_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
-ALTER TABLE "totps" ADD CONSTRAINT "totps_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
-ALTER TABLE "unsubscribe_tokens" ADD CONSTRAINT "unsubscribe_tokens_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
-CREATE INDEX "users_token_index" ON "unsubscribe_tokens" USING btree ("token");--> statement-breakpoint
-ALTER TABLE "passkeys" ADD CONSTRAINT "passkeys_user_id_users_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."users"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
-ALTER TABLE "passkeys" DROP COLUMN "user_email";--> statement-breakpoint
-ALTER TABLE "users" DROP COLUMN "hashed_password";--> statement-breakpoint
-ALTER TABLE "users" DROP COLUMN "unsubscribe_token";
\ No newline at end of file
diff --git a/backend/drizzle/0003_salty_raider.sql b/backend/drizzle/0003_salty_raider.sql
deleted file mode 100644
index c072bee7d..000000000
--- a/backend/drizzle/0003_salty_raider.sql
+++ /dev/null
@@ -1 +0,0 @@
-ALTER TABLE "totps" RENAME COLUMN "encoder_secret_key" TO "secret";
\ No newline at end of file
diff --git a/backend/drizzle/0004_flaky_charles_xavier.sql b/backend/drizzle/0004_flaky_charles_xavier.sql
deleted file mode 100644
index 69af7796d..000000000
--- a/backend/drizzle/0004_flaky_charles_xavier.sql
+++ /dev/null
@@ -1,2 +0,0 @@
-ALTER TABLE "attachments" ADD COLUMN "public" boolean DEFAULT false NOT NULL;--> statement-breakpoint
-ALTER TABLE "attachments" ADD COLUMN "bucket_name" varchar NOT NULL;
\ No newline at end of file
diff --git a/backend/drizzle/meta/0000_snapshot.json b/backend/drizzle/meta/0000_snapshot.json
index 1cc88732e..e863c8aae 100644
--- a/backend/drizzle/meta/0000_snapshot.json
+++ b/backend/drizzle/meta/0000_snapshot.json
@@ -1,5 +1,5 @@
 {
-  "id": "727b17a3-f074-4db2-92c1-bb650749e21c",
+  "id": "eb63c351-3bd9-470d-a7ae-afb456ca323a",
   "prevId": "00000000-0000-0000-0000-000000000000",
   "version": "7",
   "dialect": "postgresql",
@@ -35,6 +35,19 @@
           "notNull": true,
           "default": "'attachment'"
         },
+        "public": {
+          "name": "public",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "bucket_name": {
+          "name": "bucket_name",
+          "type": "varchar",
+          "primaryKey": false,
+          "notNull": true
+        },
         "group_id": {
           "name": "group_id",
           "type": "varchar",
@@ -448,8 +461,8 @@
           "primaryKey": true,
           "notNull": true
         },
-        "provider_id": {
-          "name": "provider_id",
+        "provider": {
+          "name": "provider",
           "type": "varchar",
           "primaryKey": false,
           "notNull": true
@@ -479,12 +492,6 @@
           "primaryKey": false,
           "notNull": false
         },
-        "tenant_id": {
-          "name": "tenant_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
         "user_id": {
           "name": "user_id",
           "type": "varchar",
@@ -510,11 +517,11 @@
       },
       "compositePrimaryKeys": {},
       "uniqueConstraints": {
-        "oauth_accounts_providerId_providerUserId_email_unique": {
-          "name": "oauth_accounts_providerId_providerUserId_email_unique",
+        "oauth_accounts_provider_providerUserId_email_unique": {
+          "name": "oauth_accounts_provider_providerUserId_email_unique",
           "nullsNotDistinct": false,
           "columns": [
-            "provider_id",
+            "provider",
             "provider_user_id",
             "email"
           ]
@@ -771,8 +778,8 @@
           "primaryKey": true,
           "notNull": true
         },
-        "user_email": {
-          "name": "user_email",
+        "user_id": {
+          "name": "user_id",
           "type": "varchar",
           "primaryKey": false,
           "notNull": true
@@ -789,6 +796,37 @@
           "primaryKey": false,
           "notNull": true
         },
+        "device_name": {
+          "name": "device_name",
+          "type": "varchar",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "device_type": {
+          "name": "device_type",
+          "type": "varchar",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'desktop'"
+        },
+        "device_os": {
+          "name": "device_os",
+          "type": "varchar",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "browser": {
+          "name": "browser",
+          "type": "varchar",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name_on_device": {
+          "name": "name_on_device",
+          "type": "varchar",
+          "primaryKey": false,
+          "notNull": true
+        },
         "created_at": {
           "name": "created_at",
           "type": "timestamp",
@@ -799,15 +837,15 @@
       },
       "indexes": {},
       "foreignKeys": {
-        "passkeys_user_email_users_email_fk": {
-          "name": "passkeys_user_email_users_email_fk",
+        "passkeys_user_id_users_id_fk": {
+          "name": "passkeys_user_id_users_id_fk",
           "tableFrom": "passkeys",
           "tableTo": "users",
           "columnsFrom": [
-            "user_email"
+            "user_id"
           ],
           "columnsTo": [
-            "email"
+            "id"
           ],
           "onDelete": "cascade",
           "onUpdate": "no action"
@@ -819,6 +857,72 @@
       "checkConstraints": {},
       "isRLSEnabled": false
     },
+    "public.passwords": {
+      "name": "passwords",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "hashed_password": {
+          "name": "hashed_password",
+          "type": "varchar",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "varchar",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "modified_at": {
+          "name": "modified_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "passwords_user_id_users_id_fk": {
+          "name": "passwords_user_id_users_id_fk",
+          "tableFrom": "passwords",
+          "tableTo": "users",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "passwords_userId_unique": {
+          "name": "passwords_userId_unique",
+          "nullsNotDistinct": false,
+          "columns": [
+            "user_id"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
     "public.requests": {
       "name": "requests",
       "schema": "",
@@ -1033,6 +1137,12 @@
           "primaryKey": false,
           "notNull": true
         },
+        "single_use_token": {
+          "name": "single_use_token",
+          "type": "varchar",
+          "primaryKey": false,
+          "notNull": false
+        },
         "type": {
           "name": "type",
           "type": "varchar",
@@ -1081,6 +1191,12 @@
           "primaryKey": false,
           "notNull": true
         },
+        "invoked_at": {
+          "name": "invoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
         "organization_id": {
           "name": "organization_id",
           "type": "varchar",
@@ -1149,6 +1265,141 @@
       "checkConstraints": {},
       "isRLSEnabled": false
     },
+    "public.totps": {
+      "name": "totps",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "varchar",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "secret": {
+          "name": "secret",
+          "type": "varchar",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "totps_user_id_users_id_fk": {
+          "name": "totps_user_id_users_id_fk",
+          "tableFrom": "totps",
+          "tableTo": "users",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.unsubscribe_tokens": {
+      "name": "unsubscribe_tokens",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "varchar",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "varchar",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token": {
+          "name": "token",
+          "type": "varchar",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "users_token_index": {
+          "name": "users_token_index",
+          "columns": [
+            {
+              "expression": "token",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "unsubscribe_tokens_user_id_users_id_fk": {
+          "name": "unsubscribe_tokens_user_id_users_id_fk",
+          "tableFrom": "unsubscribe_tokens",
+          "tableTo": "users",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "unsubscribe_tokens_userId_unique": {
+          "name": "unsubscribe_tokens_userId_unique",
+          "nullsNotDistinct": false,
+          "columns": [
+            "user_id"
+          ]
+        },
+        "unsubscribe_tokens_token_unique": {
+          "name": "unsubscribe_tokens_token_unique",
+          "nullsNotDistinct": false,
+          "columns": [
+            "token"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
     "public.users": {
       "name": "users",
       "schema": "",
@@ -1209,17 +1460,12 @@
           "primaryKey": false,
           "notNull": true
         },
-        "hashed_password": {
-          "name": "hashed_password",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "unsubscribe_token": {
-          "name": "unsubscribe_token",
-          "type": "varchar",
+        "mfa_required": {
+          "name": "mfa_required",
+          "type": "boolean",
           "primaryKey": false,
-          "notNull": true
+          "notNull": true,
+          "default": false
         },
         "first_name": {
           "name": "first_name",
@@ -1254,6 +1500,13 @@
           "notNull": true,
           "default": "'user'"
         },
+        "user_flags": {
+          "name": "user_flags",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
         "modified_at": {
           "name": "modified_at",
           "type": "timestamp",
@@ -1301,21 +1554,6 @@
           "method": "btree",
           "with": {}
         },
-        "users_token_index": {
-          "name": "users_token_index",
-          "columns": [
-            {
-              "expression": "unsubscribe_token",
-              "isExpression": false,
-              "asc": true,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        },
         "users_email_index": {
           "name": "users_email_index",
           "columns": [
@@ -1377,13 +1615,6 @@
           "columns": [
             "email"
           ]
-        },
-        "users_unsubscribeToken_unique": {
-          "name": "users_unsubscribeToken_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "unsubscribe_token"
-          ]
         }
       },
       "policies": {},
diff --git a/backend/drizzle/meta/0001_snapshot.json b/backend/drizzle/meta/0001_snapshot.json
deleted file mode 100644
index 7868f6365..000000000
--- a/backend/drizzle/meta/0001_snapshot.json
+++ /dev/null
@@ -1,1412 +0,0 @@
-{
-  "id": "97546b98-2c9e-4494-bd18-66fc4bb43284",
-  "prevId": "727b17a3-f074-4db2-92c1-bb650749e21c",
-  "version": "7",
-  "dialect": "postgresql",
-  "tables": {
-    "public.attachments": {
-      "name": "attachments",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "name": {
-          "name": "name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'attachment'"
-        },
-        "entity_type": {
-          "name": "entity_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'attachment'"
-        },
-        "group_id": {
-          "name": "group_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "filename": {
-          "name": "filename",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "content_type": {
-          "name": "content_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "converted_content_type": {
-          "name": "converted_content_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "size": {
-          "name": "size",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "original_key": {
-          "name": "original_key",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "converted_key": {
-          "name": "converted_key",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "thumbnail_key": {
-          "name": "thumbnail_key",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "created_by": {
-          "name": "created_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "modified_at": {
-          "name": "modified_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "modified_by": {
-          "name": "modified_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "organization_id": {
-          "name": "organization_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        }
-      },
-      "indexes": {
-        "attachments_organization_id_index": {
-          "name": "attachments_organization_id_index",
-          "columns": [
-            {
-              "expression": "organization_id",
-              "isExpression": false,
-              "asc": true,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        }
-      },
-      "foreignKeys": {
-        "attachments_created_by_users_id_fk": {
-          "name": "attachments_created_by_users_id_fk",
-          "tableFrom": "attachments",
-          "tableTo": "users",
-          "columnsFrom": [
-            "created_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "attachments_modified_by_users_id_fk": {
-          "name": "attachments_modified_by_users_id_fk",
-          "tableFrom": "attachments",
-          "tableTo": "users",
-          "columnsFrom": [
-            "modified_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "attachments_organization_id_organizations_id_fk": {
-          "name": "attachments_organization_id_organizations_id_fk",
-          "tableFrom": "attachments",
-          "tableTo": "organizations",
-          "columnsFrom": [
-            "organization_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.emails": {
-      "name": "emails",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "email": {
-          "name": "email",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "verified": {
-          "name": "verified",
-          "type": "boolean",
-          "primaryKey": false,
-          "notNull": true,
-          "default": false
-        },
-        "token_id": {
-          "name": "token_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "verified_at": {
-          "name": "verified_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "emails_token_id_tokens_id_fk": {
-          "name": "emails_token_id_tokens_id_fk",
-          "tableFrom": "emails",
-          "tableTo": "tokens",
-          "columnsFrom": [
-            "token_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "emails_user_id_users_id_fk": {
-          "name": "emails_user_id_users_id_fk",
-          "tableFrom": "emails",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {
-        "emails_email_unique": {
-          "name": "emails_email_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "email"
-          ]
-        }
-      },
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.memberships": {
-      "name": "memberships",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "context_type": {
-          "name": "context_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "role": {
-          "name": "role",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'member'"
-        },
-        "token_id": {
-          "name": "token_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "activated_at": {
-          "name": "activated_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "created_by": {
-          "name": "created_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "modified_at": {
-          "name": "modified_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "modified_by": {
-          "name": "modified_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "archived": {
-          "name": "archived",
-          "type": "boolean",
-          "primaryKey": false,
-          "notNull": true,
-          "default": false
-        },
-        "muted": {
-          "name": "muted",
-          "type": "boolean",
-          "primaryKey": false,
-          "notNull": true,
-          "default": false
-        },
-        "order": {
-          "name": "order",
-          "type": "double precision",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "organization_id": {
-          "name": "organization_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "memberships_user_id_users_id_fk": {
-          "name": "memberships_user_id_users_id_fk",
-          "tableFrom": "memberships",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        },
-        "memberships_token_id_tokens_id_fk": {
-          "name": "memberships_token_id_tokens_id_fk",
-          "tableFrom": "memberships",
-          "tableTo": "tokens",
-          "columnsFrom": [
-            "token_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        },
-        "memberships_created_by_users_id_fk": {
-          "name": "memberships_created_by_users_id_fk",
-          "tableFrom": "memberships",
-          "tableTo": "users",
-          "columnsFrom": [
-            "created_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "memberships_modified_by_users_id_fk": {
-          "name": "memberships_modified_by_users_id_fk",
-          "tableFrom": "memberships",
-          "tableTo": "users",
-          "columnsFrom": [
-            "modified_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "memberships_organization_id_organizations_id_fk": {
-          "name": "memberships_organization_id_organizations_id_fk",
-          "tableFrom": "memberships",
-          "tableTo": "organizations",
-          "columnsFrom": [
-            "organization_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.oauth_accounts": {
-      "name": "oauth_accounts",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "provider_id": {
-          "name": "provider_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "provider_user_id": {
-          "name": "provider_user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "email": {
-          "name": "email",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "verified": {
-          "name": "verified",
-          "type": "boolean",
-          "primaryKey": false,
-          "notNull": true,
-          "default": false
-        },
-        "verified_at": {
-          "name": "verified_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "tenant_id": {
-          "name": "tenant_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "oauth_accounts_user_id_users_id_fk": {
-          "name": "oauth_accounts_user_id_users_id_fk",
-          "tableFrom": "oauth_accounts",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {
-        "oauth_accounts_providerId_providerUserId_email_unique": {
-          "name": "oauth_accounts_providerId_providerUserId_email_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "provider_id",
-            "provider_user_id",
-            "email"
-          ]
-        }
-      },
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.organizations": {
-      "name": "organizations",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "entity_type": {
-          "name": "entity_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'organization'"
-        },
-        "name": {
-          "name": "name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "description": {
-          "name": "description",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "slug": {
-          "name": "slug",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "thumbnail_url": {
-          "name": "thumbnail_url",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "banner_url": {
-          "name": "banner_url",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "short_name": {
-          "name": "short_name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "country": {
-          "name": "country",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "timezone": {
-          "name": "timezone",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "default_language": {
-          "name": "default_language",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'en'"
-        },
-        "languages": {
-          "name": "languages",
-          "type": "json",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'[\"en\"]'::json"
-        },
-        "restrictions": {
-          "name": "restrictions",
-          "type": "json",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'{\"user\":1000,\"attachment\":100}'::json"
-        },
-        "notification_email": {
-          "name": "notification_email",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "email_domains": {
-          "name": "email_domains",
-          "type": "json",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'[]'::json"
-        },
-        "color": {
-          "name": "color",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "logo_url": {
-          "name": "logo_url",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "website_url": {
-          "name": "website_url",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "welcome_text": {
-          "name": "welcome_text",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "auth_strategies": {
-          "name": "auth_strategies",
-          "type": "json",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'[]'::json"
-        },
-        "chat_support": {
-          "name": "chat_support",
-          "type": "boolean",
-          "primaryKey": false,
-          "notNull": true,
-          "default": false
-        },
-        "created_by": {
-          "name": "created_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "modified_at": {
-          "name": "modified_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "modified_by": {
-          "name": "modified_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        }
-      },
-      "indexes": {
-        "organizations_name_index": {
-          "name": "organizations_name_index",
-          "columns": [
-            {
-              "expression": "name",
-              "isExpression": false,
-              "asc": false,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        },
-        "organizations_created_at_index": {
-          "name": "organizations_created_at_index",
-          "columns": [
-            {
-              "expression": "created_at",
-              "isExpression": false,
-              "asc": false,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        }
-      },
-      "foreignKeys": {
-        "organizations_created_by_users_id_fk": {
-          "name": "organizations_created_by_users_id_fk",
-          "tableFrom": "organizations",
-          "tableTo": "users",
-          "columnsFrom": [
-            "created_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "organizations_modified_by_users_id_fk": {
-          "name": "organizations_modified_by_users_id_fk",
-          "tableFrom": "organizations",
-          "tableTo": "users",
-          "columnsFrom": [
-            "modified_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {
-        "organizations_slug_unique": {
-          "name": "organizations_slug_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "slug"
-          ]
-        }
-      },
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.passkeys": {
-      "name": "passkeys",
-      "schema": "",
-      "columns": {
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "user_email": {
-          "name": "user_email",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "credential_id": {
-          "name": "credential_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "public_key": {
-          "name": "public_key",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "passkeys_user_email_users_email_fk": {
-          "name": "passkeys_user_email_users_email_fk",
-          "tableFrom": "passkeys",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_email"
-          ],
-          "columnsTo": [
-            "email"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.requests": {
-      "name": "requests",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "message": {
-          "name": "message",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "email": {
-          "name": "email",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "type": {
-          "name": "type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "token_id": {
-          "name": "token_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        }
-      },
-      "indexes": {
-        "requests_emails": {
-          "name": "requests_emails",
-          "columns": [
-            {
-              "expression": "email",
-              "isExpression": false,
-              "asc": false,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        },
-        "requests_created_at": {
-          "name": "requests_created_at",
-          "columns": [
-            {
-              "expression": "created_at",
-              "isExpression": false,
-              "asc": false,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        }
-      },
-      "foreignKeys": {
-        "requests_token_id_tokens_id_fk": {
-          "name": "requests_token_id_tokens_id_fk",
-          "tableFrom": "requests",
-          "tableTo": "tokens",
-          "columnsFrom": [
-            "token_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.sessions": {
-      "name": "sessions",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "token": {
-          "name": "token",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "type": {
-          "name": "type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'regular'"
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "device_name": {
-          "name": "device_name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "device_type": {
-          "name": "device_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'desktop'"
-        },
-        "device_os": {
-          "name": "device_os",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "browser": {
-          "name": "browser",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "auth_strategy": {
-          "name": "auth_strategy",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "expires_at": {
-          "name": "expires_at",
-          "type": "timestamp with time zone",
-          "primaryKey": false,
-          "notNull": true
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "sessions_user_id_users_id_fk": {
-          "name": "sessions_user_id_users_id_fk",
-          "tableFrom": "sessions",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.tokens": {
-      "name": "tokens",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "token": {
-          "name": "token",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "type": {
-          "name": "type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "email": {
-          "name": "email",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "entity_type": {
-          "name": "entity_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "role": {
-          "name": "role",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "oauth_account_id": {
-          "name": "oauth_account_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "created_by": {
-          "name": "created_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "expires_at": {
-          "name": "expires_at",
-          "type": "timestamp with time zone",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "organization_id": {
-          "name": "organization_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "tokens_user_id_users_id_fk": {
-          "name": "tokens_user_id_users_id_fk",
-          "tableFrom": "tokens",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        },
-        "tokens_oauth_account_id_oauth_accounts_id_fk": {
-          "name": "tokens_oauth_account_id_oauth_accounts_id_fk",
-          "tableFrom": "tokens",
-          "tableTo": "oauth_accounts",
-          "columnsFrom": [
-            "oauth_account_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "tokens_created_by_users_id_fk": {
-          "name": "tokens_created_by_users_id_fk",
-          "tableFrom": "tokens",
-          "tableTo": "users",
-          "columnsFrom": [
-            "created_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "tokens_organization_id_organizations_id_fk": {
-          "name": "tokens_organization_id_organizations_id_fk",
-          "tableFrom": "tokens",
-          "tableTo": "organizations",
-          "columnsFrom": [
-            "organization_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.users": {
-      "name": "users",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "entity_type": {
-          "name": "entity_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'user'"
-        },
-        "name": {
-          "name": "name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "description": {
-          "name": "description",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "slug": {
-          "name": "slug",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "thumbnail_url": {
-          "name": "thumbnail_url",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "banner_url": {
-          "name": "banner_url",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "email": {
-          "name": "email",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "hashed_password": {
-          "name": "hashed_password",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "unsubscribe_token": {
-          "name": "unsubscribe_token",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "first_name": {
-          "name": "first_name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "last_name": {
-          "name": "last_name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "language": {
-          "name": "language",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'en'"
-        },
-        "newsletter": {
-          "name": "newsletter",
-          "type": "boolean",
-          "primaryKey": false,
-          "notNull": true,
-          "default": false
-        },
-        "role": {
-          "name": "role",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'user'"
-        },
-        "user_flags": {
-          "name": "user_flags",
-          "type": "jsonb",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'{}'::jsonb"
-        },
-        "modified_at": {
-          "name": "modified_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "last_seen_at": {
-          "name": "last_seen_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "last_started_at": {
-          "name": "last_started_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "last_sign_in_at": {
-          "name": "last_sign_in_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "modified_by": {
-          "name": "modified_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        }
-      },
-      "indexes": {
-        "users_name_index": {
-          "name": "users_name_index",
-          "columns": [
-            {
-              "expression": "name",
-              "isExpression": false,
-              "asc": false,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        },
-        "users_token_index": {
-          "name": "users_token_index",
-          "columns": [
-            {
-              "expression": "unsubscribe_token",
-              "isExpression": false,
-              "asc": true,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        },
-        "users_email_index": {
-          "name": "users_email_index",
-          "columns": [
-            {
-              "expression": "email",
-              "isExpression": false,
-              "asc": false,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        },
-        "users_created_at_index": {
-          "name": "users_created_at_index",
-          "columns": [
-            {
-              "expression": "created_at",
-              "isExpression": false,
-              "asc": false,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        }
-      },
-      "foreignKeys": {
-        "users_modified_by_users_id_fk": {
-          "name": "users_modified_by_users_id_fk",
-          "tableFrom": "users",
-          "tableTo": "users",
-          "columnsFrom": [
-            "modified_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "no action",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {
-        "users_slug_unique": {
-          "name": "users_slug_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "slug"
-          ]
-        },
-        "users_email_unique": {
-          "name": "users_email_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "email"
-          ]
-        },
-        "users_unsubscribeToken_unique": {
-          "name": "users_unsubscribeToken_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "unsubscribe_token"
-          ]
-        }
-      },
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    }
-  },
-  "enums": {},
-  "schemas": {},
-  "sequences": {},
-  "roles": {},
-  "policies": {},
-  "views": {},
-  "_meta": {
-    "columns": {},
-    "schemas": {},
-    "tables": {}
-  }
-}
\ No newline at end of file
diff --git a/backend/drizzle/meta/0002_snapshot.json b/backend/drizzle/meta/0002_snapshot.json
deleted file mode 100644
index 87e67d41b..000000000
--- a/backend/drizzle/meta/0002_snapshot.json
+++ /dev/null
@@ -1,1623 +0,0 @@
-{
-  "id": "8d539283-e38e-4a7f-bea3-4841aa6d3584",
-  "prevId": "97546b98-2c9e-4494-bd18-66fc4bb43284",
-  "version": "7",
-  "dialect": "postgresql",
-  "tables": {
-    "public.attachments": {
-      "name": "attachments",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "name": {
-          "name": "name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'attachment'"
-        },
-        "entity_type": {
-          "name": "entity_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'attachment'"
-        },
-        "group_id": {
-          "name": "group_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "filename": {
-          "name": "filename",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "content_type": {
-          "name": "content_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "converted_content_type": {
-          "name": "converted_content_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "size": {
-          "name": "size",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "original_key": {
-          "name": "original_key",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "converted_key": {
-          "name": "converted_key",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "thumbnail_key": {
-          "name": "thumbnail_key",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "created_by": {
-          "name": "created_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "modified_at": {
-          "name": "modified_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "modified_by": {
-          "name": "modified_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "organization_id": {
-          "name": "organization_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        }
-      },
-      "indexes": {
-        "attachments_organization_id_index": {
-          "name": "attachments_organization_id_index",
-          "columns": [
-            {
-              "expression": "organization_id",
-              "isExpression": false,
-              "asc": true,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        }
-      },
-      "foreignKeys": {
-        "attachments_created_by_users_id_fk": {
-          "name": "attachments_created_by_users_id_fk",
-          "tableFrom": "attachments",
-          "tableTo": "users",
-          "columnsFrom": [
-            "created_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "attachments_modified_by_users_id_fk": {
-          "name": "attachments_modified_by_users_id_fk",
-          "tableFrom": "attachments",
-          "tableTo": "users",
-          "columnsFrom": [
-            "modified_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "attachments_organization_id_organizations_id_fk": {
-          "name": "attachments_organization_id_organizations_id_fk",
-          "tableFrom": "attachments",
-          "tableTo": "organizations",
-          "columnsFrom": [
-            "organization_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.emails": {
-      "name": "emails",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "email": {
-          "name": "email",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "verified": {
-          "name": "verified",
-          "type": "boolean",
-          "primaryKey": false,
-          "notNull": true,
-          "default": false
-        },
-        "token_id": {
-          "name": "token_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "verified_at": {
-          "name": "verified_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "emails_token_id_tokens_id_fk": {
-          "name": "emails_token_id_tokens_id_fk",
-          "tableFrom": "emails",
-          "tableTo": "tokens",
-          "columnsFrom": [
-            "token_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "emails_user_id_users_id_fk": {
-          "name": "emails_user_id_users_id_fk",
-          "tableFrom": "emails",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {
-        "emails_email_unique": {
-          "name": "emails_email_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "email"
-          ]
-        }
-      },
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.memberships": {
-      "name": "memberships",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "context_type": {
-          "name": "context_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "role": {
-          "name": "role",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'member'"
-        },
-        "token_id": {
-          "name": "token_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "activated_at": {
-          "name": "activated_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "created_by": {
-          "name": "created_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "modified_at": {
-          "name": "modified_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "modified_by": {
-          "name": "modified_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "archived": {
-          "name": "archived",
-          "type": "boolean",
-          "primaryKey": false,
-          "notNull": true,
-          "default": false
-        },
-        "muted": {
-          "name": "muted",
-          "type": "boolean",
-          "primaryKey": false,
-          "notNull": true,
-          "default": false
-        },
-        "order": {
-          "name": "order",
-          "type": "double precision",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "organization_id": {
-          "name": "organization_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "memberships_user_id_users_id_fk": {
-          "name": "memberships_user_id_users_id_fk",
-          "tableFrom": "memberships",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        },
-        "memberships_token_id_tokens_id_fk": {
-          "name": "memberships_token_id_tokens_id_fk",
-          "tableFrom": "memberships",
-          "tableTo": "tokens",
-          "columnsFrom": [
-            "token_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        },
-        "memberships_created_by_users_id_fk": {
-          "name": "memberships_created_by_users_id_fk",
-          "tableFrom": "memberships",
-          "tableTo": "users",
-          "columnsFrom": [
-            "created_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "memberships_modified_by_users_id_fk": {
-          "name": "memberships_modified_by_users_id_fk",
-          "tableFrom": "memberships",
-          "tableTo": "users",
-          "columnsFrom": [
-            "modified_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "memberships_organization_id_organizations_id_fk": {
-          "name": "memberships_organization_id_organizations_id_fk",
-          "tableFrom": "memberships",
-          "tableTo": "organizations",
-          "columnsFrom": [
-            "organization_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.oauth_accounts": {
-      "name": "oauth_accounts",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "provider_id": {
-          "name": "provider_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "provider_user_id": {
-          "name": "provider_user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "email": {
-          "name": "email",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "verified": {
-          "name": "verified",
-          "type": "boolean",
-          "primaryKey": false,
-          "notNull": true,
-          "default": false
-        },
-        "verified_at": {
-          "name": "verified_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "tenant_id": {
-          "name": "tenant_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "oauth_accounts_user_id_users_id_fk": {
-          "name": "oauth_accounts_user_id_users_id_fk",
-          "tableFrom": "oauth_accounts",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {
-        "oauth_accounts_providerId_providerUserId_email_unique": {
-          "name": "oauth_accounts_providerId_providerUserId_email_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "provider_id",
-            "provider_user_id",
-            "email"
-          ]
-        }
-      },
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.organizations": {
-      "name": "organizations",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "entity_type": {
-          "name": "entity_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'organization'"
-        },
-        "name": {
-          "name": "name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "description": {
-          "name": "description",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "slug": {
-          "name": "slug",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "thumbnail_url": {
-          "name": "thumbnail_url",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "banner_url": {
-          "name": "banner_url",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "short_name": {
-          "name": "short_name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "country": {
-          "name": "country",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "timezone": {
-          "name": "timezone",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "default_language": {
-          "name": "default_language",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'en'"
-        },
-        "languages": {
-          "name": "languages",
-          "type": "json",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'[\"en\"]'::json"
-        },
-        "restrictions": {
-          "name": "restrictions",
-          "type": "json",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'{\"user\":1000,\"attachment\":100}'::json"
-        },
-        "notification_email": {
-          "name": "notification_email",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "email_domains": {
-          "name": "email_domains",
-          "type": "json",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'[]'::json"
-        },
-        "color": {
-          "name": "color",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "logo_url": {
-          "name": "logo_url",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "website_url": {
-          "name": "website_url",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "welcome_text": {
-          "name": "welcome_text",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "auth_strategies": {
-          "name": "auth_strategies",
-          "type": "json",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'[]'::json"
-        },
-        "chat_support": {
-          "name": "chat_support",
-          "type": "boolean",
-          "primaryKey": false,
-          "notNull": true,
-          "default": false
-        },
-        "created_by": {
-          "name": "created_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "modified_at": {
-          "name": "modified_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "modified_by": {
-          "name": "modified_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        }
-      },
-      "indexes": {
-        "organizations_name_index": {
-          "name": "organizations_name_index",
-          "columns": [
-            {
-              "expression": "name",
-              "isExpression": false,
-              "asc": false,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        },
-        "organizations_created_at_index": {
-          "name": "organizations_created_at_index",
-          "columns": [
-            {
-              "expression": "created_at",
-              "isExpression": false,
-              "asc": false,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        }
-      },
-      "foreignKeys": {
-        "organizations_created_by_users_id_fk": {
-          "name": "organizations_created_by_users_id_fk",
-          "tableFrom": "organizations",
-          "tableTo": "users",
-          "columnsFrom": [
-            "created_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "organizations_modified_by_users_id_fk": {
-          "name": "organizations_modified_by_users_id_fk",
-          "tableFrom": "organizations",
-          "tableTo": "users",
-          "columnsFrom": [
-            "modified_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {
-        "organizations_slug_unique": {
-          "name": "organizations_slug_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "slug"
-          ]
-        }
-      },
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.passkeys": {
-      "name": "passkeys",
-      "schema": "",
-      "columns": {
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "credential_id": {
-          "name": "credential_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "public_key": {
-          "name": "public_key",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "device_name": {
-          "name": "device_name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "device_type": {
-          "name": "device_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'desktop'"
-        },
-        "device_os": {
-          "name": "device_os",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "browser": {
-          "name": "browser",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "name_on_device": {
-          "name": "name_on_device",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "passkeys_user_id_users_id_fk": {
-          "name": "passkeys_user_id_users_id_fk",
-          "tableFrom": "passkeys",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.passwords": {
-      "name": "passwords",
-      "schema": "",
-      "columns": {
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "hashed_password": {
-          "name": "hashed_password",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "modified_at": {
-          "name": "modified_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "passwords_user_id_users_id_fk": {
-          "name": "passwords_user_id_users_id_fk",
-          "tableFrom": "passwords",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {
-        "passwords_userId_unique": {
-          "name": "passwords_userId_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "user_id"
-          ]
-        }
-      },
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.requests": {
-      "name": "requests",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "message": {
-          "name": "message",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "email": {
-          "name": "email",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "type": {
-          "name": "type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "token_id": {
-          "name": "token_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        }
-      },
-      "indexes": {
-        "requests_emails": {
-          "name": "requests_emails",
-          "columns": [
-            {
-              "expression": "email",
-              "isExpression": false,
-              "asc": false,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        },
-        "requests_created_at": {
-          "name": "requests_created_at",
-          "columns": [
-            {
-              "expression": "created_at",
-              "isExpression": false,
-              "asc": false,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        }
-      },
-      "foreignKeys": {
-        "requests_token_id_tokens_id_fk": {
-          "name": "requests_token_id_tokens_id_fk",
-          "tableFrom": "requests",
-          "tableTo": "tokens",
-          "columnsFrom": [
-            "token_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.sessions": {
-      "name": "sessions",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "token": {
-          "name": "token",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "type": {
-          "name": "type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'regular'"
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "device_name": {
-          "name": "device_name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "device_type": {
-          "name": "device_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'desktop'"
-        },
-        "device_os": {
-          "name": "device_os",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "browser": {
-          "name": "browser",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "auth_strategy": {
-          "name": "auth_strategy",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "expires_at": {
-          "name": "expires_at",
-          "type": "timestamp with time zone",
-          "primaryKey": false,
-          "notNull": true
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "sessions_user_id_users_id_fk": {
-          "name": "sessions_user_id_users_id_fk",
-          "tableFrom": "sessions",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.tokens": {
-      "name": "tokens",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "token": {
-          "name": "token",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "type": {
-          "name": "type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "email": {
-          "name": "email",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "entity_type": {
-          "name": "entity_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "role": {
-          "name": "role",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "oauth_account_id": {
-          "name": "oauth_account_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "created_by": {
-          "name": "created_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "expires_at": {
-          "name": "expires_at",
-          "type": "timestamp with time zone",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "consumed_at": {
-          "name": "consumed_at",
-          "type": "timestamp with time zone",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "organization_id": {
-          "name": "organization_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "tokens_user_id_users_id_fk": {
-          "name": "tokens_user_id_users_id_fk",
-          "tableFrom": "tokens",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        },
-        "tokens_oauth_account_id_oauth_accounts_id_fk": {
-          "name": "tokens_oauth_account_id_oauth_accounts_id_fk",
-          "tableFrom": "tokens",
-          "tableTo": "oauth_accounts",
-          "columnsFrom": [
-            "oauth_account_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "tokens_created_by_users_id_fk": {
-          "name": "tokens_created_by_users_id_fk",
-          "tableFrom": "tokens",
-          "tableTo": "users",
-          "columnsFrom": [
-            "created_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "tokens_organization_id_organizations_id_fk": {
-          "name": "tokens_organization_id_organizations_id_fk",
-          "tableFrom": "tokens",
-          "tableTo": "organizations",
-          "columnsFrom": [
-            "organization_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.totps": {
-      "name": "totps",
-      "schema": "",
-      "columns": {
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "encoder_secret_key": {
-          "name": "encoder_secret_key",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "totps_user_id_users_id_fk": {
-          "name": "totps_user_id_users_id_fk",
-          "tableFrom": "totps",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.unsubscribe_tokens": {
-      "name": "unsubscribe_tokens",
-      "schema": "",
-      "columns": {
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "token": {
-          "name": "token",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        }
-      },
-      "indexes": {
-        "users_token_index": {
-          "name": "users_token_index",
-          "columns": [
-            {
-              "expression": "token",
-              "isExpression": false,
-              "asc": true,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        }
-      },
-      "foreignKeys": {
-        "unsubscribe_tokens_user_id_users_id_fk": {
-          "name": "unsubscribe_tokens_user_id_users_id_fk",
-          "tableFrom": "unsubscribe_tokens",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {
-        "unsubscribe_tokens_userId_unique": {
-          "name": "unsubscribe_tokens_userId_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "user_id"
-          ]
-        },
-        "unsubscribe_tokens_token_unique": {
-          "name": "unsubscribe_tokens_token_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "token"
-          ]
-        }
-      },
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.users": {
-      "name": "users",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "entity_type": {
-          "name": "entity_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'user'"
-        },
-        "name": {
-          "name": "name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "description": {
-          "name": "description",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "slug": {
-          "name": "slug",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "thumbnail_url": {
-          "name": "thumbnail_url",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "banner_url": {
-          "name": "banner_url",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "email": {
-          "name": "email",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "mfa_required": {
-          "name": "mfa_required",
-          "type": "boolean",
-          "primaryKey": false,
-          "notNull": true,
-          "default": false
-        },
-        "first_name": {
-          "name": "first_name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "last_name": {
-          "name": "last_name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "language": {
-          "name": "language",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'en'"
-        },
-        "newsletter": {
-          "name": "newsletter",
-          "type": "boolean",
-          "primaryKey": false,
-          "notNull": true,
-          "default": false
-        },
-        "role": {
-          "name": "role",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'user'"
-        },
-        "user_flags": {
-          "name": "user_flags",
-          "type": "jsonb",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'{}'::jsonb"
-        },
-        "modified_at": {
-          "name": "modified_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "last_seen_at": {
-          "name": "last_seen_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "last_started_at": {
-          "name": "last_started_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "last_sign_in_at": {
-          "name": "last_sign_in_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "modified_by": {
-          "name": "modified_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        }
-      },
-      "indexes": {
-        "users_name_index": {
-          "name": "users_name_index",
-          "columns": [
-            {
-              "expression": "name",
-              "isExpression": false,
-              "asc": false,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        },
-        "users_email_index": {
-          "name": "users_email_index",
-          "columns": [
-            {
-              "expression": "email",
-              "isExpression": false,
-              "asc": false,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        },
-        "users_created_at_index": {
-          "name": "users_created_at_index",
-          "columns": [
-            {
-              "expression": "created_at",
-              "isExpression": false,
-              "asc": false,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        }
-      },
-      "foreignKeys": {
-        "users_modified_by_users_id_fk": {
-          "name": "users_modified_by_users_id_fk",
-          "tableFrom": "users",
-          "tableTo": "users",
-          "columnsFrom": [
-            "modified_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "no action",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {
-        "users_slug_unique": {
-          "name": "users_slug_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "slug"
-          ]
-        },
-        "users_email_unique": {
-          "name": "users_email_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "email"
-          ]
-        }
-      },
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    }
-  },
-  "enums": {},
-  "schemas": {},
-  "sequences": {},
-  "roles": {},
-  "policies": {},
-  "views": {},
-  "_meta": {
-    "columns": {},
-    "schemas": {},
-    "tables": {}
-  }
-}
\ No newline at end of file
diff --git a/backend/drizzle/meta/0003_snapshot.json b/backend/drizzle/meta/0003_snapshot.json
deleted file mode 100644
index 045478c65..000000000
--- a/backend/drizzle/meta/0003_snapshot.json
+++ /dev/null
@@ -1,1623 +0,0 @@
-{
-  "id": "33efb0b2-266f-4d73-b64c-b01c6d5ab71b",
-  "prevId": "8d539283-e38e-4a7f-bea3-4841aa6d3584",
-  "version": "7",
-  "dialect": "postgresql",
-  "tables": {
-    "public.attachments": {
-      "name": "attachments",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "name": {
-          "name": "name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'attachment'"
-        },
-        "entity_type": {
-          "name": "entity_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'attachment'"
-        },
-        "group_id": {
-          "name": "group_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "filename": {
-          "name": "filename",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "content_type": {
-          "name": "content_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "converted_content_type": {
-          "name": "converted_content_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "size": {
-          "name": "size",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "original_key": {
-          "name": "original_key",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "converted_key": {
-          "name": "converted_key",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "thumbnail_key": {
-          "name": "thumbnail_key",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "created_by": {
-          "name": "created_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "modified_at": {
-          "name": "modified_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "modified_by": {
-          "name": "modified_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "organization_id": {
-          "name": "organization_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        }
-      },
-      "indexes": {
-        "attachments_organization_id_index": {
-          "name": "attachments_organization_id_index",
-          "columns": [
-            {
-              "expression": "organization_id",
-              "isExpression": false,
-              "asc": true,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        }
-      },
-      "foreignKeys": {
-        "attachments_created_by_users_id_fk": {
-          "name": "attachments_created_by_users_id_fk",
-          "tableFrom": "attachments",
-          "tableTo": "users",
-          "columnsFrom": [
-            "created_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "attachments_modified_by_users_id_fk": {
-          "name": "attachments_modified_by_users_id_fk",
-          "tableFrom": "attachments",
-          "tableTo": "users",
-          "columnsFrom": [
-            "modified_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "attachments_organization_id_organizations_id_fk": {
-          "name": "attachments_organization_id_organizations_id_fk",
-          "tableFrom": "attachments",
-          "tableTo": "organizations",
-          "columnsFrom": [
-            "organization_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.emails": {
-      "name": "emails",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "email": {
-          "name": "email",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "verified": {
-          "name": "verified",
-          "type": "boolean",
-          "primaryKey": false,
-          "notNull": true,
-          "default": false
-        },
-        "token_id": {
-          "name": "token_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "verified_at": {
-          "name": "verified_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "emails_token_id_tokens_id_fk": {
-          "name": "emails_token_id_tokens_id_fk",
-          "tableFrom": "emails",
-          "tableTo": "tokens",
-          "columnsFrom": [
-            "token_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "emails_user_id_users_id_fk": {
-          "name": "emails_user_id_users_id_fk",
-          "tableFrom": "emails",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {
-        "emails_email_unique": {
-          "name": "emails_email_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "email"
-          ]
-        }
-      },
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.memberships": {
-      "name": "memberships",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "context_type": {
-          "name": "context_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "role": {
-          "name": "role",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'member'"
-        },
-        "token_id": {
-          "name": "token_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "activated_at": {
-          "name": "activated_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "created_by": {
-          "name": "created_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "modified_at": {
-          "name": "modified_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "modified_by": {
-          "name": "modified_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "archived": {
-          "name": "archived",
-          "type": "boolean",
-          "primaryKey": false,
-          "notNull": true,
-          "default": false
-        },
-        "muted": {
-          "name": "muted",
-          "type": "boolean",
-          "primaryKey": false,
-          "notNull": true,
-          "default": false
-        },
-        "order": {
-          "name": "order",
-          "type": "double precision",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "organization_id": {
-          "name": "organization_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "memberships_user_id_users_id_fk": {
-          "name": "memberships_user_id_users_id_fk",
-          "tableFrom": "memberships",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        },
-        "memberships_token_id_tokens_id_fk": {
-          "name": "memberships_token_id_tokens_id_fk",
-          "tableFrom": "memberships",
-          "tableTo": "tokens",
-          "columnsFrom": [
-            "token_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        },
-        "memberships_created_by_users_id_fk": {
-          "name": "memberships_created_by_users_id_fk",
-          "tableFrom": "memberships",
-          "tableTo": "users",
-          "columnsFrom": [
-            "created_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "memberships_modified_by_users_id_fk": {
-          "name": "memberships_modified_by_users_id_fk",
-          "tableFrom": "memberships",
-          "tableTo": "users",
-          "columnsFrom": [
-            "modified_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "memberships_organization_id_organizations_id_fk": {
-          "name": "memberships_organization_id_organizations_id_fk",
-          "tableFrom": "memberships",
-          "tableTo": "organizations",
-          "columnsFrom": [
-            "organization_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.oauth_accounts": {
-      "name": "oauth_accounts",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "provider_id": {
-          "name": "provider_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "provider_user_id": {
-          "name": "provider_user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "email": {
-          "name": "email",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "verified": {
-          "name": "verified",
-          "type": "boolean",
-          "primaryKey": false,
-          "notNull": true,
-          "default": false
-        },
-        "verified_at": {
-          "name": "verified_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "tenant_id": {
-          "name": "tenant_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "oauth_accounts_user_id_users_id_fk": {
-          "name": "oauth_accounts_user_id_users_id_fk",
-          "tableFrom": "oauth_accounts",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {
-        "oauth_accounts_providerId_providerUserId_email_unique": {
-          "name": "oauth_accounts_providerId_providerUserId_email_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "provider_id",
-            "provider_user_id",
-            "email"
-          ]
-        }
-      },
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.organizations": {
-      "name": "organizations",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "entity_type": {
-          "name": "entity_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'organization'"
-        },
-        "name": {
-          "name": "name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "description": {
-          "name": "description",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "slug": {
-          "name": "slug",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "thumbnail_url": {
-          "name": "thumbnail_url",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "banner_url": {
-          "name": "banner_url",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "short_name": {
-          "name": "short_name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "country": {
-          "name": "country",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "timezone": {
-          "name": "timezone",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "default_language": {
-          "name": "default_language",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'en'"
-        },
-        "languages": {
-          "name": "languages",
-          "type": "json",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'[\"en\"]'::json"
-        },
-        "restrictions": {
-          "name": "restrictions",
-          "type": "json",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'{\"user\":1000,\"attachment\":100}'::json"
-        },
-        "notification_email": {
-          "name": "notification_email",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "email_domains": {
-          "name": "email_domains",
-          "type": "json",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'[]'::json"
-        },
-        "color": {
-          "name": "color",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "logo_url": {
-          "name": "logo_url",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "website_url": {
-          "name": "website_url",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "welcome_text": {
-          "name": "welcome_text",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "auth_strategies": {
-          "name": "auth_strategies",
-          "type": "json",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'[]'::json"
-        },
-        "chat_support": {
-          "name": "chat_support",
-          "type": "boolean",
-          "primaryKey": false,
-          "notNull": true,
-          "default": false
-        },
-        "created_by": {
-          "name": "created_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "modified_at": {
-          "name": "modified_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "modified_by": {
-          "name": "modified_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        }
-      },
-      "indexes": {
-        "organizations_name_index": {
-          "name": "organizations_name_index",
-          "columns": [
-            {
-              "expression": "name",
-              "isExpression": false,
-              "asc": false,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        },
-        "organizations_created_at_index": {
-          "name": "organizations_created_at_index",
-          "columns": [
-            {
-              "expression": "created_at",
-              "isExpression": false,
-              "asc": false,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        }
-      },
-      "foreignKeys": {
-        "organizations_created_by_users_id_fk": {
-          "name": "organizations_created_by_users_id_fk",
-          "tableFrom": "organizations",
-          "tableTo": "users",
-          "columnsFrom": [
-            "created_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "organizations_modified_by_users_id_fk": {
-          "name": "organizations_modified_by_users_id_fk",
-          "tableFrom": "organizations",
-          "tableTo": "users",
-          "columnsFrom": [
-            "modified_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {
-        "organizations_slug_unique": {
-          "name": "organizations_slug_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "slug"
-          ]
-        }
-      },
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.passkeys": {
-      "name": "passkeys",
-      "schema": "",
-      "columns": {
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "credential_id": {
-          "name": "credential_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "public_key": {
-          "name": "public_key",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "device_name": {
-          "name": "device_name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "device_type": {
-          "name": "device_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'desktop'"
-        },
-        "device_os": {
-          "name": "device_os",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "browser": {
-          "name": "browser",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "name_on_device": {
-          "name": "name_on_device",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "passkeys_user_id_users_id_fk": {
-          "name": "passkeys_user_id_users_id_fk",
-          "tableFrom": "passkeys",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.passwords": {
-      "name": "passwords",
-      "schema": "",
-      "columns": {
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "hashed_password": {
-          "name": "hashed_password",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "modified_at": {
-          "name": "modified_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "passwords_user_id_users_id_fk": {
-          "name": "passwords_user_id_users_id_fk",
-          "tableFrom": "passwords",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {
-        "passwords_userId_unique": {
-          "name": "passwords_userId_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "user_id"
-          ]
-        }
-      },
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.requests": {
-      "name": "requests",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "message": {
-          "name": "message",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "email": {
-          "name": "email",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "type": {
-          "name": "type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "token_id": {
-          "name": "token_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        }
-      },
-      "indexes": {
-        "requests_emails": {
-          "name": "requests_emails",
-          "columns": [
-            {
-              "expression": "email",
-              "isExpression": false,
-              "asc": false,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        },
-        "requests_created_at": {
-          "name": "requests_created_at",
-          "columns": [
-            {
-              "expression": "created_at",
-              "isExpression": false,
-              "asc": false,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        }
-      },
-      "foreignKeys": {
-        "requests_token_id_tokens_id_fk": {
-          "name": "requests_token_id_tokens_id_fk",
-          "tableFrom": "requests",
-          "tableTo": "tokens",
-          "columnsFrom": [
-            "token_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.sessions": {
-      "name": "sessions",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "token": {
-          "name": "token",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "type": {
-          "name": "type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'regular'"
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "device_name": {
-          "name": "device_name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "device_type": {
-          "name": "device_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'desktop'"
-        },
-        "device_os": {
-          "name": "device_os",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "browser": {
-          "name": "browser",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "auth_strategy": {
-          "name": "auth_strategy",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "expires_at": {
-          "name": "expires_at",
-          "type": "timestamp with time zone",
-          "primaryKey": false,
-          "notNull": true
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "sessions_user_id_users_id_fk": {
-          "name": "sessions_user_id_users_id_fk",
-          "tableFrom": "sessions",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.tokens": {
-      "name": "tokens",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "token": {
-          "name": "token",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "type": {
-          "name": "type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "email": {
-          "name": "email",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "entity_type": {
-          "name": "entity_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "role": {
-          "name": "role",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "oauth_account_id": {
-          "name": "oauth_account_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "created_by": {
-          "name": "created_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "expires_at": {
-          "name": "expires_at",
-          "type": "timestamp with time zone",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "consumed_at": {
-          "name": "consumed_at",
-          "type": "timestamp with time zone",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "organization_id": {
-          "name": "organization_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "tokens_user_id_users_id_fk": {
-          "name": "tokens_user_id_users_id_fk",
-          "tableFrom": "tokens",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        },
-        "tokens_oauth_account_id_oauth_accounts_id_fk": {
-          "name": "tokens_oauth_account_id_oauth_accounts_id_fk",
-          "tableFrom": "tokens",
-          "tableTo": "oauth_accounts",
-          "columnsFrom": [
-            "oauth_account_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "tokens_created_by_users_id_fk": {
-          "name": "tokens_created_by_users_id_fk",
-          "tableFrom": "tokens",
-          "tableTo": "users",
-          "columnsFrom": [
-            "created_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "tokens_organization_id_organizations_id_fk": {
-          "name": "tokens_organization_id_organizations_id_fk",
-          "tableFrom": "tokens",
-          "tableTo": "organizations",
-          "columnsFrom": [
-            "organization_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.totps": {
-      "name": "totps",
-      "schema": "",
-      "columns": {
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "secret": {
-          "name": "secret",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "totps_user_id_users_id_fk": {
-          "name": "totps_user_id_users_id_fk",
-          "tableFrom": "totps",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.unsubscribe_tokens": {
-      "name": "unsubscribe_tokens",
-      "schema": "",
-      "columns": {
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "token": {
-          "name": "token",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        }
-      },
-      "indexes": {
-        "users_token_index": {
-          "name": "users_token_index",
-          "columns": [
-            {
-              "expression": "token",
-              "isExpression": false,
-              "asc": true,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        }
-      },
-      "foreignKeys": {
-        "unsubscribe_tokens_user_id_users_id_fk": {
-          "name": "unsubscribe_tokens_user_id_users_id_fk",
-          "tableFrom": "unsubscribe_tokens",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {
-        "unsubscribe_tokens_userId_unique": {
-          "name": "unsubscribe_tokens_userId_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "user_id"
-          ]
-        },
-        "unsubscribe_tokens_token_unique": {
-          "name": "unsubscribe_tokens_token_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "token"
-          ]
-        }
-      },
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.users": {
-      "name": "users",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "entity_type": {
-          "name": "entity_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'user'"
-        },
-        "name": {
-          "name": "name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "description": {
-          "name": "description",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "slug": {
-          "name": "slug",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "thumbnail_url": {
-          "name": "thumbnail_url",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "banner_url": {
-          "name": "banner_url",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "email": {
-          "name": "email",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "mfa_required": {
-          "name": "mfa_required",
-          "type": "boolean",
-          "primaryKey": false,
-          "notNull": true,
-          "default": false
-        },
-        "first_name": {
-          "name": "first_name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "last_name": {
-          "name": "last_name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "language": {
-          "name": "language",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'en'"
-        },
-        "newsletter": {
-          "name": "newsletter",
-          "type": "boolean",
-          "primaryKey": false,
-          "notNull": true,
-          "default": false
-        },
-        "role": {
-          "name": "role",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'user'"
-        },
-        "user_flags": {
-          "name": "user_flags",
-          "type": "jsonb",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'{}'::jsonb"
-        },
-        "modified_at": {
-          "name": "modified_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "last_seen_at": {
-          "name": "last_seen_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "last_started_at": {
-          "name": "last_started_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "last_sign_in_at": {
-          "name": "last_sign_in_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "modified_by": {
-          "name": "modified_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        }
-      },
-      "indexes": {
-        "users_name_index": {
-          "name": "users_name_index",
-          "columns": [
-            {
-              "expression": "name",
-              "isExpression": false,
-              "asc": false,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        },
-        "users_email_index": {
-          "name": "users_email_index",
-          "columns": [
-            {
-              "expression": "email",
-              "isExpression": false,
-              "asc": false,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        },
-        "users_created_at_index": {
-          "name": "users_created_at_index",
-          "columns": [
-            {
-              "expression": "created_at",
-              "isExpression": false,
-              "asc": false,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        }
-      },
-      "foreignKeys": {
-        "users_modified_by_users_id_fk": {
-          "name": "users_modified_by_users_id_fk",
-          "tableFrom": "users",
-          "tableTo": "users",
-          "columnsFrom": [
-            "modified_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "no action",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {
-        "users_slug_unique": {
-          "name": "users_slug_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "slug"
-          ]
-        },
-        "users_email_unique": {
-          "name": "users_email_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "email"
-          ]
-        }
-      },
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    }
-  },
-  "enums": {},
-  "schemas": {},
-  "sequences": {},
-  "roles": {},
-  "policies": {},
-  "views": {},
-  "_meta": {
-    "columns": {},
-    "schemas": {},
-    "tables": {}
-  }
-}
\ No newline at end of file
diff --git a/backend/drizzle/meta/0004_snapshot.json b/backend/drizzle/meta/0004_snapshot.json
deleted file mode 100644
index 62282a2df..000000000
--- a/backend/drizzle/meta/0004_snapshot.json
+++ /dev/null
@@ -1,1636 +0,0 @@
-{
-  "id": "30390beb-040f-4aa6-94d4-9bc369a9ad6f",
-  "prevId": "33efb0b2-266f-4d73-b64c-b01c6d5ab71b",
-  "version": "7",
-  "dialect": "postgresql",
-  "tables": {
-    "public.attachments": {
-      "name": "attachments",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "name": {
-          "name": "name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'attachment'"
-        },
-        "entity_type": {
-          "name": "entity_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'attachment'"
-        },
-        "public": {
-          "name": "public",
-          "type": "boolean",
-          "primaryKey": false,
-          "notNull": true,
-          "default": false
-        },
-        "bucket_name": {
-          "name": "bucket_name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "group_id": {
-          "name": "group_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "filename": {
-          "name": "filename",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "content_type": {
-          "name": "content_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "converted_content_type": {
-          "name": "converted_content_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "size": {
-          "name": "size",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "original_key": {
-          "name": "original_key",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "converted_key": {
-          "name": "converted_key",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "thumbnail_key": {
-          "name": "thumbnail_key",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "created_by": {
-          "name": "created_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "modified_at": {
-          "name": "modified_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "modified_by": {
-          "name": "modified_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "organization_id": {
-          "name": "organization_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        }
-      },
-      "indexes": {
-        "attachments_organization_id_index": {
-          "name": "attachments_organization_id_index",
-          "columns": [
-            {
-              "expression": "organization_id",
-              "isExpression": false,
-              "asc": true,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        }
-      },
-      "foreignKeys": {
-        "attachments_created_by_users_id_fk": {
-          "name": "attachments_created_by_users_id_fk",
-          "tableFrom": "attachments",
-          "tableTo": "users",
-          "columnsFrom": [
-            "created_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "attachments_modified_by_users_id_fk": {
-          "name": "attachments_modified_by_users_id_fk",
-          "tableFrom": "attachments",
-          "tableTo": "users",
-          "columnsFrom": [
-            "modified_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "attachments_organization_id_organizations_id_fk": {
-          "name": "attachments_organization_id_organizations_id_fk",
-          "tableFrom": "attachments",
-          "tableTo": "organizations",
-          "columnsFrom": [
-            "organization_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.emails": {
-      "name": "emails",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "email": {
-          "name": "email",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "verified": {
-          "name": "verified",
-          "type": "boolean",
-          "primaryKey": false,
-          "notNull": true,
-          "default": false
-        },
-        "token_id": {
-          "name": "token_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "verified_at": {
-          "name": "verified_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "emails_token_id_tokens_id_fk": {
-          "name": "emails_token_id_tokens_id_fk",
-          "tableFrom": "emails",
-          "tableTo": "tokens",
-          "columnsFrom": [
-            "token_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "emails_user_id_users_id_fk": {
-          "name": "emails_user_id_users_id_fk",
-          "tableFrom": "emails",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {
-        "emails_email_unique": {
-          "name": "emails_email_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "email"
-          ]
-        }
-      },
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.memberships": {
-      "name": "memberships",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "context_type": {
-          "name": "context_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "role": {
-          "name": "role",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'member'"
-        },
-        "token_id": {
-          "name": "token_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "activated_at": {
-          "name": "activated_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "created_by": {
-          "name": "created_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "modified_at": {
-          "name": "modified_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "modified_by": {
-          "name": "modified_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "archived": {
-          "name": "archived",
-          "type": "boolean",
-          "primaryKey": false,
-          "notNull": true,
-          "default": false
-        },
-        "muted": {
-          "name": "muted",
-          "type": "boolean",
-          "primaryKey": false,
-          "notNull": true,
-          "default": false
-        },
-        "order": {
-          "name": "order",
-          "type": "double precision",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "organization_id": {
-          "name": "organization_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "memberships_user_id_users_id_fk": {
-          "name": "memberships_user_id_users_id_fk",
-          "tableFrom": "memberships",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        },
-        "memberships_token_id_tokens_id_fk": {
-          "name": "memberships_token_id_tokens_id_fk",
-          "tableFrom": "memberships",
-          "tableTo": "tokens",
-          "columnsFrom": [
-            "token_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        },
-        "memberships_created_by_users_id_fk": {
-          "name": "memberships_created_by_users_id_fk",
-          "tableFrom": "memberships",
-          "tableTo": "users",
-          "columnsFrom": [
-            "created_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "memberships_modified_by_users_id_fk": {
-          "name": "memberships_modified_by_users_id_fk",
-          "tableFrom": "memberships",
-          "tableTo": "users",
-          "columnsFrom": [
-            "modified_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "memberships_organization_id_organizations_id_fk": {
-          "name": "memberships_organization_id_organizations_id_fk",
-          "tableFrom": "memberships",
-          "tableTo": "organizations",
-          "columnsFrom": [
-            "organization_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.oauth_accounts": {
-      "name": "oauth_accounts",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "provider_id": {
-          "name": "provider_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "provider_user_id": {
-          "name": "provider_user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "email": {
-          "name": "email",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "verified": {
-          "name": "verified",
-          "type": "boolean",
-          "primaryKey": false,
-          "notNull": true,
-          "default": false
-        },
-        "verified_at": {
-          "name": "verified_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "tenant_id": {
-          "name": "tenant_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "oauth_accounts_user_id_users_id_fk": {
-          "name": "oauth_accounts_user_id_users_id_fk",
-          "tableFrom": "oauth_accounts",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {
-        "oauth_accounts_providerId_providerUserId_email_unique": {
-          "name": "oauth_accounts_providerId_providerUserId_email_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "provider_id",
-            "provider_user_id",
-            "email"
-          ]
-        }
-      },
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.organizations": {
-      "name": "organizations",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "entity_type": {
-          "name": "entity_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'organization'"
-        },
-        "name": {
-          "name": "name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "description": {
-          "name": "description",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "slug": {
-          "name": "slug",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "thumbnail_url": {
-          "name": "thumbnail_url",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "banner_url": {
-          "name": "banner_url",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "short_name": {
-          "name": "short_name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "country": {
-          "name": "country",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "timezone": {
-          "name": "timezone",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "default_language": {
-          "name": "default_language",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'en'"
-        },
-        "languages": {
-          "name": "languages",
-          "type": "json",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'[\"en\"]'::json"
-        },
-        "restrictions": {
-          "name": "restrictions",
-          "type": "json",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'{\"user\":1000,\"attachment\":100}'::json"
-        },
-        "notification_email": {
-          "name": "notification_email",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "email_domains": {
-          "name": "email_domains",
-          "type": "json",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'[]'::json"
-        },
-        "color": {
-          "name": "color",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "logo_url": {
-          "name": "logo_url",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "website_url": {
-          "name": "website_url",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "welcome_text": {
-          "name": "welcome_text",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "auth_strategies": {
-          "name": "auth_strategies",
-          "type": "json",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'[]'::json"
-        },
-        "chat_support": {
-          "name": "chat_support",
-          "type": "boolean",
-          "primaryKey": false,
-          "notNull": true,
-          "default": false
-        },
-        "created_by": {
-          "name": "created_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "modified_at": {
-          "name": "modified_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "modified_by": {
-          "name": "modified_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        }
-      },
-      "indexes": {
-        "organizations_name_index": {
-          "name": "organizations_name_index",
-          "columns": [
-            {
-              "expression": "name",
-              "isExpression": false,
-              "asc": false,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        },
-        "organizations_created_at_index": {
-          "name": "organizations_created_at_index",
-          "columns": [
-            {
-              "expression": "created_at",
-              "isExpression": false,
-              "asc": false,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        }
-      },
-      "foreignKeys": {
-        "organizations_created_by_users_id_fk": {
-          "name": "organizations_created_by_users_id_fk",
-          "tableFrom": "organizations",
-          "tableTo": "users",
-          "columnsFrom": [
-            "created_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "organizations_modified_by_users_id_fk": {
-          "name": "organizations_modified_by_users_id_fk",
-          "tableFrom": "organizations",
-          "tableTo": "users",
-          "columnsFrom": [
-            "modified_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {
-        "organizations_slug_unique": {
-          "name": "organizations_slug_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "slug"
-          ]
-        }
-      },
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.passkeys": {
-      "name": "passkeys",
-      "schema": "",
-      "columns": {
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "credential_id": {
-          "name": "credential_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "public_key": {
-          "name": "public_key",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "device_name": {
-          "name": "device_name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "device_type": {
-          "name": "device_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'desktop'"
-        },
-        "device_os": {
-          "name": "device_os",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "browser": {
-          "name": "browser",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "name_on_device": {
-          "name": "name_on_device",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "passkeys_user_id_users_id_fk": {
-          "name": "passkeys_user_id_users_id_fk",
-          "tableFrom": "passkeys",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.passwords": {
-      "name": "passwords",
-      "schema": "",
-      "columns": {
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "hashed_password": {
-          "name": "hashed_password",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "modified_at": {
-          "name": "modified_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "passwords_user_id_users_id_fk": {
-          "name": "passwords_user_id_users_id_fk",
-          "tableFrom": "passwords",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {
-        "passwords_userId_unique": {
-          "name": "passwords_userId_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "user_id"
-          ]
-        }
-      },
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.requests": {
-      "name": "requests",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "message": {
-          "name": "message",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "email": {
-          "name": "email",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "type": {
-          "name": "type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "token_id": {
-          "name": "token_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        }
-      },
-      "indexes": {
-        "requests_emails": {
-          "name": "requests_emails",
-          "columns": [
-            {
-              "expression": "email",
-              "isExpression": false,
-              "asc": false,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        },
-        "requests_created_at": {
-          "name": "requests_created_at",
-          "columns": [
-            {
-              "expression": "created_at",
-              "isExpression": false,
-              "asc": false,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        }
-      },
-      "foreignKeys": {
-        "requests_token_id_tokens_id_fk": {
-          "name": "requests_token_id_tokens_id_fk",
-          "tableFrom": "requests",
-          "tableTo": "tokens",
-          "columnsFrom": [
-            "token_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.sessions": {
-      "name": "sessions",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "token": {
-          "name": "token",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "type": {
-          "name": "type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'regular'"
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "device_name": {
-          "name": "device_name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "device_type": {
-          "name": "device_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'desktop'"
-        },
-        "device_os": {
-          "name": "device_os",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "browser": {
-          "name": "browser",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "auth_strategy": {
-          "name": "auth_strategy",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "expires_at": {
-          "name": "expires_at",
-          "type": "timestamp with time zone",
-          "primaryKey": false,
-          "notNull": true
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "sessions_user_id_users_id_fk": {
-          "name": "sessions_user_id_users_id_fk",
-          "tableFrom": "sessions",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.tokens": {
-      "name": "tokens",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "token": {
-          "name": "token",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "type": {
-          "name": "type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "email": {
-          "name": "email",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "entity_type": {
-          "name": "entity_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "role": {
-          "name": "role",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "oauth_account_id": {
-          "name": "oauth_account_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "created_by": {
-          "name": "created_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "expires_at": {
-          "name": "expires_at",
-          "type": "timestamp with time zone",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "consumed_at": {
-          "name": "consumed_at",
-          "type": "timestamp with time zone",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "organization_id": {
-          "name": "organization_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "tokens_user_id_users_id_fk": {
-          "name": "tokens_user_id_users_id_fk",
-          "tableFrom": "tokens",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        },
-        "tokens_oauth_account_id_oauth_accounts_id_fk": {
-          "name": "tokens_oauth_account_id_oauth_accounts_id_fk",
-          "tableFrom": "tokens",
-          "tableTo": "oauth_accounts",
-          "columnsFrom": [
-            "oauth_account_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "tokens_created_by_users_id_fk": {
-          "name": "tokens_created_by_users_id_fk",
-          "tableFrom": "tokens",
-          "tableTo": "users",
-          "columnsFrom": [
-            "created_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "set null",
-          "onUpdate": "no action"
-        },
-        "tokens_organization_id_organizations_id_fk": {
-          "name": "tokens_organization_id_organizations_id_fk",
-          "tableFrom": "tokens",
-          "tableTo": "organizations",
-          "columnsFrom": [
-            "organization_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.totps": {
-      "name": "totps",
-      "schema": "",
-      "columns": {
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "secret": {
-          "name": "secret",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        }
-      },
-      "indexes": {},
-      "foreignKeys": {
-        "totps_user_id_users_id_fk": {
-          "name": "totps_user_id_users_id_fk",
-          "tableFrom": "totps",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {},
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.unsubscribe_tokens": {
-      "name": "unsubscribe_tokens",
-      "schema": "",
-      "columns": {
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "user_id": {
-          "name": "user_id",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "token": {
-          "name": "token",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        }
-      },
-      "indexes": {
-        "users_token_index": {
-          "name": "users_token_index",
-          "columns": [
-            {
-              "expression": "token",
-              "isExpression": false,
-              "asc": true,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        }
-      },
-      "foreignKeys": {
-        "unsubscribe_tokens_user_id_users_id_fk": {
-          "name": "unsubscribe_tokens_user_id_users_id_fk",
-          "tableFrom": "unsubscribe_tokens",
-          "tableTo": "users",
-          "columnsFrom": [
-            "user_id"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "cascade",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {
-        "unsubscribe_tokens_userId_unique": {
-          "name": "unsubscribe_tokens_userId_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "user_id"
-          ]
-        },
-        "unsubscribe_tokens_token_unique": {
-          "name": "unsubscribe_tokens_token_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "token"
-          ]
-        }
-      },
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    },
-    "public.users": {
-      "name": "users",
-      "schema": "",
-      "columns": {
-        "created_at": {
-          "name": "created_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "now()"
-        },
-        "id": {
-          "name": "id",
-          "type": "varchar",
-          "primaryKey": true,
-          "notNull": true
-        },
-        "entity_type": {
-          "name": "entity_type",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'user'"
-        },
-        "name": {
-          "name": "name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "description": {
-          "name": "description",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "slug": {
-          "name": "slug",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "thumbnail_url": {
-          "name": "thumbnail_url",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "banner_url": {
-          "name": "banner_url",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "email": {
-          "name": "email",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true
-        },
-        "mfa_required": {
-          "name": "mfa_required",
-          "type": "boolean",
-          "primaryKey": false,
-          "notNull": true,
-          "default": false
-        },
-        "first_name": {
-          "name": "first_name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "last_name": {
-          "name": "last_name",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "language": {
-          "name": "language",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'en'"
-        },
-        "newsletter": {
-          "name": "newsletter",
-          "type": "boolean",
-          "primaryKey": false,
-          "notNull": true,
-          "default": false
-        },
-        "role": {
-          "name": "role",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'user'"
-        },
-        "user_flags": {
-          "name": "user_flags",
-          "type": "jsonb",
-          "primaryKey": false,
-          "notNull": true,
-          "default": "'{}'::jsonb"
-        },
-        "modified_at": {
-          "name": "modified_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "last_seen_at": {
-          "name": "last_seen_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "last_started_at": {
-          "name": "last_started_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "last_sign_in_at": {
-          "name": "last_sign_in_at",
-          "type": "timestamp",
-          "primaryKey": false,
-          "notNull": false
-        },
-        "modified_by": {
-          "name": "modified_by",
-          "type": "varchar",
-          "primaryKey": false,
-          "notNull": false
-        }
-      },
-      "indexes": {
-        "users_name_index": {
-          "name": "users_name_index",
-          "columns": [
-            {
-              "expression": "name",
-              "isExpression": false,
-              "asc": false,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        },
-        "users_email_index": {
-          "name": "users_email_index",
-          "columns": [
-            {
-              "expression": "email",
-              "isExpression": false,
-              "asc": false,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        },
-        "users_created_at_index": {
-          "name": "users_created_at_index",
-          "columns": [
-            {
-              "expression": "created_at",
-              "isExpression": false,
-              "asc": false,
-              "nulls": "last"
-            }
-          ],
-          "isUnique": false,
-          "concurrently": false,
-          "method": "btree",
-          "with": {}
-        }
-      },
-      "foreignKeys": {
-        "users_modified_by_users_id_fk": {
-          "name": "users_modified_by_users_id_fk",
-          "tableFrom": "users",
-          "tableTo": "users",
-          "columnsFrom": [
-            "modified_by"
-          ],
-          "columnsTo": [
-            "id"
-          ],
-          "onDelete": "no action",
-          "onUpdate": "no action"
-        }
-      },
-      "compositePrimaryKeys": {},
-      "uniqueConstraints": {
-        "users_slug_unique": {
-          "name": "users_slug_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "slug"
-          ]
-        },
-        "users_email_unique": {
-          "name": "users_email_unique",
-          "nullsNotDistinct": false,
-          "columns": [
-            "email"
-          ]
-        }
-      },
-      "policies": {},
-      "checkConstraints": {},
-      "isRLSEnabled": false
-    }
-  },
-  "enums": {},
-  "schemas": {},
-  "sequences": {},
-  "roles": {},
-  "policies": {},
-  "views": {},
-  "_meta": {
-    "columns": {},
-    "schemas": {},
-    "tables": {}
-  }
-}
\ No newline at end of file
diff --git a/backend/drizzle/meta/_journal.json b/backend/drizzle/meta/_journal.json
index 891e07c6b..dc9770bc7 100644
--- a/backend/drizzle/meta/_journal.json
+++ b/backend/drizzle/meta/_journal.json
@@ -5,36 +5,8 @@
     {
       "idx": 0,
       "version": "7",
-      "when": 1754054715288,
-      "tag": "0000_sad_paladin",
-      "breakpoints": true
-    },
-    {
-      "idx": 1,
-      "version": "7",
-      "when": 1755512487230,
-      "tag": "0001_illegal_odin",
-      "breakpoints": true
-    },
-    {
-      "idx": 2,
-      "version": "7",
-      "when": 1757659972233,
-      "tag": "0002_nosy_white_tiger",
-      "breakpoints": true
-    },
-    {
-      "idx": 3,
-      "version": "7",
-      "when": 1757668232647,
-      "tag": "0003_salty_raider",
-      "breakpoints": true
-    },
-    {
-      "idx": 4,
-      "version": "7",
-      "when": 1757935286009,
-      "tag": "0004_flaky_charles_xavier",
+      "when": 1758835199217,
+      "tag": "0000_modern_black_queen",
       "breakpoints": true
     }
   ]
diff --git a/backend/emails/create-password.tsx b/backend/emails/create-password.tsx
index 036e3e6f4..cf0f53d55 100644
--- a/backend/emails/create-password.tsx
+++ b/backend/emails/create-password.tsx
@@ -25,11 +25,7 @@ export const CreatePasswordEmail = ({ name, lng, createPasswordLink }: CreatePas
       <EmailBody>
         <Text>
           <p style={{ marginBottom: '4px' }}>{name && i18n.t('backend:email.hi', { lng, name })}</p>
-          <div
-            // biome-ignore lint/security/noDangerouslySetInnerHtml: trusted HTML content from a secure source
-            dangerouslySetInnerHTML={{
-              __html: i18n.t('backend:email.create_password.text', { appName, lng }),
-            }}
+          <div dangerouslySetInnerHTML={{ __html: i18n.t('backend:email.create_password.text', { appName, lng }) }}
           />
         </Text>
         <EmailButton ButtonText={i18n.t('common:reset_resource', { resource: i18n.t('common:password').toLowerCase(), lng })} href={createPasswordLink} />
diff --git a/backend/emails/email-verification.tsx b/backend/emails/email-verification.tsx
index 77a31f41f..dcfd65b6a 100644
--- a/backend/emails/email-verification.tsx
+++ b/backend/emails/email-verification.tsx
@@ -20,15 +20,10 @@ export interface EmailVerificationEmailProps extends BasicTemplateType {
 export const EmailVerificationEmail = ({ lng, verificationLink, email, name }: EmailVerificationEmailProps) => {
   return (
     <EmailContainer previewText={i18n.t('backend:email.email_verification.preview', { appName, lng })}>
-      <EmailHeader headerText={i18n.t('backend:email.email_verification.preview', { appName, lng })} />
+      <EmailHeader headerText={i18n.t('backend:email.email_verification.title', { appName, lng })} />
       <EmailBody>
         <Text>
-          <span
-            // biome-ignore lint/security/noDangerouslySetInnerHtml: trusted HTML content from a secure source
-            dangerouslySetInnerHTML={{
-              __html: i18n.t('backend:email.email_verification.text', { lng, appName, email, name }),
-            }}
-          />
+          <span dangerouslySetInnerHTML={{ __html: i18n.t('backend:email.email_verification.text', { lng, appName, email, name }) }}/>
         </Text>
 
         <EmailButton ButtonText={i18n.t('common:verify_my_email', { lng })} href={verificationLink} />
diff --git a/backend/emails/member-invite.tsx b/backend/emails/member-invite.tsx
index c8e946b27..f4b1475ca 100644
--- a/backend/emails/member-invite.tsx
+++ b/backend/emails/member-invite.tsx
@@ -15,7 +15,7 @@ export interface MemberInviteEmailProps extends BasicTemplateType {
   memberInviteLink: string;
   senderName: string;
   entityName: string;
-  role: (typeof appConfig.rolesByType.entityRoles)[number];
+  role: (typeof appConfig.roles.entityRoles)[number];
 }
 
 const appName = appConfig.name;
@@ -33,26 +33,15 @@ export const MemberInviteEmail = ({ name, lng, senderName, role, entityName, mem
 
       <EmailHeader
         headerText={
-          <div
-            // biome-ignore lint/security/noDangerouslySetInnerHtml: trusted HTML content from a secure source
-            dangerouslySetInnerHTML={{
-              __html: i18n.t('backend:email.member_invite.title', { lng, entityName }),
-            }}
-          />
+          <div dangerouslySetInnerHTML={{ __html: i18n.t('backend:email.member_invite.title', { lng, entityName }) }} />
         }
       />
       <EmailBody>
         <Text>
           <p style={{ marginBottom: '4px' }}>{name && i18n.t('backend:email.hi', { lng, name })}</p>
-          <span
-            // biome-ignore lint/security/noDangerouslySetInnerHtml: trusted HTML content from a secure source
-            dangerouslySetInnerHTML={{
-              __html: i18n.t('backend:email.member_invite.text', { lng, entityName, appName, senderName, role }),
-            }}
-          />
+          <span dangerouslySetInnerHTML={{ __html: i18n.t('backend:email.member_invite.text', { lng, entityName, appName, senderName, role }) }} />
         </Text>
-        {/* User is sent to org invite page, where this invitation token will be used to accept invitation. If not already signed in, 
-        it will either forward user to sign in if user exists, or to sign up if user does not exist. */}
+
         <EmailButton ButtonText={i18n.t('common:accept', { lng })} href={memberInviteLink} />
 
         <Text style={{ fontSize: '.85rem', color: '#6a737d', margin: '0.5rem 0 0 0', textAlign: 'center' }}>
diff --git a/backend/emails/newsletter.tsx b/backend/emails/newsletter.tsx
index 9ffa7a9bc..fab2e044b 100644
--- a/backend/emails/newsletter.tsx
+++ b/backend/emails/newsletter.tsx
@@ -18,12 +18,7 @@ export const NewsletterEmail = ({ lng, content, subject, unsubscribeLink, orgNam
     <EmailContainer previewText={subject}>
       <EmailHeader
         headerText={
-          <div
-            // biome-ignore lint/security/noDangerouslySetInnerHtml: trusted HTML content from a secure source
-            dangerouslySetInnerHTML={{
-              __html: i18n.t('backend:email.newsletter.title', { orgName, lng }),
-            }}
-          />
+          <div dangerouslySetInnerHTML={{ __html: i18n.t('backend:email.newsletter.title', { orgName, lng }) }} />
         }
       />
       <EmailBody>
diff --git a/backend/emails/oauth-verification.tsx b/backend/emails/oauth-verification.tsx
index 0f5bd7c7f..16c6b9c5a 100644
--- a/backend/emails/oauth-verification.tsx
+++ b/backend/emails/oauth-verification.tsx
@@ -23,18 +23,14 @@ export const OAuthVerificationEmail = ({ lng, verificationLink, email, name, pro
   return (
     <EmailContainer previewText={i18n.t('backend:email.oauth_verification.preview', { appName, lng, providerName })}>
       <EmailHeader headerText={i18n.t('backend:email.oauth_verification.preview', { appName, lng, providerName })} />
+     
       <EmailBody>
         <Text>
-          <span
-            // biome-ignore lint/security/noDangerouslySetInnerHtml: trusted HTML content from a secure source
-            dangerouslySetInnerHTML={{
-              __html: i18n.t('backend:email.oauth_verification.text', { lng, appName, email, providerEmail, providerName, name }),
-            }}
-          />
+          <span dangerouslySetInnerHTML={{ __html: i18n.t('backend:email.oauth_verification.text', { lng, appName, email, providerEmail, providerName, name }) }} />
         </Text>
-
         <EmailButton ButtonText={i18n.t('backend:email.oauth_verification.verify', { lng, providerName })} href={verificationLink} />
       </EmailBody>
+      
       <AppLogo />
       <Footer />
     </EmailContainer>
diff --git a/backend/emails/system-invite.tsx b/backend/emails/system-invite.tsx
index 5d690b369..52899554f 100644
--- a/backend/emails/system-invite.tsx
+++ b/backend/emails/system-invite.tsx
@@ -30,26 +30,15 @@ export const SystemInviteEmail = ({ name, lng, senderName, systemInviteLink }: S
 
       <EmailHeader
         headerText={
-          <div
-            // biome-ignore lint/security/noDangerouslySetInnerHtml: trusted HTML content from a secure source
-            dangerouslySetInnerHTML={{
-              __html: i18n.t('backend:email.system_invite.title', { appName, lng }),
-            }}
-          />
+          <div dangerouslySetInnerHTML={{ __html: i18n.t('backend:email.system_invite.title', { appName, lng }) }} />
         }
       />
       <EmailBody>
         <Text>
           <p style={{ marginBottom: '4px' }}>{name && i18n.t('backend:email.hi', { lng, name })}</p>
-          <span
-            // biome-ignore lint/security/noDangerouslySetInnerHtml: trusted HTML content from a secure source
-            dangerouslySetInnerHTML={{
-              __html: i18n.t('backend:email.system_invite.text', { lng, appName, senderName }),
-            }}
-          />
+          <span dangerouslySetInnerHTML={{ __html: i18n.t('backend:email.system_invite.text', { lng, appName, senderName }) }} />
         </Text>
 
-        {/* User is sent to authenticate page, where this invitation token will be used to complete the sign up process */}
         <EmailButton ButtonText={i18n.t('common:join', { lng })} href={systemInviteLink} />
 
         <Text style={{ fontSize: '.85rem', margin: '0.5rem 0 0 0', textAlign: 'center' }}>{i18n.t('backend:email.invite_expires', { lng })}</Text>
diff --git a/backend/mocks/basic.ts b/backend/mocks/basic.ts
index 551e3b55c..31541ab02 100644
--- a/backend/mocks/basic.ts
+++ b/backend/mocks/basic.ts
@@ -173,7 +173,7 @@ export const mockOrganizationMembership = (organization: OrganizationModel, user
     userId: user.id,
     organizationId: organization.id,
     contextType: 'organization',
-    role: faker.helpers.arrayElement(appConfig.rolesByType.entityRoles),
+    role: faker.helpers.arrayElement(appConfig.roles.entityRoles),
     order: getMembershipOrderOffset(organization.id) * 10,
     createdAt: pastIsoDate(),
     activatedAt: pastIsoDate(),
diff --git a/backend/package.json b/backend/package.json
index 772970925..ca1b66576 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -40,16 +40,16 @@
   },
   "dependencies": {
     "@asteasolutions/zod-to-openapi": "8.1.0",
-    "@aws-sdk/client-s3": "^3.894.0",
+    "@aws-sdk/client-s3": "^3.896.0",
     "@aws-sdk/cloudfront-signer": "^3.893.0",
-    "@aws-sdk/lib-storage": "^3.894.0",
-    "@aws-sdk/s3-request-presigner": "^3.894.0",
+    "@aws-sdk/lib-storage": "^3.896.0",
+    "@aws-sdk/s3-request-presigner": "^3.896.0",
     "@cellajs/permission-manager": "^0.1.0",
     "@dotenv-run/core": "^1.3.8",
-    "@electric-sql/pglite": "^0.3.9",
+    "@electric-sql/pglite": "^0.3.10",
     "@getbrevo/brevo": "2.5.0",
     "@hono/node-server": "^1.19.4",
-    "@hono/zod-openapi": "1.1.0",
+    "@hono/zod-openapi": "1.1.3",
     "@logtail/node": "^0.5.6",
     "@node-rs/argon2": "^2.0.2",
     "@novu/api": "^1.6.0",
@@ -75,9 +75,9 @@
     "drizzle-orm": "^0.44.5",
     "drizzle-zod": "0.8.3",
     "enforce-unique": "^1.3.0",
-    "hono": "4.9.7",
+    "hono": "4.9.8",
     "i18next": "^25.5.2",
-    "isbot": "^5.1.30",
+    "isbot": "^5.1.31",
     "jsdom": "^26.1.0",
     "jsonwebtoken": "^9.0.2",
     "jsx-email": "^2.7.3",
@@ -88,7 +88,7 @@
     "pino": "^9.11.0",
     "pino-http": "^10.5.0",
     "prom-client": "^15.1.3",
-    "rate-limiter-flexible": "^7.3.2",
+    "rate-limiter-flexible": "^7.4.0",
     "react": "^19.1.1",
     "react-dom": "^19.1.1",
     "react-i18next": "^15.7.3",
diff --git a/backend/src/db/schema/memberships.ts b/backend/src/db/schema/memberships.ts
index 3704e9e8d..d0dc38dda 100644
--- a/backend/src/db/schema/memberships.ts
+++ b/backend/src/db/schema/memberships.ts
@@ -7,7 +7,7 @@ import { generateTable } from '#/db/utils/generate-table';
 import { timestampColumns } from '#/db/utils/timestamp-columns';
 import { nanoid } from '#/utils/nanoid';
 
-const roleEnum = appConfig.rolesByType.entityRoles;
+const roleEnum = appConfig.roles.entityRoles;
 
 const { organizationId, ...otherEntityIdColumns } = generateContextEntityTypeFields();
 
diff --git a/backend/src/db/schema/oauth-accounts.ts b/backend/src/db/schema/oauth-accounts.ts
index 4cbab3118..aae2bec44 100644
--- a/backend/src/db/schema/oauth-accounts.ts
+++ b/backend/src/db/schema/oauth-accounts.ts
@@ -10,19 +10,16 @@ export const oauthAccountsTable = pgTable(
   {
     createdAt: timestampColumns.createdAt,
     id: varchar().primaryKey().$defaultFn(nanoid),
-    // TODO rename to 'provider'
-    providerId: varchar({ enum: supportedOAuthProviders }).notNull(),
+    provider: varchar({ enum: supportedOAuthProviders }).notNull(),
     providerUserId: varchar().notNull(),
     email: varchar().notNull(),
     verified: boolean().notNull().default(false),
     verifiedAt: timestamp({ mode: 'string' }),
-    // TODO remove, not used
-    tenantId: varchar(),
     userId: varchar()
       .notNull()
       .references(() => usersTable.id, { onDelete: 'cascade' }),
   },
-  (table) => [unique().on(table.providerId, table.providerUserId, table.email)],
+  (table) => [unique().on(table.provider, table.providerUserId, table.email)],
 );
 
 export type OAuthAccountModel = typeof oauthAccountsTable.$inferInsert;
diff --git a/backend/src/db/schema/tokens.ts b/backend/src/db/schema/tokens.ts
index 3ff66bd3c..20044147a 100644
--- a/backend/src/db/schema/tokens.ts
+++ b/backend/src/db/schema/tokens.ts
@@ -8,13 +8,14 @@ import { timestampColumns } from '#/db/utils/timestamp-columns';
 import { nanoid } from '#/utils/nanoid';
 
 const tokenTypeEnum = appConfig.tokenTypes;
-const roleEnum = appConfig.rolesByType.entityRoles;
+const roleEnum = appConfig.roles.entityRoles;
 
 // Base columns for tokens table
 const baseColumns = {
   createdAt: timestampColumns.createdAt,
   id: varchar().primaryKey().$defaultFn(nanoid),
   token: varchar().notNull(),
+  singleUseToken: varchar(),
   type: varchar({ enum: tokenTypeEnum }).notNull(),
   email: varchar().notNull(),
   entityType: varchar({ enum: appConfig.contextEntityTypes }),
@@ -23,7 +24,7 @@ const baseColumns = {
   oauthAccountId: varchar().references(() => oauthAccountsTable.id, { onDelete: 'set null' }),
   createdBy: varchar().references(() => usersTable.id, { onDelete: 'set null' }),
   expiresAt: timestampColumns.expiresAt,
-  consumedAt: timestamp({ withTimezone: true, mode: 'date' }),
+  invokedAt: timestamp({ withTimezone: true, mode: 'date' }),
 };
 
 // Generate entity id columns based on entity-config
diff --git a/backend/src/db/schema/users.ts b/backend/src/db/schema/users.ts
index ca91a6ac6..7b28feb66 100644
--- a/backend/src/db/schema/users.ts
+++ b/backend/src/db/schema/users.ts
@@ -3,7 +3,7 @@ import { boolean, foreignKey, index, jsonb, pgTable, timestamp, varchar } from '
 import { timestampColumns } from '#/db/utils/timestamp-columns';
 import { nanoid } from '#/utils/nanoid';
 
-const roleEnum = appConfig.rolesByType.systemRoles;
+const roleEnum = appConfig.roles.systemRoles;
 const languagesEnum = appConfig.languages;
 
 /**
diff --git a/backend/src/lib/notifications/README.md b/backend/src/lib/notifications/README.md
new file mode 100644
index 000000000..e71e00a2a
--- /dev/null
+++ b/backend/src/lib/notifications/README.md
@@ -0,0 +1,13 @@
+
+## Enable Novu Slack notification
+> [!WARNING]
+> Work in progress
+
+[Guide by Novu](https://docs.novu.co/guides/slack-guide).
+At first, [create App in Slack](https://api.slack.com/apps) so you can obtain the App ID, Client ID, and Client Secret.
+
+Then, [create Novu Workflow](https://web.novu.co/workflows?page=1&size=10) and select 'Blank workflow'.
+
+The next step is [creating the Slack integration](https://web.novu.co/integrations). Create a Slack provider and add the App ID, Client ID, and Client Secret obtained from the first step. It's important not to forget to activate it. Now, in the workflow, add the 'Chat (Slack)' option to your workflow trigger and configure the message content. Pass variables that you want to use within double curly braces as example {{usersMessage}}.
+
+Also we need to [add incoming webhook](https://api.slack.com/apps/A074GBPK6A1/incoming-webhooks?).
diff --git a/backend/src/middlewares/README.md b/backend/src/middlewares/README.md
index 8d08fcf3f..4bfa029dd 100644
--- a/backend/src/middlewares/README.md
+++ b/backend/src/middlewares/README.md
@@ -29,7 +29,7 @@ Built using [node-rate-limiter-flexible](https://github.com/animir/node-rate-lim
 
 ### Token validation
 
-You can use the middleware `hasValidToken` to validate a token. If its valid (it exists, it is not expired), then it will be added to `getContext`.
+You can use the middleware `hasValidToken` to validate a refresh token in a cookie. If its valid (it exists, it is not expired), then it will be added to `getContext`.
 
 ### Monitoring
 
diff --git a/backend/src/middlewares/has-valid-token.ts b/backend/src/middlewares/has-valid-token.ts
index 84b17e1ab..9432c9968 100644
--- a/backend/src/middlewares/has-valid-token.ts
+++ b/backend/src/middlewares/has-valid-token.ts
@@ -3,27 +3,27 @@ import { createMiddleware } from 'hono/factory';
 import type { TokenModel } from '#/db/schema/tokens';
 import type { Env } from '#/lib/context';
 import { AppError } from '#/lib/errors';
-import { getValidToken } from '#/utils/validate-token';
+import { deleteAuthCookie } from '#/modules/auth/helpers/cookie';
+import { getValidSingleUseToken } from '#/utils/get-valid-single-use-token';
 
 /**
- * Middleware to get and check the validity of a token, and set token data in context.
- * If all checks pass, the token data is added to the context for further processing in request lifecycle.
+ * Middleware to get and check the validity of a single use token from a cookie, set token data in context and remove cookie.
  *
- * @param requiredType - `"email_verification" | "password_reset" | "invitation"` Type of token that is required. This parameter ensures that only tokens of the specified type are accepted.
+ * @param tokenType - Type of token that is required. This parameter ensures that only tokens of the specified type are accepted.
  * @returns Error response or undefined if the token is valid.
  *
  */
-export const hasValidToken = (requiredType: TokenModel['type']): MiddlewareHandler<Env> =>
+// TODO how to provide additional security against CSRF for endpoints using the cookie with hasValidToken middleware?
+// Can this middleware be used to directly check a CRSF token?
+export const hasValidToken = (tokenType: TokenModel['type']): MiddlewareHandler<Env> =>
   createMiddleware<Env>(async (ctx, next) => {
-    // For email verification, redirect to frontend
-    const isRedirect = requiredType === 'email_verification';
+    if (ctx.req.method !== 'POST') throw new AppError({ status: 400, type: 'insecure_request', severity: 'error' });
 
-    // Find token in request
-    const token = ctx.req.param('token');
-    if (!token) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error', isRedirect });
+    // Check if single use token exists and consume it
+    const tokenRecord = await getValidSingleUseToken({ ctx, tokenType });
 
-    // Check if token exists
-    const tokenRecord = await getValidToken({ requiredType, token, isRedirect });
+    // Revoke single use token by deleting cookie
+    deleteAuthCookie(ctx, tokenType);
 
     // Set token in context
     ctx.set('token', tokenRecord);
diff --git a/backend/src/middlewares/rate-limiter/core.ts b/backend/src/middlewares/rate-limiter/core.ts
index a5cda38b0..d30a090e0 100644
--- a/backend/src/middlewares/rate-limiter/core.ts
+++ b/backend/src/middlewares/rate-limiter/core.ts
@@ -15,7 +15,7 @@ type RateLimitOptions = Partial<RateLimiterPostgres> | Partial<RateLimiterMemory
 // Default options
 export const defaultOptions = {
   tableName: 'rate_limits', // Name of table in database
-  points: 5, // 5 requests
+  points: 10, // 10 requests
   duration: 60 * 60, // within 1 hour
   blockDuration: 60 * 30, // Block for 30 minutes
 };
diff --git a/backend/src/middlewares/rate-limiter/helpers.ts b/backend/src/middlewares/rate-limiter/helpers.ts
index 7fae0198c..0c47daa6d 100644
--- a/backend/src/middlewares/rate-limiter/helpers.ts
+++ b/backend/src/middlewares/rate-limiter/helpers.ts
@@ -2,6 +2,7 @@ import type { Context } from 'hono';
 import { type IRateLimiterPostgresOptions, RateLimiterMemory, RateLimiterPostgres, type RateLimiterRes } from 'rate-limiter-flexible';
 import { db } from '#/db/db';
 import { env } from '#/env';
+import { Env } from '#/lib/context';
 import { AppError } from '#/lib/errors';
 import { defaultOptions } from '#/middlewares/rate-limiter/core';
 
@@ -26,7 +27,7 @@ export const getRateLimiterInstance = (options: Omit<IRateLimiterPostgresOptions
 /**
  * Rate limit Error response
  */
-export const rateLimitError = (ctx: Context, limitState: RateLimiterRes, rateLimitKey: string) => {
+export const rateLimitError = (ctx: Context<Env>, limitState: RateLimiterRes, rateLimitKey: string) => {
   ctx.header('Retry-After', getRetryAfter(limitState.msBeforeNext));
   throw new AppError({ status: 429, type: 'too_many_requests', severity: 'warn', meta: { rateLimitKey } });
 };
diff --git a/backend/src/middlewares/rate-limiter/limiters.ts b/backend/src/middlewares/rate-limiter/limiters.ts
index 05982ae8e..5406263b6 100644
--- a/backend/src/middlewares/rate-limiter/limiters.ts
+++ b/backend/src/middlewares/rate-limiter/limiters.ts
@@ -6,20 +6,20 @@ import { rateLimiter } from '#/middlewares/rate-limiter/core';
 /**
  * Email spam limit for endpoints where emails are sent to others. Identifier: IP. Max 10 requests per hour. For sign up with password, reset password, public requests etc.
  */
-export const spamLimiter: MiddlewareHandler<Env> = rateLimiter('success', 'spam', ['ip'], { points: 10, blockDuration: 60 * 60 });
+export const spamLimiter: MiddlewareHandler<Env> = rateLimiter('success', 'spam', ['ip']);
 
 /**
- * Email enumeration limiter to prevent users from guessing emails. Blocks IP for 30 min after 5 consecutive failed requests in 1 hour
+ * Email enumeration limiter to prevent users from guessing emails. Blocks IP for 30 min after 10 consecutive failed requests in 1 hour
  */
 export const emailEnumLimiter: MiddlewareHandler<Env> = rateLimiter('failseries', 'email_enum', ['ip']);
 
 /**
- * Password limiter to prevent users from guessing passwords. Blocks email or else ip for 30 min after 5 consecutive failed requests in 1 hour
+ * Password limiter to prevent users from guessing passwords. Blocks email or else ip for 30 min after 10 consecutive failed requests in 1 hour
  */
 export const passwordLimiter: MiddlewareHandler<Env> = rateLimiter('failseries', 'password', ['email', 'ip']);
 
 /**
- * Prevent brute force attacks by systematically trying tokens or secrets. Blocks IP for 30 minutes after 5 consecutive failed requests in 1 hour
+ * Prevent brute force attacks by systematically trying tokens or secrets. Blocks IP for 30 minutes after 10 consecutive failed requests in 1 hour
  */
 export const tokenLimiter = (tokenType: string): MiddlewareHandler<Env> => {
   const tokenRateLimiter = rateLimiter('failseries', `token_${tokenType}`, ['ip']);
@@ -29,7 +29,7 @@ export const tokenLimiter = (tokenType: string): MiddlewareHandler<Env> => {
     name: `token_${tokenType}Limiter`,
     middleware: tokenRateLimiter,
     category: 'rate-limit',
-    label: `token_${tokenType} (5/h)`,
+    label: `token_${tokenType} (10/h)`,
   });
 
   return tokenRateLimiter;
diff --git a/backend/src/modules/auth/general/handlers.ts b/backend/src/modules/auth/general/handlers.ts
new file mode 100644
index 000000000..fc12eac6a
--- /dev/null
+++ b/backend/src/modules/auth/general/handlers.ts
@@ -0,0 +1,207 @@
+import { OpenAPIHono } from '@hono/zod-openapi';
+import { appConfig } from 'config';
+import { and, desc, eq, isNotNull, isNull } from 'drizzle-orm';
+import { db } from '#/db/db';
+import { emailsTable } from '#/db/schema/emails';
+import { organizationsTable } from '#/db/schema/organizations';
+import { sessionsTable } from '#/db/schema/sessions';
+import { tokensTable } from '#/db/schema/tokens';
+import { usersTable } from '#/db/schema/users';
+import { type Env, getContextUser } from '#/lib/context';
+import { AppError } from '#/lib/errors';
+import { deleteAuthCookie, getAuthCookie, setAuthCookie } from '#/modules/auth/helpers/cookie';
+import { handleEmailVerification } from '#/modules/auth/helpers/handle-email-verification';
+import { getParsedSessionCookie, setUserSession, validateSession } from '#/modules/auth/helpers/session';
+import { usersBaseQuery } from '#/modules/users/helpers/select';
+import { defaultHook } from '#/utils/default-hook';
+import { getValidToken } from '#/utils/get-valid-token';
+import { isExpiredDate } from '#/utils/is-expired-date';
+import { logEvent } from '#/utils/logger';
+import { TimeSpan } from '#/utils/time-span';
+import { handleOAuthVerification } from '../oauth/helpers/handle-oauth-verification';
+import authGeneralRoutes from './routes';
+
+const app = new OpenAPIHono<Env>({ defaultHook });
+
+const authGeneralRouteHandlers = app
+  /*
+   * Check if email exists
+   */
+  .openapi(authGeneralRoutes.checkEmail, async (ctx) => {
+    const { email } = ctx.req.valid('json');
+
+    const normalizedEmail = email.toLowerCase().trim();
+
+    // If entering while having an unclaimed invitation token, abort and resend that invitation instead to prevent conflicts later
+    const [inviteToken] = await db
+      .select()
+      .from(tokensTable)
+      .where(
+        and(
+          eq(tokensTable.email, normalizedEmail),
+          eq(tokensTable.type, 'invitation'),
+          isNull(tokensTable.userId),
+          isNotNull(tokensTable.entityType),
+          isNotNull(tokensTable.role),
+          isNull(tokensTable.invokedAt),
+        ),
+      )
+      .limit(1);
+
+    if (inviteToken) throw new AppError({ status: 403, type: 'invite_takes_priority', severity: 'warn' });
+
+    // User not found, go to sign up if registration is enabled
+    const [user] = await usersBaseQuery()
+      .leftJoin(emailsTable, eq(usersTable.id, emailsTable.userId))
+      .where(eq(emailsTable.email, normalizedEmail))
+      .limit(1);
+
+    if (!user) throw new AppError({ status: 404, type: 'not_found', severity: 'warn', entityType: 'user' });
+
+    return ctx.json(true, 200);
+  })
+  /*
+   * Consume token and redirect with single use session token in cookie
+   */
+  .openapi(authGeneralRoutes.consumeToken, async (ctx) => {
+    const { token } = ctx.req.valid('param');
+
+    // Check if token exists and create a new refresh token
+    const tokenRecord = await getValidToken({ token, consumeToken: true });
+    if (!tokenRecord.singleUseToken) throw new AppError({ status: 500, type: 'invalid_token', severity: 'error', isRedirect: true });
+
+    // Set cookie using token type as name. Content is single use token. Expires in 10 minutes or until used.
+    await setAuthCookie(ctx, tokenRecord.type, tokenRecord.singleUseToken, new TimeSpan(10, 'm'));
+
+    // If verification email, we process it immediately and redirect to app
+    if (tokenRecord.type === 'email_verification') return handleEmailVerification(ctx, tokenRecord);
+
+    // If oauth verification, we redirect to oauth /verify route to complete verification though oauth provider
+    if (tokenRecord.type === 'oauth_verification') return handleOAuthVerification(ctx, tokenRecord);
+
+    // Determine redirect URL based on token type
+    let redirectUrl = appConfig.defaultRedirectPath;
+    if (tokenRecord.type === 'invitation') redirectUrl = `${appConfig.frontendUrl}/home?invitationTokenId=${tokenRecord.id}&skipWelcome=true`;
+    if (tokenRecord.type === 'password_reset') redirectUrl = `${appConfig.frontendUrl}/auth/create-password/${tokenRecord.id}`;
+
+    logEvent('info', 'Token consumed, redirecting with single use token in cookie', { tokenId: tokenRecord.id, userId: tokenRecord.userId });
+
+    return ctx.redirect(redirectUrl, 302);
+  })
+  /*
+   * Check token by id (without consuming it)
+   */
+  // TODO simplify?
+  .openapi(authGeneralRoutes.getTokenData, async (ctx) => {
+    // Find token in request
+    const { tokenId } = ctx.req.valid('param');
+    const { type: tokenType } = ctx.req.valid('query');
+
+    // Get token
+    const [tokenRecord] = await db
+      .select()
+      .from(tokensTable)
+      .where(and(eq(tokensTable.id, tokenId), eq(tokensTable.type, tokenType)));
+    if (!tokenRecord) throw new AppError({ status: 404, type: 'token_not_found', severity: 'error' });
+
+    const baseData = {
+      email: tokenRecord.email,
+      role: tokenRecord.role,
+      userId: tokenRecord.userId || '',
+    };
+
+    // If its NOT an organization invitation, return base data
+    if (!tokenRecord.organizationId) return ctx.json(baseData, 200);
+
+    // If it is a membership invitation, check if a new user has been created since invitation was sent (without verifying email)
+    const [existingUser] = await usersBaseQuery().where(eq(usersTable.email, tokenRecord.email));
+    if (!tokenRecord.userId && existingUser) {
+      await db.update(tokensTable).set({ userId: existingUser.id }).where(eq(tokensTable.id, tokenRecord.id));
+      baseData.userId = existingUser.id;
+    }
+
+    // Add organization data to base data
+    const [organization] = await db.select().from(organizationsTable).where(eq(organizationsTable.id, tokenRecord.organizationId));
+    if (!organization) throw new AppError({ status: 404, type: 'not_found', severity: 'warn', entityType: 'organization' });
+
+    const dataWithOrg = {
+      ...baseData,
+      organizationId: organization.id || '',
+      organizationName: organization.name || '',
+      organizationSlug: organization.slug || '',
+    };
+
+    return ctx.json(dataWithOrg, 200);
+  })
+  /*
+   * Start impersonation
+   */
+  .openapi(authGeneralRoutes.startImpersonation, async (ctx) => {
+    const { targetUserId } = ctx.req.valid('query');
+
+    const [user] = await usersBaseQuery().where(eq(usersTable.id, targetUserId)).limit(1);
+
+    if (!user) throw new AppError({ status: 404, type: 'not_found', severity: 'warn', entityType: 'user', meta: { targetUserId } });
+
+    const adminUser = getContextUser();
+    await setUserSession(ctx, user, 'password', 'impersonation');
+
+    logEvent('info', 'Started impersonation', { adminId: adminUser.id, targetUserId });
+
+    return ctx.json(true, 200);
+  })
+  /*
+   * Stop impersonation
+   */
+  .openapi(authGeneralRoutes.stopImpersonation, async (ctx) => {
+    const { sessionToken, adminUserId } = await getParsedSessionCookie(ctx, { deleteAfterAttempt: true });
+    const { session } = await validateSession(sessionToken);
+
+    // Only continue if session is impersonation
+    if (!adminUserId) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error' });
+
+    const [adminsLastSession] = await db
+      .select()
+      .from(sessionsTable)
+      .where(eq(sessionsTable.userId, adminUserId))
+      .orderBy(desc(sessionsTable.expiresAt))
+      .limit(1);
+
+    if (isExpiredDate(adminsLastSession.expiresAt)) throw new AppError({ status: 401, type: 'unauthorized', severity: 'warn' });
+
+    const expireTimeSpan = new TimeSpan(adminsLastSession.expiresAt.getTime() - Date.now(), 'ms');
+    const cookieContent = `${adminsLastSession.token}.${adminsLastSession.userId ?? ''}`;
+
+    await setAuthCookie(ctx, 'session', cookieContent, expireTimeSpan);
+
+    logEvent('info', 'Stopped impersonation', { adminId: adminUserId || 'na', targetUserId: session.userId });
+
+    return ctx.json(true, 200);
+  })
+  /*
+   * Sign out
+   */
+  .openapi(authGeneralRoutes.signOut, async (ctx) => {
+    const confirmMfa = await getAuthCookie(ctx, 'confirm_mfa');
+
+    if (confirmMfa) {
+      // Delete mfa cookie
+      deleteAuthCookie(ctx, 'confirm_mfa');
+
+      logEvent('info', 'User mfa canceled');
+
+      return ctx.json(true, 200);
+    }
+
+    // Find session & invalidate
+    const { sessionToken } = await getParsedSessionCookie(ctx, { deleteOnError: true, deleteAfterAttempt: true });
+    const { session: currentSession } = await validateSession(sessionToken);
+
+    await db.delete(sessionsTable).where(and(eq(sessionsTable.id, currentSession.id), eq(sessionsTable.userId, currentSession.userId)));
+
+    logEvent('info', 'User signed out', { userId: currentSession.userId });
+
+    return ctx.json(true, 200);
+  });
+
+export default authGeneralRouteHandlers;
diff --git a/backend/src/modules/auth/general/routes.ts b/backend/src/modules/auth/general/routes.ts
new file mode 100644
index 000000000..d49ce133a
--- /dev/null
+++ b/backend/src/modules/auth/general/routes.ts
@@ -0,0 +1,153 @@
+import { z } from '@hono/zod-openapi';
+import { appConfig } from 'config';
+import { createCustomRoute } from '#/lib/custom-routes';
+import { hasSystemAccess, isAuthenticated, isPublicAccess } from '#/middlewares/guard';
+import { isNoBot } from '#/middlewares/is-no-bot';
+import { emailEnumLimiter } from '#/middlewares/rate-limiter/limiters';
+import { cookieSchema, locationSchema } from '#/utils/schema/common';
+import { errorResponses, successWithoutDataSchema } from '#/utils/schema/responses';
+import { emailBodySchema, tokenWithDataSchema } from './schema';
+
+const authGeneralRoutes = {
+  startImpersonation: createCustomRoute({
+    operationId: 'startImpersonation',
+    method: 'get',
+    path: '/impersonation/start',
+    guard: [isAuthenticated, hasSystemAccess],
+    tags: ['auth'],
+    summary: 'Start impersonating',
+    description: 'Allows a system admin to impersonate a specific user by ID, returning a temporary impersonation session.',
+    request: { query: z.object({ targetUserId: z.string() }) },
+    responses: {
+      200: {
+        description: 'Impersonating',
+        headers: z.object({
+          'Set-Cookie': cookieSchema,
+        }),
+        content: {
+          'application/json': {
+            schema: successWithoutDataSchema,
+          },
+        },
+      },
+      ...errorResponses,
+    },
+  }),
+
+  stopImpersonation: createCustomRoute({
+    operationId: 'stopImpersonation',
+    method: 'get',
+    path: '/impersonation/stop',
+    guard: isAuthenticated,
+    tags: ['auth'],
+    summary: 'Stop impersonating',
+    description: 'Ends impersonation by clearing the current impersonation session and restoring the admin context.',
+    responses: {
+      200: {
+        description: 'Stopped impersonating',
+        content: {
+          'application/json': {
+            schema: successWithoutDataSchema,
+          },
+        },
+      },
+      ...errorResponses,
+    },
+  }),
+
+  checkEmail: createCustomRoute({
+    operationId: 'checkEmail',
+    method: 'post',
+    path: '/check-email',
+    guard: isPublicAccess,
+    middleware: [isNoBot, emailEnumLimiter],
+    tags: ['auth'],
+    summary: 'Check if email exists',
+    description: 'Checks if a user with the specified email address exists in the system.',
+    security: [],
+    request: {
+      body: {
+        content: {
+          'application/json': {
+            schema: emailBodySchema,
+          },
+        },
+      },
+    },
+    responses: {
+      200: {
+        description: 'Email exists',
+        content: {
+          'application/json': {
+            schema: successWithoutDataSchema,
+          },
+        },
+      },
+      ...errorResponses,
+    },
+  }),
+
+  consumeToken: createCustomRoute({
+    operationId: 'consumeToken',
+    method: 'get',
+    path: '/consume-token/{token}',
+    guard: isPublicAccess,
+    middleware: isNoBot,
+    tags: ['auth'],
+    summary: 'Refresh token',
+    description:
+      'Validates email token (for password reset, email verification or invitations) and redirects user to backend with a refreshed token in a cookie.',
+    request: {
+      params: z.object({ token: z.string() }),
+    },
+    responses: {
+      302: {
+        description: 'Redirect with refreshed token in cookie',
+        headers: locationSchema,
+      },
+      ...errorResponses,
+    },
+  }),
+
+  getTokenData: createCustomRoute({
+    operationId: 'getTokenData',
+    method: 'get',
+    path: '/token/{tokenId}',
+    guard: isPublicAccess,
+    middleware: isNoBot,
+    tags: ['auth'],
+    summary: 'Get token data',
+    description:
+      'Get basic token data by id, for password reset and invitation. It returns if the token is still valid and returns basic data if valid.',
+    request: {
+      params: z.object({ tokenId: z.string() }),
+      query: z.object({ type: z.enum(appConfig.tokenTypes) }),
+    },
+    responses: {
+      200: {
+        description: 'Token is valid',
+        content: { 'application/json': { schema: tokenWithDataSchema } },
+      },
+      ...errorResponses,
+    },
+  }),
+
+  signOut: createCustomRoute({
+    operationId: 'signOut',
+    method: 'get',
+    path: '/sign-out',
+    guard: isPublicAccess,
+    tags: ['auth'],
+    summary: 'Sign out',
+    description: 'Signs out the *current user* and clears the active session.',
+    responses: {
+      200: {
+        description: 'User signed out',
+        content: { 'application/json': { schema: successWithoutDataSchema } },
+      },
+      ...errorResponses,
+    },
+  }),
+};
+
+export default authGeneralRoutes;
diff --git a/backend/src/modules/auth/general/schema.ts b/backend/src/modules/auth/general/schema.ts
new file mode 100644
index 000000000..420f462ed
--- /dev/null
+++ b/backend/src/modules/auth/general/schema.ts
@@ -0,0 +1,16 @@
+import { z } from '@hono/zod-openapi';
+import { membershipSchema } from '#/modules/memberships/schema';
+import { userSchema } from '#/modules/users/schema';
+import { idSchema } from '#/utils/schema/common';
+
+export const emailBodySchema = z.object({
+  email: userSchema.shape.email,
+});
+export const tokenWithDataSchema = z.object({
+  email: z.email(),
+  role: z.union([membershipSchema.shape.role, z.null()]),
+  userId: idSchema.optional(),
+  organizationName: z.string().optional(),
+  organizationSlug: z.string().optional(),
+  organizationId: z.string().optional(),
+});
diff --git a/backend/src/modules/auth/handlers.ts b/backend/src/modules/auth/handlers.ts
deleted file mode 100644
index 9264292b2..000000000
--- a/backend/src/modules/auth/handlers.ts
+++ /dev/null
@@ -1,871 +0,0 @@
-import { getRandomValues } from 'node:crypto';
-import { OpenAPIHono } from '@hono/zod-openapi';
-import { encodeBase64 } from '@oslojs/encoding';
-import { generateCodeVerifier, generateState, OAuth2RequestError } from 'arctic';
-import { appConfig, type EnabledOAuthProvider } from 'config';
-import { and, desc, eq, isNotNull, isNull } from 'drizzle-orm';
-import i18n from 'i18next';
-import { db } from '#/db/db';
-import { emailsTable } from '#/db/schema/emails';
-import { membershipsTable } from '#/db/schema/memberships';
-import { organizationsTable } from '#/db/schema/organizations';
-import { passkeysTable } from '#/db/schema/passkeys';
-import { passwordsTable } from '#/db/schema/passwords';
-import { sessionsTable } from '#/db/schema/sessions';
-import { tokensTable } from '#/db/schema/tokens';
-import { totpsTable } from '#/db/schema/totps';
-import { type UserModel, usersTable } from '#/db/schema/users';
-import { env } from '#/env';
-import { type Env, getContextToken, getContextUser } from '#/lib/context';
-import { resolveEntity } from '#/lib/entity';
-import { AppError } from '#/lib/errors';
-import { eventManager } from '#/lib/events';
-import { mailer } from '#/lib/mailer';
-import { hashPassword, verifyPasswordHash } from '#/modules/auth/helpers/argon2id';
-import { deleteAuthCookie, getAuthCookie, setAuthCookie } from '#/modules/auth/helpers/cookie';
-import { consumeMfaToken, initiateMfa, validateConfirmMfaToken } from '#/modules/auth/helpers/mfa';
-import { handleOAuthCallback } from '#/modules/auth/helpers/oauth/callback';
-import { handleOAuthInitiation, type OAuthCookiePayload } from '#/modules/auth/helpers/oauth/initiation';
-import {
-  type GithubUserEmailProps,
-  type GithubUserProps,
-  type GoogleUserProps,
-  githubAuth,
-  googleAuth,
-  type MicrosoftUserProps,
-  microsoftAuth,
-} from '#/modules/auth/helpers/oauth/providers';
-import { transformGithubUserData, transformSocialUserData } from '#/modules/auth/helpers/oauth/transform-user-data';
-import { verifyPassKeyPublic } from '#/modules/auth/helpers/passkey';
-import { sendVerificationEmail } from '#/modules/auth/helpers/send-verification-email';
-import { getParsedSessionCookie, setUserSession, validateSession } from '#/modules/auth/helpers/session';
-import { verifyTotp } from '#/modules/auth/helpers/totps';
-import { handleCreateUser, handleMembershipTokenUpdate } from '#/modules/auth/helpers/user';
-import authRoutes from '#/modules/auth/routes';
-import { usersBaseQuery } from '#/modules/users/helpers/select';
-import { defaultHook } from '#/utils/default-hook';
-import { isExpiredDate } from '#/utils/is-expired-date';
-import { isValidRedirectPath } from '#/utils/is-redirect-url';
-import { getIsoDate } from '#/utils/iso-date';
-import { logEvent } from '#/utils/logger';
-import { nanoid } from '#/utils/nanoid';
-import { slugFromEmail } from '#/utils/slug-from-email';
-import { createDate, TimeSpan } from '#/utils/time-span';
-import { getValidToken } from '#/utils/validate-token';
-import { CreatePasswordEmail, type CreatePasswordEmailProps } from '../../../emails/create-password';
-
-const enabledStrategies: readonly string[] = appConfig.enabledAuthStrategies;
-const enabledOAuthProviders: readonly string[] = appConfig.enabledOAuthProviders;
-
-// Scopes for OAuth providers
-const githubScopes = ['user:email'];
-const googleScopes = ['profile', 'email'];
-const microsoftScopes = ['profile', 'email'];
-
-// When no microsoft tenant is configured, we use common with openid scope
-if (!env.MICROSOFT_TENANT_ID) {
-  microsoftScopes.push('openid');
-}
-
-// Check if oauth provider is enabled by appConfig
-function isOAuthEnabled(provider: EnabledOAuthProvider): boolean {
-  if (!enabledStrategies.includes('oauth')) return false;
-  return enabledOAuthProviders.includes(provider);
-}
-
-const app = new OpenAPIHono<Env>({ defaultHook });
-
-const authRouteHandlers = app
-  /*
-   * Check if email exists
-   */
-  .openapi(authRoutes.checkEmail, async (ctx) => {
-    const { email } = ctx.req.valid('json');
-
-    const normalizedEmail = email.toLowerCase().trim();
-
-    // If entering while having an unclaimed invitation token, abort and resend that invitation instead to prevent conflicts later
-    const [inviteToken] = await db
-      .select()
-      .from(tokensTable)
-      .where(
-        and(
-          eq(tokensTable.email, normalizedEmail),
-          eq(tokensTable.type, 'invitation'),
-          isNull(tokensTable.userId),
-          isNotNull(tokensTable.entityType),
-          isNotNull(tokensTable.role),
-          isNull(tokensTable.consumedAt),
-        ),
-      )
-      .limit(1);
-
-    if (inviteToken) throw new AppError({ status: 403, type: 'invite_takes_priority', severity: 'warn' });
-
-    // User not found, go to sign up if registration is enabled
-    const [user] = await usersBaseQuery()
-      .leftJoin(emailsTable, eq(usersTable.id, emailsTable.userId))
-      .where(eq(emailsTable.email, normalizedEmail))
-      .limit(1);
-
-    if (!user) throw new AppError({ status: 404, type: 'not_found', severity: 'warn', entityType: 'user' });
-
-    return ctx.json(true, 200);
-  })
-  /*
-   * Sign up with email & password.
-   * Attention: sign up is also used for new users that received (system or membership) invitations.
-   * Only when invited to a new organization (context), user will proceed to accept this first after signing up.
-   */
-  .openapi(authRoutes.signUp, async (ctx) => {
-    const { email, password } = ctx.req.valid('json');
-
-    // Verify if strategy allowed
-    const strategy = 'password';
-    if (!enabledStrategies.includes(strategy)) {
-      throw new AppError({ status: 400, type: 'forbidden_strategy', severity: 'error', meta: { strategy } });
-    }
-
-    // Stop if sign up is disabled and no invitation
-    if (!appConfig.has.registrationEnabled) throw new AppError({ status: 403, type: 'sign_up_restricted' });
-    const slug = slugFromEmail(email);
-
-    // Create user & send verification email
-    const newUser = { slug, name: slug, email };
-
-    const user = await handleCreateUser({ newUser });
-
-    // Separatly insert password
-    const hashedPassword = await hashPassword(password);
-    await db.insert(passwordsTable).values({ userId: user.id, hashedPassword: hashedPassword });
-
-    sendVerificationEmail({ userId: user.id });
-
-    return ctx.json(true, 200);
-  })
-  /*
-   * Sign up with email & password to accept (system or membership) invitations.
-   * Only for organization membership invitations, user will proceed to accept after signing up.
-   */
-  .openapi(authRoutes.signUpWithToken, async (ctx) => {
-    const { password } = ctx.req.valid('json');
-
-    const validToken = getContextToken();
-    if (!validToken) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error' });
-
-    const membershipInvite = !!validToken.entityType;
-    // Verify if strategy allowed
-    const strategy = 'password';
-    if (!enabledStrategies.includes(strategy)) {
-      throw new AppError({ status: 400, type: 'forbidden_strategy', severity: 'error', meta: { strategy } });
-    }
-
-    // add token if it's membership invitation
-    const membershipInviteTokenId = membershipInvite ? validToken.id : undefined;
-    const slug = slugFromEmail(validToken.email);
-
-    // Create user & send verification email
-    const newUser = { slug, name: slug, email: validToken.email };
-
-    const user = await handleCreateUser({ newUser, membershipInviteTokenId, emailVerified: true });
-
-    // Separately insert password
-    const hashedPassword = await hashPassword(password);
-    await db.insert(passwordsTable).values({ userId: user.id, hashedPassword: hashedPassword });
-
-    // Sign in user
-    await setUserSession(ctx, user, strategy);
-
-    const redirectPath = membershipInvite ? `/invitation/${validToken.token}?tokenId=${validToken.id}` : appConfig.defaultRedirectPath;
-    return ctx.json({ shouldRedirect: true, redirectPath }, 200);
-  })
-  /*
-   * Verify email
-   */
-  .openapi(authRoutes.verifyEmail, async (ctx) => {
-    const { redirect } = ctx.req.valid('query');
-
-    // No token in context
-    const token = getContextToken();
-    if (!token.userId) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error' });
-
-    // Only allow verify emails for "password" strategy (Oauth verification is handled by Oauth callback handlers)
-    if (token.oauthAccountId) {
-      throw new AppError({ status: 400, type: 'invalid_request', severity: 'error' });
-    }
-
-    // Get user
-    const [user] = await usersBaseQuery().where(eq(usersTable.id, token.userId)).limit(1);
-
-    // User not found
-    if (!user) {
-      throw new AppError({ status: 404, type: 'not_found', severity: 'warn', entityType: 'user', meta: { userId: token.userId } });
-    }
-
-    // Set email verified if it exists
-    await db
-      .update(emailsTable)
-      .set({ verified: true, verifiedAt: getIsoDate() })
-      .where(
-        and(
-          eq(emailsTable.tokenId, token.id),
-          eq(emailsTable.userId, token.userId),
-          eq(emailsTable.email, token.email),
-          eq(emailsTable.verified, false),
-        ),
-      );
-
-    // Start MFA challenge if the user has MFA enabled
-    const mfaRedirectPath = await initiateMfa(ctx, user);
-
-    // Determine redirect url
-    const decodedRedirect = decodeURIComponent(redirect || '');
-    const baseRedirectPath = isValidRedirectPath(decodedRedirect) || appConfig.defaultRedirectPath;
-
-    const redirectPath = mfaRedirectPath || baseRedirectPath;
-    const redirectUrl = new URL(redirectPath, appConfig.frontendUrl);
-
-    // If MFA is not required, set  user session immediately
-    if (!mfaRedirectPath) await setUserSession(ctx, user, 'email');
-
-    return ctx.redirect(redirectUrl, 302);
-  })
-  /*
-   * Request reset password email
-   */
-  .openapi(authRoutes.requestPassword, async (ctx) => {
-    const { email } = ctx.req.valid('json');
-
-    const normalizedEmail = email.toLowerCase().trim();
-
-    const [user] = await usersBaseQuery()
-      .leftJoin(emailsTable, eq(usersTable.id, emailsTable.userId))
-      .where(eq(emailsTable.email, normalizedEmail))
-      .limit(1);
-    if (!user) throw new AppError({ status: 404, type: 'invalid_email', severity: 'warn', entityType: 'user' });
-
-    // Delete old token if exists
-    await db.delete(tokensTable).where(and(eq(tokensTable.userId, user.id), eq(tokensTable.type, 'password_reset')));
-
-    const [tokenRecord] = await db
-      .insert(tokensTable)
-      .values({
-        token: nanoid(40),
-        type: 'password_reset',
-        userId: user.id,
-        email,
-        createdBy: user.id,
-        expiresAt: createDate(new TimeSpan(2, 'h')),
-      })
-      .returning();
-
-    // Send email
-    const lng = user.language;
-    const createPasswordLink = `${appConfig.frontendUrl}/auth/create-password/${tokenRecord.token}?tokenId=${tokenRecord.id}`;
-    const subject = i18n.t('backend:email.create_password.subject', { lng, appName: appConfig.name });
-    const staticProps = { createPasswordLink, subject, lng };
-    const recipients = [{ email: user.email }];
-
-    type Recipient = { email: string };
-
-    mailer.prepareEmails<CreatePasswordEmailProps, Recipient>(CreatePasswordEmail, staticProps, recipients);
-
-    logEvent('info', 'Create password link sent', { userId: user.id });
-
-    return ctx.json(true, 200);
-  })
-  /*
-   * Create password with token
-   */
-  .openapi(authRoutes.createPasswordWithToken, async (ctx) => {
-    const { password } = ctx.req.valid('json');
-    const token = getContextToken();
-
-    // Verify if strategy allowed
-    const strategy = 'password';
-    if (!enabledStrategies.includes(strategy)) {
-      throw new AppError({ status: 400, type: 'forbidden_strategy', severity: 'error', meta: { strategy } });
-    }
-
-    // If the token is not found or expired
-    if (!token || !token.userId) throw new AppError({ status: 401, type: 'invalid_token', severity: 'warn' });
-
-    const [user] = await usersBaseQuery().where(eq(usersTable.id, token.userId)).limit(1);
-
-    // If the user is not found
-    if (!user) {
-      throw new AppError({ status: 404, type: 'not_found', severity: 'warn', entityType: 'user', meta: { userId: token.userId } });
-    }
-
-    // Hash password
-    const hashedPassword = await hashPassword(password);
-
-    // update user password and set email verified
-    await Promise.all([
-      db.insert(passwordsTable).values({ userId: user.id, hashedPassword }).onConflictDoUpdate({
-        target: passwordsTable.userId,
-        set: { hashedPassword },
-      }),
-      db.update(emailsTable).set({ verified: true, verifiedAt: getIsoDate() }).where(eq(emailsTable.email, user.email)),
-    ]);
-
-    const redirectPath = await initiateMfa(ctx, user);
-    if (redirectPath) return ctx.json({ shouldRedirect: true, redirectPath }, 200);
-
-    await setUserSession(ctx, user, strategy);
-    return ctx.json({ shouldRedirect: false }, 200);
-  })
-  /*
-   * Sign in with email and password
-   * Attention: sign in is also used as a preparation to accept organization invitations (when signed out & user exists),
-   * after signing in, we proceed to accept the invitation.
-   */
-  .openapi(authRoutes.signIn, async (ctx) => {
-    const { email, password } = ctx.req.valid('json');
-
-    // Verify if strategy allowed
-    const strategy = 'password';
-    if (!enabledStrategies.includes(strategy)) {
-      throw new AppError({ status: 400, type: 'forbidden_strategy', severity: 'error', meta: { strategy } });
-    }
-
-    const normalizedEmail = email.toLowerCase().trim();
-
-    const [info] = await db
-      .select({ user: usersTable, hashedPassword: passwordsTable.hashedPassword, emailVerified: emailsTable.verified })
-      .from(usersTable)
-      .innerJoin(emailsTable, eq(usersTable.id, emailsTable.userId))
-      .leftJoin(passwordsTable, eq(usersTable.id, passwordsTable.userId))
-      .where(eq(emailsTable.email, normalizedEmail))
-      .limit(1);
-
-    // If user is not found or doesn't have password
-    if (!info) throw new AppError({ status: 404, type: 'not_found', severity: 'warn', entityType: 'user' });
-
-    const { user, hashedPassword, emailVerified } = info;
-
-    if (!hashedPassword) throw new AppError({ status: 403, type: 'no_password_found', severity: 'warn' });
-    // Verify password
-    const validPassword = await verifyPasswordHash(hashedPassword, password);
-    if (!validPassword) throw new AppError({ status: 403, type: 'invalid_password', severity: 'warn' });
-
-    // If email is not verified, send verification email
-    if (!emailVerified) {
-      sendVerificationEmail({ userId: user.id });
-      return ctx.json({ shouldRedirect: true, redirectPath: '/auth/email-verification/signin' }, 200);
-    }
-
-    const redirectPath = await initiateMfa(ctx, user);
-    if (redirectPath) return ctx.json({ shouldRedirect: true, redirectPath }, 200);
-
-    await setUserSession(ctx, user, 'password');
-    return ctx.json({ shouldRedirect: false }, 200);
-  })
-  /*
-   * Check token by id (without consuming it)
-   */
-  .openapi(authRoutes.checkToken, async (ctx) => {
-    // Find token in request
-    const { tokenId } = ctx.req.valid('param');
-    const { type: requiredType } = ctx.req.valid('query');
-
-    // Check if token exists
-    const tokenRecord = await getValidToken({ requiredType, tokenId, consumeToken: false });
-
-    const baseData = {
-      email: tokenRecord.email,
-      role: tokenRecord.role,
-      userId: tokenRecord.userId || '',
-    };
-
-    // If its NOT an organization invitation, return base data
-    if (!tokenRecord.organizationId) return ctx.json(baseData, 200);
-
-    // If it is a membership invitation, check if a new user has been created since invitation was sent (without verifying email)
-    const [existingUser] = await usersBaseQuery().where(eq(usersTable.email, tokenRecord.email));
-    if (!tokenRecord.userId && existingUser) {
-      await db.update(tokensTable).set({ userId: existingUser.id }).where(eq(tokensTable.id, tokenRecord.id));
-      baseData.userId = existingUser.id;
-    }
-
-    // Add organization data to base data
-    const [organization] = await db.select().from(organizationsTable).where(eq(organizationsTable.id, tokenRecord.organizationId));
-    if (!organization) throw new AppError({ status: 404, type: 'not_found', severity: 'warn', entityType: 'organization' });
-
-    const dataWithOrg = {
-      ...baseData,
-      organizationId: organization.id || '',
-      organizationName: organization.name || '',
-      organizationSlug: organization.slug || '',
-    };
-
-    return ctx.json(dataWithOrg, 200);
-  })
-  /*
-   * Accept org invite token for signed in users
-   */
-  .openapi(authRoutes.acceptEntityInvite, async (ctx) => {
-    const user = getContextUser();
-    const token = getContextToken();
-
-    // Make sure its an organization invitation
-    if (!token.entityType) throw new AppError({ status: 401, type: 'invalid_token', severity: 'warn' });
-
-    const [emailData] = await db.select().from(emailsTable).where(eq(emailsTable.email, token.email));
-    // Make sure correct user accepts invitation (for example another user could have a sessions and click on email invite of another user)
-    if (user.id !== token.userId && (!emailData || emailData.userId !== user.id)) {
-      throw new AppError({ status: 401, type: 'user_mismatch', severity: 'warn' });
-    }
-
-    // If userId is not yet set on token, handle membership token update
-    if (emailData.userId === user.id && user.id !== token.userId) await handleMembershipTokenUpdate(user.id, token.id);
-
-    // Activate memberships
-    const activatedMemberships = await db
-      .update(membershipsTable)
-      .set({ tokenId: null, activatedAt: getIsoDate() })
-      .where(and(eq(membershipsTable.tokenId, token.id)))
-      .returning();
-
-    const [targetMembership] = activatedMemberships.sort((a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime());
-    if (!targetMembership) throw new AppError({ status: 500, type: 'membership_not_found', severity: 'error', entityType: token.entityType });
-
-    const entityIdField = appConfig.entityIdFields[token.entityType];
-    if (!targetMembership[entityIdField]) throw new AppError({ status: 404, type: 'not_found', severity: 'warn', entityType: token.entityType });
-
-    const entity = await resolveEntity(token.entityType, targetMembership[entityIdField]);
-    if (!entity) throw new AppError({ status: 404, type: 'not_found', severity: 'warn', entityType: token.entityType });
-
-    eventManager.emit('acceptedMembership', targetMembership);
-
-    return ctx.json({ ...entity, membership: targetMembership }, 200);
-  })
-  /*
-   * Start impersonation
-   */
-  .openapi(authRoutes.startImpersonation, async (ctx) => {
-    const { targetUserId } = ctx.req.valid('query');
-
-    const [user] = await usersBaseQuery().where(eq(usersTable.id, targetUserId)).limit(1);
-
-    if (!user) throw new AppError({ status: 404, type: 'not_found', severity: 'warn', entityType: 'user', meta: { targetUserId } });
-
-    const adminUser = getContextUser();
-    await setUserSession(ctx, user, 'password', 'impersonation');
-
-    logEvent('info', 'Started impersonation', { adminId: adminUser.id, targetUserId });
-
-    return ctx.json(true, 200);
-  })
-  /*
-   * Stop impersonation
-   */
-  .openapi(authRoutes.stopImpersonation, async (ctx) => {
-    const { sessionToken, adminUserId } = await getParsedSessionCookie(ctx, { deleteAfterAttempt: true });
-    const { session } = await validateSession(sessionToken);
-
-    // Only continue if session is impersonation
-    if (!adminUserId) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error' });
-
-    const [adminsLastSession] = await db
-      .select()
-      .from(sessionsTable)
-      .where(eq(sessionsTable.userId, adminUserId))
-      .orderBy(desc(sessionsTable.expiresAt))
-      .limit(1);
-
-    if (isExpiredDate(adminsLastSession.expiresAt)) throw new AppError({ status: 401, type: 'unauthorized', severity: 'warn' });
-
-    const expireTimeSpan = new TimeSpan(adminsLastSession.expiresAt.getTime() - Date.now(), 'ms');
-    const cookieContent = `${adminsLastSession.token}.${adminsLastSession.userId ?? ''}`;
-
-    await setAuthCookie(ctx, 'session', cookieContent, expireTimeSpan);
-
-    logEvent('info', 'Stopped impersonation', { adminId: adminUserId || 'na', targetUserId: session.userId });
-
-    return ctx.json(true, 200);
-  })
-  /*
-   * Sign out
-   */
-  .openapi(authRoutes.signOut, async (ctx) => {
-    const confirmMfa = await getAuthCookie(ctx, 'confirm-mfa');
-
-    if (confirmMfa) {
-      // Delete mfa cookie
-      deleteAuthCookie(ctx, 'confirm-mfa');
-
-      logEvent('info', 'User mfa canceled');
-
-      return ctx.json(true, 200);
-    }
-
-    // Find session & invalidate
-    const { sessionToken } = await getParsedSessionCookie(ctx, { deleteOnError: true, deleteAfterAttempt: true });
-    const { session: currentSession } = await validateSession(sessionToken);
-
-    await db.delete(sessionsTable).where(and(eq(sessionsTable.id, currentSession.id), eq(sessionsTable.userId, currentSession.userId)));
-
-    logEvent('info', 'User signed out', { userId: currentSession.userId });
-
-    return ctx.json(true, 200);
-  })
-  /*
-   * Initiates GitHub OAuth authentication flow
-   */
-  .openapi(authRoutes.github, async (ctx) => {
-    // Generate a `state` to prevent CSRF, and build URL with scope.
-    const state = generateState();
-    const url = githubAuth.createAuthorizationURL(state, githubScopes);
-
-    // Start the OAuth session & flow (Persist `state`)
-    return await handleOAuthInitiation(ctx, 'github', url, state);
-  })
-  /*
-   * Initiates Google OAuth authentication flow
-   */
-  .openapi(authRoutes.google, async (ctx) => {
-    // Generate a `state`, PKCE, and scoped URL.
-    const state = generateState();
-    const codeVerifier = generateCodeVerifier();
-    const url = googleAuth.createAuthorizationURL(state, codeVerifier, googleScopes);
-
-    // Start the OAuth session & flow (Persist `state` and `codeVerifier`)
-    return await handleOAuthInitiation(ctx, 'google', url, state, codeVerifier);
-  })
-  /*
-   * Initiates Microsoft OAuth authentication flow
-   */
-  .openapi(authRoutes.microsoft, async (ctx) => {
-    // Generate a `state`, PKCE, and scoped URL.
-    const state = generateState();
-    const codeVerifier = generateCodeVerifier();
-    const url = microsoftAuth.createAuthorizationURL(state, codeVerifier, microsoftScopes);
-
-    // Start the OAuth session & flow (Persist `state` and `codeVerifier`)
-    return await handleOAuthInitiation(ctx, 'microsoft', url, state, codeVerifier);
-  })
-
-  /*
-   * GitHub callback
-   */
-  .openapi(authRoutes.githubCallback, async (ctx) => {
-    const { code, state, error } = ctx.req.valid('query');
-
-    /*
-     * Handle custom redirect flow (e.g., for external apps or tools):
-     * If `state` includes a `redirectUrl`, redirect there with OAuth params.
-     * Falls back silently if `state` is not a JSON-encoded object.
-     */
-    try {
-      const parsedState = JSON.parse(atob(state));
-      if (parsedState.redirectUrl) return ctx.redirect(`${parsedState.redirectUrl}?code=${code}&state=${state}&error=${error}`, 302);
-    } catch (_) {
-      // Ignore parsing errors; continue with standard OAuth handling
-    }
-
-    // When something went wrong during Github OAuth, fail early.
-    if (error || !code) {
-      throw new AppError({ status: 400, type: 'oauth_failed', severity: 'warn', isRedirect: true });
-    }
-
-    // Check if Github OAuth is enabled
-    const strategy = 'github' as EnabledOAuthProvider;
-
-    if (!isOAuthEnabled(strategy)) {
-      throw new AppError({ status: 400, type: 'unsupported_oauth', severity: 'error', meta: { strategy }, isRedirect: true });
-    }
-
-    // Verify cookie by `state` (CSRF protection)
-    const oauthCookie = await getAuthCookie(ctx, `oauth-${state}`);
-    const cookiePayload: OAuthCookiePayload | null = oauthCookie ? JSON.parse(oauthCookie) : null;
-
-    if (!state || !cookiePayload) {
-      throw new AppError({ status: 401, type: 'invalid_state', severity: 'warn', meta: { strategy }, isRedirect: true });
-    }
-
-    try {
-      // Exchange authorization code for access token and fetch Github user info
-      const githubValidation = await githubAuth.validateAuthorizationCode(code);
-      const accessToken = githubValidation.accessToken();
-
-      const headers = { Authorization: `Bearer ${accessToken}` };
-      const [githubUserResponse, githubUserEmailsResponse] = await Promise.all([
-        fetch('https://api.github.com/user', { headers }),
-        fetch('https://api.github.com/user/emails', { headers }),
-      ]);
-
-      const githubUser = (await githubUserResponse.json()) as GithubUserProps;
-      const githubUserEmails = (await githubUserEmailsResponse.json()) as GithubUserEmailProps[];
-      const providerUser = transformGithubUserData(githubUser, githubUserEmails);
-
-      // TODO is it a good idea to have this inside the try catch too?
-      return await handleOAuthCallback(ctx, providerUser, strategy, cookiePayload);
-    } catch (error) {
-      if (error instanceof AppError) throw error;
-
-      // Handle known OAuth validation errors (e.g. bad token, revoked code)
-      const type = error instanceof OAuth2RequestError ? 'invalid_credentials' : 'oauth_failed';
-      throw new AppError({
-        status: 401,
-        type,
-        severity: 'warn',
-        meta: { strategy },
-        isRedirect: true,
-        ...(error instanceof Error ? { originalError: error } : {}),
-      });
-    }
-  })
-
-  /*
-   * Google callback
-   */
-  .openapi(authRoutes.googleCallback, async (ctx) => {
-    const { state, code } = ctx.req.valid('query');
-
-    // Check if Google OAuth is enabled
-    const strategy = 'google' as EnabledOAuthProvider;
-    if (!isOAuthEnabled(strategy)) {
-      throw new AppError({ status: 400, type: 'unsupported_oauth', severity: 'error', meta: { strategy }, isRedirect: true });
-    }
-
-    // Verify cookie by `state` (CSRF protection) & PKCE validation
-    const oauthCookie = await getAuthCookie(ctx, `oauth-${state}`);
-    const cookiePayload: OAuthCookiePayload | null = oauthCookie ? JSON.parse(oauthCookie) : null;
-
-    if (!code || !cookiePayload || !cookiePayload.codeVerifier) {
-      throw new AppError({ status: 401, type: 'invalid_state', severity: 'warn', meta: { strategy }, isRedirect: true });
-    }
-
-    try {
-      // Exchange authorization code for access token and fetch Google user info
-      const googleValidation = await googleAuth.validateAuthorizationCode(code, cookiePayload.codeVerifier);
-      const accessToken = googleValidation.accessToken();
-
-      const headers = { Authorization: `Bearer ${accessToken}` };
-      const response = await fetch('https://openidconnect.googleapis.com/v1/userinfo', { headers });
-      const googleUser = (await response.json()) as GoogleUserProps;
-      const providerUser = transformSocialUserData(googleUser);
-
-      return await handleOAuthCallback(ctx, providerUser, strategy, cookiePayload);
-    } catch (error) {
-      if (error instanceof AppError) throw error;
-
-      // Handle known OAuth validation errors (e.g. bad token, revoked code)
-      const type = error instanceof OAuth2RequestError ? 'invalid_credentials' : 'oauth_failed';
-      throw new AppError({
-        status: 401,
-        type,
-        severity: 'warn',
-        meta: { strategy },
-        isRedirect: true,
-        ...(error instanceof Error ? { originalError: error } : {}),
-      });
-    }
-  })
-  /*
-   * Microsoft callback
-   */
-  .openapi(authRoutes.microsoftCallback, async (ctx) => {
-    const { state, code } = ctx.req.valid('query');
-
-    // Check if Microsoft OAuth is enabled
-    const strategy = 'microsoft' as EnabledOAuthProvider;
-    if (!isOAuthEnabled(strategy)) {
-      throw new AppError({ status: 400, type: 'unsupported_oauth', severity: 'error', meta: { strategy }, isRedirect: true });
-    }
-
-    // Verify cookie by `state` (CSRF protection) & PKCE validation
-    const oauthCookie = await getAuthCookie(ctx, `oauth-${state}`);
-    const cookiePayload: OAuthCookiePayload | null = oauthCookie ? JSON.parse(oauthCookie) : null;
-
-    if (!code || !cookiePayload || !cookiePayload.codeVerifier) {
-      throw new AppError({ status: 401, type: 'invalid_state', severity: 'warn', meta: { strategy }, isRedirect: true });
-    }
-
-    try {
-      // Exchange authorization code for access token and fetch Microsoft user info
-      const microsoftValidation = await microsoftAuth.validateAuthorizationCode(code, cookiePayload.codeVerifier);
-      const accessToken = microsoftValidation.accessToken();
-
-      const headers = { Authorization: `Bearer ${accessToken}` };
-      const response = await fetch('https://graph.microsoft.com/oidc/userinfo', { headers });
-      const microsoftUser = (await response.json()) as MicrosoftUserProps;
-      const providerUser = transformSocialUserData(microsoftUser);
-
-      return await handleOAuthCallback(ctx, providerUser, strategy, cookiePayload);
-    } catch (error) {
-      if (error instanceof AppError) throw error;
-
-      // Handle known OAuth validation errors (e.g. bad token, revoked code)
-      const type = error instanceof OAuth2RequestError ? 'invalid_credentials' : 'oauth_failed';
-      throw new AppError({
-        status: 401,
-        type,
-        severity: 'warn',
-        meta: { strategy },
-        isRedirect: true,
-        ...(error instanceof Error ? { originalError: error } : {}),
-      });
-    }
-  })
-  /*
-   * Passkey challenge
-   */
-  .openapi(authRoutes.createPasskeyChallenge, async (ctx) => {
-    const { email, type } = ctx.req.valid('json');
-
-    // Generate a 32-byte random challenge and encode it as Base64
-    const challenge = getRandomValues(new Uint8Array(32));
-    const challengeBase64 = encodeBase64(challenge);
-
-    // Save the challenge in a short-lived cookie (5 minutes)
-    await setAuthCookie(ctx, 'passkey-challenge', challengeBase64, new TimeSpan(5, 'm'));
-
-    let user: UserModel | null = null;
-
-    // Find user by email if provided
-    if (email && type === 'authentication') {
-      const normalizedEmail = email.toLowerCase().trim();
-
-      const [tableUser] = await usersBaseQuery()
-        .leftJoin(emailsTable, eq(usersTable.id, emailsTable.userId))
-        .where(eq(emailsTable.email, normalizedEmail))
-        .limit(1);
-
-      user = tableUser;
-    }
-    // If this is a multifactor request, retrieve user from pending MFA token
-    if (type === 'mfa') {
-      const userFromToken = await validateConfirmMfaToken(ctx);
-      user = userFromToken;
-    }
-
-    // If we still have no email, return challenge with empty credential list
-    if (!user) return ctx.json({ challengeBase64, credentialIds: [] }, 200);
-
-    // Fetch all passkey credentials for this user
-    const credentials = await db.select({ credentialId: passkeysTable.credentialId }).from(passkeysTable).where(eq(passkeysTable.userId, user.id));
-
-    const credentialIds = credentials.map((c) => c.credentialId);
-
-    return ctx.json({ challengeBase64, credentialIds }, 200);
-  })
-  /*
-   * Signin using passkey
-   */
-  .openapi(authRoutes.signInWithPasskey, async (ctx) => {
-    const { clientDataJSON, authenticatorData, signature, credentialId, email, type } = ctx.req.valid('json');
-    // Define strategy and session type for metadata/logging purposes
-    const meta = { strategy: 'passkey', sessionType: type === 'mfa' ? 'mfa' : 'regular' } as const;
-
-    if (type === 'authentication' && !enabledStrategies.includes(meta.strategy)) {
-      throw new AppError({ status: 400, type: 'forbidden_strategy', severity: 'error', meta });
-    }
-
-    let user: UserModel | null = null;
-
-    // Find user by email if provided
-    if (email) {
-      const normalizedEmail = email.toLowerCase().trim();
-
-      const [tableUser] = await usersBaseQuery()
-        .leftJoin(emailsTable, eq(usersTable.id, emailsTable.userId))
-        .where(eq(emailsTable.email, normalizedEmail))
-        .limit(1);
-
-      user = tableUser;
-    }
-
-    // Override user if this is a multifactor authentication
-    if (type === 'mfa') {
-      const userFromToken = await validateConfirmMfaToken(ctx);
-      user = userFromToken;
-    }
-
-    // Fail early if user not found
-    if (!user) throw new AppError({ status: 404, type: 'not_found', severity: 'warn', entityType: 'user', meta });
-
-    // Retrieve the passkey challenge from cookie
-    const challengeFromCookie = await getAuthCookie(ctx, 'passkey-challenge');
-    if (!challengeFromCookie) throw new AppError({ status: 401, type: 'invalid_credentials', severity: 'warn', meta });
-
-    // Get passkey credentials
-    const [passkeyRecord] = await db
-      .select()
-      .from(passkeysTable)
-      .where(and(eq(passkeysTable.userId, user.id), eq(passkeysTable.credentialId, credentialId)))
-      .limit(1);
-
-    if (!passkeyRecord) throw new AppError({ status: 404, type: 'passkey_not_found', severity: 'warn', meta });
-
-    try {
-      const isValid = await verifyPassKeyPublic(signature, authenticatorData, clientDataJSON, passkeyRecord.publicKey, challengeFromCookie);
-      if (!isValid) throw new AppError({ status: 401, type: 'invalid_token', severity: 'warn', meta });
-    } catch (error) {
-      if (error instanceof AppError) throw error;
-
-      throw new AppError({
-        status: 500,
-        type: 'passkey_verification_failed',
-        severity: 'error',
-        meta,
-        ...(error instanceof Error ? { originalError: error } : {}),
-      });
-    }
-
-    // Consume the MFA token now that TOTP verification succeeded
-    await consumeMfaToken(ctx);
-    // Set user session after successful verification
-    await setUserSession(ctx, user, meta.strategy, meta.sessionType);
-
-    return ctx.json(true, 200);
-  })
-  /*
-   * Verify TOTP
-   */
-  .openapi(authRoutes.verifyTotp, async (ctx) => {
-    const { code } = ctx.req.valid('json');
-
-    const strategy = 'totp';
-
-    // Verify if strategy allowed
-    if (!enabledStrategies.includes(strategy)) {
-      throw new AppError({ status: 400, type: 'forbidden_strategy', severity: 'error', meta: { strategy } });
-    }
-
-    // Define strategy and session type for metadata/logging purposes
-    const meta = { strategy, sessionType: 'mfa' } as const;
-
-    // Validate MFA token and retrieve user
-    const user = await validateConfirmMfaToken(ctx);
-
-    // Get totp credentials
-    const [credentials] = await db.select().from(totpsTable).where(eq(totpsTable.userId, user.id)).limit(1);
-    if (!credentials) throw new AppError({ status: 404, type: 'not_found', severity: 'warn', meta });
-
-    try {
-      // Verify TOTP code using stored secret
-      const isValid = verifyTotp(code, credentials.secret);
-      if (!isValid) throw new AppError({ status: 401, type: 'invalid_token', severity: 'warn', meta });
-    } catch (error) {
-      if (error instanceof AppError) throw error;
-
-      throw new AppError({
-        status: 500,
-        type: 'totp_verification_failed',
-        severity: 'error',
-        meta,
-        ...(error instanceof Error ? { originalError: error } : {}),
-      });
-    }
-
-    // Consume the MFA token now that TOTP verification succeeded
-    await consumeMfaToken(ctx);
-
-    // Set user session after successful verification
-    await setUserSession(ctx, user, meta.strategy, meta.sessionType);
-
-    return ctx.json(true, 200);
-  });
-export default authRouteHandlers;
diff --git a/backend/src/modules/auth/helpers/cookie.ts b/backend/src/modules/auth/helpers/cookie.ts
index f39c82cca..b7cdc2ee3 100644
--- a/backend/src/modules/auth/helpers/cookie.ts
+++ b/backend/src/modules/auth/helpers/cookie.ts
@@ -1,13 +1,22 @@
-import { appConfig } from 'config';
+import { appConfig, TokenType } from 'config';
 import type { Context } from 'hono';
 import { deleteCookie, getCookie, getSignedCookie, setCookie, setSignedCookie } from 'hono/cookie';
 import type { CookieOptions } from 'hono/utils/cookie';
+import { Env } from '#/lib/context';
 import type { TimeSpan } from '#/utils/time-span';
 import { env } from '../../../env';
 
 const isProduction = appConfig.mode === 'production';
-
-type CookieName = 'session' | 'confirm-mfa' | 'totp-key' | 'passkey-challenge' | `oauth-${string}`;
+// TODO make underscore consistent in cookie names
+type CookieName =
+  | TokenType
+  | 'session'
+  | 'totp-key'
+  | 'passkey-challenge'
+  | `oauth-${string}`
+  | 'email-verification'
+  | 'invitation'
+  | 'password-reset';
 
 /**
  * Sets an authentication cookie.
@@ -17,7 +26,7 @@ type CookieName = 'session' | 'confirm-mfa' | 'totp-key' | 'passkey-challenge' |
  * @param content - Content to store in the cookie.
  * @param timeSpan - Duration for which the cookie is valid.
  */
-export const setAuthCookie = async (ctx: Context, name: CookieName, content: string, timeSpan: TimeSpan) => {
+export const setAuthCookie = async (ctx: Context<Env>, name: CookieName, content: string, timeSpan: TimeSpan) => {
   const versionedName = `${appConfig.slug}-${name}-${appConfig.cookieVersion}`;
   const options = {
     secure: appConfig.mode !== 'development',
@@ -37,7 +46,7 @@ export const setAuthCookie = async (ctx: Context, name: CookieName, content: str
  * @param name - Cookie name.
  * @returns The content stored in the cookie.
  */
-export const getAuthCookie = async (ctx: Context, name: CookieName) => {
+export const getAuthCookie = async (ctx: Context<Env>, name: CookieName) => {
   const versionedName = `${appConfig.slug}-${name}-${appConfig.cookieVersion}`;
 
   const content = isProduction ? await getSignedCookie(ctx, env.COOKIE_SECRET, versionedName) : getCookie(ctx, versionedName);
@@ -51,7 +60,7 @@ export const getAuthCookie = async (ctx: Context, name: CookieName) => {
  * @param name - Cookie name.
  * @returns Deleted value
  */
-export const deleteAuthCookie = (ctx: Context, name: CookieName) => {
+export const deleteAuthCookie = (ctx: Context<Env>, name: CookieName) => {
   const versionedName = `${appConfig.slug}-${name}-${appConfig.cookieVersion}`;
 
   return deleteCookie(ctx, versionedName, {
diff --git a/backend/src/modules/auth/helpers/handle-email-verification.ts b/backend/src/modules/auth/helpers/handle-email-verification.ts
new file mode 100644
index 000000000..704c5018f
--- /dev/null
+++ b/backend/src/modules/auth/helpers/handle-email-verification.ts
@@ -0,0 +1,47 @@
+import { appConfig } from 'config';
+import { and, eq } from 'drizzle-orm';
+import { Context } from 'hono';
+import { db } from '#/db/db';
+import { emailsTable } from '#/db/schema/emails';
+import type { TokenModel } from '#/db/schema/tokens';
+import { usersTable } from '#/db/schema/users';
+import { Env } from '#/lib/context';
+import { AppError } from '#/lib/errors';
+import { usersBaseQuery } from '#/modules/users/helpers/select';
+import { getIsoDate } from '#/utils/iso-date';
+import { initiateMfa } from './mfa';
+import { setUserSession } from './session';
+
+export const handleEmailVerification = async (ctx: Context<Env>, token: TokenModel) => {
+  // Token requires userId
+  if (!token.userId) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error' });
+
+  // Get user
+  const [user] = await usersBaseQuery().where(eq(usersTable.id, token.userId)).limit(1);
+  if (!user) throw new AppError({ status: 404, type: 'not_found', severity: 'error', entityType: 'user', meta: { userId: token.userId } });
+
+  // Set email verified if it exists
+  await db
+    .update(emailsTable)
+    .set({ verified: true, verifiedAt: getIsoDate() })
+    .where(
+      and(
+        eq(emailsTable.tokenId, token.id),
+        eq(emailsTable.userId, token.userId),
+        eq(emailsTable.email, token.email),
+        eq(emailsTable.verified, false),
+      ),
+    );
+
+  // Start MFA challenge if the user has MFA enabled
+  const mfaRedirectPath = await initiateMfa(ctx, user);
+
+  // Determine redirect path
+  const redirectPath = mfaRedirectPath || appConfig.defaultRedirectPath;
+  const redirectUrl = new URL(redirectPath, appConfig.frontendUrl);
+
+  // If MFA is not required, set user session immediately
+  if (!mfaRedirectPath) await setUserSession(ctx, user, 'email');
+
+  return ctx.redirect(redirectUrl, 302);
+};
diff --git a/backend/src/modules/auth/helpers/mfa.ts b/backend/src/modules/auth/helpers/mfa.ts
index 5157710e1..5ef857367 100644
--- a/backend/src/modules/auth/helpers/mfa.ts
+++ b/backend/src/modules/auth/helpers/mfa.ts
@@ -3,12 +3,13 @@ import type { Context } from 'hono';
 import { db } from '#/db/db';
 import { tokensTable } from '#/db/schema/tokens';
 import { type UserModel, usersTable } from '#/db/schema/users';
+import { Env } from '#/lib/context';
 import { AppError } from '#/lib/errors';
 import { deleteAuthCookie, getAuthCookie, setAuthCookie } from '#/modules/auth/helpers/cookie';
 import { usersBaseQuery } from '#/modules/users/helpers/select';
+import { getValidToken } from '#/utils/get-valid-token';
 import { nanoid } from '#/utils/nanoid';
 import { createDate, TimeSpan } from '#/utils/time-span';
-import { getValidToken } from '#/utils/validate-token';
 
 /**
  * Starts a two-factor authentication challenge for a user.
@@ -19,7 +20,7 @@ import { getValidToken } from '#/utils/validate-token';
  * @param user - User to start MFA for
  * @returns Redirect path to MFA confirmation page, or null if MFA is not enabled
  */
-export const initiateMfa = async (ctx: Context, user: UserModel) => {
+export const initiateMfa = async (ctx: Context<Env>, user: UserModel) => {
   // If the user does not have MFA enabled, do nothing
   if (!user.mfaRequired) return null;
 
@@ -38,7 +39,7 @@ export const initiateMfa = async (ctx: Context, user: UserModel) => {
     .returning({ token: tokensTable.id });
 
   // Set a temporary auth cookie to track confirm MFA session
-  await setAuthCookie(ctx, 'confirm-mfa', generatedTokenId, timespan);
+  await setAuthCookie(ctx, 'confirm_mfa', generatedTokenId, timespan);
 
   // Return the path to redirect the user to MFA confirmation page
   return '/auth/authenticate/mfa-confirmation';
@@ -51,37 +52,38 @@ export const initiateMfa = async (ctx: Context, user: UserModel) => {
  * @returns UserModel
  * @throws AppError if token is missing, not found, or expired
  */
-export const validateConfirmMfaToken = async (ctx: Context): Promise<UserModel> => {
-  // Get token ID from cookie
-  const tokenIdFromCookie = await getAuthCookie(ctx, 'confirm-mfa');
-  if (!tokenIdFromCookie) throw new AppError({ status: 401, type: 'invalid_credentials', severity: 'error' });
+export const validateConfirmMfaToken = async (ctx: Context<Env>): Promise<UserModel> => {
+  // TODO should be token itself, Get token ID from cookie
+  const tokenIdFromCookie = await getAuthCookie(ctx, 'confirm_mfa');
+  if (!tokenIdFromCookie) throw new AppError({ status: 401, type: 'confirm_mfa_not_found', severity: 'error' });
 
   // Fetch token record and associated user
-  const tokenRecord = await getValidToken({ requiredType: 'confirm_mfa', consumeToken: false, tokenId: tokenIdFromCookie });
+  const tokenRecord = await getValidToken({ token: tokenIdFromCookie, consumeToken: false, tokenType: 'confirm_mfa' });
 
-  if (!tokenRecord.userId) throw new AppError({ status: 404, type: 'confirm_mfa_not_found', severity: 'warn' });
+  // Sanity check
+  if (!tokenRecord.userId) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error' });
 
   const [user] = await usersBaseQuery().where(eq(usersTable.id, tokenRecord.userId)).limit(1);
-
-  if (!user) throw new AppError({ status: 404, type: 'confirm_mfa_not_found', severity: 'warn' });
+  if (!user) throw new AppError({ status: 404, type: 'not_found', entityType: 'user', severity: 'error' });
 
   return user;
 };
 
 /**
- * Consumes the MFA token stored in the 'confirm-mfa' cookie.
+ * Consumes the MFA token stored in the 'confirm_mfa' cookie.
  * Marks it as used in the database and deletes the cookie.
  */
-export const consumeMfaToken = async (ctx: Context): Promise<void> => {
-  const tokenIdFromCookie = await getAuthCookie(ctx, 'confirm-mfa');
+// TODO shouldnt this use getValidToken for consistency? Or be a middleware?
+export const consumeMfaToken = async (ctx: Context<Env>): Promise<void> => {
+  const tokenIdFromCookie = await getAuthCookie(ctx, 'confirm_mfa');
   if (!tokenIdFromCookie) return;
 
   const [tokenRecord] = await db.select().from(tokensTable).where(eq(tokensTable.id, tokenIdFromCookie)).limit(1);
   if (!tokenRecord) return;
 
   // Mark token as consumed
-  await db.update(tokensTable).set({ consumedAt: new Date() }).where(eq(tokensTable.id, tokenRecord.id));
+  await db.update(tokensTable).set({ invokedAt: new Date() }).where(eq(tokensTable.id, tokenRecord.id));
 
   // Delete cookie
-  deleteAuthCookie(ctx, 'confirm-mfa');
+  deleteAuthCookie(ctx, 'confirm_mfa');
 };
diff --git a/backend/src/modules/auth/helpers/send-verification-email.ts b/backend/src/modules/auth/helpers/send-verification-email.ts
index c6ffb0134..e78515715 100644
--- a/backend/src/modules/auth/helpers/send-verification-email.ts
+++ b/backend/src/modules/auth/helpers/send-verification-email.ts
@@ -26,6 +26,7 @@ interface Props {
  * 1. Regular email verification (no oauthAccountId): user verifies their email address
  * 2. OAuth email verification (with oauthAccountId): user verifies by email to connect an OAuth account
  */
+// TODO perhaps split or consider refactoring
 export const sendVerificationEmail = async ({ userId, oauthAccountId, redirectPath }: Props) => {
   const [user] = await usersBaseQuery().where(eq(usersTable.id, userId)).limit(1);
 
@@ -95,15 +96,9 @@ export const sendVerificationEmail = async ({ userId, oauthAccountId, redirectPa
   const lng = user.language;
 
   // Create verification link: go to
-  const verifyPath = !oauthAccount ? `/auth/verify-email/${tokenRecord.token}` : `/auth/${oauthAccount.providerId}`;
-  const verificationURL = new URL(verifyPath, appConfig.backendAuthUrl);
+  const verifyPath = `/auth/consume-token/${tokenRecord.token}`;
+  const verificationURL = new URL(verifyPath, appConfig.backendUrl);
 
-  // Add query params to pass through OAuth verification
-  if (oauthAccount) {
-    verificationURL.searchParams.set('tokenId', tokenRecord.id);
-    verificationURL.searchParams.set('token', tokenRecord.token);
-    verificationURL.searchParams.set('type', 'verify');
-  }
   if (redirectPath) verificationURL.searchParams.set('redirect', encodeURIComponent(redirectPath));
 
   // Prepare & send email
@@ -114,7 +109,7 @@ export const sendVerificationEmail = async ({ userId, oauthAccountId, redirectPa
   type Recipient = { email: string };
 
   if (oauthAccount) {
-    const staticOAuthProps = { ...staticProps, providerEmail: oauthAccount.email, providerName: oauthAccount.providerId };
+    const staticOAuthProps = { ...staticProps, providerEmail: oauthAccount.email, providerName: oauthAccount.provider };
     mailer.prepareEmails<OAuthVerificationEmailProps, Recipient>(OAuthVerificationEmail, staticOAuthProps, recipients);
   } else {
     mailer.prepareEmails<EmailVerificationEmailProps, Recipient>(EmailVerificationEmail, staticProps, recipients);
diff --git a/backend/src/modules/auth/helpers/session.ts b/backend/src/modules/auth/helpers/session.ts
index 7135eb691..a730ea22e 100644
--- a/backend/src/modules/auth/helpers/session.ts
+++ b/backend/src/modules/auth/helpers/session.ts
@@ -5,7 +5,7 @@ import { db } from '#/db/db';
 import { type AuthStrategy, type SessionModel, type SessionTypes, sessionsTable } from '#/db/schema/sessions';
 import { type UserModel, usersTable } from '#/db/schema/users';
 import { env } from '#/env';
-import { getContextUser } from '#/lib/context';
+import { Env, getContextUser } from '#/lib/context';
 import { AppError } from '#/lib/errors';
 import { deleteAuthCookie, getAuthCookie, setAuthCookie } from '#/modules/auth/helpers/cookie';
 import { deviceInfo } from '#/modules/auth/helpers/device-info';
@@ -23,7 +23,7 @@ import { createDate, TimeSpan } from '#/utils/time-span';
  * Sets a user session and stores it in the database.
  * Generates a session token, records device information, and optionally associates an admin user for impersonation.
  */
-export const setUserSession = async (ctx: Context, user: UserModel, strategy: AuthStrategy, type: SessionTypes = 'regular'): Promise<void> => {
+export const setUserSession = async (ctx: Context<Env>, user: UserModel, strategy: AuthStrategy, type: SessionTypes = 'regular'): Promise<void> => {
   if (user.role === 'admin' || type === 'impersonation') {
     const ip = getIp(ctx);
     const allowList = (env.REMOTE_SYSTEM_ACCESS_IP ?? '').split(',');
@@ -103,7 +103,10 @@ type ParseSessionCookieOptions = {
   deleteAfterAttempt?: boolean;
 };
 
-export const getParsedSessionCookie = async (ctx: Context, options?: ParseSessionCookieOptions): Promise<z.infer<typeof sessionCookieSchema>> => {
+export const getParsedSessionCookie = async (
+  ctx: Context<Env>,
+  options?: ParseSessionCookieOptions,
+): Promise<z.infer<typeof sessionCookieSchema>> => {
   const { redirectOnError = false, deleteOnError = false, deleteAfterAttempt = false } = options ?? {};
   try {
     // Retrieve session cookie data
diff --git a/backend/src/modules/auth/helpers/totps.ts b/backend/src/modules/auth/helpers/totps.ts
index c60b9a0c6..a0210b3cf 100644
--- a/backend/src/modules/auth/helpers/totps.ts
+++ b/backend/src/modules/auth/helpers/totps.ts
@@ -14,7 +14,7 @@ const { intervalInSeconds, digits, gracePeriodInSeconds } = appConfig.totpConfig
  * @param {string} secret - The Base32-encoded shared secret.
  * @returns {boolean} - Returns `true` if the OTP is valid within the grace period, otherwise `false`.
  */
-export const verifyTotp = (otp: string, secret: string): boolean => {
+export const signInWithTotp = (otp: string, secret: string): boolean => {
   const secretBytes = decodeBase32(secret);
 
   return verifyTOTPWithGracePeriod(secretBytes, intervalInSeconds, digits, otp, gracePeriodInSeconds);
diff --git a/backend/src/modules/auth/helpers/user.ts b/backend/src/modules/auth/helpers/user.ts
index 40159403e..328061a97 100644
--- a/backend/src/modules/auth/helpers/user.ts
+++ b/backend/src/modules/auth/helpers/user.ts
@@ -35,7 +35,7 @@ export const handleCreateUser = async ({ newUser, membershipInviteTokenId, email
   const [inviteToken] = await db
     .select()
     .from(tokensTable)
-    .where(and(eq(tokensTable.email, newUser.email), eq(tokensTable.type, 'invitation'), isNull(tokensTable.userId), isNull(tokensTable.consumedAt)));
+    .where(and(eq(tokensTable.email, newUser.email), eq(tokensTable.type, 'invitation'), isNull(tokensTable.userId), isNull(tokensTable.invokedAt)));
 
   if (!membershipInviteTokenId && inviteToken) throw new AppError({ status: 403, type: 'invite_takes_priority', severity: 'warn' });
 
diff --git a/backend/src/modules/auth/oauth/handlers.ts b/backend/src/modules/auth/oauth/handlers.ts
new file mode 100644
index 000000000..71608eb35
--- /dev/null
+++ b/backend/src/modules/auth/oauth/handlers.ts
@@ -0,0 +1,246 @@
+import { OpenAPIHono } from '@hono/zod-openapi';
+import { generateCodeVerifier, generateState, OAuth2RequestError } from 'arctic';
+import { appConfig, type EnabledOAuthProvider } from 'config';
+import { env } from '#/env';
+import { type Env } from '#/lib/context';
+import { AppError } from '#/lib/errors';
+import { getAuthCookie } from '#/modules/auth/helpers/cookie';
+import { handleOAuthCallback } from '#/modules/auth/oauth/helpers/callback';
+import { handleOAuthInitiation, type OAuthCookiePayload } from '#/modules/auth/oauth/helpers/initiation';
+import {
+  type GithubUserEmailProps,
+  type GithubUserProps,
+  type GoogleUserProps,
+  githubAuth,
+  googleAuth,
+  type MicrosoftUserProps,
+  microsoftAuth,
+} from '#/modules/auth/oauth/helpers/providers';
+import { transformGithubUserData, transformSocialUserData } from '#/modules/auth/oauth/helpers/transform-user-data';
+import { defaultHook } from '#/utils/default-hook';
+import authOAuthRoutes from './routes';
+
+const enabledStrategies: readonly string[] = appConfig.enabledAuthStrategies;
+const enabledOAuthProviders: readonly string[] = appConfig.enabledOAuthProviders;
+
+// Scopes for OAuth providers
+const githubScopes = ['user:email'];
+const googleScopes = ['profile', 'email'];
+const microsoftScopes = ['profile', 'email'];
+
+// When no microsoft tenant is configured, we use common with openid scope
+if (!env.MICROSOFT_TENANT_ID) {
+  microsoftScopes.push('openid');
+}
+
+// Check if oauth provider is enabled by appConfig
+function isOAuthEnabled(provider: EnabledOAuthProvider): boolean {
+  if (!enabledStrategies.includes('oauth')) return false;
+  return enabledOAuthProviders.includes(provider);
+}
+
+// TODO make this generic for all modules?
+const app = new OpenAPIHono<Env>({ defaultHook });
+
+const authOAuthRouteHandlers = app
+
+  /*
+   * Initiates GitHub OAuth authentication flow
+   */
+  .openapi(authOAuthRoutes.github, async (ctx) => {
+    // Generate a `state` to prevent CSRF, and build URL with scope.
+    const state = generateState();
+    const url = githubAuth.createAuthorizationURL(state, githubScopes);
+
+    // Start the OAuth session & flow (Persist `state`)
+    return await handleOAuthInitiation(ctx, 'github', url, state);
+  })
+  /*
+   * Initiates Google OAuth authentication flow
+   */
+  .openapi(authOAuthRoutes.google, async (ctx) => {
+    // Generate a `state`, PKCE, and scoped URL.
+    const state = generateState();
+    const codeVerifier = generateCodeVerifier();
+    const url = googleAuth.createAuthorizationURL(state, codeVerifier, googleScopes);
+
+    // Start the OAuth session & flow (Persist `state` and `codeVerifier`)
+    return await handleOAuthInitiation(ctx, 'google', url, state, codeVerifier);
+  })
+  /*
+   * Initiates Microsoft OAuth authentication flow
+   */
+  .openapi(authOAuthRoutes.microsoft, async (ctx) => {
+    // Generate a `state`, PKCE, and scoped URL.
+    const state = generateState();
+    const codeVerifier = generateCodeVerifier();
+    const url = microsoftAuth.createAuthorizationURL(state, codeVerifier, microsoftScopes);
+
+    // Start the OAuth session & flow (Persist `state` and `codeVerifier`)
+    return await handleOAuthInitiation(ctx, 'microsoft', url, state, codeVerifier);
+  })
+
+  /*
+   * GitHub callback
+   */
+  .openapi(authOAuthRoutes.githubCallback, async (ctx) => {
+    const { code, state, error } = ctx.req.valid('query');
+
+    /*
+     * Handle custom redirect flow (e.g., for external apps or tools):
+     * If `state` includes a `redirectUrl`, redirect there with OAuth params.
+     * Falls back silently if `state` is not a JSON-encoded object.
+     */
+    try {
+      const parsedState = JSON.parse(atob(state));
+      if (parsedState.redirectUrl) return ctx.redirect(`${parsedState.redirectUrl}?code=${code}&state=${state}&error=${error}`, 302);
+    } catch (_) {
+      // Ignore parsing errors; continue with standard OAuth handling
+    }
+
+    // When something went wrong during Github OAuth, fail early.
+    if (error || !code) {
+      throw new AppError({ status: 400, type: 'oauth_failed', severity: 'warn', isRedirect: true });
+    }
+
+    // Check if Github OAuth is enabled
+    const strategy = 'github' as EnabledOAuthProvider;
+
+    if (!isOAuthEnabled(strategy)) {
+      throw new AppError({ status: 400, type: 'unsupported_oauth', severity: 'error', meta: { strategy }, isRedirect: true });
+    }
+
+    // Verify cookie by `state` (CSRF protection)
+    const oauthCookie = await getAuthCookie(ctx, `oauth-${state}`);
+    const cookiePayload: OAuthCookiePayload | null = oauthCookie ? JSON.parse(oauthCookie) : null;
+
+    if (!state || !cookiePayload) {
+      throw new AppError({ status: 401, type: 'invalid_state', severity: 'warn', meta: { strategy }, isRedirect: true });
+    }
+
+    try {
+      // Exchange authorization code for access token and fetch Github user info
+      const githubValidation = await githubAuth.validateAuthorizationCode(code);
+      const accessToken = githubValidation.accessToken();
+
+      const headers = { Authorization: `Bearer ${accessToken}` };
+      const [githubUserResponse, githubUserEmailsResponse] = await Promise.all([
+        fetch('https://api.github.com/user', { headers }),
+        fetch('https://api.github.com/user/emails', { headers }),
+      ]);
+
+      const githubUser = (await githubUserResponse.json()) as GithubUserProps;
+      const githubUserEmails = (await githubUserEmailsResponse.json()) as GithubUserEmailProps[];
+      const providerUser = transformGithubUserData(githubUser, githubUserEmails);
+
+      // TODO is it a good idea to have this inside the try catch too?
+      return await handleOAuthCallback(ctx, providerUser, strategy, cookiePayload);
+    } catch (error) {
+      if (error instanceof AppError) throw error;
+
+      // Handle known OAuth validation errors (e.g. bad token, revoked code)
+      const type = error instanceof OAuth2RequestError ? 'invalid_credentials' : 'oauth_failed';
+      throw new AppError({
+        status: 401,
+        type,
+        severity: 'warn',
+        meta: { strategy },
+        isRedirect: true,
+        ...(error instanceof Error ? { originalError: error } : {}),
+      });
+    }
+  })
+
+  /*
+   * Google callback
+   */
+  .openapi(authOAuthRoutes.googleCallback, async (ctx) => {
+    const { state, code } = ctx.req.valid('query');
+
+    // Check if Google OAuth is enabled
+    const strategy = 'google' as EnabledOAuthProvider;
+    if (!isOAuthEnabled(strategy)) {
+      throw new AppError({ status: 400, type: 'unsupported_oauth', severity: 'error', meta: { strategy }, isRedirect: true });
+    }
+
+    // Verify cookie by `state` (CSRF protection) & PKCE validation
+    const oauthCookie = await getAuthCookie(ctx, `oauth-${state}`);
+    const cookiePayload: OAuthCookiePayload | null = oauthCookie ? JSON.parse(oauthCookie) : null;
+
+    if (!code || !cookiePayload || !cookiePayload.codeVerifier) {
+      throw new AppError({ status: 401, type: 'invalid_state', severity: 'warn', meta: { strategy }, isRedirect: true });
+    }
+
+    try {
+      // Exchange authorization code for access token and fetch Google user info
+      const googleValidation = await googleAuth.validateAuthorizationCode(code, cookiePayload.codeVerifier);
+      const accessToken = googleValidation.accessToken();
+
+      const headers = { Authorization: `Bearer ${accessToken}` };
+      const response = await fetch('https://openidconnect.googleapis.com/v1/userinfo', { headers });
+      const googleUser = (await response.json()) as GoogleUserProps;
+      const providerUser = transformSocialUserData(googleUser);
+
+      return await handleOAuthCallback(ctx, providerUser, strategy, cookiePayload);
+    } catch (error) {
+      if (error instanceof AppError) throw error;
+
+      // Handle known OAuth validation errors (e.g. bad token, revoked code)
+      const type = error instanceof OAuth2RequestError ? 'invalid_credentials' : 'oauth_failed';
+      throw new AppError({
+        status: 401,
+        type,
+        severity: 'warn',
+        meta: { strategy },
+        isRedirect: true,
+        ...(error instanceof Error ? { originalError: error } : {}),
+      });
+    }
+  })
+  /*
+   * Microsoft callback
+   */
+  .openapi(authOAuthRoutes.microsoftCallback, async (ctx) => {
+    const { state, code } = ctx.req.valid('query');
+
+    // Check if Microsoft OAuth is enabled
+    const strategy = 'microsoft' as EnabledOAuthProvider;
+    if (!isOAuthEnabled(strategy)) {
+      throw new AppError({ status: 400, type: 'unsupported_oauth', severity: 'error', meta: { strategy }, isRedirect: true });
+    }
+
+    // Verify cookie by `state` (CSRF protection) & PKCE validation
+    const oauthCookie = await getAuthCookie(ctx, `oauth-${state}`);
+    const cookiePayload: OAuthCookiePayload | null = oauthCookie ? JSON.parse(oauthCookie) : null;
+
+    if (!code || !cookiePayload || !cookiePayload.codeVerifier) {
+      throw new AppError({ status: 401, type: 'invalid_state', severity: 'warn', meta: { strategy }, isRedirect: true });
+    }
+
+    try {
+      // Exchange authorization code for access token and fetch Microsoft user info
+      const microsoftValidation = await microsoftAuth.validateAuthorizationCode(code, cookiePayload.codeVerifier);
+      const accessToken = microsoftValidation.accessToken();
+
+      const headers = { Authorization: `Bearer ${accessToken}` };
+      const response = await fetch('https://graph.microsoft.com/oidc/userinfo', { headers });
+      const microsoftUser = (await response.json()) as MicrosoftUserProps;
+      const providerUser = transformSocialUserData(microsoftUser);
+
+      return await handleOAuthCallback(ctx, providerUser, strategy, cookiePayload);
+    } catch (error) {
+      if (error instanceof AppError) throw error;
+
+      // Handle known OAuth validation errors (e.g. bad token, revoked code)
+      const type = error instanceof OAuth2RequestError ? 'invalid_credentials' : 'oauth_failed';
+      throw new AppError({
+        status: 401,
+        type,
+        severity: 'warn',
+        meta: { strategy },
+        isRedirect: true,
+        ...(error instanceof Error ? { originalError: error } : {}),
+      });
+    }
+  });
+export default authOAuthRouteHandlers;
diff --git a/backend/src/modules/auth/helpers/oauth/callback.ts b/backend/src/modules/auth/oauth/helpers/callback.ts
similarity index 87%
rename from backend/src/modules/auth/helpers/oauth/callback.ts
rename to backend/src/modules/auth/oauth/helpers/callback.ts
index b15941adb..a2e77633e 100644
--- a/backend/src/modules/auth/helpers/oauth/callback.ts
+++ b/backend/src/modules/auth/oauth/helpers/callback.ts
@@ -6,19 +6,20 @@ import { emailsTable } from '#/db/schema/emails';
 import { type OAuthAccountModel, oauthAccountsTable } from '#/db/schema/oauth-accounts';
 import type { TokenModel } from '#/db/schema/tokens';
 import { type UserModel, usersTable } from '#/db/schema/users';
+import { Env } from '#/lib/context';
 import { AppError } from '#/lib/errors';
 import { getAuthCookie } from '#/modules/auth/helpers/cookie';
 import { initiateMfa } from '#/modules/auth/helpers/mfa';
-import type { OAuthCookiePayload } from '#/modules/auth/helpers/oauth/initiation';
-import type { Provider } from '#/modules/auth/helpers/oauth/providers';
-import type { TransformedUser } from '#/modules/auth/helpers/oauth/transform-user-data';
 import { sendVerificationEmail } from '#/modules/auth/helpers/send-verification-email';
 import { setUserSession } from '#/modules/auth/helpers/session';
 import { handleCreateUser } from '#/modules/auth/helpers/user';
+import type { OAuthCookiePayload } from '#/modules/auth/oauth/helpers/initiation';
+import type { Provider } from '#/modules/auth/oauth/helpers/providers';
+import type { TransformedUser } from '#/modules/auth/oauth/helpers/transform-user-data';
 import { usersBaseQuery } from '#/modules/users/helpers/select';
+import { getValidToken } from '#/utils/get-valid-token';
 import { isValidRedirectPath } from '#/utils/is-redirect-url';
 import { getIsoDate } from '#/utils/iso-date';
-import { getValidToken } from '#/utils/validate-token';
 
 /**
  * Handles the default OAuth authentication/signup flow.
@@ -32,20 +33,19 @@ import { getValidToken } from '#/utils/validate-token';
  * @returns A redirect response.
  */
 export const handleOAuthCallback = async (
-  ctx: Context,
+  ctx: Context<Env>,
   providerUser: TransformedUser,
   provider: EnabledOAuthProvider,
   cookiePayload: OAuthCookiePayload,
 ): Promise<Response> => {
-  // Restore Context: linked oauthAccount, invitation or account linking
   const oauthAccount = await getOAuthAccount(providerUser.id, provider, providerUser.email);
 
   const { connectUserId, inviteTokenId, verifyTokenId } = cookiePayload;
 
   // Handle OAuth callback flows based on cookie
-  if (connectUserId) return await connectFlow(ctx, providerUser, provider, connectUserId, oauthAccount);
-  if (inviteTokenId) return await inviteFlow(ctx, providerUser, provider, inviteTokenId, oauthAccount);
-  if (verifyTokenId) return await verifyFlow(ctx, providerUser, provider, verifyTokenId, oauthAccount);
+  if (connectUserId) return await connectCallbackFlow(ctx, providerUser, provider, connectUserId, oauthAccount);
+  if (inviteTokenId) return await inviteCallbackFlow(ctx, providerUser, provider, inviteTokenId, oauthAccount);
+  if (verifyTokenId) return await verifyCallbackFlow(ctx, providerUser, provider, verifyTokenId, oauthAccount);
 
   // User already has a verified OAuth account → sign in
   if (oauthAccount?.verified) {
@@ -101,8 +101,8 @@ export const handleOAuthCallback = async (
  * @param oauthAccount - The existing OAuth account, if one exists.
  * @returns A redirect response.
  */
-const connectFlow = async (
-  ctx: Context,
+const connectCallbackFlow = async (
+  ctx: Context<Env>,
   providerUser: TransformedUser,
   provider: EnabledOAuthProvider,
   connectUserId: string,
@@ -142,22 +142,21 @@ const connectFlow = async (
  * @param ctx - The request context.
  * @param providerUser - The transformed user data from the OAuth provider.
  * @param provider - The OAuth provider (e.g., 'google', 'github').
- * @param inviteTokenId - The ID of the invitation token.
+ * @param token - The invitation token.
  * @param oauthAccount - The linked OAuth account, if one exists.
  * @returns A redirect response.
  */
-const inviteFlow = async (
-  ctx: Context,
+const inviteCallbackFlow = async (
+  ctx: Context<Env>,
   providerUser: TransformedUser,
   provider: EnabledOAuthProvider,
-  inviteTokenId: TokenModel['id'],
+  token: TokenModel['token'],
   oauthAccount: OAuthAccountModel | null = null,
 ): Promise<Response> => {
-  // Token not found → invalid invitation
-
   const invitationToken = await getValidToken({
-    requiredType: 'invitation',
-    tokenId: inviteTokenId,
+    token,
+    consumeToken: false,
+    tokenType: 'invitation',
     isRedirect: true,
   });
 
@@ -187,17 +186,17 @@ const inviteFlow = async (
   return await handleUnverifiedOAuthAccount(ctx, newOAuthAccount, 'invite');
 };
 
-const verifyFlow = async (
-  ctx: Context,
+const verifyCallbackFlow = async (
+  ctx: Context<Env>,
   providerUser: TransformedUser,
   provider: EnabledOAuthProvider,
-  verifyTokenId: TokenModel['id'],
+  token: TokenModel['token'],
   oauthAccount: OAuthAccountModel | null = null,
 ): Promise<Response> => {
-  // Token not found → invalid verification
   const verifyToken = await getValidToken({
-    requiredType: 'email_verification',
-    tokenId: verifyTokenId,
+    token,
+    consumeToken: false,
+    tokenType: 'email_verification',
     isRedirect: true,
   });
 
@@ -209,7 +208,7 @@ const verifyFlow = async (
     verifyToken.type !== 'email_verification' ||
     verifyToken.email !== providerUser.email ||
     verifyToken.oauthAccountId !== oauthAccount.id ||
-    oauthAccount.providerId !== provider
+    oauthAccount.provider !== provider
   ) {
     throw new AppError({ status: 400, type: 'oauth_failed', severity: 'error', isRedirect: true });
   }
@@ -257,13 +256,13 @@ const verifyFlow = async (
  * Retrieves an OAuth account based on provider user ID, provider ID, and email.
  *
  * @param providerUserId - Unique user ID provided by the OAuth provider.
- * @param providerId - Identifier for the OAuth provider (e.g., "google", "github").
+ * @param provider - Identifier for the OAuth provider (e.g., "google", "github").
  * @param providerUserEmail - Email address associated with the OAuth account.
  * @returns The matched OAuth account or null if not found.
  */
 const getOAuthAccount = async (
   providerUserId: Provider['userId'],
-  providerId: Provider['id'],
+  provider: Provider['id'],
   providerUserEmail: UserModel['email'],
 ): Promise<OAuthAccountModel | null> => {
   const [oauthAccount] = await db
@@ -272,7 +271,7 @@ const getOAuthAccount = async (
     .where(
       and(
         eq(oauthAccountsTable.providerUserId, providerUserId),
-        eq(oauthAccountsTable.providerId, providerId),
+        eq(oauthAccountsTable.provider, provider),
         eq(oauthAccountsTable.email, providerUserEmail),
       ),
     );
@@ -285,14 +284,14 @@ const getOAuthAccount = async (
  *
  * @param userId - Internal user ID to associate with the OAuth account.
  * @param providerUserId - Unique user ID from the OAuth provider.
- * @param providerId - Identifier for the OAuth provider.
+ * @param provider - Identifier for the OAuth provider.
  * @param email - Email address associated with the OAuth account.
  * @returns The created OAuth account.
  */
 const createOAuthAccount = async (
   userId: OAuthAccountModel['userId'],
   providerUserId: Provider['userId'],
-  providerId: Provider['id'],
+  provider: Provider['id'],
   email: UserModel['email'],
 ): Promise<OAuthAccountModel> => {
   const [oauthAccount] = await db
@@ -300,7 +299,7 @@ const createOAuthAccount = async (
     .values({
       userId,
       providerUserId,
-      providerId,
+      provider,
       email,
       verified: false,
     })
@@ -318,7 +317,7 @@ const createOAuthAccount = async (
  * @param oauthAccount - The verified OAuth account.
  * @returns A redirect response.
  */
-const handleVerifiedOAuthAccount = async (ctx: Context, user: UserModel, oauthAccount: OAuthAccountModel): Promise<Response> => {
+const handleVerifiedOAuthAccount = async (ctx: Context<Env>, user: UserModel, oauthAccount: OAuthAccountModel): Promise<Response> => {
   // Start MFA challenge if the user has MFA enabled
   const mfaRedirectPath = await initiateMfa(ctx, user);
 
@@ -327,7 +326,7 @@ const handleVerifiedOAuthAccount = async (ctx: Context, user: UserModel, oauthAc
   const redirectUrl = new URL(redirectPath, appConfig.frontendUrl);
 
   // If MFA is not required, set  user session immediately
-  if (!mfaRedirectPath) await setUserSession(ctx, user, oauthAccount.providerId);
+  if (!mfaRedirectPath) await setUserSession(ctx, user, oauthAccount.provider);
 
   return ctx.redirect(redirectUrl, 302);
 };
@@ -340,7 +339,7 @@ const handleVerifiedOAuthAccount = async (ctx: Context, user: UserModel, oauthAc
  * @returns A redirect response.
  */
 const handleUnverifiedOAuthAccount = async (
-  ctx: Context,
+  ctx: Context<Env>,
   oauthAccount: OAuthAccountModel,
   reason: 'signup' | 'signin' | 'connect' | 'invite',
 ): Promise<Response> => {
@@ -348,7 +347,7 @@ const handleUnverifiedOAuthAccount = async (
 
   sendVerificationEmail({ userId: oauthAccount.userId, oauthAccountId: oauthAccount.id, redirectPath });
 
-  const redirectUrl = new URL(`/auth/email-verification/${reason}?provider=${oauthAccount.providerId}`, appConfig.frontendUrl);
+  const redirectUrl = new URL(`/auth/email-verification/${reason}?provider=${oauthAccount.provider}`, appConfig.frontendUrl);
 
   return ctx.redirect(redirectUrl, 302);
 };
@@ -359,7 +358,7 @@ const handleUnverifiedOAuthAccount = async (
  * @param ctx - The request context.
  * @returns A validated redirect path string.
  */
-const getOAuthRedirectPath = async (ctx: Context): Promise<string> => {
+const getOAuthRedirectPath = async (ctx: Context<Env>): Promise<string> => {
   const redirect = await getAuthCookie(ctx, 'oauth-redirect');
 
   return isValidRedirectPath(redirect) || appConfig.defaultRedirectPath;
diff --git a/backend/src/modules/auth/oauth/helpers/handle-oauth-verification.ts b/backend/src/modules/auth/oauth/helpers/handle-oauth-verification.ts
new file mode 100644
index 000000000..7c7fe4581
--- /dev/null
+++ b/backend/src/modules/auth/oauth/helpers/handle-oauth-verification.ts
@@ -0,0 +1,23 @@
+import { appConfig } from 'config';
+import { eq } from 'drizzle-orm';
+import { Context } from 'hono';
+import { db } from '#/db/db';
+import { oauthAccountsTable } from '#/db/schema/oauth-accounts';
+import { TokenModel } from '#/db/schema/tokens';
+import { Env } from '#/lib/context';
+import { AppError } from '#/lib/errors';
+
+export const handleOAuthVerification = async (ctx: Context<Env>, token: TokenModel) => {
+  // Token requires userId and oauthAccountId
+  if (!token.userId || !token.oauthAccountId) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error' });
+
+  const [oauthAccount] = await db.select().from(oauthAccountsTable).where(eq(oauthAccountsTable.id, token.oauthAccountId)).limit(1);
+  if (!oauthAccount) throw new AppError({ status: 400, type: 'invalid_request', severity: 'warn' });
+
+  const verifyPath = `/auth/${oauthAccount.provider}`;
+  const verificationURL = new URL(verifyPath, appConfig.backendUrl);
+
+  verificationURL.searchParams.set('tokenId', token.id);
+  verificationURL.searchParams.set('type', 'verify');
+  return ctx.redirect(verificationURL, 302);
+};
diff --git a/backend/src/modules/auth/helpers/oauth/initiation.ts b/backend/src/modules/auth/oauth/helpers/initiation.ts
similarity index 66%
rename from backend/src/modules/auth/helpers/oauth/initiation.ts
rename to backend/src/modules/auth/oauth/helpers/initiation.ts
index ab9b85f21..50b6f20de 100644
--- a/backend/src/modules/auth/helpers/oauth/initiation.ts
+++ b/backend/src/modules/auth/oauth/helpers/initiation.ts
@@ -1,12 +1,13 @@
 import { appConfig } from 'config';
 import type { Context } from 'hono';
+import { Env } from '#/lib/context';
 import { AppError } from '#/lib/errors';
-import { setAuthCookie } from '#/modules/auth/helpers/cookie';
+import { getAuthCookie, setAuthCookie } from '#/modules/auth/helpers/cookie';
 import { getParsedSessionCookie, validateSession } from '#/modules/auth/helpers/session';
+import { getValidToken } from '#/utils/get-valid-token';
 import { isValidRedirectPath } from '#/utils/is-redirect-url';
 import { logEvent } from '#/utils/logger';
 import { TimeSpan } from '#/utils/time-span';
-import { getValidToken } from '#/utils/validate-token';
 
 export interface OAuthCookiePayload {
   redirectPath: string;
@@ -30,12 +31,13 @@ export interface OAuthCookiePayload {
  * @param codeVerifier - PKCE code verifier (optional)
  * @returns redirect response
  */
-export const handleOAuthInitiation = async (ctx: Context, provider: string, url: URL, state: string, codeVerifier?: string) => {
+export const handleOAuthInitiation = async (ctx: Context<Env>, provider: string, url: URL, state: string, codeVerifier?: string) => {
   const { type } = ctx.req.query();
 
-  const payload = await getOAuthPayload(ctx);
-  const cookieContent = JSON.stringify({ ...payload, codeVerifier });
+  const { redirectPath } = await prepareOAuthByContext(ctx);
+  const cookieContent = JSON.stringify({ redirectPath, codeVerifier });
 
+  // TODO state in name? perhaps in content instead? reconsider cookie lifecycle security
   await setAuthCookie(ctx, `oauth-${state}`, cookieContent, new TimeSpan(5, 'm'));
 
   logEvent('info', 'User redirected to OAuth provider', { strategy: 'oauth', provider, type });
@@ -58,33 +60,30 @@ export const handleOAuthInitiation = async (ctx: Context, provider: string, url:
  *
  */
 // TODO this doesnt look very clean in the cookie when inspecting it in devtools, maybe hash it or encode it?
-const getOAuthPayload = async (ctx: Context) => {
+const prepareOAuthByContext = async (ctx: Context<Env>) => {
   const { type, redirect } = ctx.req.query();
 
   // default payload
   let redirectPath = resolveOAuthRedirect(redirect);
-  let inviteTokenId: string | null = null;
-  let connectUserId: string | null = null;
-  let verifyTokenId: string | null = null;
 
   switch (type) {
     case 'invite': {
-      ({ inviteTokenId, redirectPath } = await prepareOAuthAcceptInvite(ctx));
+      ({ redirectPath } = await prepareOAuthAcceptInvite(ctx));
       break;
     }
     case 'connect': {
-      ({ connectUserId, redirectPath } = await prepareOAuthConnect(ctx));
+      ({ redirectPath } = await prepareOAuthConnect(ctx));
       break;
     }
     case 'verify': {
-      ({ verifyTokenId, redirectPath } = await prepareOAuthVerify(ctx));
+      ({ redirectPath } = await prepareOAuthVerify(ctx));
       break;
     }
     default:
       break;
   }
 
-  return { redirectPath, inviteTokenId, connectUserId, verifyTokenId };
+  return { redirectPath };
 };
 /**
  * Resolves and validates the redirect path used after OAuth.
@@ -114,17 +113,17 @@ const resolveOAuthRedirect = (redirect?: string): string => {
  * @returns tokenId + redirectPath
  * @throws AppError if token is missing or invalid
  */
-const prepareOAuthAcceptInvite = async (ctx: Context) => {
-  const { tokenId, token } = ctx.req.query();
+const prepareOAuthAcceptInvite = async (ctx: Context<Env>) => {
+  const token = await getAuthCookie(ctx, 'invitation');
 
   // Must provide a token and tokenId
-  if (!token || !tokenId) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error', isRedirect: true });
+  if (!token) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error', isRedirect: true });
 
-  const tokenRecord = await getValidToken({ requiredType: 'invitation', tokenId, consumeToken: false });
+  const tokenRecord = await getValidToken({ token, consumeToken: false, tokenType: 'invitation' });
 
-  const redirectPath = tokenRecord.entityType ? `/invitation/${tokenRecord.token}` : appConfig.defaultRedirectPath;
+  const redirectPath = tokenRecord.entityType ? `${appConfig.backendAuthUrl}/consume-token/${tokenRecord.token}` : appConfig.defaultRedirectPath;
 
-  return { inviteTokenId: tokenRecord.id, redirectPath };
+  return { redirectPath };
 };
 
 /**
@@ -137,13 +136,15 @@ const prepareOAuthAcceptInvite = async (ctx: Context) => {
  * @returns connectUserId and redirectPath
  * @throws AppError if missing param or user mismatch
  */
-const prepareOAuthConnect = async (ctx: Context) => {
+const prepareOAuthConnect = async (ctx: Context<Env>) => {
   const connectUserId = ctx.req.query('connectUserId');
 
   if (!connectUserId) {
     throw new AppError({ status: 400, type: 'connect_user_not_found', severity: 'error', isRedirect: true });
   }
 
+  // TODO set cookie with connectUserId
+
   const { sessionToken } = await getParsedSessionCookie(ctx, { redirectOnError: true });
   const { user } = await validateSession(sessionToken);
 
@@ -156,6 +157,8 @@ const prepareOAuthConnect = async (ctx: Context) => {
 };
 /**
  * Validates and extracts verification context for an OAuth flow.
+ * To make sure that the user that started the OAuth flow is the same as the one that proceeds after
+ * email verification, we use a cookie to store the token.
  *
  * - Ensures `token` param exists
  * - Validates token record against type `email_verification`
@@ -165,16 +168,18 @@ const prepareOAuthConnect = async (ctx: Context) => {
  * @returns tokenId + redirectPath
  * @throws AppError if missing or invalid token
  */
-const prepareOAuthVerify = async (ctx: Context) => {
-  const { tokenId, token } = ctx.req.query();
+const prepareOAuthVerify = async (ctx: Context<Env>) => {
+  const token = await getAuthCookie(ctx, 'email_verification');
+  // Must provide a token
+  if (!token) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error', isRedirect: true });
 
-  // Must provide a token and tokenId
-  if (!token || !tokenId) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error', isRedirect: true });
+  // TODO split in different endpoints when you are returning for second time, you get "Token is invalid" because it was consumed already
+  //   then we need to get singleUUseToken here or somehow divert to another FileDownloadableLink, i
 
-  const tokenRecord = await getValidToken({ requiredType: 'email_verification', tokenId, consumeToken: false, isRedirect: true });
+  const tokenRecord = await getValidToken({ token, consumeToken: false, isRedirect: true, tokenType: 'email_verification' });
 
   // If entityType exists, proceed to invitation flow
-  const redirectPath = tokenRecord.entityType ? `/invitation/${tokenRecord.token}` : appConfig.defaultRedirectPath;
+  const redirectPath = tokenRecord.entityType ? `${appConfig.backendAuthUrl}/consume-token/${tokenRecord.token}` : appConfig.defaultRedirectPath;
 
   return { verifyTokenId: tokenRecord.id, redirectPath };
 };
diff --git a/backend/src/modules/auth/helpers/oauth/providers.ts b/backend/src/modules/auth/oauth/helpers/providers.ts
similarity index 100%
rename from backend/src/modules/auth/helpers/oauth/providers.ts
rename to backend/src/modules/auth/oauth/helpers/providers.ts
diff --git a/backend/src/modules/auth/helpers/oauth/transform-user-data.ts b/backend/src/modules/auth/oauth/helpers/transform-user-data.ts
similarity index 97%
rename from backend/src/modules/auth/helpers/oauth/transform-user-data.ts
rename to backend/src/modules/auth/oauth/helpers/transform-user-data.ts
index f3472c8ae..589adcb42 100644
--- a/backend/src/modules/auth/helpers/oauth/transform-user-data.ts
+++ b/backend/src/modules/auth/oauth/helpers/transform-user-data.ts
@@ -1,5 +1,5 @@
 import slugify from 'slugify';
-import type { GithubUserEmailProps, GithubUserProps, GoogleUserProps, MicrosoftUserProps } from '#/modules/auth/helpers/oauth/providers';
+import type { GithubUserEmailProps, GithubUserProps, GoogleUserProps, MicrosoftUserProps } from '#/modules/auth/oauth/helpers/providers';
 import { slugFromEmail } from '#/utils/slug-from-email';
 
 export type TransformedUser = {
diff --git a/backend/src/modules/auth/oauth/routes.ts b/backend/src/modules/auth/oauth/routes.ts
new file mode 100644
index 000000000..208d621ce
--- /dev/null
+++ b/backend/src/modules/auth/oauth/routes.ts
@@ -0,0 +1,137 @@
+import { z } from '@hono/zod-openapi';
+import { createCustomRoute } from '#/lib/custom-routes';
+import { isPublicAccess } from '#/middlewares/guard';
+import { tokenLimiter } from '#/middlewares/rate-limiter/limiters';
+import { locationSchema } from '#/utils/schema/common';
+import { errorResponses } from '#/utils/schema/responses';
+import { oauthCallbackQuerySchema, oauthQuerySchema } from './schema';
+
+const authOAuthRoutes = {
+  github: createCustomRoute({
+    operationId: 'github',
+    method: 'get',
+    path: '/github',
+    guard: isPublicAccess,
+    tags: ['auth'],
+    summary: 'Authenticate with GitHub',
+    description:
+      'Starts OAuth authentication with GitHub. Can be used for account connection, email verification, invitation process, defaults to authentication.',
+    security: [],
+    request: { query: oauthQuerySchema },
+    responses: {
+      302: {
+        description: 'Redirect to GitHub',
+        headers: locationSchema,
+      },
+      ...errorResponses,
+    },
+  }),
+
+  githubCallback: createCustomRoute({
+    operationId: 'githubCallback',
+    method: 'get',
+    path: '/github/callback',
+    guard: isPublicAccess,
+    middleware: [tokenLimiter('github')],
+    tags: ['auth'],
+    summary: 'Callback for GitHub',
+    description: 'Handles GitHub OAuth callback, retrieves user identity, and establishes a session or links account.',
+    security: [],
+    request: {
+      query: oauthCallbackQuerySchema.extend({
+        error: z.string().optional(),
+        error_description: z.string().optional(),
+        error_uri: z.string().optional(),
+      }),
+    },
+    responses: {
+      302: {
+        description: 'Redirect to frontend',
+        headers: locationSchema,
+      },
+      ...errorResponses,
+    },
+  }),
+
+  google: createCustomRoute({
+    operationId: 'google',
+    method: 'get',
+    path: '/google',
+    guard: isPublicAccess,
+    tags: ['auth'],
+    summary: 'Authenticate with Google',
+    description:
+      'Starts OAuth authentication with Google. Can be used for account connection, email verification, invitation process, defaults to authentication.',
+    security: [],
+    request: { query: oauthQuerySchema },
+    responses: {
+      302: {
+        description: 'Redirect to Google',
+        headers: locationSchema,
+      },
+      ...errorResponses,
+    },
+  }),
+
+  googleCallback: createCustomRoute({
+    operationId: 'googleCallback',
+    method: 'get',
+    path: '/google/callback',
+    guard: isPublicAccess,
+    middleware: [tokenLimiter('google')],
+    tags: ['auth'],
+    summary: 'Callback for Google',
+    description: 'Handles Google OAuth callback, retrieves user identity, and establishes a session or links account.',
+    security: [],
+    request: { query: oauthCallbackQuerySchema },
+    responses: {
+      302: {
+        description: 'Redirect to frontend',
+        headers: locationSchema,
+      },
+      ...errorResponses,
+    },
+  }),
+
+  microsoft: createCustomRoute({
+    operationId: 'microsoft',
+    method: 'get',
+    path: '/microsoft',
+    guard: isPublicAccess,
+    tags: ['auth'],
+    summary: 'Authenticate with Microsoft',
+    description:
+      'Starts OAuth authentication with Microsoft. Can be used for account connection, email verification, invitation process, defaults to authentication.',
+    security: [],
+    request: { query: oauthQuerySchema },
+    responses: {
+      302: {
+        description: 'Redirect to Microsoft',
+        headers: locationSchema,
+      },
+      ...errorResponses,
+    },
+  }),
+
+  microsoftCallback: createCustomRoute({
+    operationId: 'microsoftCallback',
+    method: 'get',
+    path: '/microsoft/callback',
+    guard: isPublicAccess,
+    middleware: [tokenLimiter('microsoft')],
+    tags: ['auth'],
+    summary: 'Callback for Microsoft',
+    description: 'Handles Microsoft OAuth callback, retrieves user identity, and establishes a session or links account.',
+    security: [],
+    request: { query: oauthCallbackQuerySchema },
+    responses: {
+      302: {
+        description: 'Redirect to frontend',
+        headers: locationSchema,
+      },
+      ...errorResponses,
+    },
+  }),
+};
+
+export default authOAuthRoutes;
diff --git a/backend/src/modules/auth/oauth/schema.ts b/backend/src/modules/auth/oauth/schema.ts
new file mode 100644
index 000000000..584060513
--- /dev/null
+++ b/backend/src/modules/auth/oauth/schema.ts
@@ -0,0 +1,25 @@
+import { z } from '@hono/zod-openapi';
+
+export const oauthQuerySchema = z
+  .object({
+    type: z.enum(['auth', 'connect', 'invite', 'verify']),
+    redirect: z.string().optional(),
+    connectUserId: z.string().optional(),
+    token: z.string().optional(),
+    tokenId: z.string().optional(),
+  })
+  .refine(
+    (data) => {
+      if (data.type === 'connect') return !!data.connectUserId;
+      if (data.type === 'invite') return !!data.tokenId && !!data.token;
+      return true; // No extra requirements for signIn & signUp
+    },
+    // TODO message is deprecated in favor of 'error'? replace everywhere
+    // TODO2 this doesnt work well when we need a redirect error, what to do?
+    { message: "Missing required field based on 'type'" },
+  );
+
+export const oauthCallbackQuerySchema = z.object({
+  code: z.string(),
+  state: z.string(),
+});
diff --git a/backend/src/modules/auth/passkeys/handlers.ts b/backend/src/modules/auth/passkeys/handlers.ts
new file mode 100644
index 000000000..9c0fe60ad
--- /dev/null
+++ b/backend/src/modules/auth/passkeys/handlers.ts
@@ -0,0 +1,195 @@
+import { getRandomValues } from 'node:crypto';
+import { OpenAPIHono } from '@hono/zod-openapi';
+import { encodeBase64 } from '@oslojs/encoding';
+import { appConfig } from 'config';
+import { and, eq, getTableColumns } from 'drizzle-orm';
+import { db } from '#/db/db';
+import { emailsTable } from '#/db/schema/emails';
+import { passkeysTable } from '#/db/schema/passkeys';
+import { totpsTable } from '#/db/schema/totps';
+import { type UserModel, usersTable } from '#/db/schema/users';
+import { type Env, getContextUser } from '#/lib/context';
+import { AppError } from '#/lib/errors';
+import { getAuthCookie, setAuthCookie } from '#/modules/auth/helpers/cookie';
+import { consumeMfaToken, validateConfirmMfaToken } from '#/modules/auth/helpers/mfa';
+import { parseAndValidatePasskeyAttestation, verifyPassKeyPublic } from '#/modules/auth/helpers/passkey';
+import { setUserSession } from '#/modules/auth/helpers/session';
+import { usersBaseQuery } from '#/modules/users/helpers/select';
+import { defaultHook } from '#/utils/default-hook';
+import { TimeSpan } from '#/utils/time-span';
+import { deviceInfo } from '../helpers/device-info';
+import authPasskeysRoutes from './routes';
+
+const enabledStrategies: readonly string[] = appConfig.enabledAuthStrategies;
+
+const app = new OpenAPIHono<Env>({ defaultHook });
+
+const authPasskeysRouteHandlers = app
+  /*
+   * Register passkey
+   */
+  .openapi(authPasskeysRoutes.createPasskey, async (ctx) => {
+    const { attestationObject, clientDataJSON, nameOnDevice } = ctx.req.valid('json');
+    const user = getContextUser();
+
+    const challengeFromCookie = await getAuthCookie(ctx, 'passkey-challenge');
+    if (!challengeFromCookie) throw new AppError({ status: 401, type: 'invalid_credentials', severity: 'error' });
+
+    const { credentialId, publicKey } = parseAndValidatePasskeyAttestation(clientDataJSON, attestationObject, challengeFromCookie);
+
+    const device = deviceInfo(ctx);
+    const passkeyValue = {
+      userId: user.id,
+      credentialId,
+      publicKey,
+      nameOnDevice,
+      deviceName: device.name,
+      deviceType: device.type,
+      deviceOs: device.os,
+      browser: device.browser,
+    };
+
+    const { credentialId: _, publicKey: __, ...passkeySelect } = getTableColumns(passkeysTable);
+
+    // Save public key in database
+    const [newPasskey] = await db.insert(passkeysTable).values(passkeyValue).returning(passkeySelect);
+
+    return ctx.json(newPasskey, 200);
+  })
+  /*
+   * Delete passkey
+   */
+  .openapi(authPasskeysRoutes.deletePasskey, async (ctx) => {
+    const { id } = ctx.req.valid('param');
+    const user = getContextUser();
+
+    // Remove all passkeys linked to this user's email
+    await db.delete(passkeysTable).where(and(eq(passkeysTable.userId, user.id), eq(passkeysTable.id, id)));
+
+    // Check if the user still has any passkeys or TOTP entries registered
+    const [userPasskeys, userTotps] = await Promise.all([
+      db.select().from(passkeysTable).where(eq(passkeysTable.userId, user.id)),
+      db.select().from(totpsTable).where(eq(totpsTable.userId, user.id)),
+    ]);
+
+    // If no TOTP and Passkeys exists, disable MFA completely
+    if (!userPasskeys.length || !userTotps.length) {
+      await db.update(usersTable).set({ mfaRequired: false }).where(eq(usersTable.id, user.id));
+    }
+
+    return ctx.json(true, 200);
+  })
+  /*
+   * Passkey challenge
+   */
+  .openapi(authPasskeysRoutes.createPasskeyChallenge, async (ctx) => {
+    const { email, type } = ctx.req.valid('json');
+
+    // Generate a 32-byte random challenge and encode it as Base64
+    const challenge = getRandomValues(new Uint8Array(32));
+    const challengeBase64 = encodeBase64(challenge);
+
+    // Save the challenge in a short-lived cookie (5 minutes)
+    await setAuthCookie(ctx, 'passkey-challenge', challengeBase64, new TimeSpan(5, 'm'));
+
+    let user: UserModel | null = null;
+
+    // Find user by email if provided
+    if (email && type === 'authentication') {
+      const normalizedEmail = email.toLowerCase().trim();
+
+      const [tableUser] = await usersBaseQuery()
+        .leftJoin(emailsTable, eq(usersTable.id, emailsTable.userId))
+        .where(eq(emailsTable.email, normalizedEmail))
+        .limit(1);
+
+      user = tableUser;
+    }
+    // If this is a multifactor request, retrieve user from pending MFA token
+    if (type === 'mfa') {
+      const userFromToken = await validateConfirmMfaToken(ctx);
+      user = userFromToken;
+    }
+
+    // If we still have no email, return challenge with empty credential list
+    if (!user) return ctx.json({ challengeBase64, credentialIds: [] }, 200);
+
+    // Fetch all passkey credentials for this user
+    const credentials = await db.select({ credentialId: passkeysTable.credentialId }).from(passkeysTable).where(eq(passkeysTable.userId, user.id));
+
+    const credentialIds = credentials.map((c) => c.credentialId);
+
+    return ctx.json({ challengeBase64, credentialIds }, 200);
+  })
+  /*
+   * Signin using passkey
+   */
+  .openapi(authPasskeysRoutes.signInWithPasskey, async (ctx) => {
+    const { clientDataJSON, authenticatorData, signature, credentialId, email, type } = ctx.req.valid('json');
+    // Define strategy and session type for metadata/logging purposes
+    const meta = { strategy: 'passkey', sessionType: type === 'mfa' ? 'mfa' : 'regular' } as const;
+
+    if (type === 'authentication' && !enabledStrategies.includes(meta.strategy)) {
+      throw new AppError({ status: 400, type: 'forbidden_strategy', severity: 'error', meta });
+    }
+
+    let user: UserModel | null = null;
+
+    // Find user by email if provided
+    if (email) {
+      const normalizedEmail = email.toLowerCase().trim();
+
+      const [tableUser] = await usersBaseQuery()
+        .leftJoin(emailsTable, eq(usersTable.id, emailsTable.userId))
+        .where(eq(emailsTable.email, normalizedEmail))
+        .limit(1);
+
+      user = tableUser;
+    }
+
+    // Override user if this is a multifactor authentication
+    if (type === 'mfa') {
+      const userFromToken = await validateConfirmMfaToken(ctx);
+      user = userFromToken;
+    }
+
+    // Fail early if user not found
+    if (!user) throw new AppError({ status: 404, type: 'not_found', severity: 'warn', entityType: 'user', meta });
+
+    // Retrieve the passkey challenge from cookie
+    const challengeFromCookie = await getAuthCookie(ctx, 'passkey-challenge');
+    if (!challengeFromCookie) throw new AppError({ status: 401, type: 'invalid_credentials', severity: 'warn', meta });
+
+    // Get passkey credentials
+    const [passkeyRecord] = await db
+      .select()
+      .from(passkeysTable)
+      .where(and(eq(passkeysTable.userId, user.id), eq(passkeysTable.credentialId, credentialId)))
+      .limit(1);
+
+    if (!passkeyRecord) throw new AppError({ status: 404, type: 'passkey_not_found', severity: 'warn', meta });
+
+    try {
+      const isValid = await verifyPassKeyPublic(signature, authenticatorData, clientDataJSON, passkeyRecord.publicKey, challengeFromCookie);
+      if (!isValid) throw new AppError({ status: 401, type: 'invalid_token', severity: 'warn', meta });
+    } catch (error) {
+      if (error instanceof AppError) throw error;
+
+      throw new AppError({
+        status: 500,
+        type: 'passkey_verification_failed',
+        severity: 'error',
+        meta,
+        ...(error instanceof Error ? { originalError: error } : {}),
+      });
+    }
+
+    // Consume the MFA token now that TOTP verification succeeded
+    await consumeMfaToken(ctx);
+    // Set user session after successful verification
+    await setUserSession(ctx, user, meta.strategy, meta.sessionType);
+
+    return ctx.json(true, 200);
+  });
+
+export default authPasskeysRouteHandlers;
diff --git a/backend/src/modules/auth/passkeys/routes.ts b/backend/src/modules/auth/passkeys/routes.ts
new file mode 100644
index 000000000..379ae3462
--- /dev/null
+++ b/backend/src/modules/auth/passkeys/routes.ts
@@ -0,0 +1,100 @@
+import { z } from '@hono/zod-openapi';
+import { createCustomRoute } from '#/lib/custom-routes';
+import { isAuthenticated, isPublicAccess } from '#/middlewares/guard';
+import { spamLimiter, tokenLimiter } from '#/middlewares/rate-limiter/limiters';
+import { cookieSchema, idSchema } from '#/utils/schema/common';
+import { errorResponses, successWithoutDataSchema } from '#/utils/schema/responses';
+import { passkeyChallengeBodySchema, passkeyChallengeSchema, passkeyCreateBodySchema, passkeySchema, passkeyVerificationBodySchema } from './schema';
+
+const authPasskeysRoutes = {
+  createPasskeyChallenge: createCustomRoute({
+    operationId: 'createPasskeyChallenge',
+    method: 'post',
+    path: '/passkey-challenge',
+    guard: isPublicAccess,
+    // TODO look into rate limit customized for passkeys
+    middleware: [spamLimiter],
+    tags: ['auth'],
+    summary: 'Create passkey challenge',
+    description: 'Initiates the passkey registration or authentication flow by creating a device bound challenge.',
+    security: [],
+    request: { body: { content: { 'application/json': { schema: passkeyChallengeBodySchema } } } },
+    responses: {
+      200: {
+        description: 'Challenge created',
+        content: { 'application/json': { schema: passkeyChallengeSchema } },
+      },
+      ...errorResponses,
+    },
+  }),
+
+  createPasskey: createCustomRoute({
+    operationId: 'createPasskey',
+    method: 'post',
+    path: '/passkey',
+    guard: isAuthenticated,
+    tags: ['me'],
+    summary: 'Create passkey',
+    description:
+      'Register a passkey for passwordless authentication by verifying a signed challenge and linking it to the *current user*. Multiple passkeys can be created for different devices/browsers.',
+    security: [],
+    request: {
+      body: {
+        required: true,
+        content: { 'application/json': { schema: passkeyCreateBodySchema } },
+      },
+    },
+    responses: {
+      200: {
+        description: 'Passkey created',
+        content: { 'application/json': { schema: passkeySchema } },
+      },
+      ...errorResponses,
+    },
+  }),
+
+  deletePasskey: createCustomRoute({
+    operationId: 'deletePasskey',
+    method: 'delete',
+    path: '/passkey/{id}',
+    guard: isAuthenticated,
+    tags: ['me'],
+    summary: 'Delete passkey',
+    description: 'Delete a passkey by id from the *current user*.',
+    security: [],
+    request: {
+      params: z.object({ id: idSchema }),
+    },
+    responses: {
+      200: {
+        description: 'Passkey deleted',
+        content: { 'application/json': { schema: successWithoutDataSchema } },
+      },
+      ...errorResponses,
+    },
+  }),
+
+  signInWithPasskey: createCustomRoute({
+    operationId: 'signInWithPasskey',
+    method: 'post',
+    path: '/passkey-verification',
+    guard: isPublicAccess,
+    middleware: [tokenLimiter('passkey')],
+    tags: ['auth'],
+    summary: 'Verify passkey',
+    description: 'Validates the signed challenge and completes passkey based authentication.',
+    request: {
+      body: { content: { 'application/json': { schema: passkeyVerificationBodySchema } } },
+    },
+    responses: {
+      200: {
+        description: 'Passkey verified',
+        headers: z.object({ 'Set-Cookie': cookieSchema }),
+        content: { 'application/json': { schema: successWithoutDataSchema } },
+      },
+      ...errorResponses,
+    },
+  }),
+};
+
+export default authPasskeysRoutes;
diff --git a/backend/src/modules/auth/passkeys/schema.ts b/backend/src/modules/auth/passkeys/schema.ts
new file mode 100644
index 000000000..7e4fe099e
--- /dev/null
+++ b/backend/src/modules/auth/passkeys/schema.ts
@@ -0,0 +1,37 @@
+import { z } from '@hono/zod-openapi';
+import { createSelectSchema } from 'drizzle-zod';
+import { t } from 'i18next';
+import { passkeysTable } from '#/db/schema/passkeys';
+
+const passkeyTypeSchema = z.union([z.literal('authentication'), z.literal('mfa')]);
+const challengeTypeSchema = z.union([...passkeyTypeSchema.options, z.literal('registration')]);
+
+export const passkeySchema = createSelectSchema(passkeysTable).omit({ credentialId: true, publicKey: true });
+
+export const passkeyCreateBodySchema = z.object({
+  attestationObject: z.string(),
+  clientDataJSON: z.string(),
+  nameOnDevice: z.string(),
+});
+
+export const passkeyChallengeBodySchema = z
+  .object({
+    type: challengeTypeSchema,
+    email: z.string().optional(),
+  })
+  .refine((data) => (data.type === 'authentication' ? !!data.email : true), { message: t('mfa_schema_requirement') });
+
+export const passkeyChallengeSchema = z.object({ challengeBase64: z.string(), credentialIds: z.array(z.string()) });
+
+export const webAuthnAssertionSchema = z.object({
+  credentialId: z.string(),
+  clientDataJSON: z.string(),
+  authenticatorData: z.string(),
+  signature: z.string(),
+});
+
+export const passkeyVerificationBodySchema = z.object({
+  ...webAuthnAssertionSchema.shape,
+  type: passkeyTypeSchema,
+  email: z.string().optional(),
+});
diff --git a/backend/src/modules/auth/passwords/handlers.ts b/backend/src/modules/auth/passwords/handlers.ts
new file mode 100644
index 000000000..74034163f
--- /dev/null
+++ b/backend/src/modules/auth/passwords/handlers.ts
@@ -0,0 +1,255 @@
+import { OpenAPIHono } from '@hono/zod-openapi';
+import { appConfig } from 'config';
+import { and, eq } from 'drizzle-orm';
+import i18n from 'i18next';
+import { db } from '#/db/db';
+import { emailsTable } from '#/db/schema/emails';
+import { membershipsTable } from '#/db/schema/memberships';
+import { passwordsTable } from '#/db/schema/passwords';
+import { tokensTable } from '#/db/schema/tokens';
+import { usersTable } from '#/db/schema/users';
+import { type Env, getContextToken } from '#/lib/context';
+import { AppError } from '#/lib/errors';
+import { mailer } from '#/lib/mailer';
+import { hashPassword, verifyPasswordHash } from '#/modules/auth/helpers/argon2id';
+import { initiateMfa } from '#/modules/auth/helpers/mfa';
+import { sendVerificationEmail } from '#/modules/auth/helpers/send-verification-email';
+import { setUserSession } from '#/modules/auth/helpers/session';
+import { membershipBaseSelect } from '#/modules/memberships/helpers/select';
+import { usersBaseQuery } from '#/modules/users/helpers/select';
+import { defaultHook } from '#/utils/default-hook';
+import { getIsoDate } from '#/utils/iso-date';
+import { logEvent } from '#/utils/logger';
+import { nanoid } from '#/utils/nanoid';
+import { slugFromEmail } from '#/utils/slug-from-email';
+import { createDate, TimeSpan } from '#/utils/time-span';
+import { CreatePasswordEmail, type CreatePasswordEmailProps } from '../../../../emails/create-password';
+import { handleEmailVerification } from '../helpers/handle-email-verification';
+import { handleCreateUser } from '../helpers/user';
+import authPasswordsRoutes from './routes';
+
+const enabledStrategies: readonly string[] = appConfig.enabledAuthStrategies;
+
+const app = new OpenAPIHono<Env>({ defaultHook });
+
+const authPasswordsRouteHandlers = app
+  /*
+   * Sign up with email & password.
+   * Attention: sign up is also used for new users that received (system or membership) invitations.
+   * Only when invited to a new organization (context), user will proceed to accept this first after signing up.
+   */
+  .openapi(authPasswordsRoutes.signUp, async (ctx) => {
+    const { email, password } = ctx.req.valid('json');
+
+    // Verify if strategy allowed
+    const strategy = 'password';
+    if (!enabledStrategies.includes(strategy)) {
+      throw new AppError({ status: 400, type: 'forbidden_strategy', severity: 'error', meta: { strategy } });
+    }
+
+    // Stop if sign up is disabled and no invitation
+    if (!appConfig.has.registrationEnabled) throw new AppError({ status: 403, type: 'sign_up_restricted' });
+    const slug = slugFromEmail(email);
+
+    // Create user & send verification email
+    const newUser = { slug, name: slug, email };
+
+    const user = await handleCreateUser({ newUser });
+
+    // Separatly insert password
+    const hashedPassword = await hashPassword(password);
+    await db.insert(passwordsTable).values({ userId: user.id, hashedPassword: hashedPassword });
+
+    sendVerificationEmail({ userId: user.id });
+
+    return ctx.json(true, 200);
+  })
+  /*
+   * Sign up with email & password to accept (system or membership) invitations.
+   * Token is in single use session cookie.
+   * Only for organization membership invitations, user will proceed to accept after signing up.
+   */
+  .openapi(authPasswordsRoutes.signUpWithToken, async (ctx) => {
+    const { password } = ctx.req.valid('json');
+
+    const validToken = getContextToken();
+    if (!validToken) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error' });
+
+    const membershipInvite = validToken.type === 'invitation';
+
+    // Verify if strategy allowed
+    const strategy = 'password';
+    if (!enabledStrategies.includes(strategy)) {
+      throw new AppError({ status: 400, type: 'forbidden_strategy', severity: 'error', meta: { strategy } });
+    }
+
+    // add token if it's membership invitation
+    const membershipInviteTokenId = membershipInvite ? validToken.id : undefined;
+    const slug = slugFromEmail(validToken.email);
+
+    // Create user & send verification email
+    const newUser = { slug, name: slug, email: validToken.email };
+
+    const user = await handleCreateUser({ newUser, membershipInviteTokenId, emailVerified: true });
+
+    // Separately insert password
+    const hashedPassword = await hashPassword(password);
+    await db.insert(passwordsTable).values({ userId: user.id, hashedPassword: hashedPassword });
+
+    // Sign in user
+    await setUserSession(ctx, user, strategy);
+
+    const [invitationMembership] = await db
+      .select(membershipBaseSelect)
+      .from(membershipsTable)
+      .where(eq(membershipsTable.tokenId, validToken.id))
+      .limit(1);
+    if (!invitationMembership) throw new AppError({ status: 400, type: 'membership_not_found', severity: 'error' });
+
+    // Redirect to accept invitation if membership invite
+    const redirectPath = membershipInvite
+      ? `/home?invitationMembershipId=${invitationMembership.id}&skipWelcome=true`
+      : appConfig.defaultRedirectPath;
+    return ctx.json({ shouldRedirect: true, redirectPath }, 200);
+  })
+  /*
+   * Verify email
+   */
+  .openapi(authPasswordsRoutes.verifyEmail, async (ctx) => {
+    const token = getContextToken();
+
+    return handleEmailVerification(ctx, token);
+  })
+  /*
+   * Request reset password email
+   */
+  .openapi(authPasswordsRoutes.requestPassword, async (ctx) => {
+    const { email } = ctx.req.valid('json');
+
+    const normalizedEmail = email.toLowerCase().trim();
+
+    const [user] = await usersBaseQuery()
+      .leftJoin(emailsTable, eq(usersTable.id, emailsTable.userId))
+      .where(eq(emailsTable.email, normalizedEmail))
+      .limit(1);
+    if (!user) throw new AppError({ status: 404, type: 'invalid_email', severity: 'warn', entityType: 'user' });
+
+    // Delete old token if exists
+    await db.delete(tokensTable).where(and(eq(tokensTable.userId, user.id), eq(tokensTable.type, 'password_reset')));
+
+    // TODO hash token
+    const [tokenRecord] = await db
+      .insert(tokensTable)
+      .values({
+        token: nanoid(40),
+        type: 'password_reset',
+        userId: user.id,
+        email,
+        createdBy: user.id,
+        expiresAt: createDate(new TimeSpan(2, 'h')),
+      })
+      .returning();
+
+    // Send email
+    const lng = user.language;
+    const createPasswordLink = `${appConfig.backendAuthUrl}/consume-token/${tokenRecord.token}`;
+    const subject = i18n.t('backend:email.create_password.subject', { lng, appName: appConfig.name });
+    const staticProps = { createPasswordLink, subject, lng };
+    const recipients = [{ email: user.email }];
+
+    type Recipient = { email: string };
+
+    mailer.prepareEmails<CreatePasswordEmailProps, Recipient>(CreatePasswordEmail, staticProps, recipients);
+
+    logEvent('info', 'Create password link sent', { userId: user.id });
+
+    return ctx.json(true, 200);
+  })
+  /*
+   * Create password with single use session token in cookie
+   */
+  .openapi(authPasswordsRoutes.createPasswordWithToken, async (ctx) => {
+    const { password } = ctx.req.valid('json');
+    const token = getContextToken();
+
+    // Verify if strategy allowed
+    const strategy = 'password';
+    if (!enabledStrategies.includes(strategy)) {
+      throw new AppError({ status: 400, type: 'forbidden_strategy', severity: 'error', meta: { strategy } });
+    }
+
+    // If the token is not found or expired
+    if (!token || !token.userId) throw new AppError({ status: 401, type: 'invalid_token', severity: 'warn' });
+
+    const [user] = await usersBaseQuery().where(eq(usersTable.id, token.userId)).limit(1);
+
+    // If the user is not found
+    if (!user) {
+      throw new AppError({ status: 404, type: 'not_found', severity: 'warn', entityType: 'user', meta: { userId: token.userId } });
+    }
+
+    // Hash password
+    const hashedPassword = await hashPassword(password);
+
+    // update user password and set email verified
+    await Promise.all([
+      db.insert(passwordsTable).values({ userId: user.id, hashedPassword }).onConflictDoUpdate({
+        target: passwordsTable.userId,
+        set: { hashedPassword },
+      }),
+      db.update(emailsTable).set({ verified: true, verifiedAt: getIsoDate() }).where(eq(emailsTable.email, user.email)),
+    ]);
+
+    const redirectPath = await initiateMfa(ctx, user);
+    if (redirectPath) return ctx.json({ shouldRedirect: true, redirectPath }, 200);
+
+    await setUserSession(ctx, user, strategy);
+    return ctx.json({ shouldRedirect: false }, 200);
+  })
+  /*
+   * Sign in with email and password
+   * Attention: sign in is also used as a preparation to accept organization invitations (when signed out & user exists),
+   * after signing in, we proceed to accept the invitation.
+   */
+  .openapi(authPasswordsRoutes.signIn, async (ctx) => {
+    const { email, password } = ctx.req.valid('json');
+
+    // Verify if strategy allowed
+    const strategy = 'password';
+    if (!enabledStrategies.includes(strategy)) {
+      throw new AppError({ status: 400, type: 'forbidden_strategy', severity: 'error', meta: { strategy } });
+    }
+
+    const normalizedEmail = email.toLowerCase().trim();
+
+    const [info] = await db
+      .select({ user: usersTable, hashedPassword: passwordsTable.hashedPassword, emailVerified: emailsTable.verified })
+      .from(usersTable)
+      .innerJoin(emailsTable, eq(usersTable.id, emailsTable.userId))
+      .leftJoin(passwordsTable, eq(usersTable.id, passwordsTable.userId))
+      .where(eq(emailsTable.email, normalizedEmail))
+      .limit(1);
+
+    // If user is not found or doesn't have password
+    if (!info) throw new AppError({ status: 404, type: 'not_found', severity: 'warn', entityType: 'user' });
+
+    const { user, hashedPassword, emailVerified } = info;
+
+    if (!hashedPassword) throw new AppError({ status: 403, type: 'no_password_found', severity: 'warn' });
+    // Verify password
+    const validPassword = await verifyPasswordHash(hashedPassword, password);
+    if (!validPassword) throw new AppError({ status: 403, type: 'invalid_password', severity: 'warn' });
+
+    // If email is not verified, send verification email
+    if (!emailVerified) {
+      sendVerificationEmail({ userId: user.id });
+      return ctx.json({ shouldRedirect: true, redirectPath: '/auth/email-verification/signin' }, 200);
+    }
+
+    const redirectPath = await initiateMfa(ctx, user);
+    if (redirectPath) return ctx.json({ shouldRedirect: true, redirectPath }, 200);
+
+    await setUserSession(ctx, user, 'password');
+    return ctx.json({ shouldRedirect: false }, 200);
+  });
+export default authPasswordsRouteHandlers;
diff --git a/backend/src/modules/auth/passwords/routes.ts b/backend/src/modules/auth/passwords/routes.ts
new file mode 100644
index 000000000..5fafb76fb
--- /dev/null
+++ b/backend/src/modules/auth/passwords/routes.ts
@@ -0,0 +1,158 @@
+import { z } from '@hono/zod-openapi';
+import { createCustomRoute } from '#/lib/custom-routes';
+import { isPublicAccess } from '#/middlewares/guard';
+import { hasValidToken } from '#/middlewares/has-valid-token';
+import { isNoBot } from '#/middlewares/is-no-bot';
+import { emailEnumLimiter, passwordLimiter, spamLimiter, tokenLimiter } from '#/middlewares/rate-limiter/limiters';
+import { cookieSchema, locationSchema, passwordSchema } from '#/utils/schema/common';
+import { errorResponses, redirectResponseSchema, successWithoutDataSchema } from '#/utils/schema/responses';
+import { emailBodySchema } from '../general/schema';
+import { emailPasswordBodySchema } from './schema';
+
+const authPasswordsRoutes = {
+  signUp: createCustomRoute({
+    operationId: 'signUp',
+    method: 'post',
+    path: '/sign-up',
+    guard: isPublicAccess,
+    middleware: [isNoBot, spamLimiter, emailEnumLimiter],
+    tags: ['auth'],
+    summary: 'Sign up with password',
+    description: 'Registers a new user using an email and password. Sends a verification email upon successful sign up.',
+    security: [],
+    request: {
+      body: {
+        content: { 'application/json': { schema: emailPasswordBodySchema } },
+      },
+    },
+    responses: {
+      200: {
+        description: 'User signed up',
+        headers: z.object({ 'Set-Cookie': cookieSchema }),
+        content: { 'application/json': { schema: successWithoutDataSchema } },
+      },
+      302: {
+        headers: locationSchema,
+        description: 'Redirect to frontend',
+      },
+      ...errorResponses,
+    },
+  }),
+
+  signUpWithToken: createCustomRoute({
+    operationId: 'signUpWithToken',
+    method: 'post',
+    path: '/sign-up/{tokenId}',
+    guard: isPublicAccess,
+    middleware: [tokenLimiter('signup_invitation'), emailEnumLimiter, hasValidToken('invitation')],
+    tags: ['auth'],
+    summary: 'Sign up to accept invite',
+    description: 'Registers a user using an email and password in response to a system or organization invitation.',
+    security: [],
+    request: {
+      params: z.object({ tokenId: z.string() }),
+      body: { content: { 'application/json': { schema: emailPasswordBodySchema } } },
+    },
+    responses: {
+      200: {
+        description: 'User signed up',
+        headers: z.object({ 'Set-Cookie': cookieSchema }),
+        content: { 'application/json': { schema: redirectResponseSchema } },
+      },
+      ...errorResponses,
+    },
+  }),
+
+  verifyEmail: createCustomRoute({
+    operationId: 'verifyEmail',
+    method: 'get',
+    path: '/verify-email/{tokenId}',
+    guard: isPublicAccess,
+    middleware: [tokenLimiter('email_verification'), hasValidToken('email_verification')],
+    tags: ['auth'],
+    summary: 'Verify email by token',
+    description: "Verifies a user's email using a single-use session token in cookie. Grants a session upon success.",
+    security: [],
+    request: {
+      params: z.object({ tokenId: z.string() }),
+      query: z.object({ redirect: z.string().optional() }),
+    },
+    responses: {
+      302: {
+        description: 'Session created and redirected',
+        headers: locationSchema,
+      },
+      ...errorResponses,
+    },
+  }),
+
+  requestPassword: createCustomRoute({
+    operationId: 'requestPassword',
+    method: 'post',
+    path: '/request-password',
+    guard: isPublicAccess,
+    middleware: [spamLimiter, emailEnumLimiter],
+    tags: ['auth'],
+    summary: 'Request new password',
+    description: "Sends an email with a link to reset the user's password.",
+    security: [],
+    request: {
+      body: { content: { 'application/json': { schema: emailBodySchema } } },
+    },
+    responses: {
+      200: {
+        description: 'Password reset email sent',
+        content: { 'application/json': { schema: successWithoutDataSchema } },
+      },
+      ...errorResponses,
+    },
+  }),
+
+  createPasswordWithToken: createCustomRoute({
+    operationId: 'createPassword',
+    method: 'post',
+    path: '/create-password/{tokenId}',
+    guard: isPublicAccess,
+    middleware: [tokenLimiter('password_reset'), hasValidToken('password_reset')],
+    tags: ['auth'],
+    summary: 'Create password',
+    description: 'Sets a new password using a single-use session token in cookie and grants a session immediately upon success.',
+    security: [],
+    request: {
+      params: z.object({ tokenId: z.string() }),
+      body: { content: { 'application/json': { schema: z.object({ password: passwordSchema }) } } },
+    },
+    responses: {
+      200: {
+        description: 'Password created',
+        content: { 'application/json': { schema: redirectResponseSchema } },
+      },
+      ...errorResponses,
+    },
+  }),
+
+  signIn: createCustomRoute({
+    operationId: 'signIn',
+    method: 'post',
+    path: '/sign-in',
+    guard: isPublicAccess,
+    middleware: [passwordLimiter],
+    tags: ['auth'],
+    summary: 'Sign in with password',
+    description: 'Authenticates an existing user using their email and password.',
+    security: [],
+    request: {
+      body: { content: { 'application/json': { schema: emailPasswordBodySchema } } },
+    },
+    responses: {
+      200: {
+        description: 'User signed in',
+        headers: z.object({ 'Set-Cookie': cookieSchema.optional() }),
+        content: { 'application/json': { schema: redirectResponseSchema } },
+      },
+      ...errorResponses,
+    },
+  }),
+};
+
+export default authPasswordsRoutes;
diff --git a/backend/src/modules/auth/passwords/schema.ts b/backend/src/modules/auth/passwords/schema.ts
new file mode 100644
index 000000000..483e1697e
--- /dev/null
+++ b/backend/src/modules/auth/passwords/schema.ts
@@ -0,0 +1,8 @@
+import { z } from '@hono/zod-openapi';
+import { userSchema } from '#/modules/users/schema';
+import { passwordSchema } from '#/utils/schema/common';
+
+export const emailPasswordBodySchema = z.object({
+  email: userSchema.shape.email,
+  password: passwordSchema,
+});
diff --git a/backend/src/modules/auth/routes.ts b/backend/src/modules/auth/routes.ts
deleted file mode 100644
index ac8b5ce12..000000000
--- a/backend/src/modules/auth/routes.ts
+++ /dev/null
@@ -1,503 +0,0 @@
-import { z } from '@hono/zod-openapi';
-import { appConfig } from 'config';
-import { createCustomRoute } from '#/lib/custom-routes';
-import { hasSystemAccess, isAuthenticated, isPublicAccess } from '#/middlewares/guard';
-import { hasValidToken } from '#/middlewares/has-valid-token';
-import { isNoBot } from '#/middlewares/is-no-bot';
-import { emailEnumLimiter, passwordLimiter, spamLimiter, tokenLimiter } from '#/middlewares/rate-limiter/limiters';
-import {
-  emailBodySchema,
-  emailPasswordBodySchema,
-  oauthCallbackQuerySchema,
-  oauthQuerySchema,
-  passkeyChallengeBodySchema,
-  passkeyChallengeSchema,
-  passkeyVerificationBodySchema,
-  tokenWithDataSchema,
-  totpVerificationBodySchema,
-} from '#/modules/auth/schema';
-import { contextEntityWithMembershipSchema } from '#/modules/entities/schema';
-import { cookieSchema, locationSchema, passwordSchema, tokenParamSchema } from '#/utils/schema/common';
-import { errorResponses, redirectResponseSchema, successWithoutDataSchema } from '#/utils/schema/responses';
-
-const authRoutes = {
-  startImpersonation: createCustomRoute({
-    operationId: 'startImpersonation',
-    method: 'get',
-    path: '/impersonation/start',
-    guard: [isAuthenticated, hasSystemAccess],
-    tags: ['auth'],
-    summary: 'Start impersonating',
-    description: 'Allows a system admin to impersonate a specific user by ID, returning a temporary impersonation session.',
-    request: { query: z.object({ targetUserId: z.string() }) },
-    responses: {
-      200: {
-        description: 'Impersonating',
-        headers: z.object({
-          'Set-Cookie': cookieSchema,
-        }),
-        content: {
-          'application/json': {
-            schema: successWithoutDataSchema,
-          },
-        },
-      },
-      ...errorResponses,
-    },
-  }),
-
-  stopImpersonation: createCustomRoute({
-    operationId: 'stopImpersonation',
-    method: 'get',
-    path: '/impersonation/stop',
-    guard: isAuthenticated,
-    tags: ['auth'],
-    summary: 'Stop impersonating',
-    description: 'Ends impersonation by clearing the current impersonation session and restoring the admin context.',
-    responses: {
-      200: {
-        description: 'Stopped impersonating',
-        content: {
-          'application/json': {
-            schema: successWithoutDataSchema,
-          },
-        },
-      },
-      ...errorResponses,
-    },
-  }),
-
-  checkEmail: createCustomRoute({
-    operationId: 'checkEmail',
-    method: 'post',
-    path: '/check-email',
-    guard: isPublicAccess,
-    middleware: [isNoBot, emailEnumLimiter],
-    tags: ['auth'],
-    summary: 'Check if email exists',
-    description: 'Checks if a user with the specified email address exists in the system.',
-    security: [],
-    request: {
-      body: {
-        content: {
-          'application/json': {
-            schema: emailBodySchema,
-          },
-        },
-      },
-    },
-    responses: {
-      200: {
-        description: 'Email exists',
-        content: {
-          'application/json': {
-            schema: successWithoutDataSchema,
-          },
-        },
-      },
-      ...errorResponses,
-    },
-  }),
-
-  signUp: createCustomRoute({
-    operationId: 'signUp',
-    method: 'post',
-    path: '/sign-up',
-    guard: isPublicAccess,
-    middleware: [isNoBot, spamLimiter, emailEnumLimiter],
-    tags: ['auth'],
-    summary: 'Sign up with password',
-    description: 'Registers a new user using an email and password. Sends a verification email upon successful sign up.',
-    security: [],
-    request: {
-      body: {
-        content: { 'application/json': { schema: emailPasswordBodySchema } },
-      },
-    },
-    responses: {
-      200: {
-        description: 'User signed up',
-        headers: z.object({ 'Set-Cookie': cookieSchema }),
-        content: { 'application/json': { schema: successWithoutDataSchema } },
-      },
-      302: {
-        headers: locationSchema,
-        description: 'Redirect to frontend',
-      },
-      ...errorResponses,
-    },
-  }),
-
-  signUpWithToken: createCustomRoute({
-    operationId: 'signUpWithToken',
-    method: 'post',
-    path: '/sign-up/{token}',
-    guard: isPublicAccess,
-    middleware: [tokenLimiter('signup_invitation'), emailEnumLimiter, hasValidToken('invitation')],
-    tags: ['auth'],
-    summary: 'Sign up to accept invite',
-    description: 'Registers a user using an email and password in response to a system or organization invitation.',
-    security: [],
-    request: {
-      params: tokenParamSchema,
-      body: { content: { 'application/json': { schema: emailPasswordBodySchema } } },
-    },
-    responses: {
-      200: {
-        description: 'User signed up',
-        headers: z.object({ 'Set-Cookie': cookieSchema }),
-        content: { 'application/json': { schema: redirectResponseSchema } },
-      },
-      ...errorResponses,
-    },
-  }),
-
-  verifyEmail: createCustomRoute({
-    operationId: 'verifyEmail',
-    method: 'get',
-    path: '/verify-email/{token}',
-    guard: isPublicAccess,
-    middleware: [tokenLimiter('email_verification'), hasValidToken('email_verification')],
-    tags: ['auth'],
-    summary: 'Verify email by token',
-    description: "Verifies a user's email using a token from their verification email. Grants a session upon success.",
-    security: [],
-    request: {
-      params: tokenParamSchema,
-      query: z.object({ redirect: z.string().optional() }),
-    },
-    responses: {
-      302: {
-        description: 'Session created and redirected',
-        headers: locationSchema,
-      },
-      ...errorResponses,
-    },
-  }),
-
-  requestPassword: createCustomRoute({
-    operationId: 'requestPassword',
-    method: 'post',
-    path: '/request-password',
-    guard: isPublicAccess,
-    middleware: [spamLimiter, emailEnumLimiter],
-    tags: ['auth'],
-    summary: 'Request new password',
-    description: "Sends an email with a link to reset the user's password.",
-    security: [],
-    request: {
-      body: { content: { 'application/json': { schema: emailBodySchema } } },
-    },
-    responses: {
-      200: {
-        description: 'Password reset email sent',
-        content: { 'application/json': { schema: successWithoutDataSchema } },
-      },
-      ...errorResponses,
-    },
-  }),
-
-  createPasswordWithToken: createCustomRoute({
-    operationId: 'createPassword',
-    method: 'post',
-    path: '/create-password/{token}',
-    guard: isPublicAccess,
-    middleware: [tokenLimiter('password_reset'), hasValidToken('password_reset')],
-    tags: ['auth'],
-    summary: 'Create password by token',
-    description: 'Sets a new password using a token and grants a session immediately upon success.',
-    security: [],
-    request: {
-      params: tokenParamSchema,
-      body: { content: { 'application/json': { schema: z.object({ password: passwordSchema }) } } },
-    },
-    responses: {
-      200: {
-        description: 'Password created',
-        content: { 'application/json': { schema: redirectResponseSchema } },
-      },
-      ...errorResponses,
-    },
-  }),
-
-  verifyTotp: createCustomRoute({
-    operationId: 'signInWithTotp',
-    method: 'post',
-    path: '/totp-verification',
-    guard: isPublicAccess,
-    // TODO look into rate limit customized for totp
-    middleware: [spamLimiter],
-    tags: ['auth'],
-    summary: 'Verify TOTP',
-    description: 'Validates the TOTP code and completes TOTP based authentication.',
-    security: [],
-    request: {
-      body: { content: { 'application/json': { schema: totpVerificationBodySchema } } },
-    },
-    responses: {
-      200: {
-        description: 'TOTP verified',
-        headers: z.object({ 'Set-Cookie': cookieSchema }),
-        content: { 'application/json': { schema: successWithoutDataSchema } },
-      },
-      ...errorResponses,
-    },
-  }),
-
-  createPasskeyChallenge: createCustomRoute({
-    operationId: 'createPasskeyChallenge',
-    method: 'post',
-    path: '/passkey-challenge',
-    guard: isPublicAccess,
-    // TODO look into rate limit customized for passkeys
-    middleware: [spamLimiter],
-    tags: ['auth'],
-    summary: 'Create passkey challenge',
-    description: 'Initiates the passkey registration or authentication flow by creating a device bound challenge.',
-    security: [],
-    request: { body: { content: { 'application/json': { schema: passkeyChallengeBodySchema } } } },
-    responses: {
-      200: {
-        description: 'Challenge created',
-        content: { 'application/json': { schema: passkeyChallengeSchema } },
-      },
-      ...errorResponses,
-    },
-  }),
-
-  signInWithPasskey: createCustomRoute({
-    operationId: 'signInWithPasskey',
-    method: 'post',
-    path: '/passkey-verification',
-    guard: isPublicAccess,
-    middleware: [tokenLimiter('passkey')],
-    tags: ['auth'],
-    summary: 'Verify passkey',
-    description: 'Validates the signed challenge and completes passkey based authentication.',
-    request: {
-      body: { content: { 'application/json': { schema: passkeyVerificationBodySchema } } },
-    },
-    responses: {
-      200: {
-        description: 'Passkey verified',
-        headers: z.object({ 'Set-Cookie': cookieSchema }),
-        content: { 'application/json': { schema: successWithoutDataSchema } },
-      },
-      ...errorResponses,
-    },
-  }),
-
-  signIn: createCustomRoute({
-    operationId: 'signIn',
-    method: 'post',
-    path: '/sign-in',
-    guard: isPublicAccess,
-    middleware: [passwordLimiter],
-    tags: ['auth'],
-    summary: 'Sign in with password',
-    description: 'Authenticates an existing user using their email and password.',
-    security: [],
-    request: {
-      body: { content: { 'application/json': { schema: emailPasswordBodySchema } } },
-    },
-    responses: {
-      200: {
-        description: 'User signed in',
-        headers: z.object({ 'Set-Cookie': cookieSchema.optional() }),
-        content: { 'application/json': { schema: redirectResponseSchema } },
-      },
-      ...errorResponses,
-    },
-  }),
-
-  checkToken: createCustomRoute({
-    operationId: 'checkToken',
-    method: 'post',
-    path: '/check-token/{tokenId}',
-    guard: isPublicAccess,
-    middleware: isNoBot,
-    tags: ['auth'],
-    summary: 'Check token',
-    description:
-      'Checks by token id - NOT token itself - if a token (e.g. for password reset, email verification, or invite) is still valid and returns basic data if valid.',
-    request: {
-      params: z.object({ tokenId: z.string() }),
-      query: z.object({ type: z.enum(appConfig.tokenTypes) }),
-    },
-    responses: {
-      200: {
-        description: 'Token is valid',
-        content: { 'application/json': { schema: tokenWithDataSchema } },
-      },
-      ...errorResponses,
-    },
-  }),
-
-  acceptEntityInvite: createCustomRoute({
-    operationId: 'acceptEntityInvite',
-    method: 'post',
-    path: '/accept-invite/{token}',
-    guard: [isAuthenticated],
-    middleware: [tokenLimiter('invitation'), hasValidToken('invitation')],
-    tags: ['auth'],
-    summary: 'Accept invitation',
-    description: 'Accepts an invitation token and activates the associated membership or system access.',
-    request: { params: tokenParamSchema },
-    responses: {
-      200: {
-        description: 'Invitation was accepted',
-        content: {
-          'application/json': {
-            schema: contextEntityWithMembershipSchema.extend({ createdAt: z.string() }),
-          },
-        },
-      },
-      ...errorResponses,
-    },
-  }),
-
-  github: createCustomRoute({
-    operationId: 'github',
-    method: 'get',
-    path: '/github',
-    guard: isPublicAccess,
-    tags: ['auth'],
-    summary: 'Authenticate with GitHub',
-    description:
-      'Starts OAuth authentication with GitHub. Can be used for account connection, email verification, invitation process, defaults to authentication.',
-    security: [],
-    request: { query: oauthQuerySchema },
-    responses: {
-      302: {
-        description: 'Redirect to GitHub',
-        headers: locationSchema,
-      },
-      ...errorResponses,
-    },
-  }),
-
-  githubCallback: createCustomRoute({
-    operationId: 'githubCallback',
-    method: 'get',
-    path: '/github/callback',
-    guard: isPublicAccess,
-    middleware: [tokenLimiter('github')],
-    tags: ['auth'],
-    summary: 'Callback for GitHub',
-    description: 'Handles GitHub OAuth callback, retrieves user identity, and establishes a session or links account.',
-    security: [],
-    request: {
-      query: oauthCallbackQuerySchema.extend({
-        error: z.string().optional(),
-        error_description: z.string().optional(),
-        error_uri: z.string().optional(),
-      }),
-    },
-    responses: {
-      302: {
-        description: 'Redirect to frontend',
-        headers: locationSchema,
-      },
-      ...errorResponses,
-    },
-  }),
-
-  google: createCustomRoute({
-    operationId: 'google',
-    method: 'get',
-    path: '/google',
-    guard: isPublicAccess,
-    tags: ['auth'],
-    summary: 'Authenticate with Google',
-    description:
-      'Starts OAuth authentication with Google. Can be used for account connection, email verification, invitation process, defaults to authentication.',
-    security: [],
-    request: { query: oauthQuerySchema },
-    responses: {
-      302: {
-        description: 'Redirect to Google',
-        headers: locationSchema,
-      },
-      ...errorResponses,
-    },
-  }),
-
-  googleCallback: createCustomRoute({
-    operationId: 'googleCallback',
-    method: 'get',
-    path: '/google/callback',
-    guard: isPublicAccess,
-    middleware: [tokenLimiter('google')],
-    tags: ['auth'],
-    summary: 'Callback for Google',
-    description: 'Handles Google OAuth callback, retrieves user identity, and establishes a session or links account.',
-    security: [],
-    request: { query: oauthCallbackQuerySchema },
-    responses: {
-      302: {
-        description: 'Redirect to frontend',
-        headers: locationSchema,
-      },
-      ...errorResponses,
-    },
-  }),
-
-  microsoft: createCustomRoute({
-    operationId: 'microsoft',
-    method: 'get',
-    path: '/microsoft',
-    guard: isPublicAccess,
-    tags: ['auth'],
-    summary: 'Authenticate with Microsoft',
-    description:
-      'Starts OAuth authentication with Microsoft. Can be used for account connection, email verification, invitation process, defaults to authentication.',
-    security: [],
-    request: { query: oauthQuerySchema },
-    responses: {
-      302: {
-        description: 'Redirect to Microsoft',
-        headers: locationSchema,
-      },
-      ...errorResponses,
-    },
-  }),
-
-  microsoftCallback: createCustomRoute({
-    operationId: 'microsoftCallback',
-    method: 'get',
-    path: '/microsoft/callback',
-    guard: isPublicAccess,
-    middleware: [tokenLimiter('microsoft')],
-    tags: ['auth'],
-    summary: 'Callback for Microsoft',
-    description: 'Handles Microsoft OAuth callback, retrieves user identity, and establishes a session or links account.',
-    security: [],
-    request: { query: oauthCallbackQuerySchema },
-    responses: {
-      302: {
-        description: 'Redirect to frontend',
-        headers: locationSchema,
-      },
-      ...errorResponses,
-    },
-  }),
-
-  signOut: createCustomRoute({
-    operationId: 'signOut',
-    method: 'get',
-    path: '/sign-out',
-    guard: isPublicAccess,
-    tags: ['auth'],
-    summary: 'Sign out',
-    description: 'Signs out the *current user* and clears the active session.',
-    responses: {
-      200: {
-        description: 'User signed out',
-        content: { 'application/json': { schema: successWithoutDataSchema } },
-      },
-      ...errorResponses,
-    },
-  }),
-};
-
-export default authRoutes;
diff --git a/backend/src/modules/auth/schema.ts b/backend/src/modules/auth/schema.ts
deleted file mode 100644
index 98da8cde3..000000000
--- a/backend/src/modules/auth/schema.ts
+++ /dev/null
@@ -1,77 +0,0 @@
-import { z } from '@hono/zod-openapi';
-import { appConfig } from 'config';
-import { t } from 'i18next';
-import { membershipSchema } from '#/modules/memberships/schema';
-import { userSchema } from '#/modules/users/schema';
-import { idSchema, passwordSchema } from '#/utils/schema/common';
-
-export const emailBodySchema = z.object({
-  email: userSchema.shape.email,
-});
-
-export const emailPasswordBodySchema = z.object({
-  email: userSchema.shape.email,
-  password: passwordSchema,
-});
-
-export const tokenWithDataSchema = z.object({
-  email: z.email(),
-  role: z.union([membershipSchema.shape.role, z.null()]),
-  userId: idSchema.optional(),
-  organizationName: z.string().optional(),
-  organizationSlug: z.string().optional(),
-  organizationId: z.string().optional(),
-});
-
-const passkeyTypeSchema = z.union([z.literal('authentication'), z.literal('mfa')]);
-const challengeTypeSchema = z.union([...passkeyTypeSchema.options, z.literal('registration')]);
-
-export const passkeyChallengeBodySchema = z
-  .object({
-    type: challengeTypeSchema,
-    email: z.string().optional(),
-  })
-  .refine((data) => (data.type === 'authentication' ? !!data.email : true), { message: t('mfa_schema_requirement') });
-
-export const passkeyChallengeSchema = z.object({ challengeBase64: z.string(), credentialIds: z.array(z.string()) });
-
-export const webAuthnAssertionSchema = z.object({
-  credentialId: z.string(),
-  clientDataJSON: z.string(),
-  authenticatorData: z.string(),
-  signature: z.string(),
-});
-
-export const passkeyVerificationBodySchema = z.object({
-  ...webAuthnAssertionSchema.shape,
-  type: passkeyTypeSchema,
-  email: z.string().optional(),
-});
-
-export const totpVerificationBodySchema = z.object({
-  code: z.string().regex(new RegExp(`^\\d{${appConfig.totpConfig.digits}}$`), `Code must be exactly ${appConfig.totpConfig.digits} digits`),
-});
-
-export const oauthQuerySchema = z
-  .object({
-    type: z.enum(['auth', 'connect', 'invite', 'verify']),
-    redirect: z.string().optional(),
-    connectUserId: z.string().optional(),
-    token: z.string().optional(),
-    tokenId: z.string().optional(),
-  })
-  .refine(
-    (data) => {
-      if (data.type === 'connect') return !!data.connectUserId;
-      if (data.type === 'invite') return !!data.tokenId && !!data.token;
-      return true; // No extra requirements for signIn & signUp
-    },
-    // TODO message is deprecated in favor of 'error'? replace everywhere
-    // TODO2 this doesnt work well when we need a redirect error, what to do?
-    { message: "Missing required field based on 'type'" },
-  );
-
-export const oauthCallbackQuerySchema = z.object({
-  code: z.string(),
-  state: z.string(),
-});
diff --git a/backend/src/modules/auth/totps/handlers.ts b/backend/src/modules/auth/totps/handlers.ts
new file mode 100644
index 000000000..c05aa85cc
--- /dev/null
+++ b/backend/src/modules/auth/totps/handlers.ts
@@ -0,0 +1,147 @@
+import { OpenAPIHono } from '@hono/zod-openapi';
+import { encodeBase32UpperCase } from '@oslojs/encoding';
+import { createTOTPKeyURI } from '@oslojs/otp';
+import { appConfig } from 'config';
+import { eq } from 'drizzle-orm';
+import { db } from '#/db/db';
+import { passkeysTable } from '#/db/schema/passkeys';
+import { totpsTable } from '#/db/schema/totps';
+import { usersTable } from '#/db/schema/users';
+import { type Env, getContextUser } from '#/lib/context';
+import { AppError } from '#/lib/errors';
+import { consumeMfaToken, validateConfirmMfaToken } from '#/modules/auth/helpers/mfa';
+import { setUserSession } from '#/modules/auth/helpers/session';
+import { signInWithTotp } from '#/modules/auth/helpers/totps';
+import { defaultHook } from '#/utils/default-hook';
+import { TimeSpan } from '#/utils/time-span';
+import { getAuthCookie, setAuthCookie } from '../helpers/cookie';
+import authTotpRoutes from './routes';
+import authTotpsRoutes from './routes';
+
+const enabledStrategies: readonly string[] = appConfig.enabledAuthStrategies;
+
+const app = new OpenAPIHono<Env>({ defaultHook });
+
+const authTotpsRouteHandlers = app
+  /*
+   * Register TOTP
+   */
+  .openapi(authTotpsRoutes.createTotpChallenge, async (ctx) => {
+    const user = getContextUser();
+
+    // Generate a 20-byte random secret and encode it as Base32
+    const secretBytes = crypto.getRandomValues(new Uint8Array(20));
+
+    // Base32 → for authenticator app (manual entry or QR code)
+    const manualKey = encodeBase32UpperCase(secretBytes);
+
+    // Save the secret in a short-lived cookie (5 minutes)
+    await setAuthCookie(ctx, 'totp-key', manualKey, new TimeSpan(5, 'm'));
+
+    // otpauth:// URI for QR scanner apps
+    const totpUri = createTOTPKeyURI(appConfig.slug, user.email, secretBytes, appConfig.totpConfig.intervalInSeconds, appConfig.totpConfig.digits);
+
+    return ctx.json({ totpUri, manualKey }, 200);
+  })
+  /*
+   * Activate TOTP
+   */
+  .openapi(authTotpsRoutes.createTotp, async (ctx) => {
+    const { code } = ctx.req.valid('json');
+    const user = getContextUser();
+
+    // Retrieve the encoded totp secret from cookie
+    const encodedSecret = await getAuthCookie(ctx, 'totp-key');
+    if (!encodedSecret) throw new AppError({ status: 400, type: 'invalid_credentials', severity: 'warn' });
+
+    // Verify TOTP code
+    try {
+      const isValid = signInWithTotp(code, encodedSecret);
+      if (!isValid) throw new AppError({ status: 403, type: 'invalid_token', severity: 'warn' });
+    } catch (error) {
+      if (error instanceof AppError) throw error;
+
+      throw new AppError({
+        status: 500,
+        type: 'invalid_credentials',
+        severity: 'error',
+        ...(error instanceof Error ? { originalError: error } : {}),
+      });
+    }
+
+    // Save encoded secret key in database
+    await db.insert(totpsTable).values({ userId: user.id, secret: encodedSecret });
+
+    return ctx.json(true, 200);
+  })
+  /*
+   * Unlink TOTP
+   */
+  .openapi(authTotpsRoutes.deleteTotp, async (ctx) => {
+    const user = getContextUser();
+
+    // Remove all totps linked to this user's email
+    await db.delete(totpsTable).where(eq(totpsTable.userId, user.id));
+
+    // Check if the user still has any passkeys or TOTP entries registered
+    const [userPasskeys, userTotps] = await Promise.all([
+      db.select().from(passkeysTable).where(eq(passkeysTable.userId, user.id)),
+      db.select().from(totpsTable).where(eq(totpsTable.userId, user.id)),
+    ]);
+
+    // If no TOTP and Passkeys exists, disable MFA completely
+    if (!userPasskeys.length || !userTotps.length) {
+      await db.update(usersTable).set({ mfaRequired: false }).where(eq(usersTable.id, user.id));
+    }
+
+    return ctx.json(true, 200);
+  })
+  /*
+   * Verify TOTP
+   */
+  .openapi(authTotpRoutes.signInWithTotp, async (ctx) => {
+    const { code } = ctx.req.valid('json');
+
+    const strategy = 'totp';
+
+    // Verify if strategy allowed
+    if (!enabledStrategies.includes(strategy)) {
+      throw new AppError({ status: 400, type: 'forbidden_strategy', severity: 'error', meta: { strategy } });
+    }
+
+    // Define strategy and session type for metadata/logging purposes
+    const meta = { strategy, sessionType: 'mfa' } as const;
+
+    // Validate MFA token and retrieve user
+    const user = await validateConfirmMfaToken(ctx);
+
+    // Get totp credentials
+    const [credentials] = await db.select().from(totpsTable).where(eq(totpsTable.userId, user.id)).limit(1);
+    if (!credentials) throw new AppError({ status: 404, type: 'not_found', severity: 'warn', meta });
+
+    try {
+      // Verify TOTP code using stored secret
+      const isValid = signInWithTotp(code, credentials.secret);
+      if (!isValid) throw new AppError({ status: 401, type: 'invalid_token', severity: 'warn', meta });
+    } catch (error) {
+      if (error instanceof AppError) throw error;
+
+      throw new AppError({
+        status: 500,
+        type: 'totp_verification_failed',
+        severity: 'error',
+        meta,
+        ...(error instanceof Error ? { originalError: error } : {}),
+      });
+    }
+
+    // Consume the MFA token now that TOTP verification succeeded
+    await consumeMfaToken(ctx);
+
+    // Set user session after successful verification
+    await setUserSession(ctx, user, meta.strategy, meta.sessionType);
+
+    return ctx.json(true, 200);
+  });
+
+export default authTotpsRouteHandlers;
diff --git a/backend/src/modules/auth/totps/routes.ts b/backend/src/modules/auth/totps/routes.ts
new file mode 100644
index 000000000..3f9488143
--- /dev/null
+++ b/backend/src/modules/auth/totps/routes.ts
@@ -0,0 +1,97 @@
+import { z } from '@hono/zod-openapi';
+import { createCustomRoute } from '#/lib/custom-routes';
+import { isAuthenticated, isPublicAccess } from '#/middlewares/guard';
+import { spamLimiter } from '#/middlewares/rate-limiter/limiters';
+import { cookieSchema } from '#/utils/schema/common';
+import { errorResponses, successWithoutDataSchema } from '#/utils/schema/responses';
+import { totpCreateBodySchema } from './schema';
+
+const authTotpsRoutes = {
+  createTotpChallenge: createCustomRoute({
+    operationId: 'createTotpChallenge',
+    method: 'post',
+    path: '/totp/register',
+    guard: isAuthenticated,
+    tags: ['me'],
+    summary: 'Create TOTP challenge',
+    description: 'Generates a new TOTP challenge for current user and returns a provisioning URI and Base32 manual key.',
+    security: [],
+    responses: {
+      200: {
+        description: 'Challenge created',
+        content: { 'application/json': { schema: z.object({ totpUri: z.string(), manualKey: z.string() }) } },
+      },
+      ...errorResponses,
+    },
+  }),
+
+  createTotp: createCustomRoute({
+    operationId: 'createTotp',
+    method: 'post',
+    path: '/totp/activate',
+    guard: isAuthenticated,
+    tags: ['me'],
+    summary: 'Activate TOTP',
+    description:
+      'Confirms TOTP setup by verifying a code from the authenticator app for the first time. On success, TOTP is registered for current user.',
+    security: [],
+    request: {
+      body: {
+        required: true,
+        content: { 'application/json': { schema: totpCreateBodySchema.pick({ code: true }) } },
+      },
+    },
+
+    responses: {
+      200: {
+        description: 'TOTP activated',
+        content: { 'application/json': { schema: successWithoutDataSchema } },
+      },
+      ...errorResponses,
+    },
+  }),
+
+  deleteTotp: createCustomRoute({
+    operationId: 'deleteTotp',
+    method: 'delete',
+    path: '/totp',
+    guard: isAuthenticated,
+    tags: ['me'],
+    summary: 'Delete TOTP',
+    description: 'Delete TOTP credential for current user.',
+    security: [],
+    responses: {
+      200: {
+        description: 'TOTP deleted',
+        content: { 'application/json': { schema: successWithoutDataSchema } },
+      },
+      ...errorResponses,
+    },
+  }),
+
+  signInWithTotp: createCustomRoute({
+    operationId: 'signInWithTotp',
+    method: 'post',
+    path: '/totp-verification',
+    guard: isPublicAccess,
+    // TODO look into rate limit customized for totp
+    middleware: [spamLimiter],
+    tags: ['auth'],
+    summary: 'Verify TOTP',
+    description: 'Validates the TOTP code and completes TOTP based authentication.',
+    security: [],
+    request: {
+      body: { content: { 'application/json': { schema: totpCreateBodySchema } } },
+    },
+    responses: {
+      200: {
+        description: 'TOTP verified',
+        headers: z.object({ 'Set-Cookie': cookieSchema }),
+        content: { 'application/json': { schema: successWithoutDataSchema } },
+      },
+      ...errorResponses,
+    },
+  }),
+};
+
+export default authTotpsRoutes;
diff --git a/backend/src/modules/auth/totps/schema.ts b/backend/src/modules/auth/totps/schema.ts
new file mode 100644
index 000000000..3b6d77349
--- /dev/null
+++ b/backend/src/modules/auth/totps/schema.ts
@@ -0,0 +1,6 @@
+import { z } from '@hono/zod-openapi';
+import { appConfig } from 'config';
+
+export const totpCreateBodySchema = z.object({
+  code: z.string().regex(new RegExp(`^\\d{${appConfig.totpConfig.digits}}$`), `Code must be exactly ${appConfig.totpConfig.digits} digits`),
+});
diff --git a/backend/src/modules/entities/schema.ts b/backend/src/modules/entities/schema.ts
index fbbb0001c..a722dcbe0 100644
--- a/backend/src/modules/entities/schema.ts
+++ b/backend/src/modules/entities/schema.ts
@@ -30,7 +30,7 @@ export const userBaseSchema = contextEntityBaseSchema
 export const contextEntitiesQuerySchema = paginationQuerySchema.extend({
   targetUserId: idSchema.optional(),
   targetOrgId: idSchema.optional(),
-  role: z.enum(appConfig.rolesByType.entityRoles).optional(),
+  role: z.enum(appConfig.roles.entityRoles).optional(),
   sort: z.enum(['name', 'createdAt']).default('createdAt').optional(),
   excludeArchived: z
     .enum(['true', 'false'])
diff --git a/backend/src/modules/me/handlers.ts b/backend/src/modules/me/handlers.ts
index 4f8e15dda..adf6f9c89 100644
--- a/backend/src/modules/me/handlers.ts
+++ b/backend/src/modules/me/handlers.ts
@@ -1,6 +1,4 @@
 import { OpenAPIHono, type z } from '@hono/zod-openapi';
-import { encodeBase32UpperCase } from '@oslojs/encoding';
-import { createTOTPKeyURI } from '@oslojs/otp';
 import type { EnabledOAuthProvider, MenuSection } from 'config';
 import { appConfig } from 'config';
 import { and, eq, getTableColumns, inArray, isNotNull, isNull, sql } from 'drizzle-orm';
@@ -11,7 +9,6 @@ import { oauthAccountsTable } from '#/db/schema/oauth-accounts';
 import { passkeysTable } from '#/db/schema/passkeys';
 import { passwordsTable } from '#/db/schema/passwords';
 import { AuthStrategy, sessionsTable } from '#/db/schema/sessions';
-import { tokensTable } from '#/db/schema/tokens';
 import { totpsTable } from '#/db/schema/totps';
 import { unsubscribeTokensTable } from '#/db/schema/unsubscribe-tokens';
 import { usersTable } from '#/db/schema/users';
@@ -22,11 +19,10 @@ import { resolveEntity } from '#/lib/entity';
 import { AppError } from '#/lib/errors';
 import { getParams, getSignature } from '#/lib/transloadit';
 import { isAuthenticated } from '#/middlewares/guard';
-import { deleteAuthCookie, getAuthCookie, setAuthCookie } from '#/modules/auth/helpers/cookie';
-import { deviceInfo } from '#/modules/auth/helpers/device-info';
-import { parseAndValidatePasskeyAttestation, verifyPassKeyPublic } from '#/modules/auth/helpers/passkey';
+import { deleteAuthCookie, getAuthCookie } from '#/modules/auth/helpers/cookie';
+import { verifyPassKeyPublic } from '#/modules/auth/helpers/passkey';
 import { getParsedSessionCookie, setUserSession, validateSession } from '#/modules/auth/helpers/session';
-import { verifyTotp } from '#/modules/auth/helpers/totps';
+import { signInWithTotp } from '#/modules/auth/helpers/totps';
 import { checkSlugAvailable } from '#/modules/entities/helpers/check-slug';
 import { getUserSessions } from '#/modules/me/helpers/get-sessions';
 import { getUserMenuEntities } from '#/modules/me/helpers/get-user-menu-entities';
@@ -37,7 +33,6 @@ import permissionManager from '#/permissions/permissions-config';
 import { defaultHook } from '#/utils/default-hook';
 import { getIsoDate } from '#/utils/iso-date';
 import { logEvent } from '#/utils/logger';
-import { TimeSpan } from '#/utils/time-span';
 import { verifyUnsubscribeToken } from '#/utils/unsubscribe-token';
 
 type UserMenu = z.infer<typeof menuSchema>;
@@ -69,6 +64,7 @@ const meRouteHandlers = app
     // Determine which MFA strategy user is using
     const strategy: Extract<AuthStrategy, 'passkey' | 'totp'> = passkeyData ? 'passkey' : 'totp';
 
+    // TODO isnt this duplicated logic from passkeys module and totps module?
     try {
       // --- Passkey verification ---
       if (passkeyData) {
@@ -100,7 +96,7 @@ const meRouteHandlers = app
         if (!credentials) throw new AppError({ status: 404, type: 'not_found', severity: 'warn' });
 
         // Verify  provided TOTP code
-        const isValid = verifyTotp(totpCode, credentials.secret);
+        const isValid = signInWithTotp(totpCode, credentials.secret);
         if (!isValid) throw new AppError({ status: 401, type: 'invalid_token', severity: 'warn' });
       }
     } catch (error) {
@@ -136,6 +132,7 @@ const meRouteHandlers = app
   .openapi(meRoutes.getMyAuth, async (ctx) => {
     const user = getContextUser();
 
+    // TODO put in helper
     // Queries for user authentication factors
     // Select passkey fields except for sensitive credential data
     const { credentialId, publicKey, ...passkeySelect } = getTableColumns(passkeysTable);
@@ -147,7 +144,7 @@ const meRouteHandlers = app
 
     // Query to get verified OAuth accounts
     const getOAuth = db
-      .select({ providerId: oauthAccountsTable.providerId })
+      .select({ provider: oauthAccountsTable.provider })
       .from(oauthAccountsTable)
       .where(and(eq(oauthAccountsTable.userId, user.id), eq(oauthAccountsTable.verified, true)));
 
@@ -162,7 +159,7 @@ const meRouteHandlers = app
 
     // Filter only providers that are enabled in appConfig
     const enabledOAuth = oauthAccounts
-      .map((el) => el.providerId)
+      .map((el) => el.provider)
       .filter((provider): provider is EnabledOAuthProvider => appConfig.enabledOAuthProviders.includes(provider as EnabledOAuthProvider));
 
     // Return a consolidated JSON response with all relevant auth info
@@ -217,7 +214,7 @@ const meRouteHandlers = app
     return ctx.json(menu, 200);
   })
   /*
-   * Get my invites data
+   * Get my invitations - a combination of pending membership and entity data
    */
   .openapi(meRoutes.getMyInvitations, async (ctx) => {
     const user = getContextUser();
@@ -226,6 +223,7 @@ const meRouteHandlers = app
       appConfig.contextEntityTypes.map((entityType) => {
         const entityTable = entityTables[entityType];
         const entityIdField = appConfig.entityIdFields[entityType];
+        // TODO cant we use an existing select for this? or resolveEntity util?
         const entitySelect = {
           id: entityTable.id,
           entityType: entityTable.entityType,
@@ -239,20 +237,17 @@ const meRouteHandlers = app
           .select({
             entity: entitySelect,
             invitedBy: userBaseSelect,
-            expiresAt: tokensTable.expiresAt,
-            token: tokensTable.token,
-            tokenId: tokensTable.id,
+            membership: membershipsTable,
           })
-          .from(tokensTable)
-          .leftJoin(usersTable, eq(usersTable.id, tokensTable.createdBy))
-          .innerJoin(entityTable, eq(entityTable.id, tokensTable[entityIdField]))
+          .from(membershipsTable)
+          .leftJoin(usersTable, eq(usersTable.id, membershipsTable.createdBy))
+          .innerJoin(entityTable, eq(entityTable.id, membershipsTable[entityIdField]))
           .where(
             and(
-              eq(tokensTable.type, 'invitation'),
-              eq(tokensTable.entityType, entityType),
-              eq(tokensTable.userId, user.id),
-              isNotNull(tokensTable.role),
-              isNull(tokensTable.consumedAt),
+              eq(membershipsTable.contextType, entityType),
+              eq(membershipsTable.userId, user.id),
+              isNotNull(membershipsTable.tokenId),
+              isNull(membershipsTable.activatedAt),
             ),
           );
       }),
@@ -356,133 +351,6 @@ const meRouteHandlers = app
 
     return ctx.json(true, 200);
   })
-  /*
-   * Register passkey
-   */
-  .openapi(meRoutes.createPasskey, async (ctx) => {
-    const { attestationObject, clientDataJSON, nameOnDevice } = ctx.req.valid('json');
-    const user = getContextUser();
-
-    const challengeFromCookie = await getAuthCookie(ctx, 'passkey-challenge');
-    if (!challengeFromCookie) throw new AppError({ status: 401, type: 'invalid_credentials', severity: 'error' });
-
-    const { credentialId, publicKey } = parseAndValidatePasskeyAttestation(clientDataJSON, attestationObject, challengeFromCookie);
-
-    const device = deviceInfo(ctx);
-    const passkeyValue = {
-      userId: user.id,
-      credentialId,
-      publicKey,
-      nameOnDevice,
-      deviceName: device.name,
-      deviceType: device.type,
-      deviceOs: device.os,
-      browser: device.browser,
-    };
-
-    const { credentialId: _, publicKey: __, ...passkeySelect } = getTableColumns(passkeysTable);
-
-    // Save public key in database
-    const [newPasskey] = await db.insert(passkeysTable).values(passkeyValue).returning(passkeySelect);
-
-    return ctx.json(newPasskey, 200);
-  })
-  /*
-   * Delete passkey
-   */
-  .openapi(meRoutes.deletePasskey, async (ctx) => {
-    const { id } = ctx.req.valid('param');
-    const user = getContextUser();
-
-    // Remove all passkeys linked to this user's email
-    await db.delete(passkeysTable).where(and(eq(passkeysTable.userId, user.id), eq(passkeysTable.id, id)));
-
-    // Check if the user still has any passkeys or TOTP entries registered
-    const [userPasskeys, userTotps] = await Promise.all([
-      db.select().from(passkeysTable).where(eq(passkeysTable.userId, user.id)),
-      db.select().from(totpsTable).where(eq(totpsTable.userId, user.id)),
-    ]);
-
-    // If no TOTP and Passkeys exists, disable MFA completely
-    if (!userPasskeys.length || !userTotps.length) {
-      await db.update(usersTable).set({ mfaRequired: false }).where(eq(usersTable.id, user.id));
-    }
-
-    return ctx.json(true, 200);
-  })
-  /*
-   * Register TOTP
-   */
-  .openapi(meRoutes.registerTotp, async (ctx) => {
-    const user = getContextUser();
-
-    // Generate a 20-byte random secret and encode it as Base32
-    const secretBytes = crypto.getRandomValues(new Uint8Array(20));
-
-    // Base32 → for authenticator app (manual entry or QR code)
-    const manualKey = encodeBase32UpperCase(secretBytes);
-
-    // Save the secret in a short-lived cookie (5 minutes)
-    await setAuthCookie(ctx, 'totp-key', manualKey, new TimeSpan(5, 'm'));
-
-    // otpauth:// URI for QR scanner apps
-    const totpUri = createTOTPKeyURI(appConfig.slug, user.email, secretBytes, appConfig.totpConfig.intervalInSeconds, appConfig.totpConfig.digits);
-
-    return ctx.json({ totpUri, manualKey }, 200);
-  })
-  /*
-   * Activate TOTP
-   */
-  .openapi(meRoutes.activateTotp, async (ctx) => {
-    const { code } = ctx.req.valid('json');
-    const user = getContextUser();
-
-    // Retrieve the encoded totp secret from cookie
-    const encodedSecret = await getAuthCookie(ctx, 'totp-key');
-    if (!encodedSecret) throw new AppError({ status: 400, type: 'invalid_credentials', severity: 'warn' });
-
-    // Verify TOTP code
-    try {
-      const isValid = verifyTotp(code, encodedSecret);
-      if (!isValid) throw new AppError({ status: 403, type: 'invalid_token', severity: 'warn' });
-    } catch (error) {
-      if (error instanceof AppError) throw error;
-
-      throw new AppError({
-        status: 500,
-        type: 'invalid_credentials',
-        severity: 'error',
-        ...(error instanceof Error ? { originalError: error } : {}),
-      });
-    }
-
-    // Save encoded secret key in database
-    await db.insert(totpsTable).values({ userId: user.id, secret: encodedSecret });
-
-    return ctx.json(true, 200);
-  })
-  /*
-   * Unlink TOTP
-   */
-  .openapi(meRoutes.deleteTotp, async (ctx) => {
-    const user = getContextUser();
-
-    // Remove all totps linked to this user's email
-    await db.delete(totpsTable).where(eq(totpsTable.userId, user.id));
-
-    // Check if the user still has any passkeys or TOTP entries registered
-    const [userPasskeys, userTotps] = await Promise.all([
-      db.select().from(passkeysTable).where(eq(passkeysTable.userId, user.id)),
-      db.select().from(totpsTable).where(eq(totpsTable.userId, user.id)),
-    ]);
-
-    // If no TOTP and Passkeys exists, disable MFA completely
-    if (!userPasskeys.length || !userTotps.length) {
-      await db.update(usersTable).set({ mfaRequired: false }).where(eq(usersTable.id, user.id));
-    }
-
-    return ctx.json(true, 200);
-  })
   /*
    * Get upload token
    */
diff --git a/backend/src/modules/me/helpers/get-sessions.ts b/backend/src/modules/me/helpers/get-sessions.ts
index b23073248..12778079a 100644
--- a/backend/src/modules/me/helpers/get-sessions.ts
+++ b/backend/src/modules/me/helpers/get-sessions.ts
@@ -3,6 +3,7 @@ import { desc, eq } from 'drizzle-orm';
 import type { Context } from 'hono';
 import { db } from '#/db/db';
 import { sessionsTable } from '#/db/schema/sessions';
+import { Env } from '#/lib/context';
 import { getParsedSessionCookie } from '#/modules/auth/helpers/session';
 import type { sessionSchema } from '#/modules/me/schema';
 
@@ -13,7 +14,7 @@ import type { sessionSchema } from '#/modules/me/schema';
  * @param userId - ID of the user whose sessions are requested.
  * @returns A list of sessions, with an additional `isCurrent` flag indicating if the session is the current active session.
  */
-export const getUserSessions = async (ctx: Context, userId: string): Promise<z.infer<typeof sessionSchema>[]> => {
+export const getUserSessions = async (ctx: Context<Env>, userId: string): Promise<z.infer<typeof sessionSchema>[]> => {
   const sessions = await db.select().from(sessionsTable).where(eq(sessionsTable.userId, userId)).orderBy(desc(sessionsTable.createdAt));
   const { sessionToken } = await getParsedSessionCookie(ctx);
 
diff --git a/backend/src/modules/me/routes.ts b/backend/src/modules/me/routes.ts
index 6dd6506a9..7c9810cd4 100644
--- a/backend/src/modules/me/routes.ts
+++ b/backend/src/modules/me/routes.ts
@@ -2,19 +2,16 @@ import { z } from '@hono/zod-openapi';
 import { createCustomRoute } from '#/lib/custom-routes';
 import { isAuthenticated, isPublicAccess } from '#/middlewares/guard';
 import { tokenLimiter } from '#/middlewares/rate-limiter/limiters';
-import { totpVerificationBodySchema } from '#/modules/auth/schema';
 import {
   meAuthDataSchema,
   meInvitationsSchema,
   menuSchema,
-  passkeyRegistrationBodySchema,
-  passkeySchema,
-  toggleMfaStateBody,
+  toggleMfaBodySchema,
   uploadTokenQuerySchema,
   uploadTokenSchema,
 } from '#/modules/me/schema';
 import { userFlagsSchema, userSchema, userUpdateBodySchema } from '#/modules/users/schema';
-import { entityWithTypeQuerySchema, idSchema, locationSchema } from '#/utils/schema/common';
+import { entityWithTypeQuerySchema, locationSchema } from '#/utils/schema/common';
 import { errorResponses, successWithoutDataSchema, successWithRejectedItemsSchema } from '#/utils/schema/responses';
 
 const meRoutes = {
@@ -60,10 +57,10 @@ const meRoutes = {
     guard: isAuthenticated,
     tags: ['me'],
     summary: 'Get invitations',
-    description: 'Returns a list of pending entity invitations which *current user* received.',
+    description: 'Returns a list of entities with pending memberships - meaning activatedAt is still null.',
     responses: {
       200: {
-        description: 'Invitations pending',
+        description: 'Entity memberships pending',
         content: { 'application/json': { schema: meInvitationsSchema } },
       },
       ...errorResponses,
@@ -224,7 +221,7 @@ const meRoutes = {
     description:
       'Enable or disable multifactor authentication for the *current user*. Requires passkey or TOTP reauthentication if session is older than 1 hour.',
     request: {
-      body: { content: { 'application/json': { schema: toggleMfaStateBody } } },
+      body: { content: { 'application/json': { schema: toggleMfaBodySchema } } },
     },
     responses: {
       200: {
@@ -234,113 +231,5 @@ const meRoutes = {
       ...errorResponses,
     },
   }),
-
-  createPasskey: createCustomRoute({
-    operationId: 'createPasskey',
-    method: 'post',
-    path: '/passkey',
-    guard: isAuthenticated,
-    tags: ['me'],
-    summary: 'Create passkey',
-    description:
-      'Register a passkey for passwordless authentication by verifying a signed challenge and linking it to the *current user*. Multiple passkeys can be created for different devices/browsers.',
-    security: [],
-    request: {
-      body: {
-        required: true,
-        content: { 'application/json': { schema: passkeyRegistrationBodySchema } },
-      },
-    },
-    responses: {
-      200: {
-        description: 'Passkey created',
-        content: { 'application/json': { schema: passkeySchema } },
-      },
-      ...errorResponses,
-    },
-  }),
-
-  deletePasskey: createCustomRoute({
-    operationId: 'deletePasskey',
-    method: 'delete',
-    path: '/passkey/{id}',
-    guard: isAuthenticated,
-    tags: ['me'],
-    summary: 'Delete passkey',
-    description: 'Delete a passkey by id from the *current user*.',
-    security: [],
-    request: {
-      params: z.object({ id: idSchema }),
-    },
-    responses: {
-      200: {
-        description: 'Passkey deleted',
-        content: { 'application/json': { schema: successWithoutDataSchema } },
-      },
-      ...errorResponses,
-    },
-  }),
-
-  registerTotp: createCustomRoute({
-    operationId: 'registerTotp',
-    method: 'post',
-    path: '/totp/register',
-    guard: isAuthenticated,
-    tags: ['me'],
-    summary: 'Register TOTP',
-    description: 'Generates a new TOTP secret for the current user and returns a provisioning URI and Base32 manual key.',
-    security: [],
-    responses: {
-      200: {
-        description: 'totpUri & manualKey',
-        content: { 'application/json': { schema: z.object({ totpUri: z.string(), manualKey: z.string() }) } },
-      },
-      ...errorResponses,
-    },
-  }),
-
-  activateTotp: createCustomRoute({
-    operationId: 'activateTotp',
-    method: 'post',
-    path: '/totp/activate',
-    guard: isAuthenticated,
-    tags: ['me'],
-    summary: 'Activate TOTP',
-    description:
-      'Confirms TOTP setup by verifying a code from the authenticator app for the first time. On success, TOTP is activated for the account.',
-    security: [],
-    request: {
-      body: {
-        required: true,
-        content: { 'application/json': { schema: totpVerificationBodySchema.pick({ code: true }) } },
-      },
-    },
-
-    responses: {
-      200: {
-        description: 'TOTP activated',
-        content: { 'application/json': { schema: successWithoutDataSchema } },
-      },
-      ...errorResponses,
-    },
-  }),
-
-  deleteTotp: createCustomRoute({
-    operationId: 'deleteTotp',
-    method: 'delete',
-    path: '/totp',
-    guard: isAuthenticated,
-    tags: ['me'],
-    summary: 'Delete TOTP',
-    description: 'Delete TOTP credential for current user.',
-    security: [],
-    responses: {
-      200: {
-        description: 'TOTP deleted',
-        content: { 'application/json': { schema: successWithoutDataSchema } },
-      },
-      ...errorResponses,
-    },
-  }),
 };
 export default meRoutes;
diff --git a/backend/src/modules/me/schema.ts b/backend/src/modules/me/schema.ts
index f4512099f..98aeeb769 100644
--- a/backend/src/modules/me/schema.ts
+++ b/backend/src/modules/me/schema.ts
@@ -1,16 +1,15 @@
 import { z } from '@hono/zod-openapi';
 import { appConfig, type ContextEntityType } from 'config';
 import { createSelectSchema } from 'drizzle-zod';
-import { passkeysTable } from '#/db/schema/passkeys';
 import { sessionsTable } from '#/db/schema/sessions';
-import { totpVerificationBodySchema, webAuthnAssertionSchema } from '#/modules/auth/schema';
 import { contextEntityBaseSchema, contextEntityWithMembershipSchema, userBaseSchema } from '#/modules/entities/schema';
 import { membershipBaseSchema } from '#/modules/memberships/schema';
 import { enabledOAuthProvidersEnum } from '#/modules/users/schema';
-import { booleanQuerySchema } from '#/utils/schema/common';
+import { booleanTransformSchema } from '#/utils/schema/common';
+import { passkeySchema, webAuthnAssertionSchema } from '../auth/passkeys/schema';
+import { totpCreateBodySchema } from '../auth/totps/schema';
 
 export const sessionSchema = createSelectSchema(sessionsTable).omit({ token: true }).extend({ isCurrent: z.boolean() });
-export const passkeySchema = createSelectSchema(passkeysTable).omit({ credentialId: true, publicKey: true });
 
 export const meAuthDataSchema = z.object({
   enabledOAuth: z.array(enabledOAuthProvidersEnum),
@@ -45,12 +44,6 @@ export const menuSchema = z
   )
   .openapi('MenuSchema');
 
-export const passkeyRegistrationBodySchema = z.object({
-  attestationObject: z.string(),
-  clientDataJSON: z.string(),
-  nameOnDevice: z.string(),
-});
-
 export const uploadTokenSchema = z.object({
   public: z.boolean(),
   sub: z.string(),
@@ -68,23 +61,21 @@ export const uploadTokenSchema = z.object({
 });
 
 export const uploadTokenQuerySchema = z.object({
-  public: booleanQuerySchema,
+  public: booleanTransformSchema,
   organizationId: z.string().optional(),
   templateId: z.enum(appConfig.uploadTemplateIds),
 });
 
-export const toggleMfaStateBody = z.object({
+export const toggleMfaBodySchema = z.object({
   passkeyData: webAuthnAssertionSchema.optional(),
-  totpCode: totpVerificationBodySchema.shape.code.optional(),
+  totpCode: totpCreateBodySchema.shape.code.optional(),
   mfaRequired: z.boolean(),
 });
 
 export const meInvitationsSchema = z.array(
   z.object({
     entity: contextEntityBaseSchema.extend({ organizationId: z.string().optional() }),
-    expiresAt: z.date(),
     invitedBy: userBaseSchema.nullable(),
-    token: z.string(),
-    tokenId: z.string(),
+    membership: membershipBaseSchema,
   }),
 );
diff --git a/backend/src/modules/memberships/handlers.ts b/backend/src/modules/memberships/handlers.ts
index 8d9279eb5..ba2f2b236 100644
--- a/backend/src/modules/memberships/handlers.ts
+++ b/backend/src/modules/memberships/handlers.ts
@@ -66,7 +66,7 @@ const membershipRouteHandlers = app
           inArray(tokensTable.email, normalizedEmails),
           isNotNull(tokensTable.entityType),
           gt(tokensTable.expiresAt, new Date()),
-          isNull(tokensTable.consumedAt),
+          isNull(tokensTable.invokedAt),
         ),
       );
 
@@ -218,10 +218,10 @@ const membershipRouteHandlers = app
     );
 
     // Prepare and send invitation emails
-    const recipients = insertedTokens.map(({ email, token, id }) => ({
+    const recipients = insertedTokens.map(({ email, token }) => ({
       email,
       name: slugFromEmail(email),
-      memberInviteLink: `${appConfig.frontendUrl}/invitation/${token}?tokenId=${id}`,
+      memberInviteLink: `${appConfig.backendAuthUrl}/consume-token/${token}`,
     }));
 
     const emailProps = {
@@ -366,6 +366,53 @@ const membershipRouteHandlers = app
 
     return ctx.json(updatedMembership, 200);
   })
+  /*
+   * Accept - or reject - organization membership invitation
+   */
+  .openapi(membershipRoutes.acceptMembership, async (ctx) => {
+    const { id: membershipId, acceptOrReject } = ctx.req.valid('param');
+
+    const user = getContextUser();
+
+    console.log('TODO, reject not handled', acceptOrReject);
+
+    // TODO use get membership util
+    const [membership] = await db
+      .select()
+      .from(membershipsTable)
+      .where(and(eq(membershipsTable.id, membershipId), isNotNull(membershipsTable.tokenId)))
+      .limit(1);
+    if (!membership) throw new AppError({ status: 404, type: 'membership_not_found', severity: 'error', meta: { membershipId } });
+
+    // Make sure correct user accepts invitation (for example another user could have a sessions and click on email invite of another user)
+    if (user.id !== membership.userId) throw new AppError({ status: 401, type: 'user_mismatch', severity: 'error' });
+
+    // Can't accept already active membership
+    if (membership.activatedAt) throw new AppError({ status: 400, type: 'membership_already_active', severity: 'error', meta: { membershipId } });
+
+    // Can't accept membership without token
+    if (!membership.tokenId) throw new AppError({ status: 400, type: 'membership_without_token', severity: 'error', meta: { membershipId } });
+
+    // Make sure its an organization membership
+    if (membership.contextType !== 'organization') throw new AppError({ status: 401, type: 'invalid_token', severity: 'warn' });
+
+    // Activate memberships, can be multiple if there are nested entity memberships. Eg. organization and project
+    // TODO test this in raak for projects and edge cases
+    const activatedMemberships = await db
+      .update(membershipsTable)
+      .set({ tokenId: null, activatedAt: getIsoDate() })
+      .where(and(eq(membershipsTable.tokenId, membership.tokenId)))
+      .returning();
+
+    const entity = await resolveEntity('organization', membership.organizationId);
+    if (!entity) throw new AppError({ status: 404, type: 'not_found', severity: 'error', entityType: 'organization' });
+
+    eventManager.emit('acceptedMembership', membership);
+
+    logEvent('info', 'Accepted memberships', { ids: activatedMemberships.map((m) => m.id) });
+
+    return ctx.json({ ...entity, membership }, 200);
+  })
   /*
    * Get members by entity id/slug and type
    */
@@ -456,7 +503,7 @@ const membershipRouteHandlers = app
           eq(tokensTable[entityIdField], entity.id),
           eq(tokensTable.organizationId, organization.id),
           isNotNull(tokensTable.role),
-          isNull(tokensTable.consumedAt),
+          isNull(tokensTable.invokedAt),
         ),
       )
       .orderBy(orderColumn);
@@ -479,7 +526,7 @@ const membershipRouteHandlers = app
       eq(tokensTable.email, normalizedEmail),
       isNotNull(tokensTable.entityType),
       isNotNull(tokensTable.role),
-      isNull(tokensTable.consumedAt),
+      isNull(tokensTable.invokedAt),
     ];
     if (tokenId) filters.push(eq(tokensTable.id, tokenId));
 
@@ -528,7 +575,7 @@ const membershipRouteHandlers = app
     const recipient = {
       email: userEmail,
       name: slugFromEmail(userEmail),
-      memberInviteLink: `${appConfig.frontendUrl}/invitation/${newToken}?tokenId=${newTokenId}`,
+      memberInviteLink: `${appConfig.backendAuthUrl}/consume-token/${newToken}`,
     };
 
     const emailProps = {
diff --git a/backend/src/modules/memberships/routes.ts b/backend/src/modules/memberships/routes.ts
index 9ce6fbad5..5480e4363 100644
--- a/backend/src/modules/memberships/routes.ts
+++ b/backend/src/modules/memberships/routes.ts
@@ -13,6 +13,7 @@ import {
 import { memberSchema } from '#/modules/users/schema';
 import { entityWithTypeQuerySchema, idInOrgParamSchema, idOrSlugSchema, idsBodySchema, inOrgParamSchema } from '#/utils/schema/common';
 import { errorResponses, paginationSchema, successWithoutDataSchema, successWithRejectedItemsSchema } from '#/utils/schema/responses';
+import { contextEntityWithMembershipSchema } from '../entities/schema';
 
 const membershipRoutes = {
   createMemberships: createCustomRoute({
@@ -42,6 +43,7 @@ const membershipRoutes = {
       ...errorResponses,
     },
   }),
+
   deleteMemberships: createCustomRoute({
     operationId: 'deleteMemberships',
     method: 'delete',
@@ -69,6 +71,7 @@ const membershipRoutes = {
       ...errorResponses,
     },
   }),
+
   updateMembership: createCustomRoute({
     operationId: 'updateMembership',
     method: 'put',
@@ -95,6 +98,31 @@ const membershipRoutes = {
       ...errorResponses,
     },
   }),
+
+  acceptMembership: createCustomRoute({
+    operationId: 'acceptMembership',
+    method: 'post',
+    path: '/{id}/{acceptOrReject}',
+    guard: isAuthenticated,
+    tags: ['auth'],
+    summary: 'Accept invitation',
+    // TODO reject flow needs to be added
+    description: 'Accepting activates the associated membership. Rejecting adds a rejectedAt timestamp.',
+    request: { params: z.object({ id: z.string(), acceptOrReject: z.enum(['accept', 'reject']) }) },
+    responses: {
+      200: {
+        description: 'Invitation was accepted',
+        content: {
+          'application/json': {
+            // TODO why the extend?
+            schema: contextEntityWithMembershipSchema.extend({ createdAt: z.string() }),
+          },
+        },
+      },
+      ...errorResponses,
+    },
+  }),
+
   getMembers: createCustomRoute({
     operationId: 'getMembers',
     method: 'get',
diff --git a/backend/src/modules/memberships/schema.ts b/backend/src/modules/memberships/schema.ts
index ee61f437d..42c90eac7 100644
--- a/backend/src/modules/memberships/schema.ts
+++ b/backend/src/modules/memberships/schema.ts
@@ -37,7 +37,7 @@ export const memberListQuerySchema = paginationQuerySchema.extend({
   idOrSlug: idOrSlugSchema,
   entityType: contextEntityTypeSchema,
   sort: z.enum(['id', 'name', 'email', 'role', 'createdAt', 'lastSeenAt']).default('createdAt').optional(),
-  role: z.enum(appConfig.rolesByType.entityRoles).optional(),
+  role: z.enum(appConfig.roles.entityRoles).optional(),
 });
 
 export const pendingInvitationListQuerySchema = paginationQuerySchema.extend({
diff --git a/backend/src/modules/requests/handlers.ts b/backend/src/modules/requests/handlers.ts
index 47a79eeca..335e25e6e 100644
--- a/backend/src/modules/requests/handlers.ts
+++ b/backend/src/modules/requests/handlers.ts
@@ -74,7 +74,7 @@ const requestRouteHandlers = app
     const { tokenId, ...requestsSelect } = getTableColumns(requestsTable);
 
     const requestsQuery = db
-      .select({ ...requestsSelect, wasInvited: sql`(${requestsTable.tokenId} IS NOT NULL)`.as('wasInvited') })
+      .select({ ...requestsSelect, wasInvited: sql<boolean>`(${requestsTable.tokenId} IS NOT NULL)::boolean`.as('wasInvited') })
       .from(requestsTable)
       .where(filter);
 
diff --git a/backend/src/modules/system/handlers.ts b/backend/src/modules/system/handlers.ts
index 8fd73c443..b51e97080 100644
--- a/backend/src/modules/system/handlers.ts
+++ b/backend/src/modules/system/handlers.ts
@@ -61,7 +61,7 @@ const systemRouteHandlers = app
           // Make sure its a system invitation
           isNull(tokensTable.entityType),
           lt(tokensTable.expiresAt, new Date()),
-          isNull(tokensTable.consumedAt),
+          isNull(tokensTable.invokedAt),
         ),
       );
 
@@ -109,7 +109,8 @@ const systemRouteHandlers = app
       email: tokenRecord.email,
       lng: lng,
       name: slugFromEmail(tokenRecord.email),
-      systemInviteLink: `${appConfig.frontendUrl}/auth/authenticate?token=${tokenRecord.token}`,
+      // TODO is there a way to import the url from the hono route files?
+      systemInviteLink: `${appConfig.backendAuthUrl}/consume-token/${tokenRecord.token}`,
     }));
 
     type Recipient = (typeof recipients)[number];
diff --git a/backend/src/modules/system/routes.ts b/backend/src/modules/system/routes.ts
index 6c9f13bdd..6c0edf1fc 100644
--- a/backend/src/modules/system/routes.ts
+++ b/backend/src/modules/system/routes.ts
@@ -3,7 +3,7 @@ import { createCustomRoute } from '#/lib/custom-routes';
 import { hasSystemAccess, isAuthenticated, isPublicAccess } from '#/middlewares/guard';
 import { tokenLimiter } from '#/middlewares/rate-limiter/limiters';
 import { inviteBodySchema, preasignedURLQuerySchema, sendNewsletterBodySchema } from '#/modules/system/schema';
-import { booleanQuerySchema } from '#/utils/schema/common';
+import { booleanTransformSchema } from '#/utils/schema/common';
 import { errorResponses, successWithoutDataSchema, successWithRejectedItemsSchema } from '#/utils/schema/responses';
 
 const systemRoutes = {
@@ -42,7 +42,7 @@ const systemRoutes = {
     summary: 'Newsletter to members',
     description: 'Sends a newsletter to members of one or more specified organizations.',
     request: {
-      query: z.object({ toSelf: booleanQuerySchema }),
+      query: z.object({ toSelf: booleanTransformSchema }),
       body: {
         required: true,
         content: {
diff --git a/backend/src/modules/system/schema.ts b/backend/src/modules/system/schema.ts
index f55fa2ca5..c763cafd4 100644
--- a/backend/src/modules/system/schema.ts
+++ b/backend/src/modules/system/schema.ts
@@ -17,7 +17,7 @@ export const preasignedURLQuerySchema = z.object({
 
 export const sendNewsletterBodySchema = z.object({
   organizationIds: z.array(z.string()),
-  roles: z.array(z.enum(appConfig.rolesByType.entityRoles)).min(1, { message: 'Role selection is required' }),
+  roles: z.array(z.enum(appConfig.roles.entityRoles)).min(1, { message: 'Role selection is required' }),
   subject: z.string(),
   content: z.string(),
 });
diff --git a/backend/src/modules/users/schema.ts b/backend/src/modules/users/schema.ts
index e4db2592d..51cfb7bc3 100644
--- a/backend/src/modules/users/schema.ts
+++ b/backend/src/modules/users/schema.ts
@@ -50,7 +50,7 @@ export const userUpdateBodySchema = createInsertSchema(usersTable, {
 export const userListQuerySchema = paginationQuerySchema
   .extend({
     sort: z.enum(['id', 'name', 'email', 'role', 'createdAt', 'lastSeenAt']).default('createdAt').optional(),
-    role: z.enum(appConfig.rolesByType.systemRoles).optional(),
+    role: z.enum(appConfig.roles.systemRoles).optional(),
     mode: z.enum(['all', 'shared']).default('shared'),
     targetEntityType: contextEntityTypeSchema.optional(),
     targetEntityId: z.string().optional(),
diff --git a/backend/src/routes.ts b/backend/src/routes.ts
index 80f8b76da..1c659ca12 100644
--- a/backend/src/routes.ts
+++ b/backend/src/routes.ts
@@ -1,5 +1,8 @@
 import attachmentRouteHandlers from '#/modules/attachments/handlers';
-import authRouteHandlers from '#/modules/auth/handlers';
+import authGeneralRouteHandlers from '#/modules/auth/general/handlers';
+import authOAuthRouteHandlers from '#/modules/auth/oauth/handlers';
+import authPasskeysRouteHandlers from '#/modules/auth/passkeys/handlers';
+import authTotpRouteHandlers from '#/modules/auth/totps/handlers';
 import entityRouteHandlers from '#/modules/entities/handlers';
 import meRouteHandlers from '#/modules/me/handlers';
 import membershipRouteHandlers from '#/modules/memberships/handlers';
@@ -9,10 +12,15 @@ import requestRouteHandlers from '#/modules/requests/handlers';
 import systemRouteHandlers from '#/modules/system/handlers';
 import userRouteHandlers from '#/modules/users/handlers';
 import baseApp from '#/server';
+import authPasswordsRouteHandlers from './modules/auth/passwords/handlers';
 
 // Define backend routes of your app
 const app = baseApp
-  .route('/auth', authRouteHandlers)
+  .route('/auth/', authGeneralRouteHandlers)
+  .route('/auth/', authTotpRouteHandlers)
+  .route('/auth/', authPasswordsRouteHandlers)
+  .route('/auth/', authPasskeysRouteHandlers)
+  .route('/auth/', authOAuthRouteHandlers)
   .route('/me', meRouteHandlers)
   .route('/users', userRouteHandlers)
   .route('/organizations', organizationRouteHandlers)
diff --git a/backend/src/utils/get-valid-single-use-token.ts b/backend/src/utils/get-valid-single-use-token.ts
new file mode 100644
index 000000000..75a111b9e
--- /dev/null
+++ b/backend/src/utils/get-valid-single-use-token.ts
@@ -0,0 +1,45 @@
+import { and, eq } from 'drizzle-orm';
+import { Context } from 'hono';
+import { db } from '#/db/db';
+import { type TokenModel, tokensTable } from '#/db/schema/tokens';
+import { AppError } from '#/lib/errors';
+import { getAuthCookie } from '#/modules/auth/helpers/cookie';
+
+type BaseProps = {
+  ctx: Context;
+  tokenType: TokenModel['type'];
+};
+/**
+ * Validates a single use token by its value, ensuring it matches the required type.
+ * It always removes the single use token cookie.
+ *
+ * @param ctx - Hono context
+ * @param tokenType (optional) The required type of the token (e.g., 'password_reset', 'email_verification').
+ * @returns The valid single use token record from the database.
+ * @throws AppError if the token is not found or of an invalid type.
+ */
+export const getValidSingleUseToken = async ({ ctx, tokenType }: BaseProps): Promise<TokenModel> => {
+  // Find single use token in cookie
+  const singleUseToken = await getAuthCookie(ctx, tokenType);
+  if (!singleUseToken) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error' });
+
+  const condition = [
+    eq(tokensTable.type, tokenType), // Match token type
+    eq(tokensTable.singleUseToken, singleUseToken), // Match token value
+  ];
+
+  const [tokenRecord] = await db
+    .select()
+    .from(tokensTable)
+    .where(and(...condition))
+    .limit(1);
+
+  if (!tokenRecord) throw new AppError({ status: 404, type: 'token_not_found', severity: 'error' });
+
+  // Sanity check
+  if (tokenType && tokenRecord.type !== tokenType) throw new AppError({ status: 401, type: 'invalid_token', severity: 'error' });
+
+  // Create single use session token and mark token as consumed
+
+  return tokenRecord;
+};
diff --git a/backend/src/utils/get-valid-token.ts b/backend/src/utils/get-valid-token.ts
new file mode 100644
index 000000000..4e33e8b74
--- /dev/null
+++ b/backend/src/utils/get-valid-token.ts
@@ -0,0 +1,60 @@
+import { and, eq, gt, isNull } from 'drizzle-orm';
+import { db } from '#/db/db';
+import { type TokenModel, tokensTable } from '#/db/schema/tokens';
+import { AppError } from '#/lib/errors';
+import { isExpiredDate } from '#/utils/is-expired-date';
+import { nanoid } from './nanoid';
+
+type BaseProps = {
+  token: string;
+  consumeToken?: boolean;
+  tokenType?: TokenModel['type'];
+  isRedirect?: boolean;
+};
+/**
+ * Validates a token by its value or ID, ensuring it matches the required type and is neither expired nor consumed.
+ * By default, it consumes the token upon successful validation.
+ *
+ * @param token The token string to validate.
+ * @param consumeToken (optional) Whether to create a new refresh token after validation.
+ * @param tokenType (optional) The required type of the token (e.g., 'password_reset', 'email_verification').
+ * @param isRedirect - Whether error requests should be redirects.
+ * @returns The valid token record from the database.
+ * @throws AppError if the token is not found, expired, or of an invalid type.
+ */
+// TODO redirect always true?
+export const getValidToken = async ({ token, tokenType, consumeToken = true, isRedirect = false }: BaseProps): Promise<TokenModel> => {
+  const condition = [
+    isNull(tokensTable.invokedAt), // Token not yet consumed
+    gt(tokensTable.expiresAt, new Date()), // Token not expired
+    eq(tokensTable.token, token), // Match token value
+  ];
+
+  if (tokenType) condition.push(eq(tokensTable.type, tokenType));
+
+  const [tokenRecord] = await db
+    .select()
+    .from(tokensTable)
+    .where(and(...condition))
+    .limit(1);
+
+  if (!tokenRecord) throw new AppError({ status: 404, type: 'token_not_found', severity: 'error', isRedirect });
+
+  // Token expired
+  if (isExpiredDate(tokenRecord.expiresAt)) throw new AppError({ status: 401, type: `${tokenRecord.type}_expired`, severity: 'warn', isRedirect });
+
+  // Sanity check
+  if (tokenType && tokenRecord.type !== tokenType) throw new AppError({ status: 401, type: 'invalid_token', severity: 'error', isRedirect });
+
+  // Create single use session token and mark token as consumed
+  if (consumeToken) {
+    const [consumedTokenRecord] = await db
+      .update(tokensTable)
+      .set({ singleUseToken: nanoid(40), invokedAt: new Date() })
+      .where(eq(tokensTable.id, tokenRecord.id))
+      .returning();
+    return consumedTokenRecord;
+  }
+
+  return tokenRecord;
+};
diff --git a/backend/src/utils/schema/common.ts b/backend/src/utils/schema/common.ts
index e0a961fa7..ee9890d0c 100644
--- a/backend/src/utils/schema/common.ts
+++ b/backend/src/utils/schema/common.ts
@@ -3,6 +3,13 @@ import { appConfig } from 'config';
 import { t } from 'i18next';
 import { isCDNUrl } from '../is-cdn-url';
 
+/** Schema to use boolean parameters (transform string to boolean) */
+export const booleanTransformSchema = z
+  .union([z.string(), z.boolean()])
+  .default('false')
+  .transform((v) => v === true || v === 'true')
+  .pipe(z.boolean());
+
 /*************************************************************************************************
  * Entity schemas
  ************************************************************************************************/
@@ -51,9 +58,6 @@ export const languageSchema = z.enum(appConfig.languages);
  * Common param schemas
  ************************************************************************************************/
 
-/** Schema for authentication token parameter (token string) */
-export const tokenParamSchema = z.object({ token: z.string() });
-
 /** Schema for entity identifier idOrSlug */
 export const entityParamSchema = z.object({ idOrSlug: idOrSlugSchema });
 
@@ -73,13 +77,6 @@ export const idInOrgParamSchema = z.object({ id: idSchema, orgIdOrSlug: idOrSlug
 /** Schema for idOrSlug that must be a specific entity type */
 export const entityWithTypeQuerySchema = z.object({ idOrSlug: idOrSlugSchema, entityType: contextEntityTypeSchema });
 
-/** Schema to use boolean query parameters (transform string to boolean) */
-export const booleanQuerySchema = z
-  .union([z.string(), z.boolean()])
-  .default('false')
-  .transform((v) => v === true || v === 'true')
-  .pipe(z.boolean());
-
 const offsetRefine = (value: number) => value >= 0;
 const limitMax = 1000;
 const limitRefine = (value: number) => value > 0 && value <= limitMax;
diff --git a/backend/src/utils/validate-token.ts b/backend/src/utils/validate-token.ts
deleted file mode 100644
index 43446ed83..000000000
--- a/backend/src/utils/validate-token.ts
+++ /dev/null
@@ -1,60 +0,0 @@
-import { and, eq, gt, isNull } from 'drizzle-orm';
-import { db } from '#/db/db';
-import { type TokenModel, tokensTable } from '#/db/schema/tokens';
-import { AppError } from '#/lib/errors';
-import { isExpiredDate } from '#/utils/is-expired-date';
-
-type BaseProps = {
-  requiredType: TokenModel['type'];
-  consumeToken?: boolean;
-  isRedirect?: boolean;
-};
-type TokenIdentifierProps = { token: string; tokenId?: never; consumeToken?: true } | { tokenId: string; token?: never; consumeToken?: boolean };
-
-/**
- * Validates a token by its value or ID, ensuring it matches the required type and is neither expired nor consumed.
- * By default, it consumes the token upon successful validation.
- *
- * @param token The token string to validate.
- * @param tokenId The token ID to validate.
- * @param requiredType The required type of the token (e.g., 'password_reset', 'email_verification').
- * @param consumeToken (Default: true) Whether to mark the token as consumed after validation.
- * @param isRedirect - Whether error requests should be redirects.
- * @returns The valid token record from the database.
- * @throws AppError if the token is not found, expired, or of an invalid type.
- */
-export const getValidToken = async ({
-  token,
-  tokenId,
-  requiredType,
-  consumeToken = true,
-  isRedirect = false,
-}: BaseProps & TokenIdentifierProps): Promise<TokenModel> => {
-  const condition = [
-    isNull(tokensTable.consumedAt), // Token not yet consumed
-    gt(tokensTable.expiresAt, new Date()), // Token not expired
-    eq(tokensTable.type, requiredType), // Correct token type
-    ...(token ? [eq(tokensTable.token, token)] : []),
-    ...(tokenId ? [eq(tokensTable.id, tokenId)] : []),
-  ];
-
-  const [tokenRecord] = await db
-    .select()
-    .from(tokensTable)
-    .where(and(...condition))
-    .limit(1);
-
-  const meta = { requiredType };
-
-  if (!tokenRecord) throw new AppError({ status: 404, type: `${requiredType}_not_found`, severity: 'warn', meta, isRedirect });
-
-  // Token expired
-  if (isExpiredDate(tokenRecord.expiresAt)) throw new AppError({ status: 401, type: `${requiredType}_expired`, severity: 'warn', meta, isRedirect });
-
-  // Sanity check
-  if (tokenRecord.type !== requiredType) throw new AppError({ status: 401, type: 'invalid_token', severity: 'error', meta, isRedirect });
-
-  // Consume token after validation
-  if (consumeToken) await db.update(tokensTable).set({ consumedAt: new Date() }).where(eq(tokensTable.id, tokenRecord.id));
-  return tokenRecord;
-};
diff --git a/backend/tests/setup.ts b/backend/tests/setup.ts
index b198108df..929a0a6af 100644
--- a/backend/tests/setup.ts
+++ b/backend/tests/setup.ts
@@ -28,11 +28,17 @@ type ConfigOverride = {
   registrationEnabled?: boolean;
 };
 
+// TODO why not get the actual app from server.ts?
 export async function getAuthApp() {
   const { default: baseApp } = await import('#/server');
-  const { default: authRouteHandlers } = await import('#/modules/auth/handlers');
+  const { default: authGeneralRouteHandlers } = await import('#/modules/auth/general/handlers');
+  const { default: authTotpsRouteHandlers } = await import('#/modules/auth/totps/handlers');
+  const { default: authPasswordsRouteHandlers } = await import('#/modules/auth/passwords/handlers');
 
-  return baseApp.route('/auth', authRouteHandlers);
+  return baseApp
+  .route('/auth', authGeneralRouteHandlers)
+  .route('/auth/totps', authTotpsRouteHandlers)
+  .route('/auth', authPasswordsRouteHandlers)
 }
 
 /**
diff --git a/config/default.ts b/config/default.ts
index d0f2ec557..99b9b132b 100644
--- a/config/default.ts
+++ b/config/default.ts
@@ -113,7 +113,8 @@ The documentation is generated from source code using \`zod\` schemas, converted
 
 /**
  * Enabled authentication strategies.
- * Currently available: 'password', 'passkey', 'oauth' and 'totp.
+ * Currently available: 'password', 'passkey', 'oauth' and 'totp'.
+ * Totp can only be used as a fallback strategy for mfa, with 'passkey' as the primary.
  */
 enabledAuthStrategies: ['password', 'passkey', 'oauth', 'totp'] as const,
 
@@ -125,7 +126,7 @@ enabledAuthStrategies: ['password', 'passkey', 'oauth', 'totp'] as const,
 enabledOAuthProviders: ['github'] as const,
 
   // Token types
-  tokenTypes: ['email_verification', 'password_reset', 'invitation', 'confirm_mfa'] as const,
+  tokenTypes: ['email_verification', 'oauth_verification', 'password_reset', 'invitation', 'confirm_mfa'] as const,
 
   // Optional settings
   has: {
@@ -226,7 +227,7 @@ enabledOAuthProviders: ['github'] as const,
   /**
    * Roles on system and entity level
    */
-  rolesByType: {
+  roles: {
     systemRoles: ['user', 'admin'] as const,
     entityRoles: ['member', 'admin'] as const,
     allRoles: ['user', 'member', 'admin'] as const,
diff --git a/config/index.ts b/config/index.ts
index 49e68db47..c6633f14a 100644
--- a/config/index.ts
+++ b/config/index.ts
@@ -53,11 +53,17 @@ export type UserFlags = typeof appConfig.defaultUserFlags
  * Theme options
  */
 export type Theme = keyof typeof appConfig.theme.colors | 'none';
+
 /**
  * Severity levels to be used in error handling
  */
 export type Severity = keyof typeof appConfig.severityLevels
 
+/**
+ * All token types used in the app
+ */
+export type TokenType = (typeof appConfig.tokenTypes)[number];
+
 const configModes = {
   development,
   tunnel,
diff --git a/frontend/package.json b/frontend/package.json
index 59bfb13ef..a45f06ffb 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -11,6 +11,7 @@
     "dev:run": "cross-env NODE_ENV=development vite --mode development",
     "tunnel": "wait-on http://localhost:4000/ping && cross-env NODE_ENV=tunnel vite --mode tunnel",
     "start": "cross-env NODE_ENV=production pnpm preview",
+    "test": "vitest",
     "ts": "tsc --pretty",
     "ts:beta": "tsgo --pretty",
     "tsperf": "rm -rf tsconfig.tsbuildinfo && cross-env NODE_ENV=development tsc --noEmit --extendedDiagnostics",
@@ -68,13 +69,13 @@
     "@radix-ui/react-visually-hidden": "^1.2.3",
     "@sentry/react": "^9.46.0",
     "@t3-oss/env-core": "^0.13.8",
-    "@tailwindcss/typography": "^0.5.18",
+    "@tailwindcss/typography": "^0.5.19",
     "@tanstack/query-sync-storage-persister": "5.87.4",
     "@tanstack/react-query": "5.87.4",
     "@tanstack/react-query-devtools": "5.87.4",
     "@tanstack/react-query-persist-client": "5.87.4",
-    "@tanstack/react-router": "1.131.41",
-    "@tanstack/react-router-devtools": "1.131.42",
+    "@tanstack/react-router": "1.132.6",
+    "@tanstack/react-router-devtools": "1.132.6",
     "@uppy/audio": "^3.0.1",
     "@uppy/core": "^5.0.2",
     "@uppy/dashboard": "^5.0.2",
@@ -96,9 +97,8 @@
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "cmdk": "^1.1.1",
-"config": "workspace:*",
-"locales": "workspace:*",
     "concurrently": "^9.2.1",
+    "config": "workspace:*",
     "dayjs": "^1.11.18",
     "embla-carousel-autoplay": "^8.6.0",
     "embla-carousel-react": "^8.6.0",
@@ -112,8 +112,9 @@
     "input-otp": "^1.4.2",
     "jspdf": "^3.0.3",
     "jspdf-autotable": "^5.0.2",
+    "locales": "workspace:*",
     "lucide-react": "^0.542.0",
-    "motion": "^12.23.18",
+    "motion": "^12.23.22",
     "nanoid": "^5.1.6",
     "pdfjs-dist": "4.8.69",
     "player.style": "^0.2.0",
@@ -138,7 +139,8 @@
     "tailwindcss-animate": "^1.0.7",
     "use-count-up": "^3.0.1",
     "vaul": "^1.1.2",
-    "virtua": "^0.43.3",
+    "virtua": "^0.43.4",
+    "vitest": "^3.2.4",
     "workbox-window": "^7.3.0",
     "zod": "4.1.8",
     "zustand": "^5.0.8",
@@ -146,17 +148,17 @@
   },
   "devDependencies": {
     "@chromatic-com/storybook": "^4.1.1",
-    "@hey-api/openapi-ts": "^0.84.0",
+    "@hey-api/openapi-ts": "^0.84.3",
     "@react-scan/vite-plugin-react-scan": "^0.1.8",
     "@rollup/plugin-terser": "^0.4.4",
     "@sentry/vite-plugin": "^3.6.1",
-    "@storybook/addon-a11y": "^9.1.7",
-    "@storybook/addon-docs": "^9.1.7",
-    "@storybook/addon-vitest": "^9.1.7",
-    "@storybook/react-vite": "^9.1.7",
+    "@storybook/addon-a11y": "^9.1.8",
+    "@storybook/addon-docs": "^9.1.8",
+    "@storybook/addon-vitest": "^9.1.8",
+    "@storybook/react-vite": "^9.1.8",
     "@tailwindcss/vite": "^4.1.13",
-    "@tanstack/router-core": "^1.131.50",
-    "@tanstack/router-plugin": "^1.131.50",
+    "@tanstack/router-core": "^1.132.6",
+    "@tanstack/router-plugin": "^1.132.6",
     "@types/canvas-confetti": "^1.9.0",
     "@types/node": "^24.5.2",
     "@types/react": "^19.1.13",
@@ -169,12 +171,12 @@
     "@vitest/coverage-v8": "^3.2.4",
     "babel-plugin-react-compiler": "19.1.0-rc.3",
     "cross-env": "^10.0.0",
-    "hono": "4.9.7",
-    "playwright": "^1.55.0",
+    "hono": "4.9.8",
+    "playwright": "^1.55.1",
     "postgres": "^3.4.7",
     "react-scan": "^0.4.3",
     "rollup-plugin-visualizer": "^6.0.3",
-    "storybook": "^9.1.7",
+    "storybook": "^9.1.8",
     "tsx": "^4.20.5",
     "typescript": "^5.9.2",
     "vite": "^7.1.7",
diff --git a/frontend/src/api.gen/sdk.gen.ts b/frontend/src/api.gen/sdk.gen.ts
index af44f0703..108d4502c 100644
--- a/frontend/src/api.gen/sdk.gen.ts
+++ b/frontend/src/api.gen/sdk.gen.ts
@@ -3,21 +3,17 @@
 import type { Client, Options as Options2, TDataShape } from './client';
 import { client } from './client.gen';
 import type {
-  AcceptEntityInviteData,
-  AcceptEntityInviteErrors,
-  AcceptEntityInviteResponses,
-  ActivateTotpData,
-  ActivateTotpErrors,
-  ActivateTotpResponses,
+  AcceptMembershipData,
+  AcceptMembershipErrors,
+  AcceptMembershipResponses,
   CheckEmailData,
   CheckEmailErrors,
   CheckEmailResponses,
   CheckSlugData,
   CheckSlugErrors,
   CheckSlugResponses,
-  CheckTokenData,
-  CheckTokenErrors,
-  CheckTokenResponses,
+  ConsumeTokenData,
+  ConsumeTokenErrors,
   CreateAttachmentData,
   CreateAttachmentErrors,
   CreateAttachmentResponses,
@@ -36,6 +32,12 @@ import type {
   CreateRequestData,
   CreateRequestErrors,
   CreateRequestResponses,
+  CreateTotpChallengeData,
+  CreateTotpChallengeErrors,
+  CreateTotpChallengeResponses,
+  CreateTotpData,
+  CreateTotpErrors,
+  CreateTotpResponses,
   DeleteAttachmentsData,
   DeleteAttachmentsErrors,
   DeleteAttachmentsResponses,
@@ -114,6 +116,9 @@ import type {
   GetRequestsData,
   GetRequestsErrors,
   GetRequestsResponses,
+  GetTokenDataData,
+  GetTokenDataErrors,
+  GetTokenDataResponses,
   GetUploadTokenData,
   GetUploadTokenErrors,
   GetUploadTokenResponses,
@@ -144,9 +149,6 @@ import type {
   RedirectToAttachmentData,
   RedirectToAttachmentErrors,
   RedirectToAttachmentResponses,
-  RegisterTotpData,
-  RegisterTotpErrors,
-  RegisterTotpResponses,
   RequestPasswordData,
   RequestPasswordErrors,
   RequestPasswordResponses,
@@ -249,6 +251,227 @@ export const checkEmail = <ThrowOnError extends boolean = true>(options?: Option
   });
 };
 
+/**
+ * Refresh token
+ * 🌐 Public access
+ *
+ * Validates email token (for password reset, email verification or invitations) and redirects user to backend with a refreshed token in a cookie.
+ *
+ * **GET /auth/consume-token/{token}** ·· [consumeToken](http://localhost:4000/docs#tag/auth/get/auth/consume-token/{token}) ·· _auth_
+ *
+ * @param {consumeTokenData} options
+ * @param {string} options.path.token - `string`
+ * @returns Possible status codes: 302, 400, 401, 403, 404, 429
+ */
+export const consumeToken = <ThrowOnError extends boolean = true>(options: Options<ConsumeTokenData, ThrowOnError>) => {
+  return (options.client ?? client).get<unknown, ConsumeTokenErrors, ThrowOnError, 'data'>({
+    responseStyle: 'data',
+    security: [
+      {
+        in: 'cookie',
+        name: 'cella-development-session-v1',
+        type: 'apiKey',
+      },
+    ],
+    url: '/auth/consume-token/{token}',
+    ...options,
+  });
+};
+
+/**
+ * Get token data
+ * 🌐 Public access
+ *
+ * Get basic token data by id, for password reset and invitation. It returns if the token is still valid and returns basic data if valid.
+ *
+ * **GET /auth/token/{tokenId}** ·· [getTokenData](http://localhost:4000/docs#tag/auth/get/auth/token/{tokenId}) ·· _auth_
+ *
+ * @param {getTokenDataData} options
+ * @param {string} options.path.tokenid - `string`
+ * @param {enum} options.query.type - `enum`
+ * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ */
+export const getTokenData = <ThrowOnError extends boolean = true>(options: Options<GetTokenDataData, ThrowOnError>) => {
+  return (options.client ?? client).get<GetTokenDataResponses, GetTokenDataErrors, ThrowOnError, 'data'>({
+    responseStyle: 'data',
+    security: [
+      {
+        in: 'cookie',
+        name: 'cella-development-session-v1',
+        type: 'apiKey',
+      },
+    ],
+    url: '/auth/token/{tokenId}',
+    ...options,
+  });
+};
+
+/**
+ * Start impersonating
+ * 🛡️ Requires authentication (system access)
+ *
+ * Allows a system admin to impersonate a specific user by ID, returning a temporary impersonation session.
+ *
+ * **GET /auth/impersonation/start** ·· [startImpersonation](http://localhost:4000/docs#tag/auth/get/auth/impersonation/start) ·· _auth_
+ *
+ * @param {startImpersonationData} options
+ * @param {string} options.query.targetuserid - `string`
+ * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ */
+export const startImpersonation = <ThrowOnError extends boolean = true>(options: Options<StartImpersonationData, ThrowOnError>) => {
+  return (options.client ?? client).get<StartImpersonationResponses, StartImpersonationErrors, ThrowOnError, 'data'>({
+    responseStyle: 'data',
+    security: [
+      {
+        in: 'cookie',
+        name: 'cella-development-session-v1',
+        type: 'apiKey',
+      },
+    ],
+    url: '/auth/impersonation/start',
+    ...options,
+  });
+};
+
+/**
+ * Stop impersonating
+ * 🛡️ Requires authentication
+ *
+ * Ends impersonation by clearing the current impersonation session and restoring the admin context.
+ *
+ * **GET /auth/impersonation/stop** ·· [stopImpersonation](http://localhost:4000/docs#tag/auth/get/auth/impersonation/stop) ·· _auth_
+ *
+ * @param {stopImpersonationData} options
+ * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ */
+export const stopImpersonation = <ThrowOnError extends boolean = true>(options?: Options<StopImpersonationData, ThrowOnError>) => {
+  return (options?.client ?? client).get<StopImpersonationResponses, StopImpersonationErrors, ThrowOnError, 'data'>({
+    responseStyle: 'data',
+    security: [
+      {
+        in: 'cookie',
+        name: 'cella-development-session-v1',
+        type: 'apiKey',
+      },
+    ],
+    url: '/auth/impersonation/stop',
+    ...options,
+  });
+};
+
+/**
+ * Sign out
+ * 🌐 Public access
+ *
+ * Signs out the *current user* and clears the active session.
+ *
+ * **GET /auth/sign-out** ·· [signOut](http://localhost:4000/docs#tag/auth/get/auth/sign-out) ·· _auth_
+ *
+ * @param {signOutData} options
+ * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ */
+export const signOut = <ThrowOnError extends boolean = true>(options?: Options<SignOutData, ThrowOnError>) => {
+  return (options?.client ?? client).get<SignOutResponses, SignOutErrors, ThrowOnError, 'data'>({
+    responseStyle: 'data',
+    security: [
+      {
+        in: 'cookie',
+        name: 'cella-development-session-v1',
+        type: 'apiKey',
+      },
+    ],
+    url: '/auth/sign-out',
+    ...options,
+  });
+};
+
+/**
+ * Create TOTP challenge
+ * 🛡️ Requires authentication
+ *
+ * Generates a new TOTP challenge for current user and returns a provisioning URI and Base32 manual key.
+ *
+ * **POST /auth/totp/register** ·· [createTotpChallenge](http://localhost:4000/docs#tag/me/post/auth/totp/register) ·· _me_
+ *
+ * @param {createTotpChallengeData} options
+ * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ */
+export const createTotpChallenge = <ThrowOnError extends boolean = true>(options?: Options<CreateTotpChallengeData, ThrowOnError>) => {
+  return (options?.client ?? client).post<CreateTotpChallengeResponses, CreateTotpChallengeErrors, ThrowOnError, 'data'>({
+    responseStyle: 'data',
+    url: '/auth/totp/register',
+    ...options,
+  });
+};
+
+/**
+ * Activate TOTP
+ * 🛡️ Requires authentication
+ *
+ * Confirms TOTP setup by verifying a code from the authenticator app for the first time. On success, TOTP is registered for current user.
+ *
+ * **POST /auth/totp/activate** ·· [createTotp](http://localhost:4000/docs#tag/me/post/auth/totp/activate) ·· _me_
+ *
+ * @param {createTotpData} options
+ * @param {string=} options.body.code - `string` (optional)
+ * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ */
+export const createTotp = <ThrowOnError extends boolean = true>(options: Options<CreateTotpData, ThrowOnError>) => {
+  return (options.client ?? client).post<CreateTotpResponses, CreateTotpErrors, ThrowOnError, 'data'>({
+    responseStyle: 'data',
+    url: '/auth/totp/activate',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
+  });
+};
+
+/**
+ * Delete TOTP
+ * 🛡️ Requires authentication
+ *
+ * Delete TOTP credential for current user.
+ *
+ * **DELETE /auth/totp** ·· [deleteTotp](http://localhost:4000/docs#tag/me/delete/auth/totp) ·· _me_
+ *
+ * @param {deleteTotpData} options
+ * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ */
+export const deleteTotp = <ThrowOnError extends boolean = true>(options?: Options<DeleteTotpData, ThrowOnError>) => {
+  return (options?.client ?? client).delete<DeleteTotpResponses, DeleteTotpErrors, ThrowOnError, 'data'>({
+    responseStyle: 'data',
+    url: '/auth/totp',
+    ...options,
+  });
+};
+
+/**
+ * Verify TOTP
+ * 🌐 Public access
+ * ⏳ Spam (10/h)
+ *
+ * Validates the TOTP code and completes TOTP based authentication.
+ *
+ * **POST /auth/totp-verification** ·· [signInWithTotp](http://localhost:4000/docs#tag/auth/post/auth/totp-verification) ·· _auth_
+ *
+ * @param {signInWithTotpData} options
+ * @param {string=} options.body.code - `string` (optional)
+ * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ */
+export const signInWithTotp = <ThrowOnError extends boolean = true>(options?: Options<SignInWithTotpData, ThrowOnError>) => {
+  return (options?.client ?? client).post<SignInWithTotpResponses, SignInWithTotpErrors, ThrowOnError, 'data'>({
+    responseStyle: 'data',
+    url: '/auth/totp-verification',
+    ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options?.headers,
+    },
+  });
+};
+
 /**
  * Sign up with password
  * 🌐 Public access
@@ -278,14 +501,14 @@ export const signUp = <ThrowOnError extends boolean = true>(options?: Options<Si
 /**
  * Sign up to accept invite
  * 🌐 Public access
- * ⏳ token_signup_invitation (5/h), Email (5/h)
+ * ⏳ token_signup_invitation (10/h), Email (5/h)
  *
  * Registers a user using an email and password in response to a system or organization invitation.
  *
- * **POST /auth/sign-up/{token}** ·· [signUpWithToken](http://localhost:4000/docs#tag/auth/post/auth/sign-up/{token}) ·· _auth_
+ * **POST /auth/sign-up/{tokenId}** ·· [signUpWithToken](http://localhost:4000/docs#tag/auth/post/auth/sign-up/{tokenId}) ·· _auth_
  *
  * @param {signUpWithTokenData} options
- * @param {string} options.path.token - `string`
+ * @param {string} options.path.tokenid - `string`
  * @param {string=} options.body.email - `string` (optional)
  * @param {string=} options.body.password - `string` (optional)
  * @returns Possible status codes: 200, 400, 401, 403, 404, 429
@@ -293,7 +516,7 @@ export const signUp = <ThrowOnError extends boolean = true>(options?: Options<Si
 export const signUpWithToken = <ThrowOnError extends boolean = true>(options: Options<SignUpWithTokenData, ThrowOnError>) => {
   return (options.client ?? client).post<SignUpWithTokenResponses, SignUpWithTokenErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
-    url: '/auth/sign-up/{token}',
+    url: '/auth/sign-up/{tokenId}',
     ...options,
     headers: {
       'Content-Type': 'application/json',
@@ -305,21 +528,21 @@ export const signUpWithToken = <ThrowOnError extends boolean = true>(options: Op
 /**
  * Verify email by token
  * 🌐 Public access
- * ⏳ token_email_verification (5/h)
+ * ⏳ token_email_verification (10/h)
  *
- * Verifies a user's email using a token from their verification email. Grants a session upon success.
+ * Verifies a user's email using a single-use session token in cookie. Grants a session upon success.
  *
- * **GET /auth/verify-email/{token}** ·· [verifyEmail](http://localhost:4000/docs#tag/auth/get/auth/verify-email/{token}) ·· _auth_
+ * **GET /auth/verify-email/{tokenId}** ·· [verifyEmail](http://localhost:4000/docs#tag/auth/get/auth/verify-email/{tokenId}) ·· _auth_
  *
  * @param {verifyEmailData} options
- * @param {string} options.path.token - `string`
+ * @param {string} options.path.tokenid - `string`
  * @param {string=} options.query.redirect - `string` (optional)
  * @returns Possible status codes: 302, 400, 401, 403, 404, 429
  */
 export const verifyEmail = <ThrowOnError extends boolean = true>(options: Options<VerifyEmailData, ThrowOnError>) => {
   return (options.client ?? client).get<unknown, VerifyEmailErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
-    url: '/auth/verify-email/{token}',
+    url: '/auth/verify-email/{tokenId}',
     ...options,
   });
 };
@@ -350,23 +573,23 @@ export const requestPassword = <ThrowOnError extends boolean = true>(options?: O
 };
 
 /**
- * Create password by token
+ * Create password
  * 🌐 Public access
- * ⏳ token_password_reset (5/h)
+ * ⏳ token_password_reset (10/h)
  *
- * Sets a new password using a token and grants a session immediately upon success.
+ * Sets a new password using a single-use session token in cookie and grants a session immediately upon success.
  *
- * **POST /auth/create-password/{token}** ·· [createPassword](http://localhost:4000/docs#tag/auth/post/auth/create-password/{token}) ·· _auth_
+ * **POST /auth/create-password/{tokenId}** ·· [createPassword](http://localhost:4000/docs#tag/auth/post/auth/create-password/{tokenId}) ·· _auth_
  *
  * @param {createPasswordData} options
- * @param {string} options.path.token - `string`
+ * @param {string} options.path.tokenid - `string`
  * @param {string=} options.body.password - `string` (optional)
  * @returns Possible status codes: 200, 400, 401, 403, 404, 429
  */
 export const createPassword = <ThrowOnError extends boolean = true>(options: Options<CreatePasswordData, ThrowOnError>) => {
   return (options.client ?? client).post<CreatePasswordResponses, CreatePasswordErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
-    url: '/auth/create-password/{token}',
+    url: '/auth/create-password/{tokenId}',
     ...options,
     headers: {
       'Content-Type': 'application/json',
@@ -402,137 +625,111 @@ export const signIn = <ThrowOnError extends boolean = true>(options?: Options<Si
 };
 
 /**
- * Check token
- * 🌐 Public access
+ * Create passkey
+ * 🛡️ Requires authentication
  *
- * Checks by token id - NOT token itself - if a token (e.g. for password reset, email verification, or invite) is still valid and returns basic data if valid.
+ * Register a passkey for passwordless authentication by verifying a signed challenge and linking it to the *current user*. Multiple passkeys can be created for different devices/browsers.
  *
- * **POST /auth/check-token/{tokenId}** ·· [checkToken](http://localhost:4000/docs#tag/auth/post/auth/check-token/{tokenId}) ·· _auth_
+ * **POST /auth/passkey** ·· [createPasskey](http://localhost:4000/docs#tag/me/post/auth/passkey) ·· _me_
  *
- * @param {checkTokenData} options
- * @param {string} options.path.tokenid - `string`
- * @param {enum} options.query.type - `enum`
+ * @param {createPasskeyData} options
+ * @param {string=} options.body.attestationObject - `string` (optional)
+ * @param {string=} options.body.clientDataJSON - `string` (optional)
+ * @param {string=} options.body.nameOnDevice - `string` (optional)
  * @returns Possible status codes: 200, 400, 401, 403, 404, 429
  */
-export const checkToken = <ThrowOnError extends boolean = true>(options: Options<CheckTokenData, ThrowOnError>) => {
-  return (options.client ?? client).post<CheckTokenResponses, CheckTokenErrors, ThrowOnError, 'data'>({
+export const createPasskey = <ThrowOnError extends boolean = true>(options: Options<CreatePasskeyData, ThrowOnError>) => {
+  return (options.client ?? client).post<CreatePasskeyResponses, CreatePasskeyErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
-    security: [
-      {
-        in: 'cookie',
-        name: 'cella-session-v1',
-        type: 'apiKey',
-      },
-    ],
-    url: '/auth/check-token/{tokenId}',
+    url: '/auth/passkey',
     ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
   });
 };
 
 /**
- * Accept invitation
+ * Delete passkey
  * 🛡️ Requires authentication
- * ⏳ token_invitation (5/h)
  *
- * Accepts an invitation token and activates the associated membership or system access.
+ * Delete a passkey by id from the *current user*.
  *
- * **POST /auth/accept-invite/{token}** ·· [acceptEntityInvite](http://localhost:4000/docs#tag/auth/post/auth/accept-invite/{token}) ·· _auth_
+ * **DELETE /auth/passkey/{id}** ·· [deletePasskey](http://localhost:4000/docs#tag/me/delete/auth/passkey/{id}) ·· _me_
  *
- * @param {acceptEntityInviteData} options
- * @param {string} options.path.token - `string`
+ * @param {deletePasskeyData} options
+ * @param {string} options.path.id - `string`
  * @returns Possible status codes: 200, 400, 401, 403, 404, 429
  */
-export const acceptEntityInvite = <ThrowOnError extends boolean = true>(options: Options<AcceptEntityInviteData, ThrowOnError>) => {
-  return (options.client ?? client).post<AcceptEntityInviteResponses, AcceptEntityInviteErrors, ThrowOnError, 'data'>({
+export const deletePasskey = <ThrowOnError extends boolean = true>(options: Options<DeletePasskeyData, ThrowOnError>) => {
+  return (options.client ?? client).delete<DeletePasskeyResponses, DeletePasskeyErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
-    security: [
-      {
-        in: 'cookie',
-        name: 'cella-session-v1',
-        type: 'apiKey',
-      },
-    ],
-    url: '/auth/accept-invite/{token}',
+    url: '/auth/passkey/{id}',
     ...options,
   });
 };
 
 /**
- * Start impersonating
- * 🛡️ Requires authentication (system access)
- *
- * Allows a system admin to impersonate a specific user by ID, returning a temporary impersonation session.
- *
- * **GET /auth/impersonation/start** ·· [startImpersonation](http://localhost:4000/docs#tag/auth/get/auth/impersonation/start) ·· _auth_
- *
- * @param {startImpersonationData} options
- * @param {string} options.query.targetuserid - `string`
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
- */
-export const startImpersonation = <ThrowOnError extends boolean = true>(options: Options<StartImpersonationData, ThrowOnError>) => {
-  return (options.client ?? client).get<StartImpersonationResponses, StartImpersonationErrors, ThrowOnError, 'data'>({
-    responseStyle: 'data',
-    security: [
-      {
-        in: 'cookie',
-        name: 'cella-session-v1',
-        type: 'apiKey',
-      },
-    ],
-    url: '/auth/impersonation/start',
-    ...options,
-  });
-};
-
-/**
- * Stop impersonating
- * 🛡️ Requires authentication
+ * Create passkey challenge
+ * 🌐 Public access
+ * ⏳ Spam (10/h)
  *
- * Ends impersonation by clearing the current impersonation session and restoring the admin context.
+ * Initiates the passkey registration or authentication flow by creating a device bound challenge.
  *
- * **GET /auth/impersonation/stop** ·· [stopImpersonation](http://localhost:4000/docs#tag/auth/get/auth/impersonation/stop) ·· _auth_
+ * **POST /auth/passkey-challenge** ·· [createPasskeyChallenge](http://localhost:4000/docs#tag/auth/post/auth/passkey-challenge) ·· _auth_
  *
- * @param {stopImpersonationData} options
+ * @param {createPasskeyChallengeData} options
+ * @param {enum | enum | enum=} options.body.type - `enum | enum | enum` (optional)
+ * @param {string=} options.body.email - `string` (optional)
  * @returns Possible status codes: 200, 400, 401, 403, 404, 429
  */
-export const stopImpersonation = <ThrowOnError extends boolean = true>(options?: Options<StopImpersonationData, ThrowOnError>) => {
-  return (options?.client ?? client).get<StopImpersonationResponses, StopImpersonationErrors, ThrowOnError, 'data'>({
+export const createPasskeyChallenge = <ThrowOnError extends boolean = true>(options?: Options<CreatePasskeyChallengeData, ThrowOnError>) => {
+  return (options?.client ?? client).post<CreatePasskeyChallengeResponses, CreatePasskeyChallengeErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
-    security: [
-      {
-        in: 'cookie',
-        name: 'cella-session-v1',
-        type: 'apiKey',
-      },
-    ],
-    url: '/auth/impersonation/stop',
+    url: '/auth/passkey-challenge',
     ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options?.headers,
+    },
   });
 };
 
 /**
- * Sign out
+ * Verify passkey
  * 🌐 Public access
+ * ⏳ token_passkey (10/h)
  *
- * Signs out the *current user* and clears the active session.
+ * Validates the signed challenge and completes passkey based authentication.
  *
- * **GET /auth/sign-out** ·· [signOut](http://localhost:4000/docs#tag/auth/get/auth/sign-out) ·· _auth_
+ * **POST /auth/passkey-verification** ·· [signInWithPasskey](http://localhost:4000/docs#tag/auth/post/auth/passkey-verification) ·· _auth_
  *
- * @param {signOutData} options
+ * @param {signInWithPasskeyData} options
+ * @param {string=} options.body.credentialId - `string` (optional)
+ * @param {string=} options.body.clientDataJSON - `string` (optional)
+ * @param {string=} options.body.authenticatorData - `string` (optional)
+ * @param {string=} options.body.signature - `string` (optional)
+ * @param {enum | enum=} options.body.type - `enum | enum` (optional)
+ * @param {string=} options.body.email - `string` (optional)
  * @returns Possible status codes: 200, 400, 401, 403, 404, 429
  */
-export const signOut = <ThrowOnError extends boolean = true>(options?: Options<SignOutData, ThrowOnError>) => {
-  return (options?.client ?? client).get<SignOutResponses, SignOutErrors, ThrowOnError, 'data'>({
+export const signInWithPasskey = <ThrowOnError extends boolean = true>(options?: Options<SignInWithPasskeyData, ThrowOnError>) => {
+  return (options?.client ?? client).post<SignInWithPasskeyResponses, SignInWithPasskeyErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
-    url: '/auth/sign-out',
+    url: '/auth/passkey-verification',
     ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options?.headers,
+    },
   });
 };
 
@@ -611,7 +808,7 @@ export const microsoft = <ThrowOnError extends boolean = true>(options: Options<
 /**
  * Callback for GitHub
  * 🌐 Public access
- * ⏳ token_github (5/h)
+ * ⏳ token_github (10/h)
  *
  * Handles GitHub OAuth callback, retrieves user identity, and establishes a session or links account.
  *
@@ -636,7 +833,7 @@ export const githubCallback = <ThrowOnError extends boolean = true>(options: Opt
 /**
  * Callback for Google
  * 🌐 Public access
- * ⏳ token_google (5/h)
+ * ⏳ token_google (10/h)
  *
  * Handles Google OAuth callback, retrieves user identity, and establishes a session or links account.
  *
@@ -658,7 +855,7 @@ export const googleCallback = <ThrowOnError extends boolean = true>(options: Opt
 /**
  * Callback for Microsoft
  * 🌐 Public access
- * ⏳ token_microsoft (5/h)
+ * ⏳ token_microsoft (10/h)
  *
  * Handles Microsoft OAuth callback, retrieves user identity, and establishes a session or links account.
  *
@@ -677,94 +874,6 @@ export const microsoftCallback = <ThrowOnError extends boolean = true>(options:
   });
 };
 
-/**
- * Create passkey challenge
- * 🌐 Public access
- * ⏳ Spam (10/h)
- *
- * Initiates the passkey registration or authentication flow by creating a device bound challenge.
- *
- * **POST /auth/passkey-challenge** ·· [createPasskeyChallenge](http://localhost:4000/docs#tag/auth/post/auth/passkey-challenge) ·· _auth_
- *
- * @param {createPasskeyChallengeData} options
- * @param {enum | enum | enum=} options.body.type - `enum | enum | enum` (optional)
- * @param {string=} options.body.email - `string` (optional)
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
- */
-export const createPasskeyChallenge = <ThrowOnError extends boolean = true>(options?: Options<CreatePasskeyChallengeData, ThrowOnError>) => {
-  return (options?.client ?? client).post<CreatePasskeyChallengeResponses, CreatePasskeyChallengeErrors, ThrowOnError, 'data'>({
-    responseStyle: 'data',
-    url: '/auth/passkey-challenge',
-    ...options,
-    headers: {
-      'Content-Type': 'application/json',
-      ...options?.headers,
-    },
-  });
-};
-
-/**
- * Verify passkey
- * 🌐 Public access
- * ⏳ token_passkey (5/h)
- *
- * Validates the signed challenge and completes passkey based authentication.
- *
- * **POST /auth/passkey-verification** ·· [signInWithPasskey](http://localhost:4000/docs#tag/auth/post/auth/passkey-verification) ·· _auth_
- *
- * @param {signInWithPasskeyData} options
- * @param {string=} options.body.credentialId - `string` (optional)
- * @param {string=} options.body.clientDataJSON - `string` (optional)
- * @param {string=} options.body.authenticatorData - `string` (optional)
- * @param {string=} options.body.signature - `string` (optional)
- * @param {enum | enum=} options.body.type - `enum | enum` (optional)
- * @param {string=} options.body.email - `string` (optional)
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
- */
-export const signInWithPasskey = <ThrowOnError extends boolean = true>(options?: Options<SignInWithPasskeyData, ThrowOnError>) => {
-  return (options?.client ?? client).post<SignInWithPasskeyResponses, SignInWithPasskeyErrors, ThrowOnError, 'data'>({
-    responseStyle: 'data',
-    security: [
-      {
-        in: 'cookie',
-        name: 'cella-session-v1',
-        type: 'apiKey',
-      },
-    ],
-    url: '/auth/passkey-verification',
-    ...options,
-    headers: {
-      'Content-Type': 'application/json',
-      ...options?.headers,
-    },
-  });
-};
-
-/**
- * Verify TOTP
- * 🌐 Public access
- * ⏳ Spam (10/h)
- *
- * Validates the TOTP code and completes TOTP based authentication.
- *
- * **POST /auth/totp-verification** ·· [signInWithTotp](http://localhost:4000/docs#tag/auth/post/auth/totp-verification) ·· _auth_
- *
- * @param {signInWithTotpData} options
- * @param {string=} options.body.code - `string` (optional)
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
- */
-export const signInWithTotp = <ThrowOnError extends boolean = true>(options?: Options<SignInWithTotpData, ThrowOnError>) => {
-  return (options?.client ?? client).post<SignInWithTotpResponses, SignInWithTotpErrors, ThrowOnError, 'data'>({
-    responseStyle: 'data',
-    url: '/auth/totp-verification',
-    ...options,
-    headers: {
-      'Content-Type': 'application/json',
-      ...options?.headers,
-    },
-  });
-};
-
 /**
  * Delete self
  * 🛡️ Requires authentication
@@ -782,7 +891,7 @@ export const deleteMe = <ThrowOnError extends boolean = true>(options?: Options<
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -808,7 +917,7 @@ export const getMe = <ThrowOnError extends boolean = true>(options?: Options<Get
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -842,7 +951,7 @@ export const updateMe = <ThrowOnError extends boolean = true>(options?: Options<
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -875,7 +984,7 @@ export const toggleMfa = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -905,7 +1014,7 @@ export const getMyAuth = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -931,7 +1040,7 @@ export const getMyMenu = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -944,7 +1053,7 @@ export const getMyMenu = <ThrowOnError extends boolean = true>(options?: Options
  * Get invitations
  * 🛡️ Requires authentication
  *
- * Returns a list of pending entity invitations which *current user* received.
+ * Returns a list of entities with pending memberships - meaning activatedAt is still null.
  *
  * **GET /me/invitations** ·· [getMyInvitations](http://localhost:4000/docs#tag/me/get/me/invitations) ·· _me_
  *
@@ -957,7 +1066,7 @@ export const getMyInvitations = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -984,7 +1093,7 @@ export const deleteMySessions = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1018,114 +1127,6 @@ export const deleteMyMembership = <ThrowOnError extends boolean = true>(options:
   });
 };
 
-/**
- * Create passkey
- * 🛡️ Requires authentication
- *
- * Register a passkey for passwordless authentication by verifying a signed challenge and linking it to the *current user*. Multiple passkeys can be created for different devices/browsers.
- *
- * **POST /me/passkey** ·· [createPasskey](http://localhost:4000/docs#tag/me/post/me/passkey) ·· _me_
- *
- * @param {createPasskeyData} options
- * @param {string=} options.body.attestationObject - `string` (optional)
- * @param {string=} options.body.clientDataJSON - `string` (optional)
- * @param {string=} options.body.nameOnDevice - `string` (optional)
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
- */
-export const createPasskey = <ThrowOnError extends boolean = true>(options: Options<CreatePasskeyData, ThrowOnError>) => {
-  return (options.client ?? client).post<CreatePasskeyResponses, CreatePasskeyErrors, ThrowOnError, 'data'>({
-    responseStyle: 'data',
-    url: '/me/passkey',
-    ...options,
-    headers: {
-      'Content-Type': 'application/json',
-      ...options.headers,
-    },
-  });
-};
-
-/**
- * Delete passkey
- * 🛡️ Requires authentication
- *
- * Delete a passkey by id from the *current user*.
- *
- * **DELETE /me/passkey/{id}** ·· [deletePasskey](http://localhost:4000/docs#tag/me/delete/me/passkey/{id}) ·· _me_
- *
- * @param {deletePasskeyData} options
- * @param {string} options.path.id - `string`
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
- */
-export const deletePasskey = <ThrowOnError extends boolean = true>(options: Options<DeletePasskeyData, ThrowOnError>) => {
-  return (options.client ?? client).delete<DeletePasskeyResponses, DeletePasskeyErrors, ThrowOnError, 'data'>({
-    responseStyle: 'data',
-    url: '/me/passkey/{id}',
-    ...options,
-  });
-};
-
-/**
- * Register TOTP
- * 🛡️ Requires authentication
- *
- * Generates a new TOTP secret for the current user and returns a provisioning URI and Base32 manual key.
- *
- * **POST /me/totp/register** ·· [registerTotp](http://localhost:4000/docs#tag/me/post/me/totp/register) ·· _me_
- *
- * @param {registerTotpData} options
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
- */
-export const registerTotp = <ThrowOnError extends boolean = true>(options?: Options<RegisterTotpData, ThrowOnError>) => {
-  return (options?.client ?? client).post<RegisterTotpResponses, RegisterTotpErrors, ThrowOnError, 'data'>({
-    responseStyle: 'data',
-    url: '/me/totp/register',
-    ...options,
-  });
-};
-
-/**
- * Activate TOTP
- * 🛡️ Requires authentication
- *
- * Confirms TOTP setup by verifying a code from the authenticator app for the first time. On success, TOTP is activated for the account.
- *
- * **POST /me/totp/activate** ·· [activateTotp](http://localhost:4000/docs#tag/me/post/me/totp/activate) ·· _me_
- *
- * @param {activateTotpData} options
- * @param {string=} options.body.code - `string` (optional)
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
- */
-export const activateTotp = <ThrowOnError extends boolean = true>(options: Options<ActivateTotpData, ThrowOnError>) => {
-  return (options.client ?? client).post<ActivateTotpResponses, ActivateTotpErrors, ThrowOnError, 'data'>({
-    responseStyle: 'data',
-    url: '/me/totp/activate',
-    ...options,
-    headers: {
-      'Content-Type': 'application/json',
-      ...options.headers,
-    },
-  });
-};
-
-/**
- * Delete TOTP
- * 🛡️ Requires authentication
- *
- * Delete TOTP credential for current user.
- *
- * **DELETE /me/totp** ·· [deleteTotp](http://localhost:4000/docs#tag/me/delete/me/totp) ·· _me_
- *
- * @param {deleteTotpData} options
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
- */
-export const deleteTotp = <ThrowOnError extends boolean = true>(options?: Options<DeleteTotpData, ThrowOnError>) => {
-  return (options?.client ?? client).delete<DeleteTotpResponses, DeleteTotpErrors, ThrowOnError, 'data'>({
-    responseStyle: 'data',
-    url: '/me/totp',
-    ...options,
-  });
-};
-
 /**
  * Get upload token
  * 🛡️ Requires authentication
@@ -1146,7 +1147,7 @@ export const getUploadToken = <ThrowOnError extends boolean = true>(options: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1158,7 +1159,7 @@ export const getUploadToken = <ThrowOnError extends boolean = true>(options: Opt
 /**
  * Unsubscribe
  * 🌐 Public access
- * ⏳ token_unsubscribe (5/h)
+ * ⏳ token_unsubscribe (10/h)
  *
  * Unsubscribes the user from email notifications using a personal unsubscribe token. No authentication is required, as the token implicitly identifies the *current user*.
  *
@@ -1174,7 +1175,7 @@ export const unsubscribeMe = <ThrowOnError extends boolean = true>(options: Opti
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1201,7 +1202,7 @@ export const deleteUsers = <ThrowOnError extends boolean = true>(options?: Optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1240,7 +1241,7 @@ export const getUsers = <ThrowOnError extends boolean = true>(options?: Options<
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1267,7 +1268,7 @@ export const getUser = <ThrowOnError extends boolean = true>(options: Options<Ge
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1301,7 +1302,7 @@ export const updateUser = <ThrowOnError extends boolean = true>(options: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1332,7 +1333,7 @@ export const deleteOrganizations = <ThrowOnError extends boolean = true>(options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1367,7 +1368,7 @@ export const getOrganizations = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1395,7 +1396,7 @@ export const createOrganization = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1426,7 +1427,7 @@ export const getOrganization = <ThrowOnError extends boolean = true>(options: Op
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1470,7 +1471,7 @@ export const updateOrganization = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1514,7 +1515,7 @@ export const getContextEntities = <ThrowOnError extends boolean = true>(options?
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1543,7 +1544,7 @@ export const getContextEntity = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1572,7 +1573,7 @@ export const checkSlug = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1603,7 +1604,7 @@ export const systemInvite = <ThrowOnError extends boolean = true>(options?: Opti
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1635,7 +1636,7 @@ export const getPresignedUrl = <ThrowOnError extends boolean = true>(options: Op
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1647,7 +1648,7 @@ export const getPresignedUrl = <ThrowOnError extends boolean = true>(options: Op
 /**
  * Paddle webhook (WIP)
  * 🌐 Public access
- * ⏳ token_paddle (5/h)
+ * ⏳ token_paddle (10/h)
  *
  * Receives and handles Paddle subscription events such as purchases, renewals, and cancellations.
  *
@@ -1662,7 +1663,7 @@ export const paddleWebhook = <ThrowOnError extends boolean = true>(options?: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1697,7 +1698,7 @@ export const sendNewsletter = <ThrowOnError extends boolean = true>(options: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1728,7 +1729,7 @@ export const deleteRequests = <ThrowOnError extends boolean = true>(options?: Op
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1763,7 +1764,7 @@ export const getRequests = <ThrowOnError extends boolean = true>(options?: Optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1793,7 +1794,7 @@ export const createRequest = <ThrowOnError extends boolean = true>(options?: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1824,7 +1825,7 @@ export const getMetrics = <ThrowOnError extends boolean = true>(options?: Option
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1851,7 +1852,7 @@ export const getPublicCounts = <ThrowOnError extends boolean = true>(options?: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1886,7 +1887,7 @@ export const shapeProxy = <ThrowOnError extends boolean = true>(options: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1914,7 +1915,7 @@ export const deleteAttachments = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1951,7 +1952,7 @@ export const getAttachments = <ThrowOnError extends boolean = true>(options: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1978,7 +1979,7 @@ export const createAttachment = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2010,7 +2011,7 @@ export const getAttachment = <ThrowOnError extends boolean = true>(options: Opti
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2040,7 +2041,7 @@ export const updateAttachment = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2056,7 +2057,7 @@ export const updateAttachment = <ThrowOnError extends boolean = true>(options: O
 /**
  * Redirect to attachment
  * 🌐 Public access
- * ⏳ token_attachment_redirect (5/h)
+ * ⏳ token_attachment_redirect (10/h)
  *
  * Redirects to the file's public or presigned URL, depending on storage visibility.
  *
@@ -2072,7 +2073,7 @@ export const redirectToAttachment = <ThrowOnError extends boolean = true>(option
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2102,7 +2103,7 @@ export const deleteMemberships = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2137,7 +2138,7 @@ export const membershipInvite = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2173,7 +2174,7 @@ export const updateMembership = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2186,6 +2187,34 @@ export const updateMembership = <ThrowOnError extends boolean = true>(options: O
   });
 };
 
+/**
+ * Accept invitation
+ * 🛡️ Requires authentication
+ *
+ * Accepting activates the associated membership. Rejecting adds a rejectedAt timestamp.
+ *
+ * **POST /{orgIdOrSlug}/memberships/{id}/{acceptOrReject}** ·· [acceptMembership](http://localhost:4000/docs#tag/auth/post/{orgIdOrSlug}/memberships/{id}/{acceptOrReject}) ·· _auth_
+ *
+ * @param {acceptMembershipData} options
+ * @param {string} options.path.id - `string`
+ * @param {enum} options.path.acceptorreject - `enum`
+ * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ */
+export const acceptMembership = <ThrowOnError extends boolean = true>(options: Options<AcceptMembershipData, ThrowOnError>) => {
+  return (options.client ?? client).post<AcceptMembershipResponses, AcceptMembershipErrors, ThrowOnError, 'data'>({
+    responseStyle: 'data',
+    security: [
+      {
+        in: 'cookie',
+        name: 'cella-development-session-v1',
+        type: 'apiKey',
+      },
+    ],
+    url: '/{orgIdOrSlug}/memberships/{id}/{acceptOrReject}',
+    ...options,
+  });
+};
+
 /**
  * Get list of members
  * 🛡️ Requires authentication (org access)
@@ -2212,7 +2241,7 @@ export const getMembers = <ThrowOnError extends boolean = true>(options: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2246,7 +2275,7 @@ export const getPendingInvitations = <ThrowOnError extends boolean = true>(optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
diff --git a/frontend/src/api.gen/types.gen.ts b/frontend/src/api.gen/types.gen.ts
index 3a96bd343..ea91fa373 100644
--- a/frontend/src/api.gen/types.gen.ts
+++ b/frontend/src/api.gen/types.gen.ts
@@ -257,17 +257,16 @@ export type CheckEmailResponses = {
 
 export type CheckEmailResponse = CheckEmailResponses[keyof CheckEmailResponses];
 
-export type SignUpData = {
-  body?: {
-    email: string;
-    password: string;
+export type ConsumeTokenData = {
+  body?: never;
+  path: {
+    token: string;
   };
-  path?: never;
   query?: never;
-  url: '/auth/sign-up';
+  url: '/auth/consume-token/{token}';
 };
 
-export type SignUpErrors = {
+export type ConsumeTokenErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -300,30 +299,20 @@ export type SignUpErrors = {
   };
 };
 
-export type SignUpError = SignUpErrors[keyof SignUpErrors];
-
-export type SignUpResponses = {
-  /**
-   * User signed up
-   */
-  200: boolean;
-};
-
-export type SignUpResponse = SignUpResponses[keyof SignUpResponses];
+export type ConsumeTokenError = ConsumeTokenErrors[keyof ConsumeTokenErrors];
 
-export type SignUpWithTokenData = {
-  body?: {
-    email: string;
-    password: string;
-  };
+export type GetTokenDataData = {
+  body?: never;
   path: {
-    token: string;
+    tokenId: string;
   };
-  query?: never;
-  url: '/auth/sign-up/{token}';
+  query: {
+    type: 'email_verification' | 'oauth_verification' | 'password_reset' | 'invitation' | 'confirm_mfa';
+  };
+  url: '/auth/token/{tokenId}';
 };
 
-export type SignUpWithTokenErrors = {
+export type GetTokenDataErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -356,32 +345,34 @@ export type SignUpWithTokenErrors = {
   };
 };
 
-export type SignUpWithTokenError = SignUpWithTokenErrors[keyof SignUpWithTokenErrors];
+export type GetTokenDataError = GetTokenDataErrors[keyof GetTokenDataErrors];
 
-export type SignUpWithTokenResponses = {
+export type GetTokenDataResponses = {
   /**
-   * User signed up
+   * Token is valid
    */
   200: {
-    shouldRedirect: boolean;
-    redirectPath?: string;
+    email: string;
+    role: 'member' | 'admin' | null;
+    userId?: string;
+    organizationName?: string;
+    organizationSlug?: string;
+    organizationId?: string;
   };
 };
 
-export type SignUpWithTokenResponse = SignUpWithTokenResponses[keyof SignUpWithTokenResponses];
+export type GetTokenDataResponse = GetTokenDataResponses[keyof GetTokenDataResponses];
 
-export type VerifyEmailData = {
+export type StartImpersonationData = {
   body?: never;
-  path: {
-    token: string;
-  };
-  query?: {
-    redirect?: string;
+  path?: never;
+  query: {
+    targetUserId: string;
   };
-  url: '/auth/verify-email/{token}';
+  url: '/auth/impersonation/start';
 };
 
-export type VerifyEmailErrors = {
+export type StartImpersonationErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -414,18 +405,25 @@ export type VerifyEmailErrors = {
   };
 };
 
-export type VerifyEmailError = VerifyEmailErrors[keyof VerifyEmailErrors];
+export type StartImpersonationError = StartImpersonationErrors[keyof StartImpersonationErrors];
 
-export type RequestPasswordData = {
-  body?: {
-    email: string;
-  };
+export type StartImpersonationResponses = {
+  /**
+   * Impersonating
+   */
+  200: boolean;
+};
+
+export type StartImpersonationResponse = StartImpersonationResponses[keyof StartImpersonationResponses];
+
+export type StopImpersonationData = {
+  body?: never;
   path?: never;
   query?: never;
-  url: '/auth/request-password';
+  url: '/auth/impersonation/stop';
 };
 
-export type RequestPasswordErrors = {
+export type StopImpersonationErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -458,29 +456,25 @@ export type RequestPasswordErrors = {
   };
 };
 
-export type RequestPasswordError = RequestPasswordErrors[keyof RequestPasswordErrors];
+export type StopImpersonationError = StopImpersonationErrors[keyof StopImpersonationErrors];
 
-export type RequestPasswordResponses = {
+export type StopImpersonationResponses = {
   /**
-   * Password reset email sent
+   * Stopped impersonating
    */
   200: boolean;
 };
 
-export type RequestPasswordResponse = RequestPasswordResponses[keyof RequestPasswordResponses];
+export type StopImpersonationResponse = StopImpersonationResponses[keyof StopImpersonationResponses];
 
-export type CreatePasswordData = {
-  body?: {
-    password: string;
-  };
-  path: {
-    token: string;
-  };
+export type SignOutData = {
+  body?: never;
+  path?: never;
   query?: never;
-  url: '/auth/create-password/{token}';
+  url: '/auth/sign-out';
 };
 
-export type CreatePasswordErrors = {
+export type SignOutErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -513,31 +507,25 @@ export type CreatePasswordErrors = {
   };
 };
 
-export type CreatePasswordError = CreatePasswordErrors[keyof CreatePasswordErrors];
+export type SignOutError = SignOutErrors[keyof SignOutErrors];
 
-export type CreatePasswordResponses = {
+export type SignOutResponses = {
   /**
-   * Password created
+   * User signed out
    */
-  200: {
-    shouldRedirect: boolean;
-    redirectPath?: string;
-  };
+  200: boolean;
 };
 
-export type CreatePasswordResponse = CreatePasswordResponses[keyof CreatePasswordResponses];
+export type SignOutResponse = SignOutResponses[keyof SignOutResponses];
 
-export type SignInData = {
-  body?: {
-    email: string;
-    password: string;
-  };
+export type CreateTotpChallengeData = {
+  body?: never;
   path?: never;
   query?: never;
-  url: '/auth/sign-in';
+  url: '/auth/totp/register';
 };
 
-export type SignInErrors = {
+export type CreateTotpChallengeErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -570,32 +558,30 @@ export type SignInErrors = {
   };
 };
 
-export type SignInError = SignInErrors[keyof SignInErrors];
+export type CreateTotpChallengeError = CreateTotpChallengeErrors[keyof CreateTotpChallengeErrors];
 
-export type SignInResponses = {
+export type CreateTotpChallengeResponses = {
   /**
-   * User signed in
+   * Challenge created
    */
   200: {
-    shouldRedirect: boolean;
-    redirectPath?: string;
+    totpUri: string;
+    manualKey: string;
   };
 };
 
-export type SignInResponse = SignInResponses[keyof SignInResponses];
+export type CreateTotpChallengeResponse = CreateTotpChallengeResponses[keyof CreateTotpChallengeResponses];
 
-export type CheckTokenData = {
-  body?: never;
-  path: {
-    tokenId: string;
-  };
-  query: {
-    type: 'email_verification' | 'password_reset' | 'invitation' | 'confirm_mfa';
+export type CreateTotpData = {
+  body: {
+    code: string;
   };
-  url: '/auth/check-token/{tokenId}';
+  path?: never;
+  query?: never;
+  url: '/auth/totp/activate';
 };
 
-export type CheckTokenErrors = {
+export type CreateTotpErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -628,34 +614,25 @@ export type CheckTokenErrors = {
   };
 };
 
-export type CheckTokenError = CheckTokenErrors[keyof CheckTokenErrors];
+export type CreateTotpError = CreateTotpErrors[keyof CreateTotpErrors];
 
-export type CheckTokenResponses = {
+export type CreateTotpResponses = {
   /**
-   * Token is valid
+   * TOTP activated
    */
-  200: {
-    email: string;
-    role: 'member' | 'admin' | null;
-    userId?: string;
-    organizationName?: string;
-    organizationSlug?: string;
-    organizationId?: string;
-  };
+  200: boolean;
 };
 
-export type CheckTokenResponse = CheckTokenResponses[keyof CheckTokenResponses];
+export type CreateTotpResponse = CreateTotpResponses[keyof CreateTotpResponses];
 
-export type AcceptEntityInviteData = {
+export type DeleteTotpData = {
   body?: never;
-  path: {
-    token: string;
-  };
+  path?: never;
   query?: never;
-  url: '/auth/accept-invite/{token}';
+  url: '/auth/totp';
 };
 
-export type AcceptEntityInviteErrors = {
+export type DeleteTotpErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -688,32 +665,27 @@ export type AcceptEntityInviteErrors = {
   };
 };
 
-export type AcceptEntityInviteError = AcceptEntityInviteErrors[keyof AcceptEntityInviteErrors];
+export type DeleteTotpError = DeleteTotpErrors[keyof DeleteTotpErrors];
 
-export type AcceptEntityInviteResponses = {
+export type DeleteTotpResponses = {
   /**
-   * Invitation was accepted
+   * TOTP deleted
    */
-  200: ContextEntityBaseSchema & {
-    membership: MembershipBaseSchema & {
-      [key: string]: unknown;
-    };
-    createdAt: string;
-  };
+  200: boolean;
 };
 
-export type AcceptEntityInviteResponse = AcceptEntityInviteResponses[keyof AcceptEntityInviteResponses];
+export type DeleteTotpResponse = DeleteTotpResponses[keyof DeleteTotpResponses];
 
-export type StartImpersonationData = {
-  body?: never;
-  path?: never;
-  query: {
-    targetUserId: string;
+export type SignInWithTotpData = {
+  body?: {
+    code: string;
   };
-  url: '/auth/impersonation/start';
+  path?: never;
+  query?: never;
+  url: '/auth/totp-verification';
 };
 
-export type StartImpersonationErrors = {
+export type SignInWithTotpErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -746,25 +718,28 @@ export type StartImpersonationErrors = {
   };
 };
 
-export type StartImpersonationError = StartImpersonationErrors[keyof StartImpersonationErrors];
+export type SignInWithTotpError = SignInWithTotpErrors[keyof SignInWithTotpErrors];
 
-export type StartImpersonationResponses = {
+export type SignInWithTotpResponses = {
   /**
-   * Impersonating
+   * TOTP verified
    */
   200: boolean;
 };
 
-export type StartImpersonationResponse = StartImpersonationResponses[keyof StartImpersonationResponses];
+export type SignInWithTotpResponse = SignInWithTotpResponses[keyof SignInWithTotpResponses];
 
-export type StopImpersonationData = {
-  body?: never;
+export type SignUpData = {
+  body?: {
+    email: string;
+    password: string;
+  };
   path?: never;
   query?: never;
-  url: '/auth/impersonation/stop';
+  url: '/auth/sign-up';
 };
 
-export type StopImpersonationErrors = {
+export type SignUpErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -797,25 +772,30 @@ export type StopImpersonationErrors = {
   };
 };
 
-export type StopImpersonationError = StopImpersonationErrors[keyof StopImpersonationErrors];
+export type SignUpError = SignUpErrors[keyof SignUpErrors];
 
-export type StopImpersonationResponses = {
+export type SignUpResponses = {
   /**
-   * Stopped impersonating
+   * User signed up
    */
   200: boolean;
 };
 
-export type StopImpersonationResponse = StopImpersonationResponses[keyof StopImpersonationResponses];
+export type SignUpResponse = SignUpResponses[keyof SignUpResponses];
 
-export type SignOutData = {
-  body?: never;
-  path?: never;
+export type SignUpWithTokenData = {
+  body?: {
+    email: string;
+    password: string;
+  };
+  path: {
+    tokenId: string;
+  };
   query?: never;
-  url: '/auth/sign-out';
+  url: '/auth/sign-up/{tokenId}';
 };
 
-export type SignOutErrors = {
+export type SignUpWithTokenErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -848,31 +828,32 @@ export type SignOutErrors = {
   };
 };
 
-export type SignOutError = SignOutErrors[keyof SignOutErrors];
+export type SignUpWithTokenError = SignUpWithTokenErrors[keyof SignUpWithTokenErrors];
 
-export type SignOutResponses = {
+export type SignUpWithTokenResponses = {
   /**
-   * User signed out
+   * User signed up
    */
-  200: boolean;
+  200: {
+    shouldRedirect: boolean;
+    redirectPath?: string;
+  };
 };
 
-export type SignOutResponse = SignOutResponses[keyof SignOutResponses];
+export type SignUpWithTokenResponse = SignUpWithTokenResponses[keyof SignUpWithTokenResponses];
 
-export type GithubData = {
+export type VerifyEmailData = {
   body?: never;
-  path?: never;
-  query: {
-    type: 'auth' | 'connect' | 'invite' | 'verify';
+  path: {
+    tokenId: string;
+  };
+  query?: {
     redirect?: string;
-    connectUserId?: string;
-    token?: string;
-    tokenId?: string;
   };
-  url: '/auth/github';
+  url: '/auth/verify-email/{tokenId}';
 };
 
-export type GithubErrors = {
+export type VerifyEmailErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -905,22 +886,18 @@ export type GithubErrors = {
   };
 };
 
-export type GithubError = GithubErrors[keyof GithubErrors];
+export type VerifyEmailError = VerifyEmailErrors[keyof VerifyEmailErrors];
 
-export type GoogleData = {
-  body?: never;
-  path?: never;
-  query: {
-    type: 'auth' | 'connect' | 'invite' | 'verify';
-    redirect?: string;
-    connectUserId?: string;
-    token?: string;
-    tokenId?: string;
+export type RequestPasswordData = {
+  body?: {
+    email: string;
   };
-  url: '/auth/google';
+  path?: never;
+  query?: never;
+  url: '/auth/request-password';
 };
 
-export type GoogleErrors = {
+export type RequestPasswordErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -953,22 +930,29 @@ export type GoogleErrors = {
   };
 };
 
-export type GoogleError = GoogleErrors[keyof GoogleErrors];
+export type RequestPasswordError = RequestPasswordErrors[keyof RequestPasswordErrors];
 
-export type MicrosoftData = {
-  body?: never;
-  path?: never;
-  query: {
-    type: 'auth' | 'connect' | 'invite' | 'verify';
-    redirect?: string;
-    connectUserId?: string;
-    token?: string;
-    tokenId?: string;
+export type RequestPasswordResponses = {
+  /**
+   * Password reset email sent
+   */
+  200: boolean;
+};
+
+export type RequestPasswordResponse = RequestPasswordResponses[keyof RequestPasswordResponses];
+
+export type CreatePasswordData = {
+  body?: {
+    password: string;
   };
-  url: '/auth/microsoft';
+  path: {
+    tokenId: string;
+  };
+  query?: never;
+  url: '/auth/create-password/{tokenId}';
 };
 
-export type MicrosoftErrors = {
+export type CreatePasswordErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -1001,22 +985,31 @@ export type MicrosoftErrors = {
   };
 };
 
-export type MicrosoftError = MicrosoftErrors[keyof MicrosoftErrors];
+export type CreatePasswordError = CreatePasswordErrors[keyof CreatePasswordErrors];
 
-export type GithubCallbackData = {
-  body?: never;
-  path?: never;
-  query: {
-    code: string;
-    state: string;
-    error?: string;
-    error_description?: string;
-    error_uri?: string;
+export type CreatePasswordResponses = {
+  /**
+   * Password created
+   */
+  200: {
+    shouldRedirect: boolean;
+    redirectPath?: string;
   };
-  url: '/auth/github/callback';
 };
 
-export type GithubCallbackErrors = {
+export type CreatePasswordResponse = CreatePasswordResponses[keyof CreatePasswordResponses];
+
+export type SignInData = {
+  body?: {
+    email: string;
+    password: string;
+  };
+  path?: never;
+  query?: never;
+  url: '/auth/sign-in';
+};
+
+export type SignInErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -1049,19 +1042,32 @@ export type GithubCallbackErrors = {
   };
 };
 
-export type GithubCallbackError = GithubCallbackErrors[keyof GithubCallbackErrors];
+export type SignInError = SignInErrors[keyof SignInErrors];
 
-export type GoogleCallbackData = {
-  body?: never;
-  path?: never;
-  query: {
-    code: string;
-    state: string;
+export type SignInResponses = {
+  /**
+   * User signed in
+   */
+  200: {
+    shouldRedirect: boolean;
+    redirectPath?: string;
   };
-  url: '/auth/google/callback';
 };
 
-export type GoogleCallbackErrors = {
+export type SignInResponse = SignInResponses[keyof SignInResponses];
+
+export type CreatePasskeyData = {
+  body: {
+    attestationObject: string;
+    clientDataJSON: string;
+    nameOnDevice: string;
+  };
+  path?: never;
+  query?: never;
+  url: '/auth/passkey';
+};
+
+export type CreatePasskeyErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -1094,19 +1100,36 @@ export type GoogleCallbackErrors = {
   };
 };
 
-export type GoogleCallbackError = GoogleCallbackErrors[keyof GoogleCallbackErrors];
+export type CreatePasskeyError = CreatePasskeyErrors[keyof CreatePasskeyErrors];
 
-export type MicrosoftCallbackData = {
+export type CreatePasskeyResponses = {
+  /**
+   * Passkey created
+   */
+  200: {
+    id: string;
+    userId: string;
+    deviceName: string | null;
+    deviceType: 'desktop' | 'mobile';
+    deviceOs: string | null;
+    browser: string | null;
+    nameOnDevice: string;
+    createdAt: string;
+  };
+};
+
+export type CreatePasskeyResponse = CreatePasskeyResponses[keyof CreatePasskeyResponses];
+
+export type DeletePasskeyData = {
   body?: never;
-  path?: never;
-  query: {
-    code: string;
-    state: string;
+  path: {
+    id: string;
   };
-  url: '/auth/microsoft/callback';
+  query?: never;
+  url: '/auth/passkey/{id}';
 };
 
-export type MicrosoftCallbackErrors = {
+export type DeletePasskeyErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -1139,7 +1162,16 @@ export type MicrosoftCallbackErrors = {
   };
 };
 
-export type MicrosoftCallbackError = MicrosoftCallbackErrors[keyof MicrosoftCallbackErrors];
+export type DeletePasskeyError = DeletePasskeyErrors[keyof DeletePasskeyErrors];
+
+export type DeletePasskeyResponses = {
+  /**
+   * Passkey deleted
+   */
+  200: boolean;
+};
+
+export type DeletePasskeyResponse = DeletePasskeyResponses[keyof DeletePasskeyResponses];
 
 export type CreatePasskeyChallengeData = {
   body?: {
@@ -1256,16 +1288,20 @@ export type SignInWithPasskeyResponses = {
 
 export type SignInWithPasskeyResponse = SignInWithPasskeyResponses[keyof SignInWithPasskeyResponses];
 
-export type SignInWithTotpData = {
-  body?: {
-    code: string;
-  };
+export type GithubData = {
+  body?: never;
   path?: never;
-  query?: never;
-  url: '/auth/totp-verification';
+  query: {
+    type: 'auth' | 'connect' | 'invite' | 'verify';
+    redirect?: string;
+    connectUserId?: string;
+    token?: string;
+    tokenId?: string;
+  };
+  url: '/auth/github';
 };
 
-export type SignInWithTotpErrors = {
+export type GithubErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -1298,25 +1334,22 @@ export type SignInWithTotpErrors = {
   };
 };
 
-export type SignInWithTotpError = SignInWithTotpErrors[keyof SignInWithTotpErrors];
-
-export type SignInWithTotpResponses = {
-  /**
-   * TOTP verified
-   */
-  200: boolean;
-};
-
-export type SignInWithTotpResponse = SignInWithTotpResponses[keyof SignInWithTotpResponses];
+export type GithubError = GithubErrors[keyof GithubErrors];
 
-export type DeleteMeData = {
+export type GoogleData = {
   body?: never;
   path?: never;
-  query?: never;
-  url: '/me';
+  query: {
+    type: 'auth' | 'connect' | 'invite' | 'verify';
+    redirect?: string;
+    connectUserId?: string;
+    token?: string;
+    tokenId?: string;
+  };
+  url: '/auth/google';
 };
 
-export type DeleteMeErrors = {
+export type GoogleErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -1349,25 +1382,22 @@ export type DeleteMeErrors = {
   };
 };
 
-export type DeleteMeError = DeleteMeErrors[keyof DeleteMeErrors];
-
-export type DeleteMeResponses = {
-  /**
-   * User deleted
-   */
-  200: boolean;
-};
-
-export type DeleteMeResponse = DeleteMeResponses[keyof DeleteMeResponses];
+export type GoogleError = GoogleErrors[keyof GoogleErrors];
 
-export type GetMeData = {
+export type MicrosoftData = {
   body?: never;
   path?: never;
-  query?: never;
-  url: '/me';
+  query: {
+    type: 'auth' | 'connect' | 'invite' | 'verify';
+    redirect?: string;
+    connectUserId?: string;
+    token?: string;
+    tokenId?: string;
+  };
+  url: '/auth/microsoft';
 };
 
-export type GetMeErrors = {
+export type MicrosoftErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -1400,36 +1430,22 @@ export type GetMeErrors = {
   };
 };
 
-export type GetMeError = GetMeErrors[keyof GetMeErrors];
-
-export type GetMeResponses = {
-  /**
-   * User
-   */
-  200: User;
-};
-
-export type GetMeResponse = GetMeResponses[keyof GetMeResponses];
+export type MicrosoftError = MicrosoftErrors[keyof MicrosoftErrors];
 
-export type UpdateMeData = {
-  body?: {
-    bannerUrl?: string | null;
-    firstName?: string | null;
-    lastName?: string | null;
-    language?: 'en' | 'nl';
-    newsletter?: boolean;
-    thumbnailUrl?: string | null;
-    slug?: string;
-    userFlags?: {
-      finishedOnboarding?: boolean;
-    };
-  };
+export type GithubCallbackData = {
+  body?: never;
   path?: never;
-  query?: never;
-  url: '/me';
+  query: {
+    code: string;
+    state: string;
+    error?: string;
+    error_description?: string;
+    error_uri?: string;
+  };
+  url: '/auth/github/callback';
 };
 
-export type UpdateMeErrors = {
+export type GithubCallbackErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -1462,34 +1478,19 @@ export type UpdateMeErrors = {
   };
 };
 
-export type UpdateMeError = UpdateMeErrors[keyof UpdateMeErrors];
-
-export type UpdateMeResponses = {
-  /**
-   * User
-   */
-  200: User;
-};
-
-export type UpdateMeResponse = UpdateMeResponses[keyof UpdateMeResponses];
+export type GithubCallbackError = GithubCallbackErrors[keyof GithubCallbackErrors];
 
-export type ToggleMfaData = {
-  body?: {
-    passkeyData?: {
-      credentialId: string;
-      clientDataJSON: string;
-      authenticatorData: string;
-      signature: string;
-    };
-    totpCode?: string;
-    mfaRequired: boolean;
-  };
+export type GoogleCallbackData = {
+  body?: never;
   path?: never;
-  query?: never;
-  url: '/me/mfa';
+  query: {
+    code: string;
+    state: string;
+  };
+  url: '/auth/google/callback';
 };
 
-export type ToggleMfaErrors = {
+export type GoogleCallbackErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -1522,25 +1523,19 @@ export type ToggleMfaErrors = {
   };
 };
 
-export type ToggleMfaError = ToggleMfaErrors[keyof ToggleMfaErrors];
-
-export type ToggleMfaResponses = {
-  /**
-   * User
-   */
-  200: User;
-};
-
-export type ToggleMfaResponse = ToggleMfaResponses[keyof ToggleMfaResponses];
+export type GoogleCallbackError = GoogleCallbackErrors[keyof GoogleCallbackErrors];
 
-export type GetMyAuthData = {
+export type MicrosoftCallbackData = {
   body?: never;
   path?: never;
-  query?: never;
-  url: '/me/auth';
+  query: {
+    code: string;
+    state: string;
+  };
+  url: '/auth/microsoft/callback';
 };
 
-export type GetMyAuthErrors = {
+export type MicrosoftCallbackErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -1573,52 +1568,16 @@ export type GetMyAuthErrors = {
   };
 };
 
-export type GetMyAuthError = GetMyAuthErrors[keyof GetMyAuthErrors];
-
-export type GetMyAuthResponses = {
-  /**
-   * User sign-up info
-   */
-  200: {
-    enabledOAuth: Array<'github'>;
-    hasTotp: boolean;
-    hasPassword: boolean;
-    sessions: Array<{
-      createdAt: string;
-      id: string;
-      type: 'regular' | 'impersonation' | 'mfa';
-      userId: string;
-      deviceName: string | null;
-      deviceType: 'desktop' | 'mobile';
-      deviceOs: string | null;
-      browser: string | null;
-      authStrategy: 'github' | 'google' | 'microsoft' | 'password' | 'passkey' | 'totp' | 'email';
-      expiresAt: string;
-      isCurrent: boolean;
-    }>;
-    passkeys: Array<{
-      id: string;
-      userId: string;
-      deviceName: string | null;
-      deviceType: 'desktop' | 'mobile';
-      deviceOs: string | null;
-      browser: string | null;
-      nameOnDevice: string;
-      createdAt: string;
-    }>;
-  };
-};
-
-export type GetMyAuthResponse = GetMyAuthResponses[keyof GetMyAuthResponses];
+export type MicrosoftCallbackError = MicrosoftCallbackErrors[keyof MicrosoftCallbackErrors];
 
-export type GetMyMenuData = {
+export type DeleteMeData = {
   body?: never;
   path?: never;
   query?: never;
-  url: '/me/menu';
+  url: '/me';
 };
 
-export type GetMyMenuErrors = {
+export type DeleteMeErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -1651,25 +1610,25 @@ export type GetMyMenuErrors = {
   };
 };
 
-export type GetMyMenuError = GetMyMenuErrors[keyof GetMyMenuErrors];
+export type DeleteMeError = DeleteMeErrors[keyof DeleteMeErrors];
 
-export type GetMyMenuResponses = {
+export type DeleteMeResponses = {
   /**
-   * Menu of user
+   * User deleted
    */
-  200: MenuSchema;
+  200: boolean;
 };
 
-export type GetMyMenuResponse = GetMyMenuResponses[keyof GetMyMenuResponses];
+export type DeleteMeResponse = DeleteMeResponses[keyof DeleteMeResponses];
 
-export type GetMyInvitationsData = {
+export type GetMeData = {
   body?: never;
   path?: never;
   query?: never;
-  url: '/me/invitations';
+  url: '/me';
 };
 
-export type GetMyInvitationsErrors = {
+export type GetMeErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -1698,42 +1657,40 @@ export type GetMyInvitationsErrors = {
    * Rate limit: too many requests.
    */
   429: ApiError & {
-    status?: 429;
-  };
-};
-
-export type GetMyInvitationsError = GetMyInvitationsErrors[keyof GetMyInvitationsErrors];
-
-export type GetMyInvitationsResponses = {
-  /**
-   * Invitations pending
-   */
-  200: Array<{
-    entity: ContextEntityBaseSchema & {
-      organizationId?: string;
-    };
-    expiresAt: string;
-    invitedBy: UserBaseSchema &
-      ({
-        [key: string]: unknown;
-      } | null);
-    token: string;
-    tokenId: string;
-  }>;
+    status?: 429;
+  };
 };
 
-export type GetMyInvitationsResponse = GetMyInvitationsResponses[keyof GetMyInvitationsResponses];
+export type GetMeError = GetMeErrors[keyof GetMeErrors];
 
-export type DeleteMySessionsData = {
+export type GetMeResponses = {
+  /**
+   * User
+   */
+  200: User;
+};
+
+export type GetMeResponse = GetMeResponses[keyof GetMeResponses];
+
+export type UpdateMeData = {
   body?: {
-    ids: Array<string>;
+    bannerUrl?: string | null;
+    firstName?: string | null;
+    lastName?: string | null;
+    language?: 'en' | 'nl';
+    newsletter?: boolean;
+    thumbnailUrl?: string | null;
+    slug?: string;
+    userFlags?: {
+      finishedOnboarding?: boolean;
+    };
   };
   path?: never;
   query?: never;
-  url: '/me/sessions';
+  url: '/me';
 };
 
-export type DeleteMySessionsErrors = {
+export type UpdateMeErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -1766,31 +1723,34 @@ export type DeleteMySessionsErrors = {
   };
 };
 
-export type DeleteMySessionsError = DeleteMySessionsErrors[keyof DeleteMySessionsErrors];
+export type UpdateMeError = UpdateMeErrors[keyof UpdateMeErrors];
 
-export type DeleteMySessionsResponses = {
+export type UpdateMeResponses = {
   /**
-   * Success
+   * User
    */
-  200: {
-    success: boolean;
-    rejectedItems: Array<string>;
-  };
+  200: User;
 };
 
-export type DeleteMySessionsResponse = DeleteMySessionsResponses[keyof DeleteMySessionsResponses];
+export type UpdateMeResponse = UpdateMeResponses[keyof UpdateMeResponses];
 
-export type DeleteMyMembershipData = {
-  body?: never;
-  path?: never;
-  query: {
-    idOrSlug: string;
-    entityType: 'organization';
+export type ToggleMfaData = {
+  body?: {
+    passkeyData?: {
+      credentialId: string;
+      clientDataJSON: string;
+      authenticatorData: string;
+      signature: string;
+    };
+    totpCode?: string;
+    mfaRequired: boolean;
   };
-  url: '/me/leave';
+  path?: never;
+  query?: never;
+  url: '/me/mfa';
 };
 
-export type DeleteMyMembershipErrors = {
+export type ToggleMfaErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -1823,29 +1783,25 @@ export type DeleteMyMembershipErrors = {
   };
 };
 
-export type DeleteMyMembershipError = DeleteMyMembershipErrors[keyof DeleteMyMembershipErrors];
+export type ToggleMfaError = ToggleMfaErrors[keyof ToggleMfaErrors];
 
-export type DeleteMyMembershipResponses = {
+export type ToggleMfaResponses = {
   /**
-   * Membership removed
+   * User
    */
-  200: boolean;
+  200: User;
 };
 
-export type DeleteMyMembershipResponse = DeleteMyMembershipResponses[keyof DeleteMyMembershipResponses];
+export type ToggleMfaResponse = ToggleMfaResponses[keyof ToggleMfaResponses];
 
-export type CreatePasskeyData = {
-  body: {
-    attestationObject: string;
-    clientDataJSON: string;
-    nameOnDevice: string;
-  };
+export type GetMyAuthData = {
+  body?: never;
   path?: never;
   query?: never;
-  url: '/me/passkey';
+  url: '/me/auth';
 };
 
-export type CreatePasskeyErrors = {
+export type GetMyAuthErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -1878,36 +1834,52 @@ export type CreatePasskeyErrors = {
   };
 };
 
-export type CreatePasskeyError = CreatePasskeyErrors[keyof CreatePasskeyErrors];
+export type GetMyAuthError = GetMyAuthErrors[keyof GetMyAuthErrors];
 
-export type CreatePasskeyResponses = {
+export type GetMyAuthResponses = {
   /**
-   * Passkey created
+   * User sign-up info
    */
   200: {
-    id: string;
-    userId: string;
-    deviceName: string | null;
-    deviceType: 'desktop' | 'mobile';
-    deviceOs: string | null;
-    browser: string | null;
-    nameOnDevice: string;
-    createdAt: string;
+    enabledOAuth: Array<'github'>;
+    hasTotp: boolean;
+    hasPassword: boolean;
+    sessions: Array<{
+      createdAt: string;
+      id: string;
+      type: 'regular' | 'impersonation' | 'mfa';
+      userId: string;
+      deviceName: string | null;
+      deviceType: 'desktop' | 'mobile';
+      deviceOs: string | null;
+      browser: string | null;
+      authStrategy: 'github' | 'google' | 'microsoft' | 'password' | 'passkey' | 'totp' | 'email';
+      expiresAt: string;
+      isCurrent: boolean;
+    }>;
+    passkeys: Array<{
+      id: string;
+      userId: string;
+      deviceName: string | null;
+      deviceType: 'desktop' | 'mobile';
+      deviceOs: string | null;
+      browser: string | null;
+      nameOnDevice: string;
+      createdAt: string;
+    }>;
   };
 };
 
-export type CreatePasskeyResponse = CreatePasskeyResponses[keyof CreatePasskeyResponses];
+export type GetMyAuthResponse = GetMyAuthResponses[keyof GetMyAuthResponses];
 
-export type DeletePasskeyData = {
+export type GetMyMenuData = {
   body?: never;
-  path: {
-    id: string;
-  };
+  path?: never;
   query?: never;
-  url: '/me/passkey/{id}';
+  url: '/me/menu';
 };
 
-export type DeletePasskeyErrors = {
+export type GetMyMenuErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -1940,25 +1912,25 @@ export type DeletePasskeyErrors = {
   };
 };
 
-export type DeletePasskeyError = DeletePasskeyErrors[keyof DeletePasskeyErrors];
+export type GetMyMenuError = GetMyMenuErrors[keyof GetMyMenuErrors];
 
-export type DeletePasskeyResponses = {
+export type GetMyMenuResponses = {
   /**
-   * Passkey deleted
+   * Menu of user
    */
-  200: boolean;
+  200: MenuSchema;
 };
 
-export type DeletePasskeyResponse = DeletePasskeyResponses[keyof DeletePasskeyResponses];
+export type GetMyMenuResponse = GetMyMenuResponses[keyof GetMyMenuResponses];
 
-export type RegisterTotpData = {
+export type GetMyInvitationsData = {
   body?: never;
   path?: never;
   query?: never;
-  url: '/me/totp/register';
+  url: '/me/invitations';
 };
 
-export type RegisterTotpErrors = {
+export type GetMyInvitationsErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -1991,30 +1963,38 @@ export type RegisterTotpErrors = {
   };
 };
 
-export type RegisterTotpError = RegisterTotpErrors[keyof RegisterTotpErrors];
+export type GetMyInvitationsError = GetMyInvitationsErrors[keyof GetMyInvitationsErrors];
 
-export type RegisterTotpResponses = {
+export type GetMyInvitationsResponses = {
   /**
-   * totpUri & manualKey
+   * Entity memberships pending
    */
-  200: {
-    totpUri: string;
-    manualKey: string;
-  };
+  200: Array<{
+    entity: ContextEntityBaseSchema & {
+      organizationId?: string;
+    };
+    invitedBy: UserBaseSchema &
+      ({
+        [key: string]: unknown;
+      } | null);
+    membership: MembershipBaseSchema & {
+      [key: string]: unknown;
+    };
+  }>;
 };
 
-export type RegisterTotpResponse = RegisterTotpResponses[keyof RegisterTotpResponses];
+export type GetMyInvitationsResponse = GetMyInvitationsResponses[keyof GetMyInvitationsResponses];
 
-export type ActivateTotpData = {
-  body: {
-    code: string;
+export type DeleteMySessionsData = {
+  body?: {
+    ids: Array<string>;
   };
   path?: never;
   query?: never;
-  url: '/me/totp/activate';
+  url: '/me/sessions';
 };
 
-export type ActivateTotpErrors = {
+export type DeleteMySessionsErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -2047,25 +2027,31 @@ export type ActivateTotpErrors = {
   };
 };
 
-export type ActivateTotpError = ActivateTotpErrors[keyof ActivateTotpErrors];
+export type DeleteMySessionsError = DeleteMySessionsErrors[keyof DeleteMySessionsErrors];
 
-export type ActivateTotpResponses = {
+export type DeleteMySessionsResponses = {
   /**
-   * TOTP activated
+   * Success
    */
-  200: boolean;
+  200: {
+    success: boolean;
+    rejectedItems: Array<string>;
+  };
 };
 
-export type ActivateTotpResponse = ActivateTotpResponses[keyof ActivateTotpResponses];
+export type DeleteMySessionsResponse = DeleteMySessionsResponses[keyof DeleteMySessionsResponses];
 
-export type DeleteTotpData = {
+export type DeleteMyMembershipData = {
   body?: never;
   path?: never;
-  query?: never;
-  url: '/me/totp';
+  query: {
+    idOrSlug: string;
+    entityType: 'organization';
+  };
+  url: '/me/leave';
 };
 
-export type DeleteTotpErrors = {
+export type DeleteMyMembershipErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -2098,16 +2084,16 @@ export type DeleteTotpErrors = {
   };
 };
 
-export type DeleteTotpError = DeleteTotpErrors[keyof DeleteTotpErrors];
+export type DeleteMyMembershipError = DeleteMyMembershipErrors[keyof DeleteMyMembershipErrors];
 
-export type DeleteTotpResponses = {
+export type DeleteMyMembershipResponses = {
   /**
-   * TOTP deleted
+   * Membership removed
    */
   200: boolean;
 };
 
-export type DeleteTotpResponse = DeleteTotpResponses[keyof DeleteTotpResponses];
+export type DeleteMyMembershipResponse = DeleteMyMembershipResponses[keyof DeleteMyMembershipResponses];
 
 export type GetUploadTokenData = {
   body?: never;
@@ -4071,6 +4057,65 @@ export type UpdateMembershipResponses = {
 
 export type UpdateMembershipResponse = UpdateMembershipResponses[keyof UpdateMembershipResponses];
 
+export type AcceptMembershipData = {
+  body?: never;
+  path: {
+    id: string;
+    acceptOrReject: 'accept' | 'reject';
+  };
+  query?: never;
+  url: '/{orgIdOrSlug}/memberships/{id}/{acceptOrReject}';
+};
+
+export type AcceptMembershipErrors = {
+  /**
+   * Bad request: problem processing request.
+   */
+  400: ApiError & {
+    status?: 400;
+  };
+  /**
+   * Unauthorized: authentication required.
+   */
+  401: ApiError & {
+    status?: 401;
+  };
+  /**
+   * Forbidden: insufficient permissions.
+   */
+  403: ApiError & {
+    status?: 403;
+  };
+  /**
+   * Not found: resource does not exist.
+   */
+  404: ApiError & {
+    status?: 404;
+  };
+  /**
+   * Rate limit: too many requests.
+   */
+  429: ApiError & {
+    status?: 429;
+  };
+};
+
+export type AcceptMembershipError = AcceptMembershipErrors[keyof AcceptMembershipErrors];
+
+export type AcceptMembershipResponses = {
+  /**
+   * Invitation was accepted
+   */
+  200: ContextEntityBaseSchema & {
+    membership: MembershipBaseSchema & {
+      [key: string]: unknown;
+    };
+    createdAt: string;
+  };
+};
+
+export type AcceptMembershipResponse = AcceptMembershipResponses[keyof AcceptMembershipResponses];
+
 export type GetMembersData = {
   body?: never;
   path?: {
diff --git a/frontend/src/api.gen/zod.gen.ts b/frontend/src/api.gen/zod.gen.ts
index 8a4401553..c5aa1957f 100644
--- a/frontend/src/api.gen/zod.gen.ts
+++ b/frontend/src/api.gen/zod.gen.ts
@@ -223,6 +223,124 @@ export const zCheckEmailData = z.object({
  */
 export const zCheckEmailResponse = z.boolean();
 
+export const zConsumeTokenData = z.object({
+  body: z.optional(z.never()),
+  path: z.object({
+    token: z.string(),
+  }),
+  query: z.optional(z.never()),
+});
+
+export const zGetTokenDataData = z.object({
+  body: z.optional(z.never()),
+  path: z.object({
+    tokenId: z.string(),
+  }),
+  query: z.object({
+    type: z.enum(['email_verification', 'oauth_verification', 'password_reset', 'invitation', 'confirm_mfa']),
+  }),
+});
+
+/**
+ * Token is valid
+ */
+export const zGetTokenDataResponse = z.object({
+  email: z.email(),
+  role: z.union([z.enum(['member', 'admin']), z.null()]),
+  userId: z.optional(z.string()),
+  organizationName: z.optional(z.string()),
+  organizationSlug: z.optional(z.string()),
+  organizationId: z.optional(z.string()),
+});
+
+export const zStartImpersonationData = z.object({
+  body: z.optional(z.never()),
+  path: z.optional(z.never()),
+  query: z.object({
+    targetUserId: z.string(),
+  }),
+});
+
+/**
+ * Impersonating
+ */
+export const zStartImpersonationResponse = z.boolean();
+
+export const zStopImpersonationData = z.object({
+  body: z.optional(z.never()),
+  path: z.optional(z.never()),
+  query: z.optional(z.never()),
+});
+
+/**
+ * Stopped impersonating
+ */
+export const zStopImpersonationResponse = z.boolean();
+
+export const zSignOutData = z.object({
+  body: z.optional(z.never()),
+  path: z.optional(z.never()),
+  query: z.optional(z.never()),
+});
+
+/**
+ * User signed out
+ */
+export const zSignOutResponse = z.boolean();
+
+export const zCreateTotpChallengeData = z.object({
+  body: z.optional(z.never()),
+  path: z.optional(z.never()),
+  query: z.optional(z.never()),
+});
+
+/**
+ * Challenge created
+ */
+export const zCreateTotpChallengeResponse = z.object({
+  totpUri: z.string(),
+  manualKey: z.string(),
+});
+
+export const zCreateTotpData = z.object({
+  body: z.object({
+    code: z.string().regex(/^\d{6}$/),
+  }),
+  path: z.optional(z.never()),
+  query: z.optional(z.never()),
+});
+
+/**
+ * TOTP activated
+ */
+export const zCreateTotpResponse = z.boolean();
+
+export const zDeleteTotpData = z.object({
+  body: z.optional(z.never()),
+  path: z.optional(z.never()),
+  query: z.optional(z.never()),
+});
+
+/**
+ * TOTP deleted
+ */
+export const zDeleteTotpResponse = z.boolean();
+
+export const zSignInWithTotpData = z.object({
+  body: z.optional(
+    z.object({
+      code: z.string().regex(/^\d{6}$/),
+    }),
+  ),
+  path: z.optional(z.never()),
+  query: z.optional(z.never()),
+});
+
+/**
+ * TOTP verified
+ */
+export const zSignInWithTotpResponse = z.boolean();
+
 export const zSignUpData = z.object({
   body: z.optional(
     z.object({
@@ -247,7 +365,7 @@ export const zSignUpWithTokenData = z.object({
     }),
   ),
   path: z.object({
-    token: z.string(),
+    tokenId: z.string(),
   }),
   query: z.optional(z.never()),
 });
@@ -263,7 +381,7 @@ export const zSignUpWithTokenResponse = z.object({
 export const zVerifyEmailData = z.object({
   body: z.optional(z.never()),
   path: z.object({
-    token: z.string(),
+    tokenId: z.string(),
   }),
   query: z.optional(
     z.object({
@@ -294,7 +412,7 @@ export const zCreatePasswordData = z.object({
     }),
   ),
   path: z.object({
-    token: z.string(),
+    tokenId: z.string(),
   }),
   query: z.optional(z.never()),
 });
@@ -326,80 +444,81 @@ export const zSignInResponse = z.object({
   redirectPath: z.optional(z.string()),
 });
 
-export const zCheckTokenData = z.object({
-  body: z.optional(z.never()),
-  path: z.object({
-    tokenId: z.string(),
-  }),
-  query: z.object({
-    type: z.enum(['email_verification', 'password_reset', 'invitation', 'confirm_mfa']),
+export const zCreatePasskeyData = z.object({
+  body: z.object({
+    attestationObject: z.string(),
+    clientDataJSON: z.string(),
+    nameOnDevice: z.string(),
   }),
+  path: z.optional(z.never()),
+  query: z.optional(z.never()),
 });
 
 /**
- * Token is valid
+ * Passkey created
  */
-export const zCheckTokenResponse = z.object({
-  email: z.email(),
-  role: z.union([z.enum(['member', 'admin']), z.null()]),
-  userId: z.optional(z.string()),
-  organizationName: z.optional(z.string()),
-  organizationSlug: z.optional(z.string()),
-  organizationId: z.optional(z.string()),
+export const zCreatePasskeyResponse = z.object({
+  id: z.string(),
+  userId: z.string(),
+  deviceName: z.union([z.string(), z.null()]),
+  deviceType: z.enum(['desktop', 'mobile']),
+  deviceOs: z.union([z.string(), z.null()]),
+  browser: z.union([z.string(), z.null()]),
+  nameOnDevice: z.string(),
+  createdAt: z.string(),
 });
 
-export const zAcceptEntityInviteData = z.object({
+export const zDeletePasskeyData = z.object({
   body: z.optional(z.never()),
   path: z.object({
-    token: z.string(),
+    id: z.string(),
   }),
   query: z.optional(z.never()),
 });
 
 /**
- * Invitation was accepted
- */
-export const zAcceptEntityInviteResponse = zContextEntityBaseSchema.and(
-  z.object({
-    membership: zMembershipBaseSchema.and(z.record(z.string(), z.unknown())),
-    createdAt: z.string(),
-  }),
-);
-
-export const zStartImpersonationData = z.object({
-  body: z.optional(z.never()),
-  path: z.optional(z.never()),
-  query: z.object({
-    targetUserId: z.string(),
-  }),
-});
-
-/**
- * Impersonating
+ * Passkey deleted
  */
-export const zStartImpersonationResponse = z.boolean();
+export const zDeletePasskeyResponse = z.boolean();
 
-export const zStopImpersonationData = z.object({
-  body: z.optional(z.never()),
+export const zCreatePasskeyChallengeData = z.object({
+  body: z.optional(
+    z.object({
+      type: z.union([z.enum(['authentication']), z.enum(['mfa']), z.enum(['registration'])]),
+      email: z.optional(z.string()),
+    }),
+  ),
   path: z.optional(z.never()),
   query: z.optional(z.never()),
 });
 
 /**
- * Stopped impersonating
+ * Challenge created
  */
-export const zStopImpersonationResponse = z.boolean();
+export const zCreatePasskeyChallengeResponse = z.object({
+  challengeBase64: z.string(),
+  credentialIds: z.array(z.string()),
+});
 
-export const zSignOutData = z.object({
-  body: z.optional(z.never()),
+export const zSignInWithPasskeyData = z.object({
+  body: z.optional(
+    z.object({
+      credentialId: z.string(),
+      clientDataJSON: z.string(),
+      authenticatorData: z.string(),
+      signature: z.string(),
+      type: z.union([z.enum(['authentication']), z.enum(['mfa'])]),
+      email: z.optional(z.string()),
+    }),
+  ),
   path: z.optional(z.never()),
   query: z.optional(z.never()),
 });
 
 /**
- * User signed out
+ * Passkey verified
  */
-export const zSignOutResponse = z.boolean();
+export const zSignInWithPasskeyResponse = z.boolean();
 
 export const zGithubData = z.object({
   body: z.optional(z.never()),
@@ -467,60 +586,6 @@ export const zMicrosoftCallbackData = z.object({
   }),
 });
 
-export const zCreatePasskeyChallengeData = z.object({
-  body: z.optional(
-    z.object({
-      type: z.union([z.enum(['authentication']), z.enum(['mfa']), z.enum(['registration'])]),
-      email: z.optional(z.string()),
-    }),
-  ),
-  path: z.optional(z.never()),
-  query: z.optional(z.never()),
-});
-
-/**
- * Challenge created
- */
-export const zCreatePasskeyChallengeResponse = z.object({
-  challengeBase64: z.string(),
-  credentialIds: z.array(z.string()),
-});
-
-export const zSignInWithPasskeyData = z.object({
-  body: z.optional(
-    z.object({
-      credentialId: z.string(),
-      clientDataJSON: z.string(),
-      authenticatorData: z.string(),
-      signature: z.string(),
-      type: z.union([z.enum(['authentication']), z.enum(['mfa'])]),
-      email: z.optional(z.string()),
-    }),
-  ),
-  path: z.optional(z.never()),
-  query: z.optional(z.never()),
-});
-
-/**
- * Passkey verified
- */
-export const zSignInWithPasskeyResponse = z.boolean();
-
-export const zSignInWithTotpData = z.object({
-  body: z.optional(
-    z.object({
-      code: z.string().regex(/^\d{6}$/),
-    }),
-  ),
-  path: z.optional(z.never()),
-  query: z.optional(z.never()),
-});
-
-/**
- * TOTP verified
- */
-export const zSignInWithTotpResponse = z.boolean();
-
 export const zDeleteMeData = z.object({
   body: z.optional(z.never()),
   path: z.optional(z.never()),
@@ -653,7 +718,7 @@ export const zGetMyInvitationsData = z.object({
 });
 
 /**
- * Invitations pending
+ * Entity memberships pending
  */
 export const zGetMyInvitationsResponse = z.array(
   z.object({
@@ -662,10 +727,8 @@ export const zGetMyInvitationsResponse = z.array(
         organizationId: z.optional(z.string()),
       }),
     ),
-    expiresAt: z.iso.date(),
     invitedBy: zUserBaseSchema.and(z.union([z.record(z.string(), z.unknown()), z.null()])),
-    token: z.string(),
-    tokenId: z.string(),
+    membership: zMembershipBaseSchema.and(z.record(z.string(), z.unknown())),
   }),
 );
 
@@ -701,81 +764,6 @@ export const zDeleteMyMembershipData = z.object({
  */
 export const zDeleteMyMembershipResponse = z.boolean();
 
-export const zCreatePasskeyData = z.object({
-  body: z.object({
-    attestationObject: z.string(),
-    clientDataJSON: z.string(),
-    nameOnDevice: z.string(),
-  }),
-  path: z.optional(z.never()),
-  query: z.optional(z.never()),
-});
-
-/**
- * Passkey created
- */
-export const zCreatePasskeyResponse = z.object({
-  id: z.string(),
-  userId: z.string(),
-  deviceName: z.union([z.string(), z.null()]),
-  deviceType: z.enum(['desktop', 'mobile']),
-  deviceOs: z.union([z.string(), z.null()]),
-  browser: z.union([z.string(), z.null()]),
-  nameOnDevice: z.string(),
-  createdAt: z.string(),
-});
-
-export const zDeletePasskeyData = z.object({
-  body: z.optional(z.never()),
-  path: z.object({
-    id: z.string(),
-  }),
-  query: z.optional(z.never()),
-});
-
-/**
- * Passkey deleted
- */
-export const zDeletePasskeyResponse = z.boolean();
-
-export const zRegisterTotpData = z.object({
-  body: z.optional(z.never()),
-  path: z.optional(z.never()),
-  query: z.optional(z.never()),
-});
-
-/**
- * totpUri & manualKey
- */
-export const zRegisterTotpResponse = z.object({
-  totpUri: z.string(),
-  manualKey: z.string(),
-});
-
-export const zActivateTotpData = z.object({
-  body: z.object({
-    code: z.string().regex(/^\d{6}$/),
-  }),
-  path: z.optional(z.never()),
-  query: z.optional(z.never()),
-});
-
-/**
- * TOTP activated
- */
-export const zActivateTotpResponse = z.boolean();
-
-export const zDeleteTotpData = z.object({
-  body: z.optional(z.never()),
-  path: z.optional(z.never()),
-  query: z.optional(z.never()),
-});
-
-/**
- * TOTP deleted
- */
-export const zDeleteTotpResponse = z.boolean();
-
 export const zGetUploadTokenData = z.object({
   body: z.optional(z.never()),
   path: z.optional(z.never()),
@@ -1455,6 +1443,25 @@ export const zUpdateMembershipResponse = z.object({
   organizationId: z.string(),
 });
 
+export const zAcceptMembershipData = z.object({
+  body: z.optional(z.never()),
+  path: z.object({
+    id: z.string(),
+    acceptOrReject: z.enum(['accept', 'reject']),
+  }),
+  query: z.optional(z.never()),
+});
+
+/**
+ * Invitation was accepted
+ */
+export const zAcceptMembershipResponse = zContextEntityBaseSchema.and(
+  z.object({
+    membership: zMembershipBaseSchema.and(z.record(z.string(), z.unknown())),
+    createdAt: z.string(),
+  }),
+);
+
 export const zGetMembersData = z.object({
   body: z.optional(z.never()),
   path: z.optional(
diff --git a/frontend/src/modules/auth/accept-entity-invite.tsx b/frontend/src/modules/auth/accept-entity-invite.tsx
deleted file mode 100644
index 179593014..000000000
--- a/frontend/src/modules/auth/accept-entity-invite.tsx
+++ /dev/null
@@ -1,82 +0,0 @@
-import { useMutation } from '@tanstack/react-query';
-import { Link, useNavigate, useParams, useSearch } from '@tanstack/react-router';
-import { appConfig } from 'config';
-import { Ban, Check } from 'lucide-react';
-import { useTranslation } from 'react-i18next';
-import { acceptEntityInvite } from '~/api.gen';
-import AuthErrorNotice from '~/modules/auth/error-notice';
-import { useCheckToken } from '~/modules/auth/use-token-check';
-import Spinner from '~/modules/common/spinner';
-import { toaster } from '~/modules/common/toaster/service';
-import { getAndSetMenu } from '~/modules/me/helpers';
-import { buttonVariants, SubmitButton } from '~/modules/ui/button';
-import { getEntityRoute } from '~/routes-resolver';
-import { useUserStore } from '~/store/user';
-import { cn } from '~/utils/cn';
-
-// Accept entity invitation when user is signed in
-const AcceptEntityInvite = () => {
-  const { t } = useTranslation();
-  const navigate = useNavigate();
-
-  const { token } = useParams({ from: '/publicLayout/authLayout/invitation/$token' });
-  const { tokenId } = useSearch({ from: '/publicLayout/authLayout/invitation/$token' });
-
-  const { user: currentUser } = useUserStore();
-
-  const { data, isLoading, error } = useCheckToken('invitation', tokenId);
-
-  const {
-    mutate: _acceptEntityInvite,
-    isPending,
-    error: acceptInviteError,
-  } = useMutation({
-    mutationFn: () => acceptEntityInvite({ path: { token } }),
-    onSuccess: async (entity) => {
-      await getAndSetMenu();
-
-      toaster(t('common:invitation_accepted', 'success'));
-
-      const { to, params, search } = getEntityRoute(entity);
-      navigate({ to, params, search });
-    },
-  });
-
-  // Accept organization invitation
-  const onSubmit = () => _acceptEntityInvite();
-
-  if (isLoading) return <Spinner className="h-10 w-10" />;
-  if (error || acceptInviteError) return <AuthErrorNotice error={error || acceptInviteError} />;
-
-  // Handle current user not being the one invited
-  if (!data?.userId || data.userId !== currentUser?.id)
-    return (
-      <AuthErrorNotice error={new Error(t('error:invitation_not_for_you'))}>
-        <Link to="/sign-out" reloadDocument className={buttonVariants({ size: 'lg' })}>
-          {t('common:sign_out_first')}
-        </Link>
-      </AuthErrorNotice>
-    );
-
-  return (
-    <>
-      <h1 className="text-2xl text-center">{t('common:accept_invite')}</h1>
-      <p className="font-light mb-4">{t('common:accept_invite_text', { email: data.email, organization: data.organizationName, role: data.role })}</p>
-
-      {data.email && (
-        <div className="space-y-4">
-          <SubmitButton loading={isPending} className="w-full" onClick={onSubmit}>
-            <Check size={16} strokeWidth={3} className="mr-2" />
-            {t('common:accept')}
-          </SubmitButton>
-          <Link to={appConfig.defaultRedirectPath} preload={false} className={cn('w-full', buttonVariants({ variant: 'secondary' }))}>
-            <Ban size={16} className="mr-2" />
-            {t('common:decline')}
-          </Link>
-        </div>
-      )}
-    </>
-  );
-};
-
-export default AcceptEntityInvite;
diff --git a/frontend/src/modules/auth/create-password-form.tsx b/frontend/src/modules/auth/create-password-form.tsx
index 03f3e70d2..b4a2205d2 100644
--- a/frontend/src/modules/auth/create-password-form.tsx
+++ b/frontend/src/modules/auth/create-password-form.tsx
@@ -1,6 +1,6 @@
 import { zodResolver } from '@hookform/resolvers/zod';
 import { useMutation } from '@tanstack/react-query';
-import { useNavigate, useParams, useSearch } from '@tanstack/react-router';
+import { useNavigate, useParams } from '@tanstack/react-router';
 import { appConfig } from 'config';
 import { ArrowRight } from 'lucide-react';
 import { lazy, Suspense, useRef } from 'react';
@@ -11,7 +11,7 @@ import { type CreatePasswordData, type CreatePasswordResponse, createPassword }
 import type { ApiError } from '~/lib/api';
 import AuthErrorNotice from '~/modules/auth/error-notice';
 import { RequestPasswordDialog } from '~/modules/auth/request-password-dialog';
-import { useCheckToken } from '~/modules/auth/use-token-check';
+import { useGetTokenData } from '~/modules/auth/use-token-check';
 import Spinner from '~/modules/common/spinner';
 import { toaster } from '~/modules/common/toaster/service';
 import { Button, SubmitButton } from '~/modules/ui/button';
@@ -30,10 +30,9 @@ const CreatePasswordForm = () => {
 
   const requestButtonRef = useRef(null);
 
-  const { token } = useParams({ from: '/publicLayout/authLayout/auth/create-password/$token' });
-  const { tokenId } = useSearch({ from: '/publicLayout/authLayout/auth/create-password/$token' });
+  const { tokenId } = useParams({ from: '/publicLayout/authLayout/auth/create-password/$tokenId' });
 
-  const { data, isLoading, error } = useCheckToken('password_reset', tokenId);
+  const { data, isLoading, error } = useGetTokenData('password_reset', tokenId);
   const isMobile = window.innerWidth < 640;
 
   // Reset password & sign in
@@ -42,7 +41,7 @@ const CreatePasswordForm = () => {
     isPending,
     error: resetPasswordError,
   } = useMutation<CreatePasswordResponse, ApiError, CreatePasswordData['body'] & CreatePasswordData['path']>({
-    mutationFn: ({ token, password }) => createPassword({ path: { token }, body: { password } }),
+    mutationFn: ({ tokenId, password }) => createPassword({ path: { tokenId }, body: { password } }),
     onSuccess: () => {
       toaster(t('common:success.password_reset'), 'success');
       navigate({ to: appConfig.defaultRedirectPath });
@@ -55,7 +54,7 @@ const CreatePasswordForm = () => {
   });
 
   // Submit new password
-  const onSubmit = ({ password }: FormValues) => _createPassword({ token, password });
+  const onSubmit = ({ password }: FormValues) => _createPassword({ tokenId, password });
 
   if (isLoading) return <Spinner className="h-10 w-10" />;
 
diff --git a/frontend/src/modules/auth/error-notice.tsx b/frontend/src/modules/auth/error-notice.tsx
index 7d86a105e..97ccadc8d 100644
--- a/frontend/src/modules/auth/error-notice.tsx
+++ b/frontend/src/modules/auth/error-notice.tsx
@@ -31,10 +31,10 @@ const AuthErrorNotice = ({ error, children }: { error: ErrorNoticeError; childre
         <CardTitle className="text-2xl mb-2 justify-center">{title}</CardTitle>
         <CardDescription className="text-foreground/80 text-lg flex-col gap-2">
           <span className="block">{message}</span>
-          <p className="mt-2 font-light">
+          <span className="block mt-2 font-light">
             <span className="block">{severity === 'warn' && t('error:contact_mistake')}</span>
             <span className="block">{severity === 'error' && t('error:try_again_later')}</span>
-          </p>
+          </span>
         </CardDescription>
       </CardHeader>
       <CardFooter className="flex gap-2 max-sm:flex-col max-sm:items-stretch flex-wrap mt-8 justify-center">
diff --git a/frontend/src/modules/auth/oauth-providers.tsx b/frontend/src/modules/auth/oauth-providers.tsx
index 63ed03ddc..64cbbbec0 100644
--- a/frontend/src/modules/auth/oauth-providers.tsx
+++ b/frontend/src/modules/auth/oauth-providers.tsx
@@ -23,7 +23,7 @@ type OAuthProvider = (typeof mapOAuthProviders)[number];
 const OAuthProviders = ({ authStep = 'signIn' }: { authStep: AuthStep }) => {
   const { t } = useTranslation();
   const mode = useUIStore((state) => state.mode);
-  const { token, tokenId, redirect } = useSearch({ from: '/publicLayout/authLayout/auth/authenticate' });
+  const { tokenId, redirect } = useSearch({ from: '/publicLayout/authLayout/auth/authenticate' });
 
   const [loadingProvider, setLoadingProvider] = useState<EnabledOAuthProvider | null>(null);
 
@@ -38,8 +38,7 @@ const OAuthProviders = ({ authStep = 'signIn' }: { authStep: AuthStep }) => {
       const params = new URLSearchParams();
 
       params.set('redirect', encodeURIComponent(redirectPath));
-      if (token && tokenId) {
-        params.set('token', token);
+      if (tokenId) {
         params.set('tokenId', tokenId);
         params.set('type', 'invite');
       } else params.set('type', 'auth');
diff --git a/frontend/src/modules/auth/steps/provider.tsx b/frontend/src/modules/auth/steps/provider.tsx
index a17c2b200..047ddffb1 100644
--- a/frontend/src/modules/auth/steps/provider.tsx
+++ b/frontend/src/modules/auth/steps/provider.tsx
@@ -2,7 +2,7 @@ import { useMatchRoute, useSearch } from '@tanstack/react-router';
 import { type ReactNode, useEffect, useState } from 'react';
 import type { ApiError } from '~/lib/api';
 import type { AuthStep } from '~/modules/auth/types';
-import { useCheckToken } from '~/modules/auth/use-token-check';
+import { useGetTokenData } from '~/modules/auth/use-token-check';
 import { useUserStore } from '~/store/user';
 import { AuthContext } from './provider-context';
 
@@ -22,7 +22,7 @@ export const AuthStepsProvider = ({ children }: { children: ReactNode }) => {
   const [step, setStepState] = useState<AuthStep>(initStep);
   const [authError, setAuthError] = useState<ApiError | null>(null);
 
-  const { data: tokenData } = useCheckToken('invitation', tokenId, !!tokenId);
+  const { data: tokenData } = useGetTokenData('invitation', tokenId, !!tokenId);
 
   const setStep = (newStep: AuthStep, newEmail: string, error?: ApiError) => {
     setStepState(newStep);
diff --git a/frontend/src/modules/auth/steps/sign-in.tsx b/frontend/src/modules/auth/steps/sign-in.tsx
index 7eb91aa6d..570155684 100644
--- a/frontend/src/modules/auth/steps/sign-in.tsx
+++ b/frontend/src/modules/auth/steps/sign-in.tsx
@@ -35,7 +35,7 @@ export const SignInStep = () => {
   const passwordRef = useRef<HTMLInputElement>(null);
 
   const { lastUser, clearUserStore } = useUserStore();
-  const { redirect: encodedRedirect, token, tokenId } = useSearch({ from: '/publicLayout/authLayout/auth/authenticate' });
+  const { redirect: encodedRedirect, tokenId } = useSearch({ from: '/publicLayout/authLayout/auth/authenticate' });
 
   const redirect = decodeURIComponent(encodedRedirect || '');
   const isMobile = window.innerWidth < 640;
@@ -56,12 +56,16 @@ export const SignInStep = () => {
       }
 
       // Go to invitation if token is provided, otherwise use provided redirect or default path
-      const redirectPath = token ? '/invitation/$token' : redirect?.startsWith('/') ? redirect : appConfig.defaultRedirectPath;
+      const redirectPath = tokenId
+        ? `/home?invitationTokenId=${tokenId}&skipWelcome=true`
+        : redirect?.startsWith('/')
+          ? redirect
+          : appConfig.defaultRedirectPath;
 
       navigate({
         to: redirectPath,
         replace: true,
-        ...(token && { params: { token }, search: { tokenId } }),
+        ...(tokenId && { search: { tokenId } }),
       });
     },
     onError: (error: ApiError) => {
@@ -83,15 +87,15 @@ export const SignInStep = () => {
   return (
     <Form {...form}>
       <h1 className="text-2xl text-center">
-        {token ? t('common:invite_sign_in') : lastUser ? t('common:welcome_back') : t('common:sign_in_as')} <br />
+        {tokenId ? t('common:invite_sign_in') : lastUser ? t('common:welcome_back') : t('common:sign_in_as')} <br />
         <Button
           variant="ghost"
           onClick={resetAuth}
-          disabled={!!token}
+          disabled={!!tokenId}
           className="mx-auto flex max-w-full truncate font-light mt-2 sm:text-xl bg-foreground/10"
         >
           <span className="truncate">{email}</span>
-          {!token && <ChevronDown size={16} className="ml-1" />}
+          {!tokenId && <ChevronDown size={16} className="ml-1" />}
         </Button>
       </h1>
       {emailEnabled && (
diff --git a/frontend/src/modules/auth/steps/sign-up.tsx b/frontend/src/modules/auth/steps/sign-up.tsx
index 76cf0f6ea..7b45d871f 100644
--- a/frontend/src/modules/auth/steps/sign-up.tsx
+++ b/frontend/src/modules/auth/steps/sign-up.tsx
@@ -34,7 +34,7 @@ export const SignUpStep = () => {
 
   const { email, tokenData, setStep, resetSteps } = useAuthStepsContext();
 
-  const { token } = useSearch({ from: '/publicLayout/authLayout/auth/authenticate' });
+  const { tokenId } = useSearch({ from: '/publicLayout/authLayout/auth/authenticate' });
 
   const isMobile = window.innerWidth < 640;
 
@@ -54,7 +54,7 @@ export const SignUpStep = () => {
     ApiError,
     NonNullable<SignUpWithTokenData['body']> & SignUpWithTokenData['path']
   >({
-    mutationFn: ({ token, ...body }) => signUpWithToken({ body, path: { token } }),
+    mutationFn: ({ tokenId, ...body }) => signUpWithToken({ body, path: { tokenId } }),
     onSuccess: ({ redirectPath }) => {
       const to = redirectPath ?? appConfig.defaultRedirectPath;
       return navigate({ to, replace: true });
@@ -69,7 +69,7 @@ export const SignUpStep = () => {
 
   // Handle submit action
   const onSubmit = (formValues: FormValues) => {
-    if (token) return _signUpWithToken({ ...formValues, token });
+    if (tokenId) return _signUpWithToken({ ...formValues, tokenId });
     _signUp({ ...formValues });
   };
 
diff --git a/frontend/src/modules/auth/totp-verify-code-form.tsx b/frontend/src/modules/auth/totp-verify-code-form.tsx
index 28172dc9d..4742faeaf 100644
--- a/frontend/src/modules/auth/totp-verify-code-form.tsx
+++ b/frontend/src/modules/auth/totp-verify-code-form.tsx
@@ -3,13 +3,13 @@ import { appConfig } from 'config';
 import { useForm, useFormState } from 'react-hook-form';
 import { useTranslation } from 'react-i18next';
 import type z from 'zod';
-import { zActivateTotpData } from '~/api.gen/zod.gen';
+import { zCreateTotpData } from '~/api.gen/zod.gen';
 import { Button, SubmitButton } from '~/modules/ui/button';
 import { Form, FormControl, FormField, FormItem, FormLabel, FormMessage } from '~/modules/ui/form';
 import { defaultOnInvalid } from '~/utils/form-on-invalid';
 import { InputOTP, InputOTPGroup, InputOTPSlot } from '../ui/totp';
 
-const formSchema = zActivateTotpData.shape.body;
+const formSchema = zCreateTotpData.shape.body;
 type FormValues = z.infer<typeof formSchema>;
 
 interface Props {
diff --git a/frontend/src/modules/auth/types.ts b/frontend/src/modules/auth/types.ts
index 0174d8d3b..e1f0133c4 100644
--- a/frontend/src/modules/auth/types.ts
+++ b/frontend/src/modules/auth/types.ts
@@ -1,4 +1,4 @@
-import type { CheckTokenResponse, CreatePasskeyChallengeData } from '~/api.gen';
+import type { CreatePasskeyChallengeData, GetTokenDataResponse } from '~/api.gen';
 
 type PasskeyChallengeType = NonNullable<CreatePasskeyChallengeData['body']>['type'];
 
@@ -7,6 +7,6 @@ export interface PasskeyCredentialProps {
   type: PasskeyChallengeType;
 }
 
-export type TokenData = CheckTokenResponse;
+export type TokenData = GetTokenDataResponse;
 
 export type AuthStep = 'checkEmail' | 'signIn' | 'signUp' | 'inviteOnly' | 'waitlist' | 'error' | 'mfa';
diff --git a/frontend/src/modules/auth/use-token-check.tsx b/frontend/src/modules/auth/use-token-check.tsx
index a6338136d..0b94f9ec6 100644
--- a/frontend/src/modules/auth/use-token-check.tsx
+++ b/frontend/src/modules/auth/use-token-check.tsx
@@ -1,11 +1,9 @@
 import { type UseQueryResult, useQuery } from '@tanstack/react-query';
-import type { appConfig } from 'config';
-import { checkToken } from '~/api.gen';
+import type { TokenType } from 'config';
+import { getTokenData } from '~/api.gen';
 import type { ApiError } from '~/lib/api';
 import type { TokenData } from '~/modules/auth/types';
 
-type TokenType = (typeof appConfig.tokenTypes)[number];
-
 /**
  *  Get token data by ID.
  *
@@ -13,12 +11,12 @@ type TokenType = (typeof appConfig.tokenTypes)[number];
  * @param tokenId Token ID to check
  * @param enabled (Default true) Enable the query
  */
-export const useCheckToken = (type: TokenType, tokenId?: string, enabled = true): UseQueryResult<TokenData | undefined, ApiError> => {
+export const useGetTokenData = (type: TokenType, tokenId?: string, enabled = true): UseQueryResult<TokenData | undefined, ApiError> => {
   return useQuery({
     queryKey: [],
     queryFn: async () => {
       if (!tokenId) throw new Error('Token ID is required');
-      return checkToken({ path: { tokenId }, query: { type } });
+      return getTokenData({ path: { tokenId }, query: { type } });
     },
     enabled,
     staleTime: 0, // Important to always get latest token status
diff --git a/frontend/src/modules/common/data-table/select-column.tsx b/frontend/src/modules/common/data-table/select-column.tsx
index 23efbf0a1..27ac376a3 100644
--- a/frontend/src/modules/common/data-table/select-column.tsx
+++ b/frontend/src/modules/common/data-table/select-column.tsx
@@ -12,7 +12,7 @@ export const renderSelect = <TRow extends User | Member | Organization>({
 }: {
   row: TRow;
   onRowChange: (row: TRow, commitChanges?: boolean) => void;
-  options: typeof appConfig.rolesByType.entityRoles | typeof appConfig.rolesByType.systemRoles;
+  options: typeof appConfig.roles.entityRoles | typeof appConfig.roles.systemRoles;
 }) => {
   const { t } = useTranslation();
 
diff --git a/frontend/src/modules/common/error-notice.tsx b/frontend/src/modules/common/error-notice.tsx
index 1facac035..70de80e8c 100644
--- a/frontend/src/modules/common/error-notice.tsx
+++ b/frontend/src/modules/common/error-notice.tsx
@@ -108,10 +108,10 @@ const ErrorNotice = ({ error, resetErrorBoundary, level }: ErrorNoticeProps) =>
               <CardTitle className="text-2xl mb-2 justify-center">{title}</CardTitle>
               <CardDescription className="text-foreground/80 text-lg flex-col gap-2">
                 <span className="block">{message}</span>
-                <p className="mt-2 font-light">
+                <span className="block mt-2 font-light">
                   <span className="block">{severity === 'warn' && t('error:contact_mistake')}</span>
                   <span className="block">{severity === 'error' && t('error:try_again_later')}</span>
-                </p>
+                </span>
               </CardDescription>
             </CardHeader>
             {error && 'status' in error && (
diff --git a/frontend/src/modules/common/form-fields/select-role-radio.tsx b/frontend/src/modules/common/form-fields/select-role-radio.tsx
index 9248308a6..3d5d9a1f8 100644
--- a/frontend/src/modules/common/form-fields/select-role-radio.tsx
+++ b/frontend/src/modules/common/form-fields/select-role-radio.tsx
@@ -6,14 +6,14 @@ import { cn } from '~/utils/cn';
 interface Props {
   entityType?: ContextEntityType;
   onChange: (value?: string) => void;
-  value?: (typeof appConfig.rolesByType.allRoles)[number];
+  value?: (typeof appConfig.roles.allRoles)[number];
   className?: string;
 }
 
 const SelectRoleRadio = ({ entityType, onChange, value, className }: Props) => {
   const { t } = useTranslation();
 
-  const roles = entityType ? appConfig.rolesByType.entityRoles : ['user'];
+  const roles = entityType ? appConfig.roles.entityRoles : ['user'];
 
   return (
     <RadioGroup value={value} onValueChange={onChange} className={cn('inline-flex gap-4 items-center', className)}>
diff --git a/frontend/src/modules/common/form-fields/select-role.tsx b/frontend/src/modules/common/form-fields/select-role.tsx
index 643ef0c1a..ccc0e7f4b 100644
--- a/frontend/src/modules/common/form-fields/select-role.tsx
+++ b/frontend/src/modules/common/form-fields/select-role.tsx
@@ -15,7 +15,7 @@ const SelectRole = ({ entity = false, onChange, value, className }: SelectRolePr
   const { t } = useTranslation();
   const { isOnline } = useOnlineManager();
 
-  const roles = entity ? appConfig.rolesByType.entityRoles : appConfig.rolesByType.systemRoles;
+  const roles = entity ? appConfig.roles.entityRoles : appConfig.roles.systemRoles;
 
   return (
     <Select value={value === undefined || value === 'all' ? 'all' : value} onValueChange={(role) => onChange(role === 'all' ? undefined : role)}>
diff --git a/frontend/src/modules/common/form-fields/select-roles.tsx b/frontend/src/modules/common/form-fields/select-roles.tsx
index 41162bbeb..ade1fc533 100644
--- a/frontend/src/modules/common/form-fields/select-roles.tsx
+++ b/frontend/src/modules/common/form-fields/select-roles.tsx
@@ -21,7 +21,7 @@ const SelectRoles = ({ onChange, value = [], className }: SelectRoleProps) => {
 
   return (
     <div className={cn('inline-flex gap-2 items-center', className)}>
-      {appConfig.rolesByType.entityRoles.map((role) => (
+      {appConfig.roles.entityRoles.map((role) => (
         // biome-ignore lint/a11y/noLabelWithoutControl: label is for visual grouping only, no input needed
         <label key={role} className="inline-flex gap-2 items-center cursor-pointer ">
           <Checkbox checked={value.includes(role)} onCheckedChange={() => handleCheckboxChange(role)} className="w-5 h-5" />
diff --git a/frontend/src/modules/me/entity-invitations.tsx b/frontend/src/modules/me/entity-invitations.tsx
index b1aae1b31..be6e9381d 100644
--- a/frontend/src/modules/me/entity-invitations.tsx
+++ b/frontend/src/modules/me/entity-invitations.tsx
@@ -1,19 +1,17 @@
 import { useMutation, useSuspenseQuery } from '@tanstack/react-query';
 import { Link } from '@tanstack/react-router';
 import { useTranslation } from 'react-i18next';
-import { type AcceptEntityInviteResponse, type ApiError, acceptEntityInvite, type GetMyInvitationsResponse } from '~/api.gen';
+import { AcceptMembershipData, type AcceptMembershipResponse, type ApiError, acceptMembership, type GetMyInvitationsResponse } from '~/api.gen';
 import { AvatarWrap } from '~/modules/common/avatar-wrap';
 import { ExpandableList } from '~/modules/common/expandable-list';
 import { toaster } from '~/modules/common/toaster/service';
 import { getAndSetMenu } from '~/modules/me/helpers';
-import { meInvitesQueryOptions, meKeys } from '~/modules/me/query';
-import { ResendMembershipInviteButton } from '~/modules/memberships/resend-membership-invitation';
+import { meInvitationsQueryOptions, meKeys } from '~/modules/me/query';
 import { Button } from '~/modules/ui/button';
 import { Card, CardContent, CardHeader, CardTitle } from '~/modules/ui/card';
 import { UserCell } from '~/modules/users/user-cell';
 import { queryClient } from '~/query/query-client';
 import { getEntityRoute } from '~/routes-resolver';
-import { useUserStore } from '~/store/user';
 import { dateShort } from '~/utils/date-short';
 
 /**
@@ -21,13 +19,12 @@ import { dateShort } from '~/utils/date-short';
  */
 export const EntityInvitations = () => {
   const { t } = useTranslation();
-  const { user } = useUserStore();
 
-  const queryOptions = meInvitesQueryOptions();
+  const queryOptions = meInvitationsQueryOptions();
   const { data: invites } = useSuspenseQuery(queryOptions);
 
-  const { mutate: _acceptEntityInvite } = useMutation<AcceptEntityInviteResponse, ApiError, string>({
-    mutationFn: (token) => acceptEntityInvite({ path: { token } }),
+  const { mutate: _acceptMembership } = useMutation<AcceptMembershipResponse, ApiError, AcceptMembershipData['path']>({
+    mutationFn: ({ id, acceptOrReject }) => acceptMembership({ path: { id, acceptOrReject } }),
     onSuccess: async (acceptedEntity) => {
       await getAndSetMenu();
       queryClient.setQueryData<GetMyInvitationsResponse>(meKeys.invites, (oldData) => {
@@ -38,8 +35,6 @@ export const EntityInvitations = () => {
     },
   });
 
-  const callback = () => queryClient.invalidateQueries({ queryKey: meKeys.invites });
-
   if (!invites?.length) return null;
 
   return (
@@ -57,10 +52,11 @@ export const EntityInvitations = () => {
           </div>
           <ExpandableList
             items={invites}
-            renderItem={({ entity, invitedBy, expiresAt, token, tokenId }) => {
+            renderItem={({ entity, invitedBy, membership }) => {
               const { to, params, search } = getEntityRoute({ ...entity, membership: null });
 
-              const isExpired = new Date(expiresAt) < new Date();
+              // TODO
+              const isExpired = new Date(membership.createdAt as string) < new Date();
               return (
                 <div className="grid grid-cols-4 col-end- items-center gap-4 py-2">
                   <Link to={to} params={params} search={search} draggable="false" className="flex space-x-2 items-center outline-0 ring-0 group">
@@ -76,19 +72,16 @@ export const EntityInvitations = () => {
                     </span>
                   </Link>
                   {invitedBy ? <UserCell user={invitedBy} tabIndex={0} /> : '-'}
-                  <span>{isExpired ? 'Expired' : dateShort(expiresAt)}</span>
-                  {isExpired ? (
-                    <ResendMembershipInviteButton
-                      resendData={{ email: user.email, tokenId }}
-                      buttonProps={{ className: 'w-full', size: 'xs', variant: 'outlinePrimary' }}
-                      wrapperClassName="w-[60%] ml-auto"
-                      callback={callback}
-                    />
-                  ) : (
-                    <Button className="w-[60%] ml-auto" size="xs" variant="darkSuccess" onClick={() => _acceptEntityInvite(token)}>
-                      {t('common:accept')}
-                    </Button>
-                  )}
+                  {/* TODO */}
+                  <span>{isExpired ? 'Expired' : dateShort(membership.createdAt as string)}</span>
+                  <Button
+                    className="w-[60%] ml-auto"
+                    size="xs"
+                    variant="darkSuccess"
+                    onClick={() => _acceptMembership({ id: membership.id, acceptOrReject: 'accept' })}
+                  >
+                    {t('common:accept')}
+                  </Button>
                 </div>
               );
             }}
diff --git a/frontend/src/modules/me/query.ts b/frontend/src/modules/me/query.ts
index d41ab985c..4a9cfae99 100644
--- a/frontend/src/modules/me/query.ts
+++ b/frontend/src/modules/me/query.ts
@@ -59,7 +59,7 @@ export const menuQueryOptions = () => queryOptions({ queryKey: meKeys.menu, quer
  *
  * @returns Query options.
  */
-export const meInvitesQueryOptions = () => queryOptions({ queryKey: meKeys.invites, queryFn: () => getMyInvitations() });
+export const meInvitationsQueryOptions = () => queryOptions({ queryKey: meKeys.invites, queryFn: () => getMyInvitations() });
 
 /**
  * Mutation hook for updating current user (self) info
diff --git a/frontend/src/modules/me/totp/setup.tsx b/frontend/src/modules/me/totp/setup.tsx
index ed58fbf51..1be98723a 100644
--- a/frontend/src/modules/me/totp/setup.tsx
+++ b/frontend/src/modules/me/totp/setup.tsx
@@ -3,7 +3,7 @@ import { CircleAlert, CopyCheckIcon, CopyIcon } from 'lucide-react';
 import { QRCodeSVG } from 'qrcode.react';
 import { useRef, useState } from 'react';
 import { useTranslation } from 'react-i18next';
-import { type ActivateTotpData, type ActivateTotpResponse, type ApiError, activateTotp, registerTotp } from '~/api.gen';
+import { type ApiError, type CreateTotpData, type CreateTotpResponse, createTotp, createTotpChallenge } from '~/api.gen';
 import { useCopyToClipboard } from '~/hooks/use-copy-to-clipboard';
 import { TotpConfirmationForm } from '~/modules/auth/totp-verify-code-form';
 import { useDialoger } from '~/modules/common/dialoger/use-dialoger';
@@ -19,8 +19,8 @@ export const SetupTotp = () => {
   const [formVersion, setFormVersion] = useState(0);
 
   // Mutation to validate and activate TOTP with provided code
-  const { mutate, isPending } = useMutation<ActivateTotpResponse, ApiError | Error, NonNullable<ActivateTotpData['body']>>({
-    mutationFn: async (body) => await activateTotp({ body }),
+  const { mutate, isPending } = useMutation<CreateTotpResponse, ApiError | Error, NonNullable<CreateTotpData['body']>>({
+    mutationFn: async (body) => await createTotp({ body }),
     onSuccess: () => {
       useDialoger.getState().remove('setup-totp');
       useUserStore.getState().setMeAuthData({ hasTotp: true });
@@ -40,7 +40,7 @@ export const SetupTotp = () => {
   // Fetch TOTP registration data (URI and manual key)
   const { data } = useSuspenseQuery({
     queryKey: ['totp', 'uri'],
-    queryFn: async () => await registerTotp(),
+    queryFn: async () => await createTotpChallenge(),
     staleTime: 0,
   });
 
diff --git a/frontend/src/modules/memberships/members-table/columns.tsx b/frontend/src/modules/memberships/members-table/columns.tsx
index 6411a47dd..aa093d20b 100644
--- a/frontend/src/modules/memberships/members-table/columns.tsx
+++ b/frontend/src/modules/memberships/members-table/columns.tsx
@@ -66,7 +66,7 @@ export const useColumns = (isAdmin: boolean, isSheet: boolean) => {
             renderSelect({
               row,
               onRowChange,
-              options: appConfig.rolesByType.entityRoles,
+              options: appConfig.roles.entityRoles,
             }),
         }),
       },
diff --git a/frontend/src/modules/memberships/resend-membership-invitation.tsx b/frontend/src/modules/memberships/resend-membership-invitation.tsx
index 252ffa8ff..d49085dc6 100644
--- a/frontend/src/modules/memberships/resend-membership-invitation.tsx
+++ b/frontend/src/modules/memberships/resend-membership-invitation.tsx
@@ -15,6 +15,7 @@ type ResendButtonPrpos = {
   callback?: () => void;
 };
 
+// TODO refactor to resend token or refresh token with token refresh functionality that is upcoming
 export const ResendMembershipInviteButton = ({ resendData, wrapperClassName, buttonProps, callback }: ResendButtonPrpos) => {
   const { t } = useTranslation();
   const [disabledResetPassword, setDisabledResetPassword] = useState(false);
diff --git a/frontend/src/modules/organizations/table/columns.tsx b/frontend/src/modules/organizations/table/columns.tsx
index 9c2fff66e..89a9b3e11 100644
--- a/frontend/src/modules/organizations/table/columns.tsx
+++ b/frontend/src/modules/organizations/table/columns.tsx
@@ -69,7 +69,7 @@ export const useColumns = () => {
           renderSelect({
             row,
             onRowChange,
-            options: appConfig.rolesByType.entityRoles,
+            options: appConfig.roles.entityRoles,
           }),
       },
       {
diff --git a/frontend/src/routes/auth-routes.tsx b/frontend/src/routes/auth-routes.tsx
index 168ed8040..d9008bafa 100644
--- a/frontend/src/routes/auth-routes.tsx
+++ b/frontend/src/routes/auth-routes.tsx
@@ -1,7 +1,6 @@
 import { createRoute, redirect } from '@tanstack/react-router';
 import { appConfig } from 'config';
 import { z } from 'zod';
-import AcceptEntityInvite from '~/modules/auth/accept-entity-invite';
 import CreatePasswordForm from '~/modules/auth/create-password-form';
 import EmailVerification from '~/modules/auth/email-verification';
 import AuthPage from '~/modules/auth/layout';
@@ -11,8 +10,6 @@ import AuthSteps from '~/modules/auth/steps';
 import { MfaStep } from '~/modules/auth/steps/mfa';
 import { AuthStepsProvider } from '~/modules/auth/steps/provider';
 import Unsubscribed from '~/modules/auth/unsubscribed';
-import { meQueryOptions } from '~/modules/me/query';
-import { queryClient } from '~/query/query-client';
 import { PublicLayoutRoute } from '~/routes/base-routes';
 import { useUserStore } from '~/store/user';
 import appTitle from '~/utils/app-title';
@@ -71,8 +68,7 @@ export const RequestPasswordRoute = createRoute({
 });
 
 export const CreatePasswordWithTokenRoute = createRoute({
-  path: '/auth/create-password/$token',
-  validateSearch: z.object({ tokenId: z.string() }),
+  path: '/auth/create-password/$tokenId',
   staticData: { isAuth: false },
   head: () => ({ meta: [{ title: appTitle('Create password') }] }),
   getParentRoute: () => AuthLayoutRoute,
@@ -88,26 +84,6 @@ export const EmailVerificationRoute = createRoute({
   component: () => <EmailVerification />,
 });
 
-export const AcceptEntityInviteRoute = createRoute({
-  path: '/invitation/$token',
-  validateSearch: z.object({ tokenId: z.string() }),
-  staticData: { isAuth: true },
-  head: () => ({ meta: [{ title: appTitle('Join') }] }),
-  beforeLoad: async ({ params, search }) => {
-    try {
-      const queryOptions = meQueryOptions();
-      const options = { ...queryOptions, revalidateIfStale: true };
-      await queryClient.ensureQueryData(options);
-    } catch {
-      // When user is new, authentication will process the user first, then redirect back here
-      console.info('Not authenticated while trying to handle invitation (silent check) -> redirect to sign in with invite data');
-      throw redirect({ to: '/auth/authenticate', search: { tokenId: search.tokenId, token: params.token } });
-    }
-  },
-  getParentRoute: () => AuthLayoutRoute,
-  component: () => <AcceptEntityInvite />,
-});
-
 export const UnsubscribedRoute = createRoute({
   path: '/auth/unsubscribed',
   staticData: { isAuth: false },
diff --git a/frontend/src/routes/base-routes.tsx b/frontend/src/routes/base-routes.tsx
index 68c3de88a..23365668d 100644
--- a/frontend/src/routes/base-routes.tsx
+++ b/frontend/src/routes/base-routes.tsx
@@ -109,6 +109,7 @@ export const AppLayoutRoute = createRoute({
     // If location is root and has user, redirect to home
     if (location.pathname === '/') throw redirect({ to: appConfig.defaultRedirectPath, replace: true });
   },
+  // @ts-ignore // TODO
   loader: async ({ cause }) => {
     if (cause !== 'enter') return;
 
diff --git a/frontend/src/routes/home-routes.tsx b/frontend/src/routes/home-routes.tsx
index 97a64d587..74a5a88ea 100644
--- a/frontend/src/routes/home-routes.tsx
+++ b/frontend/src/routes/home-routes.tsx
@@ -1,5 +1,6 @@
 import { createRoute, redirect } from '@tanstack/react-router';
 import { lazy, Suspense } from 'react';
+import z from 'zod';
 import Home from '~/modules/home';
 import { AppLayoutRoute } from '~/routes/base-routes';
 import { useUserStore } from '~/store/user';
@@ -9,6 +10,7 @@ const Welcome = lazy(() => import('~/modules/home/welcome-page'));
 
 export const HomeRoute = createRoute({
   path: '/',
+  head: () => ({ meta: [{ title: appTitle('Home') }] }),
   staticData: { isAuth: true },
   getParentRoute: () => AppLayoutRoute,
   component: () => (
@@ -21,12 +23,19 @@ export const HomeRoute = createRoute({
 // We need an alias for '/' to forward users better if coming from backend
 export const HomeAliasRoute = createRoute({
   path: '/home',
+  validateSearch: z.object({
+    invitationTokenId: z.string().optional(),
+    invitationMembershipId: z.string().optional(),
+    skipWelcome: z.string().optional(),
+  }),
   staticData: { isAuth: true },
   head: () => ({ meta: [{ title: appTitle('Home') }] }),
   getParentRoute: () => AppLayoutRoute,
-  beforeLoad: () => {
+  beforeLoad: ({ search, cause }) => {
+    if (cause !== 'enter' || search.skipWelcome) return;
     const { user } = useUserStore.getState();
-    if (!user.userFlags.finishedOnboarding) throw redirect({ to: '/welcome' });
+    if (user.userFlags.finishedOnboarding) return;
+    throw redirect({ to: '/welcome' });
   },
   component: () => (
     <Suspense>
diff --git a/frontend/src/routes/route-tree.tsx b/frontend/src/routes/route-tree.tsx
index 298e5e6e2..f12514aab 100644
--- a/frontend/src/routes/route-tree.tsx
+++ b/frontend/src/routes/route-tree.tsx
@@ -1,6 +1,5 @@
 import type { NavItemId } from '~/modules/navigation/types';
 import {
-  AcceptEntityInviteRoute,
   AuthenticateRoute,
   AuthLayoutRoute,
   CreatePasswordWithTokenRoute,
@@ -42,7 +41,6 @@ export const routeTree = RootRoute.addChildren([
   AppLayoutRoute.addChildren([
     HomeRoute,
     HomeAliasRoute,
-    AcceptEntityInviteRoute,
     WelcomeRoute,
     SystemRoute.addChildren([UsersTableRoute, OrganizationsTableRoute, RequestsTableRoute, MetricsRoute]),
     UserProfileRoute,
diff --git a/info/DEPLOYMENT.md b/info/DEPLOYMENT.md
index 07afdb65e..401d89ed6 100644
--- a/info/DEPLOYMENT.md
+++ b/info/DEPLOYMENT.md
@@ -1,4 +1,6 @@
 # Deployment
+> [!WARNING]
+> Deployment is a work in progress. We are trying to build a deployment flow that consists out of 🇪🇺 European services. Apart from Github atm...😅 Want to help? Let's connect! ✉️ <info@cellajs.com>
 
 Cella makes it easy to deploy on [Render](https://www.render.com) (backend, frontend). More options will become available over time.
 
@@ -7,14 +9,3 @@ Cella makes it easy to deploy on [Render](https://www.render.com) (backend, fron
 Go to [blueprints](https://dashboard.render.com/select-repo?type=blueprint) and select the repo by clicking `Connect`.
 
 Speed up the process by using the existing `render.yaml` file in the root.
-
-## Enable Novu Slack notification
-
-[Gide by Novu](https://docs.novu.co/guides/slack-guide).
-At first, [create App in Slack](https://api.slack.com/apps) so you can obtain the App ID, Client ID, and Client Secret.
-
-Then, [create Novu Workflow](https://web.novu.co/workflows?page=1&size=10) and select 'Blank workflow'.
-
-The next step is [creating the Slack integration](https://web.novu.co/integrations). Create a Slack provider and add the App ID, Client ID, and Client Secret obtained from the first step. It's important not to forget to activate it. Now, in the workflow, add the 'Chat (Slack)' option to your workflow trigger and configure the message content. Pass variables that you want to use within double curly braces as example {{usersMessage}}.
-
-Also we need to [add incoming webhook](https://api.slack.com/apps/A074GBPK6A1/incoming-webhooks?).
diff --git a/info/RELEASES.md b/info/RELEASES.md
new file mode 100644
index 000000000..12034265e
--- /dev/null
+++ b/info/RELEASES.md
@@ -0,0 +1,21 @@
+## Releases
+
+We use GitHub Actions to automatically create releases when version tags are pushed.
+
+1. Make sure your changes are merged.
+2. Bump the version with pnpm (this also creates a Git tag):  
+
+```sh
+  pnpm version patch   # or minor / major
+```
+3. Push the commit and the tag:
+```sh
+  git push origin --follow-tags
+```
+Thats it, the workflow will generate RELEASE_NOTES.md from commit messages and publish a GitHub Release automatically.
+
+Release notes are grouped by commit type. The following prefixes are supported:
+- `feat:`, `fix:`, `perf:`, `refactor:`, `revert:`, `chore:`, `ci:`, `docs:` `style:`, `test:`, `build:`
+
+<br />
+<br />
diff --git a/lefthook.yaml b/lefthook.yaml
index 4e23e3275..0ffaab726 100644
--- a/lefthook.yaml
+++ b/lefthook.yaml
@@ -1,8 +1,8 @@
 pre-commit:
   commands:
-    typescript:
-      run: pnpm generate:openapi && pnpm ts && git add frontend/src/api.gen
-    biome:
-      glob: "*.{js,ts,cjs,mjs,d.cts,d.mts,jsx,tsx,json,jsonc}"
-      run: pnpm dlx @biomejs/biome check --write --no-errors-on-unmatched --files-ignore-unknown=true {staged_files} && git update-index --again
-  parallel: false
+  #   typescript:
+  #     run: pnpm generate:openapi && pnpm ts && git add frontend/src/api.gen
+  #   biome:
+  #     glob: "*.{js,ts,cjs,mjs,d.cts,d.mts,jsx,tsx,json,jsonc}"
+  #     run: pnpm dlx @biomejs/biome check --write --no-errors-on-unmatched --files-ignore-unknown=true {staged_files} && git update-index --again
+  # parallel: false
diff --git a/locales/en/backend.json b/locales/en/backend.json
index fd8e7a6d2..16444f3c0 100644
--- a/locales/en/backend.json
+++ b/locales/en/backend.json
@@ -5,7 +5,8 @@
   "email.create_password.preview": "Reset your {{appName}} password",
   "email.create_password.subject": "Reset password",
   "email.create_password.text": "A password reset link has been requested for your <strong>{{appName}}</strong> account.",
-  "email.email_verification.preview": "Verify your email for {{appName}}",
+  "email.email_verification.preview": "Complete {{appName}} sign up",
+  "email.email_verification.title": "Verify your email for {{appName}}",
   "email.email_verification.subject": "Verify email",
   "email.email_verification.text": "Hi {{name}}, you are almost ready to start on {{appName}}! Click the link below to verify your email address '{{email}}' and get started. The link expires in 2 hours.",
   "email.oauth_verification.preview": "Verify connecting your {{ providerName}} to {{appName}}",
diff --git a/locales/en/common.json b/locales/en/common.json
index 0cec7f86a..bb5a30b18 100644
--- a/locales/en/common.json
+++ b/locales/en/common.json
@@ -1,8 +1,6 @@
 {
   "about": "About",
   "accept": "Accept",
-  "accept_invite": "Accept invitation",
-  "accept_invite_text": "Hi {{email}}, click accept to become part of organization {{organization}} as {{role}}.",
   "accessibility": "Accessibility",
   "account": "Account",
   "action": "Action",
@@ -246,7 +244,7 @@
   "onboarding_completed": "Great! Let's go.",
   "onboarding_completed.text": "Have a look around to explore the features of {{appName}}.",
   "onboarding_welcome": "Welcome to {{appName}}",
-  "onboarding_welcome.text": "A template to build collaborative web apps with sync engine. What will you build with it?",
+  "onboarding_welcome.text": "🚀 Boost development of collaborative web apps with sync engine. What will you build?",
   "online": "Online",
   "options": "Options",
   "or": "Or",
@@ -324,8 +322,8 @@
   "restore": "Restore",
   "restrict_image_upload": "Image upload not configured.",
   "results": "Results",
-  "retry_resend_invitation.text": "Wait 1 minute before sending another invite.",
-  "retry_reset_password.text": "Wait 1 minute before sending another reset link.",
+  "retry_resend_invitation.text": "Please check your inbox before requesting another invite.",
+  "retry_reset_password.text": "Please check your inbox before requesting another reset link.",
   "revert": "Revert",
   "revert_handle": "Revert to current handle",
   "roadmap": "Roadmap",
@@ -360,7 +358,6 @@
   "sign_in_or_up": "Sign in or sign up",
   "sign_in_with": "Sign in with {{provider}}",
   "sign_out": "Sign out",
-  "sign_out_first": "Sign out first",
   "sign_up": "Sign up",
   "signing_out": "Signing out ... Enjoy your day!",
   "size": "Size",
diff --git a/locales/en/errors.json b/locales/en/errors.json
index 83155e7db..408ace4ce 100644
--- a/locales/en/errors.json
+++ b/locales/en/errors.json
@@ -10,8 +10,10 @@
   "delete_resources": "{{resources}} could not be deleted",
   "duplicate_creation": "Item already exist",
   "email_exists": "Email already exists",
-  "email_verification_expired": "Email verification token has expired",
-  "email_verification_expired.text": "The token you provided has expired. Use forgot password to verify.",
+  "email_verification_expired": "Email verification token expired",
+  "email_verification_expired.text": "Use forgot password to verify.",
+  "oauth_verification_expired": "OAuth verification token expired",
+  "oauth_verification_expired.text": "Go to sign in to restart the authentication process.",
   "email_verification_not_found": "Can't verify email",
   "email_verification_not_found.text": "The token is used or doesn't exist anymore. ",
   "error": "Error",
@@ -72,6 +74,8 @@
   "invalid_session": "Not authenticated",
   "invalid_session.text": "Your session has expired or is invalid. Please sign in again.",
   "invalid_state": "Invalid state",
+  "insecure_request": "Insecure request",
+  "insecure_request.text": "To protect your data, we can't process this request.",
   "invalid_state.text": "Could not complete the authentication process.",
   "invalid_token": "Invalid token",
   "invitation_expired": "Invitation has expired",
@@ -110,7 +114,7 @@
   "no_user_found": "No user found",
   "not_found": "Not found",
   "not_found.text": "This resource does not exist or has been deleted.",
-  "not_found.token": "Token is invalid. Please request a new one.",
+  "token_not_found": "Token is invalid.",
   "connect_user_not_found": "Failed to connect account, user data missing.",
   "verification_not_found": "Failed to verify email, token missing or invalid.",
   "oauth_failed": "OAuth failed",
@@ -120,6 +124,10 @@
   "oauth_taken": "Not allowed to connect.",
   "membership_not_found": "Membership not found",
   "membership_not_found.text": "The membership you are trying to access does not exist or has been deleted.",
+  "membership_without_token": "Membership cannot be activated",
+  "membership_without_token.text": "This membership cannot be activated because it lacks a valid token.",
+  "membership_already_active": "Membership active",
+  "membership_already_active.text": "This membership has already been activated.",
   "oauth_taken.text": "The account you tried to connect is already linked to a different user.",
   "oauth_email_exists": "Not allowed to connect.",
   "oauth_email_exists.text": "The email of the account you tried to connect, already belongs to an existing user. If that's you, please sign first and go to settings to connect this account.",
@@ -183,8 +191,8 @@
   "organization_mismatch": "This item is linked to a different organization than the one you're currently using. Please switch to the appropriate organization or ask your administrator for access.",
   "session_expired": "Session Expired",
   "session_expired.text": "Your authentication session has expired. Please log in again to continue.",
-  "confirm_mfa_not_found": "Verification token not found",
-  "confirm_mfa_not_found.text": "We couldn't find your verification token. Please sign in again to continue.",
+  "confirm_mfa_not_found": "Verification failed",
+  "confirm_mfa_not_found.text": "We couldn't complete the second verification process. Please sign in again to continue.",
   "confirm_mfa_expired": "Verification step expired",
   "confirm_mfa_expired.text": "Your verification token has expired or is invalid. Please sign in again to continue.",
   "totp_verification_failed": "TOTP verification failed",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index b5dac56b5..2248a564e 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -46,17 +46,17 @@ importers:
         specifier: 8.1.0
         version: 8.1.0(zod@4.1.8)
       '@aws-sdk/client-s3':
-        specifier: ^3.894.0
-        version: 3.894.0
+        specifier: ^3.896.0
+        version: 3.896.0
       '@aws-sdk/cloudfront-signer':
         specifier: ^3.893.0
         version: 3.893.0
       '@aws-sdk/lib-storage':
-        specifier: ^3.894.0
-        version: 3.894.0(@aws-sdk/client-s3@3.894.0)
+        specifier: ^3.896.0
+        version: 3.896.0(@aws-sdk/client-s3@3.896.0)
       '@aws-sdk/s3-request-presigner':
-        specifier: ^3.894.0
-        version: 3.894.0
+        specifier: ^3.896.0
+        version: 3.896.0
       '@cellajs/permission-manager':
         specifier: ^0.1.0
         version: 0.1.0(@swc/core@1.7.26)(jiti@2.6.0)(postcss@8.5.6)(tsx@4.20.5)(yaml@2.8.1)
@@ -64,17 +64,17 @@ importers:
         specifier: ^1.3.8
         version: 1.3.8
       '@electric-sql/pglite':
-        specifier: ^0.3.9
-        version: 0.3.9
+        specifier: ^0.3.10
+        version: 0.3.10
       '@getbrevo/brevo':
         specifier: 2.5.0
         version: 2.5.0
       '@hono/node-server':
         specifier: ^1.19.4
-        version: 1.19.4(hono@4.9.7)
+        version: 1.19.4(hono@4.9.8)
       '@hono/zod-openapi':
-        specifier: 1.1.0
-        version: 1.1.0(hono@4.9.7)(zod@4.1.8)
+        specifier: 1.1.3
+        version: 1.1.3(hono@4.9.8)(zod@4.1.8)
       '@logtail/node':
         specifier: ^0.5.6
         version: 0.5.6
@@ -119,7 +119,7 @@ importers:
         version: 3.2.1
       '@scalar/hono-api-reference':
         specifier: ^0.9.19
-        version: 0.9.19(hono@4.9.7)
+        version: 0.9.19(hono@4.9.8)
       '@sendgrid/mail':
         specifier: ^8.1.6
         version: 8.1.6
@@ -143,22 +143,22 @@ importers:
         version: link:../config
       drizzle-orm:
         specifier: ^0.44.5
-        version: 0.44.5(@electric-sql/pglite@0.3.9)(@libsql/client-wasm@0.14.0)(@opentelemetry/api@1.9.0)(@types/pg@8.15.5)(gel@2.0.2)(pg@8.16.3)(postgres@3.4.7)
+        version: 0.44.5(@electric-sql/pglite@0.3.10)(@libsql/client-wasm@0.14.0)(@opentelemetry/api@1.9.0)(@types/pg@8.15.5)(gel@2.0.2)(pg@8.16.3)(postgres@3.4.7)
       drizzle-zod:
         specifier: 0.8.3
-        version: 0.8.3(drizzle-orm@0.44.5(@electric-sql/pglite@0.3.9)(@libsql/client-wasm@0.14.0)(@opentelemetry/api@1.9.0)(@types/pg@8.15.5)(gel@2.0.2)(pg@8.16.3)(postgres@3.4.7))(zod@4.1.8)
+        version: 0.8.3(drizzle-orm@0.44.5(@electric-sql/pglite@0.3.10)(@libsql/client-wasm@0.14.0)(@opentelemetry/api@1.9.0)(@types/pg@8.15.5)(gel@2.0.2)(pg@8.16.3)(postgres@3.4.7))(zod@4.1.8)
       enforce-unique:
         specifier: ^1.3.0
         version: 1.3.0
       hono:
-        specifier: 4.9.7
-        version: 4.9.7
+        specifier: 4.9.8
+        version: 4.9.8
       i18next:
         specifier: ^25.5.2
         version: 25.5.2(typescript@5.9.2)
       isbot:
-        specifier: ^5.1.30
-        version: 5.1.30
+        specifier: ^5.1.31
+        version: 5.1.31
       jsdom:
         specifier: ^26.1.0
         version: 26.1.0(canvas@3.2.0)
@@ -190,8 +190,8 @@ importers:
         specifier: ^15.1.3
         version: 15.1.3
       rate-limiter-flexible:
-        specifier: ^7.3.2
-        version: 7.3.2
+        specifier: ^7.4.0
+        version: 7.4.0
       react:
         specifier: ^19.1.1
         version: 19.1.1
@@ -468,8 +468,8 @@ importers:
         specifier: ^0.13.8
         version: 0.13.8(arktype@2.1.20)(typescript@5.9.2)(zod@4.1.8)
       '@tailwindcss/typography':
-        specifier: ^0.5.18
-        version: 0.5.18(tailwindcss@4.1.13)
+        specifier: ^0.5.19
+        version: 0.5.19(tailwindcss@4.1.13)
       '@tanstack/query-sync-storage-persister':
         specifier: 5.87.4
         version: 5.87.4
@@ -483,11 +483,11 @@ importers:
         specifier: 5.87.4
         version: 5.87.4(@tanstack/react-query@5.87.4(react@19.1.1))(react@19.1.1)
       '@tanstack/react-router':
-        specifier: 1.131.41
-        version: 1.131.41(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        specifier: 1.132.6
+        version: 1.132.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@tanstack/react-router-devtools':
-        specifier: 1.131.42
-        version: 1.131.42(@tanstack/react-router@1.131.41(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(@tanstack/router-core@1.131.50)(csstype@3.1.3)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(solid-js@1.9.9)(tiny-invariant@1.3.3)
+        specifier: 1.132.6
+        version: 1.132.6(@tanstack/react-router@1.132.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(@tanstack/router-core@1.132.6)(@types/node@24.5.2)(csstype@3.1.3)(jiti@2.6.0)(lightningcss@1.30.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.5)(yaml@2.8.1)
       '@uppy/audio':
         specifier: ^3.0.1
         version: 3.0.1(@uppy/core@5.0.2)
@@ -603,8 +603,8 @@ importers:
         specifier: ^0.542.0
         version: 0.542.0(react@19.1.1)
       motion:
-        specifier: ^12.23.18
-        version: 12.23.18(@emotion/is-prop-valid@1.3.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        specifier: ^12.23.22
+        version: 12.23.22(@emotion/is-prop-valid@1.3.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       nanoid:
         specifier: ^5.1.6
         version: 5.1.6
@@ -678,8 +678,11 @@ importers:
         specifier: ^1.1.2
         version: 1.1.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       virtua:
-        specifier: ^0.43.3
-        version: 0.43.3(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(solid-js@1.9.9)(vue@3.5.13(typescript@5.9.2))
+        specifier: ^0.43.4
+        version: 0.43.4(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(solid-js@1.9.9)(vue@3.5.13(typescript@5.9.2))
+      vitest:
+        specifier: ^3.2.4
+        version: 3.2.4(@types/debug@4.1.12)(@types/node@24.5.2)(@vitest/browser@3.2.4)(jiti@2.6.0)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
       workbox-window:
         specifier: ^7.3.0
         version: 7.3.0
@@ -695,10 +698,10 @@ importers:
     devDependencies:
       '@chromatic-com/storybook':
         specifier: ^4.1.1
-        version: 4.1.1(storybook@9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))
+        version: 4.1.1(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))
       '@hey-api/openapi-ts':
-        specifier: ^0.84.0
-        version: 0.84.0(magicast@0.3.5)(typescript@5.9.2)
+        specifier: ^0.84.3
+        version: 0.84.3(magicast@0.3.5)(typescript@5.9.2)
       '@react-scan/vite-plugin-react-scan':
         specifier: ^0.1.8
         version: 0.1.8(react-scan@0.4.3(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react-router-dom@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react-router@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react@19.1.1)(rollup@2.79.2))(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
@@ -709,26 +712,26 @@ importers:
         specifier: ^3.6.1
         version: 3.6.1
       '@storybook/addon-a11y':
-        specifier: ^9.1.7
-        version: 9.1.7(storybook@9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))
+        specifier: ^9.1.8
+        version: 9.1.8(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))
       '@storybook/addon-docs':
-        specifier: ^9.1.7
-        version: 9.1.7(@types/react@19.1.13)(storybook@9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))
+        specifier: ^9.1.8
+        version: 9.1.8(@types/react@19.1.13)(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))
       '@storybook/addon-vitest':
-        specifier: ^9.1.7
-        version: 9.1.7(@vitest/browser@3.2.4(playwright@1.55.0)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))(vitest@3.2.4))(@vitest/runner@3.2.4)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))(vitest@3.2.4(@types/debug@4.1.12)(@types/node@24.5.2)(@vitest/browser@3.2.4)(jiti@2.6.0)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+        specifier: ^9.1.8
+        version: 9.1.8(@vitest/browser@3.2.4)(@vitest/runner@3.2.4)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))(vitest@3.2.4)
       '@storybook/react-vite':
-        specifier: ^9.1.7
-        version: 9.1.7(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(rollup@2.79.2)(storybook@9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))(typescript@5.9.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+        specifier: ^9.1.8
+        version: 9.1.8(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(rollup@2.79.2)(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))(typescript@5.9.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
       '@tailwindcss/vite':
         specifier: ^4.1.13
         version: 4.1.13(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
       '@tanstack/router-core':
-        specifier: ^1.131.50
-        version: 1.131.50
+        specifier: ^1.132.6
+        version: 1.132.6
       '@tanstack/router-plugin':
-        specifier: ^1.131.50
-        version: 1.131.50(@tanstack/react-router@1.131.41(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+        specifier: ^1.132.6
+        version: 1.132.6(@tanstack/react-router@1.132.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
       '@types/canvas-confetti':
         specifier: ^1.9.0
         version: 1.9.0
@@ -755,10 +758,10 @@ importers:
         version: 5.0.3(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
       '@vitest/browser':
         specifier: ^3.2.4
-        version: 3.2.4(playwright@1.55.0)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))(vitest@3.2.4)
+        version: 3.2.4(playwright@1.55.1)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))(vitest@3.2.4)
       '@vitest/coverage-v8':
         specifier: ^3.2.4
-        version: 3.2.4(@vitest/browser@3.2.4(playwright@1.55.0)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))(vitest@3.2.4))(vitest@3.2.4(@types/debug@4.1.12)(@types/node@24.5.2)(@vitest/browser@3.2.4)(jiti@2.6.0)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+        version: 3.2.4(@vitest/browser@3.2.4)(vitest@3.2.4)
       babel-plugin-react-compiler:
         specifier: 19.1.0-rc.3
         version: 19.1.0-rc.3
@@ -766,11 +769,11 @@ importers:
         specifier: ^10.0.0
         version: 10.0.0
       hono:
-        specifier: 4.9.7
-        version: 4.9.7
+        specifier: 4.9.8
+        version: 4.9.8
       playwright:
-        specifier: ^1.55.0
-        version: 1.55.0
+        specifier: ^1.55.1
+        version: 1.55.1
       postgres:
         specifier: ^3.4.7
         version: 3.4.7
@@ -781,8 +784,8 @@ importers:
         specifier: ^6.0.3
         version: 6.0.3(rollup@2.79.2)
       storybook:
-        specifier: ^9.1.7
-        version: 9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+        specifier: ^9.1.8
+        version: 9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
       tsx:
         specifier: ^4.20.5
         version: 4.20.5
@@ -896,55 +899,55 @@ packages:
   '@aws-crypto/util@5.2.0':
     resolution: {integrity: sha512-4RkU9EsI6ZpBve5fseQlGNUWKMa1RLPQ1dnjnQoe07ldfIzcsGb5hC5W0Dm7u423KWzawlrpbjXBrXCEv9zazQ==}
 
-  '@aws-sdk/client-s3@3.894.0':
-    resolution: {integrity: sha512-SCNiNYm2lFVoRXU6QMSi3EpLDxqZ1g/ZaagyAZoFHHPWoLZAodHA4H20o/dAemGZTAoCNYsEZccPQ63i36zDHw==}
+  '@aws-sdk/client-s3@3.896.0':
+    resolution: {integrity: sha512-UETVuMLQRqgrWxTnavotY0TlB/jaR9sL3hkIFPx4KtjmigNBdwRaiVfOuTnIXKd+w9RPINYG//nnrK+5gIyZkA==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/client-sso@3.894.0':
-    resolution: {integrity: sha512-lsznYIOiaMtbJfxTlMbvc6d37a1D6OIYF/RgFu9ue765XtiAG2RUF4aoEKA9e448Bwv+078eE+ndNxH3fd0uEw==}
+  '@aws-sdk/client-sso@3.896.0':
+    resolution: {integrity: sha512-mpE3mrNili1dcvEvxaYjyoib8HlRXkb2bY5a3WeK++KObFY+HUujKtgQmiNSRX5YwQszm//fTrmGMmv9zpMcKg==}
     engines: {node: '>=18.0.0'}
 
   '@aws-sdk/cloudfront-signer@3.893.0':
     resolution: {integrity: sha512-SL2z8C9tRgZaqwJ1pbxQaBrUTb1DnFzqLEOJzYGrV9BWk5+LYm6KCK5XmBXzHICaKQL4YtigO7lNUU8SGEaw9Q==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/core@3.894.0':
-    resolution: {integrity: sha512-7zbO31NV2FaocmMtWOg/fuTk3PC2Ji2AC0Fi2KqrppEDIcwLlTTuT9w/rdu/93Pz+wyUhCxWnDc0tPbwtCLs+A==}
+  '@aws-sdk/core@3.896.0':
+    resolution: {integrity: sha512-uJaoyWKeGNyCyeI+cIJrD7LEB4iF/W8/x2ij7zg32OFpAAJx96N34/e+XSKp/xkJpO5FKiBOskKLnHeUsJsAPA==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/credential-provider-env@3.894.0':
-    resolution: {integrity: sha512-2aiQJIRWOuROPPISKgzQnH/HqSfucdk5z5VMemVH3Mm2EYOrzBwmmiiFpmSMN3ST+sE8c7gusqycUchP+KfALQ==}
+  '@aws-sdk/credential-provider-env@3.896.0':
+    resolution: {integrity: sha512-Cnqhupdkp825ICySrz4QTI64Nq3AmUAscPW8dueanni0avYBDp7RBppX4H0+6icqN569B983XNfQ0YSImQhfhg==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/credential-provider-http@3.894.0':
-    resolution: {integrity: sha512-Z5QQpqFRflszrT+lUq6+ORuu4jRDcpgCUSoTtlhczidMqfdOSckKmK3chZEfmUUJPSwoFQZ7EiVTsX3c886fBg==}
+  '@aws-sdk/credential-provider-http@3.896.0':
+    resolution: {integrity: sha512-CN0fTCKCUA1OTSx1c76o8XyJCy2WoI/av3J8r8mL6GmxTerhLRyzDy/MwxzPjTYPoL+GLEg6V4a9fRkWj1hBUA==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/credential-provider-ini@3.894.0':
-    resolution: {integrity: sha512-SpSR7ULrdBpOrqP7HtpBg1LtJiud+AKH+w8nXX9EjedbIVQgy5uNoGMxRt+fp3aa1D4TXooRPE183YpG6+zwLg==}
+  '@aws-sdk/credential-provider-ini@3.896.0':
+    resolution: {integrity: sha512-+rbYG98czzwZLTYHJasK+VBjnIeXk73mRpZXHvaa4kDNxBezdN2YsoGNpLlPSxPdbpq18LY3LRtkdFTaT6DIQA==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/credential-provider-node@3.894.0':
-    resolution: {integrity: sha512-B2QNQtZBYHCQLfxSyftGoW2gPtpM2ndhMfmKvIMrSuKUXz3v+p70FLsGRETeOu6kOHsobGlgK+TQCg08qGQfeQ==}
+  '@aws-sdk/credential-provider-node@3.896.0':
+    resolution: {integrity: sha512-J0Jm+56MNngk1PIyqoJFf5FC2fjA4CYXlqODqNRDtid7yk7HB9W3UTtvxofmii5KJOLcHGNPdGnHWKkUc+xYgw==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/credential-provider-process@3.894.0':
-    resolution: {integrity: sha512-VU74GNsj+SsO+pl4d+JimlQ7+AcderZaC6bFndQssQdFZ5NRad8yFNz5Xbec8CPJr+z/VAwHib6431F5nYF46g==}
+  '@aws-sdk/credential-provider-process@3.896.0':
+    resolution: {integrity: sha512-UfWVMQPZy7dus40c4LWxh5vQ+I51z0q4vf09Eqas5848e9DrGRG46GYIuc/gy+4CqEypjbg/XNMjnZfGLHxVnQ==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/credential-provider-sso@3.894.0':
-    resolution: {integrity: sha512-ZZ1jF8x70RObXbRAcUPMANqX0LhgxVCQBzAfy3tslOp3h6aTgB+WMdGpVVR91x00DbSJnswMMN+mgWkaw78fSQ==}
+  '@aws-sdk/credential-provider-sso@3.896.0':
+    resolution: {integrity: sha512-77Te8WrVdLABKlv7QyetXP6aYEX1UORiahLA1PXQb/p66aFBw18Xc6JiN/6zJ4RqdyV1Xr9rwYBwGYua93ANIA==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/credential-provider-web-identity@3.894.0':
-    resolution: {integrity: sha512-6IwlCueEwzu2RAzUWufb4ZPf+LxF30vSTB1aHy9RVNce8MTaBt5VZ0EPdicdnhL0xqGuYNERP5+WpS70K7D1dw==}
+  '@aws-sdk/credential-provider-web-identity@3.896.0':
+    resolution: {integrity: sha512-gwMwZWumo+V0xJplO8j2HIb1TfPsF9fbcRGXS0CanEvjg4fF2Xs1pOQl2oCw3biPZpxHB0plNZjqSF2eneGg9g==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/lib-storage@3.894.0':
-    resolution: {integrity: sha512-ZbMJGZR2DjsBuezKxvYolT5TMrCH5ye/bF1tx2kfZdYe2P4sIoAvPADhIwpKdMkk2i+QjBtoTuKiivA3f0+s1Q==}
+  '@aws-sdk/lib-storage@3.896.0':
+    resolution: {integrity: sha512-EJWXL/5LxBJFujsOud3+EfRbIwy/SZiWy5ld70RdoqLS/RsfZh9+mZMJGvd3hewy7xHgDYVbxZfDh14bsvfYIQ==}
     engines: {node: '>=18.0.0'}
     peerDependencies:
-      '@aws-sdk/client-s3': ^3.894.0
+      '@aws-sdk/client-s3': ^3.896.0
 
   '@aws-sdk/middleware-bucket-endpoint@3.893.0':
     resolution: {integrity: sha512-H+wMAoFC73T7M54OFIezdHXR9/lH8TZ3Cx1C3MEBb2ctlzQrVCd8LX8zmOtcGYC8plrRwV+8rNPe0FMqecLRew==}
@@ -954,8 +957,8 @@ packages:
     resolution: {integrity: sha512-PEZkvD6k0X9sacHkvkVF4t2QyQEAzd35OJ2bIrjWCfc862TwukMMJ1KErRmQ1WqKXHKF4L0ed5vtWaO/8jVLNA==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/middleware-flexible-checksums@3.894.0':
-    resolution: {integrity: sha512-Dcz3thFO+9ZvTXV+Q4v/2okfMY8sUCHHBqJMUf9BDEuSvV94JVXFXbu1rm6S/N1Rh0gMLoUVzrOk3W84BLGPsg==}
+  '@aws-sdk/middleware-flexible-checksums@3.896.0':
+    resolution: {integrity: sha512-bB3W/IFG7HNNziACOp1aZVGGnrIahXc0PxZoU055JirEGQtDFIU1ZD7S9zLKmy9FFUvQsAeRL9nDFHbx8cwx/w==}
     engines: {node: '>=18.0.0'}
 
   '@aws-sdk/middleware-host-header@3.893.0':
@@ -974,36 +977,36 @@ packages:
     resolution: {integrity: sha512-H7Zotd9zUHQAr/wr3bcWHULYhEeoQrF54artgsoUGIf/9emv6LzY89QUccKIxYd6oHKNTrTyXm9F0ZZrzXNxlg==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/middleware-sdk-s3@3.894.0':
-    resolution: {integrity: sha512-0C3lTVdTuv5CkJ4LulpA7FmGFSKrGUKxnFZ6+qGjYjNzbdiHXfq0TyEBiDmVqDkoV2k4AT2H/m0Xw//rTkcNEQ==}
+  '@aws-sdk/middleware-sdk-s3@3.896.0':
+    resolution: {integrity: sha512-hlPu/AZ5Afa4ZafP+aXIjRtKm7BX57lurA+TJ+7nXm1Az8Du3Sg2tZXP2/GfqTztLIFQYj/Jy5smkJ0+1HNAPQ==}
     engines: {node: '>=18.0.0'}
 
   '@aws-sdk/middleware-ssec@3.893.0':
     resolution: {integrity: sha512-e4ccCiAnczv9mMPheKjgKxZQN473mcup+3DPLVNnIw5GRbQoDqPSB70nUzfORKZvM7ar7xLMPxNR8qQgo1C8Rg==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/middleware-user-agent@3.894.0':
-    resolution: {integrity: sha512-+s1HRLDIuSMhOzVsxRKbatUjJib0w1AGxDfWNZWrSnM7Aq9U1cap0XgR9/zy7NhJ+I3Twrx6SCVfpjpZspoRTA==}
+  '@aws-sdk/middleware-user-agent@3.896.0':
+    resolution: {integrity: sha512-so/3tZH34YIeqG/QJgn5ZinnmHRdXV1ehsj4wVUrezL/dVW86jfwIkQIwpw8roOC657UoUf91c9FDhCxs3J5aQ==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/nested-clients@3.894.0':
-    resolution: {integrity: sha512-FEEIk43RLO7Oy2BHXfwbo4gjCec7pK7i5nnUT9GbJQh6JMcS0FqPJGF95lQa93quS3SgwdCpWbv01TH86i+41w==}
+  '@aws-sdk/nested-clients@3.896.0':
+    resolution: {integrity: sha512-KaHALB6DIXScJL/ExmonADr3jtTV6dpOHoEeTRSskJ/aW+rhZo7kH8SLmrwOT/qX8d5tza17YyR/oRkIKY6Eaw==}
     engines: {node: '>=18.0.0'}
 
   '@aws-sdk/region-config-resolver@3.893.0':
     resolution: {integrity: sha512-/cJvh3Zsa+Of0Zbg7vl9wp/kZtdb40yk/2+XcroAMVPO9hPvmS9r/UOm6tO7FeX4TtkRFwWaQJiTZTgSdsPY+Q==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/s3-request-presigner@3.894.0':
-    resolution: {integrity: sha512-Ut0kEo3zq88ZZE1QQf/RN1XWM+m7bTrD9S/MgTXJYw14zv8r/UnoAA/aiR33Eb1s8AqOwzWFPP8W9VJ81H90cw==}
+  '@aws-sdk/s3-request-presigner@3.896.0':
+    resolution: {integrity: sha512-pAlxvB1UmbgyfW8JyJy30FXfsfcWAbtR5gCO25mR5PPwuBQgzQR6lf/L4zbp+ZsSNhlKsvroe537oW5EXYk6Dw==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/signature-v4-multi-region@3.894.0':
-    resolution: {integrity: sha512-Te5b3fSbatkZrh3eYNmpOadZFKsCLNSwiolQKQeEeKHxdnqORwYXa+0ypcTHle6ukic+tFRRd9n3NuMVo9uiVg==}
+  '@aws-sdk/signature-v4-multi-region@3.896.0':
+    resolution: {integrity: sha512-txiQDEZXL9tlNP8mbnNaDtuHBYc/FCqaZ8Y76qnfM3o6CTIn0t0tTAlnx1CyFe4EaikVBgQuZvj5KfNA8PmlzA==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/token-providers@3.894.0':
-    resolution: {integrity: sha512-tOkrD6U3UrU5IJfbBl932RBi8EjFVFkU1hAjPgAWWBDy6uRQunpuh3i1z6dRQoelVT88BmEyEv1l/WpM5uZezg==}
+  '@aws-sdk/token-providers@3.896.0':
+    resolution: {integrity: sha512-WBoD+RY7tUfW9M+wGrZ2vdveR+ziZOjGHWFY3lcGnDvI8KE+fcSccEOTxgJBNBS5Z8B+WHKU2sZjb+Z7QqGwjw==}
     engines: {node: '>=18.0.0'}
 
   '@aws-sdk/types@3.893.0':
@@ -1014,8 +1017,8 @@ packages:
     resolution: {integrity: sha512-u8H4f2Zsi19DGnwj5FSZzDMhytYF/bCh37vAtBsn3cNDL3YG578X5oc+wSX54pM3tOxS+NY7tvOAo52SW7koUA==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/util-endpoints@3.893.0':
-    resolution: {integrity: sha512-xeMcL31jXHKyxRwB3oeNjs8YEpyvMnSYWr2OwLydgzgTr0G349AHlJHwYGCF9xiJ2C27kDxVvXV/Hpdp0p7TWw==}
+  '@aws-sdk/util-endpoints@3.895.0':
+    resolution: {integrity: sha512-MhxBvWbwxmKknuggO2NeMwOVkHOYL98pZ+1ZRI5YwckoCL3AvISMnPJgfN60ww6AIXHGpkp+HhpFdKOe8RHSEg==}
     engines: {node: '>=18.0.0'}
 
   '@aws-sdk/util-format-url@3.893.0':
@@ -1029,8 +1032,8 @@ packages:
   '@aws-sdk/util-user-agent-browser@3.893.0':
     resolution: {integrity: sha512-PE9NtbDBW6Kgl1bG6A5fF3EPo168tnkj8TgMcT0sg4xYBWsBpq0bpJZRh+Jm5Bkwiw9IgTCLjEU7mR6xWaMB9w==}
 
-  '@aws-sdk/util-user-agent-node@3.894.0':
-    resolution: {integrity: sha512-tmA3XtQA6nPGyJGl9+7Bbo/5UmUvqCiweC5fNmfTg/aLpT3YkiivOG36XhuJxXVBkX3jr5Sc+IsaANUlJmblEA==}
+  '@aws-sdk/util-user-agent-node@3.896.0':
+    resolution: {integrity: sha512-jegizucAwoxyBddKl0kRGNEgRHcfGuMeyhP1Nf+wIUmHz/9CxobIajqcVk/KRNLdZY5mSn7YG2VtP3z0BcBb0w==}
     engines: {node: '>=18.0.0'}
     peerDependencies:
       aws-crt: '>=1.0.0'
@@ -1734,8 +1737,8 @@ packages:
   '@electric-sql/client@1.0.10':
     resolution: {integrity: sha512-KcP6R2OGiruxbhAa0wMGiRIfpXDQQ8vznBmn34kG/UJ11sqA4NQBhoPhSsKkCPs5EKc2DoS6bcnqLkIHFdxmvg==}
 
-  '@electric-sql/pglite@0.3.9':
-    resolution: {integrity: sha512-7S0uzvxA2HqvK8uaDKr2T12C0fq2OMxVyM8eaoIZjtqBJDYURfjORa4aYwk/fOnLwx5d6b4n7n0mcpOzNGlLwg==}
+  '@electric-sql/pglite@0.3.10':
+    resolution: {integrity: sha512-1XtXXprd848aR4hvjNqBc3Gc86zNGmd60x+MgOUShbHYxt+J76N8A81DqTEl275T8xBD0vdTgqR/dJ4yJyz0NQ==}
 
   '@electric-sql/react@1.0.10':
     resolution: {integrity: sha512-MqzLXYH8Fk/8gHVH4Wi9/YJUOaz9xtMoXHyX1hEZ2ZHqgOb/OJECCWyGJ66L4+dfSVux1VL+CM89N/rFMMbXvA==}
@@ -2664,6 +2667,7 @@ packages:
 
   '@evilmartians/lefthook@1.13.3':
     resolution: {integrity: sha512-vYJcf3jZq7MfSlOZzkgnP5bfVMYRW7qETiiGZ/vDkZCzcGV9hLGSic882JSh2dyAX2azfvIW5Tbq/RSHL9i7mw==}
+    cpu: [x64, arm64, ia32]
     os: [darwin, linux, win32]
     hasBin: true
 
@@ -2743,8 +2747,8 @@ packages:
     resolution: {integrity: sha512-+5eg9pgAAM9oSqJQuUtfTKbLz8yieFKN91myyXiLnprqFj8ROfxUKJLr9DKq/hGKyybKT1WxFSetDqCFm80pCA==}
     engines: {node: '>= 16'}
 
-  '@hey-api/openapi-ts@0.84.0':
-    resolution: {integrity: sha512-LVt+lM+y5w5qupdNQFTd1oV5OD5vy9zDruCcJ4KyryY0QaRA/FOqrMZgZnioMCKUMoHMBCjBIb61E5+G2tS4qA==}
+  '@hey-api/openapi-ts@0.84.3':
+    resolution: {integrity: sha512-WFjGGBzmIzGRdHw+CC7g8TSzl4UjdWbNwiDO07a3BUEhSBZbLGidfh+E4SOGbePak6sWptVh9WqO3QrThFH25A==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=22.10.0}
     hasBin: true
     peerDependencies:
@@ -2765,8 +2769,8 @@ packages:
     peerDependencies:
       hono: ^4
 
-  '@hono/zod-openapi@1.1.0':
-    resolution: {integrity: sha512-S4jVR+A/jI4MA/RKJqmpjdHAN2l/EsqLnKHBv68x3WxV1NGVe3Sh7f6LV6rHEGYNHfiqpD75664A/erc+r9dQA==}
+  '@hono/zod-openapi@1.1.3':
+    resolution: {integrity: sha512-ikA8p0Jt7yplxOqbYwdh8rCQWaGN4bu8zK1HbCWqfWT9clo87L32D0eAQ/r0tJodtZbTV5d1vPB75FCkUt1Jdg==}
     engines: {node: '>=16.0.0'}
     peerDependencies:
       hono: '>=4.3.6'
@@ -4769,221 +4773,111 @@ packages:
       rollup:
         optional: true
 
-  '@rollup/rollup-android-arm-eabi@4.52.0':
-    resolution: {integrity: sha512-VxDYCDqOaR7NXzAtvRx7G1u54d2kEHopb28YH/pKzY6y0qmogP3gG7CSiWsq9WvDFxOQMpNEyjVAHZFXfH3o/A==}
-    cpu: [arm]
-    os: [android]
-
   '@rollup/rollup-android-arm-eabi@4.52.2':
     resolution: {integrity: sha512-o3pcKzJgSGt4d74lSZ+OCnHwkKBeAbFDmbEm5gg70eA8VkyCuC/zV9TwBnmw6VjDlRdF4Pshfb+WE9E6XY1PoQ==}
     cpu: [arm]
     os: [android]
 
-  '@rollup/rollup-android-arm64@4.52.0':
-    resolution: {integrity: sha512-pqDirm8koABIKvzL59YI9W9DWbRlTX7RWhN+auR8HXJxo89m4mjqbah7nJZjeKNTNYopqL+yGg+0mhCpf3xZtQ==}
-    cpu: [arm64]
-    os: [android]
-
   '@rollup/rollup-android-arm64@4.52.2':
     resolution: {integrity: sha512-cqFSWO5tX2vhC9hJTK8WAiPIm4Q8q/cU8j2HQA0L3E1uXvBYbOZMhE2oFL8n2pKB5sOCHY6bBuHaRwG7TkfJyw==}
     cpu: [arm64]
     os: [android]
 
-  '@rollup/rollup-darwin-arm64@4.52.0':
-    resolution: {integrity: sha512-YCdWlY/8ltN6H78HnMsRHYlPiKvqKagBP1r+D7SSylxX+HnsgXGCmLiV3Y4nSyY9hW8qr8U9LDUx/Lo7M6MfmQ==}
-    cpu: [arm64]
-    os: [darwin]
-
   '@rollup/rollup-darwin-arm64@4.52.2':
     resolution: {integrity: sha512-vngduywkkv8Fkh3wIZf5nFPXzWsNsVu1kvtLETWxTFf/5opZmflgVSeLgdHR56RQh71xhPhWoOkEBvbehwTlVA==}
     cpu: [arm64]
     os: [darwin]
 
-  '@rollup/rollup-darwin-x64@4.52.0':
-    resolution: {integrity: sha512-z4nw6y1j+OOSGzuVbSWdIp1IUks9qNw4dc7z7lWuWDKojY38VMWBlEN7F9jk5UXOkUcp97vA1N213DF+Lz8BRg==}
-    cpu: [x64]
-    os: [darwin]
-
   '@rollup/rollup-darwin-x64@4.52.2':
     resolution: {integrity: sha512-h11KikYrUCYTrDj6h939hhMNlqU2fo/X4NB0OZcys3fya49o1hmFaczAiJWVAFgrM1NCP6RrO7lQKeVYSKBPSQ==}
     cpu: [x64]
     os: [darwin]
 
-  '@rollup/rollup-freebsd-arm64@4.52.0':
-    resolution: {integrity: sha512-Q/dv9Yvyr5rKlK8WQJZVrp5g2SOYeZUs9u/t2f9cQ2E0gJjYB/BWoedXfUT0EcDJefi2zzVfhcOj8drWCzTviw==}
-    cpu: [arm64]
-    os: [freebsd]
-
   '@rollup/rollup-freebsd-arm64@4.52.2':
     resolution: {integrity: sha512-/eg4CI61ZUkLXxMHyVlmlGrSQZ34xqWlZNW43IAU4RmdzWEx0mQJ2mN/Cx4IHLVZFL6UBGAh+/GXhgvGb+nVxw==}
     cpu: [arm64]
     os: [freebsd]
 
-  '@rollup/rollup-freebsd-x64@4.52.0':
-    resolution: {integrity: sha512-kdBsLs4Uile/fbjZVvCRcKB4q64R+1mUq0Yd7oU1CMm1Av336ajIFqNFovByipciuUQjBCPMxwJhCgfG2re3rg==}
-    cpu: [x64]
-    os: [freebsd]
-
   '@rollup/rollup-freebsd-x64@4.52.2':
     resolution: {integrity: sha512-QOWgFH5X9+p+S1NAfOqc0z8qEpJIoUHf7OWjNUGOeW18Mx22lAUOiA9b6r2/vpzLdfxi/f+VWsYjUOMCcYh0Ng==}
     cpu: [x64]
     os: [freebsd]
 
-  '@rollup/rollup-linux-arm-gnueabihf@4.52.0':
-    resolution: {integrity: sha512-aL6hRwu0k7MTUESgkg7QHY6CoqPgr6gdQXRJI1/VbFlUMwsSzPGSR7sG5d+MCbYnJmJwThc2ol3nixj1fvI/zQ==}
-    cpu: [arm]
-    os: [linux]
-
   '@rollup/rollup-linux-arm-gnueabihf@4.52.2':
     resolution: {integrity: sha512-kDWSPafToDd8LcBYd1t5jw7bD5Ojcu12S3uT372e5HKPzQt532vW+rGFFOaiR0opxePyUkHrwz8iWYEyH1IIQA==}
     cpu: [arm]
     os: [linux]
 
-  '@rollup/rollup-linux-arm-musleabihf@4.52.0':
-    resolution: {integrity: sha512-BTs0M5s1EJejgIBJhCeiFo7GZZ2IXWkFGcyZhxX4+8usnIo5Mti57108vjXFIQmmJaRyDwmV59Tw64Ap1dkwMw==}
-    cpu: [arm]
-    os: [linux]
-
   '@rollup/rollup-linux-arm-musleabihf@4.52.2':
     resolution: {integrity: sha512-gKm7Mk9wCv6/rkzwCiUC4KnevYhlf8ztBrDRT9g/u//1fZLapSRc+eDZj2Eu2wpJ+0RzUKgtNijnVIB4ZxyL+w==}
     cpu: [arm]
     os: [linux]
 
-  '@rollup/rollup-linux-arm64-gnu@4.52.0':
-    resolution: {integrity: sha512-uj672IVOU9m08DBGvoPKPi/J8jlVgjh12C9GmjjBxCTQc3XtVmRkRKyeHSmIKQpvJ7fIm1EJieBUcnGSzDVFyw==}
-    cpu: [arm64]
-    os: [linux]
-
   '@rollup/rollup-linux-arm64-gnu@4.52.2':
     resolution: {integrity: sha512-66lA8vnj5mB/rtDNwPgrrKUOtCLVQypkyDa2gMfOefXK6rcZAxKLO9Fy3GkW8VkPnENv9hBkNOFfGLf6rNKGUg==}
     cpu: [arm64]
     os: [linux]
 
-  '@rollup/rollup-linux-arm64-musl@4.52.0':
-    resolution: {integrity: sha512-/+IVbeDMDCtB/HP/wiWsSzduD10SEGzIZX2945KSgZRNi4TSkjHqRJtNTVtVb8IRwhJ65ssI56krlLik+zFWkw==}
-    cpu: [arm64]
-    os: [linux]
-
   '@rollup/rollup-linux-arm64-musl@4.52.2':
     resolution: {integrity: sha512-s+OPucLNdJHvuZHuIz2WwncJ+SfWHFEmlC5nKMUgAelUeBUnlB4wt7rXWiyG4Zn07uY2Dd+SGyVa9oyLkVGOjA==}
     cpu: [arm64]
     os: [linux]
 
-  '@rollup/rollup-linux-loong64-gnu@4.52.0':
-    resolution: {integrity: sha512-U1vVzvSWtSMWKKrGoROPBXMh3Vwn93TA9V35PldokHGqiUbF6erSzox/5qrSMKp6SzakvyjcPiVF8yB1xKr9Pg==}
-    cpu: [loong64]
-    os: [linux]
-
   '@rollup/rollup-linux-loong64-gnu@4.52.2':
     resolution: {integrity: sha512-8wTRM3+gVMDLLDdaT6tKmOE3lJyRy9NpJUS/ZRWmLCmOPIJhVyXwjBo+XbrrwtV33Em1/eCTd5TuGJm4+DmYjw==}
     cpu: [loong64]
     os: [linux]
 
-  '@rollup/rollup-linux-ppc64-gnu@4.52.0':
-    resolution: {integrity: sha512-X/4WfuBAdQRH8cK3DYl8zC00XEE6aM472W+QCycpQJeLWVnHfkv7RyBFVaTqNUMsTgIX8ihMjCvFF9OUgeABzw==}
-    cpu: [ppc64]
-    os: [linux]
-
   '@rollup/rollup-linux-ppc64-gnu@4.52.2':
     resolution: {integrity: sha512-6yqEfgJ1anIeuP2P/zhtfBlDpXUb80t8DpbYwXQ3bQd95JMvUaqiX+fKqYqUwZXqdJDd8xdilNtsHM2N0cFm6A==}
     cpu: [ppc64]
     os: [linux]
 
-  '@rollup/rollup-linux-riscv64-gnu@4.52.0':
-    resolution: {integrity: sha512-xIRYc58HfWDBZoLmWfWXg2Sq8VCa2iJ32B7mqfWnkx5mekekl0tMe7FHpY8I72RXEcUkaWawRvl3qA55og+cwQ==}
-    cpu: [riscv64]
-    os: [linux]
-
   '@rollup/rollup-linux-riscv64-gnu@4.52.2':
     resolution: {integrity: sha512-sshYUiYVSEI2B6dp4jMncwxbrUqRdNApF2c3bhtLAU0qA8Lrri0p0NauOsTWh3yCCCDyBOjESHMExonp7Nzc0w==}
     cpu: [riscv64]
     os: [linux]
 
-  '@rollup/rollup-linux-riscv64-musl@4.52.0':
-    resolution: {integrity: sha512-mbsoUey05WJIOz8U1WzNdf+6UMYGwE3fZZnQqsM22FZ3wh1N887HT6jAOjXs6CNEK3Ntu2OBsyQDXfIjouI4dw==}
-    cpu: [riscv64]
-    os: [linux]
-
   '@rollup/rollup-linux-riscv64-musl@4.52.2':
     resolution: {integrity: sha512-duBLgd+3pqC4MMwBrKkFxaZerUxZcYApQVC5SdbF5/e/589GwVvlRUnyqMFbM8iUSb1BaoX/3fRL7hB9m2Pj8Q==}
     cpu: [riscv64]
     os: [linux]
 
-  '@rollup/rollup-linux-s390x-gnu@4.52.0':
-    resolution: {integrity: sha512-qP6aP970bucEi5KKKR4AuPFd8aTx9EF6BvutvYxmZuWLJHmnq4LvBfp0U+yFDMGwJ+AIJEH5sIP+SNypauMWzg==}
-    cpu: [s390x]
-    os: [linux]
-
   '@rollup/rollup-linux-s390x-gnu@4.52.2':
     resolution: {integrity: sha512-tzhYJJidDUVGMgVyE+PmxENPHlvvqm1KILjjZhB8/xHYqAGeizh3GBGf9u6WdJpZrz1aCpIIHG0LgJgH9rVjHQ==}
     cpu: [s390x]
     os: [linux]
 
-  '@rollup/rollup-linux-x64-gnu@4.52.0':
-    resolution: {integrity: sha512-nmSVN+F2i1yKZ7rJNKO3G7ZzmxJgoQBQZ/6c4MuS553Grmr7WqR7LLDcYG53Z2m9409z3JLt4sCOhLdbKQ3HmA==}
-    cpu: [x64]
-    os: [linux]
-
   '@rollup/rollup-linux-x64-gnu@4.52.2':
     resolution: {integrity: sha512-opH8GSUuVcCSSyHHcl5hELrmnk4waZoVpgn/4FDao9iyE4WpQhyWJ5ryl5M3ocp4qkRuHfyXnGqg8M9oKCEKRA==}
     cpu: [x64]
     os: [linux]
 
-  '@rollup/rollup-linux-x64-musl@4.52.0':
-    resolution: {integrity: sha512-2d0qRo33G6TfQVjaMR71P+yJVGODrt5V6+T0BDYH4EMfGgdC/2HWDVjSSFw888GSzAZUwuska3+zxNUCDco6rQ==}
-    cpu: [x64]
-    os: [linux]
-
   '@rollup/rollup-linux-x64-musl@4.52.2':
     resolution: {integrity: sha512-LSeBHnGli1pPKVJ79ZVJgeZWWZXkEe/5o8kcn23M8eMKCUANejchJbF/JqzM4RRjOJfNRhKJk8FuqL1GKjF5oQ==}
     cpu: [x64]
     os: [linux]
 
-  '@rollup/rollup-openharmony-arm64@4.52.0':
-    resolution: {integrity: sha512-A1JalX4MOaFAAyGgpO7XP5khquv/7xKzLIyLmhNrbiCxWpMlnsTYr8dnsWM7sEeotNmxvSOEL7F65j0HXFcFsw==}
-    cpu: [arm64]
-    os: [openharmony]
-
   '@rollup/rollup-openharmony-arm64@4.52.2':
     resolution: {integrity: sha512-uPj7MQ6/s+/GOpolavm6BPo+6CbhbKYyZHUDvZ/SmJM7pfDBgdGisFX3bY/CBDMg2ZO4utfhlApkSfZ92yXw7Q==}
     cpu: [arm64]
     os: [openharmony]
 
-  '@rollup/rollup-win32-arm64-msvc@4.52.0':
-    resolution: {integrity: sha512-YQugafP/rH0eOOHGjmNgDURrpYHrIX0yuojOI8bwCyXwxC9ZdTd3vYkmddPX0oHONLXu9Rb1dDmT0VNpjkzGGw==}
-    cpu: [arm64]
-    os: [win32]
-
   '@rollup/rollup-win32-arm64-msvc@4.52.2':
     resolution: {integrity: sha512-Z9MUCrSgIaUeeHAiNkm3cQyst2UhzjPraR3gYYfOjAuZI7tcFRTOD+4cHLPoS/3qinchth+V56vtqz1Tv+6KPA==}
     cpu: [arm64]
     os: [win32]
 
-  '@rollup/rollup-win32-ia32-msvc@4.52.0':
-    resolution: {integrity: sha512-zYdUYhi3Qe2fndujBqL5FjAFzvNeLxtIqfzNEVKD1I7C37/chv1VxhscWSQHTNfjPCrBFQMnynwA3kpZpZ8w4A==}
-    cpu: [ia32]
-    os: [win32]
-
   '@rollup/rollup-win32-ia32-msvc@4.52.2':
     resolution: {integrity: sha512-+GnYBmpjldD3XQd+HMejo+0gJGwYIOfFeoBQv32xF/RUIvccUz20/V6Otdv+57NE70D5pa8W/jVGDoGq0oON4A==}
     cpu: [ia32]
     os: [win32]
 
-  '@rollup/rollup-win32-x64-gnu@4.52.0':
-    resolution: {integrity: sha512-fGk03kQylNaCOQ96HDMeT7E2n91EqvCDd3RwvT5k+xNdFCeMGnj5b5hEgTGrQuyidqSsD3zJDQ21QIaxXqTBJw==}
-    cpu: [x64]
-    os: [win32]
-
   '@rollup/rollup-win32-x64-gnu@4.52.2':
     resolution: {integrity: sha512-ApXFKluSB6kDQkAqZOKXBjiaqdF1BlKi+/eqnYe9Ee7U2K3pUDKsIyr8EYm/QDHTJIM+4X+lI0gJc3TTRhd+dA==}
     cpu: [x64]
     os: [win32]
 
-  '@rollup/rollup-win32-x64-msvc@4.52.0':
-    resolution: {integrity: sha512-6iKDCVSIUQ8jPMoIV0OytRKniaYyy5EbY/RRydmLW8ZR3cEBhxbWl5ro0rkUNe0ef6sScvhbY79HrjRm8i3vDQ==}
-    cpu: [x64]
-    os: [win32]
-
   '@rollup/rollup-win32-x64-msvc@4.52.2':
     resolution: {integrity: sha512-ARz+Bs8kY6FtitYM96PqPEVvPXqEZmPZsSkXvyX19YzDqkCaIlhCieLLMI5hxO9SRZ2XtCtm8wxhy0iJ2jxNfw==}
     cpu: [x64]
@@ -5223,8 +5117,8 @@ packages:
     resolution: {integrity: sha512-IT6MatgBWagLybZl1xQcURXRICvqz1z3APSCAI9IqdvfCkrA7RaQIEfgC6G/KvfxnDfQUDqFV+ZlixcuFznGBQ==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/core@3.11.1':
-    resolution: {integrity: sha512-REH7crwORgdjSpYs15JBiIWOYjj0hJNC3aCecpJvAlMMaaqL5i2CLb1i6Hc4yevToTKSqslLMI9FKjhugEwALA==}
+  '@smithy/core@3.12.0':
+    resolution: {integrity: sha512-zJeAgogZfbwlPGL93y4Z/XNeIN37YCreRUd6YMIRvaq+6RnBK8PPYYIQ85Is/GglPh3kNImD5riDCXbVSDpCiQ==}
     engines: {node: '>=18.0.0'}
 
   '@smithy/credential-provider-imds@4.1.2':
@@ -5287,12 +5181,12 @@ packages:
     resolution: {integrity: sha512-9wlfBBgTsRvC2JxLJxv4xDGNBrZuio3AgSl0lSFX7fneW2cGskXTYpFxCdRYD2+5yzmsiTuaAJD1Wp7gWt9y9w==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/middleware-endpoint@4.2.3':
-    resolution: {integrity: sha512-+1H5A28DeffRVrqmVmtqtRraEjoaC6JVap3xEQdVoBh2EagCVY7noPmcBcG4y7mnr9AJitR1ZAse2l+tEtK5vg==}
+  '@smithy/middleware-endpoint@4.2.4':
+    resolution: {integrity: sha512-FZ4hzupOmthm8Q8ujYrd0I+/MHwVMuSTdkDtIQE0xVuvJt9pLT6Q+b0p4/t+slDyrpcf+Wj7SN+ZqT5OryaaZg==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/middleware-retry@4.2.4':
-    resolution: {integrity: sha512-amyqYQFewnAviX3yy/rI/n1HqAgfvUdkEhc04kDjxsngAUREKuOI24iwqQUirrj6GtodWmR4iO5Zeyl3/3BwWg==}
+  '@smithy/middleware-retry@4.3.0':
+    resolution: {integrity: sha512-qhEX9745fAxZvtLM4bQJAVC98elWjiMO2OiHl1s6p7hUzS4QfZO1gXUYNwEK8m0J6NoCD5W52ggWxbIDHI0XSg==}
     engines: {node: '>=18.0.0'}
 
   '@smithy/middleware-serde@4.1.1':
@@ -5339,8 +5233,8 @@ packages:
     resolution: {integrity: sha512-M9rZhWQLjlQVCCR37cSjHfhriGRN+FQ8UfgrYNufv66TJgk+acaggShl3KS5U/ssxivvZLlnj7QH2CUOKlxPyA==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/smithy-client@4.6.3':
-    resolution: {integrity: sha512-K27LqywsaqKz4jusdUQYJh/YP2VbnbdskZ42zG8xfV+eovbTtMc2/ZatLWCfSkW0PDsTUXlpvlaMyu8925HsOw==}
+  '@smithy/smithy-client@4.6.4':
+    resolution: {integrity: sha512-qL7O3VDyfzCSN9r+sdbQXGhaHtrfSJL30En6Jboj0I3bobf2g1/T0eP2L4qxqrEW26gWhJ4THI4ElVVLjYyBHg==}
     engines: {node: '>=18.0.0'}
 
   '@smithy/types@4.5.0':
@@ -5375,12 +5269,12 @@ packages:
     resolution: {integrity: sha512-swXz2vMjrP1ZusZWVTB/ai5gK+J8U0BWvP10v9fpcFvg+Xi/87LHvHfst2IgCs1i0v4qFZfGwCmeD/KNCdJZbQ==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/util-defaults-mode-browser@4.1.3':
-    resolution: {integrity: sha512-5fm3i2laE95uhY6n6O6uGFxI5SVbqo3/RWEuS3YsT0LVmSZk+0eUqPhKd4qk0KxBRPaT5VNT/WEBUqdMyYoRgg==}
+  '@smithy/util-defaults-mode-browser@4.1.4':
+    resolution: {integrity: sha512-mLDJ1s4eA3vwOGaQOEPlg5LB4LdZUUMpB5UMOMofeGhWqiS7WR7dTpLiNi9zVn+YziKUd3Af5NLfxDs7NJqmIw==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/util-defaults-mode-node@4.1.3':
-    resolution: {integrity: sha512-lwnMzlMslZ9GJNt+/wVjz6+fe9Wp5tqR1xAyQn+iywmP+Ymj0F6NhU/KfHM5jhGPQchRSCcau5weKhFdLIM4cA==}
+  '@smithy/util-defaults-mode-node@4.1.4':
+    resolution: {integrity: sha512-pjX2iMTcOASaSanAd7bu6i3fcMMezr3NTr8Rh64etB0uHRZi+Aw86DoCxPESjY4UTIuA06hhqtTtw95o//imYA==}
     engines: {node: '>=18.0.0'}
 
   '@smithy/util-endpoints@3.1.2':
@@ -5419,28 +5313,32 @@ packages:
     resolution: {integrity: sha512-PJBmyayrlfxM7nbqjomF4YcT1sApQwZio0NHSsT0EzhJqljRmvhzqZua43TyEs80nJk2Cn2FGPg/N8phH6KeCQ==}
     engines: {node: '>=18.0.0'}
 
+  '@smithy/uuid@1.0.0':
+    resolution: {integrity: sha512-OlA/yZHh0ekYFnbUkmYBDQPE6fGfdrvgz39ktp8Xf+FA6BfxLejPTMDOG0Nfk5/rDySAz1dRbFf24zaAFYVXlQ==}
+    engines: {node: '>=18.0.0'}
+
   '@standard-schema/spec@1.0.0':
     resolution: {integrity: sha512-m2bOd0f2RT9k8QJx1JN85cZYyH1RqFBdlwtkSlf4tBDYLCiiZnv1fIIwacK6cqwXavOydf0NPToMQgpKq+dVlA==}
 
   '@standard-schema/utils@0.3.0':
     resolution: {integrity: sha512-e7Mew686owMaPJVNNLs55PUvgz371nKgwsc4vxE49zsODpJEnxgxRo2y/OKrqueavXgZNMDVj3DdHFlaSAeU8g==}
 
-  '@storybook/addon-a11y@9.1.7':
-    resolution: {integrity: sha512-f7YXEnTcAGeEJBqhTgkd/GoKMEf+6m1ziBnpAaJLMWvfYxE2j4FwSMddXPfF+DxdS97/xYig6WckHb93HRIFkQ==}
+  '@storybook/addon-a11y@9.1.8':
+    resolution: {integrity: sha512-7I+Ll29aBwgAbpkNpK+BBJ+BmMCS7+Qe8fPh1n4701Hx7FB+laAx8UP+3kbmqCOwCvLU5JU5KJKgUMMGVE/Jww==}
     peerDependencies:
-      storybook: ^9.1.7
+      storybook: ^9.1.8
 
-  '@storybook/addon-docs@9.1.7':
-    resolution: {integrity: sha512-ZwD25QBWOeZS2T/JSHl6iqMx7w2yCxREnZIQaLpyOoGl2mRUk2NHcsGfdXQ4sL0zd7YT7CTfzH5tbwQfLIiEog==}
+  '@storybook/addon-docs@9.1.8':
+    resolution: {integrity: sha512-GVrNVEdNRRo6r1hawfgyy6x+HJqPx1oOHm0U0wz0SGAxgS/Xh6SQVZL+RDoh7NpXkNi1GbezVlT931UsHQTyvQ==}
     peerDependencies:
-      storybook: ^9.1.7
+      storybook: ^9.1.8
 
-  '@storybook/addon-vitest@9.1.7':
-    resolution: {integrity: sha512-LP+Tt0b/NyBCGATM+qHupNlX4Wm9d/LGDU0LPul29vPHpXnZ9Xd93mXEQ0ANnQNm5+zdTTUMFo5tlsgm0S19ZQ==}
+  '@storybook/addon-vitest@9.1.8':
+    resolution: {integrity: sha512-F1AgGpIuDxrGXErMRTfF9zUXvGSUgQPbAXggs74p9vz0855nlRMEny1cYY9BtktVr4JGyq+Mz2774hCt9HR3KQ==}
     peerDependencies:
       '@vitest/browser': ^3.0.0
       '@vitest/runner': ^3.0.0
-      storybook: ^9.1.7
+      storybook: ^9.1.8
       vitest: ^3.0.0
     peerDependenciesMeta:
       '@vitest/browser':
@@ -5450,16 +5348,16 @@ packages:
       vitest:
         optional: true
 
-  '@storybook/builder-vite@9.1.7':
-    resolution: {integrity: sha512-9nflIekC220TSKprN/dDW+tAZSxwkRaq0C6mc5UCgXKjgq4oXditpdwrAcoH0v91RC/bN7LW9Xu5IbvnLNiqLQ==}
+  '@storybook/builder-vite@9.1.8':
+    resolution: {integrity: sha512-JjvBag0nM1N51O3VF5++op9Ly5OC8Q+y4PrWLgi2dKhMxJFs8fD9D4PeI/v41PUiQcI0suQxN9BoYoKn2QxUZw==}
     peerDependencies:
-      storybook: ^9.1.7
+      storybook: ^9.1.8
       vite: ^5.0.0 || ^6.0.0 || ^7.0.0
 
-  '@storybook/csf-plugin@9.1.7':
-    resolution: {integrity: sha512-xrPKWt16hBXvyHliuIEzPLvHdRbEe5Oubk/NIPibFVG4cxhEmNxMeHo3uFua3wgtEXyp4UErRWteviNjYSzjUA==}
+  '@storybook/csf-plugin@9.1.8':
+    resolution: {integrity: sha512-KnrXPz87bn+8ZGkzFEBc7TT5HkWpR1Xz7ojxPclSvkKxTfzazuaw0JlOQMzJoI1+wHXDAIw/4MIsO8HEiaWyfQ==}
     peerDependencies:
-      storybook: ^9.1.7
+      storybook: ^9.1.8
 
   '@storybook/global@5.0.0':
     resolution: {integrity: sha512-FcOqPAXACP0I3oJ/ws6/rrPT9WGhu915Cg8D02a9YxLo0DE9zI+a9A5gRGvmQ09fiWPukqI8ZAEoQEdWUKMQdQ==}
@@ -5471,29 +5369,29 @@ packages:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0-beta
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0-beta
 
-  '@storybook/react-dom-shim@9.1.7':
-    resolution: {integrity: sha512-ktjCuZ42g3TAF6nMiSdLbJu/EcvC039hYrmVltKpfF7krf+0xHkK3dCuYqSBp5nv3fS+IemrqmzJwREu5BJLuQ==}
+  '@storybook/react-dom-shim@9.1.8':
+    resolution: {integrity: sha512-OepccjVZh/KQugTH8/RL2CIyf1g5Lwc5ESC8x8BH3iuYc82WMQBwMJzRI5EofQdirau63NGrqkWCgQASoVreEA==}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0-beta
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0-beta
-      storybook: ^9.1.7
+      storybook: ^9.1.8
 
-  '@storybook/react-vite@9.1.7':
-    resolution: {integrity: sha512-552jMY5eKnP/rWKpcEjyE4ppyGmO+r9IoYNIJQBWA4DpXAQ8NjhsygCFhdDPFGfCxx7+KmfRgOBPcXeywWNgtQ==}
+  '@storybook/react-vite@9.1.8':
+    resolution: {integrity: sha512-DIxp76vcelyFOUJupeQEIHXDrSPP6KDXj6Z+Z9thS1HH7JY+OdGtcMLy4fbiD77Zyc8TV9RRZ1D33z2Ot/v9Vw==}
     engines: {node: '>=20.0.0'}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0-beta
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0-beta
-      storybook: ^9.1.7
+      storybook: ^9.1.8
       vite: ^5.0.0 || ^6.0.0 || ^7.0.0
 
-  '@storybook/react@9.1.7':
-    resolution: {integrity: sha512-GxuA2Eh3LlkEF4HHDKFGP+bqQ1+7VtABVacSXukMu82WV4VAOXhhHEDII8R9AVl2Fbs/iPJnNVj06wnkDeUZhA==}
+  '@storybook/react@9.1.8':
+    resolution: {integrity: sha512-EULkwHroJ4IDYcjIBj9VpGhaZ9E5b8LI84hlfBkJ9rnK44a/GrK1yFRIusukO58qTJSh2Y7zfAFKNuiaWh3Sfw==}
     engines: {node: '>=20.0.0'}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0-beta
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0-beta
-      storybook: ^9.1.7
+      storybook: ^9.1.8
       typescript: '>= 4.9.x'
     peerDependenciesMeta:
       typescript:
@@ -5679,8 +5577,8 @@ packages:
     resolution: {integrity: sha512-CPgsM1IpGRa880sMbYmG1s4xhAy3xEt1QULgTJGQmZUeNgXFR7s1YxYygmJyBGtou4SyEosGAGEeYqY7R53bIA==}
     engines: {node: '>= 10'}
 
-  '@tailwindcss/typography@0.5.18':
-    resolution: {integrity: sha512-dDIgwZOlf+tVkZ7A029VvQ1+ngKATENDjMEx2N35s2yPjfTS05RWSM8ilhEWSa5DMJ6ci2Ha9WNZEd2GQjrdQg==}
+  '@tailwindcss/typography@0.5.19':
+    resolution: {integrity: sha512-w31dd8HOx3k9vPtcQh5QHP9GwKcgbMp87j58qi6xgiBnFFtKEAgCWnDw4qUT8aHwkCp8bKvb/KGKWWHedP0AAg==}
     peerDependencies:
       tailwindcss: '>=3.0.0 || insiders || >=4.0.0-alpha.20 || >=4.0.0-beta.1'
 
@@ -5689,8 +5587,8 @@ packages:
     peerDependencies:
       vite: ^5.2.0 || ^6 || ^7
 
-  '@tanstack/history@1.131.2':
-    resolution: {integrity: sha512-cs1WKawpXIe+vSTeiZUuSBy8JFjEuDgdMKZFRLKwQysKo8y2q6Q1HvS74Yw+m5IhOW1nTZooa6rlgdfXcgFAaw==}
+  '@tanstack/history@1.132.0':
+    resolution: {integrity: sha512-GG2R9I6QSlbNR9fEuX2sQCigY6K28w51h2634TWmkaHXlzQw+rWuIWr4nAGM9doA+kWRi1LFSFMvAiG3cOqjXQ==}
     engines: {node: '>=12'}
 
   '@tanstack/query-core@5.87.4':
@@ -5722,16 +5620,16 @@ packages:
     peerDependencies:
       react: ^18 || ^19
 
-  '@tanstack/react-router-devtools@1.131.42':
-    resolution: {integrity: sha512-7pymFB1CCimRHot2Zp0ZekQjd1iN812V88n9NLPSeiv9sVRtRVIaLphJjDeudx1NNgkfSJPx2lOhz6K38cuZog==}
+  '@tanstack/react-router-devtools@1.132.6':
+    resolution: {integrity: sha512-NwcStEA5ePPGvuogDONuQX5oDL+Wl3NI7N5HiI9rqcOSY5kF85DfaMrTBADS8r1CCY7NMjRrjULEfgR8Z1CrxA==}
     engines: {node: '>=12'}
     peerDependencies:
-      '@tanstack/react-router': ^1.131.41
+      '@tanstack/react-router': ^1.132.6
       react: '>=18.0.0 || >=19.0.0'
       react-dom: '>=18.0.0 || >=19.0.0'
 
-  '@tanstack/react-router@1.131.41':
-    resolution: {integrity: sha512-QEbTYpAosiD8e4qEZRr9aJipGSb8pQc+pfZwK6NCD2Tcxwu2oF6MVtwv0bIDLRpZP0VJMBpxXlTRISUDNMNqIA==}
+  '@tanstack/react-router@1.132.6':
+    resolution: {integrity: sha512-YfRHfEzOS2TtrP0+nQ98aUvqQBg6uNRZPzOT4X35lLOwmXJbK8dTzlZva5KhfT5wrkZfU5N8jSc0COB+ALwkLQ==}
     engines: {node: '>=12'}
     peerDependencies:
       react: '>=18.0.0 || >=19.0.0'
@@ -5743,19 +5641,15 @@ packages:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
 
-  '@tanstack/router-core@1.131.41':
-    resolution: {integrity: sha512-VoLly00DWM0abKuVPRm8wiwGtRBHOKs6K896fy48Q/KYoDVLs8kRCRjFGS7rGnYC2FIkmmvHqYRqNg7jgCx2yg==}
+  '@tanstack/router-core@1.132.6':
+    resolution: {integrity: sha512-K5DqCnCSaxRw1BN63aZaZCkTKsGTXkAikzlTBSMVeijLE+D5P1Q9+m7xfuhVkr1sa/0yNNeP5VBmw28AZhnoJA==}
     engines: {node: '>=12'}
 
-  '@tanstack/router-core@1.131.50':
-    resolution: {integrity: sha512-eojd4JZ5ziUhGEmXZ4CaVX5mQdiTMiz56Sp8ZQ6r7deb55Q+5G4JQDkeuXpI7HMAvzr+4qlsFeLaDRXXjXyOqQ==}
-    engines: {node: '>=12'}
-
-  '@tanstack/router-devtools-core@1.131.42':
-    resolution: {integrity: sha512-o8jKTiwXcUSjmkozcMjIw1yhjVYeXcuQO7DtfgjKW3B85iveH6VzYK+bGEVU7wmLNMuUSe2eI/7RBzJ6a5+MCA==}
+  '@tanstack/router-devtools-core@1.132.6':
+    resolution: {integrity: sha512-j1r97ox6cSMXX6Rh8I+ReFelGoRyrCE030/7auZpxO/hhVfQHcTeIhMwXh9/I54XIEx70SnG6UVEUKuP9AhT8g==}
     engines: {node: '>=12'}
     peerDependencies:
-      '@tanstack/router-core': ^1.131.41
+      '@tanstack/router-core': ^1.132.6
       csstype: ^3.0.10
       solid-js: '>=1.9.5'
       tiny-invariant: ^1.3.3
@@ -5763,18 +5657,18 @@ packages:
       csstype:
         optional: true
 
-  '@tanstack/router-generator@1.131.50':
-    resolution: {integrity: sha512-zlMBw5l88GIg3v+378JsfDYq3ejEaJmD3P1R+m0yEPxh0N//Id1FjKNSS7yJbejlK2WGVm9DUG46iBdTDMQM+Q==}
+  '@tanstack/router-generator@1.132.6':
+    resolution: {integrity: sha512-C09gIsljx72HpOzmjEZp+1YgAmD6DnOpr+UZcdIEgaLtc9hqCZ+JO2YJZuSxsMIRizjovCP+fmcKDSuVUgCwLA==}
     engines: {node: '>=12'}
 
-  '@tanstack/router-plugin@1.131.50':
-    resolution: {integrity: sha512-gdEBPGzx7llQNRnaqfPJ1iaPS3oqB8SlvKRG5l7Fxp4q4yINgkeowFYSKEhPOc9bjoNhGrIHOlvPTPXEzAQXzQ==}
+  '@tanstack/router-plugin@1.132.6':
+    resolution: {integrity: sha512-PmcMLBY0Y3Fnjo17O/BQm8IrMxJgli6DTT/0+7420+KbYXL8D30BG4xURj0gzYR0Kh7vHO6DK/c6r9NBPa+0zQ==}
     engines: {node: '>=12'}
     peerDependencies:
       '@rsbuild/core': '>=1.0.2'
-      '@tanstack/react-router': ^1.131.50
-      vite: '>=5.0.0 || >=6.0.0'
-      vite-plugin-solid: ^2.11.2
+      '@tanstack/react-router': ^1.132.6
+      vite: '>=5.0.0 || >=6.0.0 || >=7.0.0'
+      vite-plugin-solid: ^2.11.8
       webpack: '>=5.92.0'
     peerDependenciesMeta:
       '@rsbuild/core':
@@ -5788,15 +5682,15 @@ packages:
       webpack:
         optional: true
 
-  '@tanstack/router-utils@1.131.2':
-    resolution: {integrity: sha512-sr3x0d2sx9YIJoVth0QnfEcAcl+39sQYaNQxThtHmRpyeFYNyM2TTH+Ud3TNEnI3bbzmLYEUD+7YqB987GzhDA==}
+  '@tanstack/router-utils@1.132.0':
+    resolution: {integrity: sha512-WDnvAi9kO20joLDzlsTvfgXNv+FgQ4G98xAD8r4jKWoTdTTG05DU2sRYimtbdq4Q7E3uVdvyvPdhRy45wan7bw==}
     engines: {node: '>=12'}
 
   '@tanstack/store@0.7.7':
     resolution: {integrity: sha512-xa6pTan1bcaqYDS9BDpSiS63qa6EoDkPN9RsRaxHuDdVDNntzq3xNwR5YKTU/V3SkSyC9T4YVOPh2zRQN0nhIQ==}
 
-  '@tanstack/virtual-file-routes@1.131.2':
-    resolution: {integrity: sha512-VEEOxc4mvyu67O+Bl0APtYjwcNRcL9it9B4HKbNgcBTIOEalhk+ufBl4kiqc8WP1sx1+NAaiS+3CcJBhrqaSRg==}
+  '@tanstack/virtual-file-routes@1.132.0':
+    resolution: {integrity: sha512-d3do4ih9IdLPBVY4Gb8x7Ho7z0oFDLpxoao7uNVkfWtYU7nc3B+rnnVejXIgprmI5gt1hNzyNDJFr8G/W926GA==}
     engines: {node: '>=12'}
 
   '@testing-library/dom@10.4.1':
@@ -5813,97 +5707,97 @@ packages:
     peerDependencies:
       '@testing-library/dom': '>=7.21.4'
 
-  '@tiptap/core@2.26.1':
-    resolution: {integrity: sha512-fymyd/XZvYiHjBoLt1gxs024xP/LY26d43R1vluYq7AHBL/7DE3ywzy+1GEsGyAv5Je2L0KBhNIR/izbq3Kaqg==}
+  '@tiptap/core@2.26.2':
+    resolution: {integrity: sha512-cr30QWJECl5j7qUUG4Z4BDitHgJIBWipbC3JbjoDtumgZLedGa5SV+JiGa4GUhNt9E34Pw1BH0gBDL4adGHiLg==}
     peerDependencies:
       '@tiptap/pm': ^2.7.0
 
-  '@tiptap/extension-bold@2.26.1':
-    resolution: {integrity: sha512-zCce9PRuTNhadFir71luLo99HERDpGJ0EEflGm7RN8I1SnNi9gD5ooK42BOIQtejGCJqg3hTPZiYDJC2hXvckQ==}
+  '@tiptap/extension-bold@2.26.2':
+    resolution: {integrity: sha512-kNjbHZhLyDu2ZBZmJINzXg3MAW7+05KqGkcwxudC1X/DQM5V5FpW7u6TOlC+nf1I9wABgayxURyU8FsIaXDxqA==}
     peerDependencies:
       '@tiptap/core': ^2.7.0
 
-  '@tiptap/extension-bubble-menu@2.26.1':
-    resolution: {integrity: sha512-oHevUcZbTMFOTpdCEo4YEDe044MB4P1ZrWyML8CGe5tnnKdlI9BN03AXpI1mEEa5CA3H1/eEckXx8EiCgYwQ3Q==}
+  '@tiptap/extension-bubble-menu@2.26.2':
+    resolution: {integrity: sha512-kB7/bGTUnC7ZCBH/fkigpfId925nwGOn+Nq1hf199NYMu2ffWbKk75ckLwyqlETprQYzzHfViIqcwyxJzo04Sg==}
     peerDependencies:
       '@tiptap/core': ^2.7.0
       '@tiptap/pm': ^2.7.0
 
-  '@tiptap/extension-code@2.26.1':
-    resolution: {integrity: sha512-GU9deB1A/Tr4FMPu71CvlcjGKwRhGYz60wQ8m4aM+ELZcVIcZRa1ebR8bExRIEWnvRztQuyRiCQzw2N0xQJ1QQ==}
+  '@tiptap/extension-code@2.26.2':
+    resolution: {integrity: sha512-xnKJvzlAp75dheyaK5tLKAksHf9PtSr8a7OuPjf2IXS5K+QMtnwxx7KAHHijmecfWjLR0wyu9AvT/FWFfKi5LQ==}
     peerDependencies:
       '@tiptap/core': ^2.7.0
 
-  '@tiptap/extension-floating-menu@2.26.1':
-    resolution: {integrity: sha512-OJF+H6qhQogVTMedAGSWuoL1RPe3LZYXONuFCVyzHnvvMpK+BP1vm180E2zDNFnn/DVA+FOrzNGpZW7YjoFH1w==}
+  '@tiptap/extension-floating-menu@2.26.2':
+    resolution: {integrity: sha512-AILrhwKAGU4Z6GcjNXJAsN0LHlL26bE7VRrYIqUwDv44ImiQf5vu9jEnncBOeHWzMe8SgjrrJWGNNu+dceACpw==}
     peerDependencies:
       '@tiptap/core': ^2.7.0
       '@tiptap/pm': ^2.7.0
 
-  '@tiptap/extension-gapcursor@2.26.1':
-    resolution: {integrity: sha512-KOiMZc3PwJS3hR0nSq5d0TJi2jkNZkLZElcT6pCEnhRHzPH6dRMu9GM5Jj798ZRUy0T9UFcKJalFZaDxnmRnpg==}
+  '@tiptap/extension-gapcursor@2.26.2':
+    resolution: {integrity: sha512-a68mi8V0mh058UrBIk23f50K5JGVeRZnF6ViptIleAD/Ny1K6VLjGCz6k190de+Tb9tnQLPEwwwDcy+ZnvCmYQ==}
     peerDependencies:
       '@tiptap/core': ^2.7.0
       '@tiptap/pm': ^2.7.0
 
-  '@tiptap/extension-history@2.26.1':
-    resolution: {integrity: sha512-m6YR1gkkauIDo3PRl0gP+7Oc4n5OqDzcjVh6LvWREmZP8nmi94hfseYbqOXUb6RPHIc0JKF02eiRifT4MSd2nw==}
+  '@tiptap/extension-history@2.26.2':
+    resolution: {integrity: sha512-X/cu79AV5D2Z1QtuvKo/4/Rgl/Uti/n5V3QgCxFLQRCKTxHOCis+RlBCjBfOPztJX4T9QUE6lq20KqB47rsNwQ==}
     peerDependencies:
       '@tiptap/core': ^2.7.0
       '@tiptap/pm': ^2.7.0
 
-  '@tiptap/extension-horizontal-rule@2.26.1':
-    resolution: {integrity: sha512-mT6baqOhs/NakgrAeDeed194E/ZJFGL692H0C7f1N7WDRaWxUu2oR0LrnRqSH5OyPjELkzu6nQnNy0+0tFGHHg==}
+  '@tiptap/extension-horizontal-rule@2.26.2':
+    resolution: {integrity: sha512-whlUskFUwmi7nXn4OT55xHXSAqwEAEQfZWswmae1Y5wTMDxavZ0FF4xvCVgsQ7gYG782tIgLCzriTN4AjBphIQ==}
     peerDependencies:
       '@tiptap/core': ^2.7.0
       '@tiptap/pm': ^2.7.0
 
-  '@tiptap/extension-italic@2.26.1':
-    resolution: {integrity: sha512-pOs6oU4LyGO89IrYE4jbE8ZYsPwMMIiKkYfXcfeD9NtpGNBnjeVXXF5I9ndY2ANrCAgC8k58C3/powDRf0T2yA==}
+  '@tiptap/extension-italic@2.26.2':
+    resolution: {integrity: sha512-/4AiE2JWtjY9yW+MifMP8EOOwOSDKDUxCyqtGT6e4xqqFUNLZJA0o4P/MYjcKVwsa1/IsDRsOaFRlAiMmAXVXw==}
     peerDependencies:
       '@tiptap/core': ^2.7.0
 
-  '@tiptap/extension-link@2.26.1':
-    resolution: {integrity: sha512-7yfum5Jymkue/uOSTQPt2SmkZIdZx7t3QhZLqBU7R9ettkdSCBgEGok6N+scJM1R1Zes+maSckLm0JZw5BKYNA==}
+  '@tiptap/extension-link@2.26.2':
+    resolution: {integrity: sha512-rzYxx5wI1551ubPfW2pJ3V957cX/WAmbUI3q8Un+LlOsSmbddl+5BjlF5t/vl/pwaOv7FJAz9e29n877zkGOVQ==}
     peerDependencies:
       '@tiptap/core': ^2.7.0
       '@tiptap/pm': ^2.7.0
 
-  '@tiptap/extension-paragraph@2.26.1':
-    resolution: {integrity: sha512-UezvM9VDRAVJlX1tykgHWSD1g3MKfVMWWZ+Tg+PE4+kizOwoYkRWznVPgCAxjmyHajxpCKRXgqTZkOxjJ9Kjzg==}
+  '@tiptap/extension-paragraph@2.26.2':
+    resolution: {integrity: sha512-dccyffm95nNT9arjxGOyv4/cOPF4XS5Osylccp9KYLrmiSTXEuzVIYtMXhXbc0UUdABGvbFQWi88tRxgeDTkgA==}
     peerDependencies:
       '@tiptap/core': ^2.7.0
 
-  '@tiptap/extension-strike@2.26.1':
-    resolution: {integrity: sha512-CkoRH+pAi6MgdCh7K0cVZl4N2uR4pZdabXAnFSoLZRSg6imLvEUmWHfSi1dl3Z7JOvd3a4yZ4NxerQn5MWbJ7g==}
+  '@tiptap/extension-strike@2.26.2':
+    resolution: {integrity: sha512-gY8/P8ycvICiZsa9OeTpOnSL0o+PAYH1QpBomaBhdZZ2tcsziMYN9BZto6uQARi9tdxeOYRePyZ+Junk4xsyFg==}
     peerDependencies:
       '@tiptap/core': ^2.7.0
 
-  '@tiptap/extension-table-cell@2.26.1':
-    resolution: {integrity: sha512-0P5zY+WGFnULggJkX6+CevmFoBmVv1aUiBBXfcFuLG2mnUsS3QALQTowFtz/0/VbtbjzcOSStaGDHRJxPbk9XQ==}
+  '@tiptap/extension-table-cell@2.26.2':
+    resolution: {integrity: sha512-A2XThaJBVQvR/nKyUfHwyoSuz/NtwWYDjnGjYtN/+fFCEWx++33HjvtxmCCpGrw5xuE783L4I9cr5Pcrepgy3A==}
     peerDependencies:
       '@tiptap/core': ^2.7.0
 
-  '@tiptap/extension-table-header@2.26.1':
-    resolution: {integrity: sha512-SAwTW9H+sjVYjoeU5z8pVDMHn3r3FCi+zp2KAxsEsmujcd7qrQdY0cAjQtWjckCq6H3sQkbICa+xlCCd7C8ZAQ==}
+  '@tiptap/extension-table-header@2.26.2':
+    resolution: {integrity: sha512-ppiL8aOQuBqy8GjMuVmIWu187rvNwxANCoAE+iGRDTK0y6c27HA+f6Y9n55T9PYqzDs5Z03gIBGhNIyw1lfc5A==}
     peerDependencies:
       '@tiptap/core': ^2.7.0
 
-  '@tiptap/extension-text@2.26.1':
-    resolution: {integrity: sha512-p2n8WVMd/2vckdJlol24acaTDIZAhI7qle5cM75bn01sOEZoFlSw6SwINOULrUCzNJsYb43qrLEibZb4j2LeQw==}
+  '@tiptap/extension-text@2.26.2':
+    resolution: {integrity: sha512-Rb8Le/Li+EixQNc/pGkEJpLjozTjWYP9glaYfnjPtRVw4tHcd7khVm5mer0TQjonbBUjVC1zSuXv9gifXOv6DQ==}
     peerDependencies:
       '@tiptap/core': ^2.7.0
 
-  '@tiptap/extension-underline@2.26.1':
-    resolution: {integrity: sha512-/fufv41WDMdf0a4xmFAxONoAz08TonJXX6NEoSJmuGKO59M/Y0Pz8DTK1g32Wk44kn7dyScDiPlvvndl+UOv0A==}
+  '@tiptap/extension-underline@2.26.2':
+    resolution: {integrity: sha512-kpKJSfsn1+b8l96YPg2GRn3aaN78pLqSeyzfA5FYVbN0lyptbqRVOrNM8p3n6l0LbAkiEjc/TgOMwNNEL93kyA==}
     peerDependencies:
       '@tiptap/core': ^2.7.0
 
-  '@tiptap/pm@2.26.1':
-    resolution: {integrity: sha512-8aF+mY/vSHbGFqyG663ds84b+vca5Lge3tHdTMTKazxCnhXR9dn2oQJMnZ78YZvdRbkPkMJJHti9h3K7u2UQvw==}
+  '@tiptap/pm@2.26.2':
+    resolution: {integrity: sha512-H2kJHckC9idlYPu/PNdu5XR3Rdu7gbNb+Qrdt2gBnaDyHgAcs+14wak6x19vy27GV9FFzg9722Eb7LErooo28w==}
 
-  '@tiptap/react@2.26.1':
-    resolution: {integrity: sha512-Zxlwzi1iML7aELa+PyysFD2ncVo2mEcjTkhoDok9iTbMGpm1oU8hgR1i6iHrcSNQLfaRiW6M7HNhZZQPKIC9yw==}
+  '@tiptap/react@2.26.2':
+    resolution: {integrity: sha512-p7jv0sltCC2L4iHIVNthtjv/CIxajOalb7ytjLx6ijx5q2J564VIny0U7O33Ymbo2cV0dJoB+Bo5aeaJ5SfHGg==}
     peerDependencies:
       '@tiptap/core': ^2.7.0
       '@tiptap/pm': ^2.7.0
@@ -6109,9 +6003,6 @@ packages:
   '@types/use-sync-external-store@0.0.6':
     resolution: {integrity: sha512-zFDAD+tlpf2r4asuHEj0XH6pY6i0g5NeAHPn+15wk3BV6JA69eERFXC1gyGThDkVa1zCyKr5jox1+2LbV/AMLg==}
 
-  '@types/uuid@9.0.8':
-    resolution: {integrity: sha512-jg+97EGIcY9AGHJJRaaPVgetKDsrTgbRjQ5Msgjh/DQKEFl0DtyRr/VCOyD1T2R1MNeWPK/u7JoGhlDZnKBAfA==}
-
   '@types/wrap-ansi@3.0.0':
     resolution: {integrity: sha512-ltIpx+kM7g/MLRZfkbL7EsCEjfzCcScLpkg37eXEtx5kmrAKBkTJwd1GIAjDSL8wTpM6Hzn5YO4pSb91BEwu1g==}
 
@@ -6673,8 +6564,8 @@ packages:
   base64-js@1.5.1:
     resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==}
 
-  baseline-browser-mapping@2.8.6:
-    resolution: {integrity: sha512-wrH5NNqren/QMtKUEEJf7z86YjfqW/2uw3IL3/xpqZUC95SSVIFXYQeeGjL6FT/X68IROu6RMehZQS5foy2BXw==}
+  baseline-browser-mapping@2.8.7:
+    resolution: {integrity: sha512-bxxN2M3a4d1CRoQC//IqsR5XrLh0IJ8TCv2x6Y9N0nckNz/rTjZB3//GGscZziZOxmjP55rzxg/ze7usFI9FqQ==}
     hasBin: true
 
   bcp-47-match@2.0.3:
@@ -6786,8 +6677,8 @@ packages:
     resolution: {integrity: sha512-QOSvevhslijgYwRx6Rv7zKdMF8lbRmx+uQGx2+vDc+KI/eBnsy9kit5aj23AgGu3pa4t9AgwbnXWqS+iOY+2aA==}
     engines: {node: '>= 6'}
 
-  caniuse-lite@1.0.30001743:
-    resolution: {integrity: sha512-e6Ojr7RV14Un7dz6ASD0aZDmQPT/A+eZU+nuTNfjqmRrmkmQlnTNWH0SKmqagx9PeW87UVqapSurtAXifmtdmw==}
+  caniuse-lite@1.0.30001745:
+    resolution: {integrity: sha512-ywt6i8FzvdgrrrGbr1jZVObnVv6adj+0if2/omv9cmR2oiZs30zL4DIyaptKcbOrBdOIc74QTMoJvSE2QHh5UQ==}
 
   canvas-confetti@1.9.3:
     resolution: {integrity: sha512-rFfTURMvmVEX1gyXFgn5QMn81bYk70qa0HLzcIOSVEyl57n6o9ItHeBtUSWdvKAPY0xlvBHno4/v3QPrT83q9g==}
@@ -7009,8 +6900,8 @@ packages:
   convert-source-map@2.0.0:
     resolution: {integrity: sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==}
 
-  cookie-es@1.2.2:
-    resolution: {integrity: sha512-+W7VmiVINB+ywl1HGXJXmrqkOhpKrIiVZV6tQuV54ZyQC7MMuBt81Vc336GMLoHBq5hV/F9eXgt5Mnx0Rha5Fg==}
+  cookie-es@2.0.0:
+    resolution: {integrity: sha512-RAj4E421UYRgqokKUmotqAwuplYw15qtdXfY+hGzgCJ/MBjCVZcSoHK/kH9kocfjRjcDME7IiDWR/1WX1TM2Pg==}
 
   cookie@1.0.2:
     resolution: {integrity: sha512-9Kr/j4O16ISv8zBBhJoi4bXOYNTkFLOqSL3UDB0njXxCXNezjeyVrJyGOWtgfs/q2km1gwBcfH8q1yEGoMYunA==}
@@ -7243,8 +7134,8 @@ packages:
     engines: {node: '>=0.10'}
     hasBin: true
 
-  detect-libc@2.1.0:
-    resolution: {integrity: sha512-vEtk+OcP7VBRtQZ1EJ3bdgzSfBjgnEalLTp5zjJrS+2Z1w2KZly4SBdac/WDU3hhsNAZ9E8SC96ME4Ey8MZ7cg==}
+  detect-libc@2.1.1:
+    resolution: {integrity: sha512-ecqj/sy1jcK1uWrwpR67UhYrIFQ+5WlGxth34WquCbamhFA6hkkwiu37o6J5xCHdo1oixJRfVRw+ywV+Hq/0Aw==}
     engines: {node: '>=8'}
 
   detect-node-es@1.1.0:
@@ -7459,8 +7350,8 @@ packages:
     engines: {node: '>=0.10.0'}
     hasBin: true
 
-  electron-to-chromium@1.5.222:
-    resolution: {integrity: sha512-gA7psSwSwQRE60CEoLz6JBCQPIxNeuzB2nL8vE03GK/OHxlvykbLyeiumQy1iH5C2f3YbRAZpGCMT12a/9ih9w==}
+  electron-to-chromium@1.5.223:
+    resolution: {integrity: sha512-qKm55ic6nbEmagFlTFczML33rF90aU+WtrJ9MdTCThrcvDNdUHN4p6QfVN78U06ZmguqXIyMPyYhw2TrbDUwPQ==}
 
   embla-carousel-autoplay@8.6.0:
     resolution: {integrity: sha512-OBu5G3nwaSXkZCo1A6LTaFMZ8EpkYbwIaH+bPqdBnDGQ2fh4+NbzjXjs2SktoPNKCtflfVMc75njaDHOYXcrsA==}
@@ -7828,8 +7719,8 @@ packages:
       react-dom:
         optional: true
 
-  framer-motion@12.23.18:
-    resolution: {integrity: sha512-HBVXBL5x3nk/0WrYM5G4VgjBey99ytVYET5AX17s/pcnlH90cyaxVUqgoN8cpF4+PqZRVOhwWsv28F+hxA9Tzg==}
+  framer-motion@12.23.22:
+    resolution: {integrity: sha512-ZgGvdxXCw55ZYvhoZChTlG6pUuehecgvEAJz0BHoC5pQKW1EC5xf1Mul1ej5+ai+pVY0pylyFfdl45qnM1/GsA==}
     peerDependencies:
       '@emotion/is-prop-valid': '*'
       react: ^18.0.0 || ^19.0.0
@@ -8117,8 +8008,8 @@ packages:
   hoist-non-react-statics@3.3.2:
     resolution: {integrity: sha512-/gGivxi8JPKWNm/W0jSmzcMPpfpPLc3dY/6GxhX2hQ9iGj3aDfklV4ET7NjKpSinLpJ5vafa9iiGIEZg10SfBw==}
 
-  hono@4.9.7:
-    resolution: {integrity: sha512-t4Te6ERzIaC48W3x4hJmBwgNlLhmiEdEE5ViYb02ffw4ignHNHa5IBtPjmbKstmtKa8X6C35iWwK4HaqvrzG9w==}
+  hono@4.9.8:
+    resolution: {integrity: sha512-JW8Bb4RFWD9iOKxg5PbUarBYGM99IcxFl2FPBo2gSJO11jjUDqlP1Bmfyqt8Z/dGhIQ63PMA9LdcLefXyIasyg==}
     engines: {node: '>=16.9.0'}
 
   html-encoding-sniffer@4.0.0:
@@ -8223,8 +8114,8 @@ packages:
     resolution: {integrity: sha512-TR3KfrTZTYLPB6jUjfx6MF9WcWrHL9su5TObK4ZkYgBdWKPOFoSoQIdEuTuR82pmtxH2spWG9h6etwfr1pLBqQ==}
     engines: {node: '>=6'}
 
-  import-in-the-middle@1.14.2:
-    resolution: {integrity: sha512-5tCuY9BV8ujfOpwtAGgsTx9CGUapcFMEEyByLv1B+v2+6DhAcw+Zr0nhQT7uwaZ7DiourxFEscghOR8e1aPLQw==}
+  import-in-the-middle@1.14.4:
+    resolution: {integrity: sha512-eWjxh735SJLFJJDs5X82JQ2405OdJeAHDBnaoFCfdr5GVc7AWc9xU7KbrF+3Xd5F2ccP1aQFKtY+65X6EfKZ7A==}
 
   imurmurhash@0.1.4:
     resolution: {integrity: sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==}
@@ -8452,8 +8343,8 @@ packages:
   isarray@2.0.5:
     resolution: {integrity: sha512-xHjhDr3cNBK0BzdUJSPXZntQUx/mwMS5Rw4A7lPJ90XGAO6ISP/ePDNuo0vhqOZU+UD5JoodwCAAoZQd3FeAKw==}
 
-  isbot@5.1.30:
-    resolution: {integrity: sha512-3wVJEonAns1OETX83uWsk5IAne2S5zfDcntD2hbtU23LelSqNXzXs9zKjMPOLMzroCgIjCfjYAEHrd2D6FOkiA==}
+  isbot@5.1.31:
+    resolution: {integrity: sha512-DPgQshehErHAqSCKDb3rNW03pa2wS/v5evvUqtxt6TTnHRqAG8FdzcSSJs9656pK6Y+NT7K9R4acEYXLHYfpUQ==}
     engines: {node: '>=18'}
 
   isexe@2.0.0:
@@ -8547,11 +8438,6 @@ packages:
       canvas:
         optional: true
 
-  jsesc@3.0.2:
-    resolution: {integrity: sha512-xKqzzWXDttJuOcawBt4KnKHHIf5oQ/Cxax+0PWFG+DFDgHNAdi+TXECADI+RYiFUMmx8792xsMbbgXj4CwnP4g==}
-    engines: {node: '>=6'}
-    hasBin: true
-
   jsesc@3.1.0:
     resolution: {integrity: sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==}
     engines: {node: '>=6'}
@@ -9129,14 +9015,14 @@ packages:
   module-details-from-path@1.0.4:
     resolution: {integrity: sha512-EGWKgxALGMgzvxYF1UyGTy0HXX/2vHLkw6+NvDKW2jypWbHpjQuj4UMcqQWXHERJhVGKikolT06G3bcKe4fi7w==}
 
-  motion-dom@12.23.18:
-    resolution: {integrity: sha512-9piw3uOcP6DpS0qpnDF95bLDzmgMxLOg/jghLnHwYJ0YFizzuvbH/L8106dy39JNgHYmXFUTztoP9JQvUqlBwQ==}
+  motion-dom@12.23.21:
+    resolution: {integrity: sha512-5xDXx/AbhrfgsQmSE7YESMn4Dpo6x5/DTZ4Iyy4xqDvVHWvFVoV+V2Ri2S/ksx+D40wrZ7gPYiMWshkdoqNgNQ==}
 
   motion-utils@12.23.6:
     resolution: {integrity: sha512-eAWoPgr4eFEOFfg2WjIsMoqJTW6Z8MTUCgn/GZ3VRpClWBdnbjryiA3ZSNLyxCTmCQx4RmYX6jX1iWHbenUPNQ==}
 
-  motion@12.23.18:
-    resolution: {integrity: sha512-uzcEs9eInMnOL2Tm8z6Akje/vETSFUzAlGQyKV58+8vlEFDOKx8jNR/asKei4ETi+8wH6vTyf6gCKgu580x4+w==}
+  motion@12.23.22:
+    resolution: {integrity: sha512-iSq6X9vLHbeYwmHvhK//+U74ROaPnZmBuy60XZzqNl0QtZkWfoZyMDHYnpKuWFv0sNMqHgED8aCXk94LCoQPGg==}
     peerDependencies:
       '@emotion/is-prop-valid': '*'
       react: ^18.0.0 || ^19.0.0
@@ -9533,13 +9419,13 @@ packages:
   player.style@0.2.0:
     resolution: {integrity: sha512-Ngoaz49TClptMr8HDA2IFmjT3Iq6R27QEUH/C+On33L59RSF3dCLefBYB1Au2RDZQJ6oVFpc1sXaPVpp7fEzzA==}
 
-  playwright-core@1.55.0:
-    resolution: {integrity: sha512-GvZs4vU3U5ro2nZpeiwyb0zuFaqb9sUiAJuyrWpcGouD8y9/HLgGbNRjIph7zU9D3hnPaisMl9zG9CgFi/biIg==}
+  playwright-core@1.55.1:
+    resolution: {integrity: sha512-Z6Mh9mkwX+zxSlHqdr5AOcJnfp+xUWLCt9uKV18fhzA8eyxUd8NUWzAjxUh55RZKSYwDGX0cfaySdhZJGMoJ+w==}
     engines: {node: '>=18'}
     hasBin: true
 
-  playwright@1.55.0:
-    resolution: {integrity: sha512-sdCWStblvV1YU909Xqx0DhOjPZE4/5lJsIS84IfN9dAZfcl/CIZ5O8l3o0j7hPMjDvqoTF8ZUcc+i/GL5erstA==}
+  playwright@1.55.1:
+    resolution: {integrity: sha512-cJW4Xd/G3v5ovXtJJ52MAOclqeac9S/aGGgRzLabuF8TnIb6xHvMzKIa6JmrRzUkeXJgfL1MhukP0NK6l39h3A==}
     engines: {node: '>=18'}
     hasBin: true
 
@@ -9834,8 +9720,8 @@ packages:
   randombytes@2.1.0:
     resolution: {integrity: sha512-vYl3iOX+4CKUWuxGi9Ukhie6fsqXqS9FE2Zaic4tNFD2N2QQaXOMFbuKK4QmDHC0JO6B1Zp41J0LpT0oR68amQ==}
 
-  rate-limiter-flexible@7.3.2:
-    resolution: {integrity: sha512-lOnbiJAzlK5IGKPnCg8u5zJ+NQu3aCXZ+yCOG0p3tK/1Wjm0aqx9+pj0X1pV0ehipjmwVV1B0C9kW+xmfCkE3Q==}
+  rate-limiter-flexible@7.4.0:
+    resolution: {integrity: sha512-IJopePGO6HnMWVdeLCihnxXZ0WCW0mxXiU5LE3bZ00GHESsCaAvgD8hN/ATIJeZhnrVdU5cfRyS1uV63Vmc4zg==}
 
   rc9@2.1.2:
     resolution: {integrity: sha512-btXCnMmRIBINM2LDZoEmOogIZU7Qe7zn4BpomSKZ/ykbLObuBdvG+mFq11DL6fjH1DRwHhrlgtYWG96bJiC7Cg==}
@@ -10118,15 +10004,15 @@ packages:
     resolution: {integrity: sha512-dYqgNSZbDwkaJ2ceRd9ojCGjBq+mOm9LmtXnAnEGyHhN/5R7iDW2TRw3h+o/jCFxus3P2LfWIIiwowAjANm7IA==}
     engines: {node: '>= 0.4'}
 
-  regexpu-core@6.3.1:
-    resolution: {integrity: sha512-DzcswPr252wEr7Qz8AyAVbfyBDKLoYp6eRA1We2Fa9qirRFSdtkP5sHr3yglDKy2BbA0fd2T+j/CUSKes3FeVQ==}
+  regexpu-core@6.4.0:
+    resolution: {integrity: sha512-0ghuzq67LI9bLXpOX/ISfve/Mq33a4aFRzoQYhnnok1JOFpmE/A2TBGkNVenOGEeSBCjIiWcc6MVOG5HEQv0sA==}
     engines: {node: '>=4'}
 
   regjsgen@0.8.0:
     resolution: {integrity: sha512-RvwtGe3d7LvWiDQXeQw8p5asZUmfU1G/l6WbUXeHta7Y2PEIvBTwH6E2EfmYUK8pxcxEdEmaomqyp0vZZ7C+3Q==}
 
-  regjsparser@0.12.0:
-    resolution: {integrity: sha512-cnE+y8bz4NhMjISKbgeVJtqNbtf5QpjZP+Bslo+UqkIt9QPnX9q095eiRRASJG1/tz6dlNr6Z5NsBiWYokp6EQ==}
+  regjsparser@0.13.0:
+    resolution: {integrity: sha512-NZQZdC5wOE/H3UT28fVGL+ikOZcEzfMGk/c3iN9UGxzWHMa1op7274oyiUVrAG4B2EuFhus8SvkaYnhvW92p9Q==}
     hasBin: true
 
   rehype-format@5.0.1:
@@ -10297,11 +10183,6 @@ packages:
     engines: {node: '>=10.0.0'}
     hasBin: true
 
-  rollup@4.52.0:
-    resolution: {integrity: sha512-+IuescNkTJQgX7AkIDtITipZdIGcWF0pnVvZTWStiazUmcGA2ag8dfg0urest2XlXUi9kuhfQ+qmdc5Stc3z7g==}
-    engines: {node: '>=18.0.0', npm: '>=8.0.0'}
-    hasBin: true
-
   rollup@4.52.2:
     resolution: {integrity: sha512-I25/2QgoROE1vYV+NQ1En9T9UFB9Cmfm2CJ83zZOlaDpvz29wGQSZXWKw7MiNXau7wYgB/T9fVIdIuEQ+KbiiA==}
     engines: {node: '>=18.0.0', npm: '>=8.0.0'}
@@ -10548,8 +10429,8 @@ packages:
     resolution: {integrity: sha512-eLoXW/DHyl62zxY4SCaIgnRhuMr6ri4juEYARS8E6sCEqzKpOiE521Ucofdx+KnDZl5xmvGYaaKCk5FEOxJCoQ==}
     engines: {node: '>= 0.4'}
 
-  storybook@9.1.7:
-    resolution: {integrity: sha512-X8YSQMNuqV9DklQLZH6mLKpDn15Z5tuUUTAIYsiGqx5BwsjtXnv5K04fXgl3jqTZyUauzV/ii8KdT04NVLtMwQ==}
+  storybook@9.1.8:
+    resolution: {integrity: sha512-/iP+DvieJ6Mnixy4PFY/KXnhsg/IHIDlTbZqly3EDbveuhsCuIUELfGnj+QSRGf9C6v/f4sZf9sZ3r80ZnKuEA==}
     hasBin: true
     peerDependencies:
       prettier: ^2 || ^3
@@ -10709,8 +10590,8 @@ packages:
     resolution: {integrity: sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==}
     engines: {node: '>=10'}
 
-  tar@7.4.4:
-    resolution: {integrity: sha512-O1z7ajPkjTgEgmTGz0v9X4eqeEXTDREPTO77pVC1Nbs86feBU1Zhdg+edzavPmYW1olxkwsqA2v4uOw6E8LeDg==}
+  tar@7.5.1:
+    resolution: {integrity: sha512-nlGpxf+hv0v7GkWBK2V9spgactGOp0qvfWRxUMjqHyzrt3SgwE48DIv/FhqPHJYLHpgW1opq3nERbz5Anq7n1g==}
     engines: {node: '>=18'}
 
   tdigest@0.1.2:
@@ -11128,10 +11009,6 @@ packages:
     resolution: {integrity: sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==}
     hasBin: true
 
-  uuid@9.0.1:
-    resolution: {integrity: sha512-b+1eJOlsR9K8HJpow9Ok3fiWOWSIcIzXodvv0rQjVoOVNpWMpxf1wZNpt4y9h10odCNrqnYp1OBzRktckBe3sA==}
-    hasBin: true
-
   v8-compile-cache-lib@3.0.1:
     resolution: {integrity: sha512-wa7YjyUGfNZngI/vtK0UHAN+lgDCxBPCylVXGp0zu59Fz5aiGtNXaq3DhIov063MorB+VfufLh3JlF2KdTK3xg==}
 
@@ -11169,8 +11046,8 @@ packages:
   victory-vendor@37.3.6:
     resolution: {integrity: sha512-SbPDPdDBYp+5MJHhBCAyI7wKM3d5ivekigc2Dk2s7pgbZ9wIgIBYGVw4zGHBml/qTFbexrofXW6Gu4noGxrOwQ==}
 
-  virtua@0.43.3:
-    resolution: {integrity: sha512-KA4iLdc1ISLgeqWEdT++Y8zeRQxWMOsF0pMG8gXPGorfCC7xdVZS9R4/kRCkyrk9z52VoQBBOEAL48vrPnKSuw==}
+  virtua@0.43.4:
+    resolution: {integrity: sha512-zS9A2EC3KY9hRjG5NM7t0gPGqkcdOc7HWhuc9KDvKq3yz10sRup5L09axFyWHePr1ppWljpAHtr0BCCsM6tS5Q==}
     peerDependencies:
       react: '>=16.14.0'
       react-dom: '>=16.14.0'
@@ -11740,32 +11617,32 @@ snapshots:
       '@smithy/util-utf8': 2.3.0
       tslib: 2.8.1
 
-  '@aws-sdk/client-s3@3.894.0':
+  '@aws-sdk/client-s3@3.896.0':
     dependencies:
       '@aws-crypto/sha1-browser': 5.2.0
       '@aws-crypto/sha256-browser': 5.2.0
       '@aws-crypto/sha256-js': 5.2.0
-      '@aws-sdk/core': 3.894.0
-      '@aws-sdk/credential-provider-node': 3.894.0
+      '@aws-sdk/core': 3.896.0
+      '@aws-sdk/credential-provider-node': 3.896.0
       '@aws-sdk/middleware-bucket-endpoint': 3.893.0
       '@aws-sdk/middleware-expect-continue': 3.893.0
-      '@aws-sdk/middleware-flexible-checksums': 3.894.0
+      '@aws-sdk/middleware-flexible-checksums': 3.896.0
       '@aws-sdk/middleware-host-header': 3.893.0
       '@aws-sdk/middleware-location-constraint': 3.893.0
       '@aws-sdk/middleware-logger': 3.893.0
       '@aws-sdk/middleware-recursion-detection': 3.893.0
-      '@aws-sdk/middleware-sdk-s3': 3.894.0
+      '@aws-sdk/middleware-sdk-s3': 3.896.0
       '@aws-sdk/middleware-ssec': 3.893.0
-      '@aws-sdk/middleware-user-agent': 3.894.0
+      '@aws-sdk/middleware-user-agent': 3.896.0
       '@aws-sdk/region-config-resolver': 3.893.0
-      '@aws-sdk/signature-v4-multi-region': 3.894.0
+      '@aws-sdk/signature-v4-multi-region': 3.896.0
       '@aws-sdk/types': 3.893.0
-      '@aws-sdk/util-endpoints': 3.893.0
+      '@aws-sdk/util-endpoints': 3.895.0
       '@aws-sdk/util-user-agent-browser': 3.893.0
-      '@aws-sdk/util-user-agent-node': 3.894.0
+      '@aws-sdk/util-user-agent-node': 3.896.0
       '@aws-sdk/xml-builder': 3.894.0
       '@smithy/config-resolver': 4.2.2
-      '@smithy/core': 3.11.1
+      '@smithy/core': 3.12.0
       '@smithy/eventstream-serde-browser': 4.1.1
       '@smithy/eventstream-serde-config-resolver': 4.2.1
       '@smithy/eventstream-serde-node': 4.1.1
@@ -11776,68 +11653,67 @@ snapshots:
       '@smithy/invalid-dependency': 4.1.1
       '@smithy/md5-js': 4.1.1
       '@smithy/middleware-content-length': 4.1.1
-      '@smithy/middleware-endpoint': 4.2.3
-      '@smithy/middleware-retry': 4.2.4
+      '@smithy/middleware-endpoint': 4.2.4
+      '@smithy/middleware-retry': 4.3.0
       '@smithy/middleware-serde': 4.1.1
       '@smithy/middleware-stack': 4.1.1
       '@smithy/node-config-provider': 4.2.2
       '@smithy/node-http-handler': 4.2.1
       '@smithy/protocol-http': 5.2.1
-      '@smithy/smithy-client': 4.6.3
+      '@smithy/smithy-client': 4.6.4
       '@smithy/types': 4.5.0
       '@smithy/url-parser': 4.1.1
       '@smithy/util-base64': 4.1.0
       '@smithy/util-body-length-browser': 4.1.0
       '@smithy/util-body-length-node': 4.1.0
-      '@smithy/util-defaults-mode-browser': 4.1.3
-      '@smithy/util-defaults-mode-node': 4.1.3
+      '@smithy/util-defaults-mode-browser': 4.1.4
+      '@smithy/util-defaults-mode-node': 4.1.4
       '@smithy/util-endpoints': 3.1.2
       '@smithy/util-middleware': 4.1.1
       '@smithy/util-retry': 4.1.2
       '@smithy/util-stream': 4.3.2
       '@smithy/util-utf8': 4.1.0
       '@smithy/util-waiter': 4.1.1
-      '@types/uuid': 9.0.8
+      '@smithy/uuid': 1.0.0
       tslib: 2.8.1
-      uuid: 9.0.1
     transitivePeerDependencies:
       - aws-crt
 
-  '@aws-sdk/client-sso@3.894.0':
+  '@aws-sdk/client-sso@3.896.0':
     dependencies:
       '@aws-crypto/sha256-browser': 5.2.0
       '@aws-crypto/sha256-js': 5.2.0
-      '@aws-sdk/core': 3.894.0
+      '@aws-sdk/core': 3.896.0
       '@aws-sdk/middleware-host-header': 3.893.0
       '@aws-sdk/middleware-logger': 3.893.0
       '@aws-sdk/middleware-recursion-detection': 3.893.0
-      '@aws-sdk/middleware-user-agent': 3.894.0
+      '@aws-sdk/middleware-user-agent': 3.896.0
       '@aws-sdk/region-config-resolver': 3.893.0
       '@aws-sdk/types': 3.893.0
-      '@aws-sdk/util-endpoints': 3.893.0
+      '@aws-sdk/util-endpoints': 3.895.0
       '@aws-sdk/util-user-agent-browser': 3.893.0
-      '@aws-sdk/util-user-agent-node': 3.894.0
+      '@aws-sdk/util-user-agent-node': 3.896.0
       '@smithy/config-resolver': 4.2.2
-      '@smithy/core': 3.11.1
+      '@smithy/core': 3.12.0
       '@smithy/fetch-http-handler': 5.2.1
       '@smithy/hash-node': 4.1.1
       '@smithy/invalid-dependency': 4.1.1
       '@smithy/middleware-content-length': 4.1.1
-      '@smithy/middleware-endpoint': 4.2.3
-      '@smithy/middleware-retry': 4.2.4
+      '@smithy/middleware-endpoint': 4.2.4
+      '@smithy/middleware-retry': 4.3.0
       '@smithy/middleware-serde': 4.1.1
       '@smithy/middleware-stack': 4.1.1
       '@smithy/node-config-provider': 4.2.2
       '@smithy/node-http-handler': 4.2.1
       '@smithy/protocol-http': 5.2.1
-      '@smithy/smithy-client': 4.6.3
+      '@smithy/smithy-client': 4.6.4
       '@smithy/types': 4.5.0
       '@smithy/url-parser': 4.1.1
       '@smithy/util-base64': 4.1.0
       '@smithy/util-body-length-browser': 4.1.0
       '@smithy/util-body-length-node': 4.1.0
-      '@smithy/util-defaults-mode-browser': 4.1.3
-      '@smithy/util-defaults-mode-node': 4.1.3
+      '@smithy/util-defaults-mode-browser': 4.1.4
+      '@smithy/util-defaults-mode-node': 4.1.4
       '@smithy/util-endpoints': 3.1.2
       '@smithy/util-middleware': 4.1.1
       '@smithy/util-retry': 4.1.2
@@ -11851,53 +11727,52 @@ snapshots:
       '@smithy/url-parser': 4.1.1
       tslib: 2.8.1
 
-  '@aws-sdk/core@3.894.0':
+  '@aws-sdk/core@3.896.0':
     dependencies:
       '@aws-sdk/types': 3.893.0
       '@aws-sdk/xml-builder': 3.894.0
-      '@smithy/core': 3.11.1
+      '@smithy/core': 3.12.0
       '@smithy/node-config-provider': 4.2.2
       '@smithy/property-provider': 4.1.1
       '@smithy/protocol-http': 5.2.1
       '@smithy/signature-v4': 5.2.1
-      '@smithy/smithy-client': 4.6.3
+      '@smithy/smithy-client': 4.6.4
       '@smithy/types': 4.5.0
       '@smithy/util-base64': 4.1.0
-      '@smithy/util-body-length-browser': 4.1.0
       '@smithy/util-middleware': 4.1.1
       '@smithy/util-utf8': 4.1.0
       tslib: 2.8.1
 
-  '@aws-sdk/credential-provider-env@3.894.0':
+  '@aws-sdk/credential-provider-env@3.896.0':
     dependencies:
-      '@aws-sdk/core': 3.894.0
+      '@aws-sdk/core': 3.896.0
       '@aws-sdk/types': 3.893.0
       '@smithy/property-provider': 4.1.1
       '@smithy/types': 4.5.0
       tslib: 2.8.1
 
-  '@aws-sdk/credential-provider-http@3.894.0':
+  '@aws-sdk/credential-provider-http@3.896.0':
     dependencies:
-      '@aws-sdk/core': 3.894.0
+      '@aws-sdk/core': 3.896.0
       '@aws-sdk/types': 3.893.0
       '@smithy/fetch-http-handler': 5.2.1
       '@smithy/node-http-handler': 4.2.1
       '@smithy/property-provider': 4.1.1
       '@smithy/protocol-http': 5.2.1
-      '@smithy/smithy-client': 4.6.3
+      '@smithy/smithy-client': 4.6.4
       '@smithy/types': 4.5.0
       '@smithy/util-stream': 4.3.2
       tslib: 2.8.1
 
-  '@aws-sdk/credential-provider-ini@3.894.0':
+  '@aws-sdk/credential-provider-ini@3.896.0':
     dependencies:
-      '@aws-sdk/core': 3.894.0
-      '@aws-sdk/credential-provider-env': 3.894.0
-      '@aws-sdk/credential-provider-http': 3.894.0
-      '@aws-sdk/credential-provider-process': 3.894.0
-      '@aws-sdk/credential-provider-sso': 3.894.0
-      '@aws-sdk/credential-provider-web-identity': 3.894.0
-      '@aws-sdk/nested-clients': 3.894.0
+      '@aws-sdk/core': 3.896.0
+      '@aws-sdk/credential-provider-env': 3.896.0
+      '@aws-sdk/credential-provider-http': 3.896.0
+      '@aws-sdk/credential-provider-process': 3.896.0
+      '@aws-sdk/credential-provider-sso': 3.896.0
+      '@aws-sdk/credential-provider-web-identity': 3.896.0
+      '@aws-sdk/nested-clients': 3.896.0
       '@aws-sdk/types': 3.893.0
       '@smithy/credential-provider-imds': 4.1.2
       '@smithy/property-provider': 4.1.1
@@ -11907,14 +11782,14 @@ snapshots:
     transitivePeerDependencies:
       - aws-crt
 
-  '@aws-sdk/credential-provider-node@3.894.0':
+  '@aws-sdk/credential-provider-node@3.896.0':
     dependencies:
-      '@aws-sdk/credential-provider-env': 3.894.0
-      '@aws-sdk/credential-provider-http': 3.894.0
-      '@aws-sdk/credential-provider-ini': 3.894.0
-      '@aws-sdk/credential-provider-process': 3.894.0
-      '@aws-sdk/credential-provider-sso': 3.894.0
-      '@aws-sdk/credential-provider-web-identity': 3.894.0
+      '@aws-sdk/credential-provider-env': 3.896.0
+      '@aws-sdk/credential-provider-http': 3.896.0
+      '@aws-sdk/credential-provider-ini': 3.896.0
+      '@aws-sdk/credential-provider-process': 3.896.0
+      '@aws-sdk/credential-provider-sso': 3.896.0
+      '@aws-sdk/credential-provider-web-identity': 3.896.0
       '@aws-sdk/types': 3.893.0
       '@smithy/credential-provider-imds': 4.1.2
       '@smithy/property-provider': 4.1.1
@@ -11924,20 +11799,20 @@ snapshots:
     transitivePeerDependencies:
       - aws-crt
 
-  '@aws-sdk/credential-provider-process@3.894.0':
+  '@aws-sdk/credential-provider-process@3.896.0':
     dependencies:
-      '@aws-sdk/core': 3.894.0
+      '@aws-sdk/core': 3.896.0
       '@aws-sdk/types': 3.893.0
       '@smithy/property-provider': 4.1.1
       '@smithy/shared-ini-file-loader': 4.2.0
       '@smithy/types': 4.5.0
       tslib: 2.8.1
 
-  '@aws-sdk/credential-provider-sso@3.894.0':
+  '@aws-sdk/credential-provider-sso@3.896.0':
     dependencies:
-      '@aws-sdk/client-sso': 3.894.0
-      '@aws-sdk/core': 3.894.0
-      '@aws-sdk/token-providers': 3.894.0
+      '@aws-sdk/client-sso': 3.896.0
+      '@aws-sdk/core': 3.896.0
+      '@aws-sdk/token-providers': 3.896.0
       '@aws-sdk/types': 3.893.0
       '@smithy/property-provider': 4.1.1
       '@smithy/shared-ini-file-loader': 4.2.0
@@ -11946,10 +11821,10 @@ snapshots:
     transitivePeerDependencies:
       - aws-crt
 
-  '@aws-sdk/credential-provider-web-identity@3.894.0':
+  '@aws-sdk/credential-provider-web-identity@3.896.0':
     dependencies:
-      '@aws-sdk/core': 3.894.0
-      '@aws-sdk/nested-clients': 3.894.0
+      '@aws-sdk/core': 3.896.0
+      '@aws-sdk/nested-clients': 3.896.0
       '@aws-sdk/types': 3.893.0
       '@smithy/property-provider': 4.1.1
       '@smithy/shared-ini-file-loader': 4.2.0
@@ -11958,12 +11833,12 @@ snapshots:
     transitivePeerDependencies:
       - aws-crt
 
-  '@aws-sdk/lib-storage@3.894.0(@aws-sdk/client-s3@3.894.0)':
+  '@aws-sdk/lib-storage@3.896.0(@aws-sdk/client-s3@3.896.0)':
     dependencies:
-      '@aws-sdk/client-s3': 3.894.0
+      '@aws-sdk/client-s3': 3.896.0
       '@smithy/abort-controller': 4.1.1
-      '@smithy/middleware-endpoint': 4.2.3
-      '@smithy/smithy-client': 4.6.3
+      '@smithy/middleware-endpoint': 4.2.4
+      '@smithy/smithy-client': 4.6.4
       buffer: 5.6.0
       events: 3.3.0
       stream-browserify: 3.0.0
@@ -11986,12 +11861,12 @@ snapshots:
       '@smithy/types': 4.5.0
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-flexible-checksums@3.894.0':
+  '@aws-sdk/middleware-flexible-checksums@3.896.0':
     dependencies:
       '@aws-crypto/crc32': 5.2.0
       '@aws-crypto/crc32c': 5.2.0
       '@aws-crypto/util': 5.2.0
-      '@aws-sdk/core': 3.894.0
+      '@aws-sdk/core': 3.896.0
       '@aws-sdk/types': 3.893.0
       '@smithy/is-array-buffer': 4.1.0
       '@smithy/node-config-provider': 4.2.2
@@ -12029,16 +11904,16 @@ snapshots:
       '@smithy/types': 4.5.0
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-sdk-s3@3.894.0':
+  '@aws-sdk/middleware-sdk-s3@3.896.0':
     dependencies:
-      '@aws-sdk/core': 3.894.0
+      '@aws-sdk/core': 3.896.0
       '@aws-sdk/types': 3.893.0
       '@aws-sdk/util-arn-parser': 3.893.0
-      '@smithy/core': 3.11.1
+      '@smithy/core': 3.12.0
       '@smithy/node-config-provider': 4.2.2
       '@smithy/protocol-http': 5.2.1
       '@smithy/signature-v4': 5.2.1
-      '@smithy/smithy-client': 4.6.3
+      '@smithy/smithy-client': 4.6.4
       '@smithy/types': 4.5.0
       '@smithy/util-config-provider': 4.1.0
       '@smithy/util-middleware': 4.1.1
@@ -12052,51 +11927,51 @@ snapshots:
       '@smithy/types': 4.5.0
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-user-agent@3.894.0':
+  '@aws-sdk/middleware-user-agent@3.896.0':
     dependencies:
-      '@aws-sdk/core': 3.894.0
+      '@aws-sdk/core': 3.896.0
       '@aws-sdk/types': 3.893.0
-      '@aws-sdk/util-endpoints': 3.893.0
-      '@smithy/core': 3.11.1
+      '@aws-sdk/util-endpoints': 3.895.0
+      '@smithy/core': 3.12.0
       '@smithy/protocol-http': 5.2.1
       '@smithy/types': 4.5.0
       tslib: 2.8.1
 
-  '@aws-sdk/nested-clients@3.894.0':
+  '@aws-sdk/nested-clients@3.896.0':
     dependencies:
       '@aws-crypto/sha256-browser': 5.2.0
       '@aws-crypto/sha256-js': 5.2.0
-      '@aws-sdk/core': 3.894.0
+      '@aws-sdk/core': 3.896.0
       '@aws-sdk/middleware-host-header': 3.893.0
       '@aws-sdk/middleware-logger': 3.893.0
       '@aws-sdk/middleware-recursion-detection': 3.893.0
-      '@aws-sdk/middleware-user-agent': 3.894.0
+      '@aws-sdk/middleware-user-agent': 3.896.0
       '@aws-sdk/region-config-resolver': 3.893.0
       '@aws-sdk/types': 3.893.0
-      '@aws-sdk/util-endpoints': 3.893.0
+      '@aws-sdk/util-endpoints': 3.895.0
       '@aws-sdk/util-user-agent-browser': 3.893.0
-      '@aws-sdk/util-user-agent-node': 3.894.0
+      '@aws-sdk/util-user-agent-node': 3.896.0
       '@smithy/config-resolver': 4.2.2
-      '@smithy/core': 3.11.1
+      '@smithy/core': 3.12.0
       '@smithy/fetch-http-handler': 5.2.1
       '@smithy/hash-node': 4.1.1
       '@smithy/invalid-dependency': 4.1.1
       '@smithy/middleware-content-length': 4.1.1
-      '@smithy/middleware-endpoint': 4.2.3
-      '@smithy/middleware-retry': 4.2.4
+      '@smithy/middleware-endpoint': 4.2.4
+      '@smithy/middleware-retry': 4.3.0
       '@smithy/middleware-serde': 4.1.1
       '@smithy/middleware-stack': 4.1.1
       '@smithy/node-config-provider': 4.2.2
       '@smithy/node-http-handler': 4.2.1
       '@smithy/protocol-http': 5.2.1
-      '@smithy/smithy-client': 4.6.3
+      '@smithy/smithy-client': 4.6.4
       '@smithy/types': 4.5.0
       '@smithy/url-parser': 4.1.1
       '@smithy/util-base64': 4.1.0
       '@smithy/util-body-length-browser': 4.1.0
       '@smithy/util-body-length-node': 4.1.0
-      '@smithy/util-defaults-mode-browser': 4.1.3
-      '@smithy/util-defaults-mode-node': 4.1.3
+      '@smithy/util-defaults-mode-browser': 4.1.4
+      '@smithy/util-defaults-mode-node': 4.1.4
       '@smithy/util-endpoints': 3.1.2
       '@smithy/util-middleware': 4.1.1
       '@smithy/util-retry': 4.1.2
@@ -12114,30 +11989,30 @@ snapshots:
       '@smithy/util-middleware': 4.1.1
       tslib: 2.8.1
 
-  '@aws-sdk/s3-request-presigner@3.894.0':
+  '@aws-sdk/s3-request-presigner@3.896.0':
     dependencies:
-      '@aws-sdk/signature-v4-multi-region': 3.894.0
+      '@aws-sdk/signature-v4-multi-region': 3.896.0
       '@aws-sdk/types': 3.893.0
       '@aws-sdk/util-format-url': 3.893.0
-      '@smithy/middleware-endpoint': 4.2.3
+      '@smithy/middleware-endpoint': 4.2.4
       '@smithy/protocol-http': 5.2.1
-      '@smithy/smithy-client': 4.6.3
+      '@smithy/smithy-client': 4.6.4
       '@smithy/types': 4.5.0
       tslib: 2.8.1
 
-  '@aws-sdk/signature-v4-multi-region@3.894.0':
+  '@aws-sdk/signature-v4-multi-region@3.896.0':
     dependencies:
-      '@aws-sdk/middleware-sdk-s3': 3.894.0
+      '@aws-sdk/middleware-sdk-s3': 3.896.0
       '@aws-sdk/types': 3.893.0
       '@smithy/protocol-http': 5.2.1
       '@smithy/signature-v4': 5.2.1
       '@smithy/types': 4.5.0
       tslib: 2.8.1
 
-  '@aws-sdk/token-providers@3.894.0':
+  '@aws-sdk/token-providers@3.896.0':
     dependencies:
-      '@aws-sdk/core': 3.894.0
-      '@aws-sdk/nested-clients': 3.894.0
+      '@aws-sdk/core': 3.896.0
+      '@aws-sdk/nested-clients': 3.896.0
       '@aws-sdk/types': 3.893.0
       '@smithy/property-provider': 4.1.1
       '@smithy/shared-ini-file-loader': 4.2.0
@@ -12155,7 +12030,7 @@ snapshots:
     dependencies:
       tslib: 2.8.1
 
-  '@aws-sdk/util-endpoints@3.893.0':
+  '@aws-sdk/util-endpoints@3.895.0':
     dependencies:
       '@aws-sdk/types': 3.893.0
       '@smithy/types': 4.5.0
@@ -12181,9 +12056,9 @@ snapshots:
       bowser: 2.12.1
       tslib: 2.8.1
 
-  '@aws-sdk/util-user-agent-node@3.894.0':
+  '@aws-sdk/util-user-agent-node@3.896.0':
     dependencies:
-      '@aws-sdk/middleware-user-agent': 3.894.0
+      '@aws-sdk/middleware-user-agent': 3.896.0
       '@aws-sdk/types': 3.893.0
       '@smithy/node-config-provider': 4.2.2
       '@smithy/types': 4.5.0
@@ -12262,7 +12137,7 @@ snapshots:
     dependencies:
       '@babel/core': 7.28.4
       '@babel/helper-annotate-as-pure': 7.27.3
-      regexpu-core: 6.3.1
+      regexpu-core: 6.4.0
       semver: 6.3.1
 
   '@babel/helper-define-polyfill-provider@0.6.5(@babel/core@7.28.4)':
@@ -12955,21 +12830,21 @@ snapshots:
     dependencies:
       '@emoji-mart/data': 1.2.1
       '@shikijs/types': 3.2.1
-      '@tiptap/core': 2.26.1(@tiptap/pm@2.26.1)
-      '@tiptap/extension-bold': 2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))
-      '@tiptap/extension-code': 2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))
-      '@tiptap/extension-gapcursor': 2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))(@tiptap/pm@2.26.1)
-      '@tiptap/extension-history': 2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))(@tiptap/pm@2.26.1)
-      '@tiptap/extension-horizontal-rule': 2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))(@tiptap/pm@2.26.1)
-      '@tiptap/extension-italic': 2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))
-      '@tiptap/extension-link': 2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))(@tiptap/pm@2.26.1)
-      '@tiptap/extension-paragraph': 2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))
-      '@tiptap/extension-strike': 2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))
-      '@tiptap/extension-table-cell': 2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))
-      '@tiptap/extension-table-header': 2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))
-      '@tiptap/extension-text': 2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))
-      '@tiptap/extension-underline': 2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))
-      '@tiptap/pm': 2.26.1
+      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
+      '@tiptap/extension-bold': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))
+      '@tiptap/extension-code': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))
+      '@tiptap/extension-gapcursor': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)
+      '@tiptap/extension-history': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)
+      '@tiptap/extension-horizontal-rule': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)
+      '@tiptap/extension-italic': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))
+      '@tiptap/extension-link': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)
+      '@tiptap/extension-paragraph': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))
+      '@tiptap/extension-strike': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))
+      '@tiptap/extension-table-cell': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))
+      '@tiptap/extension-table-header': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))
+      '@tiptap/extension-text': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))
+      '@tiptap/extension-underline': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))
+      '@tiptap/pm': 2.26.2
       emoji-mart: 5.6.0
       hast-util-from-dom: 5.0.1
       prosemirror-dropcursor: 1.8.2
@@ -13007,9 +12882,9 @@ snapshots:
       '@blocknote/core': 0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)
       '@emoji-mart/data': 1.2.1
       '@floating-ui/react': 0.26.28(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@tiptap/core': 2.26.1(@tiptap/pm@2.26.1)
-      '@tiptap/pm': 2.26.1
-      '@tiptap/react': 2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))(@tiptap/pm@2.26.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
+      '@tiptap/pm': 2.26.2
+      '@tiptap/react': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       emoji-mart: 5.6.0
       lodash.merge: 4.6.2
       react: 19.1.1
@@ -13075,13 +12950,13 @@ snapshots:
       - tsx
       - yaml
 
-  '@chromatic-com/storybook@4.1.1(storybook@9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))':
+  '@chromatic-com/storybook@4.1.1(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))':
     dependencies:
       '@neoconfetti/react': 1.0.0
       chromatic: 12.2.0
       filesize: 10.1.6
       jsonfile: 6.2.0
-      storybook: 9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+      storybook: 9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
       strip-ansi: 7.1.2
     transitivePeerDependencies:
       - '@chromatic-com/cypress'
@@ -13148,9 +13023,9 @@ snapshots:
     dependencies:
       '@microsoft/fetch-event-source': 2.0.1
     optionalDependencies:
-      '@rollup/rollup-darwin-arm64': 4.52.0
+      '@rollup/rollup-darwin-arm64': 4.52.2
 
-  '@electric-sql/pglite@0.3.9': {}
+  '@electric-sql/pglite@0.3.10': {}
 
   '@electric-sql/react@1.0.10(react@19.1.1)':
     dependencies:
@@ -13741,7 +13616,7 @@ snapshots:
       js-yaml: 4.1.0
       lodash: 4.17.21
 
-  '@hey-api/openapi-ts@0.84.0(magicast@0.3.5)(typescript@5.9.2)':
+  '@hey-api/openapi-ts@0.84.3(magicast@0.3.5)(typescript@5.9.2)':
     dependencies:
       '@hey-api/codegen-core': 0.2.0(typescript@5.9.2)
       '@hey-api/json-schema-ref-parser': 1.1.0
@@ -13774,21 +13649,21 @@ snapshots:
       - utf-8-validate
     optional: true
 
-  '@hono/node-server@1.19.4(hono@4.9.7)':
+  '@hono/node-server@1.19.4(hono@4.9.8)':
     dependencies:
-      hono: 4.9.7
+      hono: 4.9.8
 
-  '@hono/zod-openapi@1.1.0(hono@4.9.7)(zod@4.1.8)':
+  '@hono/zod-openapi@1.1.3(hono@4.9.8)(zod@4.1.8)':
     dependencies:
       '@asteasolutions/zod-to-openapi': 8.1.0(zod@4.1.8)
-      '@hono/zod-validator': 0.7.3(hono@4.9.7)(zod@4.1.8)
-      hono: 4.9.7
+      '@hono/zod-validator': 0.7.3(hono@4.9.8)(zod@4.1.8)
+      hono: 4.9.8
       openapi3-ts: 4.5.0
       zod: 4.1.8
 
-  '@hono/zod-validator@0.7.3(hono@4.9.7)(zod@4.1.8)':
+  '@hono/zod-validator@0.7.3(hono@4.9.8)(zod@4.1.8)':
     dependencies:
-      hono: 4.9.7
+      hono: 4.9.8
       zod: 4.1.8
 
   '@hookform/resolvers@3.10.0(react-hook-form@7.63.0(react@19.1.1))':
@@ -14553,7 +14428,7 @@ snapshots:
     dependencies:
       '@opentelemetry/api': 1.9.0
       '@opentelemetry/api-logs': 0.205.0
-      import-in-the-middle: 1.14.2
+      import-in-the-middle: 1.14.4
       require-in-the-middle: 7.5.2
     transitivePeerDependencies:
       - supports-color
@@ -14563,7 +14438,7 @@ snapshots:
       '@opentelemetry/api': 1.9.0
       '@opentelemetry/api-logs': 0.57.2
       '@types/shimmer': 1.2.0
-      import-in-the-middle: 1.14.2
+      import-in-the-middle: 1.14.4
       require-in-the-middle: 7.5.2
       semver: 7.7.2
       shimmer: 1.2.1
@@ -15886,135 +15761,69 @@ snapshots:
     optionalDependencies:
       rollup: 2.79.2
 
-  '@rollup/rollup-android-arm-eabi@4.52.0':
-    optional: true
-
   '@rollup/rollup-android-arm-eabi@4.52.2':
     optional: true
 
-  '@rollup/rollup-android-arm64@4.52.0':
-    optional: true
-
   '@rollup/rollup-android-arm64@4.52.2':
     optional: true
 
-  '@rollup/rollup-darwin-arm64@4.52.0':
-    optional: true
-
   '@rollup/rollup-darwin-arm64@4.52.2':
     optional: true
 
-  '@rollup/rollup-darwin-x64@4.52.0':
-    optional: true
-
   '@rollup/rollup-darwin-x64@4.52.2':
     optional: true
 
-  '@rollup/rollup-freebsd-arm64@4.52.0':
-    optional: true
-
   '@rollup/rollup-freebsd-arm64@4.52.2':
     optional: true
 
-  '@rollup/rollup-freebsd-x64@4.52.0':
-    optional: true
-
   '@rollup/rollup-freebsd-x64@4.52.2':
     optional: true
 
-  '@rollup/rollup-linux-arm-gnueabihf@4.52.0':
-    optional: true
-
   '@rollup/rollup-linux-arm-gnueabihf@4.52.2':
     optional: true
 
-  '@rollup/rollup-linux-arm-musleabihf@4.52.0':
-    optional: true
-
   '@rollup/rollup-linux-arm-musleabihf@4.52.2':
     optional: true
 
-  '@rollup/rollup-linux-arm64-gnu@4.52.0':
-    optional: true
-
   '@rollup/rollup-linux-arm64-gnu@4.52.2':
     optional: true
 
-  '@rollup/rollup-linux-arm64-musl@4.52.0':
-    optional: true
-
   '@rollup/rollup-linux-arm64-musl@4.52.2':
     optional: true
 
-  '@rollup/rollup-linux-loong64-gnu@4.52.0':
-    optional: true
-
   '@rollup/rollup-linux-loong64-gnu@4.52.2':
     optional: true
 
-  '@rollup/rollup-linux-ppc64-gnu@4.52.0':
-    optional: true
-
   '@rollup/rollup-linux-ppc64-gnu@4.52.2':
     optional: true
 
-  '@rollup/rollup-linux-riscv64-gnu@4.52.0':
-    optional: true
-
   '@rollup/rollup-linux-riscv64-gnu@4.52.2':
     optional: true
 
-  '@rollup/rollup-linux-riscv64-musl@4.52.0':
-    optional: true
-
   '@rollup/rollup-linux-riscv64-musl@4.52.2':
     optional: true
 
-  '@rollup/rollup-linux-s390x-gnu@4.52.0':
-    optional: true
-
   '@rollup/rollup-linux-s390x-gnu@4.52.2':
     optional: true
 
-  '@rollup/rollup-linux-x64-gnu@4.52.0':
-    optional: true
-
   '@rollup/rollup-linux-x64-gnu@4.52.2':
     optional: true
 
-  '@rollup/rollup-linux-x64-musl@4.52.0':
-    optional: true
-
   '@rollup/rollup-linux-x64-musl@4.52.2':
     optional: true
 
-  '@rollup/rollup-openharmony-arm64@4.52.0':
-    optional: true
-
   '@rollup/rollup-openharmony-arm64@4.52.2':
     optional: true
 
-  '@rollup/rollup-win32-arm64-msvc@4.52.0':
-    optional: true
-
   '@rollup/rollup-win32-arm64-msvc@4.52.2':
     optional: true
 
-  '@rollup/rollup-win32-ia32-msvc@4.52.0':
-    optional: true
-
   '@rollup/rollup-win32-ia32-msvc@4.52.2':
     optional: true
 
-  '@rollup/rollup-win32-x64-gnu@4.52.0':
-    optional: true
-
   '@rollup/rollup-win32-x64-gnu@4.52.2':
     optional: true
 
-  '@rollup/rollup-win32-x64-msvc@4.52.0':
-    optional: true
-
   '@rollup/rollup-win32-x64-msvc@4.52.2':
     optional: true
 
@@ -16031,10 +15840,10 @@ snapshots:
     dependencies:
       '@scalar/types': 0.2.16
 
-  '@scalar/hono-api-reference@0.9.19(hono@4.9.7)':
+  '@scalar/hono-api-reference@0.9.19(hono@4.9.8)':
     dependencies:
       '@scalar/core': 0.3.17
-      hono: 4.9.7
+      hono: 4.9.8
 
   '@scalar/openapi-types@0.3.7':
     dependencies:
@@ -16079,7 +15888,7 @@ snapshots:
 
   '@sentry-internal/node-cpu-profiler@2.2.0':
     dependencies:
-      detect-libc: 2.1.0
+      detect-libc: 2.1.1
       node-abi: 3.77.0
 
   '@sentry-internal/replay-canvas@9.46.0':
@@ -16173,7 +15982,7 @@ snapshots:
       '@opentelemetry/semantic-conventions': 1.37.0
       '@sentry/core': 9.46.0
       '@sentry/opentelemetry': 9.46.0(@opentelemetry/api@1.9.0)(@opentelemetry/context-async-hooks@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/core@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/semantic-conventions@1.37.0)
-      import-in-the-middle: 1.14.2
+      import-in-the-middle: 1.14.4
 
   '@sentry/node@9.46.0':
     dependencies:
@@ -16210,7 +16019,7 @@ snapshots:
       '@sentry/core': 9.46.0
       '@sentry/node-core': 9.46.0(@opentelemetry/api@1.9.0)(@opentelemetry/context-async-hooks@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/core@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/instrumentation@0.57.2(@opentelemetry/api@1.9.0))(@opentelemetry/resources@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/semantic-conventions@1.37.0)
       '@sentry/opentelemetry': 9.46.0(@opentelemetry/api@1.9.0)(@opentelemetry/context-async-hooks@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/core@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/semantic-conventions@1.37.0)
-      import-in-the-middle: 1.14.2
+      import-in-the-middle: 1.14.4
       minimatch: 9.0.5
     transitivePeerDependencies:
       - supports-color
@@ -16342,7 +16151,7 @@ snapshots:
       '@smithy/util-middleware': 4.1.1
       tslib: 2.8.1
 
-  '@smithy/core@3.11.1':
+  '@smithy/core@3.12.0':
     dependencies:
       '@smithy/middleware-serde': 4.1.1
       '@smithy/protocol-http': 5.2.1
@@ -16352,9 +16161,8 @@ snapshots:
       '@smithy/util-middleware': 4.1.1
       '@smithy/util-stream': 4.3.2
       '@smithy/util-utf8': 4.1.0
-      '@types/uuid': 9.0.8
+      '@smithy/uuid': 1.0.0
       tslib: 2.8.1
-      uuid: 9.0.1
 
   '@smithy/credential-provider-imds@4.1.2':
     dependencies:
@@ -16447,9 +16255,9 @@ snapshots:
       '@smithy/types': 4.5.0
       tslib: 2.8.1
 
-  '@smithy/middleware-endpoint@4.2.3':
+  '@smithy/middleware-endpoint@4.2.4':
     dependencies:
-      '@smithy/core': 3.11.1
+      '@smithy/core': 3.12.0
       '@smithy/middleware-serde': 4.1.1
       '@smithy/node-config-provider': 4.2.2
       '@smithy/shared-ini-file-loader': 4.2.0
@@ -16458,18 +16266,17 @@ snapshots:
       '@smithy/util-middleware': 4.1.1
       tslib: 2.8.1
 
-  '@smithy/middleware-retry@4.2.4':
+  '@smithy/middleware-retry@4.3.0':
     dependencies:
       '@smithy/node-config-provider': 4.2.2
       '@smithy/protocol-http': 5.2.1
       '@smithy/service-error-classification': 4.1.2
-      '@smithy/smithy-client': 4.6.3
+      '@smithy/smithy-client': 4.6.4
       '@smithy/types': 4.5.0
       '@smithy/util-middleware': 4.1.1
       '@smithy/util-retry': 4.1.2
-      '@types/uuid': 9.0.8
+      '@smithy/uuid': 1.0.0
       tslib: 2.8.1
-      uuid: 9.0.1
 
   '@smithy/middleware-serde@4.1.1':
     dependencies:
@@ -16538,10 +16345,10 @@ snapshots:
       '@smithy/util-utf8': 4.1.0
       tslib: 2.8.1
 
-  '@smithy/smithy-client@4.6.3':
+  '@smithy/smithy-client@4.6.4':
     dependencies:
-      '@smithy/core': 3.11.1
-      '@smithy/middleware-endpoint': 4.2.3
+      '@smithy/core': 3.12.0
+      '@smithy/middleware-endpoint': 4.2.4
       '@smithy/middleware-stack': 4.1.1
       '@smithy/protocol-http': 5.2.1
       '@smithy/types': 4.5.0
@@ -16586,21 +16393,21 @@ snapshots:
     dependencies:
       tslib: 2.8.1
 
-  '@smithy/util-defaults-mode-browser@4.1.3':
+  '@smithy/util-defaults-mode-browser@4.1.4':
     dependencies:
       '@smithy/property-provider': 4.1.1
-      '@smithy/smithy-client': 4.6.3
+      '@smithy/smithy-client': 4.6.4
       '@smithy/types': 4.5.0
       bowser: 2.12.1
       tslib: 2.8.1
 
-  '@smithy/util-defaults-mode-node@4.1.3':
+  '@smithy/util-defaults-mode-node@4.1.4':
     dependencies:
       '@smithy/config-resolver': 4.2.2
       '@smithy/credential-provider-imds': 4.1.2
       '@smithy/node-config-provider': 4.2.2
       '@smithy/property-provider': 4.1.1
-      '@smithy/smithy-client': 4.6.3
+      '@smithy/smithy-client': 4.6.4
       '@smithy/types': 4.5.0
       tslib: 2.8.1
 
@@ -16656,54 +16463,58 @@ snapshots:
       '@smithy/types': 4.5.0
       tslib: 2.8.1
 
+  '@smithy/uuid@1.0.0':
+    dependencies:
+      tslib: 2.8.1
+
   '@standard-schema/spec@1.0.0': {}
 
   '@standard-schema/utils@0.3.0': {}
 
-  '@storybook/addon-a11y@9.1.7(storybook@9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))':
+  '@storybook/addon-a11y@9.1.8(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))':
     dependencies:
       '@storybook/global': 5.0.0
       axe-core: 4.10.3
-      storybook: 9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+      storybook: 9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
 
-  '@storybook/addon-docs@9.1.7(@types/react@19.1.13)(storybook@9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))':
+  '@storybook/addon-docs@9.1.8(@types/react@19.1.13)(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))':
     dependencies:
       '@mdx-js/react': 3.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@storybook/csf-plugin': 9.1.7(storybook@9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))
+      '@storybook/csf-plugin': 9.1.8(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))
       '@storybook/icons': 1.6.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@storybook/react-dom-shim': 9.1.7(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))
+      '@storybook/react-dom-shim': 9.1.8(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
-      storybook: 9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+      storybook: 9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
       ts-dedent: 2.2.0
     transitivePeerDependencies:
       - '@types/react'
 
-  '@storybook/addon-vitest@9.1.7(@vitest/browser@3.2.4(playwright@1.55.0)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))(vitest@3.2.4))(@vitest/runner@3.2.4)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))(vitest@3.2.4(@types/debug@4.1.12)(@types/node@24.5.2)(@vitest/browser@3.2.4)(jiti@2.6.0)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))':
+  '@storybook/addon-vitest@9.1.8(@vitest/browser@3.2.4)(@vitest/runner@3.2.4)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))(vitest@3.2.4)':
     dependencies:
       '@storybook/global': 5.0.0
       '@storybook/icons': 1.6.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       prompts: 2.4.2
-      storybook: 9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+      storybook: 9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
       ts-dedent: 2.2.0
     optionalDependencies:
-      '@vitest/browser': 3.2.4(playwright@1.55.0)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))(vitest@3.2.4)
+      '@vitest/browser': 3.2.4(playwright@1.55.1)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))(vitest@3.2.4)
       '@vitest/runner': 3.2.4
       vitest: 3.2.4(@types/debug@4.1.12)(@types/node@24.5.2)(@vitest/browser@3.2.4)(jiti@2.6.0)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
     transitivePeerDependencies:
       - react
       - react-dom
 
-  '@storybook/builder-vite@9.1.7(storybook@9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))':
+  '@storybook/builder-vite@9.1.8(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))':
     dependencies:
-      '@storybook/csf-plugin': 9.1.7(storybook@9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))
-      storybook: 9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+      '@storybook/csf-plugin': 9.1.8(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))
+      storybook: 9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
       ts-dedent: 2.2.0
       vite: 7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
 
-  '@storybook/csf-plugin@9.1.7(storybook@9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))':
+  '@storybook/csf-plugin@9.1.8(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))':
     dependencies:
-      storybook: 9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+      storybook: 9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
       unplugin: 1.16.1
 
   '@storybook/global@5.0.0': {}
@@ -16713,25 +16524,25 @@ snapshots:
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
 
-  '@storybook/react-dom-shim@9.1.7(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))':
+  '@storybook/react-dom-shim@9.1.8(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))':
     dependencies:
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
-      storybook: 9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+      storybook: 9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
 
-  '@storybook/react-vite@9.1.7(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(rollup@2.79.2)(storybook@9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))(typescript@5.9.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))':
+  '@storybook/react-vite@9.1.8(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(rollup@2.79.2)(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))(typescript@5.9.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))':
     dependencies:
       '@joshwooding/vite-plugin-react-docgen-typescript': 0.6.1(typescript@5.9.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
       '@rollup/pluginutils': 5.3.0(rollup@2.79.2)
-      '@storybook/builder-vite': 9.1.7(storybook@9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
-      '@storybook/react': 9.1.7(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))(typescript@5.9.2)
+      '@storybook/builder-vite': 9.1.8(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+      '@storybook/react': 9.1.8(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))(typescript@5.9.2)
       find-up: 7.0.0
       magic-string: 0.30.19
       react: 19.1.1
       react-docgen: 8.0.1
       react-dom: 19.1.1(react@19.1.1)
       resolve: 1.22.10
-      storybook: 9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+      storybook: 9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
       tsconfig-paths: 4.2.0
       vite: 7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
     transitivePeerDependencies:
@@ -16739,13 +16550,13 @@ snapshots:
       - supports-color
       - typescript
 
-  '@storybook/react@9.1.7(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))(typescript@5.9.2)':
+  '@storybook/react@9.1.8(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))(typescript@5.9.2)':
     dependencies:
       '@storybook/global': 5.0.0
-      '@storybook/react-dom-shim': 9.1.7(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))
+      '@storybook/react-dom-shim': 9.1.8(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
-      storybook: 9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+      storybook: 9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
     optionalDependencies:
       typescript: 5.9.2
 
@@ -16865,8 +16676,8 @@ snapshots:
 
   '@tailwindcss/oxide@4.1.13':
     dependencies:
-      detect-libc: 2.1.0
-      tar: 7.4.4
+      detect-libc: 2.1.1
+      tar: 7.5.1
     optionalDependencies:
       '@tailwindcss/oxide-android-arm64': 4.1.13
       '@tailwindcss/oxide-darwin-arm64': 4.1.13
@@ -16881,7 +16692,7 @@ snapshots:
       '@tailwindcss/oxide-win32-arm64-msvc': 4.1.13
       '@tailwindcss/oxide-win32-x64-msvc': 4.1.13
 
-  '@tailwindcss/typography@0.5.18(tailwindcss@4.1.13)':
+  '@tailwindcss/typography@0.5.19(tailwindcss@4.1.13)':
     dependencies:
       postcss-selector-parser: 6.0.10
       tailwindcss: 4.1.13
@@ -16893,7 +16704,7 @@ snapshots:
       tailwindcss: 4.1.13
       vite: 7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
 
-  '@tanstack/history@1.131.2': {}
+  '@tanstack/history@1.132.0': {}
 
   '@tanstack/query-core@5.87.4': {}
 
@@ -16925,24 +16736,36 @@ snapshots:
       '@tanstack/query-core': 5.87.4
       react: 19.1.1
 
-  '@tanstack/react-router-devtools@1.131.42(@tanstack/react-router@1.131.41(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(@tanstack/router-core@1.131.50)(csstype@3.1.3)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(solid-js@1.9.9)(tiny-invariant@1.3.3)':
+  '@tanstack/react-router-devtools@1.132.6(@tanstack/react-router@1.132.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(@tanstack/router-core@1.132.6)(@types/node@24.5.2)(csstype@3.1.3)(jiti@2.6.0)(lightningcss@1.30.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.5)(yaml@2.8.1)':
     dependencies:
-      '@tanstack/react-router': 1.131.41(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@tanstack/router-devtools-core': 1.131.42(@tanstack/router-core@1.131.50)(csstype@3.1.3)(solid-js@1.9.9)(tiny-invariant@1.3.3)
+      '@tanstack/react-router': 1.132.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@tanstack/router-devtools-core': 1.132.6(@tanstack/router-core@1.132.6)(@types/node@24.5.2)(csstype@3.1.3)(jiti@2.6.0)(lightningcss@1.30.1)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.5)(yaml@2.8.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
+      vite: 7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
     transitivePeerDependencies:
       - '@tanstack/router-core'
+      - '@types/node'
       - csstype
+      - jiti
+      - less
+      - lightningcss
+      - sass
+      - sass-embedded
       - solid-js
+      - stylus
+      - sugarss
+      - terser
       - tiny-invariant
+      - tsx
+      - yaml
 
-  '@tanstack/react-router@1.131.41(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@tanstack/react-router@1.132.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@tanstack/history': 1.131.2
+      '@tanstack/history': 1.132.0
       '@tanstack/react-store': 0.7.7(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@tanstack/router-core': 1.131.41
-      isbot: 5.1.30
+      '@tanstack/router-core': 1.132.6
+      isbot: 5.1.31
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
       tiny-invariant: 1.3.3
@@ -16955,41 +16778,44 @@ snapshots:
       react-dom: 19.1.1(react@19.1.1)
       use-sync-external-store: 1.5.0(react@19.1.1)
 
-  '@tanstack/router-core@1.131.41':
+  '@tanstack/router-core@1.132.6':
     dependencies:
-      '@tanstack/history': 1.131.2
+      '@tanstack/history': 1.132.0
       '@tanstack/store': 0.7.7
-      cookie-es: 1.2.2
+      cookie-es: 2.0.0
       seroval: 1.3.2
       seroval-plugins: 1.3.3(seroval@1.3.2)
       tiny-invariant: 1.3.3
       tiny-warning: 1.0.3
 
-  '@tanstack/router-core@1.131.50':
+  '@tanstack/router-devtools-core@1.132.6(@tanstack/router-core@1.132.6)(@types/node@24.5.2)(csstype@3.1.3)(jiti@2.6.0)(lightningcss@1.30.1)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.5)(yaml@2.8.1)':
     dependencies:
-      '@tanstack/history': 1.131.2
-      '@tanstack/store': 0.7.7
-      cookie-es: 1.2.2
-      seroval: 1.3.2
-      seroval-plugins: 1.3.3(seroval@1.3.2)
-      tiny-invariant: 1.3.3
-      tiny-warning: 1.0.3
-
-  '@tanstack/router-devtools-core@1.131.42(@tanstack/router-core@1.131.50)(csstype@3.1.3)(solid-js@1.9.9)(tiny-invariant@1.3.3)':
-    dependencies:
-      '@tanstack/router-core': 1.131.50
+      '@tanstack/router-core': 1.132.6
       clsx: 2.1.1
       goober: 2.1.16(csstype@3.1.3)
       solid-js: 1.9.9
       tiny-invariant: 1.3.3
+      vite: 7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
     optionalDependencies:
       csstype: 3.1.3
+    transitivePeerDependencies:
+      - '@types/node'
+      - jiti
+      - less
+      - lightningcss
+      - sass
+      - sass-embedded
+      - stylus
+      - sugarss
+      - terser
+      - tsx
+      - yaml
 
-  '@tanstack/router-generator@1.131.50':
+  '@tanstack/router-generator@1.132.6':
     dependencies:
-      '@tanstack/router-core': 1.131.50
-      '@tanstack/router-utils': 1.131.2
-      '@tanstack/virtual-file-routes': 1.131.2
+      '@tanstack/router-core': 1.132.6
+      '@tanstack/router-utils': 1.132.0
+      '@tanstack/virtual-file-routes': 1.132.0
       prettier: 3.6.2
       recast: 0.23.11
       source-map: 0.7.6
@@ -16998,7 +16824,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@tanstack/router-plugin@1.131.50(@tanstack/react-router@1.131.41(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))':
+  '@tanstack/router-plugin@1.132.6(@tanstack/react-router@1.132.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))':
     dependencies:
       '@babel/core': 7.28.4
       '@babel/plugin-syntax-jsx': 7.27.1(@babel/core@7.28.4)
@@ -17006,21 +16832,21 @@ snapshots:
       '@babel/template': 7.27.2
       '@babel/traverse': 7.28.4
       '@babel/types': 7.28.4
-      '@tanstack/router-core': 1.131.50
-      '@tanstack/router-generator': 1.131.50
-      '@tanstack/router-utils': 1.131.2
-      '@tanstack/virtual-file-routes': 1.131.2
+      '@tanstack/router-core': 1.132.6
+      '@tanstack/router-generator': 1.132.6
+      '@tanstack/router-utils': 1.132.0
+      '@tanstack/virtual-file-routes': 1.132.0
       babel-dead-code-elimination: 1.0.10
       chokidar: 3.6.0
       unplugin: 2.3.10
       zod: 3.25.76
     optionalDependencies:
-      '@tanstack/react-router': 1.131.41(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@tanstack/react-router': 1.132.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       vite: 7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
     transitivePeerDependencies:
       - supports-color
 
-  '@tanstack/router-utils@1.131.2':
+  '@tanstack/router-utils@1.132.0':
     dependencies:
       '@babel/core': 7.28.4
       '@babel/generator': 7.28.3
@@ -17028,12 +16854,14 @@ snapshots:
       '@babel/preset-typescript': 7.27.1(@babel/core@7.28.4)
       ansis: 4.1.0
       diff: 8.0.2
+      fast-glob: 3.3.3
+      pathe: 2.0.3
     transitivePeerDependencies:
       - supports-color
 
   '@tanstack/store@0.7.7': {}
 
-  '@tanstack/virtual-file-routes@1.131.2': {}
+  '@tanstack/virtual-file-routes@1.132.0': {}
 
   '@testing-library/dom@10.4.1':
     dependencies:
@@ -17059,80 +16887,80 @@ snapshots:
     dependencies:
       '@testing-library/dom': 10.4.1
 
-  '@tiptap/core@2.26.1(@tiptap/pm@2.26.1)':
+  '@tiptap/core@2.26.2(@tiptap/pm@2.26.2)':
     dependencies:
-      '@tiptap/pm': 2.26.1
+      '@tiptap/pm': 2.26.2
 
-  '@tiptap/extension-bold@2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))':
+  '@tiptap/extension-bold@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))':
     dependencies:
-      '@tiptap/core': 2.26.1(@tiptap/pm@2.26.1)
+      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
 
-  '@tiptap/extension-bubble-menu@2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))(@tiptap/pm@2.26.1)':
+  '@tiptap/extension-bubble-menu@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)':
     dependencies:
-      '@tiptap/core': 2.26.1(@tiptap/pm@2.26.1)
-      '@tiptap/pm': 2.26.1
+      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
+      '@tiptap/pm': 2.26.2
       tippy.js: 6.3.7
 
-  '@tiptap/extension-code@2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))':
+  '@tiptap/extension-code@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))':
     dependencies:
-      '@tiptap/core': 2.26.1(@tiptap/pm@2.26.1)
+      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
 
-  '@tiptap/extension-floating-menu@2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))(@tiptap/pm@2.26.1)':
+  '@tiptap/extension-floating-menu@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)':
     dependencies:
-      '@tiptap/core': 2.26.1(@tiptap/pm@2.26.1)
-      '@tiptap/pm': 2.26.1
+      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
+      '@tiptap/pm': 2.26.2
       tippy.js: 6.3.7
 
-  '@tiptap/extension-gapcursor@2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))(@tiptap/pm@2.26.1)':
+  '@tiptap/extension-gapcursor@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)':
     dependencies:
-      '@tiptap/core': 2.26.1(@tiptap/pm@2.26.1)
-      '@tiptap/pm': 2.26.1
+      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
+      '@tiptap/pm': 2.26.2
 
-  '@tiptap/extension-history@2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))(@tiptap/pm@2.26.1)':
+  '@tiptap/extension-history@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)':
     dependencies:
-      '@tiptap/core': 2.26.1(@tiptap/pm@2.26.1)
-      '@tiptap/pm': 2.26.1
+      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
+      '@tiptap/pm': 2.26.2
 
-  '@tiptap/extension-horizontal-rule@2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))(@tiptap/pm@2.26.1)':
+  '@tiptap/extension-horizontal-rule@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)':
     dependencies:
-      '@tiptap/core': 2.26.1(@tiptap/pm@2.26.1)
-      '@tiptap/pm': 2.26.1
+      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
+      '@tiptap/pm': 2.26.2
 
-  '@tiptap/extension-italic@2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))':
+  '@tiptap/extension-italic@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))':
     dependencies:
-      '@tiptap/core': 2.26.1(@tiptap/pm@2.26.1)
+      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
 
-  '@tiptap/extension-link@2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))(@tiptap/pm@2.26.1)':
+  '@tiptap/extension-link@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)':
     dependencies:
-      '@tiptap/core': 2.26.1(@tiptap/pm@2.26.1)
-      '@tiptap/pm': 2.26.1
+      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
+      '@tiptap/pm': 2.26.2
       linkifyjs: 4.3.2
 
-  '@tiptap/extension-paragraph@2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))':
+  '@tiptap/extension-paragraph@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))':
     dependencies:
-      '@tiptap/core': 2.26.1(@tiptap/pm@2.26.1)
+      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
 
-  '@tiptap/extension-strike@2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))':
+  '@tiptap/extension-strike@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))':
     dependencies:
-      '@tiptap/core': 2.26.1(@tiptap/pm@2.26.1)
+      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
 
-  '@tiptap/extension-table-cell@2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))':
+  '@tiptap/extension-table-cell@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))':
     dependencies:
-      '@tiptap/core': 2.26.1(@tiptap/pm@2.26.1)
+      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
 
-  '@tiptap/extension-table-header@2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))':
+  '@tiptap/extension-table-header@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))':
     dependencies:
-      '@tiptap/core': 2.26.1(@tiptap/pm@2.26.1)
+      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
 
-  '@tiptap/extension-text@2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))':
+  '@tiptap/extension-text@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))':
     dependencies:
-      '@tiptap/core': 2.26.1(@tiptap/pm@2.26.1)
+      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
 
-  '@tiptap/extension-underline@2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))':
+  '@tiptap/extension-underline@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))':
     dependencies:
-      '@tiptap/core': 2.26.1(@tiptap/pm@2.26.1)
+      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
 
-  '@tiptap/pm@2.26.1':
+  '@tiptap/pm@2.26.2':
     dependencies:
       prosemirror-changeset: 2.3.1
       prosemirror-collab: 1.3.1
@@ -17153,12 +16981,12 @@ snapshots:
       prosemirror-transform: 1.10.4
       prosemirror-view: 1.41.1
 
-  '@tiptap/react@2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))(@tiptap/pm@2.26.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@tiptap/react@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@tiptap/core': 2.26.1(@tiptap/pm@2.26.1)
-      '@tiptap/extension-bubble-menu': 2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))(@tiptap/pm@2.26.1)
-      '@tiptap/extension-floating-menu': 2.26.1(@tiptap/core@2.26.1(@tiptap/pm@2.26.1))(@tiptap/pm@2.26.1)
-      '@tiptap/pm': 2.26.1
+      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
+      '@tiptap/extension-bubble-menu': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)
+      '@tiptap/extension-floating-menu': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)
+      '@tiptap/pm': 2.26.2
       '@types/use-sync-external-store': 0.0.6
       fast-deep-equal: 3.1.3
       react: 19.1.1
@@ -17372,8 +17200,6 @@ snapshots:
 
   '@types/use-sync-external-store@0.0.6': {}
 
-  '@types/uuid@9.0.8': {}
-
   '@types/wrap-ansi@3.0.0': {}
 
   '@types/zxcvbn@4.4.5': {}
@@ -17732,7 +17558,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@vitest/browser@3.2.4(playwright@1.55.0)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))(vitest@3.2.4)':
+  '@vitest/browser@3.2.4(playwright@1.55.1)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))(vitest@3.2.4)':
     dependencies:
       '@testing-library/dom': 10.4.1
       '@testing-library/user-event': 14.6.1(@testing-library/dom@10.4.1)
@@ -17744,14 +17570,14 @@ snapshots:
       vitest: 3.2.4(@types/debug@4.1.12)(@types/node@24.5.2)(@vitest/browser@3.2.4)(jiti@2.6.0)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
       ws: 8.18.3
     optionalDependencies:
-      playwright: 1.55.0
+      playwright: 1.55.1
     transitivePeerDependencies:
       - bufferutil
       - msw
       - utf-8-validate
       - vite
 
-  '@vitest/coverage-v8@3.2.4(@vitest/browser@3.2.4(playwright@1.55.0)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))(vitest@3.2.4))(vitest@3.2.4(@types/debug@4.1.12)(@types/node@24.5.2)(@vitest/browser@3.2.4)(jiti@2.6.0)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))':
+  '@vitest/coverage-v8@3.2.4(@vitest/browser@3.2.4)(vitest@3.2.4)':
     dependencies:
       '@ampproject/remapping': 2.3.0
       '@bcoe/v8-coverage': 1.0.2
@@ -17768,7 +17594,7 @@ snapshots:
       tinyrainbow: 2.0.0
       vitest: 3.2.4(@types/debug@4.1.12)(@types/node@24.5.2)(@vitest/browser@3.2.4)(jiti@2.6.0)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
     optionalDependencies:
-      '@vitest/browser': 3.2.4(playwright@1.55.0)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))(vitest@3.2.4)
+      '@vitest/browser': 3.2.4(playwright@1.55.1)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))(vitest@3.2.4)
     transitivePeerDependencies:
       - supports-color
 
@@ -18020,7 +17846,7 @@ snapshots:
   autoprefixer@10.4.21(postcss@8.5.6):
     dependencies:
       browserslist: 4.26.2
-      caniuse-lite: 1.0.30001743
+      caniuse-lite: 1.0.30001745
       fraction.js: 4.3.7
       normalize-range: 0.1.2
       picocolors: 1.1.1
@@ -18102,7 +17928,7 @@ snapshots:
 
   base64-js@1.5.1: {}
 
-  baseline-browser-mapping@2.8.6: {}
+  baseline-browser-mapping@2.8.7: {}
 
   bcp-47-match@2.0.3: {}
 
@@ -18155,9 +17981,9 @@ snapshots:
 
   browserslist@4.26.2:
     dependencies:
-      baseline-browser-mapping: 2.8.6
-      caniuse-lite: 1.0.30001743
-      electron-to-chromium: 1.5.222
+      baseline-browser-mapping: 2.8.7
+      caniuse-lite: 1.0.30001745
+      electron-to-chromium: 1.5.223
       node-releases: 2.0.21
       update-browserslist-db: 1.1.3(browserslist@4.26.2)
 
@@ -18230,7 +18056,7 @@ snapshots:
 
   camelcase-css@2.0.1: {}
 
-  caniuse-lite@1.0.30001743: {}
+  caniuse-lite@1.0.30001745: {}
 
   canvas-confetti@1.9.3: {}
 
@@ -18446,7 +18272,7 @@ snapshots:
 
   convert-source-map@2.0.0: {}
 
-  cookie-es@1.2.2: {}
+  cookie-es@2.0.0: {}
 
   cookie@1.0.2: {}
 
@@ -18657,7 +18483,7 @@ snapshots:
 
   detect-libc@1.0.3: {}
 
-  detect-libc@2.1.0: {}
+  detect-libc@2.1.1: {}
 
   detect-node-es@1.1.0: {}
 
@@ -18758,9 +18584,9 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  drizzle-orm@0.44.5(@electric-sql/pglite@0.3.9)(@libsql/client-wasm@0.14.0)(@opentelemetry/api@1.9.0)(@types/pg@8.15.5)(gel@2.0.2)(pg@8.16.3)(postgres@3.4.7):
+  drizzle-orm@0.44.5(@electric-sql/pglite@0.3.10)(@libsql/client-wasm@0.14.0)(@opentelemetry/api@1.9.0)(@types/pg@8.15.5)(gel@2.0.2)(pg@8.16.3)(postgres@3.4.7):
     optionalDependencies:
-      '@electric-sql/pglite': 0.3.9
+      '@electric-sql/pglite': 0.3.10
       '@libsql/client-wasm': 0.14.0
       '@opentelemetry/api': 1.9.0
       '@types/pg': 8.15.5
@@ -18768,9 +18594,9 @@ snapshots:
       pg: 8.16.3
       postgres: 3.4.7
 
-  drizzle-zod@0.8.3(drizzle-orm@0.44.5(@electric-sql/pglite@0.3.9)(@libsql/client-wasm@0.14.0)(@opentelemetry/api@1.9.0)(@types/pg@8.15.5)(gel@2.0.2)(pg@8.16.3)(postgres@3.4.7))(zod@4.1.8):
+  drizzle-zod@0.8.3(drizzle-orm@0.44.5(@electric-sql/pglite@0.3.10)(@libsql/client-wasm@0.14.0)(@opentelemetry/api@1.9.0)(@types/pg@8.15.5)(gel@2.0.2)(pg@8.16.3)(postgres@3.4.7))(zod@4.1.8):
     dependencies:
-      drizzle-orm: 0.44.5(@electric-sql/pglite@0.3.9)(@libsql/client-wasm@0.14.0)(@opentelemetry/api@1.9.0)(@types/pg@8.15.5)(gel@2.0.2)(pg@8.16.3)(postgres@3.4.7)
+      drizzle-orm: 0.44.5(@electric-sql/pglite@0.3.10)(@libsql/client-wasm@0.14.0)(@opentelemetry/api@1.9.0)(@types/pg@8.15.5)(gel@2.0.2)(pg@8.16.3)(postgres@3.4.7)
       zod: 4.1.8
 
   dunder-proto@1.0.1:
@@ -18801,7 +18627,7 @@ snapshots:
     dependencies:
       jake: 10.9.4
 
-  electron-to-chromium@1.5.222: {}
+  electron-to-chromium@1.5.223: {}
 
   embla-carousel-autoplay@8.6.0(embla-carousel@8.6.0):
     dependencies:
@@ -19358,9 +19184,9 @@ snapshots:
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
 
-  framer-motion@12.23.18(@emotion/is-prop-valid@1.3.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
+  framer-motion@12.23.22(@emotion/is-prop-valid@1.3.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
     dependencies:
-      motion-dom: 12.23.18
+      motion-dom: 12.23.21
       motion-utils: 12.23.6
       tslib: 2.8.1
     optionalDependencies:
@@ -19779,7 +19605,7 @@ snapshots:
     dependencies:
       react-is: 16.13.1
 
-  hono@4.9.7: {}
+  hono@4.9.8: {}
 
   html-encoding-sniffer@4.0.0:
     dependencies:
@@ -19910,7 +19736,7 @@ snapshots:
       parent-module: 1.0.1
       resolve-from: 4.0.0
 
-  import-in-the-middle@1.14.2:
+  import-in-the-middle@1.14.4:
     dependencies:
       acorn: 8.15.0
       acorn-import-attributes: 1.9.5(acorn@8.15.0)
@@ -20112,7 +19938,7 @@ snapshots:
 
   isarray@2.0.5: {}
 
-  isbot@5.1.30: {}
+  isbot@5.1.31: {}
 
   isexe@2.0.0: {}
 
@@ -20227,8 +20053,6 @@ snapshots:
       - supports-color
       - utf-8-validate
 
-  jsesc@3.0.2: {}
-
   jsesc@3.1.0: {}
 
   json-buffer@3.0.1: {}
@@ -20446,7 +20270,7 @@ snapshots:
 
   lightningcss@1.30.1:
     dependencies:
-      detect-libc: 2.1.0
+      detect-libc: 2.1.1
     optionalDependencies:
       lightningcss-darwin-arm64: 1.30.1
       lightningcss-darwin-x64: 1.30.1
@@ -21017,15 +20841,15 @@ snapshots:
 
   module-details-from-path@1.0.4: {}
 
-  motion-dom@12.23.18:
+  motion-dom@12.23.21:
     dependencies:
       motion-utils: 12.23.6
 
   motion-utils@12.23.6: {}
 
-  motion@12.23.18(@emotion/is-prop-valid@1.3.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
+  motion@12.23.22(@emotion/is-prop-valid@1.3.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
     dependencies:
-      framer-motion: 12.23.18(@emotion/is-prop-valid@1.3.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      framer-motion: 12.23.22(@emotion/is-prop-valid@1.3.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       tslib: 2.8.1
     optionalDependencies:
       '@emotion/is-prop-valid': 1.3.1
@@ -21433,11 +21257,11 @@ snapshots:
     transitivePeerDependencies:
       - react
 
-  playwright-core@1.55.0: {}
+  playwright-core@1.55.1: {}
 
-  playwright@1.55.0:
+  playwright@1.55.1:
     dependencies:
-      playwright-core: 1.55.0
+      playwright-core: 1.55.1
     optionalDependencies:
       fsevents: 2.3.2
 
@@ -21526,7 +21350,7 @@ snapshots:
 
   prebuild-install@7.1.3:
     dependencies:
-      detect-libc: 2.1.0
+      detect-libc: 2.1.1
       expand-template: 2.0.3
       github-from-package: 0.0.0
       minimist: 1.2.8
@@ -21751,7 +21575,7 @@ snapshots:
     dependencies:
       safe-buffer: 5.2.1
 
-  rate-limiter-flexible@7.3.2: {}
+  rate-limiter-flexible@7.4.0: {}
 
   rc9@2.1.2:
     dependencies:
@@ -21932,7 +21756,7 @@ snapshots:
       estree-walker: 3.0.3
       kleur: 4.1.5
       mri: 1.2.0
-      playwright: 1.55.0
+      playwright: 1.55.1
       preact: 10.27.2
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
@@ -22065,20 +21889,20 @@ snapshots:
       gopd: 1.2.0
       set-function-name: 2.0.2
 
-  regexpu-core@6.3.1:
+  regexpu-core@6.4.0:
     dependencies:
       regenerate: 1.4.2
       regenerate-unicode-properties: 10.2.2
       regjsgen: 0.8.0
-      regjsparser: 0.12.0
+      regjsparser: 0.13.0
       unicode-match-property-ecmascript: 2.0.0
       unicode-match-property-value-ecmascript: 2.2.1
 
   regjsgen@0.8.0: {}
 
-  regjsparser@0.12.0:
+  regjsparser@0.13.0:
     dependencies:
-      jsesc: 3.0.2
+      jsesc: 3.1.0
 
   rehype-format@5.0.1:
     dependencies:
@@ -22346,34 +22170,6 @@ snapshots:
     optionalDependencies:
       fsevents: 2.3.3
 
-  rollup@4.52.0:
-    dependencies:
-      '@types/estree': 1.0.8
-    optionalDependencies:
-      '@rollup/rollup-android-arm-eabi': 4.52.0
-      '@rollup/rollup-android-arm64': 4.52.0
-      '@rollup/rollup-darwin-arm64': 4.52.0
-      '@rollup/rollup-darwin-x64': 4.52.0
-      '@rollup/rollup-freebsd-arm64': 4.52.0
-      '@rollup/rollup-freebsd-x64': 4.52.0
-      '@rollup/rollup-linux-arm-gnueabihf': 4.52.0
-      '@rollup/rollup-linux-arm-musleabihf': 4.52.0
-      '@rollup/rollup-linux-arm64-gnu': 4.52.0
-      '@rollup/rollup-linux-arm64-musl': 4.52.0
-      '@rollup/rollup-linux-loong64-gnu': 4.52.0
-      '@rollup/rollup-linux-ppc64-gnu': 4.52.0
-      '@rollup/rollup-linux-riscv64-gnu': 4.52.0
-      '@rollup/rollup-linux-riscv64-musl': 4.52.0
-      '@rollup/rollup-linux-s390x-gnu': 4.52.0
-      '@rollup/rollup-linux-x64-gnu': 4.52.0
-      '@rollup/rollup-linux-x64-musl': 4.52.0
-      '@rollup/rollup-openharmony-arm64': 4.52.0
-      '@rollup/rollup-win32-arm64-msvc': 4.52.0
-      '@rollup/rollup-win32-ia32-msvc': 4.52.0
-      '@rollup/rollup-win32-x64-gnu': 4.52.0
-      '@rollup/rollup-win32-x64-msvc': 4.52.0
-      fsevents: 2.3.3
-
   rollup@4.52.2:
     dependencies:
       '@types/estree': 1.0.8
@@ -22659,7 +22455,7 @@ snapshots:
       es-errors: 1.3.0
       internal-slot: 1.1.0
 
-  storybook@9.1.7(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)):
+  storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)):
     dependencies:
       '@storybook/global': 5.0.0
       '@testing-library/jest-dom': 6.8.0
@@ -22914,7 +22710,7 @@ snapshots:
       mkdirp: 1.0.4
       yallist: 4.0.0
 
-  tar@7.4.4:
+  tar@7.5.1:
     dependencies:
       '@isaacs/fs-minipass': 4.0.1
       chownr: 3.0.0
@@ -23386,8 +23182,6 @@ snapshots:
 
   uuid@8.3.2: {}
 
-  uuid@9.0.1: {}
-
   v8-compile-cache-lib@3.0.1:
     optional: true
 
@@ -23444,7 +23238,7 @@ snapshots:
       d3-time: 3.1.0
       d3-timer: 3.0.1
 
-  virtua@0.43.3(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(solid-js@1.9.9)(vue@3.5.13(typescript@5.9.2)):
+  virtua@0.43.4(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(solid-js@1.9.9)(vue@3.5.13(typescript@5.9.2)):
     optionalDependencies:
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
@@ -23536,7 +23330,7 @@ snapshots:
       fdir: 6.5.0(picomatch@4.0.3)
       picomatch: 4.0.3
       postcss: 8.5.6
-      rollup: 4.52.0
+      rollup: 4.52.2
       tinyglobby: 0.2.15
     optionalDependencies:
       '@types/node': 24.5.2
@@ -23575,7 +23369,7 @@ snapshots:
     optionalDependencies:
       '@types/debug': 4.1.12
       '@types/node': 24.5.2
-      '@vitest/browser': 3.2.4(playwright@1.55.0)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))(vitest@3.2.4)
+      '@vitest/browser': 3.2.4(playwright@1.55.1)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))(vitest@3.2.4)
       jsdom: 26.1.0(canvas@3.2.0)
     transitivePeerDependencies:
       - jiti

From 01d47b3c89349ea02bc718f75600a0cbb3f9e1bb Mon Sep 17 00:00:00 2001
From: David Hordiienko <shiraz0david@gmail.com>
Date: Fri, 26 Sep 2025 11:28:23 +0300
Subject: [PATCH 13/48] chore: add todo

---
 backend/src/modules/auth/passwords/handlers.ts | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/backend/src/modules/auth/passwords/handlers.ts b/backend/src/modules/auth/passwords/handlers.ts
index 74034163f..fe1dfd016 100644
--- a/backend/src/modules/auth/passwords/handlers.ts
+++ b/backend/src/modules/auth/passwords/handlers.ts
@@ -1,7 +1,3 @@
-import { OpenAPIHono } from '@hono/zod-openapi';
-import { appConfig } from 'config';
-import { and, eq } from 'drizzle-orm';
-import i18n from 'i18next';
 import { db } from '#/db/db';
 import { emailsTable } from '#/db/schema/emails';
 import { membershipsTable } from '#/db/schema/memberships';
@@ -23,6 +19,10 @@ import { logEvent } from '#/utils/logger';
 import { nanoid } from '#/utils/nanoid';
 import { slugFromEmail } from '#/utils/slug-from-email';
 import { createDate, TimeSpan } from '#/utils/time-span';
+import { OpenAPIHono } from '@hono/zod-openapi';
+import { appConfig } from 'config';
+import { and, eq } from 'drizzle-orm';
+import i18n from 'i18next';
 import { CreatePasswordEmail, type CreatePasswordEmailProps } from '../../../../emails/create-password';
 import { handleEmailVerification } from '../helpers/handle-email-verification';
 import { handleCreateUser } from '../helpers/user';
@@ -200,6 +200,7 @@ const authPasswordsRouteHandlers = app
       db.update(emailsTable).set({ verified: true, verifiedAt: getIsoDate() }).where(eq(emailsTable.email, user.email)),
     ]);
 
+    // TODO(bug) MFA on when user already auth, FE not revalidate session just keep prev one
     const redirectPath = await initiateMfa(ctx, user);
     if (redirectPath) return ctx.json({ shouldRedirect: true, redirectPath }, 200);
 

From 661d4533ac5c1e005713a818f42f27d6c26e4b0f Mon Sep 17 00:00:00 2001
From: David Hordiienko <shiraz0david@gmail.com>
Date: Fri, 26 Sep 2025 11:42:05 +0300
Subject: [PATCH 14/48] chore: add code for delete prev session not  fully
 tested yet

---
 backend/src/modules/auth/helpers/session.ts | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/backend/src/modules/auth/helpers/session.ts b/backend/src/modules/auth/helpers/session.ts
index a730ea22e..e71d3e695 100644
--- a/backend/src/modules/auth/helpers/session.ts
+++ b/backend/src/modules/auth/helpers/session.ts
@@ -1,6 +1,3 @@
-import type { z } from '@hono/zod-openapi';
-import { eq } from 'drizzle-orm';
-import type { Context } from 'hono';
 import { db } from '#/db/db';
 import { type AuthStrategy, type SessionModel, type SessionTypes, sessionsTable } from '#/db/schema/sessions';
 import { type UserModel, usersTable } from '#/db/schema/users';
@@ -18,6 +15,9 @@ import { nanoid } from '#/utils/nanoid';
 import { encodeLowerCased } from '#/utils/oslo';
 import { sessionCookieSchema } from '#/utils/schema/session-cookie';
 import { createDate, TimeSpan } from '#/utils/time-span';
+import type { z } from '@hono/zod-openapi';
+import { eq } from 'drizzle-orm';
+import type { Context } from 'hono';
 
 /**
  * Sets a user session and stores it in the database.
@@ -32,6 +32,17 @@ export const setUserSession = async (ctx: Context<Env>, user: UserModel, strateg
     if (!allowAll && (!ip || !allowList.includes(ip))) throw new AppError({ status: 403, type: 'system_access_forbidden', severity: 'warn' });
   }
 
+  // // Delete previous session (skip if impersonation)
+  // if (type !== 'impersonation') {
+  //   const existingSession = deleteAuthCookie(ctx, 'session');
+
+  //   if (existingSession) {
+  //     const [existingSessionToken] = existingSession.split('.');
+
+  //     // Remove previous session from DB
+  //     await db.delete(sessionsTable).where(eq(sessionsTable.token, existingSessionToken));
+  //   }
+  // }
   // Get device information
   const device = deviceInfo(ctx);
 

From 57ce3e10aa50ef297ad952b42cd2770426dc8db1 Mon Sep 17 00:00:00 2001
From: David Hordiienko <shiraz0david@gmail.com>
Date: Fri, 26 Sep 2025 12:00:11 +0300
Subject: [PATCH 15/48] improve: FE dev script

---
 frontend/package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frontend/package.json b/frontend/package.json
index a45f06ffb..9bc89ae4f 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -7,7 +7,7 @@
   },
   "scripts": {
     "quick": "cross-env VITE_QUICK=true pnpm dev",
-    "dev": "wait-on http://localhost:4000/ping && pnpm generate-client && pnpm concurrently \"pnpm dev:run\" \"pnpm storybook\"",
+    "dev": "wait-on http://localhost:4000/ping && pnpm generate-client && pnpm concurrently --names \"VITE,STORY\" --prefix name \"pnpm dev:run\" \"pnpm storybook\"",
     "dev:run": "cross-env NODE_ENV=development vite --mode development",
     "tunnel": "wait-on http://localhost:4000/ping && cross-env NODE_ENV=tunnel vite --mode tunnel",
     "start": "cross-env NODE_ENV=production pnpm preview",

From d9ed5c6b04d76af61c38523469489745d60bc24a Mon Sep 17 00:00:00 2001
From: flipvanhaaren <flip@shareworks.nl>
Date: Fri, 26 Sep 2025 12:46:59 +0200
Subject: [PATCH 16/48] fix: system invite

---
 backend/src/middlewares/README.md             |   2 +-
 ...token.ts => has-valid-single-use-token.ts} |   8 +-
 backend/src/modules/attachments/handlers.ts   |  12 +-
 backend/src/modules/auth/general/handlers.ts  |  20 ++-
 backend/src/modules/auth/helpers/cookie.ts    |  13 +-
 backend/src/modules/auth/helpers/user.ts      |  10 +-
 backend/src/modules/auth/oauth/handlers.ts    |  18 +--
 .../modules/auth/oauth/helpers/callback.ts    |   2 +-
 .../modules/auth/oauth/helpers/initiation.ts  |   2 +-
 backend/src/modules/auth/passkeys/handlers.ts |   8 +-
 .../src/modules/auth/passwords/handlers.ts    |  25 ++--
 backend/src/modules/auth/passwords/routes.ts  |   8 +-
 backend/src/modules/auth/totps/handlers.ts    |  12 +-
 backend/src/modules/entities/handlers.ts      |   6 +-
 backend/src/modules/me/handlers.ts            |  24 +--
 backend/src/modules/memberships/handlers.ts   |  16 +-
 backend/src/modules/metrics/handlers.ts       |   4 +-
 backend/src/modules/organizations/handlers.ts |  10 +-
 backend/src/modules/requests/handlers.ts      |   6 +-
 backend/src/modules/system/handlers.ts        | 139 +++++++++++-------
 backend/src/modules/users/handlers.ts         |   8 +-
 .../src/utils/get-valid-single-use-token.ts   |   3 +-
 backend/tests/helpers.ts                      |   1 +
 frontend/src/api.gen/sdk.gen.ts               | 100 ++++++-------
 frontend/src/modules/common/text-effect.tsx   |   2 +-
 .../modules/home/onboarding/welcome-text.tsx  |   9 +-
 locales/en/common.json                        |   2 +-
 27 files changed, 252 insertions(+), 218 deletions(-)
 rename backend/src/middlewares/{has-valid-token.ts => has-valid-single-use-token.ts} (85%)

diff --git a/backend/src/middlewares/README.md b/backend/src/middlewares/README.md
index 4bfa029dd..ef1a4abd2 100644
--- a/backend/src/middlewares/README.md
+++ b/backend/src/middlewares/README.md
@@ -29,7 +29,7 @@ Built using [node-rate-limiter-flexible](https://github.com/animir/node-rate-lim
 
 ### Token validation
 
-You can use the middleware `hasValidToken` to validate a refresh token in a cookie. If its valid (it exists, it is not expired), then it will be added to `getContext`.
+You can use the middleware `hasValidSingleUseToken` to validate a single use token in a cookie. If its valid (it exists, it is not expired), then it will be added to `getContext`.
 
 ### Monitoring
 
diff --git a/backend/src/middlewares/has-valid-token.ts b/backend/src/middlewares/has-valid-single-use-token.ts
similarity index 85%
rename from backend/src/middlewares/has-valid-token.ts
rename to backend/src/middlewares/has-valid-single-use-token.ts
index 9432c9968..1549d8361 100644
--- a/backend/src/middlewares/has-valid-token.ts
+++ b/backend/src/middlewares/has-valid-single-use-token.ts
@@ -1,6 +1,6 @@
+import type { TokenType } from 'config';
 import type { MiddlewareHandler } from 'hono';
 import { createMiddleware } from 'hono/factory';
-import type { TokenModel } from '#/db/schema/tokens';
 import type { Env } from '#/lib/context';
 import { AppError } from '#/lib/errors';
 import { deleteAuthCookie } from '#/modules/auth/helpers/cookie';
@@ -13,9 +13,9 @@ import { getValidSingleUseToken } from '#/utils/get-valid-single-use-token';
  * @returns Error response or undefined if the token is valid.
  *
  */
-// TODO how to provide additional security against CSRF for endpoints using the cookie with hasValidToken middleware?
+// TODO how to provide additional security against CSRF for endpoints using the cookie with hasValidSingleUseToken middleware?
 // Can this middleware be used to directly check a CRSF token?
-export const hasValidToken = (tokenType: TokenModel['type']): MiddlewareHandler<Env> =>
+export const hasValidSingleUseToken = (tokenType: TokenType): MiddlewareHandler<Env> =>
   createMiddleware<Env>(async (ctx, next) => {
     if (ctx.req.method !== 'POST') throw new AppError({ status: 400, type: 'insecure_request', severity: 'error' });
 
@@ -23,7 +23,7 @@ export const hasValidToken = (tokenType: TokenModel['type']): MiddlewareHandler<
     const tokenRecord = await getValidSingleUseToken({ ctx, tokenType });
 
     // Revoke single use token by deleting cookie
-    deleteAuthCookie(ctx, tokenType);
+    deleteAuthCookie(ctx, tokenRecord.type);
 
     // Set token in context
     ctx.set('token', tokenRecord);
diff --git a/backend/src/modules/attachments/handlers.ts b/backend/src/modules/attachments/handlers.ts
index fc7fe0242..0a17b18f6 100644
--- a/backend/src/modules/attachments/handlers.ts
+++ b/backend/src/modules/attachments/handlers.ts
@@ -81,7 +81,7 @@ const attachmentsRouteHandlers = app
       });
     }
   })
-  /*
+  /**
    * Create one or more attachments
    */
   .openapi(attachmentRoutes.createAttachments, async (ctx) => {
@@ -122,7 +122,7 @@ const attachmentsRouteHandlers = app
 
     return ctx.json(data, 200);
   })
-  /*
+  /**
    * Get attachments
    */
   .openapi(attachmentRoutes.getAttachments, async (ctx) => {
@@ -179,7 +179,7 @@ const attachmentsRouteHandlers = app
 
     return ctx.json({ items, total }, 200);
   })
-  /*
+  /**
    * Get attachment by id
    */
   .openapi(attachmentRoutes.getAttachment, async (ctx) => {
@@ -191,7 +191,7 @@ const attachmentsRouteHandlers = app
 
     return ctx.json(data, 200);
   })
-  /*
+  /**
    * Update an attachment by id
    */
   .openapi(attachmentRoutes.updateAttachment, async (ctx) => {
@@ -218,7 +218,7 @@ const attachmentsRouteHandlers = app
 
     return ctx.json(data, 200);
   })
-  /*
+  /**
    * Delete attachments by ids
    */
   .openapi(attachmentRoutes.deleteAttachments, async (ctx) => {
@@ -241,7 +241,7 @@ const attachmentsRouteHandlers = app
 
     return ctx.json({ success: true, rejectedItems }, 200);
   })
-  /*
+  /**
    * Redirect to attachment
    */
   .openapi(attachmentRoutes.redirectToAttachment, async (ctx) => {
diff --git a/backend/src/modules/auth/general/handlers.ts b/backend/src/modules/auth/general/handlers.ts
index fc12eac6a..07d57dcd1 100644
--- a/backend/src/modules/auth/general/handlers.ts
+++ b/backend/src/modules/auth/general/handlers.ts
@@ -24,7 +24,7 @@ import authGeneralRoutes from './routes';
 const app = new OpenAPIHono<Env>({ defaultHook });
 
 const authGeneralRouteHandlers = app
-  /*
+  /**
    * Check if email exists
    */
   .openapi(authGeneralRoutes.checkEmail, async (ctx) => {
@@ -60,7 +60,7 @@ const authGeneralRouteHandlers = app
 
     return ctx.json(true, 200);
   })
-  /*
+  /**
    * Consume token and redirect with single use session token in cookie
    */
   .openapi(authGeneralRoutes.consumeToken, async (ctx) => {
@@ -81,14 +81,18 @@ const authGeneralRouteHandlers = app
 
     // Determine redirect URL based on token type
     let redirectUrl = appConfig.defaultRedirectPath;
-    if (tokenRecord.type === 'invitation') redirectUrl = `${appConfig.frontendUrl}/home?invitationTokenId=${tokenRecord.id}&skipWelcome=true`;
-    if (tokenRecord.type === 'password_reset') redirectUrl = `${appConfig.frontendUrl}/auth/create-password/${tokenRecord.id}`;
+
+    if (tokenRecord.type === 'invitation' && tokenRecord.entityType)
+      redirectUrl = `${appConfig.frontendUrl}/home?invitationTokenId=${tokenRecord.id}&skipWelcome=true`;
+    else if (tokenRecord.type === 'invitation' && !tokenRecord.entityType)
+      redirectUrl = `${appConfig.frontendUrl}/auth/authenticate?tokenId=${tokenRecord.id}`;
+    else if (tokenRecord.type === 'password_reset') redirectUrl = `${appConfig.frontendUrl}/auth/create-password/${tokenRecord.id}`;
 
     logEvent('info', 'Token consumed, redirecting with single use token in cookie', { tokenId: tokenRecord.id, userId: tokenRecord.userId });
 
     return ctx.redirect(redirectUrl, 302);
   })
-  /*
+  /**
    * Check token by id (without consuming it)
    */
   // TODO simplify?
@@ -133,7 +137,7 @@ const authGeneralRouteHandlers = app
 
     return ctx.json(dataWithOrg, 200);
   })
-  /*
+  /**
    * Start impersonation
    */
   .openapi(authGeneralRoutes.startImpersonation, async (ctx) => {
@@ -150,7 +154,7 @@ const authGeneralRouteHandlers = app
 
     return ctx.json(true, 200);
   })
-  /*
+  /**
    * Stop impersonation
    */
   .openapi(authGeneralRoutes.stopImpersonation, async (ctx) => {
@@ -178,7 +182,7 @@ const authGeneralRouteHandlers = app
 
     return ctx.json(true, 200);
   })
-  /*
+  /**
    * Sign out
    */
   .openapi(authGeneralRoutes.signOut, async (ctx) => {
diff --git a/backend/src/modules/auth/helpers/cookie.ts b/backend/src/modules/auth/helpers/cookie.ts
index b7cdc2ee3..3534aa426 100644
--- a/backend/src/modules/auth/helpers/cookie.ts
+++ b/backend/src/modules/auth/helpers/cookie.ts
@@ -7,16 +7,9 @@ import type { TimeSpan } from '#/utils/time-span';
 import { env } from '../../../env';
 
 const isProduction = appConfig.mode === 'production';
-// TODO make underscore consistent in cookie names
-type CookieName =
-  | TokenType
-  | 'session'
-  | 'totp-key'
-  | 'passkey-challenge'
-  | `oauth-${string}`
-  | 'email-verification'
-  | 'invitation'
-  | 'password-reset';
+
+// TODO totp_challenge?
+type CookieName = TokenType | 'session' | 'totp_key' | 'passkey-challenge' | `oauth_${string}`;
 
 /**
  * Sets an authentication cookie.
diff --git a/backend/src/modules/auth/helpers/user.ts b/backend/src/modules/auth/helpers/user.ts
index 328061a97..792fed122 100644
--- a/backend/src/modules/auth/helpers/user.ts
+++ b/backend/src/modules/auth/helpers/user.ts
@@ -1,5 +1,5 @@
 import { appConfig } from 'config';
-import { and, eq, isNull } from 'drizzle-orm';
+import { and, eq } from 'drizzle-orm';
 import { db } from '#/db/db';
 import { emailsTable } from '#/db/schema/emails';
 import { tokensTable } from '#/db/schema/tokens';
@@ -31,14 +31,6 @@ interface HandleCreateUserProps {
  * @returns Error response or Redirect response or Response
  */
 export const handleCreateUser = async ({ newUser, membershipInviteTokenId, emailVerified }: HandleCreateUserProps): Promise<UserModel> => {
-  // If signing up without token while having an unclaimed invitation token, abort and resend that invitation instead to prevent conflicts later
-  const [inviteToken] = await db
-    .select()
-    .from(tokensTable)
-    .where(and(eq(tokensTable.email, newUser.email), eq(tokensTable.type, 'invitation'), isNull(tokensTable.userId), isNull(tokensTable.invokedAt)));
-
-  if (!membershipInviteTokenId && inviteToken) throw new AppError({ status: 403, type: 'invite_takes_priority', severity: 'warn' });
-
   // Check if slug is available
   const slugAvailable = await checkSlugAvailable(newUser.slug);
 
diff --git a/backend/src/modules/auth/oauth/handlers.ts b/backend/src/modules/auth/oauth/handlers.ts
index 71608eb35..42c12de32 100644
--- a/backend/src/modules/auth/oauth/handlers.ts
+++ b/backend/src/modules/auth/oauth/handlers.ts
@@ -44,7 +44,7 @@ const app = new OpenAPIHono<Env>({ defaultHook });
 
 const authOAuthRouteHandlers = app
 
-  /*
+  /**
    * Initiates GitHub OAuth authentication flow
    */
   .openapi(authOAuthRoutes.github, async (ctx) => {
@@ -55,7 +55,7 @@ const authOAuthRouteHandlers = app
     // Start the OAuth session & flow (Persist `state`)
     return await handleOAuthInitiation(ctx, 'github', url, state);
   })
-  /*
+  /**
    * Initiates Google OAuth authentication flow
    */
   .openapi(authOAuthRoutes.google, async (ctx) => {
@@ -67,7 +67,7 @@ const authOAuthRouteHandlers = app
     // Start the OAuth session & flow (Persist `state` and `codeVerifier`)
     return await handleOAuthInitiation(ctx, 'google', url, state, codeVerifier);
   })
-  /*
+  /**
    * Initiates Microsoft OAuth authentication flow
    */
   .openapi(authOAuthRoutes.microsoft, async (ctx) => {
@@ -80,7 +80,7 @@ const authOAuthRouteHandlers = app
     return await handleOAuthInitiation(ctx, 'microsoft', url, state, codeVerifier);
   })
 
-  /*
+  /**
    * GitHub callback
    */
   .openapi(authOAuthRoutes.githubCallback, async (ctx) => {
@@ -111,7 +111,7 @@ const authOAuthRouteHandlers = app
     }
 
     // Verify cookie by `state` (CSRF protection)
-    const oauthCookie = await getAuthCookie(ctx, `oauth-${state}`);
+    const oauthCookie = await getAuthCookie(ctx, `oauth_${state}`);
     const cookiePayload: OAuthCookiePayload | null = oauthCookie ? JSON.parse(oauthCookie) : null;
 
     if (!state || !cookiePayload) {
@@ -151,7 +151,7 @@ const authOAuthRouteHandlers = app
     }
   })
 
-  /*
+  /**
    * Google callback
    */
   .openapi(authOAuthRoutes.googleCallback, async (ctx) => {
@@ -164,7 +164,7 @@ const authOAuthRouteHandlers = app
     }
 
     // Verify cookie by `state` (CSRF protection) & PKCE validation
-    const oauthCookie = await getAuthCookie(ctx, `oauth-${state}`);
+    const oauthCookie = await getAuthCookie(ctx, `oauth_${state}`);
     const cookiePayload: OAuthCookiePayload | null = oauthCookie ? JSON.parse(oauthCookie) : null;
 
     if (!code || !cookiePayload || !cookiePayload.codeVerifier) {
@@ -197,7 +197,7 @@ const authOAuthRouteHandlers = app
       });
     }
   })
-  /*
+  /**
    * Microsoft callback
    */
   .openapi(authOAuthRoutes.microsoftCallback, async (ctx) => {
@@ -210,7 +210,7 @@ const authOAuthRouteHandlers = app
     }
 
     // Verify cookie by `state` (CSRF protection) & PKCE validation
-    const oauthCookie = await getAuthCookie(ctx, `oauth-${state}`);
+    const oauthCookie = await getAuthCookie(ctx, `oauth_${state}`);
     const cookiePayload: OAuthCookiePayload | null = oauthCookie ? JSON.parse(oauthCookie) : null;
 
     if (!code || !cookiePayload || !cookiePayload.codeVerifier) {
diff --git a/backend/src/modules/auth/oauth/helpers/callback.ts b/backend/src/modules/auth/oauth/helpers/callback.ts
index a2e77633e..a7937394e 100644
--- a/backend/src/modules/auth/oauth/helpers/callback.ts
+++ b/backend/src/modules/auth/oauth/helpers/callback.ts
@@ -359,7 +359,7 @@ const handleUnverifiedOAuthAccount = async (
  * @returns A validated redirect path string.
  */
 const getOAuthRedirectPath = async (ctx: Context<Env>): Promise<string> => {
-  const redirect = await getAuthCookie(ctx, 'oauth-redirect');
+  const redirect = await getAuthCookie(ctx, 'oauth_redirect');
 
   return isValidRedirectPath(redirect) || appConfig.defaultRedirectPath;
 };
diff --git a/backend/src/modules/auth/oauth/helpers/initiation.ts b/backend/src/modules/auth/oauth/helpers/initiation.ts
index 50b6f20de..eb00c471c 100644
--- a/backend/src/modules/auth/oauth/helpers/initiation.ts
+++ b/backend/src/modules/auth/oauth/helpers/initiation.ts
@@ -38,7 +38,7 @@ export const handleOAuthInitiation = async (ctx: Context<Env>, provider: string,
   const cookieContent = JSON.stringify({ redirectPath, codeVerifier });
 
   // TODO state in name? perhaps in content instead? reconsider cookie lifecycle security
-  await setAuthCookie(ctx, `oauth-${state}`, cookieContent, new TimeSpan(5, 'm'));
+  await setAuthCookie(ctx, `oauth_${state}`, cookieContent, new TimeSpan(5, 'm'));
 
   logEvent('info', 'User redirected to OAuth provider', { strategy: 'oauth', provider, type });
 
diff --git a/backend/src/modules/auth/passkeys/handlers.ts b/backend/src/modules/auth/passkeys/handlers.ts
index 9c0fe60ad..85b65de5d 100644
--- a/backend/src/modules/auth/passkeys/handlers.ts
+++ b/backend/src/modules/auth/passkeys/handlers.ts
@@ -25,7 +25,7 @@ const enabledStrategies: readonly string[] = appConfig.enabledAuthStrategies;
 const app = new OpenAPIHono<Env>({ defaultHook });
 
 const authPasskeysRouteHandlers = app
-  /*
+  /**
    * Register passkey
    */
   .openapi(authPasskeysRoutes.createPasskey, async (ctx) => {
@@ -56,7 +56,7 @@ const authPasskeysRouteHandlers = app
 
     return ctx.json(newPasskey, 200);
   })
-  /*
+  /**
    * Delete passkey
    */
   .openapi(authPasskeysRoutes.deletePasskey, async (ctx) => {
@@ -79,7 +79,7 @@ const authPasskeysRouteHandlers = app
 
     return ctx.json(true, 200);
   })
-  /*
+  /**
    * Passkey challenge
    */
   .openapi(authPasskeysRoutes.createPasskeyChallenge, async (ctx) => {
@@ -121,7 +121,7 @@ const authPasskeysRouteHandlers = app
 
     return ctx.json({ challengeBase64, credentialIds }, 200);
   })
-  /*
+  /**
    * Signin using passkey
    */
   .openapi(authPasskeysRoutes.signInWithPasskey, async (ctx) => {
diff --git a/backend/src/modules/auth/passwords/handlers.ts b/backend/src/modules/auth/passwords/handlers.ts
index fe1dfd016..9b49a650e 100644
--- a/backend/src/modules/auth/passwords/handlers.ts
+++ b/backend/src/modules/auth/passwords/handlers.ts
@@ -33,7 +33,7 @@ const enabledStrategies: readonly string[] = appConfig.enabledAuthStrategies;
 const app = new OpenAPIHono<Env>({ defaultHook });
 
 const authPasswordsRouteHandlers = app
-  /*
+  /**
    * Sign up with email & password.
    * Attention: sign up is also used for new users that received (system or membership) invitations.
    * Only when invited to a new organization (context), user will proceed to accept this first after signing up.
@@ -64,7 +64,7 @@ const authPasswordsRouteHandlers = app
 
     return ctx.json(true, 200);
   })
-  /*
+  /**
    * Sign up with email & password to accept (system or membership) invitations.
    * Token is in single use session cookie.
    * Only for organization membership invitations, user will proceed to accept after signing up.
@@ -75,7 +75,7 @@ const authPasswordsRouteHandlers = app
     const validToken = getContextToken();
     if (!validToken) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error' });
 
-    const membershipInvite = validToken.type === 'invitation';
+    const isMembershipInvite = validToken.type === 'invitation' && validToken.entityType;
 
     // Verify if strategy allowed
     const strategy = 'password';
@@ -84,7 +84,7 @@ const authPasswordsRouteHandlers = app
     }
 
     // add token if it's membership invitation
-    const membershipInviteTokenId = membershipInvite ? validToken.id : undefined;
+    const membershipInviteTokenId = isMembershipInvite ? validToken.id : undefined;
     const slug = slugFromEmail(validToken.email);
 
     // Create user & send verification email
@@ -99,6 +99,10 @@ const authPasswordsRouteHandlers = app
     // Sign in user
     await setUserSession(ctx, user, strategy);
 
+    // If no membership invitation, we are done
+    if (!isMembershipInvite) return ctx.json({ shouldRedirect: true, redirectPath: appConfig.defaultRedirectPath }, 200);
+
+    // If membership invitation, get membership to forward
     const [invitationMembership] = await db
       .select(membershipBaseSelect)
       .from(membershipsTable)
@@ -107,12 +111,11 @@ const authPasswordsRouteHandlers = app
     if (!invitationMembership) throw new AppError({ status: 400, type: 'membership_not_found', severity: 'error' });
 
     // Redirect to accept invitation if membership invite
-    const redirectPath = membershipInvite
-      ? `/home?invitationMembershipId=${invitationMembership.id}&skipWelcome=true`
-      : appConfig.defaultRedirectPath;
+    const redirectPath = `/home?invitationMembershipId=${invitationMembership.id}&skipWelcome=true`;
+
     return ctx.json({ shouldRedirect: true, redirectPath }, 200);
   })
-  /*
+  /**
    * Verify email
    */
   .openapi(authPasswordsRoutes.verifyEmail, async (ctx) => {
@@ -120,7 +123,7 @@ const authPasswordsRouteHandlers = app
 
     return handleEmailVerification(ctx, token);
   })
-  /*
+  /**
    * Request reset password email
    */
   .openapi(authPasswordsRoutes.requestPassword, async (ctx) => {
@@ -165,7 +168,7 @@ const authPasswordsRouteHandlers = app
 
     return ctx.json(true, 200);
   })
-  /*
+  /**
    * Create password with single use session token in cookie
    */
   .openapi(authPasswordsRoutes.createPasswordWithToken, async (ctx) => {
@@ -207,7 +210,7 @@ const authPasswordsRouteHandlers = app
     await setUserSession(ctx, user, strategy);
     return ctx.json({ shouldRedirect: false }, 200);
   })
-  /*
+  /**
    * Sign in with email and password
    * Attention: sign in is also used as a preparation to accept organization invitations (when signed out & user exists),
    * after signing in, we proceed to accept the invitation.
diff --git a/backend/src/modules/auth/passwords/routes.ts b/backend/src/modules/auth/passwords/routes.ts
index 5fafb76fb..e14a7abf7 100644
--- a/backend/src/modules/auth/passwords/routes.ts
+++ b/backend/src/modules/auth/passwords/routes.ts
@@ -1,7 +1,7 @@
 import { z } from '@hono/zod-openapi';
 import { createCustomRoute } from '#/lib/custom-routes';
 import { isPublicAccess } from '#/middlewares/guard';
-import { hasValidToken } from '#/middlewares/has-valid-token';
+import { hasValidSingleUseToken } from '#/middlewares/has-valid-single-use-token';
 import { isNoBot } from '#/middlewares/is-no-bot';
 import { emailEnumLimiter, passwordLimiter, spamLimiter, tokenLimiter } from '#/middlewares/rate-limiter/limiters';
 import { cookieSchema, locationSchema, passwordSchema } from '#/utils/schema/common';
@@ -44,7 +44,7 @@ const authPasswordsRoutes = {
     method: 'post',
     path: '/sign-up/{tokenId}',
     guard: isPublicAccess,
-    middleware: [tokenLimiter('signup_invitation'), emailEnumLimiter, hasValidToken('invitation')],
+    middleware: [tokenLimiter('signup_invitation'), emailEnumLimiter, hasValidSingleUseToken('invitation')],
     tags: ['auth'],
     summary: 'Sign up to accept invite',
     description: 'Registers a user using an email and password in response to a system or organization invitation.',
@@ -68,7 +68,7 @@ const authPasswordsRoutes = {
     method: 'get',
     path: '/verify-email/{tokenId}',
     guard: isPublicAccess,
-    middleware: [tokenLimiter('email_verification'), hasValidToken('email_verification')],
+    middleware: [tokenLimiter('email_verification'), hasValidSingleUseToken('email_verification')],
     tags: ['auth'],
     summary: 'Verify email by token',
     description: "Verifies a user's email using a single-use session token in cookie. Grants a session upon success.",
@@ -113,7 +113,7 @@ const authPasswordsRoutes = {
     method: 'post',
     path: '/create-password/{tokenId}',
     guard: isPublicAccess,
-    middleware: [tokenLimiter('password_reset'), hasValidToken('password_reset')],
+    middleware: [tokenLimiter('password_reset'), hasValidSingleUseToken('password_reset')],
     tags: ['auth'],
     summary: 'Create password',
     description: 'Sets a new password using a single-use session token in cookie and grants a session immediately upon success.',
diff --git a/backend/src/modules/auth/totps/handlers.ts b/backend/src/modules/auth/totps/handlers.ts
index c05aa85cc..d4e1414a4 100644
--- a/backend/src/modules/auth/totps/handlers.ts
+++ b/backend/src/modules/auth/totps/handlers.ts
@@ -23,7 +23,7 @@ const enabledStrategies: readonly string[] = appConfig.enabledAuthStrategies;
 const app = new OpenAPIHono<Env>({ defaultHook });
 
 const authTotpsRouteHandlers = app
-  /*
+  /**
    * Register TOTP
    */
   .openapi(authTotpsRoutes.createTotpChallenge, async (ctx) => {
@@ -36,14 +36,14 @@ const authTotpsRouteHandlers = app
     const manualKey = encodeBase32UpperCase(secretBytes);
 
     // Save the secret in a short-lived cookie (5 minutes)
-    await setAuthCookie(ctx, 'totp-key', manualKey, new TimeSpan(5, 'm'));
+    await setAuthCookie(ctx, 'totp_key', manualKey, new TimeSpan(5, 'm'));
 
     // otpauth:// URI for QR scanner apps
     const totpUri = createTOTPKeyURI(appConfig.slug, user.email, secretBytes, appConfig.totpConfig.intervalInSeconds, appConfig.totpConfig.digits);
 
     return ctx.json({ totpUri, manualKey }, 200);
   })
-  /*
+  /**
    * Activate TOTP
    */
   .openapi(authTotpsRoutes.createTotp, async (ctx) => {
@@ -51,7 +51,7 @@ const authTotpsRouteHandlers = app
     const user = getContextUser();
 
     // Retrieve the encoded totp secret from cookie
-    const encodedSecret = await getAuthCookie(ctx, 'totp-key');
+    const encodedSecret = await getAuthCookie(ctx, 'totp_key');
     if (!encodedSecret) throw new AppError({ status: 400, type: 'invalid_credentials', severity: 'warn' });
 
     // Verify TOTP code
@@ -74,7 +74,7 @@ const authTotpsRouteHandlers = app
 
     return ctx.json(true, 200);
   })
-  /*
+  /**
    * Unlink TOTP
    */
   .openapi(authTotpsRoutes.deleteTotp, async (ctx) => {
@@ -96,7 +96,7 @@ const authTotpsRouteHandlers = app
 
     return ctx.json(true, 200);
   })
-  /*
+  /**
    * Verify TOTP
    */
   .openapi(authTotpRoutes.signInWithTotp, async (ctx) => {
diff --git a/backend/src/modules/entities/handlers.ts b/backend/src/modules/entities/handlers.ts
index a4e2a36e4..61486c7cd 100644
--- a/backend/src/modules/entities/handlers.ts
+++ b/backend/src/modules/entities/handlers.ts
@@ -20,7 +20,7 @@ import { prepareStringForILikeFilter } from '#/utils/sql';
 const app = new OpenAPIHono<Env>({ defaultHook });
 
 const entityRouteHandlers = app
-  /*
+  /**
    * Get all users' context entities with members counts
    */
   .openapi(entityRoutes.getContextEntities, async (ctx) => {
@@ -158,7 +158,7 @@ const entityRouteHandlers = app
     // Return response
     return ctx.json({ items, total }, 200);
   })
-  /*
+  /**
    * Get base entity info
    */
   .openapi(entityRoutes.getContextEntity, async (ctx) => {
@@ -169,7 +169,7 @@ const entityRouteHandlers = app
 
     return ctx.json(entity, 200);
   })
-  /*
+  /**
    * Check if slug is available
    */
   .openapi(entityRoutes.checkSlug, async (ctx) => {
diff --git a/backend/src/modules/me/handlers.ts b/backend/src/modules/me/handlers.ts
index adf6f9c89..fd2036448 100644
--- a/backend/src/modules/me/handlers.ts
+++ b/backend/src/modules/me/handlers.ts
@@ -43,7 +43,7 @@ const app = new OpenAPIHono<Env>({ defaultHook });
 export const streams = new Map<string, SSEStreamingApi>();
 
 const meRouteHandlers = app
-  /*
+  /**
    * Get me
    */
   .openapi(meRoutes.getMe, async (ctx) => {
@@ -54,7 +54,7 @@ const meRouteHandlers = app
 
     return ctx.json(user, 200);
   })
-  /*
+  /**
    * Toggle MFA require for me auth
    */
   .openapi(meRoutes.toggleMfa, async (ctx) => {
@@ -126,7 +126,7 @@ const meRouteHandlers = app
 
     return ctx.json(updatedUser, 200);
   })
-  /*
+  /**
    * Get my auth data
    */
   .openapi(meRoutes.getMyAuth, async (ctx) => {
@@ -174,7 +174,7 @@ const meRouteHandlers = app
       200,
     );
   })
-  /*
+  /**
    * Get my user menu
    */
   .openapi(meRoutes.getMyMenu, async (ctx) => {
@@ -213,7 +213,7 @@ const meRouteHandlers = app
 
     return ctx.json(menu, 200);
   })
-  /*
+  /**
    * Get my invitations - a combination of pending membership and entity data
    */
   .openapi(meRoutes.getMyInvitations, async (ctx) => {
@@ -255,7 +255,7 @@ const meRouteHandlers = app
 
     return ctx.json(pendingInvites.flat(), 200);
   })
-  /*
+  /**
    * Terminate one or more of my sessions
    */
   .openapi(meRoutes.deleteMySessions, async (ctx) => {
@@ -283,7 +283,7 @@ const meRouteHandlers = app
       return ctx.json({ success: false, rejectedItems: sessionIds }, 200);
     }
   })
-  /*
+  /**
    * Update current user (me)
    */
   .openapi(meRoutes.updateMe, async (ctx) => {
@@ -314,7 +314,7 @@ const meRouteHandlers = app
 
     return ctx.json(updatedUser, 200);
   })
-  /*
+  /**
    * Delete current user (me)
    */
   .openapi(meRoutes.deleteMe, async (ctx) => {
@@ -331,7 +331,7 @@ const meRouteHandlers = app
 
     return ctx.json(true, 200);
   })
-  /*
+  /**
    * Delete one of my entity memberships
    */
   .openapi(meRoutes.deleteMyMembership, async (ctx) => {
@@ -351,7 +351,7 @@ const meRouteHandlers = app
 
     return ctx.json(true, 200);
   })
-  /*
+  /**
    * Get upload token
    */
   .openapi(meRoutes.getUploadToken, async (ctx) => {
@@ -380,7 +380,7 @@ const meRouteHandlers = app
       });
     }
   })
-  /*
+  /**
    * Unsubscribe myself by token from receiving newsletters
    */
   .openapi(meRoutes.unsubscribeMe, async (ctx) => {
@@ -404,7 +404,7 @@ const meRouteHandlers = app
     const redirectUrl = new URL('/auth/unsubscribed', appConfig.frontendUrl);
     return ctx.redirect(redirectUrl, 302);
   })
-  /*
+  /**
    *  Get SSE stream
    */
   .get('/sse', isAuthenticated, async (ctx) => {
diff --git a/backend/src/modules/memberships/handlers.ts b/backend/src/modules/memberships/handlers.ts
index ba2f2b236..5193767d7 100644
--- a/backend/src/modules/memberships/handlers.ts
+++ b/backend/src/modules/memberships/handlers.ts
@@ -31,7 +31,7 @@ import { MemberInviteEmail, type MemberInviteEmailProps } from '../../../emails/
 const app = new OpenAPIHono<Env>({ defaultHook });
 
 const membershipRouteHandlers = app
-  /*
+  /**
    * Create memberships (invite members) for an entity such as an organization
    */
   .openapi(membershipRoutes.createMemberships, async (ctx) => {
@@ -243,7 +243,7 @@ const membershipRouteHandlers = app
     const rejectedItems = normalizedEmails.filter((email) => !recipients.some((recipient) => recipient.email === email));
     return ctx.json({ success: true, rejectedItems, invitesSentCount: recipients.length }, 200);
   })
-  /*
+  /**
    * Delete memberships to remove users from entity
    * When user is allowed to delete entity, they can delete memberships too
    */
@@ -292,7 +292,7 @@ const membershipRouteHandlers = app
 
     return ctx.json({ success: true, rejectedItems }, 200);
   })
-  /*
+  /**
    * Update user membership
    */
   .openapi(membershipRoutes.updateMembership, async (ctx) => {
@@ -366,7 +366,7 @@ const membershipRouteHandlers = app
 
     return ctx.json(updatedMembership, 200);
   })
-  /*
+  /**
    * Accept - or reject - organization membership invitation
    */
   .openapi(membershipRoutes.acceptMembership, async (ctx) => {
@@ -413,7 +413,7 @@ const membershipRouteHandlers = app
 
     return ctx.json({ ...entity, membership }, 200);
   })
-  /*
+  /**
    * Get members by entity id/slug and type
    */
   .openapi(membershipRoutes.getMembers, async (ctx) => {
@@ -468,7 +468,7 @@ const membershipRouteHandlers = app
 
     return ctx.json({ items, total }, 200);
   })
-  /*
+  /**
    * Get pending membership invitations by entity id/slug and type
    */
   .openapi(membershipRoutes.getPendingInvitations, async (ctx) => {
@@ -481,6 +481,7 @@ const membershipRouteHandlers = app
 
     const entityIdField = appConfig.entityIdFields[entity.entityType];
 
+    // TODO optimize this code
     const invitedMemberSelect = {
       id: tokensTable.id,
       name: usersTable.name,
@@ -503,6 +504,7 @@ const membershipRouteHandlers = app
           eq(tokensTable[entityIdField], entity.id),
           eq(tokensTable.organizationId, organization.id),
           isNotNull(tokensTable.role),
+          isNotNull(tokensTable.entityType),
           isNull(tokensTable.invokedAt),
         ),
       )
@@ -514,7 +516,7 @@ const membershipRouteHandlers = app
 
     return ctx.json({ items, total }, 200);
   })
-  /*
+  /**
    * Resend invitation email for entity invites.
    */
   .openapi(membershipRoutes.resendInvitation, async (ctx) => {
diff --git a/backend/src/modules/metrics/handlers.ts b/backend/src/modules/metrics/handlers.ts
index 47a0d1a97..c415be5c5 100644
--- a/backend/src/modules/metrics/handlers.ts
+++ b/backend/src/modules/metrics/handlers.ts
@@ -21,7 +21,7 @@ type CountsType = z.infer<typeof publicCountsSchema>;
 const publicCountsCache = new Map<string, { data: CountsType; expiresAt: number }>();
 
 const metricRouteHandlers = app
-  /*
+  /**
    * Get metrics
    */
   .openapi(metricRoutes.getMetrics, async (ctx) => {
@@ -36,7 +36,7 @@ const metricRouteHandlers = app
 
     return ctx.json(requestsPerMinute, 200);
   })
-  /*
+  /**
    * Get public counts with caching
    */
   .openapi(metricRoutes.getPublicCounts, async (ctx) => {
diff --git a/backend/src/modules/organizations/handlers.ts b/backend/src/modules/organizations/handlers.ts
index e9ad669db..f461569cd 100644
--- a/backend/src/modules/organizations/handlers.ts
+++ b/backend/src/modules/organizations/handlers.ts
@@ -28,7 +28,7 @@ import { defaultWelcomeText } from '#json/text-blocks.json';
 const app = new OpenAPIHono<Env>({ defaultHook });
 
 const organizationRouteHandlers = app
-  /*
+  /**
    * Create organization
    */
   .openapi(organizationRoutes.createOrganization, async (ctx) => {
@@ -79,7 +79,7 @@ const organizationRouteHandlers = app
 
     return ctx.json(data, 200);
   })
-  /*
+  /**
    * Get list of organizations
    */
   .openapi(organizationRoutes.getOrganizations, async (ctx) => {
@@ -143,7 +143,7 @@ const organizationRouteHandlers = app
 
     return ctx.json({ items: organizations, total }, 200);
   })
-  /*
+  /**
    * Get organization by id or slug
    */
   .openapi(organizationRoutes.getOrganization, async (ctx) => {
@@ -156,7 +156,7 @@ const organizationRouteHandlers = app
 
     return ctx.json(data, 200);
   })
-  /*
+  /**
    * Update an organization by id or slug
    */
   .openapi(organizationRoutes.updateOrganization, async (ctx) => {
@@ -206,7 +206,7 @@ const organizationRouteHandlers = app
 
     return ctx.json(data, 200);
   })
-  /*
+  /**
    * Delete organizations by ids
    */
   .openapi(organizationRoutes.deleteOrganizations, async (ctx) => {
diff --git a/backend/src/modules/requests/handlers.ts b/backend/src/modules/requests/handlers.ts
index 335e25e6e..71542086e 100644
--- a/backend/src/modules/requests/handlers.ts
+++ b/backend/src/modules/requests/handlers.ts
@@ -19,7 +19,7 @@ const uniqueRequests: RequestModel['type'][] = ['waitlist', 'newsletter'];
 const app = new OpenAPIHono<Env>({ defaultHook });
 
 const requestRouteHandlers = app
-  /*
+  /**
    *  Create request
    */
   .openapi(requestRoutes.createRequest, async (ctx) => {
@@ -63,7 +63,7 @@ const requestRouteHandlers = app
 
     return ctx.json(data, 200);
   })
-  /*
+  /**
    *  Get list of requests for system admins
    */
   .openapi(requestRoutes.getRequests, async (ctx) => {
@@ -96,7 +96,7 @@ const requestRouteHandlers = app
 
     return ctx.json({ items, total }, 200);
   })
-  /*
+  /**
    *  Delete requests
    */
   .openapi(requestRoutes.deleteRequests, async (ctx) => {
diff --git a/backend/src/modules/system/handlers.ts b/backend/src/modules/system/handlers.ts
index b51e97080..53592430f 100644
--- a/backend/src/modules/system/handlers.ts
+++ b/backend/src/modules/system/handlers.ts
@@ -1,7 +1,7 @@
 import { OpenAPIHono } from '@hono/zod-openapi';
 import { EventName, Paddle } from '@paddle/paddle-node-sdk';
 import { appConfig } from 'config';
-import { and, eq, inArray, isNotNull, isNull, lt, or } from 'drizzle-orm';
+import { and, eq, inArray, isNotNull, isNull, or } from 'drizzle-orm';
 import i18n from 'i18next';
 import { db } from '#/db/db';
 import { attachmentsTable } from '#/db/schema/attachments';
@@ -18,7 +18,6 @@ import { AppError } from '#/lib/errors';
 import { mailer } from '#/lib/mailer';
 import { getSignedUrlFromKey } from '#/lib/signed-url';
 import systemRoutes from '#/modules/system/routes';
-import { usersBaseQuery } from '#/modules/users/helpers/select';
 import permissionManager from '#/permissions/permissions-config';
 import { defaultHook } from '#/utils/default-hook';
 import { logError, logEvent } from '#/utils/logger';
@@ -34,8 +33,12 @@ const paddle = new Paddle(env.PADDLE_API_KEY || '');
 const app = new OpenAPIHono<Env>({ defaultHook });
 
 const systemRouteHandlers = app
-  /*
-   * Invite users to system
+  /**
+   * Invite users to system by list of email addresses. There are some scenarios:
+   * 1. email doesn't exist in emailsTable AND not in tokensTable (so no pending invitation) -> add to recipients list and create invitation token.
+   * 2. email doesn't exist in emailsTable BUT does exist in tokensTable (so pending invitation already) -> if token is expired, add to recipients,
+   * remove the old token and create a new one.
+   * 3. email exists in emailsTable AND in tokensTable -> remove from recipients.
    */
   .openapi(systemRoutes.createInvite, async (ctx) => {
     const { emails } = ctx.req.valid('json');
@@ -46,76 +49,108 @@ const systemRouteHandlers = app
     const senderThumbnailUrl = user.thumbnailUrl;
     const subject = i18n.t('backend:email.system_invite.subject', { lng, appName: appConfig.name });
 
-    const normalizedEmails = emails.map((email) => email.toLowerCase().trim());
+    // Normalize + de-dupe
+    const normalizedEmails = [...new Set(emails.map((e) => e.toLowerCase().trim()))];
+    if (normalizedEmails.length === 0) throw new AppError({ status: 400, type: 'no_recipients', severity: 'warn' });
 
-    if (!normalizedEmails.length) throw new AppError({ status: 400, type: 'no_recipients', severity: 'warn' });
+    const now = new Date();
 
-    // Query to filter out invitations on same email
-    const existingInvitesQuery = db
-      .select()
+    // 1) Emails that already belong to a verified user (users can have multiple emails)
+    const existingEmailRecords = await db
+      .select({ email: emailsTable.email })
+      .from(emailsTable)
+      .where(and(inArray(emailsTable.email, normalizedEmails), eq(emailsTable.verified, true)));
+
+    const existingEmails = new Set(existingEmailRecords.map((r) => r.email));
+
+    // 2) Pending invitation tokens for normalized emails
+    const pendingTokens = await db
+      .select({
+        id: tokensTable.id,
+        email: tokensTable.email,
+        expiresAt: tokensTable.expiresAt,
+        invokedAt: tokensTable.invokedAt,
+      })
       .from(tokensTable)
       .where(
         and(
           inArray(tokensTable.email, normalizedEmails),
           eq(tokensTable.type, 'invitation'),
-          // Make sure its a system invitation
-          isNull(tokensTable.entityType),
-          lt(tokensTable.expiresAt, new Date()),
-          isNull(tokensTable.invokedAt),
+          isNull(tokensTable.entityType), // system invite
+          isNull(tokensTable.invokedAt), // pending (not used)
         ),
       );
 
-    const existingUsersQuery = await usersBaseQuery().where(inArray(emailsTable.email, normalizedEmails));
+    // Index tokens per email, classify active vs expired
+    const activeTokenByEmail = new Map<string, { id: string }>();
+    const expiredTokenIdsByEmail = new Map<string, string[]>();
+
+    for (const t of pendingTokens) {
+      const isActive = t.expiresAt > now;
+      if (isActive) activeTokenByEmail.set(t.email, { id: t.id });
+      else {
+        const arr = expiredTokenIdsByEmail.get(t.email) ?? [];
+        arr.push(t.id);
+        expiredTokenIdsByEmail.set(t.email, arr);
+      }
+    }
+
+    // 3) Decide recipients vs rejected based on scenarios
+    const recipientEmails: string[] = [];
+    const rejectedItems: string[] = [];
+
+    for (const email of normalizedEmails) {
+      if (existingEmails.has(email)) {
+        // Already a user
+        rejectedItems.push(email);
+        continue;
+      }
+
+      if (activeTokenByEmail.has(email)) {
+        // Already has an active pending invite
+        rejectedItems.push(email);
+        continue;
+      }
 
-    const [existingUsers, existingInvites] = await Promise.all([existingUsersQuery, existingInvitesQuery]);
+      // Either no token at all OR expired token(s)
+      recipientEmails.push(email);
+    }
 
-    // Create a set of emails from both existing users and invitations
-    const existingEmails = new Set([...existingUsers.map((user) => user.email), ...existingInvites.map((invite) => invite.email)]);
+    if (recipientEmails.length === 0) {
+      return ctx.json({ success: false, rejectedItems, invitesSentCount: 0 }, 200);
+    }
 
-    // Filter out emails that already user or has invitations
-    const recipientEmails = normalizedEmails.filter((email) => !existingEmails.has(email));
-    const rejectedItems = normalizedEmails.filter((email) => existingEmails.has(email));
+    // 5) Create new tokens for recipients
+    const tokens = recipientEmails.map((email) => ({
+      token: nanoid(40),
+      type: 'invitation' as const,
+      email,
+      createdBy: user.id,
+      expiresAt: createDate(new TimeSpan(7, 'd')),
+      // entityType stays NULL => system-level
+    }));
 
-    // Stop if no recipients
-    if (recipientEmails.length === 0) return ctx.json({ success: false, rejectedItems, invitesSentCount: 0 }, 200);
-
-    // Generate tokens
-    const tokens = recipientEmails.map((email) => {
-      const token = nanoid(40);
-      return {
-        token,
-        type: 'invitation' as const,
-        email: email.toLowerCase().trim(),
-        createdBy: user.id,
-        expiresAt: createDate(new TimeSpan(7, 'd')),
-      };
-    });
-
-    // Batch insert tokens
     const insertedTokens = await db.insert(tokensTable).values(tokens).returning();
 
-    // Change waitlist request status
+    // 6) Link waitlist requests (if any)
     await Promise.all(
-      insertedTokens.map((token) =>
+      insertedTokens.map((t) =>
         db
           .update(requestsTable)
-          .set({ tokenId: token.id })
-          .where(and(eq(requestsTable.email, token.email), eq(requestsTable.type, 'waitlist'))),
+          .set({ tokenId: t.id })
+          .where(and(eq(requestsTable.email, t.email), eq(requestsTable.type, 'waitlist'))),
       ),
     );
 
-    // Prepare emails
-    const recipients = insertedTokens.map((tokenRecord) => ({
-      email: tokenRecord.email,
-      lng: lng,
-      name: slugFromEmail(tokenRecord.email),
-      // TODO is there a way to import the url from the hono route files?
-      systemInviteLink: `${appConfig.backendAuthUrl}/consume-token/${tokenRecord.token}`,
+    // 7) Prepare & send emails
+    const recipients = insertedTokens.map((t) => ({
+      email: t.email,
+      lng,
+      name: slugFromEmail(t.email),
+      systemInviteLink: `${appConfig.backendAuthUrl}/consume-token/${t.token}`,
     }));
-
     type Recipient = (typeof recipients)[number];
 
-    // Send invitation
     const staticProps = { senderName, senderThumbnailUrl, subject, lng };
     await mailer.prepareEmails<SystemInviteEmailProps, Recipient>(SystemInviteEmail, staticProps, recipients, user.email);
 
@@ -123,7 +158,7 @@ const systemRouteHandlers = app
 
     return ctx.json({ success: true, rejectedItems, invitesSentCount: recipients.length }, 200);
   })
-  /*
+  /**
    * Get presigned URL
    */
   .openapi(systemRoutes.getPresignedUrl, async (ctx) => {
@@ -162,7 +197,7 @@ const systemRouteHandlers = app
 
     return ctx.json(url, 200);
   })
-  /*
+  /**
    * Paddle webhook
    */
   .openapi(systemRoutes.paddleWebhook, async (ctx) => {
@@ -186,7 +221,7 @@ const systemRouteHandlers = app
 
     return ctx.json(true, 200);
   })
-  /*
+  /**
    * Send newsletter to members of one or more organizations matching one ore more roles.
    */
   .openapi(systemRoutes.sendNewsletter, async (ctx) => {
diff --git a/backend/src/modules/users/handlers.ts b/backend/src/modules/users/handlers.ts
index 0ee8719ef..b78013bf8 100644
--- a/backend/src/modules/users/handlers.ts
+++ b/backend/src/modules/users/handlers.ts
@@ -19,7 +19,7 @@ import { prepareStringForILikeFilter } from '#/utils/sql';
 const app = new OpenAPIHono<Env>({ defaultHook });
 
 const usersRouteHandlers = app
-  /*
+  /**
    * Get list of users
    */
   .openapi(userRoutes.getUsers, async (ctx) => {
@@ -110,7 +110,7 @@ const usersRouteHandlers = app
 
     return ctx.json({ items, total }, 200);
   })
-  /*
+  /**
    * Delete users
    */
   .openapi(userRoutes.deleteUsers, async (ctx) => {
@@ -151,7 +151,7 @@ const usersRouteHandlers = app
 
     return ctx.json({ success: true, rejectedItems }, 200);
   })
-  /*
+  /**
    * Get a user by id or slug
    */
   .openapi(userRoutes.getUser, async (ctx) => {
@@ -194,7 +194,7 @@ const usersRouteHandlers = app
 
     return ctx.json(targetUser, 200);
   })
-  /*
+  /**
    * Update a user by id or slug
    */
   .openapi(userRoutes.updateUser, async (ctx) => {
diff --git a/backend/src/utils/get-valid-single-use-token.ts b/backend/src/utils/get-valid-single-use-token.ts
index 75a111b9e..f6e4dee2a 100644
--- a/backend/src/utils/get-valid-single-use-token.ts
+++ b/backend/src/utils/get-valid-single-use-token.ts
@@ -1,3 +1,4 @@
+import { TokenType } from 'config';
 import { and, eq } from 'drizzle-orm';
 import { Context } from 'hono';
 import { db } from '#/db/db';
@@ -7,7 +8,7 @@ import { getAuthCookie } from '#/modules/auth/helpers/cookie';
 
 type BaseProps = {
   ctx: Context;
-  tokenType: TokenModel['type'];
+  tokenType: TokenType;
 };
 /**
  * Validates a single use token by its value, ensuring it matches the required type.
diff --git a/backend/tests/helpers.ts b/backend/tests/helpers.ts
index 6d3d449f7..411531ea8 100644
--- a/backend/tests/helpers.ts
+++ b/backend/tests/helpers.ts
@@ -48,6 +48,7 @@ export async function createUser(email: string, password: string) {
  * @param email - The email of the user to retrieve.
  * @returns 
  */
+// TODO not used anymore?
 export async function getUserByEmail(email: string): Promise<UserModel[]> {
   return await db
     .select()
diff --git a/frontend/src/api.gen/sdk.gen.ts b/frontend/src/api.gen/sdk.gen.ts
index 108d4502c..8261e92df 100644
--- a/frontend/src/api.gen/sdk.gen.ts
+++ b/frontend/src/api.gen/sdk.gen.ts
@@ -269,7 +269,7 @@ export const consumeToken = <ThrowOnError extends boolean = true>(options: Optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -297,7 +297,7 @@ export const getTokenData = <ThrowOnError extends boolean = true>(options: Optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -324,7 +324,7 @@ export const startImpersonation = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -350,7 +350,7 @@ export const stopImpersonation = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -376,7 +376,7 @@ export const signOut = <ThrowOnError extends boolean = true>(options?: Options<S
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -720,7 +720,7 @@ export const signInWithPasskey = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -891,7 +891,7 @@ export const deleteMe = <ThrowOnError extends boolean = true>(options?: Options<
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -917,7 +917,7 @@ export const getMe = <ThrowOnError extends boolean = true>(options?: Options<Get
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -951,7 +951,7 @@ export const updateMe = <ThrowOnError extends boolean = true>(options?: Options<
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -984,7 +984,7 @@ export const toggleMfa = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1014,7 +1014,7 @@ export const getMyAuth = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1040,7 +1040,7 @@ export const getMyMenu = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1066,7 +1066,7 @@ export const getMyInvitations = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1093,7 +1093,7 @@ export const deleteMySessions = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1147,7 +1147,7 @@ export const getUploadToken = <ThrowOnError extends boolean = true>(options: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1175,7 +1175,7 @@ export const unsubscribeMe = <ThrowOnError extends boolean = true>(options: Opti
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1202,7 +1202,7 @@ export const deleteUsers = <ThrowOnError extends boolean = true>(options?: Optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1241,7 +1241,7 @@ export const getUsers = <ThrowOnError extends boolean = true>(options?: Options<
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1268,7 +1268,7 @@ export const getUser = <ThrowOnError extends boolean = true>(options: Options<Ge
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1302,7 +1302,7 @@ export const updateUser = <ThrowOnError extends boolean = true>(options: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1333,7 +1333,7 @@ export const deleteOrganizations = <ThrowOnError extends boolean = true>(options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1368,7 +1368,7 @@ export const getOrganizations = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1396,7 +1396,7 @@ export const createOrganization = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1427,7 +1427,7 @@ export const getOrganization = <ThrowOnError extends boolean = true>(options: Op
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1471,7 +1471,7 @@ export const updateOrganization = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1515,7 +1515,7 @@ export const getContextEntities = <ThrowOnError extends boolean = true>(options?
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1544,7 +1544,7 @@ export const getContextEntity = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1573,7 +1573,7 @@ export const checkSlug = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1604,7 +1604,7 @@ export const systemInvite = <ThrowOnError extends boolean = true>(options?: Opti
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1636,7 +1636,7 @@ export const getPresignedUrl = <ThrowOnError extends boolean = true>(options: Op
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1663,7 +1663,7 @@ export const paddleWebhook = <ThrowOnError extends boolean = true>(options?: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1698,7 +1698,7 @@ export const sendNewsletter = <ThrowOnError extends boolean = true>(options: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1729,7 +1729,7 @@ export const deleteRequests = <ThrowOnError extends boolean = true>(options?: Op
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1764,7 +1764,7 @@ export const getRequests = <ThrowOnError extends boolean = true>(options?: Optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1794,7 +1794,7 @@ export const createRequest = <ThrowOnError extends boolean = true>(options?: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1825,7 +1825,7 @@ export const getMetrics = <ThrowOnError extends boolean = true>(options?: Option
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1852,7 +1852,7 @@ export const getPublicCounts = <ThrowOnError extends boolean = true>(options?: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1887,7 +1887,7 @@ export const shapeProxy = <ThrowOnError extends boolean = true>(options: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1915,7 +1915,7 @@ export const deleteAttachments = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1952,7 +1952,7 @@ export const getAttachments = <ThrowOnError extends boolean = true>(options: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1979,7 +1979,7 @@ export const createAttachment = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2011,7 +2011,7 @@ export const getAttachment = <ThrowOnError extends boolean = true>(options: Opti
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2041,7 +2041,7 @@ export const updateAttachment = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2073,7 +2073,7 @@ export const redirectToAttachment = <ThrowOnError extends boolean = true>(option
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2103,7 +2103,7 @@ export const deleteMemberships = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2138,7 +2138,7 @@ export const membershipInvite = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2174,7 +2174,7 @@ export const updateMembership = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2206,7 +2206,7 @@ export const acceptMembership = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2241,7 +2241,7 @@ export const getMembers = <ThrowOnError extends boolean = true>(options: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2275,7 +2275,7 @@ export const getPendingInvitations = <ThrowOnError extends boolean = true>(optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
diff --git a/frontend/src/modules/common/text-effect.tsx b/frontend/src/modules/common/text-effect.tsx
index 0f835b29e..69ab78567 100644
--- a/frontend/src/modules/common/text-effect.tsx
+++ b/frontend/src/modules/common/text-effect.tsx
@@ -28,7 +28,7 @@ export const TextEffect = ({ text, className = '' }: TextEffectProps) => {
       animate={isInView ? 'show' : ''}
       variants={variants}
       viewport={{ once: true }}
-      className={cn('text-xl text-center font-medium sm:text-4xl md:text-5xl md:leading-[4rem]', className)}
+      className={cn('', className)}
     >
       {letters.map((word, i) => (
         // biome-ignore lint/suspicious/noArrayIndexKey: list is static and will not be reordered
diff --git a/frontend/src/modules/home/onboarding/welcome-text.tsx b/frontend/src/modules/home/onboarding/welcome-text.tsx
index 5c822845d..5ce0e0588 100644
--- a/frontend/src/modules/home/onboarding/welcome-text.tsx
+++ b/frontend/src/modules/home/onboarding/welcome-text.tsx
@@ -12,10 +12,13 @@ export const WelcomeText = ({ onboardingToStepper }: WelcomeTextProps) => {
   const { t } = useTranslation();
 
   return (
-    <div className="flex flex-col items-center text-center mx-auto space-y-6 p-8 max-w-3xl">
+    <div className="flex flex-col items-center text-center mx-auto space-y-6 p-8 max-w-4xl">
       <h1 className="text-2xl font-bold">{t('common:onboarding_welcome', { appName: appConfig.name })}</h1>
-      <div className="text-xl text-foreground/90 md:text-2xl font-light leading-7 pb-8">
-        <TextEffect text={t('common:onboarding_welcome.text', { appName: appConfig.name })} />
+      <div className="text-foreground/90 md:text-2xl font-light leading-7 pb-8">
+        <TextEffect
+          text={t('common:onboarding_welcome.text', { appName: appConfig.name })}
+          className="text-2xl text-center font-medium sm:text-4xl md:text-5xl sm:leading-[3rem] md:leading-[4rem]"
+        />
       </div>
       <Button onClick={onboardingToStepper} className="max-sm:w-full">
         {t('common:get_started')}
diff --git a/locales/en/common.json b/locales/en/common.json
index bb5a30b18..e54317108 100644
--- a/locales/en/common.json
+++ b/locales/en/common.json
@@ -365,7 +365,7 @@
   "skip_org_creation.text": "You are not part of an organization yet. To complete the onboarding process, please create one.",
   "slug": "Slug",
   "status_page": "Status page",
-  "still_not_accepted": "{{count}} of {{total}} haven't accepted the invitation yet.",
+  "still_not_accepted": "{{count}} of {{total}} already joined or already have invitations.",
   "stop_impersonation": "Stop impersonation",
   "strategy": "Method",
   "subitem": "Subitem",

From 47e0812c09967a0aaab6a8434204e5060ffadce5 Mon Sep 17 00:00:00 2001
From: flipvanhaaren <flip@shareworks.nl>
Date: Fri, 26 Sep 2025 13:47:46 +0200
Subject: [PATCH 17/48] fix: member invite

---
 README.md                                     |  2 +-
 .../middlewares/has-valid-single-use-token.ts |  2 +-
 backend/src/modules/auth/general/handlers.ts  | 18 +++++-----
 backend/src/modules/auth/general/routes.ts    |  8 ++---
 backend/src/modules/auth/helpers/mfa.ts       |  2 +-
 .../auth/helpers/send-verification-email.ts   |  2 +-
 backend/src/modules/auth/helpers/session.ts   |  6 ++--
 .../modules/auth/oauth/helpers/callback.ts    |  6 ++--
 .../modules/auth/oauth/helpers/initiation.ts  | 14 +++++---
 .../src/modules/auth/passwords/handlers.ts    | 10 +++---
 backend/src/modules/memberships/handlers.ts   |  4 +--
 backend/src/modules/system/handlers.ts        |  2 +-
 .../src/utils/get-valid-single-use-token.ts   |  3 --
 backend/src/utils/get-valid-token.ts          | 34 +++++++++++--------
 frontend/src/api.gen/sdk.gen.ts               | 15 ++++----
 frontend/src/api.gen/types.gen.ts             |  9 ++---
 frontend/src/api.gen/zod.gen.ts               |  3 +-
 frontend/src/modules/common/error-notice.tsx  |  2 +-
 frontend/src/routes/home-routes.tsx           |  2 +-
 lefthook.yaml                                 | 12 +++----
 20 files changed, 83 insertions(+), 73 deletions(-)

diff --git a/README.md b/README.md
index ceffd7b47..b3898a9f1 100644
--- a/README.md
+++ b/README.md
@@ -33,7 +33,7 @@
 </div>
 
 > [!CAUTION]
-> This is a prerelease. Versioned releases will start once we have solid tests for authentication, authorization and data access. Want to contribute or discuss cella with us? Let's connect! ✉️ <info@cellajs.com>
+> This is a prerelease. Versioned releases will start once we have enough tests for authentication, authorization and data access. Want to contribute or discuss cella with us? Let's connect! ✉️ <info@cellajs.com>
 
 #### Contents
 - [Create app](#create-app)
diff --git a/backend/src/middlewares/has-valid-single-use-token.ts b/backend/src/middlewares/has-valid-single-use-token.ts
index 1549d8361..8ed57cef0 100644
--- a/backend/src/middlewares/has-valid-single-use-token.ts
+++ b/backend/src/middlewares/has-valid-single-use-token.ts
@@ -19,7 +19,7 @@ export const hasValidSingleUseToken = (tokenType: TokenType): MiddlewareHandler<
   createMiddleware<Env>(async (ctx, next) => {
     if (ctx.req.method !== 'POST') throw new AppError({ status: 400, type: 'insecure_request', severity: 'error' });
 
-    // Check if single use token exists and consume it
+    // Check if single use token exists and invoke it
     const tokenRecord = await getValidSingleUseToken({ ctx, tokenType });
 
     // Revoke single use token by deleting cookie
diff --git a/backend/src/modules/auth/general/handlers.ts b/backend/src/modules/auth/general/handlers.ts
index 07d57dcd1..e708795e0 100644
--- a/backend/src/modules/auth/general/handlers.ts
+++ b/backend/src/modules/auth/general/handlers.ts
@@ -63,11 +63,11 @@ const authGeneralRouteHandlers = app
   /**
    * Consume token and redirect with single use session token in cookie
    */
-  .openapi(authGeneralRoutes.consumeToken, async (ctx) => {
-    const { token } = ctx.req.valid('param');
+  .openapi(authGeneralRoutes.invokeToken, async (ctx) => {
+    const { token, type: tokenType } = ctx.req.valid('param');
 
     // Check if token exists and create a new refresh token
-    const tokenRecord = await getValidToken({ token, consumeToken: true });
+    const tokenRecord = await getValidToken({ ctx, token, tokenType, invokeToken: true });
     if (!tokenRecord.singleUseToken) throw new AppError({ status: 500, type: 'invalid_token', severity: 'error', isRedirect: true });
 
     // Set cookie using token type as name. Content is single use token. Expires in 10 minutes or until used.
@@ -82,18 +82,16 @@ const authGeneralRouteHandlers = app
     // Determine redirect URL based on token type
     let redirectUrl = appConfig.defaultRedirectPath;
 
-    if (tokenRecord.type === 'invitation' && tokenRecord.entityType)
-      redirectUrl = `${appConfig.frontendUrl}/home?invitationTokenId=${tokenRecord.id}&skipWelcome=true`;
-    else if (tokenRecord.type === 'invitation' && !tokenRecord.entityType)
-      redirectUrl = `${appConfig.frontendUrl}/auth/authenticate?tokenId=${tokenRecord.id}`;
-    else if (tokenRecord.type === 'password_reset') redirectUrl = `${appConfig.frontendUrl}/auth/create-password/${tokenRecord.id}`;
+    if (tokenRecord.type === 'invitation') redirectUrl = `${appConfig.frontendUrl}/auth/authenticate?tokenId=${tokenRecord.id}`;
 
-    logEvent('info', 'Token consumed, redirecting with single use token in cookie', { tokenId: tokenRecord.id, userId: tokenRecord.userId });
+    if (tokenRecord.type === 'password_reset') redirectUrl = `${appConfig.frontendUrl}/auth/create-password/${tokenRecord.id}`;
+
+    logEvent('info', 'Token invoked, redirecting with single use token in cookie', { tokenId: tokenRecord.id, userId: tokenRecord.userId });
 
     return ctx.redirect(redirectUrl, 302);
   })
   /**
-   * Check token by id (without consuming it)
+   * Get token data by id (without invoking it)
    */
   // TODO simplify?
   .openapi(authGeneralRoutes.getTokenData, async (ctx) => {
diff --git a/backend/src/modules/auth/general/routes.ts b/backend/src/modules/auth/general/routes.ts
index d49ce133a..c7cd170e4 100644
--- a/backend/src/modules/auth/general/routes.ts
+++ b/backend/src/modules/auth/general/routes.ts
@@ -87,10 +87,10 @@ const authGeneralRoutes = {
     },
   }),
 
-  consumeToken: createCustomRoute({
-    operationId: 'consumeToken',
+  invokeToken: createCustomRoute({
+    operationId: 'invokeToken',
     method: 'get',
-    path: '/consume-token/{token}',
+    path: '/invoke-token/{type}/{token}',
     guard: isPublicAccess,
     middleware: isNoBot,
     tags: ['auth'],
@@ -98,7 +98,7 @@ const authGeneralRoutes = {
     description:
       'Validates email token (for password reset, email verification or invitations) and redirects user to backend with a refreshed token in a cookie.',
     request: {
-      params: z.object({ token: z.string() }),
+      params: z.object({ type: z.enum(appConfig.tokenTypes), token: z.string() }),
     },
     responses: {
       302: {
diff --git a/backend/src/modules/auth/helpers/mfa.ts b/backend/src/modules/auth/helpers/mfa.ts
index 5ef857367..6de5004c8 100644
--- a/backend/src/modules/auth/helpers/mfa.ts
+++ b/backend/src/modules/auth/helpers/mfa.ts
@@ -58,7 +58,7 @@ export const validateConfirmMfaToken = async (ctx: Context<Env>): Promise<UserMo
   if (!tokenIdFromCookie) throw new AppError({ status: 401, type: 'confirm_mfa_not_found', severity: 'error' });
 
   // Fetch token record and associated user
-  const tokenRecord = await getValidToken({ token: tokenIdFromCookie, consumeToken: false, tokenType: 'confirm_mfa' });
+  const tokenRecord = await getValidToken({ ctx, token: tokenIdFromCookie, invokeToken: false, tokenType: 'confirm_mfa' });
 
   // Sanity check
   if (!tokenRecord.userId) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error' });
diff --git a/backend/src/modules/auth/helpers/send-verification-email.ts b/backend/src/modules/auth/helpers/send-verification-email.ts
index e78515715..d7d74a2f3 100644
--- a/backend/src/modules/auth/helpers/send-verification-email.ts
+++ b/backend/src/modules/auth/helpers/send-verification-email.ts
@@ -96,7 +96,7 @@ export const sendVerificationEmail = async ({ userId, oauthAccountId, redirectPa
   const lng = user.language;
 
   // Create verification link: go to
-  const verifyPath = `/auth/consume-token/${tokenRecord.token}`;
+  const verifyPath = `/auth/invoke-token/${tokenRecord.type}/${tokenRecord.token}`;
   const verificationURL = new URL(verifyPath, appConfig.backendUrl);
 
   if (redirectPath) verificationURL.searchParams.set('redirect', encodeURIComponent(redirectPath));
diff --git a/backend/src/modules/auth/helpers/session.ts b/backend/src/modules/auth/helpers/session.ts
index e71d3e695..28b89ee6d 100644
--- a/backend/src/modules/auth/helpers/session.ts
+++ b/backend/src/modules/auth/helpers/session.ts
@@ -1,3 +1,6 @@
+import type { z } from '@hono/zod-openapi';
+import { eq } from 'drizzle-orm';
+import type { Context } from 'hono';
 import { db } from '#/db/db';
 import { type AuthStrategy, type SessionModel, type SessionTypes, sessionsTable } from '#/db/schema/sessions';
 import { type UserModel, usersTable } from '#/db/schema/users';
@@ -15,9 +18,6 @@ import { nanoid } from '#/utils/nanoid';
 import { encodeLowerCased } from '#/utils/oslo';
 import { sessionCookieSchema } from '#/utils/schema/session-cookie';
 import { createDate, TimeSpan } from '#/utils/time-span';
-import type { z } from '@hono/zod-openapi';
-import { eq } from 'drizzle-orm';
-import type { Context } from 'hono';
 
 /**
  * Sets a user session and stores it in the database.
diff --git a/backend/src/modules/auth/oauth/helpers/callback.ts b/backend/src/modules/auth/oauth/helpers/callback.ts
index a7937394e..f697a7e5f 100644
--- a/backend/src/modules/auth/oauth/helpers/callback.ts
+++ b/backend/src/modules/auth/oauth/helpers/callback.ts
@@ -154,8 +154,9 @@ const inviteCallbackFlow = async (
   oauthAccount: OAuthAccountModel | null = null,
 ): Promise<Response> => {
   const invitationToken = await getValidToken({
+    ctx,
     token,
-    consumeToken: false,
+    invokeToken: false,
     tokenType: 'invitation',
     isRedirect: true,
   });
@@ -194,8 +195,9 @@ const verifyCallbackFlow = async (
   oauthAccount: OAuthAccountModel | null = null,
 ): Promise<Response> => {
   const verifyToken = await getValidToken({
+    ctx,
     token,
-    consumeToken: false,
+    invokeToken: false,
     tokenType: 'email_verification',
     isRedirect: true,
   });
diff --git a/backend/src/modules/auth/oauth/helpers/initiation.ts b/backend/src/modules/auth/oauth/helpers/initiation.ts
index eb00c471c..3b664d559 100644
--- a/backend/src/modules/auth/oauth/helpers/initiation.ts
+++ b/backend/src/modules/auth/oauth/helpers/initiation.ts
@@ -119,9 +119,11 @@ const prepareOAuthAcceptInvite = async (ctx: Context<Env>) => {
   // Must provide a token and tokenId
   if (!token) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error', isRedirect: true });
 
-  const tokenRecord = await getValidToken({ token, consumeToken: false, tokenType: 'invitation' });
+  const tokenRecord = await getValidToken({ ctx, token, invokeToken: false, tokenType: 'invitation' });
 
-  const redirectPath = tokenRecord.entityType ? `${appConfig.backendAuthUrl}/consume-token/${tokenRecord.token}` : appConfig.defaultRedirectPath;
+  const redirectPath = tokenRecord.entityType
+    ? `${appConfig.backendAuthUrl}/invoke-token/${tokenRecord.type}/${tokenRecord.token}`
+    : appConfig.defaultRedirectPath;
 
   return { redirectPath };
 };
@@ -173,13 +175,15 @@ const prepareOAuthVerify = async (ctx: Context<Env>) => {
   // Must provide a token
   if (!token) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error', isRedirect: true });
 
-  // TODO split in different endpoints when you are returning for second time, you get "Token is invalid" because it was consumed already
+  // TODO split in different endpoints when you are returning for second time, you get "Token is invalid" because it was invoked already
   //   then we need to get singleUUseToken here or somehow divert to another FileDownloadableLink, i
 
-  const tokenRecord = await getValidToken({ token, consumeToken: false, isRedirect: true, tokenType: 'email_verification' });
+  const tokenRecord = await getValidToken({ ctx, token, invokeToken: false, isRedirect: true, tokenType: 'email_verification' });
 
   // If entityType exists, proceed to invitation flow
-  const redirectPath = tokenRecord.entityType ? `${appConfig.backendAuthUrl}/consume-token/${tokenRecord.token}` : appConfig.defaultRedirectPath;
+  const redirectPath = tokenRecord.entityType
+    ? `${appConfig.backendAuthUrl}/invoke-token/${tokenRecord.type}/${tokenRecord.token}`
+    : appConfig.defaultRedirectPath;
 
   return { verifyTokenId: tokenRecord.id, redirectPath };
 };
diff --git a/backend/src/modules/auth/passwords/handlers.ts b/backend/src/modules/auth/passwords/handlers.ts
index 9b49a650e..41e789f72 100644
--- a/backend/src/modules/auth/passwords/handlers.ts
+++ b/backend/src/modules/auth/passwords/handlers.ts
@@ -1,3 +1,7 @@
+import { OpenAPIHono } from '@hono/zod-openapi';
+import { appConfig } from 'config';
+import { and, eq } from 'drizzle-orm';
+import i18n from 'i18next';
 import { db } from '#/db/db';
 import { emailsTable } from '#/db/schema/emails';
 import { membershipsTable } from '#/db/schema/memberships';
@@ -19,10 +23,6 @@ import { logEvent } from '#/utils/logger';
 import { nanoid } from '#/utils/nanoid';
 import { slugFromEmail } from '#/utils/slug-from-email';
 import { createDate, TimeSpan } from '#/utils/time-span';
-import { OpenAPIHono } from '@hono/zod-openapi';
-import { appConfig } from 'config';
-import { and, eq } from 'drizzle-orm';
-import i18n from 'i18next';
 import { CreatePasswordEmail, type CreatePasswordEmailProps } from '../../../../emails/create-password';
 import { handleEmailVerification } from '../helpers/handle-email-verification';
 import { handleCreateUser } from '../helpers/user';
@@ -155,7 +155,7 @@ const authPasswordsRouteHandlers = app
 
     // Send email
     const lng = user.language;
-    const createPasswordLink = `${appConfig.backendAuthUrl}/consume-token/${tokenRecord.token}`;
+    const createPasswordLink = `${appConfig.backendAuthUrl}/invoke-token/${tokenRecord.type}/${tokenRecord.token}`;
     const subject = i18n.t('backend:email.create_password.subject', { lng, appName: appConfig.name });
     const staticProps = { createPasswordLink, subject, lng };
     const recipients = [{ email: user.email }];
diff --git a/backend/src/modules/memberships/handlers.ts b/backend/src/modules/memberships/handlers.ts
index 5193767d7..f5810b12a 100644
--- a/backend/src/modules/memberships/handlers.ts
+++ b/backend/src/modules/memberships/handlers.ts
@@ -221,7 +221,7 @@ const membershipRouteHandlers = app
     const recipients = insertedTokens.map(({ email, token }) => ({
       email,
       name: slugFromEmail(email),
-      memberInviteLink: `${appConfig.backendAuthUrl}/consume-token/${token}`,
+      memberInviteLink: `${appConfig.backendAuthUrl}/invoke-token/invitation/${token}`,
     }));
 
     const emailProps = {
@@ -577,7 +577,7 @@ const membershipRouteHandlers = app
     const recipient = {
       email: userEmail,
       name: slugFromEmail(userEmail),
-      memberInviteLink: `${appConfig.backendAuthUrl}/consume-token/${newToken}`,
+      memberInviteLink: `${appConfig.backendAuthUrl}/invoke-token/${oldToken.type}/${newToken}`,
     };
 
     const emailProps = {
diff --git a/backend/src/modules/system/handlers.ts b/backend/src/modules/system/handlers.ts
index 53592430f..314f1a1fb 100644
--- a/backend/src/modules/system/handlers.ts
+++ b/backend/src/modules/system/handlers.ts
@@ -147,7 +147,7 @@ const systemRouteHandlers = app
       email: t.email,
       lng,
       name: slugFromEmail(t.email),
-      systemInviteLink: `${appConfig.backendAuthUrl}/consume-token/${t.token}`,
+      systemInviteLink: `${appConfig.backendAuthUrl}/invoke-token/${t.type}/${t.token}`,
     }));
     type Recipient = (typeof recipients)[number];
 
diff --git a/backend/src/utils/get-valid-single-use-token.ts b/backend/src/utils/get-valid-single-use-token.ts
index f6e4dee2a..704a90f1a 100644
--- a/backend/src/utils/get-valid-single-use-token.ts
+++ b/backend/src/utils/get-valid-single-use-token.ts
@@ -12,7 +12,6 @@ type BaseProps = {
 };
 /**
  * Validates a single use token by its value, ensuring it matches the required type.
- * It always removes the single use token cookie.
  *
  * @param ctx - Hono context
  * @param tokenType (optional) The required type of the token (e.g., 'password_reset', 'email_verification').
@@ -40,7 +39,5 @@ export const getValidSingleUseToken = async ({ ctx, tokenType }: BaseProps): Pro
   // Sanity check
   if (tokenType && tokenRecord.type !== tokenType) throw new AppError({ status: 401, type: 'invalid_token', severity: 'error' });
 
-  // Create single use session token and mark token as consumed
-
   return tokenRecord;
 };
diff --git a/backend/src/utils/get-valid-token.ts b/backend/src/utils/get-valid-token.ts
index 4e33e8b74..d867acdf4 100644
--- a/backend/src/utils/get-valid-token.ts
+++ b/backend/src/utils/get-valid-token.ts
@@ -1,44 +1,50 @@
 import { and, eq, gt, isNull } from 'drizzle-orm';
+import { Context } from 'hono';
 import { db } from '#/db/db';
 import { type TokenModel, tokensTable } from '#/db/schema/tokens';
+import { Env } from '#/lib/context';
 import { AppError } from '#/lib/errors';
 import { isExpiredDate } from '#/utils/is-expired-date';
+import { getValidSingleUseToken } from './get-valid-single-use-token';
 import { nanoid } from './nanoid';
 
 type BaseProps = {
+  ctx: Context<Env>;
   token: string;
-  consumeToken?: boolean;
-  tokenType?: TokenModel['type'];
+  tokenType: TokenModel['type'];
+  invokeToken?: boolean;
   isRedirect?: boolean;
 };
 /**
- * Validates a token by its value or ID, ensuring it matches the required type and is neither expired nor consumed.
- * By default, it consumes the token upon successful validation.
+ * Validates a token by its value or ID, ensuring it matches the required type and is neither expired nor invoked.
+ * By default, it invokes the token upon successful validation.
  *
+ * @param ctx - Hono context.
  * @param token The token string to validate.
- * @param consumeToken (optional) Whether to create a new refresh token after validation.
- * @param tokenType (optional) The required type of the token (e.g., 'password_reset', 'email_verification').
+ * @param invokeToken (optional) Whether to create a single-use token after invoking/consuming the primary `token`.
+ * @param tokenType The required type of the token (e.g., 'password_reset', 'email_verification').
  * @param isRedirect - Whether error requests should be redirects.
  * @returns The valid token record from the database.
  * @throws AppError if the token is not found, expired, or of an invalid type.
  */
 // TODO redirect always true?
-export const getValidToken = async ({ token, tokenType, consumeToken = true, isRedirect = false }: BaseProps): Promise<TokenModel> => {
+export const getValidToken = async ({ ctx, token, tokenType, invokeToken = true, isRedirect = true }: BaseProps): Promise<TokenModel> => {
   const condition = [
-    isNull(tokensTable.invokedAt), // Token not yet consumed
+    isNull(tokensTable.invokedAt), // Token not yet invoked
     gt(tokensTable.expiresAt, new Date()), // Token not expired
     eq(tokensTable.token, token), // Match token value
   ];
 
   if (tokenType) condition.push(eq(tokensTable.type, tokenType));
 
-  const [tokenRecord] = await db
+  let [tokenRecord] = await db
     .select()
     .from(tokensTable)
     .where(and(...condition))
     .limit(1);
 
-  if (!tokenRecord) throw new AppError({ status: 404, type: 'token_not_found', severity: 'error', isRedirect });
+  // If token not found, perhaps user already has the single-use token
+  if (!tokenRecord) tokenRecord = await getValidSingleUseToken({ ctx, tokenType });
 
   // Token expired
   if (isExpiredDate(tokenRecord.expiresAt)) throw new AppError({ status: 401, type: `${tokenRecord.type}_expired`, severity: 'warn', isRedirect });
@@ -46,14 +52,14 @@ export const getValidToken = async ({ token, tokenType, consumeToken = true, isR
   // Sanity check
   if (tokenType && tokenRecord.type !== tokenType) throw new AppError({ status: 401, type: 'invalid_token', severity: 'error', isRedirect });
 
-  // Create single use session token and mark token as consumed
-  if (consumeToken) {
-    const [consumedTokenRecord] = await db
+  // Create single use session token and mark token as invoked
+  if (invokeToken) {
+    const [invokedTokenRecord] = await db
       .update(tokensTable)
       .set({ singleUseToken: nanoid(40), invokedAt: new Date() })
       .where(eq(tokensTable.id, tokenRecord.id))
       .returning();
-    return consumedTokenRecord;
+    return invokedTokenRecord;
   }
 
   return tokenRecord;
diff --git a/frontend/src/api.gen/sdk.gen.ts b/frontend/src/api.gen/sdk.gen.ts
index 8261e92df..f9c4fec7c 100644
--- a/frontend/src/api.gen/sdk.gen.ts
+++ b/frontend/src/api.gen/sdk.gen.ts
@@ -12,8 +12,6 @@ import type {
   CheckSlugData,
   CheckSlugErrors,
   CheckSlugResponses,
-  ConsumeTokenData,
-  ConsumeTokenErrors,
   CreateAttachmentData,
   CreateAttachmentErrors,
   CreateAttachmentResponses,
@@ -136,6 +134,8 @@ import type {
   GoogleCallbackErrors,
   GoogleData,
   GoogleErrors,
+  InvokeTokenData,
+  InvokeTokenErrors,
   MembershipInviteData,
   MembershipInviteErrors,
   MembershipInviteResponses,
@@ -257,14 +257,15 @@ export const checkEmail = <ThrowOnError extends boolean = true>(options?: Option
  *
  * Validates email token (for password reset, email verification or invitations) and redirects user to backend with a refreshed token in a cookie.
  *
- * **GET /auth/consume-token/{token}** ·· [consumeToken](http://localhost:4000/docs#tag/auth/get/auth/consume-token/{token}) ·· _auth_
+ * **GET /auth/invoke-token/{type}/{token}** ·· [invokeToken](http://localhost:4000/docs#tag/auth/get/auth/invoke-token/{type}/{token}) ·· _auth_
  *
- * @param {consumeTokenData} options
+ * @param {invokeTokenData} options
+ * @param {enum} options.path.type - `enum`
  * @param {string} options.path.token - `string`
  * @returns Possible status codes: 302, 400, 401, 403, 404, 429
  */
-export const consumeToken = <ThrowOnError extends boolean = true>(options: Options<ConsumeTokenData, ThrowOnError>) => {
-  return (options.client ?? client).get<unknown, ConsumeTokenErrors, ThrowOnError, 'data'>({
+export const invokeToken = <ThrowOnError extends boolean = true>(options: Options<InvokeTokenData, ThrowOnError>) => {
+  return (options.client ?? client).get<unknown, InvokeTokenErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
     security: [
       {
@@ -273,7 +274,7 @@ export const consumeToken = <ThrowOnError extends boolean = true>(options: Optio
         type: 'apiKey',
       },
     ],
-    url: '/auth/consume-token/{token}',
+    url: '/auth/invoke-token/{type}/{token}',
     ...options,
   });
 };
diff --git a/frontend/src/api.gen/types.gen.ts b/frontend/src/api.gen/types.gen.ts
index ea91fa373..1511899da 100644
--- a/frontend/src/api.gen/types.gen.ts
+++ b/frontend/src/api.gen/types.gen.ts
@@ -257,16 +257,17 @@ export type CheckEmailResponses = {
 
 export type CheckEmailResponse = CheckEmailResponses[keyof CheckEmailResponses];
 
-export type ConsumeTokenData = {
+export type InvokeTokenData = {
   body?: never;
   path: {
+    type: 'email_verification' | 'oauth_verification' | 'password_reset' | 'invitation' | 'confirm_mfa';
     token: string;
   };
   query?: never;
-  url: '/auth/consume-token/{token}';
+  url: '/auth/invoke-token/{type}/{token}';
 };
 
-export type ConsumeTokenErrors = {
+export type InvokeTokenErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -299,7 +300,7 @@ export type ConsumeTokenErrors = {
   };
 };
 
-export type ConsumeTokenError = ConsumeTokenErrors[keyof ConsumeTokenErrors];
+export type InvokeTokenError = InvokeTokenErrors[keyof InvokeTokenErrors];
 
 export type GetTokenDataData = {
   body?: never;
diff --git a/frontend/src/api.gen/zod.gen.ts b/frontend/src/api.gen/zod.gen.ts
index c5aa1957f..b2bfc1d0c 100644
--- a/frontend/src/api.gen/zod.gen.ts
+++ b/frontend/src/api.gen/zod.gen.ts
@@ -223,9 +223,10 @@ export const zCheckEmailData = z.object({
  */
 export const zCheckEmailResponse = z.boolean();
 
-export const zConsumeTokenData = z.object({
+export const zInvokeTokenData = z.object({
   body: z.optional(z.never()),
   path: z.object({
+    type: z.enum(['email_verification', 'oauth_verification', 'password_reset', 'invitation', 'confirm_mfa']),
     token: z.string(),
   }),
   query: z.optional(z.never()),
diff --git a/frontend/src/modules/common/error-notice.tsx b/frontend/src/modules/common/error-notice.tsx
index 70de80e8c..925d1a831 100644
--- a/frontend/src/modules/common/error-notice.tsx
+++ b/frontend/src/modules/common/error-notice.tsx
@@ -54,7 +54,7 @@ export const getErrorInfo = (error?: ErrorNoticeError, errorFromQuery?: string)
   };
 
   const defaultTitle = error?.name || i18n.t('error:error');
-  const defaultMessage = error?.message || i18n.t('error:reported_try_or_contact');
+  const defaultMessage = error?.message || '';
 
   // Title translation
   const title = i18n.t(localeKey, { ...translationOptions, defaultValue: defaultTitle });
diff --git a/frontend/src/routes/home-routes.tsx b/frontend/src/routes/home-routes.tsx
index 74a5a88ea..75006eeff 100644
--- a/frontend/src/routes/home-routes.tsx
+++ b/frontend/src/routes/home-routes.tsx
@@ -26,7 +26,7 @@ export const HomeAliasRoute = createRoute({
   validateSearch: z.object({
     invitationTokenId: z.string().optional(),
     invitationMembershipId: z.string().optional(),
-    skipWelcome: z.string().optional(),
+    skipWelcome: z.boolean().optional(),
   }),
   staticData: { isAuth: true },
   head: () => ({ meta: [{ title: appTitle('Home') }] }),
diff --git a/lefthook.yaml b/lefthook.yaml
index 0ffaab726..4e23e3275 100644
--- a/lefthook.yaml
+++ b/lefthook.yaml
@@ -1,8 +1,8 @@
 pre-commit:
   commands:
-  #   typescript:
-  #     run: pnpm generate:openapi && pnpm ts && git add frontend/src/api.gen
-  #   biome:
-  #     glob: "*.{js,ts,cjs,mjs,d.cts,d.mts,jsx,tsx,json,jsonc}"
-  #     run: pnpm dlx @biomejs/biome check --write --no-errors-on-unmatched --files-ignore-unknown=true {staged_files} && git update-index --again
-  # parallel: false
+    typescript:
+      run: pnpm generate:openapi && pnpm ts && git add frontend/src/api.gen
+    biome:
+      glob: "*.{js,ts,cjs,mjs,d.cts,d.mts,jsx,tsx,json,jsonc}"
+      run: pnpm dlx @biomejs/biome check --write --no-errors-on-unmatched --files-ignore-unknown=true {staged_files} && git update-index --again
+  parallel: false

From fdf216f34170221038a1eaa0ffd060fb261ff2a3 Mon Sep 17 00:00:00 2001
From: flipvanhaaren <flip@shareworks.nl>
Date: Fri, 26 Sep 2025 14:53:40 +0200
Subject: [PATCH 18/48] refactor: restructure auth helpers

---
 backend/scripts/seeds/organizations/seed.ts   |   2 +-
 backend/scripts/seeds/user/seed.ts            |   2 +-
 .../src/middlewares/guard/is-authenticated.ts |   4 +-
 .../middlewares/has-valid-single-use-token.ts |   2 +-
 backend/src/modules/auth/general/handlers.ts  |  16 +--
 .../auth/{ => general}/helpers/cookie.ts      |   2 +-
 .../auth/{ => general}/helpers/device-info.ts |   0
 .../modules/auth/{ => general}/helpers/mfa.ts |  18 +--
 .../helpers/send-verification-email.ts        |   8 +-
 .../auth/{ => general}/helpers/session.ts     |   4 +-
 .../auth/{ => general}/helpers/user.ts        |   0
 backend/src/modules/auth/oauth/handlers.ts    |   2 +-
 .../modules/auth/oauth/helpers/callback.ts    |  14 +--
 .../modules/auth/oauth/helpers/initiation.ts  |  12 +-
 backend/src/modules/auth/passkeys/handlers.ts |  10 +-
 .../auth/{ => passkeys}/helpers/passkey.ts    |   0
 backend/src/modules/auth/passkeys/routes.ts   |   4 +-
 .../src/modules/auth/passwords/handlers.ts    |  16 +--
 .../auth/{ => passwords}/helpers/argon2id.ts  |   2 +-
 .../helpers/handle-email-verification.ts      |   4 +-
 backend/src/modules/auth/passwords/routes.ts  |   4 +-
 backend/src/modules/auth/totps/handlers.ts    |   8 +-
 .../modules/auth/{ => totps}/helpers/totps.ts |   0
 backend/src/modules/auth/totps/routes.ts      |   6 +-
 backend/src/modules/me/handlers.ts            |   8 +-
 .../src/modules/me/helpers/get-sessions.ts    |   2 +-
 backend/src/modules/memberships/routes.ts     |   2 +-
 backend/src/modules/system/handlers.ts        |   2 +-
 .../src/utils/get-valid-single-use-token.ts   |   6 +-
 backend/src/utils/get-valid-token.ts          |   6 +-
 backend/tests/helpers.ts                      |   2 +-
 config/default.ts                             |   2 +-
 frontend/src/api.gen/sdk.gen.ts               | 116 +++++++++---------
 frontend/src/api.gen/types.gen.ts             |   4 +-
 frontend/src/api.gen/zod.gen.ts               |   4 +-
 .../src/modules/auth/create-password-form.tsx |   4 +-
 locales/en/errors.json                        |  30 ++---
 37 files changed, 165 insertions(+), 163 deletions(-)
 rename backend/src/modules/auth/{ => general}/helpers/cookie.ts (98%)
 rename backend/src/modules/auth/{ => general}/helpers/device-info.ts (100%)
 rename backend/src/modules/auth/{ => general}/helpers/mfa.ts (86%)
 rename backend/src/modules/auth/{ => general}/helpers/send-verification-email.ts (95%)
 rename backend/src/modules/auth/{ => general}/helpers/session.ts (97%)
 rename backend/src/modules/auth/{ => general}/helpers/user.ts (100%)
 rename backend/src/modules/auth/{ => passkeys}/helpers/passkey.ts (100%)
 rename backend/src/modules/auth/{ => passwords}/helpers/argon2id.ts (96%)
 rename backend/src/modules/auth/{ => passwords}/helpers/handle-email-verification.ts (93%)
 rename backend/src/modules/auth/{ => totps}/helpers/totps.ts (100%)

diff --git a/backend/scripts/seeds/organizations/seed.ts b/backend/scripts/seeds/organizations/seed.ts
index 01fa073f3..34b34b10d 100644
--- a/backend/scripts/seeds/organizations/seed.ts
+++ b/backend/scripts/seeds/organizations/seed.ts
@@ -8,7 +8,7 @@ import { OrganizationModel, organizationsTable } from '#/db/schema/organizations
 import { passwordsTable } from '#/db/schema/passwords';
 import { unsubscribeTokensTable } from '#/db/schema/unsubscribe-tokens';
 import { UserModel, usersTable } from '#/db/schema/users';
-import { hashPassword } from '#/modules/auth/helpers/argon2id';
+import { hashPassword } from '#/modules/auth/passwords/helpers/argon2id';
 import { getMembershipOrderOffset, mockEmail, mockMany, mockOrganization, mockOrganizationMembership, mockPassword, mockUnsubscribeToken, mockUser } from '../../../mocks/basic';
 import { defaultAdminUser } from '../fixtures';
 import { isOrganizationSeeded as isAlreadySeeded } from '../utils';
diff --git a/backend/scripts/seeds/user/seed.ts b/backend/scripts/seeds/user/seed.ts
index 762da3c1b..9e7bd3115 100644
--- a/backend/scripts/seeds/user/seed.ts
+++ b/backend/scripts/seeds/user/seed.ts
@@ -3,7 +3,7 @@ import { emailsTable } from '#/db/schema/emails';
 import { passwordsTable } from '#/db/schema/passwords';
 import { unsubscribeTokensTable } from '#/db/schema/unsubscribe-tokens';
 import { usersTable } from '#/db/schema/users';
-import { hashPassword } from '#/modules/auth/helpers/argon2id';
+import { hashPassword } from '#/modules/auth/passwords/helpers/argon2id';
 import chalk from 'chalk';
 import { appConfig } from 'config';
 import { mockAdmin, mockEmail, mockPassword, mockUnsubscribeToken } from '../../../mocks/basic';
diff --git a/backend/src/middlewares/guard/is-authenticated.ts b/backend/src/middlewares/guard/is-authenticated.ts
index b1e8f12d8..89ba7f026 100644
--- a/backend/src/middlewares/guard/is-authenticated.ts
+++ b/backend/src/middlewares/guard/is-authenticated.ts
@@ -8,8 +8,8 @@ import { usersTable } from '#/db/schema/users';
 import type { Env } from '#/lib/context';
 import { AppError } from '#/lib/errors';
 import { registerMiddlewareDescription } from '#/lib/openapi-describer';
-import { deleteAuthCookie } from '#/modules/auth/helpers/cookie';
-import { getParsedSessionCookie, validateSession } from '#/modules/auth/helpers/session';
+import { deleteAuthCookie } from '#/modules/auth/general/helpers/cookie';
+import { getParsedSessionCookie, validateSession } from '#/modules/auth/general/helpers/session';
 import { membershipBaseSelect } from '#/modules/memberships/helpers/select';
 import { TimeSpan } from '#/utils/time-span';
 
diff --git a/backend/src/middlewares/has-valid-single-use-token.ts b/backend/src/middlewares/has-valid-single-use-token.ts
index 8ed57cef0..615891ac5 100644
--- a/backend/src/middlewares/has-valid-single-use-token.ts
+++ b/backend/src/middlewares/has-valid-single-use-token.ts
@@ -3,7 +3,7 @@ import type { MiddlewareHandler } from 'hono';
 import { createMiddleware } from 'hono/factory';
 import type { Env } from '#/lib/context';
 import { AppError } from '#/lib/errors';
-import { deleteAuthCookie } from '#/modules/auth/helpers/cookie';
+import { deleteAuthCookie } from '#/modules/auth/general/helpers/cookie';
 import { getValidSingleUseToken } from '#/utils/get-valid-single-use-token';
 
 /**
diff --git a/backend/src/modules/auth/general/handlers.ts b/backend/src/modules/auth/general/handlers.ts
index e708795e0..7372d0b63 100644
--- a/backend/src/modules/auth/general/handlers.ts
+++ b/backend/src/modules/auth/general/handlers.ts
@@ -9,9 +9,9 @@ import { tokensTable } from '#/db/schema/tokens';
 import { usersTable } from '#/db/schema/users';
 import { type Env, getContextUser } from '#/lib/context';
 import { AppError } from '#/lib/errors';
-import { deleteAuthCookie, getAuthCookie, setAuthCookie } from '#/modules/auth/helpers/cookie';
-import { handleEmailVerification } from '#/modules/auth/helpers/handle-email-verification';
-import { getParsedSessionCookie, setUserSession, validateSession } from '#/modules/auth/helpers/session';
+import { deleteAuthCookie, getAuthCookie, setAuthCookie } from '#/modules/auth/general/helpers/cookie';
+import { getParsedSessionCookie, setUserSession, validateSession } from '#/modules/auth/general/helpers/session';
+import { handleEmailVerification } from '#/modules/auth/passwords/helpers/handle-email-verification';
 import { usersBaseQuery } from '#/modules/users/helpers/select';
 import { defaultHook } from '#/utils/default-hook';
 import { getValidToken } from '#/utils/get-valid-token';
@@ -74,17 +74,17 @@ const authGeneralRouteHandlers = app
     await setAuthCookie(ctx, tokenRecord.type, tokenRecord.singleUseToken, new TimeSpan(10, 'm'));
 
     // If verification email, we process it immediately and redirect to app
-    if (tokenRecord.type === 'email_verification') return handleEmailVerification(ctx, tokenRecord);
+    if (tokenRecord.type === 'email-verification') return handleEmailVerification(ctx, tokenRecord);
 
     // If oauth verification, we redirect to oauth /verify route to complete verification though oauth provider
-    if (tokenRecord.type === 'oauth_verification') return handleOAuthVerification(ctx, tokenRecord);
+    if (tokenRecord.type === 'oauth-verification') return handleOAuthVerification(ctx, tokenRecord);
 
     // Determine redirect URL based on token type
     let redirectUrl = appConfig.defaultRedirectPath;
 
     if (tokenRecord.type === 'invitation') redirectUrl = `${appConfig.frontendUrl}/auth/authenticate?tokenId=${tokenRecord.id}`;
 
-    if (tokenRecord.type === 'password_reset') redirectUrl = `${appConfig.frontendUrl}/auth/create-password/${tokenRecord.id}`;
+    if (tokenRecord.type === 'password-reset') redirectUrl = `${appConfig.frontendUrl}/auth/create-password/${tokenRecord.id}`;
 
     logEvent('info', 'Token invoked, redirecting with single use token in cookie', { tokenId: tokenRecord.id, userId: tokenRecord.userId });
 
@@ -184,11 +184,11 @@ const authGeneralRouteHandlers = app
    * Sign out
    */
   .openapi(authGeneralRoutes.signOut, async (ctx) => {
-    const confirmMfa = await getAuthCookie(ctx, 'confirm_mfa');
+    const confirmMfa = await getAuthCookie(ctx, 'confirm-mfa');
 
     if (confirmMfa) {
       // Delete mfa cookie
-      deleteAuthCookie(ctx, 'confirm_mfa');
+      deleteAuthCookie(ctx, 'confirm-mfa');
 
       logEvent('info', 'User mfa canceled');
 
diff --git a/backend/src/modules/auth/helpers/cookie.ts b/backend/src/modules/auth/general/helpers/cookie.ts
similarity index 98%
rename from backend/src/modules/auth/helpers/cookie.ts
rename to backend/src/modules/auth/general/helpers/cookie.ts
index 3534aa426..4ff0343dd 100644
--- a/backend/src/modules/auth/helpers/cookie.ts
+++ b/backend/src/modules/auth/general/helpers/cookie.ts
@@ -4,7 +4,7 @@ import { deleteCookie, getCookie, getSignedCookie, setCookie, setSignedCookie }
 import type { CookieOptions } from 'hono/utils/cookie';
 import { Env } from '#/lib/context';
 import type { TimeSpan } from '#/utils/time-span';
-import { env } from '../../../env';
+import { env } from '../../../../env';
 
 const isProduction = appConfig.mode === 'production';
 
diff --git a/backend/src/modules/auth/helpers/device-info.ts b/backend/src/modules/auth/general/helpers/device-info.ts
similarity index 100%
rename from backend/src/modules/auth/helpers/device-info.ts
rename to backend/src/modules/auth/general/helpers/device-info.ts
diff --git a/backend/src/modules/auth/helpers/mfa.ts b/backend/src/modules/auth/general/helpers/mfa.ts
similarity index 86%
rename from backend/src/modules/auth/helpers/mfa.ts
rename to backend/src/modules/auth/general/helpers/mfa.ts
index 6de5004c8..4790bd05d 100644
--- a/backend/src/modules/auth/helpers/mfa.ts
+++ b/backend/src/modules/auth/general/helpers/mfa.ts
@@ -5,7 +5,7 @@ import { tokensTable } from '#/db/schema/tokens';
 import { type UserModel, usersTable } from '#/db/schema/users';
 import { Env } from '#/lib/context';
 import { AppError } from '#/lib/errors';
-import { deleteAuthCookie, getAuthCookie, setAuthCookie } from '#/modules/auth/helpers/cookie';
+import { deleteAuthCookie, getAuthCookie, setAuthCookie } from '#/modules/auth/general/helpers/cookie';
 import { usersBaseQuery } from '#/modules/users/helpers/select';
 import { getValidToken } from '#/utils/get-valid-token';
 import { nanoid } from '#/utils/nanoid';
@@ -30,7 +30,7 @@ export const initiateMfa = async (ctx: Context<Env>, user: UserModel) => {
     .insert(tokensTable)
     .values({
       token: nanoid(40),
-      type: 'confirm_mfa',
+      type: 'confirm-mfa',
       userId: user.id,
       email: user.email,
       createdBy: user.id,
@@ -39,7 +39,7 @@ export const initiateMfa = async (ctx: Context<Env>, user: UserModel) => {
     .returning({ token: tokensTable.id });
 
   // Set a temporary auth cookie to track confirm MFA session
-  await setAuthCookie(ctx, 'confirm_mfa', generatedTokenId, timespan);
+  await setAuthCookie(ctx, 'confirm-mfa', generatedTokenId, timespan);
 
   // Return the path to redirect the user to MFA confirmation page
   return '/auth/authenticate/mfa-confirmation';
@@ -54,11 +54,11 @@ export const initiateMfa = async (ctx: Context<Env>, user: UserModel) => {
  */
 export const validateConfirmMfaToken = async (ctx: Context<Env>): Promise<UserModel> => {
   // TODO should be token itself, Get token ID from cookie
-  const tokenIdFromCookie = await getAuthCookie(ctx, 'confirm_mfa');
-  if (!tokenIdFromCookie) throw new AppError({ status: 401, type: 'confirm_mfa_not_found', severity: 'error' });
+  const tokenIdFromCookie = await getAuthCookie(ctx, 'confirm-mfa');
+  if (!tokenIdFromCookie) throw new AppError({ status: 401, type: 'confirm-mfa_not_found', severity: 'error' });
 
   // Fetch token record and associated user
-  const tokenRecord = await getValidToken({ ctx, token: tokenIdFromCookie, invokeToken: false, tokenType: 'confirm_mfa' });
+  const tokenRecord = await getValidToken({ ctx, token: tokenIdFromCookie, invokeToken: false, tokenType: 'confirm-mfa' });
 
   // Sanity check
   if (!tokenRecord.userId) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error' });
@@ -70,12 +70,12 @@ export const validateConfirmMfaToken = async (ctx: Context<Env>): Promise<UserMo
 };
 
 /**
- * Consumes the MFA token stored in the 'confirm_mfa' cookie.
+ * Consumes the MFA token stored in the 'confirm-mfa' cookie.
  * Marks it as used in the database and deletes the cookie.
  */
 // TODO shouldnt this use getValidToken for consistency? Or be a middleware?
 export const consumeMfaToken = async (ctx: Context<Env>): Promise<void> => {
-  const tokenIdFromCookie = await getAuthCookie(ctx, 'confirm_mfa');
+  const tokenIdFromCookie = await getAuthCookie(ctx, 'confirm-mfa');
   if (!tokenIdFromCookie) return;
 
   const [tokenRecord] = await db.select().from(tokensTable).where(eq(tokensTable.id, tokenIdFromCookie)).limit(1);
@@ -85,5 +85,5 @@ export const consumeMfaToken = async (ctx: Context<Env>): Promise<void> => {
   await db.update(tokensTable).set({ invokedAt: new Date() }).where(eq(tokensTable.id, tokenRecord.id));
 
   // Delete cookie
-  deleteAuthCookie(ctx, 'confirm_mfa');
+  deleteAuthCookie(ctx, 'confirm-mfa');
 };
diff --git a/backend/src/modules/auth/helpers/send-verification-email.ts b/backend/src/modules/auth/general/helpers/send-verification-email.ts
similarity index 95%
rename from backend/src/modules/auth/helpers/send-verification-email.ts
rename to backend/src/modules/auth/general/helpers/send-verification-email.ts
index d7d74a2f3..7e85344bc 100644
--- a/backend/src/modules/auth/helpers/send-verification-email.ts
+++ b/backend/src/modules/auth/general/helpers/send-verification-email.ts
@@ -12,8 +12,8 @@ import { usersBaseQuery } from '#/modules/users/helpers/select';
 import { logEvent } from '#/utils/logger';
 import { nanoid } from '#/utils/nanoid';
 import { createDate, TimeSpan } from '#/utils/time-span';
-import { EmailVerificationEmail, type EmailVerificationEmailProps } from '../../../../emails/email-verification';
-import { OAuthVerificationEmail, OAuthVerificationEmailProps } from '../../../../emails/oauth-verification';
+import { EmailVerificationEmail, type EmailVerificationEmailProps } from '../../../../../emails/email-verification';
+import { OAuthVerificationEmail, OAuthVerificationEmailProps } from '../../../../../emails/oauth-verification';
 
 interface Props {
   userId: string;
@@ -54,7 +54,7 @@ export const sendVerificationEmail = async ({ userId, oauthAccountId, redirectPa
       and(
         ...[
           eq(tokensTable.userId, user.id),
-          eq(tokensTable.type, 'email_verification'),
+          eq(tokensTable.type, 'email-verification'),
           ...(oauthAccountId ? [eq(tokensTable.oauthAccountId, oauthAccountId)] : []),
         ],
       ),
@@ -68,7 +68,7 @@ export const sendVerificationEmail = async ({ userId, oauthAccountId, redirectPa
     .insert(tokensTable)
     .values({
       token,
-      type: 'email_verification',
+      type: 'email-verification',
       userId: user.id,
       email,
       createdBy: user.id,
diff --git a/backend/src/modules/auth/helpers/session.ts b/backend/src/modules/auth/general/helpers/session.ts
similarity index 97%
rename from backend/src/modules/auth/helpers/session.ts
rename to backend/src/modules/auth/general/helpers/session.ts
index 28b89ee6d..272310344 100644
--- a/backend/src/modules/auth/helpers/session.ts
+++ b/backend/src/modules/auth/general/helpers/session.ts
@@ -7,8 +7,8 @@ import { type UserModel, usersTable } from '#/db/schema/users';
 import { env } from '#/env';
 import { Env, getContextUser } from '#/lib/context';
 import { AppError } from '#/lib/errors';
-import { deleteAuthCookie, getAuthCookie, setAuthCookie } from '#/modules/auth/helpers/cookie';
-import { deviceInfo } from '#/modules/auth/helpers/device-info';
+import { deleteAuthCookie, getAuthCookie, setAuthCookie } from '#/modules/auth/general/helpers/cookie';
+import { deviceInfo } from '#/modules/auth/general/helpers/device-info';
 import { userSelect } from '#/modules/users/helpers/select';
 import { getIp } from '#/utils/get-ip';
 import { isExpiredDate } from '#/utils/is-expired-date';
diff --git a/backend/src/modules/auth/helpers/user.ts b/backend/src/modules/auth/general/helpers/user.ts
similarity index 100%
rename from backend/src/modules/auth/helpers/user.ts
rename to backend/src/modules/auth/general/helpers/user.ts
diff --git a/backend/src/modules/auth/oauth/handlers.ts b/backend/src/modules/auth/oauth/handlers.ts
index 42c12de32..5fdb0efde 100644
--- a/backend/src/modules/auth/oauth/handlers.ts
+++ b/backend/src/modules/auth/oauth/handlers.ts
@@ -4,7 +4,7 @@ import { appConfig, type EnabledOAuthProvider } from 'config';
 import { env } from '#/env';
 import { type Env } from '#/lib/context';
 import { AppError } from '#/lib/errors';
-import { getAuthCookie } from '#/modules/auth/helpers/cookie';
+import { getAuthCookie } from '#/modules/auth/general/helpers/cookie';
 import { handleOAuthCallback } from '#/modules/auth/oauth/helpers/callback';
 import { handleOAuthInitiation, type OAuthCookiePayload } from '#/modules/auth/oauth/helpers/initiation';
 import {
diff --git a/backend/src/modules/auth/oauth/helpers/callback.ts b/backend/src/modules/auth/oauth/helpers/callback.ts
index f697a7e5f..71ea0d4c5 100644
--- a/backend/src/modules/auth/oauth/helpers/callback.ts
+++ b/backend/src/modules/auth/oauth/helpers/callback.ts
@@ -8,11 +8,11 @@ import type { TokenModel } from '#/db/schema/tokens';
 import { type UserModel, usersTable } from '#/db/schema/users';
 import { Env } from '#/lib/context';
 import { AppError } from '#/lib/errors';
-import { getAuthCookie } from '#/modules/auth/helpers/cookie';
-import { initiateMfa } from '#/modules/auth/helpers/mfa';
-import { sendVerificationEmail } from '#/modules/auth/helpers/send-verification-email';
-import { setUserSession } from '#/modules/auth/helpers/session';
-import { handleCreateUser } from '#/modules/auth/helpers/user';
+import { getAuthCookie } from '#/modules/auth/general/helpers/cookie';
+import { initiateMfa } from '#/modules/auth/general/helpers/mfa';
+import { sendVerificationEmail } from '#/modules/auth/general/helpers/send-verification-email';
+import { setUserSession } from '#/modules/auth/general/helpers/session';
+import { handleCreateUser } from '#/modules/auth/general/helpers/user';
 import type { OAuthCookiePayload } from '#/modules/auth/oauth/helpers/initiation';
 import type { Provider } from '#/modules/auth/oauth/helpers/providers';
 import type { TransformedUser } from '#/modules/auth/oauth/helpers/transform-user-data';
@@ -198,7 +198,7 @@ const verifyCallbackFlow = async (
     ctx,
     token,
     invokeToken: false,
-    tokenType: 'email_verification',
+    tokenType: 'email-verification',
     isRedirect: true,
   });
 
@@ -207,7 +207,7 @@ const verifyCallbackFlow = async (
 
   // Invalid token settings → invalid verification
   if (
-    verifyToken.type !== 'email_verification' ||
+    verifyToken.type !== 'email-verification' ||
     verifyToken.email !== providerUser.email ||
     verifyToken.oauthAccountId !== oauthAccount.id ||
     oauthAccount.provider !== provider
diff --git a/backend/src/modules/auth/oauth/helpers/initiation.ts b/backend/src/modules/auth/oauth/helpers/initiation.ts
index 3b664d559..bee302b6b 100644
--- a/backend/src/modules/auth/oauth/helpers/initiation.ts
+++ b/backend/src/modules/auth/oauth/helpers/initiation.ts
@@ -2,8 +2,8 @@ import { appConfig } from 'config';
 import type { Context } from 'hono';
 import { Env } from '#/lib/context';
 import { AppError } from '#/lib/errors';
-import { getAuthCookie, setAuthCookie } from '#/modules/auth/helpers/cookie';
-import { getParsedSessionCookie, validateSession } from '#/modules/auth/helpers/session';
+import { getAuthCookie, setAuthCookie } from '#/modules/auth/general/helpers/cookie';
+import { getParsedSessionCookie, validateSession } from '#/modules/auth/general/helpers/session';
 import { getValidToken } from '#/utils/get-valid-token';
 import { isValidRedirectPath } from '#/utils/is-redirect-url';
 import { logEvent } from '#/utils/logger';
@@ -171,14 +171,12 @@ const prepareOAuthConnect = async (ctx: Context<Env>) => {
  * @throws AppError if missing or invalid token
  */
 const prepareOAuthVerify = async (ctx: Context<Env>) => {
-  const token = await getAuthCookie(ctx, 'email_verification');
+  const token = await getAuthCookie(ctx, 'email-verification');
   // Must provide a token
   if (!token) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error', isRedirect: true });
 
-  // TODO split in different endpoints when you are returning for second time, you get "Token is invalid" because it was invoked already
-  //   then we need to get singleUUseToken here or somehow divert to another FileDownloadableLink, i
-
-  const tokenRecord = await getValidToken({ ctx, token, invokeToken: false, isRedirect: true, tokenType: 'email_verification' });
+  // Get token or single use token.
+  const tokenRecord = await getValidToken({ ctx, token, invokeToken: false, isRedirect: true, tokenType: 'email-verification' });
 
   // If entityType exists, proceed to invitation flow
   const redirectPath = tokenRecord.entityType
diff --git a/backend/src/modules/auth/passkeys/handlers.ts b/backend/src/modules/auth/passkeys/handlers.ts
index 85b65de5d..8e1811c14 100644
--- a/backend/src/modules/auth/passkeys/handlers.ts
+++ b/backend/src/modules/auth/passkeys/handlers.ts
@@ -10,14 +10,14 @@ import { totpsTable } from '#/db/schema/totps';
 import { type UserModel, usersTable } from '#/db/schema/users';
 import { type Env, getContextUser } from '#/lib/context';
 import { AppError } from '#/lib/errors';
-import { getAuthCookie, setAuthCookie } from '#/modules/auth/helpers/cookie';
-import { consumeMfaToken, validateConfirmMfaToken } from '#/modules/auth/helpers/mfa';
-import { parseAndValidatePasskeyAttestation, verifyPassKeyPublic } from '#/modules/auth/helpers/passkey';
-import { setUserSession } from '#/modules/auth/helpers/session';
+import { getAuthCookie, setAuthCookie } from '#/modules/auth/general/helpers/cookie';
+import { consumeMfaToken, validateConfirmMfaToken } from '#/modules/auth/general/helpers/mfa';
+import { setUserSession } from '#/modules/auth/general/helpers/session';
+import { parseAndValidatePasskeyAttestation, verifyPassKeyPublic } from '#/modules/auth/passkeys/helpers/passkey';
 import { usersBaseQuery } from '#/modules/users/helpers/select';
 import { defaultHook } from '#/utils/default-hook';
 import { TimeSpan } from '#/utils/time-span';
-import { deviceInfo } from '../helpers/device-info';
+import { deviceInfo } from '../general/helpers/device-info';
 import authPasskeysRoutes from './routes';
 
 const enabledStrategies: readonly string[] = appConfig.enabledAuthStrategies;
diff --git a/backend/src/modules/auth/helpers/passkey.ts b/backend/src/modules/auth/passkeys/helpers/passkey.ts
similarity index 100%
rename from backend/src/modules/auth/helpers/passkey.ts
rename to backend/src/modules/auth/passkeys/helpers/passkey.ts
diff --git a/backend/src/modules/auth/passkeys/routes.ts b/backend/src/modules/auth/passkeys/routes.ts
index 379ae3462..29dff3e0b 100644
--- a/backend/src/modules/auth/passkeys/routes.ts
+++ b/backend/src/modules/auth/passkeys/routes.ts
@@ -33,7 +33,7 @@ const authPasskeysRoutes = {
     method: 'post',
     path: '/passkey',
     guard: isAuthenticated,
-    tags: ['me'],
+    tags: ['auth'],
     summary: 'Create passkey',
     description:
       'Register a passkey for passwordless authentication by verifying a signed challenge and linking it to the *current user*. Multiple passkeys can be created for different devices/browsers.',
@@ -58,7 +58,7 @@ const authPasskeysRoutes = {
     method: 'delete',
     path: '/passkey/{id}',
     guard: isAuthenticated,
-    tags: ['me'],
+    tags: ['auth'],
     summary: 'Delete passkey',
     description: 'Delete a passkey by id from the *current user*.',
     security: [],
diff --git a/backend/src/modules/auth/passwords/handlers.ts b/backend/src/modules/auth/passwords/handlers.ts
index 41e789f72..4a0073cef 100644
--- a/backend/src/modules/auth/passwords/handlers.ts
+++ b/backend/src/modules/auth/passwords/handlers.ts
@@ -11,10 +11,10 @@ import { usersTable } from '#/db/schema/users';
 import { type Env, getContextToken } from '#/lib/context';
 import { AppError } from '#/lib/errors';
 import { mailer } from '#/lib/mailer';
-import { hashPassword, verifyPasswordHash } from '#/modules/auth/helpers/argon2id';
-import { initiateMfa } from '#/modules/auth/helpers/mfa';
-import { sendVerificationEmail } from '#/modules/auth/helpers/send-verification-email';
-import { setUserSession } from '#/modules/auth/helpers/session';
+import { initiateMfa } from '#/modules/auth/general/helpers/mfa';
+import { sendVerificationEmail } from '#/modules/auth/general/helpers/send-verification-email';
+import { setUserSession } from '#/modules/auth/general/helpers/session';
+import { hashPassword, verifyPasswordHash } from '#/modules/auth/passwords/helpers/argon2id';
 import { membershipBaseSelect } from '#/modules/memberships/helpers/select';
 import { usersBaseQuery } from '#/modules/users/helpers/select';
 import { defaultHook } from '#/utils/default-hook';
@@ -24,8 +24,8 @@ import { nanoid } from '#/utils/nanoid';
 import { slugFromEmail } from '#/utils/slug-from-email';
 import { createDate, TimeSpan } from '#/utils/time-span';
 import { CreatePasswordEmail, type CreatePasswordEmailProps } from '../../../../emails/create-password';
-import { handleEmailVerification } from '../helpers/handle-email-verification';
-import { handleCreateUser } from '../helpers/user';
+import { handleCreateUser } from '../general/helpers/user';
+import { handleEmailVerification } from './helpers/handle-email-verification';
 import authPasswordsRoutes from './routes';
 
 const enabledStrategies: readonly string[] = appConfig.enabledAuthStrategies;
@@ -138,14 +138,14 @@ const authPasswordsRouteHandlers = app
     if (!user) throw new AppError({ status: 404, type: 'invalid_email', severity: 'warn', entityType: 'user' });
 
     // Delete old token if exists
-    await db.delete(tokensTable).where(and(eq(tokensTable.userId, user.id), eq(tokensTable.type, 'password_reset')));
+    await db.delete(tokensTable).where(and(eq(tokensTable.userId, user.id), eq(tokensTable.type, 'password-reset')));
 
     // TODO hash token
     const [tokenRecord] = await db
       .insert(tokensTable)
       .values({
         token: nanoid(40),
-        type: 'password_reset',
+        type: 'password-reset',
         userId: user.id,
         email,
         createdBy: user.id,
diff --git a/backend/src/modules/auth/helpers/argon2id.ts b/backend/src/modules/auth/passwords/helpers/argon2id.ts
similarity index 96%
rename from backend/src/modules/auth/helpers/argon2id.ts
rename to backend/src/modules/auth/passwords/helpers/argon2id.ts
index 30243cd8a..15ba8246b 100644
--- a/backend/src/modules/auth/helpers/argon2id.ts
+++ b/backend/src/modules/auth/passwords/helpers/argon2id.ts
@@ -1,5 +1,5 @@
 import { hash, verify } from '@node-rs/argon2';
-import { env } from '../../../env';
+import { env } from '../../../../env';
 /**
  * Hashes a password using argon2id with a secret for enhanced security.
  * https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#argon2id
diff --git a/backend/src/modules/auth/helpers/handle-email-verification.ts b/backend/src/modules/auth/passwords/helpers/handle-email-verification.ts
similarity index 93%
rename from backend/src/modules/auth/helpers/handle-email-verification.ts
rename to backend/src/modules/auth/passwords/helpers/handle-email-verification.ts
index 704c5018f..4e1e1c334 100644
--- a/backend/src/modules/auth/helpers/handle-email-verification.ts
+++ b/backend/src/modules/auth/passwords/helpers/handle-email-verification.ts
@@ -9,8 +9,8 @@ import { Env } from '#/lib/context';
 import { AppError } from '#/lib/errors';
 import { usersBaseQuery } from '#/modules/users/helpers/select';
 import { getIsoDate } from '#/utils/iso-date';
-import { initiateMfa } from './mfa';
-import { setUserSession } from './session';
+import { initiateMfa } from '../../general/helpers/mfa';
+import { setUserSession } from '../../general/helpers/session';
 
 export const handleEmailVerification = async (ctx: Context<Env>, token: TokenModel) => {
   // Token requires userId
diff --git a/backend/src/modules/auth/passwords/routes.ts b/backend/src/modules/auth/passwords/routes.ts
index e14a7abf7..d7692b895 100644
--- a/backend/src/modules/auth/passwords/routes.ts
+++ b/backend/src/modules/auth/passwords/routes.ts
@@ -68,7 +68,7 @@ const authPasswordsRoutes = {
     method: 'get',
     path: '/verify-email/{tokenId}',
     guard: isPublicAccess,
-    middleware: [tokenLimiter('email_verification'), hasValidSingleUseToken('email_verification')],
+    middleware: [tokenLimiter('email-verification'), hasValidSingleUseToken('email-verification')],
     tags: ['auth'],
     summary: 'Verify email by token',
     description: "Verifies a user's email using a single-use session token in cookie. Grants a session upon success.",
@@ -113,7 +113,7 @@ const authPasswordsRoutes = {
     method: 'post',
     path: '/create-password/{tokenId}',
     guard: isPublicAccess,
-    middleware: [tokenLimiter('password_reset'), hasValidSingleUseToken('password_reset')],
+    middleware: [tokenLimiter('password-reset'), hasValidSingleUseToken('password-reset')],
     tags: ['auth'],
     summary: 'Create password',
     description: 'Sets a new password using a single-use session token in cookie and grants a session immediately upon success.',
diff --git a/backend/src/modules/auth/totps/handlers.ts b/backend/src/modules/auth/totps/handlers.ts
index d4e1414a4..b6eff4e11 100644
--- a/backend/src/modules/auth/totps/handlers.ts
+++ b/backend/src/modules/auth/totps/handlers.ts
@@ -9,12 +9,12 @@ import { totpsTable } from '#/db/schema/totps';
 import { usersTable } from '#/db/schema/users';
 import { type Env, getContextUser } from '#/lib/context';
 import { AppError } from '#/lib/errors';
-import { consumeMfaToken, validateConfirmMfaToken } from '#/modules/auth/helpers/mfa';
-import { setUserSession } from '#/modules/auth/helpers/session';
-import { signInWithTotp } from '#/modules/auth/helpers/totps';
+import { consumeMfaToken, validateConfirmMfaToken } from '#/modules/auth/general/helpers/mfa';
+import { setUserSession } from '#/modules/auth/general/helpers/session';
+import { signInWithTotp } from '#/modules/auth/totps/helpers/totps';
 import { defaultHook } from '#/utils/default-hook';
 import { TimeSpan } from '#/utils/time-span';
-import { getAuthCookie, setAuthCookie } from '../helpers/cookie';
+import { getAuthCookie, setAuthCookie } from '../general/helpers/cookie';
 import authTotpRoutes from './routes';
 import authTotpsRoutes from './routes';
 
diff --git a/backend/src/modules/auth/helpers/totps.ts b/backend/src/modules/auth/totps/helpers/totps.ts
similarity index 100%
rename from backend/src/modules/auth/helpers/totps.ts
rename to backend/src/modules/auth/totps/helpers/totps.ts
diff --git a/backend/src/modules/auth/totps/routes.ts b/backend/src/modules/auth/totps/routes.ts
index 3f9488143..43ad5de02 100644
--- a/backend/src/modules/auth/totps/routes.ts
+++ b/backend/src/modules/auth/totps/routes.ts
@@ -12,7 +12,7 @@ const authTotpsRoutes = {
     method: 'post',
     path: '/totp/register',
     guard: isAuthenticated,
-    tags: ['me'],
+    tags: ['auth'],
     summary: 'Create TOTP challenge',
     description: 'Generates a new TOTP challenge for current user and returns a provisioning URI and Base32 manual key.',
     security: [],
@@ -30,7 +30,7 @@ const authTotpsRoutes = {
     method: 'post',
     path: '/totp/activate',
     guard: isAuthenticated,
-    tags: ['me'],
+    tags: ['auth'],
     summary: 'Activate TOTP',
     description:
       'Confirms TOTP setup by verifying a code from the authenticator app for the first time. On success, TOTP is registered for current user.',
@@ -56,7 +56,7 @@ const authTotpsRoutes = {
     method: 'delete',
     path: '/totp',
     guard: isAuthenticated,
-    tags: ['me'],
+    tags: ['auth'],
     summary: 'Delete TOTP',
     description: 'Delete TOTP credential for current user.',
     security: [],
diff --git a/backend/src/modules/me/handlers.ts b/backend/src/modules/me/handlers.ts
index fd2036448..88a5484fe 100644
--- a/backend/src/modules/me/handlers.ts
+++ b/backend/src/modules/me/handlers.ts
@@ -19,10 +19,10 @@ import { resolveEntity } from '#/lib/entity';
 import { AppError } from '#/lib/errors';
 import { getParams, getSignature } from '#/lib/transloadit';
 import { isAuthenticated } from '#/middlewares/guard';
-import { deleteAuthCookie, getAuthCookie } from '#/modules/auth/helpers/cookie';
-import { verifyPassKeyPublic } from '#/modules/auth/helpers/passkey';
-import { getParsedSessionCookie, setUserSession, validateSession } from '#/modules/auth/helpers/session';
-import { signInWithTotp } from '#/modules/auth/helpers/totps';
+import { deleteAuthCookie, getAuthCookie } from '#/modules/auth/general/helpers/cookie';
+import { getParsedSessionCookie, setUserSession, validateSession } from '#/modules/auth/general/helpers/session';
+import { verifyPassKeyPublic } from '#/modules/auth/passkeys/helpers/passkey';
+import { signInWithTotp } from '#/modules/auth/totps/helpers/totps';
 import { checkSlugAvailable } from '#/modules/entities/helpers/check-slug';
 import { getUserSessions } from '#/modules/me/helpers/get-sessions';
 import { getUserMenuEntities } from '#/modules/me/helpers/get-user-menu-entities';
diff --git a/backend/src/modules/me/helpers/get-sessions.ts b/backend/src/modules/me/helpers/get-sessions.ts
index 12778079a..c42ee6048 100644
--- a/backend/src/modules/me/helpers/get-sessions.ts
+++ b/backend/src/modules/me/helpers/get-sessions.ts
@@ -4,7 +4,7 @@ import type { Context } from 'hono';
 import { db } from '#/db/db';
 import { sessionsTable } from '#/db/schema/sessions';
 import { Env } from '#/lib/context';
-import { getParsedSessionCookie } from '#/modules/auth/helpers/session';
+import { getParsedSessionCookie } from '#/modules/auth/general/helpers/session';
 import type { sessionSchema } from '#/modules/me/schema';
 
 /**
diff --git a/backend/src/modules/memberships/routes.ts b/backend/src/modules/memberships/routes.ts
index 5480e4363..60fb50f29 100644
--- a/backend/src/modules/memberships/routes.ts
+++ b/backend/src/modules/memberships/routes.ts
@@ -104,7 +104,7 @@ const membershipRoutes = {
     method: 'post',
     path: '/{id}/{acceptOrReject}',
     guard: isAuthenticated,
-    tags: ['auth'],
+    tags: ['membership'],
     summary: 'Accept invitation',
     // TODO reject flow needs to be added
     description: 'Accepting activates the associated membership. Rejecting adds a rejectedAt timestamp.',
diff --git a/backend/src/modules/system/handlers.ts b/backend/src/modules/system/handlers.ts
index 314f1a1fb..ba36276ff 100644
--- a/backend/src/modules/system/handlers.ts
+++ b/backend/src/modules/system/handlers.ts
@@ -26,7 +26,7 @@ import { slugFromEmail } from '#/utils/slug-from-email';
 import { createDate, TimeSpan } from '#/utils/time-span';
 import { NewsletterEmail, type NewsletterEmailProps } from '../../../emails/newsletter';
 import { SystemInviteEmail, type SystemInviteEmailProps } from '../../../emails/system-invite';
-import { getParsedSessionCookie, validateSession } from '../auth/helpers/session';
+import { getParsedSessionCookie, validateSession } from '../auth/general/helpers/session';
 
 const paddle = new Paddle(env.PADDLE_API_KEY || '');
 
diff --git a/backend/src/utils/get-valid-single-use-token.ts b/backend/src/utils/get-valid-single-use-token.ts
index 704a90f1a..00462e356 100644
--- a/backend/src/utils/get-valid-single-use-token.ts
+++ b/backend/src/utils/get-valid-single-use-token.ts
@@ -4,7 +4,7 @@ import { Context } from 'hono';
 import { db } from '#/db/db';
 import { type TokenModel, tokensTable } from '#/db/schema/tokens';
 import { AppError } from '#/lib/errors';
-import { getAuthCookie } from '#/modules/auth/helpers/cookie';
+import { getAuthCookie } from '#/modules/auth/general/helpers/cookie';
 
 type BaseProps = {
   ctx: Context;
@@ -14,7 +14,7 @@ type BaseProps = {
  * Validates a single use token by its value, ensuring it matches the required type.
  *
  * @param ctx - Hono context
- * @param tokenType (optional) The required type of the token (e.g., 'password_reset', 'email_verification').
+ * @param tokenType (optional) The required type of the token (e.g., 'password-reset', 'email-verification').
  * @returns The valid single use token record from the database.
  * @throws AppError if the token is not found or of an invalid type.
  */
@@ -34,7 +34,7 @@ export const getValidSingleUseToken = async ({ ctx, tokenType }: BaseProps): Pro
     .where(and(...condition))
     .limit(1);
 
-  if (!tokenRecord) throw new AppError({ status: 404, type: 'token_not_found', severity: 'error' });
+  if (!tokenRecord) throw new AppError({ status: 404, type: `${tokenType}_not_found`, severity: 'error' });
 
   // Sanity check
   if (tokenType && tokenRecord.type !== tokenType) throw new AppError({ status: 401, type: 'invalid_token', severity: 'error' });
diff --git a/backend/src/utils/get-valid-token.ts b/backend/src/utils/get-valid-token.ts
index d867acdf4..103a80ae7 100644
--- a/backend/src/utils/get-valid-token.ts
+++ b/backend/src/utils/get-valid-token.ts
@@ -22,7 +22,7 @@ type BaseProps = {
  * @param ctx - Hono context.
  * @param token The token string to validate.
  * @param invokeToken (optional) Whether to create a single-use token after invoking/consuming the primary `token`.
- * @param tokenType The required type of the token (e.g., 'password_reset', 'email_verification').
+ * @param tokenType The required type of the token (e.g., 'password-reset', 'email-verification').
  * @param isRedirect - Whether error requests should be redirects.
  * @returns The valid token record from the database.
  * @throws AppError if the token is not found, expired, or of an invalid type.
@@ -47,7 +47,9 @@ export const getValidToken = async ({ ctx, token, tokenType, invokeToken = true,
   if (!tokenRecord) tokenRecord = await getValidSingleUseToken({ ctx, tokenType });
 
   // Token expired
-  if (isExpiredDate(tokenRecord.expiresAt)) throw new AppError({ status: 401, type: `${tokenRecord.type}_expired`, severity: 'warn', isRedirect });
+  if (isExpiredDate(tokenRecord.expiresAt)) {
+    throw new AppError({ status: 401, type: `${tokenRecord.type}_expired`, severity: 'warn', isRedirect });
+  }
 
   // Sanity check
   if (tokenType && tokenRecord.type !== tokenType) throw new AppError({ status: 401, type: 'invalid_token', severity: 'error', isRedirect });
diff --git a/backend/tests/helpers.ts b/backend/tests/helpers.ts
index 411531ea8..58b2cf1ae 100644
--- a/backend/tests/helpers.ts
+++ b/backend/tests/helpers.ts
@@ -3,7 +3,7 @@ import { emailsTable } from '#/db/schema/emails';
 import { passwordsTable } from '#/db/schema/passwords';
 import { unsubscribeTokensTable } from '#/db/schema/unsubscribe-tokens';
 import { type UserModel, usersTable } from '#/db/schema/users';
-import { hashPassword } from '#/modules/auth/helpers/argon2id';
+import { hashPassword } from '#/modules/auth/passwords/helpers/argon2id';
 import { eq } from 'drizzle-orm';
 import { mockEmail, mockPassword, mockUnsubscribeToken, mockUser } from '../mocks/basic';
 
diff --git a/config/default.ts b/config/default.ts
index 99b9b132b..2cf7a7af3 100644
--- a/config/default.ts
+++ b/config/default.ts
@@ -126,7 +126,7 @@ enabledAuthStrategies: ['password', 'passkey', 'oauth', 'totp'] as const,
 enabledOAuthProviders: ['github'] as const,
 
   // Token types
-  tokenTypes: ['email_verification', 'oauth_verification', 'password_reset', 'invitation', 'confirm_mfa'] as const,
+  tokenTypes: ['email-verification', 'oauth-verification', 'password-reset', 'invitation', 'confirm-mfa'] as const,
 
   // Optional settings
   has: {
diff --git a/frontend/src/api.gen/sdk.gen.ts b/frontend/src/api.gen/sdk.gen.ts
index f9c4fec7c..1fa6a911e 100644
--- a/frontend/src/api.gen/sdk.gen.ts
+++ b/frontend/src/api.gen/sdk.gen.ts
@@ -270,7 +270,7 @@ export const invokeToken = <ThrowOnError extends boolean = true>(options: Option
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -298,7 +298,7 @@ export const getTokenData = <ThrowOnError extends boolean = true>(options: Optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -325,7 +325,7 @@ export const startImpersonation = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -351,7 +351,7 @@ export const stopImpersonation = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -377,7 +377,7 @@ export const signOut = <ThrowOnError extends boolean = true>(options?: Options<S
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -392,7 +392,7 @@ export const signOut = <ThrowOnError extends boolean = true>(options?: Options<S
  *
  * Generates a new TOTP challenge for current user and returns a provisioning URI and Base32 manual key.
  *
- * **POST /auth/totp/register** ·· [createTotpChallenge](http://localhost:4000/docs#tag/me/post/auth/totp/register) ·· _me_
+ * **POST /auth/totp/register** ·· [createTotpChallenge](http://localhost:4000/docs#tag/auth/post/auth/totp/register) ·· _auth_
  *
  * @param {createTotpChallengeData} options
  * @returns Possible status codes: 200, 400, 401, 403, 404, 429
@@ -411,7 +411,7 @@ export const createTotpChallenge = <ThrowOnError extends boolean = true>(options
  *
  * Confirms TOTP setup by verifying a code from the authenticator app for the first time. On success, TOTP is registered for current user.
  *
- * **POST /auth/totp/activate** ·· [createTotp](http://localhost:4000/docs#tag/me/post/auth/totp/activate) ·· _me_
+ * **POST /auth/totp/activate** ·· [createTotp](http://localhost:4000/docs#tag/auth/post/auth/totp/activate) ·· _auth_
  *
  * @param {createTotpData} options
  * @param {string=} options.body.code - `string` (optional)
@@ -435,7 +435,7 @@ export const createTotp = <ThrowOnError extends boolean = true>(options: Options
  *
  * Delete TOTP credential for current user.
  *
- * **DELETE /auth/totp** ·· [deleteTotp](http://localhost:4000/docs#tag/me/delete/auth/totp) ·· _me_
+ * **DELETE /auth/totp** ·· [deleteTotp](http://localhost:4000/docs#tag/auth/delete/auth/totp) ·· _auth_
  *
  * @param {deleteTotpData} options
  * @returns Possible status codes: 200, 400, 401, 403, 404, 429
@@ -529,7 +529,7 @@ export const signUpWithToken = <ThrowOnError extends boolean = true>(options: Op
 /**
  * Verify email by token
  * 🌐 Public access
- * ⏳ token_email_verification (10/h)
+ * ⏳ token_email-verification (10/h)
  *
  * Verifies a user's email using a single-use session token in cookie. Grants a session upon success.
  *
@@ -576,7 +576,7 @@ export const requestPassword = <ThrowOnError extends boolean = true>(options?: O
 /**
  * Create password
  * 🌐 Public access
- * ⏳ token_password_reset (10/h)
+ * ⏳ token_password-reset (10/h)
  *
  * Sets a new password using a single-use session token in cookie and grants a session immediately upon success.
  *
@@ -631,7 +631,7 @@ export const signIn = <ThrowOnError extends boolean = true>(options?: Options<Si
  *
  * Register a passkey for passwordless authentication by verifying a signed challenge and linking it to the *current user*. Multiple passkeys can be created for different devices/browsers.
  *
- * **POST /auth/passkey** ·· [createPasskey](http://localhost:4000/docs#tag/me/post/auth/passkey) ·· _me_
+ * **POST /auth/passkey** ·· [createPasskey](http://localhost:4000/docs#tag/auth/post/auth/passkey) ·· _auth_
  *
  * @param {createPasskeyData} options
  * @param {string=} options.body.attestationObject - `string` (optional)
@@ -657,7 +657,7 @@ export const createPasskey = <ThrowOnError extends boolean = true>(options: Opti
  *
  * Delete a passkey by id from the *current user*.
  *
- * **DELETE /auth/passkey/{id}** ·· [deletePasskey](http://localhost:4000/docs#tag/me/delete/auth/passkey/{id}) ·· _me_
+ * **DELETE /auth/passkey/{id}** ·· [deletePasskey](http://localhost:4000/docs#tag/auth/delete/auth/passkey/{id}) ·· _auth_
  *
  * @param {deletePasskeyData} options
  * @param {string} options.path.id - `string`
@@ -721,7 +721,7 @@ export const signInWithPasskey = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -892,7 +892,7 @@ export const deleteMe = <ThrowOnError extends boolean = true>(options?: Options<
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -918,7 +918,7 @@ export const getMe = <ThrowOnError extends boolean = true>(options?: Options<Get
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -952,7 +952,7 @@ export const updateMe = <ThrowOnError extends boolean = true>(options?: Options<
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -985,7 +985,7 @@ export const toggleMfa = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1015,7 +1015,7 @@ export const getMyAuth = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1041,7 +1041,7 @@ export const getMyMenu = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1067,7 +1067,7 @@ export const getMyInvitations = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1094,7 +1094,7 @@ export const deleteMySessions = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1148,7 +1148,7 @@ export const getUploadToken = <ThrowOnError extends boolean = true>(options: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1176,7 +1176,7 @@ export const unsubscribeMe = <ThrowOnError extends boolean = true>(options: Opti
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1203,7 +1203,7 @@ export const deleteUsers = <ThrowOnError extends boolean = true>(options?: Optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1242,7 +1242,7 @@ export const getUsers = <ThrowOnError extends boolean = true>(options?: Options<
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1269,7 +1269,7 @@ export const getUser = <ThrowOnError extends boolean = true>(options: Options<Ge
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1303,7 +1303,7 @@ export const updateUser = <ThrowOnError extends boolean = true>(options: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1334,7 +1334,7 @@ export const deleteOrganizations = <ThrowOnError extends boolean = true>(options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1369,7 +1369,7 @@ export const getOrganizations = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1397,7 +1397,7 @@ export const createOrganization = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1428,7 +1428,7 @@ export const getOrganization = <ThrowOnError extends boolean = true>(options: Op
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1472,7 +1472,7 @@ export const updateOrganization = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1516,7 +1516,7 @@ export const getContextEntities = <ThrowOnError extends boolean = true>(options?
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1545,7 +1545,7 @@ export const getContextEntity = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1574,7 +1574,7 @@ export const checkSlug = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1605,7 +1605,7 @@ export const systemInvite = <ThrowOnError extends boolean = true>(options?: Opti
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1637,7 +1637,7 @@ export const getPresignedUrl = <ThrowOnError extends boolean = true>(options: Op
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1664,7 +1664,7 @@ export const paddleWebhook = <ThrowOnError extends boolean = true>(options?: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1699,7 +1699,7 @@ export const sendNewsletter = <ThrowOnError extends boolean = true>(options: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1730,7 +1730,7 @@ export const deleteRequests = <ThrowOnError extends boolean = true>(options?: Op
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1765,7 +1765,7 @@ export const getRequests = <ThrowOnError extends boolean = true>(options?: Optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1795,7 +1795,7 @@ export const createRequest = <ThrowOnError extends boolean = true>(options?: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1826,7 +1826,7 @@ export const getMetrics = <ThrowOnError extends boolean = true>(options?: Option
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1853,7 +1853,7 @@ export const getPublicCounts = <ThrowOnError extends boolean = true>(options?: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1888,7 +1888,7 @@ export const shapeProxy = <ThrowOnError extends boolean = true>(options: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1916,7 +1916,7 @@ export const deleteAttachments = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1953,7 +1953,7 @@ export const getAttachments = <ThrowOnError extends boolean = true>(options: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1980,7 +1980,7 @@ export const createAttachment = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2012,7 +2012,7 @@ export const getAttachment = <ThrowOnError extends boolean = true>(options: Opti
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2042,7 +2042,7 @@ export const updateAttachment = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2074,7 +2074,7 @@ export const redirectToAttachment = <ThrowOnError extends boolean = true>(option
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2104,7 +2104,7 @@ export const deleteMemberships = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2139,7 +2139,7 @@ export const membershipInvite = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2175,7 +2175,7 @@ export const updateMembership = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2194,7 +2194,7 @@ export const updateMembership = <ThrowOnError extends boolean = true>(options: O
  *
  * Accepting activates the associated membership. Rejecting adds a rejectedAt timestamp.
  *
- * **POST /{orgIdOrSlug}/memberships/{id}/{acceptOrReject}** ·· [acceptMembership](http://localhost:4000/docs#tag/auth/post/{orgIdOrSlug}/memberships/{id}/{acceptOrReject}) ·· _auth_
+ * **POST /{orgIdOrSlug}/memberships/{id}/{acceptOrReject}** ·· [acceptMembership](http://localhost:4000/docs#tag/membership/post/{orgIdOrSlug}/memberships/{id}/{acceptOrReject}) ·· _membership_
  *
  * @param {acceptMembershipData} options
  * @param {string} options.path.id - `string`
@@ -2207,7 +2207,7 @@ export const acceptMembership = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2242,7 +2242,7 @@ export const getMembers = <ThrowOnError extends boolean = true>(options: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2276,7 +2276,7 @@ export const getPendingInvitations = <ThrowOnError extends boolean = true>(optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
diff --git a/frontend/src/api.gen/types.gen.ts b/frontend/src/api.gen/types.gen.ts
index 1511899da..505449f75 100644
--- a/frontend/src/api.gen/types.gen.ts
+++ b/frontend/src/api.gen/types.gen.ts
@@ -260,7 +260,7 @@ export type CheckEmailResponse = CheckEmailResponses[keyof CheckEmailResponses];
 export type InvokeTokenData = {
   body?: never;
   path: {
-    type: 'email_verification' | 'oauth_verification' | 'password_reset' | 'invitation' | 'confirm_mfa';
+    type: 'email-verification' | 'oauth-verification' | 'password-reset' | 'invitation' | 'confirm-mfa';
     token: string;
   };
   query?: never;
@@ -308,7 +308,7 @@ export type GetTokenDataData = {
     tokenId: string;
   };
   query: {
-    type: 'email_verification' | 'oauth_verification' | 'password_reset' | 'invitation' | 'confirm_mfa';
+    type: 'email-verification' | 'oauth-verification' | 'password-reset' | 'invitation' | 'confirm-mfa';
   };
   url: '/auth/token/{tokenId}';
 };
diff --git a/frontend/src/api.gen/zod.gen.ts b/frontend/src/api.gen/zod.gen.ts
index b2bfc1d0c..82b3e7e0d 100644
--- a/frontend/src/api.gen/zod.gen.ts
+++ b/frontend/src/api.gen/zod.gen.ts
@@ -226,7 +226,7 @@ export const zCheckEmailResponse = z.boolean();
 export const zInvokeTokenData = z.object({
   body: z.optional(z.never()),
   path: z.object({
-    type: z.enum(['email_verification', 'oauth_verification', 'password_reset', 'invitation', 'confirm_mfa']),
+    type: z.enum(['email-verification', 'oauth-verification', 'password-reset', 'invitation', 'confirm-mfa']),
     token: z.string(),
   }),
   query: z.optional(z.never()),
@@ -238,7 +238,7 @@ export const zGetTokenDataData = z.object({
     tokenId: z.string(),
   }),
   query: z.object({
-    type: z.enum(['email_verification', 'oauth_verification', 'password_reset', 'invitation', 'confirm_mfa']),
+    type: z.enum(['email-verification', 'oauth-verification', 'password-reset', 'invitation', 'confirm-mfa']),
   }),
 });
 
diff --git a/frontend/src/modules/auth/create-password-form.tsx b/frontend/src/modules/auth/create-password-form.tsx
index b4a2205d2..35a651055 100644
--- a/frontend/src/modules/auth/create-password-form.tsx
+++ b/frontend/src/modules/auth/create-password-form.tsx
@@ -32,7 +32,7 @@ const CreatePasswordForm = () => {
 
   const { tokenId } = useParams({ from: '/publicLayout/authLayout/auth/create-password/$tokenId' });
 
-  const { data, isLoading, error } = useGetTokenData('password_reset', tokenId);
+  const { data, isLoading, error } = useGetTokenData('password-reset', tokenId);
   const isMobile = window.innerWidth < 640;
 
   // Reset password & sign in
@@ -43,7 +43,7 @@ const CreatePasswordForm = () => {
   } = useMutation<CreatePasswordResponse, ApiError, CreatePasswordData['body'] & CreatePasswordData['path']>({
     mutationFn: ({ tokenId, password }) => createPassword({ path: { tokenId }, body: { password } }),
     onSuccess: () => {
-      toaster(t('common:success.password_reset'), 'success');
+      toaster(t('common:success.password-reset'), 'success');
       navigate({ to: appConfig.defaultRedirectPath });
     },
   });
diff --git a/locales/en/errors.json b/locales/en/errors.json
index 408ace4ce..d7070e0e0 100644
--- a/locales/en/errors.json
+++ b/locales/en/errors.json
@@ -10,12 +10,14 @@
   "delete_resources": "{{resources}} could not be deleted",
   "duplicate_creation": "Item already exist",
   "email_exists": "Email already exists",
-  "email_verification_expired": "Email verification token expired",
-  "email_verification_expired.text": "Use forgot password to verify.",
-  "oauth_verification_expired": "OAuth verification token expired",
-  "oauth_verification_expired.text": "Go to sign in to restart the authentication process.",
-  "email_verification_not_found": "Can't verify email",
-  "email_verification_not_found.text": "The token is used or doesn't exist anymore. ",
+  "email-verification_expired": "Email verification token expired",
+  "email-verification_expired.text": "Use forgot password to verify.",
+  "oauth-verification_expired": "OAuth verification token expired",
+  "oauth-verification_expired.text": "Go to sign in to restart the authentication process.",
+  "email-verification_not_found": "Can't verify email",
+  "email-verification_not_found.text": "Go to sign in to restart the authentication process.",
+  "oauth-verification_not_found": "Can't verify",
+  "oauth-verification_not_found.text": "Go to sign in to restart the authentication process.",
   "error": "Error",
   "error.text": "Unknown error.",
   "expired_token": "Token has expired",
@@ -143,10 +145,10 @@
   "passkey_verification_failed": "Passkey verification failed",
   "passkey_verification_failed.text": "Passkey verification failed. Please try again or use another method.",
   "passkey_unlink_failed": "Unlinking passkey failed. Try again later.",
-  "password_reset_expired": "Password reset token has expired",
-  "password_reset_expired.text": "The token you provided has expired. Use forgot password to request a new one.",
-  "password_reset_not_found": "Can't reset password",
-  "password_reset_not_found.text": "The token is used or doesn't exist. Use forgot password to request a new one.",
+  "password-reset_expired": "Password reset token has expired",
+  "password-reset_expired.text": "The token you provided has expired. Use forgot password to request a new one.",
+  "password-reset_not_found": "Can't reset password",
+  "password-reset_not_found.text": "The token is used or doesn't exist. Use forgot password to request a new one.",
   "reorder_resource": "{{resource}} reorder failed.",
   "reported_try_later": "An error has been reported. Please try again later.",
   "reported_try_or_contact": "An error has been reported. Please try again later and contact support if the problem persists.",
@@ -191,10 +193,10 @@
   "organization_mismatch": "This item is linked to a different organization than the one you're currently using. Please switch to the appropriate organization or ask your administrator for access.",
   "session_expired": "Session Expired",
   "session_expired.text": "Your authentication session has expired. Please log in again to continue.",
-  "confirm_mfa_not_found": "Verification failed",
-  "confirm_mfa_not_found.text": "We couldn't complete the second verification process. Please sign in again to continue.",
-  "confirm_mfa_expired": "Verification step expired",
-  "confirm_mfa_expired.text": "Your verification token has expired or is invalid. Please sign in again to continue.",
+  "confirm-mfa_not_found": "Verification failed",
+  "confirm-mfa_not_found.text": "We couldn't complete the second verification process. Please sign in again to continue.",
+  "confirm-mfa_expired": "Verification step expired",
+  "confirm-mfa_expired.text": "Your verification token has expired or is invalid. Please sign in again to continue.",
   "totp_verification_failed": "TOTP verification failed",
   "totp_verification_failed.text": "TOTP verification failed. Please try again or use another method.",
   "totp_setup_failed": "TOTP setup failed. Try again later.",

From 54fcc67d290a2be2161284bb97fafeda1c1ce5df Mon Sep 17 00:00:00 2001
From: flipvanhaaren <flip@shareworks.nl>
Date: Fri, 26 Sep 2025 15:02:18 +0200
Subject: [PATCH 19/48] fix: auth imports

---
 .../modules/auth/oauth/helpers/initiation.ts  |  17 ++-
 backend/src/modules/auth/passkeys/handlers.ts |   2 +-
 .../src/modules/auth/passwords/handlers.ts    |   2 +-
 backend/src/modules/auth/totps/handlers.ts    |   2 +-
 backend/tests/sign-up/basic.test.ts           |   2 +-
 frontend/src/api.gen/sdk.gen.ts               | 100 +++++++++---------
 6 files changed, 62 insertions(+), 63 deletions(-)

diff --git a/backend/src/modules/auth/oauth/helpers/initiation.ts b/backend/src/modules/auth/oauth/helpers/initiation.ts
index bee302b6b..8e0a9e4bf 100644
--- a/backend/src/modules/auth/oauth/helpers/initiation.ts
+++ b/backend/src/modules/auth/oauth/helpers/initiation.ts
@@ -139,18 +139,16 @@ const prepareOAuthAcceptInvite = async (ctx: Context<Env>) => {
  * @throws AppError if missing param or user mismatch
  */
 const prepareOAuthConnect = async (ctx: Context<Env>) => {
+  // Get userId to connect
   const connectUserId = ctx.req.query('connectUserId');
+  if (!connectUserId) throw new AppError({ status: 400, type: 'connect_user_not_found', severity: 'error', isRedirect: true });
 
-  if (!connectUserId) {
-    throw new AppError({ status: 400, type: 'connect_user_not_found', severity: 'error', isRedirect: true });
-  }
-
-  // TODO set cookie with connectUserId
-
+  // Get user from valid session
   const { sessionToken } = await getParsedSessionCookie(ctx, { redirectOnError: true });
   const { user } = await validateSession(sessionToken);
-
   if (!user) throw new AppError({ status: 404, type: 'not_found', entityType: 'user', severity: 'error', isRedirect: true });
+
+  // Make sure it matches with connectUserId
   if (user.id !== connectUserId) throw new AppError({ status: 403, type: 'user_mismatch', severity: 'error', isRedirect: true });
 
   const redirectPath = '/settings#authentication';
@@ -171,12 +169,13 @@ const prepareOAuthConnect = async (ctx: Context<Env>) => {
  * @throws AppError if missing or invalid token
  */
 const prepareOAuthVerify = async (ctx: Context<Env>) => {
-  const token = await getAuthCookie(ctx, 'email-verification');
+  const token = await getAuthCookie(ctx, 'oauth-verification');
+
   // Must provide a token
   if (!token) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error', isRedirect: true });
 
   // Get token or single use token.
-  const tokenRecord = await getValidToken({ ctx, token, invokeToken: false, isRedirect: true, tokenType: 'email-verification' });
+  const tokenRecord = await getValidToken({ ctx, token, invokeToken: false, isRedirect: true, tokenType: 'oauth-verification' });
 
   // If entityType exists, proceed to invitation flow
   const redirectPath = tokenRecord.entityType
diff --git a/backend/src/modules/auth/passkeys/handlers.ts b/backend/src/modules/auth/passkeys/handlers.ts
index 8e1811c14..5507793a7 100644
--- a/backend/src/modules/auth/passkeys/handlers.ts
+++ b/backend/src/modules/auth/passkeys/handlers.ts
@@ -11,13 +11,13 @@ import { type UserModel, usersTable } from '#/db/schema/users';
 import { type Env, getContextUser } from '#/lib/context';
 import { AppError } from '#/lib/errors';
 import { getAuthCookie, setAuthCookie } from '#/modules/auth/general/helpers/cookie';
+import { deviceInfo } from '#/modules/auth/general/helpers/device-info';
 import { consumeMfaToken, validateConfirmMfaToken } from '#/modules/auth/general/helpers/mfa';
 import { setUserSession } from '#/modules/auth/general/helpers/session';
 import { parseAndValidatePasskeyAttestation, verifyPassKeyPublic } from '#/modules/auth/passkeys/helpers/passkey';
 import { usersBaseQuery } from '#/modules/users/helpers/select';
 import { defaultHook } from '#/utils/default-hook';
 import { TimeSpan } from '#/utils/time-span';
-import { deviceInfo } from '../general/helpers/device-info';
 import authPasskeysRoutes from './routes';
 
 const enabledStrategies: readonly string[] = appConfig.enabledAuthStrategies;
diff --git a/backend/src/modules/auth/passwords/handlers.ts b/backend/src/modules/auth/passwords/handlers.ts
index 4a0073cef..5a825ec73 100644
--- a/backend/src/modules/auth/passwords/handlers.ts
+++ b/backend/src/modules/auth/passwords/handlers.ts
@@ -14,6 +14,7 @@ import { mailer } from '#/lib/mailer';
 import { initiateMfa } from '#/modules/auth/general/helpers/mfa';
 import { sendVerificationEmail } from '#/modules/auth/general/helpers/send-verification-email';
 import { setUserSession } from '#/modules/auth/general/helpers/session';
+import { handleCreateUser } from '#/modules/auth/general/helpers/user';
 import { hashPassword, verifyPasswordHash } from '#/modules/auth/passwords/helpers/argon2id';
 import { membershipBaseSelect } from '#/modules/memberships/helpers/select';
 import { usersBaseQuery } from '#/modules/users/helpers/select';
@@ -24,7 +25,6 @@ import { nanoid } from '#/utils/nanoid';
 import { slugFromEmail } from '#/utils/slug-from-email';
 import { createDate, TimeSpan } from '#/utils/time-span';
 import { CreatePasswordEmail, type CreatePasswordEmailProps } from '../../../../emails/create-password';
-import { handleCreateUser } from '../general/helpers/user';
 import { handleEmailVerification } from './helpers/handle-email-verification';
 import authPasswordsRoutes from './routes';
 
diff --git a/backend/src/modules/auth/totps/handlers.ts b/backend/src/modules/auth/totps/handlers.ts
index b6eff4e11..074b1f9f5 100644
--- a/backend/src/modules/auth/totps/handlers.ts
+++ b/backend/src/modules/auth/totps/handlers.ts
@@ -9,12 +9,12 @@ import { totpsTable } from '#/db/schema/totps';
 import { usersTable } from '#/db/schema/users';
 import { type Env, getContextUser } from '#/lib/context';
 import { AppError } from '#/lib/errors';
+import { getAuthCookie, setAuthCookie } from '#/modules/auth/general/helpers/cookie';
 import { consumeMfaToken, validateConfirmMfaToken } from '#/modules/auth/general/helpers/mfa';
 import { setUserSession } from '#/modules/auth/general/helpers/session';
 import { signInWithTotp } from '#/modules/auth/totps/helpers/totps';
 import { defaultHook } from '#/utils/default-hook';
 import { TimeSpan } from '#/utils/time-span';
-import { getAuthCookie, setAuthCookie } from '../general/helpers/cookie';
 import authTotpRoutes from './routes';
 import authTotpsRoutes from './routes';
 
diff --git a/backend/tests/sign-up/basic.test.ts b/backend/tests/sign-up/basic.test.ts
index d5be43b4e..d5b1fd89b 100644
--- a/backend/tests/sign-up/basic.test.ts
+++ b/backend/tests/sign-up/basic.test.ts
@@ -15,7 +15,7 @@ beforeAll(async () => {
 
   // Tmp solution: Mock the sendVerificationEmail function to avoid background running tasks...
   // Later we should only mock the email sending part, not the whole function. 
-  vi.mock('#/modules/auth/helpers/send-verification-email', () => ({
+  vi.mock('#/modules/auth/general/helpers/send-verification-email', () => ({
     sendVerificationEmail: vi.fn().mockResolvedValue(undefined)
   }));
 });
diff --git a/frontend/src/api.gen/sdk.gen.ts b/frontend/src/api.gen/sdk.gen.ts
index 1fa6a911e..37b5a8be1 100644
--- a/frontend/src/api.gen/sdk.gen.ts
+++ b/frontend/src/api.gen/sdk.gen.ts
@@ -270,7 +270,7 @@ export const invokeToken = <ThrowOnError extends boolean = true>(options: Option
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -298,7 +298,7 @@ export const getTokenData = <ThrowOnError extends boolean = true>(options: Optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -325,7 +325,7 @@ export const startImpersonation = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -351,7 +351,7 @@ export const stopImpersonation = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -377,7 +377,7 @@ export const signOut = <ThrowOnError extends boolean = true>(options?: Options<S
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -721,7 +721,7 @@ export const signInWithPasskey = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -892,7 +892,7 @@ export const deleteMe = <ThrowOnError extends boolean = true>(options?: Options<
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -918,7 +918,7 @@ export const getMe = <ThrowOnError extends boolean = true>(options?: Options<Get
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -952,7 +952,7 @@ export const updateMe = <ThrowOnError extends boolean = true>(options?: Options<
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -985,7 +985,7 @@ export const toggleMfa = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1015,7 +1015,7 @@ export const getMyAuth = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1041,7 +1041,7 @@ export const getMyMenu = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1067,7 +1067,7 @@ export const getMyInvitations = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1094,7 +1094,7 @@ export const deleteMySessions = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1148,7 +1148,7 @@ export const getUploadToken = <ThrowOnError extends boolean = true>(options: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1176,7 +1176,7 @@ export const unsubscribeMe = <ThrowOnError extends boolean = true>(options: Opti
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1203,7 +1203,7 @@ export const deleteUsers = <ThrowOnError extends boolean = true>(options?: Optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1242,7 +1242,7 @@ export const getUsers = <ThrowOnError extends boolean = true>(options?: Options<
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1269,7 +1269,7 @@ export const getUser = <ThrowOnError extends boolean = true>(options: Options<Ge
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1303,7 +1303,7 @@ export const updateUser = <ThrowOnError extends boolean = true>(options: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1334,7 +1334,7 @@ export const deleteOrganizations = <ThrowOnError extends boolean = true>(options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1369,7 +1369,7 @@ export const getOrganizations = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1397,7 +1397,7 @@ export const createOrganization = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1428,7 +1428,7 @@ export const getOrganization = <ThrowOnError extends boolean = true>(options: Op
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1472,7 +1472,7 @@ export const updateOrganization = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1516,7 +1516,7 @@ export const getContextEntities = <ThrowOnError extends boolean = true>(options?
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1545,7 +1545,7 @@ export const getContextEntity = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1574,7 +1574,7 @@ export const checkSlug = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1605,7 +1605,7 @@ export const systemInvite = <ThrowOnError extends boolean = true>(options?: Opti
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1637,7 +1637,7 @@ export const getPresignedUrl = <ThrowOnError extends boolean = true>(options: Op
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1664,7 +1664,7 @@ export const paddleWebhook = <ThrowOnError extends boolean = true>(options?: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1699,7 +1699,7 @@ export const sendNewsletter = <ThrowOnError extends boolean = true>(options: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1730,7 +1730,7 @@ export const deleteRequests = <ThrowOnError extends boolean = true>(options?: Op
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1765,7 +1765,7 @@ export const getRequests = <ThrowOnError extends boolean = true>(options?: Optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1795,7 +1795,7 @@ export const createRequest = <ThrowOnError extends boolean = true>(options?: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1826,7 +1826,7 @@ export const getMetrics = <ThrowOnError extends boolean = true>(options?: Option
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1853,7 +1853,7 @@ export const getPublicCounts = <ThrowOnError extends boolean = true>(options?: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1888,7 +1888,7 @@ export const shapeProxy = <ThrowOnError extends boolean = true>(options: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1916,7 +1916,7 @@ export const deleteAttachments = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1953,7 +1953,7 @@ export const getAttachments = <ThrowOnError extends boolean = true>(options: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1980,7 +1980,7 @@ export const createAttachment = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2012,7 +2012,7 @@ export const getAttachment = <ThrowOnError extends boolean = true>(options: Opti
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2042,7 +2042,7 @@ export const updateAttachment = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2074,7 +2074,7 @@ export const redirectToAttachment = <ThrowOnError extends boolean = true>(option
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2104,7 +2104,7 @@ export const deleteMemberships = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2139,7 +2139,7 @@ export const membershipInvite = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2175,7 +2175,7 @@ export const updateMembership = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2207,7 +2207,7 @@ export const acceptMembership = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2242,7 +2242,7 @@ export const getMembers = <ThrowOnError extends boolean = true>(options: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2276,7 +2276,7 @@ export const getPendingInvitations = <ThrowOnError extends boolean = true>(optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],

From 96da59a91bd62364e7bec3b2c9574cbb9ef2cd18 Mon Sep 17 00:00:00 2001
From: flipvanhaaren <flip@shareworks.nl>
Date: Sat, 27 Sep 2025 10:28:22 +0200
Subject: [PATCH 20/48] fixes

---
 .../modules/auth/oauth/helpers/initiation.ts  | 46 +++++++------------
 backend/src/modules/auth/oauth/schema.ts      | 22 ++-------
 .../helpers/handle-email-verification.ts      |  4 +-
 backend/src/modules/system/handlers.ts        |  2 +-
 .../src/utils/get-valid-single-use-token.ts   | 11 +++--
 backend/src/utils/get-valid-token.ts          |  2 +-
 frontend/src/api.gen/sdk.gen.ts               |  9 ----
 frontend/src/api.gen/types.gen.ts             |  9 ----
 frontend/src/api.gen/zod.gen.ts               |  9 ----
 locales/en/errors.json                        |  1 +
 10 files changed, 31 insertions(+), 84 deletions(-)

diff --git a/backend/src/modules/auth/oauth/helpers/initiation.ts b/backend/src/modules/auth/oauth/helpers/initiation.ts
index 8e0a9e4bf..10b3fc1d7 100644
--- a/backend/src/modules/auth/oauth/helpers/initiation.ts
+++ b/backend/src/modules/auth/oauth/helpers/initiation.ts
@@ -2,8 +2,9 @@ import { appConfig } from 'config';
 import type { Context } from 'hono';
 import { Env } from '#/lib/context';
 import { AppError } from '#/lib/errors';
-import { getAuthCookie, setAuthCookie } from '#/modules/auth/general/helpers/cookie';
+import { deleteAuthCookie, getAuthCookie, setAuthCookie } from '#/modules/auth/general/helpers/cookie';
 import { getParsedSessionCookie, validateSession } from '#/modules/auth/general/helpers/session';
+import { getValidSingleUseToken } from '#/utils/get-valid-single-use-token';
 import { getValidToken } from '#/utils/get-valid-token';
 import { isValidRedirectPath } from '#/utils/is-redirect-url';
 import { logEvent } from '#/utils/logger';
@@ -110,7 +111,7 @@ const resolveOAuthRedirect = (redirect?: string): string => {
  * - Determines correct redirect path based on entity type
  *
  * @param ctx - Hono context
- * @returns tokenId + redirectPath
+ * @returns redirectPath
  * @throws AppError if token is missing or invalid
  */
 const prepareOAuthAcceptInvite = async (ctx: Context<Env>) => {
@@ -129,58 +130,43 @@ const prepareOAuthAcceptInvite = async (ctx: Context<Env>) => {
 };
 
 /**
- * Validates and extracts connection context for an OAuth flow. Operates in authenticated context.
- *
- * - Ensures `connect` param exists
- * - Validates logged-in user matches `connect` param
+ * Connect an provider account such as your Github account to your existing account.
+ * Can only be done from within an authenticated context.
  *
  * @param ctx - Hono context
  * @returns connectUserId and redirectPath
  * @throws AppError if missing param or user mismatch
  */
 const prepareOAuthConnect = async (ctx: Context<Env>) => {
-  // Get userId to connect
-  const connectUserId = ctx.req.query('connectUserId');
-  if (!connectUserId) throw new AppError({ status: 400, type: 'connect_user_not_found', severity: 'error', isRedirect: true });
+  const { sessionToken } = await getParsedSessionCookie(ctx, { redirectOnError: true });
 
   // Get user from valid session
-  const { sessionToken } = await getParsedSessionCookie(ctx, { redirectOnError: true });
   const { user } = await validateSession(sessionToken);
   if (!user) throw new AppError({ status: 404, type: 'not_found', entityType: 'user', severity: 'error', isRedirect: true });
 
-  // Make sure it matches with connectUserId
-  if (user.id !== connectUserId) throw new AppError({ status: 403, type: 'user_mismatch', severity: 'error', isRedirect: true });
-
+  //TODO we do this on callback or not?
   const redirectPath = '/settings#authentication';
 
-  return { connectUserId, redirectPath };
+  return { connectUserId: user.id, redirectPath };
 };
 /**
- * Validates and extracts verification context for an OAuth flow.
- * To make sure that the user that started the OAuth flow is the same as the one that proceeds after
- * email verification, we use a cookie to store the token.
- *
- * - Ensures `token` param exists
- * - Validates token record against type `email_verification`
- * - Determines redirect path based on entity type
+ * Validates single-use token from cookie and revokes it to redirect back to frontend on success.
  *
  * @param ctx - Hono context
  * @returns tokenId + redirectPath
  * @throws AppError if missing or invalid token
  */
 const prepareOAuthVerify = async (ctx: Context<Env>) => {
-  const token = await getAuthCookie(ctx, 'oauth-verification');
+  // Validate single use token from db
+  const tokenRecord = await getValidSingleUseToken({ ctx, tokenType: 'oauth-verification', isRedirect: true });
 
-  // Must provide a token
-  if (!token) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error', isRedirect: true });
+  // Revoke single use token by deleting cookie
+  deleteAuthCookie(ctx, 'oauth-verification');
 
-  // Get token or single use token.
-  const tokenRecord = await getValidToken({ ctx, token, invokeToken: false, isRedirect: true, tokenType: 'oauth-verification' });
+  let redirectPath = appConfig.defaultRedirectPath;
 
-  // If entityType exists, proceed to invitation flow
-  const redirectPath = tokenRecord.entityType
-    ? `${appConfig.backendAuthUrl}/invoke-token/${tokenRecord.type}/${tokenRecord.token}`
-    : appConfig.defaultRedirectPath;
+  // If its a membership invitation
+  if (tokenRecord.entityType) redirectPath = `${appConfig.frontendUrl}/home?invitationTokenId=${tokenRecord.id}&skipWelcome=true`;
 
   return { verifyTokenId: tokenRecord.id, redirectPath };
 };
diff --git a/backend/src/modules/auth/oauth/schema.ts b/backend/src/modules/auth/oauth/schema.ts
index 584060513..5a29b7269 100644
--- a/backend/src/modules/auth/oauth/schema.ts
+++ b/backend/src/modules/auth/oauth/schema.ts
@@ -1,23 +1,9 @@
 import { z } from '@hono/zod-openapi';
 
-export const oauthQuerySchema = z
-  .object({
-    type: z.enum(['auth', 'connect', 'invite', 'verify']),
-    redirect: z.string().optional(),
-    connectUserId: z.string().optional(),
-    token: z.string().optional(),
-    tokenId: z.string().optional(),
-  })
-  .refine(
-    (data) => {
-      if (data.type === 'connect') return !!data.connectUserId;
-      if (data.type === 'invite') return !!data.tokenId && !!data.token;
-      return true; // No extra requirements for signIn & signUp
-    },
-    // TODO message is deprecated in favor of 'error'? replace everywhere
-    // TODO2 this doesnt work well when we need a redirect error, what to do?
-    { message: "Missing required field based on 'type'" },
-  );
+export const oauthQuerySchema = z.object({
+  type: z.enum(['auth', 'connect', 'invite', 'verify']),
+  redirect: z.string().optional(),
+});
 
 export const oauthCallbackQuerySchema = z.object({
   code: z.string(),
diff --git a/backend/src/modules/auth/passwords/helpers/handle-email-verification.ts b/backend/src/modules/auth/passwords/helpers/handle-email-verification.ts
index 4e1e1c334..b7f8f1541 100644
--- a/backend/src/modules/auth/passwords/helpers/handle-email-verification.ts
+++ b/backend/src/modules/auth/passwords/helpers/handle-email-verification.ts
@@ -7,10 +7,10 @@ import type { TokenModel } from '#/db/schema/tokens';
 import { usersTable } from '#/db/schema/users';
 import { Env } from '#/lib/context';
 import { AppError } from '#/lib/errors';
+import { initiateMfa } from '#/modules/auth/general/helpers/mfa';
+import { setUserSession } from '#/modules/auth/general/helpers/session';
 import { usersBaseQuery } from '#/modules/users/helpers/select';
 import { getIsoDate } from '#/utils/iso-date';
-import { initiateMfa } from '../../general/helpers/mfa';
-import { setUserSession } from '../../general/helpers/session';
 
 export const handleEmailVerification = async (ctx: Context<Env>, token: TokenModel) => {
   // Token requires userId
diff --git a/backend/src/modules/system/handlers.ts b/backend/src/modules/system/handlers.ts
index ba36276ff..b9d93682a 100644
--- a/backend/src/modules/system/handlers.ts
+++ b/backend/src/modules/system/handlers.ts
@@ -17,6 +17,7 @@ import { type Env, getContextUser } from '#/lib/context';
 import { AppError } from '#/lib/errors';
 import { mailer } from '#/lib/mailer';
 import { getSignedUrlFromKey } from '#/lib/signed-url';
+import { getParsedSessionCookie, validateSession } from '#/modules/auth/general/helpers/session';
 import systemRoutes from '#/modules/system/routes';
 import permissionManager from '#/permissions/permissions-config';
 import { defaultHook } from '#/utils/default-hook';
@@ -26,7 +27,6 @@ import { slugFromEmail } from '#/utils/slug-from-email';
 import { createDate, TimeSpan } from '#/utils/time-span';
 import { NewsletterEmail, type NewsletterEmailProps } from '../../../emails/newsletter';
 import { SystemInviteEmail, type SystemInviteEmailProps } from '../../../emails/system-invite';
-import { getParsedSessionCookie, validateSession } from '../auth/general/helpers/session';
 
 const paddle = new Paddle(env.PADDLE_API_KEY || '');
 
diff --git a/backend/src/utils/get-valid-single-use-token.ts b/backend/src/utils/get-valid-single-use-token.ts
index 00462e356..aa5071e58 100644
--- a/backend/src/utils/get-valid-single-use-token.ts
+++ b/backend/src/utils/get-valid-single-use-token.ts
@@ -6,9 +6,10 @@ import { type TokenModel, tokensTable } from '#/db/schema/tokens';
 import { AppError } from '#/lib/errors';
 import { getAuthCookie } from '#/modules/auth/general/helpers/cookie';
 
-type BaseProps = {
+type Props = {
   ctx: Context;
   tokenType: TokenType;
+  isRedirect?: boolean;
 };
 /**
  * Validates a single use token by its value, ensuring it matches the required type.
@@ -18,10 +19,10 @@ type BaseProps = {
  * @returns The valid single use token record from the database.
  * @throws AppError if the token is not found or of an invalid type.
  */
-export const getValidSingleUseToken = async ({ ctx, tokenType }: BaseProps): Promise<TokenModel> => {
+export const getValidSingleUseToken = async ({ ctx, tokenType, isRedirect }: Props): Promise<TokenModel> => {
   // Find single use token in cookie
   const singleUseToken = await getAuthCookie(ctx, tokenType);
-  if (!singleUseToken) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error' });
+  if (!singleUseToken) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error', isRedirect });
 
   const condition = [
     eq(tokensTable.type, tokenType), // Match token type
@@ -34,10 +35,10 @@ export const getValidSingleUseToken = async ({ ctx, tokenType }: BaseProps): Pro
     .where(and(...condition))
     .limit(1);
 
-  if (!tokenRecord) throw new AppError({ status: 404, type: `${tokenType}_not_found`, severity: 'error' });
+  if (!tokenRecord) throw new AppError({ status: 404, type: `${tokenType}_not_found`, severity: 'error', isRedirect });
 
   // Sanity check
-  if (tokenType && tokenRecord.type !== tokenType) throw new AppError({ status: 401, type: 'invalid_token', severity: 'error' });
+  if (tokenType && tokenRecord.type !== tokenType) throw new AppError({ status: 401, type: 'invalid_token', severity: 'error', isRedirect });
 
   return tokenRecord;
 };
diff --git a/backend/src/utils/get-valid-token.ts b/backend/src/utils/get-valid-token.ts
index 103a80ae7..55306bf87 100644
--- a/backend/src/utils/get-valid-token.ts
+++ b/backend/src/utils/get-valid-token.ts
@@ -44,7 +44,7 @@ export const getValidToken = async ({ ctx, token, tokenType, invokeToken = true,
     .limit(1);
 
   // If token not found, perhaps user already has the single-use token
-  if (!tokenRecord) tokenRecord = await getValidSingleUseToken({ ctx, tokenType });
+  if (!tokenRecord) tokenRecord = await getValidSingleUseToken({ ctx, tokenType, isRedirect });
 
   // Token expired
   if (isExpiredDate(tokenRecord.expiresAt)) {
diff --git a/frontend/src/api.gen/sdk.gen.ts b/frontend/src/api.gen/sdk.gen.ts
index 37b5a8be1..e997141bd 100644
--- a/frontend/src/api.gen/sdk.gen.ts
+++ b/frontend/src/api.gen/sdk.gen.ts
@@ -745,9 +745,6 @@ export const signInWithPasskey = <ThrowOnError extends boolean = true>(options?:
  * @param {githubData} options
  * @param {enum} options.query.type - `enum`
  * @param {string=} options.query.redirect - `string` (optional)
- * @param {string=} options.query.connectuserid - `string` (optional)
- * @param {string=} options.query.token - `string` (optional)
- * @param {string=} options.query.tokenid - `string` (optional)
  * @returns Possible status codes: 302, 400, 401, 403, 404, 429
  */
 export const github = <ThrowOnError extends boolean = true>(options: Options<GithubData, ThrowOnError>) => {
@@ -769,9 +766,6 @@ export const github = <ThrowOnError extends boolean = true>(options: Options<Git
  * @param {googleData} options
  * @param {enum} options.query.type - `enum`
  * @param {string=} options.query.redirect - `string` (optional)
- * @param {string=} options.query.connectuserid - `string` (optional)
- * @param {string=} options.query.token - `string` (optional)
- * @param {string=} options.query.tokenid - `string` (optional)
  * @returns Possible status codes: 302, 400, 401, 403, 404, 429
  */
 export const google = <ThrowOnError extends boolean = true>(options: Options<GoogleData, ThrowOnError>) => {
@@ -793,9 +787,6 @@ export const google = <ThrowOnError extends boolean = true>(options: Options<Goo
  * @param {microsoftData} options
  * @param {enum} options.query.type - `enum`
  * @param {string=} options.query.redirect - `string` (optional)
- * @param {string=} options.query.connectuserid - `string` (optional)
- * @param {string=} options.query.token - `string` (optional)
- * @param {string=} options.query.tokenid - `string` (optional)
  * @returns Possible status codes: 302, 400, 401, 403, 404, 429
  */
 export const microsoft = <ThrowOnError extends boolean = true>(options: Options<MicrosoftData, ThrowOnError>) => {
diff --git a/frontend/src/api.gen/types.gen.ts b/frontend/src/api.gen/types.gen.ts
index 505449f75..8333a521e 100644
--- a/frontend/src/api.gen/types.gen.ts
+++ b/frontend/src/api.gen/types.gen.ts
@@ -1295,9 +1295,6 @@ export type GithubData = {
   query: {
     type: 'auth' | 'connect' | 'invite' | 'verify';
     redirect?: string;
-    connectUserId?: string;
-    token?: string;
-    tokenId?: string;
   };
   url: '/auth/github';
 };
@@ -1343,9 +1340,6 @@ export type GoogleData = {
   query: {
     type: 'auth' | 'connect' | 'invite' | 'verify';
     redirect?: string;
-    connectUserId?: string;
-    token?: string;
-    tokenId?: string;
   };
   url: '/auth/google';
 };
@@ -1391,9 +1385,6 @@ export type MicrosoftData = {
   query: {
     type: 'auth' | 'connect' | 'invite' | 'verify';
     redirect?: string;
-    connectUserId?: string;
-    token?: string;
-    tokenId?: string;
   };
   url: '/auth/microsoft';
 };
diff --git a/frontend/src/api.gen/zod.gen.ts b/frontend/src/api.gen/zod.gen.ts
index 82b3e7e0d..7bcc2ff67 100644
--- a/frontend/src/api.gen/zod.gen.ts
+++ b/frontend/src/api.gen/zod.gen.ts
@@ -527,9 +527,6 @@ export const zGithubData = z.object({
   query: z.object({
     type: z.enum(['auth', 'connect', 'invite', 'verify']),
     redirect: z.optional(z.string()),
-    connectUserId: z.optional(z.string()),
-    token: z.optional(z.string()),
-    tokenId: z.optional(z.string()),
   }),
 });
 
@@ -539,9 +536,6 @@ export const zGoogleData = z.object({
   query: z.object({
     type: z.enum(['auth', 'connect', 'invite', 'verify']),
     redirect: z.optional(z.string()),
-    connectUserId: z.optional(z.string()),
-    token: z.optional(z.string()),
-    tokenId: z.optional(z.string()),
   }),
 });
 
@@ -551,9 +545,6 @@ export const zMicrosoftData = z.object({
   query: z.object({
     type: z.enum(['auth', 'connect', 'invite', 'verify']),
     redirect: z.optional(z.string()),
-    connectUserId: z.optional(z.string()),
-    token: z.optional(z.string()),
-    tokenId: z.optional(z.string()),
   }),
 });
 
diff --git a/locales/en/errors.json b/locales/en/errors.json
index d7070e0e0..800e684ab 100644
--- a/locales/en/errors.json
+++ b/locales/en/errors.json
@@ -140,6 +140,7 @@
   "page_not_found": "Page not found",
   "page_not_found.text": "This page didn't exist or has been deleted.",
   "passkey_registration_failed": "Passkey registration failed. Try again later.",
+  "single_use_token_invalid": "Short-lived session invalid",
   "passkey_not_found": "Passkey not recognized",
   "passkey_not_found.text": "We couldn`t verify this passkey. It may not belong to your account or has been removed.",
   "passkey_verification_failed": "Passkey verification failed",

From bbf31042b1364a7c97913dd977d57fd8e98dd382 Mon Sep 17 00:00:00 2001
From: David Hordiienko <shiraz0david@gmail.com>
Date: Mon, 29 Sep 2025 09:44:29 +0300
Subject: [PATCH 21/48] fix: new memberships order gaps

---
 backend/src/modules/memberships/helpers/index.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/src/modules/memberships/helpers/index.ts b/backend/src/modules/memberships/helpers/index.ts
index f2d89b125..3449f99f3 100644
--- a/backend/src/modules/memberships/helpers/index.ts
+++ b/backend/src/modules/memberships/helpers/index.ts
@@ -57,7 +57,7 @@ export const insertMembership = async <T extends BaseEntityModel>({
     createdBy,
     tokenId,
     activatedAt: tokenId ? null : getIsoDate(),
-    order: maxOrder ? maxOrder + 1 : 1,
+    order: maxOrder ? maxOrder + 10 : 1000,
   };
 
   // Insert organization membership first

From ccdbcade8b081dd7b5e24dc911864fc7439c84b0 Mon Sep 17 00:00:00 2001
From: David Hordiienko <90209095+LemonardoD@users.noreply.github.com>
Date: Tue, 30 Sep 2025 09:21:58 +0300
Subject: [PATCH 22/48] Refactor/app error (#626)

* progress(AppError):  change isRedirect to redirectPath

* progress: improve authenticateRouteSearch

* progress: improve usage of ErrorNotice

* progress: improve form style
---
 backend/src/lib/errors.ts                     | 16 ++++--
 backend/src/modules/auth/general/handlers.ts  |  2 +-
 .../src/modules/auth/general/helpers/mfa.ts   |  1 +
 .../modules/auth/general/helpers/session.ts   |  6 +-
 backend/src/modules/auth/oauth/handlers.ts    | 20 +++----
 .../modules/auth/oauth/helpers/callback.ts    | 26 +++++----
 .../modules/auth/oauth/helpers/initiation.ts  | 10 ++--
 .../src/utils/get-valid-single-use-token.ts   | 10 ++--
 backend/src/utils/get-valid-token.ts          | 11 ++--
 .../src/modules/auth/create-password-form.tsx |  6 +-
 frontend/src/modules/auth/error-notice.tsx    | 56 -------------------
 frontend/src/modules/auth/steps/error.tsx     |  6 +-
 frontend/src/modules/auth/steps/provider.tsx  | 11 +++-
 frontend/src/modules/auth/steps/waitlist.tsx  | 11 ++--
 frontend/src/modules/common/error-notice.tsx  | 29 ++++++----
 .../src/modules/requests/waitlist-form.tsx    |  4 +-
 frontend/src/routes/auth-routes.tsx           | 16 +++---
 frontend/src/routes/base-routes.tsx           |  2 +-
 18 files changed, 106 insertions(+), 137 deletions(-)
 delete mode 100644 frontend/src/modules/auth/error-notice.tsx

diff --git a/backend/src/lib/errors.ts b/backend/src/lib/errors.ts
index c80d02e46..295611320 100644
--- a/backend/src/lib/errors.ts
+++ b/backend/src/lib/errors.ts
@@ -27,7 +27,7 @@ export type ConstructedError = {
   entityType?: ErrorSchemaType['entityType'];
   meta?: ErrorMeta;
   originalError?: Error;
-  isRedirect?: boolean;
+  redirectPath?: string;
 };
 
 // Custom error class to handle App errors
@@ -36,7 +36,7 @@ export class AppError extends Error {
   status: ErrorSchemaType['status'];
   type: ErrorSchemaType['type'];
   severity: ErrorSchemaType['severity'];
-  isRedirect: boolean;
+  redirectPath: string | null;
   entityType?: ErrorSchemaType['entityType'];
   meta?: ErrorMeta;
   originalError?: Error;
@@ -50,7 +50,7 @@ export class AppError extends Error {
     this.type = error.type;
     this.entityType = error.entityType;
     this.severity = error.severity || 'info';
-    this.isRedirect = error.isRedirect || false;
+    this.redirectPath = error.redirectPath || null;
     this.meta = error.meta;
     this.originalError = error.originalError;
 
@@ -80,7 +80,7 @@ export const handleAppError: ErrorHandler<Env> = (err, ctx) => {
         });
 
   // Get non-enumerable 'stack', 'message', and 'cause'. These do NOT get included when using the spread operator (...)
-  const { isRedirect, originalError, message, cause, stack, ...error } = normalizedError;
+  const { redirectPath, originalError, message, cause, stack, ...error } = normalizedError;
   const { severity, type, meta } = error;
 
   // Get the current user and organization from context
@@ -113,8 +113,12 @@ export const handleAppError: ErrorHandler<Env> = (err, ctx) => {
   else eventLogger[severity]({ ...(meta ?? {}), ...(detailsRequired ? { ...detailedError } : {}) });
 
   // Redirect to the frontend error page with query parameters for error details
-  if (isRedirect) {
-    const redirectUrl = `${appConfig.frontendUrl}/error?error=${type}&severity=${severity}`;
+  if (redirectPath) {
+    const redirectUrl = new URL(redirectPath, appConfig.frontendUrl);
+
+    redirectUrl.searchParams.set('error', type);
+    redirectUrl.searchParams.set('severity', severity);
+
     return ctx.redirect(redirectUrl, 302);
   }
 
diff --git a/backend/src/modules/auth/general/handlers.ts b/backend/src/modules/auth/general/handlers.ts
index 7372d0b63..a3fb0d848 100644
--- a/backend/src/modules/auth/general/handlers.ts
+++ b/backend/src/modules/auth/general/handlers.ts
@@ -68,7 +68,7 @@ const authGeneralRouteHandlers = app
 
     // Check if token exists and create a new refresh token
     const tokenRecord = await getValidToken({ ctx, token, tokenType, invokeToken: true });
-    if (!tokenRecord.singleUseToken) throw new AppError({ status: 500, type: 'invalid_token', severity: 'error', isRedirect: true });
+    if (!tokenRecord.singleUseToken) throw new AppError({ status: 500, type: 'invalid_token', severity: 'error', redirectPath: '/error' });
 
     // Set cookie using token type as name. Content is single use token. Expires in 10 minutes or until used.
     await setAuthCookie(ctx, tokenRecord.type, tokenRecord.singleUseToken, new TimeSpan(10, 'm'));
diff --git a/backend/src/modules/auth/general/helpers/mfa.ts b/backend/src/modules/auth/general/helpers/mfa.ts
index 4790bd05d..57407452e 100644
--- a/backend/src/modules/auth/general/helpers/mfa.ts
+++ b/backend/src/modules/auth/general/helpers/mfa.ts
@@ -54,6 +54,7 @@ export const initiateMfa = async (ctx: Context<Env>, user: UserModel) => {
  */
 export const validateConfirmMfaToken = async (ctx: Context<Env>): Promise<UserModel> => {
   // TODO should be token itself, Get token ID from cookie
+  // TODO on error redirect?
   const tokenIdFromCookie = await getAuthCookie(ctx, 'confirm-mfa');
   if (!tokenIdFromCookie) throw new AppError({ status: 401, type: 'confirm-mfa_not_found', severity: 'error' });
 
diff --git a/backend/src/modules/auth/general/helpers/session.ts b/backend/src/modules/auth/general/helpers/session.ts
index 272310344..6b290c14c 100644
--- a/backend/src/modules/auth/general/helpers/session.ts
+++ b/backend/src/modules/auth/general/helpers/session.ts
@@ -109,7 +109,7 @@ export const validateSession = async (hashedSessionToken: string): Promise<{ ses
 };
 
 type ParseSessionCookieOptions = {
-  redirectOnError?: boolean;
+  redirectOnError?: string;
   deleteOnError?: boolean;
   deleteAfterAttempt?: boolean;
 };
@@ -118,7 +118,7 @@ export const getParsedSessionCookie = async (
   ctx: Context<Env>,
   options?: ParseSessionCookieOptions,
 ): Promise<z.infer<typeof sessionCookieSchema>> => {
-  const { redirectOnError = false, deleteOnError = false, deleteAfterAttempt = false } = options ?? {};
+  const { redirectOnError, deleteOnError = false, deleteAfterAttempt = false } = options ?? {};
   try {
     // Retrieve session cookie data
     const sessionData = await getAuthCookie(ctx, 'session');
@@ -135,7 +135,7 @@ export const getParsedSessionCookie = async (
     return sessionCookieSchema.parse({ sessionToken, adminUserId });
   } catch (error) {
     if (deleteOnError) deleteAuthCookie(ctx, 'session');
-    throw new AppError({ status: 401, type: 'unauthorized', severity: 'warn', isRedirect: redirectOnError });
+    throw new AppError({ status: 401, type: 'unauthorized', severity: 'warn', redirectPath: redirectOnError });
   } finally {
     if (deleteAfterAttempt) deleteAuthCookie(ctx, 'session');
   }
diff --git a/backend/src/modules/auth/oauth/handlers.ts b/backend/src/modules/auth/oauth/handlers.ts
index 5fdb0efde..b8eab4f73 100644
--- a/backend/src/modules/auth/oauth/handlers.ts
+++ b/backend/src/modules/auth/oauth/handlers.ts
@@ -100,14 +100,14 @@ const authOAuthRouteHandlers = app
 
     // When something went wrong during Github OAuth, fail early.
     if (error || !code) {
-      throw new AppError({ status: 400, type: 'oauth_failed', severity: 'warn', isRedirect: true });
+      throw new AppError({ status: 400, type: 'oauth_failed', severity: 'warn', redirectPath: '/auth/authenticate' });
     }
 
     // Check if Github OAuth is enabled
     const strategy = 'github' as EnabledOAuthProvider;
 
     if (!isOAuthEnabled(strategy)) {
-      throw new AppError({ status: 400, type: 'unsupported_oauth', severity: 'error', meta: { strategy }, isRedirect: true });
+      throw new AppError({ status: 400, type: 'unsupported_oauth', severity: 'error', meta: { strategy }, redirectPath: '/auth/authenticate' });
     }
 
     // Verify cookie by `state` (CSRF protection)
@@ -115,7 +115,7 @@ const authOAuthRouteHandlers = app
     const cookiePayload: OAuthCookiePayload | null = oauthCookie ? JSON.parse(oauthCookie) : null;
 
     if (!state || !cookiePayload) {
-      throw new AppError({ status: 401, type: 'invalid_state', severity: 'warn', meta: { strategy }, isRedirect: true });
+      throw new AppError({ status: 401, type: 'invalid_state', severity: 'warn', meta: { strategy }, redirectPath: '/auth/authenticate' });
     }
 
     try {
@@ -145,7 +145,7 @@ const authOAuthRouteHandlers = app
         type,
         severity: 'warn',
         meta: { strategy },
-        isRedirect: true,
+        redirectPath: '/auth/authenticate',
         ...(error instanceof Error ? { originalError: error } : {}),
       });
     }
@@ -160,7 +160,7 @@ const authOAuthRouteHandlers = app
     // Check if Google OAuth is enabled
     const strategy = 'google' as EnabledOAuthProvider;
     if (!isOAuthEnabled(strategy)) {
-      throw new AppError({ status: 400, type: 'unsupported_oauth', severity: 'error', meta: { strategy }, isRedirect: true });
+      throw new AppError({ status: 400, type: 'unsupported_oauth', severity: 'error', meta: { strategy }, redirectPath: '/auth/authenticate' });
     }
 
     // Verify cookie by `state` (CSRF protection) & PKCE validation
@@ -168,7 +168,7 @@ const authOAuthRouteHandlers = app
     const cookiePayload: OAuthCookiePayload | null = oauthCookie ? JSON.parse(oauthCookie) : null;
 
     if (!code || !cookiePayload || !cookiePayload.codeVerifier) {
-      throw new AppError({ status: 401, type: 'invalid_state', severity: 'warn', meta: { strategy }, isRedirect: true });
+      throw new AppError({ status: 401, type: 'invalid_state', severity: 'warn', meta: { strategy }, redirectPath: '/auth/authenticate' });
     }
 
     try {
@@ -192,7 +192,7 @@ const authOAuthRouteHandlers = app
         type,
         severity: 'warn',
         meta: { strategy },
-        isRedirect: true,
+        redirectPath: '/auth/authenticate',
         ...(error instanceof Error ? { originalError: error } : {}),
       });
     }
@@ -206,7 +206,7 @@ const authOAuthRouteHandlers = app
     // Check if Microsoft OAuth is enabled
     const strategy = 'microsoft' as EnabledOAuthProvider;
     if (!isOAuthEnabled(strategy)) {
-      throw new AppError({ status: 400, type: 'unsupported_oauth', severity: 'error', meta: { strategy }, isRedirect: true });
+      throw new AppError({ status: 400, type: 'unsupported_oauth', severity: 'error', meta: { strategy }, redirectPath: '/auth/authenticate' });
     }
 
     // Verify cookie by `state` (CSRF protection) & PKCE validation
@@ -214,7 +214,7 @@ const authOAuthRouteHandlers = app
     const cookiePayload: OAuthCookiePayload | null = oauthCookie ? JSON.parse(oauthCookie) : null;
 
     if (!code || !cookiePayload || !cookiePayload.codeVerifier) {
-      throw new AppError({ status: 401, type: 'invalid_state', severity: 'warn', meta: { strategy }, isRedirect: true });
+      throw new AppError({ status: 401, type: 'invalid_state', severity: 'warn', meta: { strategy }, redirectPath: '/auth/authenticate' });
     }
 
     try {
@@ -238,7 +238,7 @@ const authOAuthRouteHandlers = app
         type,
         severity: 'warn',
         meta: { strategy },
-        isRedirect: true,
+        redirectPath: '/auth/authenticate',
         ...(error instanceof Error ? { originalError: error } : {}),
       });
     }
diff --git a/backend/src/modules/auth/oauth/helpers/callback.ts b/backend/src/modules/auth/oauth/helpers/callback.ts
index 71ea0d4c5..7d81b8287 100644
--- a/backend/src/modules/auth/oauth/helpers/callback.ts
+++ b/backend/src/modules/auth/oauth/helpers/callback.ts
@@ -21,6 +21,8 @@ import { getValidToken } from '#/utils/get-valid-token';
 import { isValidRedirectPath } from '#/utils/is-redirect-url';
 import { getIsoDate } from '#/utils/iso-date';
 
+const redirectPath = '/auth/authenticate';
+
 /**
  * Handles the default OAuth authentication/signup flow.
  * Determines if the user has an existing verified/unverified account or needs to register.
@@ -69,14 +71,14 @@ export const handleOAuthCallback = async (
     .limit(2);
 
   // Multiple users with the same email → conflict
-  if (users.length > 1) throw new AppError({ status: 409, type: 'oauth_conflict', severity: 'error', isRedirect: true });
+  if (users.length > 1) throw new AppError({ status: 409, type: 'oauth_conflict', severity: 'error', redirectPath });
 
   // Existing user (by email) found -> suggest sign in and connect
-  if (users.length === 1) throw new AppError({ status: 409, type: 'oauth_email_exists', severity: 'warn', isRedirect: true });
+  if (users.length === 1) throw new AppError({ status: 409, type: 'oauth_email_exists', severity: 'warn', redirectPath });
 
   // No user found and registration is disabled
   if (!appConfig.has.registrationEnabled) {
-    throw new AppError({ status: 403, type: 'sign_up_restricted', isRedirect: true });
+    throw new AppError({ status: 403, type: 'sign_up_restricted', redirectPath });
   }
 
   // No user match → create a new user and OAuth account
@@ -111,7 +113,7 @@ const connectCallbackFlow = async (
   if (oauthAccount) {
     // OAuth account is linked to a different user
     if (oauthAccount.userId !== connectUserId) {
-      throw new AppError({ status: 409, type: 'oauth_conflict', severity: 'error', isRedirect: true });
+      throw new AppError({ status: 409, type: 'oauth_conflict', severity: 'error', redirectPath });
     }
 
     // Already linked + verified → log in the user
@@ -127,7 +129,7 @@ const connectCallbackFlow = async (
   // New OAuth account connection → validate email isn't used by another user
   const users = await usersBaseQuery().leftJoin(emailsTable, eq(usersTable.id, emailsTable.userId)).where(eq(emailsTable.email, providerUser.email));
   if (users.some((u) => u.id !== connectUserId)) {
-    throw new AppError({ status: 409, type: 'oauth_conflict', severity: 'error', isRedirect: true });
+    throw new AppError({ status: 409, type: 'oauth_conflict', severity: 'error', redirectPath });
   }
 
   // Safe to connect → create and link OAuth account to current user
@@ -158,20 +160,20 @@ const inviteCallbackFlow = async (
     token,
     invokeToken: false,
     tokenType: 'invitation',
-    isRedirect: true,
+    redirectPath,
   });
 
   // Email in token doesn't match provider email
   if (invitationToken.email !== providerUser.email) {
-    throw new AppError({ status: 409, type: 'oauth_wrong_email', severity: 'error', isRedirect: true });
+    throw new AppError({ status: 409, type: 'oauth_wrong_email', severity: 'error', redirectPath });
   }
 
   // OAuth account already linked
-  if (oauthAccount) throw new AppError({ status: 409, type: 'oauth_conflict', severity: 'error', isRedirect: true });
+  if (oauthAccount) throw new AppError({ status: 409, type: 'oauth_conflict', severity: 'error', redirectPath });
 
   // No linked OAuth account and email already in use by an existing user
   const users = await usersBaseQuery().leftJoin(emailsTable, eq(usersTable.id, emailsTable.userId)).where(eq(emailsTable.email, providerUser.email));
-  if (users.length) throw new AppError({ status: 409, type: 'oauth_email_exists', severity: 'error', isRedirect: true });
+  if (users.length) throw new AppError({ status: 409, type: 'oauth_email_exists', severity: 'error', redirectPath });
 
   // TODO User already signed up meanwhile?
 
@@ -199,11 +201,11 @@ const verifyCallbackFlow = async (
     token,
     invokeToken: false,
     tokenType: 'email-verification',
-    isRedirect: true,
+    redirectPath,
   });
 
   // No OauthAccount → invalid verification
-  if (!oauthAccount) throw new AppError({ status: 400, type: 'oauth_failed', severity: 'error', isRedirect: true });
+  if (!oauthAccount) throw new AppError({ status: 400, type: 'oauth_failed', severity: 'error', redirectPath });
 
   // Invalid token settings → invalid verification
   if (
@@ -212,7 +214,7 @@ const verifyCallbackFlow = async (
     verifyToken.oauthAccountId !== oauthAccount.id ||
     oauthAccount.provider !== provider
   ) {
-    throw new AppError({ status: 400, type: 'oauth_failed', severity: 'error', isRedirect: true });
+    throw new AppError({ status: 400, type: 'oauth_failed', severity: 'error', redirectPath });
   }
 
   const [user] = await usersBaseQuery().where(eq(usersTable.id, oauthAccount.userId));
diff --git a/backend/src/modules/auth/oauth/helpers/initiation.ts b/backend/src/modules/auth/oauth/helpers/initiation.ts
index 10b3fc1d7..fa8cfba59 100644
--- a/backend/src/modules/auth/oauth/helpers/initiation.ts
+++ b/backend/src/modules/auth/oauth/helpers/initiation.ts
@@ -118,9 +118,9 @@ const prepareOAuthAcceptInvite = async (ctx: Context<Env>) => {
   const token = await getAuthCookie(ctx, 'invitation');
 
   // Must provide a token and tokenId
-  if (!token) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error', isRedirect: true });
+  if (!token) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error', redirectPath: '/auth/authenticate' });
 
-  const tokenRecord = await getValidToken({ ctx, token, invokeToken: false, tokenType: 'invitation' });
+  const tokenRecord = await getValidToken({ ctx, token, invokeToken: false, tokenType: 'invitation', redirectPath: '/auth/authenticate' });
 
   const redirectPath = tokenRecord.entityType
     ? `${appConfig.backendAuthUrl}/invoke-token/${tokenRecord.type}/${tokenRecord.token}`
@@ -138,11 +138,11 @@ const prepareOAuthAcceptInvite = async (ctx: Context<Env>) => {
  * @throws AppError if missing param or user mismatch
  */
 const prepareOAuthConnect = async (ctx: Context<Env>) => {
-  const { sessionToken } = await getParsedSessionCookie(ctx, { redirectOnError: true });
+  const { sessionToken } = await getParsedSessionCookie(ctx, { redirectOnError: '/auth/authenticate' });
 
   // Get user from valid session
   const { user } = await validateSession(sessionToken);
-  if (!user) throw new AppError({ status: 404, type: 'not_found', entityType: 'user', severity: 'error', isRedirect: true });
+  if (!user) throw new AppError({ status: 404, type: 'not_found', entityType: 'user', severity: 'error', redirectPath: '/auth/authenticate' });
 
   //TODO we do this on callback or not?
   const redirectPath = '/settings#authentication';
@@ -158,7 +158,7 @@ const prepareOAuthConnect = async (ctx: Context<Env>) => {
  */
 const prepareOAuthVerify = async (ctx: Context<Env>) => {
   // Validate single use token from db
-  const tokenRecord = await getValidSingleUseToken({ ctx, tokenType: 'oauth-verification', isRedirect: true });
+  const tokenRecord = await getValidSingleUseToken({ ctx, tokenType: 'oauth-verification', redirectPath: '/auth/authenticate' });
 
   // Revoke single use token by deleting cookie
   deleteAuthCookie(ctx, 'oauth-verification');
diff --git a/backend/src/utils/get-valid-single-use-token.ts b/backend/src/utils/get-valid-single-use-token.ts
index aa5071e58..8d1a19476 100644
--- a/backend/src/utils/get-valid-single-use-token.ts
+++ b/backend/src/utils/get-valid-single-use-token.ts
@@ -9,7 +9,7 @@ import { getAuthCookie } from '#/modules/auth/general/helpers/cookie';
 type Props = {
   ctx: Context;
   tokenType: TokenType;
-  isRedirect?: boolean;
+  redirectPath?: string;
 };
 /**
  * Validates a single use token by its value, ensuring it matches the required type.
@@ -19,10 +19,10 @@ type Props = {
  * @returns The valid single use token record from the database.
  * @throws AppError if the token is not found or of an invalid type.
  */
-export const getValidSingleUseToken = async ({ ctx, tokenType, isRedirect }: Props): Promise<TokenModel> => {
+export const getValidSingleUseToken = async ({ ctx, tokenType, redirectPath }: Props): Promise<TokenModel> => {
   // Find single use token in cookie
   const singleUseToken = await getAuthCookie(ctx, tokenType);
-  if (!singleUseToken) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error', isRedirect });
+  if (!singleUseToken) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error', redirectPath });
 
   const condition = [
     eq(tokensTable.type, tokenType), // Match token type
@@ -35,10 +35,10 @@ export const getValidSingleUseToken = async ({ ctx, tokenType, isRedirect }: Pro
     .where(and(...condition))
     .limit(1);
 
-  if (!tokenRecord) throw new AppError({ status: 404, type: `${tokenType}_not_found`, severity: 'error', isRedirect });
+  if (!tokenRecord) throw new AppError({ status: 404, type: `${tokenType}_not_found`, severity: 'error', redirectPath });
 
   // Sanity check
-  if (tokenType && tokenRecord.type !== tokenType) throw new AppError({ status: 401, type: 'invalid_token', severity: 'error', isRedirect });
+  if (tokenType && tokenRecord.type !== tokenType) throw new AppError({ status: 401, type: 'invalid_token', severity: 'error', redirectPath });
 
   return tokenRecord;
 };
diff --git a/backend/src/utils/get-valid-token.ts b/backend/src/utils/get-valid-token.ts
index 55306bf87..f0fa38774 100644
--- a/backend/src/utils/get-valid-token.ts
+++ b/backend/src/utils/get-valid-token.ts
@@ -13,7 +13,7 @@ type BaseProps = {
   token: string;
   tokenType: TokenModel['type'];
   invokeToken?: boolean;
-  isRedirect?: boolean;
+  redirectPath?: string;
 };
 /**
  * Validates a token by its value or ID, ensuring it matches the required type and is neither expired nor invoked.
@@ -27,8 +27,7 @@ type BaseProps = {
  * @returns The valid token record from the database.
  * @throws AppError if the token is not found, expired, or of an invalid type.
  */
-// TODO redirect always true?
-export const getValidToken = async ({ ctx, token, tokenType, invokeToken = true, isRedirect = true }: BaseProps): Promise<TokenModel> => {
+export const getValidToken = async ({ ctx, token, tokenType, invokeToken = true, redirectPath }: BaseProps): Promise<TokenModel> => {
   const condition = [
     isNull(tokensTable.invokedAt), // Token not yet invoked
     gt(tokensTable.expiresAt, new Date()), // Token not expired
@@ -44,15 +43,15 @@ export const getValidToken = async ({ ctx, token, tokenType, invokeToken = true,
     .limit(1);
 
   // If token not found, perhaps user already has the single-use token
-  if (!tokenRecord) tokenRecord = await getValidSingleUseToken({ ctx, tokenType, isRedirect });
+  if (!tokenRecord) tokenRecord = await getValidSingleUseToken({ ctx, tokenType, redirectPath });
 
   // Token expired
   if (isExpiredDate(tokenRecord.expiresAt)) {
-    throw new AppError({ status: 401, type: `${tokenRecord.type}_expired`, severity: 'warn', isRedirect });
+    throw new AppError({ status: 401, type: `${tokenRecord.type}_expired`, severity: 'warn', redirectPath });
   }
 
   // Sanity check
-  if (tokenType && tokenRecord.type !== tokenType) throw new AppError({ status: 401, type: 'invalid_token', severity: 'error', isRedirect });
+  if (tokenType && tokenRecord.type !== tokenType) throw new AppError({ status: 401, type: 'invalid_token', severity: 'error', redirectPath });
 
   // Create single use session token and mark token as invoked
   if (invokeToken) {
diff --git a/frontend/src/modules/auth/create-password-form.tsx b/frontend/src/modules/auth/create-password-form.tsx
index 35a651055..8d1136026 100644
--- a/frontend/src/modules/auth/create-password-form.tsx
+++ b/frontend/src/modules/auth/create-password-form.tsx
@@ -9,9 +9,9 @@ import { useTranslation } from 'react-i18next';
 import { z } from 'zod';
 import { type CreatePasswordData, type CreatePasswordResponse, createPassword } from '~/api.gen';
 import type { ApiError } from '~/lib/api';
-import AuthErrorNotice from '~/modules/auth/error-notice';
 import { RequestPasswordDialog } from '~/modules/auth/request-password-dialog';
 import { useGetTokenData } from '~/modules/auth/use-token-check';
+import ErrorNotice from '~/modules/common/error-notice';
 import Spinner from '~/modules/common/spinner';
 import { toaster } from '~/modules/common/toaster/service';
 import { Button, SubmitButton } from '~/modules/ui/button';
@@ -61,13 +61,13 @@ const CreatePasswordForm = () => {
   // If error, allow to request new password reset
   if (error || resetPasswordError)
     return (
-      <AuthErrorNotice error={error || resetPasswordError}>
+      <ErrorNotice error={error || resetPasswordError} level={'public'}>
         <RequestPasswordDialog email={data?.email}>
           <Button ref={requestButtonRef} size="lg">
             {t('common:forgot_password')}
           </Button>
         </RequestPasswordDialog>
-      </AuthErrorNotice>
+      </ErrorNotice>
     );
 
   if (!data?.email) return null;
diff --git a/frontend/src/modules/auth/error-notice.tsx b/frontend/src/modules/auth/error-notice.tsx
deleted file mode 100644
index 97ccadc8d..000000000
--- a/frontend/src/modules/auth/error-notice.tsx
+++ /dev/null
@@ -1,56 +0,0 @@
-import { Link, useRouterState } from '@tanstack/react-router';
-import { MessageCircleQuestion } from 'lucide-react';
-import { useRef } from 'react';
-import { useTranslation } from 'react-i18next';
-import { type ErrorNoticeError, getErrorInfo, handleAskForHelp } from '~/modules/common/error-notice';
-import { Button, buttonVariants } from '~/modules/ui/button';
-import { Card, CardDescription, CardFooter, CardHeader, CardTitle } from '~/modules/ui/card';
-
-/**
- * UI to notify user about an authentication related error
- *
- * @param error - ErrorNoticeError
- * @param children - React.ReactNode (optional)
- */
-// TODO consider reducing duplication with common error notice
-const AuthErrorNotice = ({ error, children }: { error: ErrorNoticeError; children?: React.ReactNode }) => {
-  const { t } = useTranslation();
-  const { location } = useRouterState();
-
-  const contactButtonRef = useRef(null);
-
-  const { error: errorFromQuery, severity: severityFromQuery } = location.search;
-
-  const severity = error && 'status' in error ? error.severity : severityFromQuery;
-
-  const { title, message } = getErrorInfo(error, errorFromQuery);
-
-  return (
-    <Card className="bg-transparent border-0 md:-mx-16 lg:-mx-40">
-      <CardHeader className="text-center p-0">
-        <CardTitle className="text-2xl mb-2 justify-center">{title}</CardTitle>
-        <CardDescription className="text-foreground/80 text-lg flex-col gap-2">
-          <span className="block">{message}</span>
-          <span className="block mt-2 font-light">
-            <span className="block">{severity === 'warn' && t('error:contact_mistake')}</span>
-            <span className="block">{severity === 'error' && t('error:try_again_later')}</span>
-          </span>
-        </CardDescription>
-      </CardHeader>
-      <CardFooter className="flex gap-2 max-sm:flex-col max-sm:items-stretch flex-wrap mt-8 justify-center">
-        {children}
-        <Link to="/auth/authenticate" reloadDocument className={buttonVariants({ size: 'lg', variant: 'plain' })}>
-          {t('common:sign_in')}
-        </Link>
-        {severity && ['warn', 'error'].includes(severity) && (
-          <Button ref={contactButtonRef} variant="plain" onClick={() => handleAskForHelp(contactButtonRef)} size="lg">
-            <MessageCircleQuestion size={16} className="mr-2" />
-            {t('common:contact_support')}
-          </Button>
-        )}
-      </CardFooter>
-    </Card>
-  );
-};
-
-export default AuthErrorNotice;
diff --git a/frontend/src/modules/auth/steps/error.tsx b/frontend/src/modules/auth/steps/error.tsx
index 5d4a8093b..cbca8f778 100644
--- a/frontend/src/modules/auth/steps/error.tsx
+++ b/frontend/src/modules/auth/steps/error.tsx
@@ -1,5 +1,5 @@
-import AuthErrorNotice from '~/modules/auth/error-notice';
 import { useAuthStepsContext } from '~/modules/auth/steps/provider-context';
+import ErrorNotice from '~/modules/common/error-notice';
 import { ResendMembershipInviteButton } from '~/modules/memberships/resend-membership-invitation';
 
 /**
@@ -10,8 +10,8 @@ export const AuthErrorStep = () => {
   const { email, authError } = useAuthStepsContext();
 
   return (
-    <AuthErrorNotice error={authError}>
+    <ErrorNotice error={authError} level={'public'}>
       {authError?.type === 'invite_takes_priority' && <ResendMembershipInviteButton resendData={{ email }} buttonProps={{ size: 'lg' }} />}
-    </AuthErrorNotice>
+    </ErrorNotice>
   );
 };
diff --git a/frontend/src/modules/auth/steps/provider.tsx b/frontend/src/modules/auth/steps/provider.tsx
index 047ddffb1..cb45533ee 100644
--- a/frontend/src/modules/auth/steps/provider.tsx
+++ b/frontend/src/modules/auth/steps/provider.tsx
@@ -1,4 +1,5 @@
 import { useMatchRoute, useSearch } from '@tanstack/react-router';
+import { appConfig } from 'config';
 import { type ReactNode, useEffect, useState } from 'react';
 import type { ApiError } from '~/lib/api';
 import type { AuthStep } from '~/modules/auth/types';
@@ -10,7 +11,7 @@ import { AuthContext } from './provider-context';
 export const AuthStepsProvider = ({ children }: { children: ReactNode }) => {
   const matchRoute = useMatchRoute();
   const { lastUser } = useUserStore();
-  const { tokenId } = useSearch({ from: '/publicLayout/authLayout/auth/authenticate' });
+  const { tokenId, error, severity } = useSearch({ from: '/publicLayout/authLayout/auth/authenticate' });
 
   const isMfaRoute = !!matchRoute({ to: '/auth/authenticate/mfa-confirmation' });
 
@@ -40,6 +41,14 @@ export const AuthStepsProvider = ({ children }: { children: ReactNode }) => {
     if (isMfaRoute) setStepState('mfa');
   }, [isMfaRoute]);
 
+  useEffect(() => {
+    if (!error) return;
+
+    if (error === 'sign_up_restricted') {
+      setStepState(appConfig.has.waitlist ? 'waitlist' : 'inviteOnly');
+    } else setStepState('error');
+  }, [error, severity]);
+
   // If token is provided, directly set email and step based on token data
   useEffect(() => {
     if (!tokenId || !tokenData?.email) return;
diff --git a/frontend/src/modules/auth/steps/waitlist.tsx b/frontend/src/modules/auth/steps/waitlist.tsx
index 7a2b2d991..7cd44ea5a 100644
--- a/frontend/src/modules/auth/steps/waitlist.tsx
+++ b/frontend/src/modules/auth/steps/waitlist.tsx
@@ -21,11 +21,12 @@ export const WaitlistStep = () => {
       <>
         <div className="text-2xl text-center">
           <h1 className="text-xxl">{t('common:request_access')}</h1>
-
-          <Button variant="ghost" onClick={resetSteps} className="mx-auto flex max-w-full truncate font-light mt-2 sm:text-xl bg-foreground/10">
-            <span className="truncate">{email}</span>
-            <ChevronDown size={16} className="ml-1" />
-          </Button>
+          {email.length > 0 && (
+            <Button variant="ghost" onClick={resetSteps} className="mx-auto flex max-w-full truncate font-light mt-2 sm:text-xl bg-foreground/10">
+              <span className="truncate">{email}</span>
+              <ChevronDown size={16} className="ml-1" />
+            </Button>
+          )}
         </div>
         <LegalNotice email={email} mode="waitlist" />
       </>
diff --git a/frontend/src/modules/common/error-notice.tsx b/frontend/src/modules/common/error-notice.tsx
index 925d1a831..a1858468c 100644
--- a/frontend/src/modules/common/error-notice.tsx
+++ b/frontend/src/modules/common/error-notice.tsx
@@ -14,9 +14,10 @@ import { Card, CardContent, CardDescription, CardFooter, CardHeader, CardTitle }
 export type ErrorNoticeError = ApiError | Error | null;
 
 interface ErrorNoticeProps {
+  level: 'root' | 'app' | 'public';
   error?: ErrorNoticeError;
+  children?: React.ReactNode;
   resetErrorBoundary?: () => void;
-  level: 'root' | 'app' | 'public';
 }
 
 export const handleAskForHelp = (ref: RefObject<HTMLButtonElement | null>) => {
@@ -75,7 +76,7 @@ export const getErrorInfo = (error?: ErrorNoticeError, errorFromQuery?: string)
  * app: no footer required
  * public: show footer
  */
-const ErrorNotice = ({ error, resetErrorBoundary, level }: ErrorNoticeProps) => {
+const ErrorNotice = ({ error, children, resetErrorBoundary, level }: ErrorNoticeProps) => {
   const { t } = useTranslation();
   const { location } = useRouterState();
   const contactButtonRef = useRef<HTMLButtonElement>(null);
@@ -163,15 +164,21 @@ const ErrorNotice = ({ error, resetErrorBoundary, level }: ErrorNoticeProps) =>
               </CardContent>
             )}
             <CardFooter className="flex gap-2 max-sm:flex-col max-sm:items-stretch flex-wrap mt-8 justify-center">
-              <Button onClick={handleGoToHome} variant="secondary">
-                <Home size={16} className="mr-2" />
-                {t('common:home')}
-              </Button>
-              {!location.pathname.startsWith('/error') && severity !== 'info' && (
-                <Button onClick={handleReload}>
-                  <RefreshCw size={16} className="mr-2" />
-                  {t('common:reload')}
-                </Button>
+              {children ? (
+                children
+              ) : (
+                <>
+                  <Button onClick={handleGoToHome} variant="secondary">
+                    <Home size={16} className="mr-2" />
+                    {t('common:home')}
+                  </Button>
+                  {!location.pathname.startsWith('/error') && severity !== 'info' && (
+                    <Button onClick={handleReload}>
+                      <RefreshCw size={16} className="mr-2" />
+                      {t('common:reload')}
+                    </Button>
+                  )}
+                </>
               )}
               {severity && ['warn', 'error'].includes(severity) && (
                 <Button ref={contactButtonRef} variant="plain" onClick={() => handleAskForHelp(contactButtonRef)}>
diff --git a/frontend/src/modules/requests/waitlist-form.tsx b/frontend/src/modules/requests/waitlist-form.tsx
index 786143d05..d2454743a 100644
--- a/frontend/src/modules/requests/waitlist-form.tsx
+++ b/frontend/src/modules/requests/waitlist-form.tsx
@@ -65,12 +65,12 @@ export const WaitlistForm = ({ email, inputClassName, buttonContent, buttonClass
 
   return (
     <Form {...form}>
-      <form onSubmit={form.handleSubmit(onSubmit, defaultOnInvalid)} className={cn('max-xs:min-w-full flex flex-col gap-4 sm:flex-row', className)}>
+      <form onSubmit={form.handleSubmit(onSubmit, defaultOnInvalid)} className={cn('max-xs:min-w-full flex flex-col items-end gap-4', className)}>
         <FormField
           control={form.control}
           name="email"
           render={({ field }) => (
-            <FormItem className={`${!email ? '' : 'hidden'} grow gap-0`}>
+            <FormItem className={`${!email ? '' : 'hidden'} grow gap-0 w-full`}>
               <FormControl>
                 <Input
                   {...field}
diff --git a/frontend/src/routes/auth-routes.tsx b/frontend/src/routes/auth-routes.tsx
index d9008bafa..c2b5fe226 100644
--- a/frontend/src/routes/auth-routes.tsx
+++ b/frontend/src/routes/auth-routes.tsx
@@ -10,16 +10,18 @@ import AuthSteps from '~/modules/auth/steps';
 import { MfaStep } from '~/modules/auth/steps/mfa';
 import { AuthStepsProvider } from '~/modules/auth/steps/provider';
 import Unsubscribed from '~/modules/auth/unsubscribed';
-import { PublicLayoutRoute } from '~/routes/base-routes';
+import { errorSearchSchema, PublicLayoutRoute } from '~/routes/base-routes';
 import { useUserStore } from '~/store/user';
 import appTitle from '~/utils/app-title';
 
-const authenticateRouteSearch = z.object({
-  tokenId: z.string().optional(),
-  token: z.string().optional(),
-  redirect: z.string().optional(),
-  fromRoot: z.boolean().optional(),
-});
+const authenticateRouteSearch = z
+  .object({
+    tokenId: z.string().optional(),
+    token: z.string().optional(),
+    redirect: z.string().optional(),
+    fromRoot: z.boolean().optional(),
+  })
+  .extend(errorSearchSchema.shape);
 
 export const AuthLayoutRoute = createRoute({
   id: 'authLayout',
diff --git a/frontend/src/routes/base-routes.tsx b/frontend/src/routes/base-routes.tsx
index 23365668d..ef7f97201 100644
--- a/frontend/src/routes/base-routes.tsx
+++ b/frontend/src/routes/base-routes.tsx
@@ -19,7 +19,7 @@ import appTitle from '~/utils/app-title';
 // Lazy load main App component, which is behind authentication
 const AppLayout = lazy(() => import('~/modules/common/app/layout'));
 
-const errorSearchSchema = z.object({
+export const errorSearchSchema = z.object({
   error: z.string().optional(),
   severity: zApiError.shape.severity.optional(),
 });

From 1c6f4e4606e940672f2a9a2c302e3a1bb5400798 Mon Sep 17 00:00:00 2001
From: David Hordiienko <shiraz0david@gmail.com>
Date: Tue, 30 Sep 2025 10:09:52 +0300
Subject: [PATCH 23/48] chore: small fixes

---
 .../modules/auth/oauth/helpers/callback.ts    |   6 +-
 frontend/src/api.gen/sdk.gen.ts               | 100 +++++++++---------
 locales/en/backend.json                       |   2 +-
 3 files changed, 55 insertions(+), 53 deletions(-)

diff --git a/backend/src/modules/auth/oauth/helpers/callback.ts b/backend/src/modules/auth/oauth/helpers/callback.ts
index 7d81b8287..1cfb1d09e 100644
--- a/backend/src/modules/auth/oauth/helpers/callback.ts
+++ b/backend/src/modules/auth/oauth/helpers/callback.ts
@@ -110,10 +110,12 @@ const connectCallbackFlow = async (
   connectUserId: string,
   oauthAccount: OAuthAccountModel | null = null,
 ): Promise<Response> => {
+  const connectRedirectPath = '/settings';
+
   if (oauthAccount) {
     // OAuth account is linked to a different user
     if (oauthAccount.userId !== connectUserId) {
-      throw new AppError({ status: 409, type: 'oauth_conflict', severity: 'error', redirectPath });
+      throw new AppError({ status: 409, type: 'oauth_conflict', severity: 'error', redirectPath: connectRedirectPath });
     }
 
     // Already linked + verified → log in the user
@@ -129,7 +131,7 @@ const connectCallbackFlow = async (
   // New OAuth account connection → validate email isn't used by another user
   const users = await usersBaseQuery().leftJoin(emailsTable, eq(usersTable.id, emailsTable.userId)).where(eq(emailsTable.email, providerUser.email));
   if (users.some((u) => u.id !== connectUserId)) {
-    throw new AppError({ status: 409, type: 'oauth_conflict', severity: 'error', redirectPath });
+    throw new AppError({ status: 409, type: 'oauth_conflict', severity: 'error', redirectPath: connectRedirectPath });
   }
 
   // Safe to connect → create and link OAuth account to current user
diff --git a/frontend/src/api.gen/sdk.gen.ts b/frontend/src/api.gen/sdk.gen.ts
index e997141bd..6548b20ae 100644
--- a/frontend/src/api.gen/sdk.gen.ts
+++ b/frontend/src/api.gen/sdk.gen.ts
@@ -270,7 +270,7 @@ export const invokeToken = <ThrowOnError extends boolean = true>(options: Option
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -298,7 +298,7 @@ export const getTokenData = <ThrowOnError extends boolean = true>(options: Optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -325,7 +325,7 @@ export const startImpersonation = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -351,7 +351,7 @@ export const stopImpersonation = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -377,7 +377,7 @@ export const signOut = <ThrowOnError extends boolean = true>(options?: Options<S
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -721,7 +721,7 @@ export const signInWithPasskey = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -883,7 +883,7 @@ export const deleteMe = <ThrowOnError extends boolean = true>(options?: Options<
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -909,7 +909,7 @@ export const getMe = <ThrowOnError extends boolean = true>(options?: Options<Get
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -943,7 +943,7 @@ export const updateMe = <ThrowOnError extends boolean = true>(options?: Options<
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -976,7 +976,7 @@ export const toggleMfa = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1006,7 +1006,7 @@ export const getMyAuth = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1032,7 +1032,7 @@ export const getMyMenu = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1058,7 +1058,7 @@ export const getMyInvitations = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1085,7 +1085,7 @@ export const deleteMySessions = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1139,7 +1139,7 @@ export const getUploadToken = <ThrowOnError extends boolean = true>(options: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1167,7 +1167,7 @@ export const unsubscribeMe = <ThrowOnError extends boolean = true>(options: Opti
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1194,7 +1194,7 @@ export const deleteUsers = <ThrowOnError extends boolean = true>(options?: Optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1233,7 +1233,7 @@ export const getUsers = <ThrowOnError extends boolean = true>(options?: Options<
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1260,7 +1260,7 @@ export const getUser = <ThrowOnError extends boolean = true>(options: Options<Ge
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1294,7 +1294,7 @@ export const updateUser = <ThrowOnError extends boolean = true>(options: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1325,7 +1325,7 @@ export const deleteOrganizations = <ThrowOnError extends boolean = true>(options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1360,7 +1360,7 @@ export const getOrganizations = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1388,7 +1388,7 @@ export const createOrganization = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1419,7 +1419,7 @@ export const getOrganization = <ThrowOnError extends boolean = true>(options: Op
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1463,7 +1463,7 @@ export const updateOrganization = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1507,7 +1507,7 @@ export const getContextEntities = <ThrowOnError extends boolean = true>(options?
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1536,7 +1536,7 @@ export const getContextEntity = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1565,7 +1565,7 @@ export const checkSlug = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1596,7 +1596,7 @@ export const systemInvite = <ThrowOnError extends boolean = true>(options?: Opti
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1628,7 +1628,7 @@ export const getPresignedUrl = <ThrowOnError extends boolean = true>(options: Op
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1655,7 +1655,7 @@ export const paddleWebhook = <ThrowOnError extends boolean = true>(options?: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1690,7 +1690,7 @@ export const sendNewsletter = <ThrowOnError extends boolean = true>(options: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1721,7 +1721,7 @@ export const deleteRequests = <ThrowOnError extends boolean = true>(options?: Op
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1756,7 +1756,7 @@ export const getRequests = <ThrowOnError extends boolean = true>(options?: Optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1786,7 +1786,7 @@ export const createRequest = <ThrowOnError extends boolean = true>(options?: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1817,7 +1817,7 @@ export const getMetrics = <ThrowOnError extends boolean = true>(options?: Option
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1844,7 +1844,7 @@ export const getPublicCounts = <ThrowOnError extends boolean = true>(options?: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1879,7 +1879,7 @@ export const shapeProxy = <ThrowOnError extends boolean = true>(options: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1907,7 +1907,7 @@ export const deleteAttachments = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1944,7 +1944,7 @@ export const getAttachments = <ThrowOnError extends boolean = true>(options: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1971,7 +1971,7 @@ export const createAttachment = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2003,7 +2003,7 @@ export const getAttachment = <ThrowOnError extends boolean = true>(options: Opti
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2033,7 +2033,7 @@ export const updateAttachment = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2065,7 +2065,7 @@ export const redirectToAttachment = <ThrowOnError extends boolean = true>(option
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2095,7 +2095,7 @@ export const deleteMemberships = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2130,7 +2130,7 @@ export const membershipInvite = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2166,7 +2166,7 @@ export const updateMembership = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2198,7 +2198,7 @@ export const acceptMembership = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2233,7 +2233,7 @@ export const getMembers = <ThrowOnError extends boolean = true>(options: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2267,7 +2267,7 @@ export const getPendingInvitations = <ThrowOnError extends boolean = true>(optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
diff --git a/locales/en/backend.json b/locales/en/backend.json
index 16444f3c0..8dd36ae1e 100644
--- a/locales/en/backend.json
+++ b/locales/en/backend.json
@@ -11,7 +11,7 @@
   "email.email_verification.text": "Hi {{name}}, you are almost ready to start on {{appName}}! Click the link below to verify your email address '{{email}}' and get started. The link expires in 2 hours.",
   "email.oauth_verification.preview": "Verify connecting your {{ providerName}} to {{appName}}",
   "email.oauth_verification.subject": "Verify to connect",
-  "email.oauth_verification.text": "Hi {{name}}, to confirm linking your {{providerName}} account with email {{providerEmail}} to {{appName}} with email {{email}}, click the link below. The link expires in 2 hours.",
+  "email.oauth_verification.text": "Hi {{name}}, to confirm linking your {{providerName}} account to {{appName}} with email {{email}}, click the link below. The link expires in 2 hours.",
   "email.oauth_verification.verify": "Connect {{providerName}}",
   "email.hi": "Hi {{name}},",
   "email.invite_expires": "This link will expire in 7 days.",

From 45494bac004c86f4280185ebaa631db95fdaa7fb Mon Sep 17 00:00:00 2001
From: flipvanhaaren <flip@shareworks.nl>
Date: Tue, 30 Sep 2025 11:28:19 +0200
Subject: [PATCH 24/48] improve: progress on oauth

---
 backend/src/db/schema/oauth-accounts.ts       |   3 +-
 .../helpers/send-verification-email.ts        |  42 ++-----
 backend/src/modules/auth/oauth/handlers.ts    |  26 ++--
 .../modules/auth/oauth/helpers/callback.ts    |  66 +++++-----
 .../modules/auth/oauth/helpers/initiation.ts  |  15 +--
 .../helpers/send-oauth-verification-email.ts  | 113 +++++++++++++++++
 backend/src/modules/auth/oauth/schema.ts      |   5 +-
 frontend/src/api.gen/sdk.gen.ts               | 118 +++++++++---------
 frontend/src/api.gen/types.gen.ts             |  12 +-
 frontend/src/api.gen/zod.gen.ts               |  30 +++--
 frontend/src/modules/common/avatar-wrap.tsx   |   2 +-
 .../src/modules/me/entity-invitations.tsx     |   2 +-
 frontend/src/modules/me/settings-page.tsx     |   3 +-
 .../modules/navigation/menu-sheet/item.tsx    |   2 +-
 .../modules/organizations/table/columns.tsx   |   2 +-
 frontend/src/modules/users/user-cell.tsx      |   2 +-
 16 files changed, 268 insertions(+), 175 deletions(-)
 create mode 100644 backend/src/modules/auth/oauth/helpers/send-oauth-verification-email.ts

diff --git a/backend/src/db/schema/oauth-accounts.ts b/backend/src/db/schema/oauth-accounts.ts
index aae2bec44..9f0435e11 100644
--- a/backend/src/db/schema/oauth-accounts.ts
+++ b/backend/src/db/schema/oauth-accounts.ts
@@ -22,4 +22,5 @@ export const oauthAccountsTable = pgTable(
   (table) => [unique().on(table.provider, table.providerUserId, table.email)],
 );
 
-export type OAuthAccountModel = typeof oauthAccountsTable.$inferInsert;
+export type OAuthAccountModel = typeof oauthAccountsTable.$inferSelect;
+export type InsertOAuthAccountModel = typeof oauthAccountsTable.$inferInsert;
diff --git a/backend/src/modules/auth/general/helpers/send-verification-email.ts b/backend/src/modules/auth/general/helpers/send-verification-email.ts
index 7e85344bc..d841ecbac 100644
--- a/backend/src/modules/auth/general/helpers/send-verification-email.ts
+++ b/backend/src/modules/auth/general/helpers/send-verification-email.ts
@@ -3,7 +3,6 @@ import { and, eq } from 'drizzle-orm';
 import i18n from 'i18next';
 import { db } from '#/db/db';
 import { type EmailModel, emailsTable } from '#/db/schema/emails';
-import { oauthAccountsTable } from '#/db/schema/oauth-accounts';
 import { tokensTable } from '#/db/schema/tokens';
 import { usersTable } from '#/db/schema/users';
 import { AppError } from '#/lib/errors';
@@ -13,55 +12,36 @@ import { logEvent } from '#/utils/logger';
 import { nanoid } from '#/utils/nanoid';
 import { createDate, TimeSpan } from '#/utils/time-span';
 import { EmailVerificationEmail, type EmailVerificationEmailProps } from '../../../../../emails/email-verification';
-import { OAuthVerificationEmail, OAuthVerificationEmailProps } from '../../../../../emails/oauth-verification';
 
 interface Props {
   userId: string;
-  oauthAccountId?: string;
   redirectPath?: string;
 }
 
 /**
- * Send a verification email to user. There are two scenarios:
- * 1. Regular email verification (no oauthAccountId): user verifies their email address
- * 2. OAuth email verification (with oauthAccountId): user verifies by email to connect an OAuth account
+ * Send a verification email to user.
  */
-// TODO perhaps split or consider refactoring
-export const sendVerificationEmail = async ({ userId, oauthAccountId, redirectPath }: Props) => {
+export const sendVerificationEmail = async ({ userId, redirectPath }: Props) => {
   const [user] = await usersBaseQuery().where(eq(usersTable.id, userId)).limit(1);
 
   // User not found
   if (!user) throw new AppError({ status: 404, type: 'not_found', severity: 'warn', entityType: 'user' });
 
-  // OAuthAccountId is provided and doesnt exist
-  const [oauthAccount] = oauthAccountId ? await db.select().from(oauthAccountsTable).where(eq(oauthAccountsTable.id, oauthAccountId)) : [];
-  if (oauthAccountId && !oauthAccount) throw new AppError({ status: 404, type: 'not_found', severity: 'warn' });
-
   const [emailInUse]: (EmailModel | undefined)[] = await db
     .select()
     .from(emailsTable)
     .where(and(eq(emailsTable.email, user.email), eq(emailsTable.verified, true)));
 
-  // email verified (+ optional OAuthAccount verified)
-  if (emailInUse && (!oauthAccountId || oauthAccount.verified)) {
+  // email verified / TODO email_exists is perhaps wrong text, shouldnt it be email_already_verified?
+  if (emailInUse) {
     throw new AppError({ status: 409, type: 'email_exists', severity: 'warn', entityType: 'user' });
   }
 
   // Delete previous token
-  await db
-    .delete(tokensTable)
-    .where(
-      and(
-        ...[
-          eq(tokensTable.userId, user.id),
-          eq(tokensTable.type, 'email-verification'),
-          ...(oauthAccountId ? [eq(tokensTable.oauthAccountId, oauthAccountId)] : []),
-        ],
-      ),
-    );
+  await db.delete(tokensTable).where(and(eq(tokensTable.userId, user.id), eq(tokensTable.type, 'email-verification')));
 
   const token = nanoid(40);
-  const email = oauthAccount?.email ?? user.email;
+  const email = user.email;
 
   // Create new token
   const [tokenRecord] = await db
@@ -72,7 +52,6 @@ export const sendVerificationEmail = async ({ userId, oauthAccountId, redirectPa
       userId: user.id,
       email,
       createdBy: user.id,
-      ...(oauthAccountId && { oauthAccountId: oauthAccountId }),
       expiresAt: createDate(new TimeSpan(2, 'h')),
     })
     .returning();
@@ -102,18 +81,13 @@ export const sendVerificationEmail = async ({ userId, oauthAccountId, redirectPa
   if (redirectPath) verificationURL.searchParams.set('redirect', encodeURIComponent(redirectPath));
 
   // Prepare & send email
-  const subjectText = oauthAccount ? 'backend:email.oauth_verification.subject' : 'backend:email.email_verification.subject';
+  const subjectText = 'backend:email.email_verification.subject';
   const subject = i18n.t(subjectText, { lng, appName: appConfig.name });
   const staticProps = { verificationLink: verificationURL.toString(), subject, lng, name: user.name };
   const recipients = [{ email }];
   type Recipient = { email: string };
 
-  if (oauthAccount) {
-    const staticOAuthProps = { ...staticProps, providerEmail: oauthAccount.email, providerName: oauthAccount.provider };
-    mailer.prepareEmails<OAuthVerificationEmailProps, Recipient>(OAuthVerificationEmail, staticOAuthProps, recipients);
-  } else {
-    mailer.prepareEmails<EmailVerificationEmailProps, Recipient>(EmailVerificationEmail, staticProps, recipients);
-  }
+  mailer.prepareEmails<EmailVerificationEmailProps, Recipient>(EmailVerificationEmail, staticProps, recipients);
 
   logEvent('info', 'Verification email sent', { userId: user.id });
 };
diff --git a/backend/src/modules/auth/oauth/handlers.ts b/backend/src/modules/auth/oauth/handlers.ts
index b8eab4f73..5acfea357 100644
--- a/backend/src/modules/auth/oauth/handlers.ts
+++ b/backend/src/modules/auth/oauth/handlers.ts
@@ -100,7 +100,7 @@ const authOAuthRouteHandlers = app
 
     // When something went wrong during Github OAuth, fail early.
     if (error || !code) {
-      throw new AppError({ status: 400, type: 'oauth_failed', severity: 'warn', redirectPath: '/auth/authenticate' });
+      throw new AppError({ status: 400, type: 'oauth_failed', severity: 'error', redirectPath: '/auth/authenticate' });
     }
 
     // Check if Github OAuth is enabled
@@ -115,9 +115,11 @@ const authOAuthRouteHandlers = app
     const cookiePayload: OAuthCookiePayload | null = oauthCookie ? JSON.parse(oauthCookie) : null;
 
     if (!state || !cookiePayload) {
-      throw new AppError({ status: 401, type: 'invalid_state', severity: 'warn', meta: { strategy }, redirectPath: '/auth/authenticate' });
+      throw new AppError({ status: 401, type: 'invalid_state', severity: 'error', meta: { strategy }, redirectPath: '/auth/authenticate' });
     }
 
+    const callbackType = cookiePayload.type;
+
     try {
       // Exchange authorization code for access token and fetch Github user info
       const githubValidation = await githubAuth.validateAuthorizationCode(code);
@@ -134,7 +136,7 @@ const authOAuthRouteHandlers = app
       const providerUser = transformGithubUserData(githubUser, githubUserEmails);
 
       // TODO is it a good idea to have this inside the try catch too?
-      return await handleOAuthCallback(ctx, providerUser, strategy, cookiePayload);
+      return await handleOAuthCallback(ctx, callbackType, providerUser, strategy);
     } catch (error) {
       if (error instanceof AppError) throw error;
 
@@ -143,7 +145,7 @@ const authOAuthRouteHandlers = app
       throw new AppError({
         status: 401,
         type,
-        severity: 'warn',
+        severity: 'error',
         meta: { strategy },
         redirectPath: '/auth/authenticate',
         ...(error instanceof Error ? { originalError: error } : {}),
@@ -168,9 +170,11 @@ const authOAuthRouteHandlers = app
     const cookiePayload: OAuthCookiePayload | null = oauthCookie ? JSON.parse(oauthCookie) : null;
 
     if (!code || !cookiePayload || !cookiePayload.codeVerifier) {
-      throw new AppError({ status: 401, type: 'invalid_state', severity: 'warn', meta: { strategy }, redirectPath: '/auth/authenticate' });
+      throw new AppError({ status: 401, type: 'invalid_state', severity: 'error', meta: { strategy }, redirectPath: '/auth/authenticate' });
     }
 
+    const callbackType = cookiePayload.type;
+
     try {
       // Exchange authorization code for access token and fetch Google user info
       const googleValidation = await googleAuth.validateAuthorizationCode(code, cookiePayload.codeVerifier);
@@ -181,7 +185,7 @@ const authOAuthRouteHandlers = app
       const googleUser = (await response.json()) as GoogleUserProps;
       const providerUser = transformSocialUserData(googleUser);
 
-      return await handleOAuthCallback(ctx, providerUser, strategy, cookiePayload);
+      return await handleOAuthCallback(ctx, callbackType, providerUser, strategy);
     } catch (error) {
       if (error instanceof AppError) throw error;
 
@@ -190,7 +194,7 @@ const authOAuthRouteHandlers = app
       throw new AppError({
         status: 401,
         type,
-        severity: 'warn',
+        severity: 'error',
         meta: { strategy },
         redirectPath: '/auth/authenticate',
         ...(error instanceof Error ? { originalError: error } : {}),
@@ -214,9 +218,11 @@ const authOAuthRouteHandlers = app
     const cookiePayload: OAuthCookiePayload | null = oauthCookie ? JSON.parse(oauthCookie) : null;
 
     if (!code || !cookiePayload || !cookiePayload.codeVerifier) {
-      throw new AppError({ status: 401, type: 'invalid_state', severity: 'warn', meta: { strategy }, redirectPath: '/auth/authenticate' });
+      throw new AppError({ status: 401, type: 'invalid_state', severity: 'error', meta: { strategy }, redirectPath: '/auth/authenticate' });
     }
 
+    const callbackType = cookiePayload.type;
+
     try {
       // Exchange authorization code for access token and fetch Microsoft user info
       const microsoftValidation = await microsoftAuth.validateAuthorizationCode(code, cookiePayload.codeVerifier);
@@ -227,7 +233,7 @@ const authOAuthRouteHandlers = app
       const microsoftUser = (await response.json()) as MicrosoftUserProps;
       const providerUser = transformSocialUserData(microsoftUser);
 
-      return await handleOAuthCallback(ctx, providerUser, strategy, cookiePayload);
+      return await handleOAuthCallback(ctx, callbackType, providerUser, strategy);
     } catch (error) {
       if (error instanceof AppError) throw error;
 
@@ -236,7 +242,7 @@ const authOAuthRouteHandlers = app
       throw new AppError({
         status: 401,
         type,
-        severity: 'warn',
+        severity: 'error',
         meta: { strategy },
         redirectPath: '/auth/authenticate',
         ...(error instanceof Error ? { originalError: error } : {}),
diff --git a/backend/src/modules/auth/oauth/helpers/callback.ts b/backend/src/modules/auth/oauth/helpers/callback.ts
index 1cfb1d09e..5c35162ae 100644
--- a/backend/src/modules/auth/oauth/helpers/callback.ts
+++ b/backend/src/modules/auth/oauth/helpers/callback.ts
@@ -4,50 +4,48 @@ import type { Context } from 'hono';
 import { db } from '#/db/db';
 import { emailsTable } from '#/db/schema/emails';
 import { type OAuthAccountModel, oauthAccountsTable } from '#/db/schema/oauth-accounts';
-import type { TokenModel } from '#/db/schema/tokens';
 import { type UserModel, usersTable } from '#/db/schema/users';
 import { Env } from '#/lib/context';
 import { AppError } from '#/lib/errors';
 import { getAuthCookie } from '#/modules/auth/general/helpers/cookie';
 import { initiateMfa } from '#/modules/auth/general/helpers/mfa';
-import { sendVerificationEmail } from '#/modules/auth/general/helpers/send-verification-email';
-import { setUserSession } from '#/modules/auth/general/helpers/session';
+import { getParsedSessionCookie, setUserSession, validateSession } from '#/modules/auth/general/helpers/session';
 import { handleCreateUser } from '#/modules/auth/general/helpers/user';
-import type { OAuthCookiePayload } from '#/modules/auth/oauth/helpers/initiation';
 import type { Provider } from '#/modules/auth/oauth/helpers/providers';
+import { sendOAuthVerificationEmail } from '#/modules/auth/oauth/helpers/send-oauth-verification-email';
 import type { TransformedUser } from '#/modules/auth/oauth/helpers/transform-user-data';
 import { usersBaseQuery } from '#/modules/users/helpers/select';
-import { getValidToken } from '#/utils/get-valid-token';
+import { getValidSingleUseToken } from '#/utils/get-valid-single-use-token';
 import { isValidRedirectPath } from '#/utils/is-redirect-url';
 import { getIsoDate } from '#/utils/iso-date';
-
-const redirectPath = '/auth/authenticate';
+import { OAuthFlowType } from '../schema';
 
 /**
  * Handles the default OAuth authentication/signup flow.
  * Determines if the user has an existing verified/unverified account or needs to register.
  *
  * @param ctx - The request context.
+ * @param callbackType - type of callback, ie 'invite', 'connect'.
  * @param providerUser - The transformed user data from the OAuth provider.
  * @param provider - The OAuth provider (e.g., 'google', 'github').
- * @param oauthAccount - The linked OAuth account, if one exists.
  *
  * @returns A redirect response.
  */
 export const handleOAuthCallback = async (
   ctx: Context<Env>,
+  callbackType: OAuthFlowType,
   providerUser: TransformedUser,
   provider: EnabledOAuthProvider,
-  cookiePayload: OAuthCookiePayload,
 ): Promise<Response> => {
+  const redirectPath = '/auth/authenticate';
   const oauthAccount = await getOAuthAccount(providerUser.id, provider, providerUser.email);
 
-  const { connectUserId, inviteTokenId, verifyTokenId } = cookiePayload;
-
   // Handle OAuth callback flows based on cookie
-  if (connectUserId) return await connectCallbackFlow(ctx, providerUser, provider, connectUserId, oauthAccount);
-  if (inviteTokenId) return await inviteCallbackFlow(ctx, providerUser, provider, inviteTokenId, oauthAccount);
-  if (verifyTokenId) return await verifyCallbackFlow(ctx, providerUser, provider, verifyTokenId, oauthAccount);
+  if (callbackType === 'connect') return await connectCallbackFlow(ctx, providerUser, provider, oauthAccount);
+  if (callbackType === 'invite') return await inviteCallbackFlow(ctx, providerUser, provider, oauthAccount);
+  if (callbackType === 'verify') return await verifyCallbackFlow(ctx, providerUser, provider, oauthAccount);
+
+  // If not any of the above, proceed with basic authentication (sign in / sign up) flow
 
   // User already has a verified OAuth account → sign in
   if (oauthAccount?.verified) {
@@ -107,15 +105,22 @@ const connectCallbackFlow = async (
   ctx: Context<Env>,
   providerUser: TransformedUser,
   provider: EnabledOAuthProvider,
-  connectUserId: string,
   oauthAccount: OAuthAccountModel | null = null,
 ): Promise<Response> => {
-  const connectRedirectPath = '/settings';
+  const redirectPath = `/settings#authentication`;
+
+  const { sessionToken } = await getParsedSessionCookie(ctx, { redirectOnError: redirectPath });
+
+  // Get user from valid session
+  const { user } = await validateSession(sessionToken);
+  if (!user) throw new AppError({ status: 404, type: 'not_found', entityType: 'user', severity: 'error', redirectPath });
+
+  const connectUserId = user.id;
 
   if (oauthAccount) {
     // OAuth account is linked to a different user
     if (oauthAccount.userId !== connectUserId) {
-      throw new AppError({ status: 409, type: 'oauth_conflict', severity: 'error', redirectPath: connectRedirectPath });
+      throw new AppError({ status: 409, type: 'oauth_conflict', severity: 'error', redirectPath });
     }
 
     // Already linked + verified → log in the user
@@ -131,7 +136,7 @@ const connectCallbackFlow = async (
   // New OAuth account connection → validate email isn't used by another user
   const users = await usersBaseQuery().leftJoin(emailsTable, eq(usersTable.id, emailsTable.userId)).where(eq(emailsTable.email, providerUser.email));
   if (users.some((u) => u.id !== connectUserId)) {
-    throw new AppError({ status: 409, type: 'oauth_conflict', severity: 'error', redirectPath: connectRedirectPath });
+    throw new AppError({ status: 409, type: 'oauth_conflict', severity: 'error', redirectPath });
   }
 
   // Safe to connect → create and link OAuth account to current user
@@ -146,7 +151,6 @@ const connectCallbackFlow = async (
  * @param ctx - The request context.
  * @param providerUser - The transformed user data from the OAuth provider.
  * @param provider - The OAuth provider (e.g., 'google', 'github').
- * @param token - The invitation token.
  * @param oauthAccount - The linked OAuth account, if one exists.
  * @returns A redirect response.
  */
@@ -154,16 +158,10 @@ const inviteCallbackFlow = async (
   ctx: Context<Env>,
   providerUser: TransformedUser,
   provider: EnabledOAuthProvider,
-  token: TokenModel['token'],
   oauthAccount: OAuthAccountModel | null = null,
 ): Promise<Response> => {
-  const invitationToken = await getValidToken({
-    ctx,
-    token,
-    invokeToken: false,
-    tokenType: 'invitation',
-    redirectPath,
-  });
+  const redirectPath = '/auth/authenticate';
+  const invitationToken = await getValidSingleUseToken({ ctx, tokenType: 'invitation', redirectPath });
 
   // Email in token doesn't match provider email
   if (invitationToken.email !== providerUser.email) {
@@ -195,23 +193,17 @@ const verifyCallbackFlow = async (
   ctx: Context<Env>,
   providerUser: TransformedUser,
   provider: EnabledOAuthProvider,
-  token: TokenModel['token'],
   oauthAccount: OAuthAccountModel | null = null,
 ): Promise<Response> => {
-  const verifyToken = await getValidToken({
-    ctx,
-    token,
-    invokeToken: false,
-    tokenType: 'email-verification',
-    redirectPath,
-  });
+  const redirectPath = '/auth/authenticate';
+  const verifyToken = await getValidSingleUseToken({ ctx, tokenType: 'oauth-verification' });
 
   // No OauthAccount → invalid verification
   if (!oauthAccount) throw new AppError({ status: 400, type: 'oauth_failed', severity: 'error', redirectPath });
 
   // Invalid token settings → invalid verification
   if (
-    verifyToken.type !== 'email-verification' ||
+    verifyToken.type !== 'oauth-verification' ||
     verifyToken.email !== providerUser.email ||
     verifyToken.oauthAccountId !== oauthAccount.id ||
     oauthAccount.provider !== provider
@@ -351,7 +343,7 @@ const handleUnverifiedOAuthAccount = async (
 ): Promise<Response> => {
   const redirectPath = await getOAuthRedirectPath(ctx);
 
-  sendVerificationEmail({ userId: oauthAccount.userId, oauthAccountId: oauthAccount.id, redirectPath });
+  sendOAuthVerificationEmail({ userId: oauthAccount.userId, oauthAccountId: oauthAccount.id, redirectPath });
 
   const redirectUrl = new URL(`/auth/email-verification/${reason}?provider=${oauthAccount.provider}`, appConfig.frontendUrl);
 
diff --git a/backend/src/modules/auth/oauth/helpers/initiation.ts b/backend/src/modules/auth/oauth/helpers/initiation.ts
index fa8cfba59..60fca79b0 100644
--- a/backend/src/modules/auth/oauth/helpers/initiation.ts
+++ b/backend/src/modules/auth/oauth/helpers/initiation.ts
@@ -2,19 +2,18 @@ import { appConfig } from 'config';
 import type { Context } from 'hono';
 import { Env } from '#/lib/context';
 import { AppError } from '#/lib/errors';
-import { deleteAuthCookie, getAuthCookie, setAuthCookie } from '#/modules/auth/general/helpers/cookie';
+import { getAuthCookie, setAuthCookie } from '#/modules/auth/general/helpers/cookie';
 import { getParsedSessionCookie, validateSession } from '#/modules/auth/general/helpers/session';
 import { getValidSingleUseToken } from '#/utils/get-valid-single-use-token';
 import { getValidToken } from '#/utils/get-valid-token';
 import { isValidRedirectPath } from '#/utils/is-redirect-url';
 import { logEvent } from '#/utils/logger';
 import { TimeSpan } from '#/utils/time-span';
+import { OAuthFlowType } from '../schema';
 
 export interface OAuthCookiePayload {
   redirectPath: string;
-  inviteTokenId: string | null;
-  connectUserId: string | null;
-  verifyTokenId: string | null;
+  type: OAuthFlowType;
   codeVerifier?: string;
 }
 
@@ -33,12 +32,13 @@ export interface OAuthCookiePayload {
  * @returns redirect response
  */
 export const handleOAuthInitiation = async (ctx: Context<Env>, provider: string, url: URL, state: string, codeVerifier?: string) => {
+  // TODO Type of type is string, can we somehow get a stronger type from hono/zod/openapi, since it should be type OAuthFlowType?
   const { type } = ctx.req.query();
 
   const { redirectPath } = await prepareOAuthByContext(ctx);
-  const cookieContent = JSON.stringify({ redirectPath, codeVerifier });
+  const cookieContent = JSON.stringify({ redirectPath, codeVerifier, type });
 
-  // TODO state in name? perhaps in content instead? reconsider cookie lifecycle security
+  // TODO state in name? perhaps in content instead? reconsider cookie lifecycle security and cleanliness
   await setAuthCookie(ctx, `oauth_${state}`, cookieContent, new TimeSpan(5, 'm'));
 
   logEvent('info', 'User redirected to OAuth provider', { strategy: 'oauth', provider, type });
@@ -160,9 +160,6 @@ const prepareOAuthVerify = async (ctx: Context<Env>) => {
   // Validate single use token from db
   const tokenRecord = await getValidSingleUseToken({ ctx, tokenType: 'oauth-verification', redirectPath: '/auth/authenticate' });
 
-  // Revoke single use token by deleting cookie
-  deleteAuthCookie(ctx, 'oauth-verification');
-
   let redirectPath = appConfig.defaultRedirectPath;
 
   // If its a membership invitation
diff --git a/backend/src/modules/auth/oauth/helpers/send-oauth-verification-email.ts b/backend/src/modules/auth/oauth/helpers/send-oauth-verification-email.ts
new file mode 100644
index 000000000..ed649fd7d
--- /dev/null
+++ b/backend/src/modules/auth/oauth/helpers/send-oauth-verification-email.ts
@@ -0,0 +1,113 @@
+import { appConfig } from 'config';
+import { and, eq } from 'drizzle-orm';
+import i18n from 'i18next';
+import { db } from '#/db/db';
+import { type EmailModel, emailsTable } from '#/db/schema/emails';
+import { oauthAccountsTable } from '#/db/schema/oauth-accounts';
+import { tokensTable } from '#/db/schema/tokens';
+import { usersTable } from '#/db/schema/users';
+import { AppError } from '#/lib/errors';
+import { mailer } from '#/lib/mailer';
+import { usersBaseQuery } from '#/modules/users/helpers/select';
+import { logEvent } from '#/utils/logger';
+import { nanoid } from '#/utils/nanoid';
+import { createDate, TimeSpan } from '#/utils/time-span';
+import { OAuthVerificationEmail, OAuthVerificationEmailProps } from '../../../../../emails/oauth-verification';
+
+interface Props {
+  userId: string;
+  oauthAccountId: string;
+  redirectPath?: string;
+}
+
+/**
+ * OAuth email verification (with oauthAccountId): user verifies by email to connect an OAuth account
+ * This is done to be sure that the oauth account holder also owns the email address.
+ */
+export const sendOAuthVerificationEmail = async ({ userId, oauthAccountId, redirectPath }: Props) => {
+  const [user] = await usersBaseQuery().where(eq(usersTable.id, userId)).limit(1);
+
+  // User not found
+  if (!user) throw new AppError({ status: 404, type: 'not_found', severity: 'warn', entityType: 'user' });
+
+  // OAuthAccountId is provided and doesnt exist
+  const [oauthAccount] = await db.select().from(oauthAccountsTable).where(eq(oauthAccountsTable.id, oauthAccountId));
+  if (!oauthAccount) throw new AppError({ status: 404, type: 'not_found', severity: 'warn' });
+
+  const [emailInUse]: (EmailModel | undefined)[] = await db
+    .select()
+    .from(emailsTable)
+    .where(and(eq(emailsTable.email, user.email), eq(emailsTable.verified, true)));
+
+  // email and oauthAccount verified
+  if (emailInUse && oauthAccount.verified) {
+    throw new AppError({ status: 409, type: 'email_exists', severity: 'warn', entityType: 'user' });
+  }
+
+  // TODO move these queries into another helper that also is used by send-email-verification.ts?
+  // Delete previous token
+  await db
+    .delete(tokensTable)
+    .where(
+      and(
+        ...[
+          eq(tokensTable.userId, user.id),
+          eq(tokensTable.type, 'oauth-verification'),
+          ...(oauthAccountId ? [eq(tokensTable.oauthAccountId, oauthAccountId)] : []),
+        ],
+      ),
+    );
+
+  const token = nanoid(40);
+  const email = oauthAccount?.email ?? user.email;
+
+  // Create new token
+  const [tokenRecord] = await db
+    .insert(tokensTable)
+    .values({
+      token,
+      type: 'oauth-verification',
+      userId: user.id,
+      email,
+      createdBy: user.id,
+      ...(oauthAccountId && { oauthAccountId: oauthAccountId }),
+      expiresAt: createDate(new TimeSpan(2, 'h')),
+    })
+    .returning();
+
+  // Only update when no verified email exists
+  if (!emailInUse) {
+    await db
+      .insert(emailsTable)
+      .values({ email, userId: user.id, tokenId: tokenRecord.id })
+      .onConflictDoUpdate({
+        target: emailsTable.email,
+        where: eq(emailsTable.verified, false),
+        set: {
+          tokenId: tokenRecord.id,
+          userId: user.id,
+        },
+      });
+  }
+
+  // Send email
+  const lng = user.language;
+
+  // Create verification link: go to
+  const verifyPath = `/auth/invoke-token/${tokenRecord.type}/${tokenRecord.token}`;
+  const verificationURL = new URL(verifyPath, appConfig.backendUrl);
+
+  if (redirectPath) verificationURL.searchParams.set('redirect', encodeURIComponent(redirectPath));
+
+  // Prepare & send email
+  const subjectText = 'backend:email.email_verification.subject';
+  const subject = i18n.t(subjectText, { lng, appName: appConfig.name });
+  const staticProps = { verificationLink: verificationURL.toString(), subject, lng, name: user.name };
+  const recipients = [{ email }];
+  type Recipient = { email: string };
+
+  const staticOAuthProps = { ...staticProps, providerEmail: oauthAccount.email, providerName: oauthAccount.provider };
+  mailer.prepareEmails<OAuthVerificationEmailProps, Recipient>(OAuthVerificationEmail, staticOAuthProps, recipients);
+
+  logEvent('info', 'Verification email sent', { userId: user.id });
+};
diff --git a/backend/src/modules/auth/oauth/schema.ts b/backend/src/modules/auth/oauth/schema.ts
index 5a29b7269..bdf3ae279 100644
--- a/backend/src/modules/auth/oauth/schema.ts
+++ b/backend/src/modules/auth/oauth/schema.ts
@@ -1,7 +1,10 @@
 import { z } from '@hono/zod-openapi';
 
+const oauthFlowTypes = ['auth', 'connect', 'invite', 'verify'] as const;
+export type OAuthFlowType = (typeof oauthFlowTypes)[number];
+
 export const oauthQuerySchema = z.object({
-  type: z.enum(['auth', 'connect', 'invite', 'verify']),
+  type: z.enum(oauthFlowTypes).default('auth'),
   redirect: z.string().optional(),
 });
 
diff --git a/frontend/src/api.gen/sdk.gen.ts b/frontend/src/api.gen/sdk.gen.ts
index 6548b20ae..56c5d11d4 100644
--- a/frontend/src/api.gen/sdk.gen.ts
+++ b/frontend/src/api.gen/sdk.gen.ts
@@ -270,7 +270,7 @@ export const invokeToken = <ThrowOnError extends boolean = true>(options: Option
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -298,7 +298,7 @@ export const getTokenData = <ThrowOnError extends boolean = true>(options: Optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -325,7 +325,7 @@ export const startImpersonation = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -351,7 +351,7 @@ export const stopImpersonation = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -377,7 +377,7 @@ export const signOut = <ThrowOnError extends boolean = true>(options?: Options<S
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -721,7 +721,7 @@ export const signInWithPasskey = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -743,12 +743,12 @@ export const signInWithPasskey = <ThrowOnError extends boolean = true>(options?:
  * **GET /auth/github** ·· [github](http://localhost:4000/docs#tag/auth/get/auth/github) ·· _auth_
  *
  * @param {githubData} options
- * @param {enum} options.query.type - `enum`
+ * @param {enum=} options.query.type - `enum` (optional)
  * @param {string=} options.query.redirect - `string` (optional)
  * @returns Possible status codes: 302, 400, 401, 403, 404, 429
  */
-export const github = <ThrowOnError extends boolean = true>(options: Options<GithubData, ThrowOnError>) => {
-  return (options.client ?? client).get<unknown, GithubErrors, ThrowOnError, 'data'>({
+export const github = <ThrowOnError extends boolean = true>(options?: Options<GithubData, ThrowOnError>) => {
+  return (options?.client ?? client).get<unknown, GithubErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
     url: '/auth/github',
     ...options,
@@ -764,12 +764,12 @@ export const github = <ThrowOnError extends boolean = true>(options: Options<Git
  * **GET /auth/google** ·· [google](http://localhost:4000/docs#tag/auth/get/auth/google) ·· _auth_
  *
  * @param {googleData} options
- * @param {enum} options.query.type - `enum`
+ * @param {enum=} options.query.type - `enum` (optional)
  * @param {string=} options.query.redirect - `string` (optional)
  * @returns Possible status codes: 302, 400, 401, 403, 404, 429
  */
-export const google = <ThrowOnError extends boolean = true>(options: Options<GoogleData, ThrowOnError>) => {
-  return (options.client ?? client).get<unknown, GoogleErrors, ThrowOnError, 'data'>({
+export const google = <ThrowOnError extends boolean = true>(options?: Options<GoogleData, ThrowOnError>) => {
+  return (options?.client ?? client).get<unknown, GoogleErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
     url: '/auth/google',
     ...options,
@@ -785,12 +785,12 @@ export const google = <ThrowOnError extends boolean = true>(options: Options<Goo
  * **GET /auth/microsoft** ·· [microsoft](http://localhost:4000/docs#tag/auth/get/auth/microsoft) ·· _auth_
  *
  * @param {microsoftData} options
- * @param {enum} options.query.type - `enum`
+ * @param {enum=} options.query.type - `enum` (optional)
  * @param {string=} options.query.redirect - `string` (optional)
  * @returns Possible status codes: 302, 400, 401, 403, 404, 429
  */
-export const microsoft = <ThrowOnError extends boolean = true>(options: Options<MicrosoftData, ThrowOnError>) => {
-  return (options.client ?? client).get<unknown, MicrosoftErrors, ThrowOnError, 'data'>({
+export const microsoft = <ThrowOnError extends boolean = true>(options?: Options<MicrosoftData, ThrowOnError>) => {
+  return (options?.client ?? client).get<unknown, MicrosoftErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
     url: '/auth/microsoft',
     ...options,
@@ -883,7 +883,7 @@ export const deleteMe = <ThrowOnError extends boolean = true>(options?: Options<
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -909,7 +909,7 @@ export const getMe = <ThrowOnError extends boolean = true>(options?: Options<Get
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -943,7 +943,7 @@ export const updateMe = <ThrowOnError extends boolean = true>(options?: Options<
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -976,7 +976,7 @@ export const toggleMfa = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1006,7 +1006,7 @@ export const getMyAuth = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1032,7 +1032,7 @@ export const getMyMenu = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1058,7 +1058,7 @@ export const getMyInvitations = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1085,7 +1085,7 @@ export const deleteMySessions = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1139,7 +1139,7 @@ export const getUploadToken = <ThrowOnError extends boolean = true>(options: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1167,7 +1167,7 @@ export const unsubscribeMe = <ThrowOnError extends boolean = true>(options: Opti
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1194,7 +1194,7 @@ export const deleteUsers = <ThrowOnError extends boolean = true>(options?: Optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1233,7 +1233,7 @@ export const getUsers = <ThrowOnError extends boolean = true>(options?: Options<
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1260,7 +1260,7 @@ export const getUser = <ThrowOnError extends boolean = true>(options: Options<Ge
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1294,7 +1294,7 @@ export const updateUser = <ThrowOnError extends boolean = true>(options: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1325,7 +1325,7 @@ export const deleteOrganizations = <ThrowOnError extends boolean = true>(options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1360,7 +1360,7 @@ export const getOrganizations = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1388,7 +1388,7 @@ export const createOrganization = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1419,7 +1419,7 @@ export const getOrganization = <ThrowOnError extends boolean = true>(options: Op
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1463,7 +1463,7 @@ export const updateOrganization = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1507,7 +1507,7 @@ export const getContextEntities = <ThrowOnError extends boolean = true>(options?
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1536,7 +1536,7 @@ export const getContextEntity = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1565,7 +1565,7 @@ export const checkSlug = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1596,7 +1596,7 @@ export const systemInvite = <ThrowOnError extends boolean = true>(options?: Opti
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1628,7 +1628,7 @@ export const getPresignedUrl = <ThrowOnError extends boolean = true>(options: Op
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1655,7 +1655,7 @@ export const paddleWebhook = <ThrowOnError extends boolean = true>(options?: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1690,7 +1690,7 @@ export const sendNewsletter = <ThrowOnError extends boolean = true>(options: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1721,7 +1721,7 @@ export const deleteRequests = <ThrowOnError extends boolean = true>(options?: Op
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1756,7 +1756,7 @@ export const getRequests = <ThrowOnError extends boolean = true>(options?: Optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1786,7 +1786,7 @@ export const createRequest = <ThrowOnError extends boolean = true>(options?: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1817,7 +1817,7 @@ export const getMetrics = <ThrowOnError extends boolean = true>(options?: Option
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1844,7 +1844,7 @@ export const getPublicCounts = <ThrowOnError extends boolean = true>(options?: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1879,7 +1879,7 @@ export const shapeProxy = <ThrowOnError extends boolean = true>(options: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1907,7 +1907,7 @@ export const deleteAttachments = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1944,7 +1944,7 @@ export const getAttachments = <ThrowOnError extends boolean = true>(options: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1971,7 +1971,7 @@ export const createAttachment = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2003,7 +2003,7 @@ export const getAttachment = <ThrowOnError extends boolean = true>(options: Opti
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2033,7 +2033,7 @@ export const updateAttachment = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2065,7 +2065,7 @@ export const redirectToAttachment = <ThrowOnError extends boolean = true>(option
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2095,7 +2095,7 @@ export const deleteMemberships = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2130,7 +2130,7 @@ export const membershipInvite = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2166,7 +2166,7 @@ export const updateMembership = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2198,7 +2198,7 @@ export const acceptMembership = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2233,7 +2233,7 @@ export const getMembers = <ThrowOnError extends boolean = true>(options: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2267,7 +2267,7 @@ export const getPendingInvitations = <ThrowOnError extends boolean = true>(optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
diff --git a/frontend/src/api.gen/types.gen.ts b/frontend/src/api.gen/types.gen.ts
index 8333a521e..177cfb678 100644
--- a/frontend/src/api.gen/types.gen.ts
+++ b/frontend/src/api.gen/types.gen.ts
@@ -1292,8 +1292,8 @@ export type SignInWithPasskeyResponse = SignInWithPasskeyResponses[keyof SignInW
 export type GithubData = {
   body?: never;
   path?: never;
-  query: {
-    type: 'auth' | 'connect' | 'invite' | 'verify';
+  query?: {
+    type?: 'auth' | 'connect' | 'invite' | 'verify';
     redirect?: string;
   };
   url: '/auth/github';
@@ -1337,8 +1337,8 @@ export type GithubError = GithubErrors[keyof GithubErrors];
 export type GoogleData = {
   body?: never;
   path?: never;
-  query: {
-    type: 'auth' | 'connect' | 'invite' | 'verify';
+  query?: {
+    type?: 'auth' | 'connect' | 'invite' | 'verify';
     redirect?: string;
   };
   url: '/auth/google';
@@ -1382,8 +1382,8 @@ export type GoogleError = GoogleErrors[keyof GoogleErrors];
 export type MicrosoftData = {
   body?: never;
   path?: never;
-  query: {
-    type: 'auth' | 'connect' | 'invite' | 'verify';
+  query?: {
+    type?: 'auth' | 'connect' | 'invite' | 'verify';
     redirect?: string;
   };
   url: '/auth/microsoft';
diff --git a/frontend/src/api.gen/zod.gen.ts b/frontend/src/api.gen/zod.gen.ts
index 7bcc2ff67..6822b4fb1 100644
--- a/frontend/src/api.gen/zod.gen.ts
+++ b/frontend/src/api.gen/zod.gen.ts
@@ -524,28 +524,34 @@ export const zSignInWithPasskeyResponse = z.boolean();
 export const zGithubData = z.object({
   body: z.optional(z.never()),
   path: z.optional(z.never()),
-  query: z.object({
-    type: z.enum(['auth', 'connect', 'invite', 'verify']),
-    redirect: z.optional(z.string()),
-  }),
+  query: z.optional(
+    z.object({
+      type: z.optional(z.enum(['auth', 'connect', 'invite', 'verify'])),
+      redirect: z.optional(z.string()),
+    }),
+  ),
 });
 
 export const zGoogleData = z.object({
   body: z.optional(z.never()),
   path: z.optional(z.never()),
-  query: z.object({
-    type: z.enum(['auth', 'connect', 'invite', 'verify']),
-    redirect: z.optional(z.string()),
-  }),
+  query: z.optional(
+    z.object({
+      type: z.optional(z.enum(['auth', 'connect', 'invite', 'verify'])),
+      redirect: z.optional(z.string()),
+    }),
+  ),
 });
 
 export const zMicrosoftData = z.object({
   body: z.optional(z.never()),
   path: z.optional(z.never()),
-  query: z.object({
-    type: z.enum(['auth', 'connect', 'invite', 'verify']),
-    redirect: z.optional(z.string()),
-  }),
+  query: z.optional(
+    z.object({
+      type: z.optional(z.enum(['auth', 'connect', 'invite', 'verify'])),
+      redirect: z.optional(z.string()),
+    }),
+  ),
 });
 
 export const zGithubCallbackData = z.object({
diff --git a/frontend/src/modules/common/avatar-wrap.tsx b/frontend/src/modules/common/avatar-wrap.tsx
index acee8f335..f86571615 100644
--- a/frontend/src/modules/common/avatar-wrap.tsx
+++ b/frontend/src/modules/common/avatar-wrap.tsx
@@ -41,7 +41,7 @@ const AvatarWrap = memo(({ type, id, name, icon: Icon, url, className, ...props
       ) : (
         <AvatarFallback className={avatarBackground}>
           <span className="sr-only">{name}</span>
-          <div className="text-black opacity-80 flex h-full items-center justify-center">{name?.charAt(0).toUpperCase() || '-'}</div>
+          <div className="text-black opacity-80 font-semibold flex h-full items-center justify-center">{name?.charAt(0).toUpperCase() || '-'}</div>
         </AvatarFallback>
       )}
     </Avatar>
diff --git a/frontend/src/modules/me/entity-invitations.tsx b/frontend/src/modules/me/entity-invitations.tsx
index be6e9381d..ede0b3e43 100644
--- a/frontend/src/modules/me/entity-invitations.tsx
+++ b/frontend/src/modules/me/entity-invitations.tsx
@@ -62,7 +62,7 @@ export const EntityInvitations = () => {
                   <Link to={to} params={params} search={search} draggable="false" className="flex space-x-2 items-center outline-0 ring-0 group">
                     <AvatarWrap
                       type="organization"
-                      className="h-10 w-10 group-active:translate-y-[.05rem] group-hover:font-semibold"
+                      className="h-10 w-10 group-active:translate-y-[.05rem] group-hover:font-bold"
                       id={entity.id}
                       name={entity.name}
                       url={entity.thumbnailUrl}
diff --git a/frontend/src/modules/me/settings-page.tsx b/frontend/src/modules/me/settings-page.tsx
index 7321c8e53..1f6f5814d 100644
--- a/frontend/src/modules/me/settings-page.tsx
+++ b/frontend/src/modules/me/settings-page.tsx
@@ -82,9 +82,10 @@ const UserSettingsPage = () => {
     if (!onlineManager.isOnline()) return toaster(t('common:action.offline.text'), 'warning');
 
     // Proceed to OAuth URL with redirect and connect
+    // TODO show spinner/loading like in auth page?
     try {
       const baseUrl = `${appConfig.backendAuthUrl}/${provider}`;
-      const params = new URLSearchParams({ connectUserId: user.id, type: 'connect', redirect: encodeURIComponent(window.location.pathname) });
+      const params = new URLSearchParams({ type: 'connect', redirect: encodeURIComponent(window.location.pathname) });
 
       const providerUrl = `${baseUrl}?${params.toString()}`;
       window.location.assign(providerUrl);
diff --git a/frontend/src/modules/navigation/menu-sheet/item.tsx b/frontend/src/modules/navigation/menu-sheet/item.tsx
index 305993d62..52c95a59a 100644
--- a/frontend/src/modules/navigation/menu-sheet/item.tsx
+++ b/frontend/src/modules/navigation/menu-sheet/item.tsx
@@ -52,7 +52,7 @@ export const MenuSheetItem = ({ item, icon: Icon, className, searchResults }: Me
     >
       <span className="absolute left-0 top-3 h-[calc(100%-1.5rem)] w-1 rounded-lg bg-primary transition-opacity opacity-0 group-data-[link-active=true]/menuItem:opacity-100" />
       <AvatarWrap
-        className="z-1 items-center m-2 mx-3 group-hover/menuItem:font-semibold group-data-[subitem=true]/menuItem:my-2 group-data-[subitem=true]/menuItem:mx-4 group-data-[subitem=true]/menuItem:text-xs h-8 w-8 group-data-[subitem=true]/menuItem:h-6 group-active/menuItem:translate-y-[.05rem] group-data-[subitem=true]/menuItem:w-6"
+        className="z-1 items-center m-2 mx-3 group-hover/menuItem:font-bold group-data-[subitem=true]/menuItem:my-2 group-data-[subitem=true]/menuItem:mx-4 group-data-[subitem=true]/menuItem:text-xs h-8 w-8 group-data-[subitem=true]/menuItem:h-6 group-active/menuItem:translate-y-[.05rem] group-data-[subitem=true]/menuItem:w-6"
         type={item.entityType}
         id={item.id}
         icon={Icon}
diff --git a/frontend/src/modules/organizations/table/columns.tsx b/frontend/src/modules/organizations/table/columns.tsx
index 89a9b3e11..eef1a5393 100644
--- a/frontend/src/modules/organizations/table/columns.tsx
+++ b/frontend/src/modules/organizations/table/columns.tsx
@@ -36,7 +36,7 @@ export const useColumns = () => {
           >
             <AvatarWrap
               type="organization"
-              className="h-8 w-8 group-active:translate-y-[.05rem] group-hover:font-semibold"
+              className="h-8 w-8 group-active:translate-y-[.05rem] group-hover:font-bold"
               id={row.id}
               name={row.name}
               url={row.thumbnailUrl}
diff --git a/frontend/src/modules/users/user-cell.tsx b/frontend/src/modules/users/user-cell.tsx
index e1d2af6d0..7b5e5dde8 100644
--- a/frontend/src/modules/users/user-cell.tsx
+++ b/frontend/src/modules/users/user-cell.tsx
@@ -51,7 +51,7 @@ export const UserCell = ({ user, orgIdOrSlug, tabIndex }: BaseProps & { user: Us
     >
       <AvatarWrap
         type="user"
-        className="h-8 w-8 group-active:translate-y-[.05rem] group-hover:font-semibold"
+        className="h-8 w-8 group-active:translate-y-[.05rem] group-hover:font-bold"
         id={user.id}
         name={user.name}
         url={user.thumbnailUrl}

From e74c29f9e4cec1d2846af6d5e9a6ede2b1104d68 Mon Sep 17 00:00:00 2001
From: flipvanhaaren <flip@shareworks.nl>
Date: Tue, 30 Sep 2025 11:56:30 +0200
Subject: [PATCH 25/48] chore: add todo for create membership

---
 backend/src/modules/memberships/handlers.ts | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/backend/src/modules/memberships/handlers.ts b/backend/src/modules/memberships/handlers.ts
index f5810b12a..93af88fdd 100644
--- a/backend/src/modules/memberships/handlers.ts
+++ b/backend/src/modules/memberships/handlers.ts
@@ -33,6 +33,11 @@ const app = new OpenAPIHono<Env>({ defaultHook });
 const membershipRouteHandlers = app
   /**
    * Create memberships (invite members) for an entity such as an organization
+   * TODO: rework this to not use tokens if not necessary.
+   * 1. email doesn't exist in emailsTable AND not in tokensTable (so no pending invitation) -> add to recipients list and create invitation token.
+   * 2. email doesn't exist in emailsTable BUT does exist in tokensTable (so pending invitation already) -> if token is expired, add to recipients,
+   * remove the old token and create a new one.
+   * 3. email exists in emailsTable: dont create a token but just s membership without activation.
    */
   .openapi(membershipRoutes.createMemberships, async (ctx) => {
     const { emails, role } = ctx.req.valid('json');
@@ -262,9 +267,7 @@ const membershipRouteHandlers = app
     const targets = await db
       .select()
       .from(membershipsTable)
-      .where(
-        and(inArray(membershipsTable.userId, membershipIds), eq(membershipsTable[entityIdField], entity.id), isNotNull(membershipsTable.activatedAt)),
-      );
+      .where(and(inArray(membershipsTable.userId, membershipIds), eq(membershipsTable[entityIdField], entity.id)));
 
     // Check if membership exist
     const rejectedItems: string[] = [];

From 2a1e2e0ad41ebd26b8ce7f40ad3307817ef539eb Mon Sep 17 00:00:00 2001
From: flipvanhaaren <flip@shareworks.nl>
Date: Tue, 30 Sep 2025 14:12:29 +0200
Subject: [PATCH 26/48] chore: align auth endpoint naming

---
 backend/src/modules/auth/passkeys/handlers.ts |  2 +-
 backend/src/modules/auth/passkeys/routes.ts   | 12 +--
 backend/src/modules/auth/totps/handlers.ts    |  6 +-
 backend/src/modules/auth/totps/routes.ts      | 16 ++--
 config/default.ts                             |  2 +-
 frontend/src/api.gen/sdk.gen.ts               | 76 +++++++++----------
 frontend/src/api.gen/types.gen.ts             | 60 +++++++--------
 frontend/src/api.gen/zod.gen.ts               | 30 ++++----
 .../src/modules/auth/passkey-credentials.ts   |  4 +-
 frontend/src/modules/auth/types.ts            |  4 +-
 frontend/src/modules/me/totp/setup.tsx        |  4 +-
 11 files changed, 108 insertions(+), 108 deletions(-)

diff --git a/backend/src/modules/auth/passkeys/handlers.ts b/backend/src/modules/auth/passkeys/handlers.ts
index 5507793a7..0e9ce9b51 100644
--- a/backend/src/modules/auth/passkeys/handlers.ts
+++ b/backend/src/modules/auth/passkeys/handlers.ts
@@ -82,7 +82,7 @@ const authPasskeysRouteHandlers = app
   /**
    * Passkey challenge
    */
-  .openapi(authPasskeysRoutes.createPasskeyChallenge, async (ctx) => {
+  .openapi(authPasskeysRoutes.generatePasskeyChallenge, async (ctx) => {
     const { email, type } = ctx.req.valid('json');
 
     // Generate a 32-byte random challenge and encode it as Base64
diff --git a/backend/src/modules/auth/passkeys/routes.ts b/backend/src/modules/auth/passkeys/routes.ts
index 29dff3e0b..212eb68b7 100644
--- a/backend/src/modules/auth/passkeys/routes.ts
+++ b/backend/src/modules/auth/passkeys/routes.ts
@@ -7,21 +7,21 @@ import { errorResponses, successWithoutDataSchema } from '#/utils/schema/respons
 import { passkeyChallengeBodySchema, passkeyChallengeSchema, passkeyCreateBodySchema, passkeySchema, passkeyVerificationBodySchema } from './schema';
 
 const authPasskeysRoutes = {
-  createPasskeyChallenge: createCustomRoute({
-    operationId: 'createPasskeyChallenge',
+  generatePasskeyChallenge: createCustomRoute({
+    operationId: 'generatePasskeyChallenge',
     method: 'post',
-    path: '/passkey-challenge',
+    path: '/passkey/generate-challenge',
     guard: isPublicAccess,
     // TODO look into rate limit customized for passkeys
     middleware: [spamLimiter],
     tags: ['auth'],
-    summary: 'Create passkey challenge',
-    description: 'Initiates the passkey registration or authentication flow by creating a device bound challenge.',
+    summary: 'Generate passkey challenge',
+    description: 'Initiates the passkey registration or authentication flow by generating a device bound challenge.',
     security: [],
     request: { body: { content: { 'application/json': { schema: passkeyChallengeBodySchema } } } },
     responses: {
       200: {
-        description: 'Challenge created',
+        description: 'Challenge generated',
         content: { 'application/json': { schema: passkeyChallengeSchema } },
       },
       ...errorResponses,
diff --git a/backend/src/modules/auth/totps/handlers.ts b/backend/src/modules/auth/totps/handlers.ts
index 074b1f9f5..863c2d15d 100644
--- a/backend/src/modules/auth/totps/handlers.ts
+++ b/backend/src/modules/auth/totps/handlers.ts
@@ -24,9 +24,9 @@ const app = new OpenAPIHono<Env>({ defaultHook });
 
 const authTotpsRouteHandlers = app
   /**
-   * Register TOTP
+   * Create TOTP key
    */
-  .openapi(authTotpsRoutes.createTotpChallenge, async (ctx) => {
+  .openapi(authTotpsRoutes.generateTotpKey, async (ctx) => {
     const user = getContextUser();
 
     // Generate a 20-byte random secret and encode it as Base32
@@ -44,7 +44,7 @@ const authTotpsRouteHandlers = app
     return ctx.json({ totpUri, manualKey }, 200);
   })
   /**
-   * Activate TOTP
+   * Create TOTP in database
    */
   .openapi(authTotpsRoutes.createTotp, async (ctx) => {
     const { code } = ctx.req.valid('json');
diff --git a/backend/src/modules/auth/totps/routes.ts b/backend/src/modules/auth/totps/routes.ts
index 43ad5de02..3b3ab1f4c 100644
--- a/backend/src/modules/auth/totps/routes.ts
+++ b/backend/src/modules/auth/totps/routes.ts
@@ -7,14 +7,14 @@ import { errorResponses, successWithoutDataSchema } from '#/utils/schema/respons
 import { totpCreateBodySchema } from './schema';
 
 const authTotpsRoutes = {
-  createTotpChallenge: createCustomRoute({
-    operationId: 'createTotpChallenge',
+  generateTotpKey: createCustomRoute({
+    operationId: 'generateTotpKey',
     method: 'post',
-    path: '/totp/register',
+    path: '/totp/generate-key',
     guard: isAuthenticated,
     tags: ['auth'],
-    summary: 'Create TOTP challenge',
-    description: 'Generates a new TOTP challenge for current user and returns a provisioning URI and Base32 manual key.',
+    summary: 'Generate TOTP key',
+    description: 'Generates a new TOTP key for current user and returns a provisioning URI and Base32 manual key.',
     security: [],
     responses: {
       200: {
@@ -28,10 +28,10 @@ const authTotpsRoutes = {
   createTotp: createCustomRoute({
     operationId: 'createTotp',
     method: 'post',
-    path: '/totp/activate',
+    path: '/totp',
     guard: isAuthenticated,
     tags: ['auth'],
-    summary: 'Activate TOTP',
+    summary: 'Set TOTP',
     description:
       'Confirms TOTP setup by verifying a code from the authenticator app for the first time. On success, TOTP is registered for current user.',
     security: [],
@@ -44,7 +44,7 @@ const authTotpsRoutes = {
 
     responses: {
       200: {
-        description: 'TOTP activated',
+        description: 'TOTP created',
         content: { 'application/json': { schema: successWithoutDataSchema } },
       },
       ...errorResponses,
diff --git a/config/default.ts b/config/default.ts
index 2cf7a7af3..956081535 100644
--- a/config/default.ts
+++ b/config/default.ts
@@ -140,7 +140,7 @@ enabledOAuthProviders: ['github'] as const,
 
   // TOTP configuration
   totpConfig: { 
-    intervalInSeconds: 60,
+    intervalInSeconds: 30,
     gracePeriodInSeconds: 60,
     digits: 6
   },
diff --git a/frontend/src/api.gen/sdk.gen.ts b/frontend/src/api.gen/sdk.gen.ts
index 56c5d11d4..a9930b7e0 100644
--- a/frontend/src/api.gen/sdk.gen.ts
+++ b/frontend/src/api.gen/sdk.gen.ts
@@ -18,9 +18,6 @@ import type {
   CreateOrganizationData,
   CreateOrganizationErrors,
   CreateOrganizationResponses,
-  CreatePasskeyChallengeData,
-  CreatePasskeyChallengeErrors,
-  CreatePasskeyChallengeResponses,
   CreatePasskeyData,
   CreatePasskeyErrors,
   CreatePasskeyResponses,
@@ -30,9 +27,6 @@ import type {
   CreateRequestData,
   CreateRequestErrors,
   CreateRequestResponses,
-  CreateTotpChallengeData,
-  CreateTotpChallengeErrors,
-  CreateTotpChallengeResponses,
   CreateTotpData,
   CreateTotpErrors,
   CreateTotpResponses,
@@ -66,6 +60,12 @@ import type {
   DeleteUsersData,
   DeleteUsersErrors,
   DeleteUsersResponses,
+  GeneratePasskeyChallengeData,
+  GeneratePasskeyChallengeErrors,
+  GeneratePasskeyChallengeResponses,
+  GenerateTotpKeyData,
+  GenerateTotpKeyErrors,
+  GenerateTotpKeyResponses,
   GetAttachmentData,
   GetAttachmentErrors,
   GetAttachmentResponses,
@@ -387,64 +387,64 @@ export const signOut = <ThrowOnError extends boolean = true>(options?: Options<S
 };
 
 /**
- * Create TOTP challenge
+ * Generate TOTP key
  * 🛡️ Requires authentication
  *
- * Generates a new TOTP challenge for current user and returns a provisioning URI and Base32 manual key.
+ * Generates a new TOTP key for current user and returns a provisioning URI and Base32 manual key.
  *
- * **POST /auth/totp/register** ·· [createTotpChallenge](http://localhost:4000/docs#tag/auth/post/auth/totp/register) ·· _auth_
+ * **POST /auth/totp/generate-key** ·· [generateTotpKey](http://localhost:4000/docs#tag/auth/post/auth/totp/generate-key) ·· _auth_
  *
- * @param {createTotpChallengeData} options
+ * @param {generateTotpKeyData} options
  * @returns Possible status codes: 200, 400, 401, 403, 404, 429
  */
-export const createTotpChallenge = <ThrowOnError extends boolean = true>(options?: Options<CreateTotpChallengeData, ThrowOnError>) => {
-  return (options?.client ?? client).post<CreateTotpChallengeResponses, CreateTotpChallengeErrors, ThrowOnError, 'data'>({
+export const generateTotpKey = <ThrowOnError extends boolean = true>(options?: Options<GenerateTotpKeyData, ThrowOnError>) => {
+  return (options?.client ?? client).post<GenerateTotpKeyResponses, GenerateTotpKeyErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
-    url: '/auth/totp/register',
+    url: '/auth/totp/generate-key',
     ...options,
   });
 };
 
 /**
- * Activate TOTP
+ * Delete TOTP
  * 🛡️ Requires authentication
  *
- * Confirms TOTP setup by verifying a code from the authenticator app for the first time. On success, TOTP is registered for current user.
+ * Delete TOTP credential for current user.
  *
- * **POST /auth/totp/activate** ·· [createTotp](http://localhost:4000/docs#tag/auth/post/auth/totp/activate) ·· _auth_
+ * **DELETE /auth/totp** ·· [deleteTotp](http://localhost:4000/docs#tag/auth/delete/auth/totp) ·· _auth_
  *
- * @param {createTotpData} options
- * @param {string=} options.body.code - `string` (optional)
+ * @param {deleteTotpData} options
  * @returns Possible status codes: 200, 400, 401, 403, 404, 429
  */
-export const createTotp = <ThrowOnError extends boolean = true>(options: Options<CreateTotpData, ThrowOnError>) => {
-  return (options.client ?? client).post<CreateTotpResponses, CreateTotpErrors, ThrowOnError, 'data'>({
+export const deleteTotp = <ThrowOnError extends boolean = true>(options?: Options<DeleteTotpData, ThrowOnError>) => {
+  return (options?.client ?? client).delete<DeleteTotpResponses, DeleteTotpErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
-    url: '/auth/totp/activate',
+    url: '/auth/totp',
     ...options,
-    headers: {
-      'Content-Type': 'application/json',
-      ...options.headers,
-    },
   });
 };
 
 /**
- * Delete TOTP
+ * Set TOTP
  * 🛡️ Requires authentication
  *
- * Delete TOTP credential for current user.
+ * Confirms TOTP setup by verifying a code from the authenticator app for the first time. On success, TOTP is registered for current user.
  *
- * **DELETE /auth/totp** ·· [deleteTotp](http://localhost:4000/docs#tag/auth/delete/auth/totp) ·· _auth_
+ * **POST /auth/totp** ·· [createTotp](http://localhost:4000/docs#tag/auth/post/auth/totp) ·· _auth_
  *
- * @param {deleteTotpData} options
+ * @param {createTotpData} options
+ * @param {string=} options.body.code - `string` (optional)
  * @returns Possible status codes: 200, 400, 401, 403, 404, 429
  */
-export const deleteTotp = <ThrowOnError extends boolean = true>(options?: Options<DeleteTotpData, ThrowOnError>) => {
-  return (options?.client ?? client).delete<DeleteTotpResponses, DeleteTotpErrors, ThrowOnError, 'data'>({
+export const createTotp = <ThrowOnError extends boolean = true>(options: Options<CreateTotpData, ThrowOnError>) => {
+  return (options.client ?? client).post<CreateTotpResponses, CreateTotpErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
     url: '/auth/totp',
     ...options,
+    headers: {
+      'Content-Type': 'application/json',
+      ...options.headers,
+    },
   });
 };
 
@@ -672,23 +672,23 @@ export const deletePasskey = <ThrowOnError extends boolean = true>(options: Opti
 };
 
 /**
- * Create passkey challenge
+ * Generate passkey challenge
  * 🌐 Public access
  * ⏳ Spam (10/h)
  *
- * Initiates the passkey registration or authentication flow by creating a device bound challenge.
+ * Initiates the passkey registration or authentication flow by generating a device bound challenge.
  *
- * **POST /auth/passkey-challenge** ·· [createPasskeyChallenge](http://localhost:4000/docs#tag/auth/post/auth/passkey-challenge) ·· _auth_
+ * **POST /auth/passkey/generate-challenge** ·· [generatePasskeyChallenge](http://localhost:4000/docs#tag/auth/post/auth/passkey/generate-challenge) ·· _auth_
  *
- * @param {createPasskeyChallengeData} options
+ * @param {generatePasskeyChallengeData} options
  * @param {enum | enum | enum=} options.body.type - `enum | enum | enum` (optional)
  * @param {string=} options.body.email - `string` (optional)
  * @returns Possible status codes: 200, 400, 401, 403, 404, 429
  */
-export const createPasskeyChallenge = <ThrowOnError extends boolean = true>(options?: Options<CreatePasskeyChallengeData, ThrowOnError>) => {
-  return (options?.client ?? client).post<CreatePasskeyChallengeResponses, CreatePasskeyChallengeErrors, ThrowOnError, 'data'>({
+export const generatePasskeyChallenge = <ThrowOnError extends boolean = true>(options?: Options<GeneratePasskeyChallengeData, ThrowOnError>) => {
+  return (options?.client ?? client).post<GeneratePasskeyChallengeResponses, GeneratePasskeyChallengeErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
-    url: '/auth/passkey-challenge',
+    url: '/auth/passkey/generate-challenge',
     ...options,
     headers: {
       'Content-Type': 'application/json',
diff --git a/frontend/src/api.gen/types.gen.ts b/frontend/src/api.gen/types.gen.ts
index 177cfb678..92350a2a9 100644
--- a/frontend/src/api.gen/types.gen.ts
+++ b/frontend/src/api.gen/types.gen.ts
@@ -519,14 +519,14 @@ export type SignOutResponses = {
 
 export type SignOutResponse = SignOutResponses[keyof SignOutResponses];
 
-export type CreateTotpChallengeData = {
+export type GenerateTotpKeyData = {
   body?: never;
   path?: never;
   query?: never;
-  url: '/auth/totp/register';
+  url: '/auth/totp/generate-key';
 };
 
-export type CreateTotpChallengeErrors = {
+export type GenerateTotpKeyErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -559,9 +559,9 @@ export type CreateTotpChallengeErrors = {
   };
 };
 
-export type CreateTotpChallengeError = CreateTotpChallengeErrors[keyof CreateTotpChallengeErrors];
+export type GenerateTotpKeyError = GenerateTotpKeyErrors[keyof GenerateTotpKeyErrors];
 
-export type CreateTotpChallengeResponses = {
+export type GenerateTotpKeyResponses = {
   /**
    * Challenge created
    */
@@ -571,18 +571,16 @@ export type CreateTotpChallengeResponses = {
   };
 };
 
-export type CreateTotpChallengeResponse = CreateTotpChallengeResponses[keyof CreateTotpChallengeResponses];
+export type GenerateTotpKeyResponse = GenerateTotpKeyResponses[keyof GenerateTotpKeyResponses];
 
-export type CreateTotpData = {
-  body: {
-    code: string;
-  };
+export type DeleteTotpData = {
+  body?: never;
   path?: never;
   query?: never;
-  url: '/auth/totp/activate';
+  url: '/auth/totp';
 };
 
-export type CreateTotpErrors = {
+export type DeleteTotpErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -615,25 +613,27 @@ export type CreateTotpErrors = {
   };
 };
 
-export type CreateTotpError = CreateTotpErrors[keyof CreateTotpErrors];
+export type DeleteTotpError = DeleteTotpErrors[keyof DeleteTotpErrors];
 
-export type CreateTotpResponses = {
+export type DeleteTotpResponses = {
   /**
-   * TOTP activated
+   * TOTP deleted
    */
   200: boolean;
 };
 
-export type CreateTotpResponse = CreateTotpResponses[keyof CreateTotpResponses];
+export type DeleteTotpResponse = DeleteTotpResponses[keyof DeleteTotpResponses];
 
-export type DeleteTotpData = {
-  body?: never;
+export type CreateTotpData = {
+  body: {
+    code: string;
+  };
   path?: never;
   query?: never;
   url: '/auth/totp';
 };
 
-export type DeleteTotpErrors = {
+export type CreateTotpErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -666,16 +666,16 @@ export type DeleteTotpErrors = {
   };
 };
 
-export type DeleteTotpError = DeleteTotpErrors[keyof DeleteTotpErrors];
+export type CreateTotpError = CreateTotpErrors[keyof CreateTotpErrors];
 
-export type DeleteTotpResponses = {
+export type CreateTotpResponses = {
   /**
-   * TOTP deleted
+   * TOTP created
    */
   200: boolean;
 };
 
-export type DeleteTotpResponse = DeleteTotpResponses[keyof DeleteTotpResponses];
+export type CreateTotpResponse = CreateTotpResponses[keyof CreateTotpResponses];
 
 export type SignInWithTotpData = {
   body?: {
@@ -1174,17 +1174,17 @@ export type DeletePasskeyResponses = {
 
 export type DeletePasskeyResponse = DeletePasskeyResponses[keyof DeletePasskeyResponses];
 
-export type CreatePasskeyChallengeData = {
+export type GeneratePasskeyChallengeData = {
   body?: {
     type: 'authentication' | 'mfa' | 'registration';
     email?: string;
   };
   path?: never;
   query?: never;
-  url: '/auth/passkey-challenge';
+  url: '/auth/passkey/generate-challenge';
 };
 
-export type CreatePasskeyChallengeErrors = {
+export type GeneratePasskeyChallengeErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -1217,11 +1217,11 @@ export type CreatePasskeyChallengeErrors = {
   };
 };
 
-export type CreatePasskeyChallengeError = CreatePasskeyChallengeErrors[keyof CreatePasskeyChallengeErrors];
+export type GeneratePasskeyChallengeError = GeneratePasskeyChallengeErrors[keyof GeneratePasskeyChallengeErrors];
 
-export type CreatePasskeyChallengeResponses = {
+export type GeneratePasskeyChallengeResponses = {
   /**
-   * Challenge created
+   * Challenge generated
    */
   200: {
     challengeBase64: string;
@@ -1229,7 +1229,7 @@ export type CreatePasskeyChallengeResponses = {
   };
 };
 
-export type CreatePasskeyChallengeResponse = CreatePasskeyChallengeResponses[keyof CreatePasskeyChallengeResponses];
+export type GeneratePasskeyChallengeResponse = GeneratePasskeyChallengeResponses[keyof GeneratePasskeyChallengeResponses];
 
 export type SignInWithPasskeyData = {
   body?: {
diff --git a/frontend/src/api.gen/zod.gen.ts b/frontend/src/api.gen/zod.gen.ts
index 6822b4fb1..cd89bc62c 100644
--- a/frontend/src/api.gen/zod.gen.ts
+++ b/frontend/src/api.gen/zod.gen.ts
@@ -289,7 +289,7 @@ export const zSignOutData = z.object({
  */
 export const zSignOutResponse = z.boolean();
 
-export const zCreateTotpChallengeData = z.object({
+export const zGenerateTotpKeyData = z.object({
   body: z.optional(z.never()),
   path: z.optional(z.never()),
   query: z.optional(z.never()),
@@ -298,34 +298,34 @@ export const zCreateTotpChallengeData = z.object({
 /**
  * Challenge created
  */
-export const zCreateTotpChallengeResponse = z.object({
+export const zGenerateTotpKeyResponse = z.object({
   totpUri: z.string(),
   manualKey: z.string(),
 });
 
-export const zCreateTotpData = z.object({
-  body: z.object({
-    code: z.string().regex(/^\d{6}$/),
-  }),
+export const zDeleteTotpData = z.object({
+  body: z.optional(z.never()),
   path: z.optional(z.never()),
   query: z.optional(z.never()),
 });
 
 /**
- * TOTP activated
+ * TOTP deleted
  */
-export const zCreateTotpResponse = z.boolean();
+export const zDeleteTotpResponse = z.boolean();
 
-export const zDeleteTotpData = z.object({
-  body: z.optional(z.never()),
+export const zCreateTotpData = z.object({
+  body: z.object({
+    code: z.string().regex(/^\d{6}$/),
+  }),
   path: z.optional(z.never()),
   query: z.optional(z.never()),
 });
 
 /**
- * TOTP deleted
+ * TOTP created
  */
-export const zDeleteTotpResponse = z.boolean();
+export const zCreateTotpResponse = z.boolean();
 
 export const zSignInWithTotpData = z.object({
   body: z.optional(
@@ -482,7 +482,7 @@ export const zDeletePasskeyData = z.object({
  */
 export const zDeletePasskeyResponse = z.boolean();
 
-export const zCreatePasskeyChallengeData = z.object({
+export const zGeneratePasskeyChallengeData = z.object({
   body: z.optional(
     z.object({
       type: z.union([z.enum(['authentication']), z.enum(['mfa']), z.enum(['registration'])]),
@@ -494,9 +494,9 @@ export const zCreatePasskeyChallengeData = z.object({
 });
 
 /**
- * Challenge created
+ * Challenge generated
  */
-export const zCreatePasskeyChallengeResponse = z.object({
+export const zGeneratePasskeyChallengeResponse = z.object({
   challengeBase64: z.string(),
   credentialIds: z.array(z.string()),
 });
diff --git a/frontend/src/modules/auth/passkey-credentials.ts b/frontend/src/modules/auth/passkey-credentials.ts
index f733702d8..4de45c38f 100644
--- a/frontend/src/modules/auth/passkey-credentials.ts
+++ b/frontend/src/modules/auth/passkey-credentials.ts
@@ -1,6 +1,6 @@
 import { decodeBase64, encodeBase64 } from '@oslojs/encoding';
 import { appConfig } from 'config';
-import { createPasskeyChallenge } from '~/api.gen';
+import { generatePasskeyChallenge } from '~/api.gen';
 import type { PasskeyCredentialProps } from '~/modules/auth/types';
 import { generatePasskeyName } from '~/modules/me/helpers';
 import { useUserStore } from '~/store/user';
@@ -93,7 +93,7 @@ const validateCredentials = (credential: Credential | null) => {
 
 const getChallenge = async (body: PasskeyCredentialProps) => {
   //  Fetch a challenge from BE
-  const { challengeBase64, credentialIds } = await createPasskeyChallenge({ body });
+  const { challengeBase64, credentialIds } = await generatePasskeyChallenge({ body });
 
   // Decode  challenge and wrap it in a Uint8Array (required format)
   const raw = decodeBase64(challengeBase64);
diff --git a/frontend/src/modules/auth/types.ts b/frontend/src/modules/auth/types.ts
index e1f0133c4..fcacda3f4 100644
--- a/frontend/src/modules/auth/types.ts
+++ b/frontend/src/modules/auth/types.ts
@@ -1,6 +1,6 @@
-import type { CreatePasskeyChallengeData, GetTokenDataResponse } from '~/api.gen';
+import type { GeneratePasskeyChallengeData, GetTokenDataResponse } from '~/api.gen';
 
-type PasskeyChallengeType = NonNullable<CreatePasskeyChallengeData['body']>['type'];
+type PasskeyChallengeType = NonNullable<GeneratePasskeyChallengeData['body']>['type'];
 
 export interface PasskeyCredentialProps {
   email?: string;
diff --git a/frontend/src/modules/me/totp/setup.tsx b/frontend/src/modules/me/totp/setup.tsx
index 1be98723a..85ea8e859 100644
--- a/frontend/src/modules/me/totp/setup.tsx
+++ b/frontend/src/modules/me/totp/setup.tsx
@@ -3,7 +3,7 @@ import { CircleAlert, CopyCheckIcon, CopyIcon } from 'lucide-react';
 import { QRCodeSVG } from 'qrcode.react';
 import { useRef, useState } from 'react';
 import { useTranslation } from 'react-i18next';
-import { type ApiError, type CreateTotpData, type CreateTotpResponse, createTotp, createTotpChallenge } from '~/api.gen';
+import { type ApiError, type CreateTotpData, type CreateTotpResponse, createTotp, generateTotpKey } from '~/api.gen';
 import { useCopyToClipboard } from '~/hooks/use-copy-to-clipboard';
 import { TotpConfirmationForm } from '~/modules/auth/totp-verify-code-form';
 import { useDialoger } from '~/modules/common/dialoger/use-dialoger';
@@ -40,7 +40,7 @@ export const SetupTotp = () => {
   // Fetch TOTP registration data (URI and manual key)
   const { data } = useSuspenseQuery({
     queryKey: ['totp', 'uri'],
-    queryFn: async () => await createTotpChallenge(),
+    queryFn: async () => await generateTotpKey(),
     staleTime: 0,
   });
 

From 520b4f4fc03c127383cd2f03c94a1047847a879e Mon Sep 17 00:00:00 2001
From: David Hordiienko <90209095+LemonardoD@users.noreply.github.com>
Date: Tue, 30 Sep 2025 16:03:19 +0300
Subject: [PATCH 27/48] add: email response on app request (#627)

---
 backend/emails/request-was-sent.tsx      |  40 +++++++++
 backend/src/modules/requests/handlers.ts |  14 ++++
 frontend/src/api.gen/sdk.gen.ts          | 100 +++++++++++------------
 locales/en/backend.json                  |   9 +-
 4 files changed, 112 insertions(+), 51 deletions(-)
 create mode 100644 backend/emails/request-was-sent.tsx

diff --git a/backend/emails/request-was-sent.tsx b/backend/emails/request-was-sent.tsx
new file mode 100644
index 000000000..04fa72ea4
--- /dev/null
+++ b/backend/emails/request-was-sent.tsx
@@ -0,0 +1,40 @@
+import i18n from 'i18next';
+import { Text } from 'jsx-email';
+
+import { appConfig } from 'config';
+import type { BasicTemplateType } from '../src/lib/mailer';
+import { AppLogo } from './components/app-logo';
+import { EmailContainer } from './components/container';
+import { EmailBody } from './components/email-body';
+import { EmailHeader } from './components/email-header';
+import { Footer } from './components/footer';
+
+export interface RequestResponseEmailProps extends BasicTemplateType {
+  type: "waitlist" | "newsletter" | "contact",
+  message: string | null 
+}
+
+export const RequestResponseEmail = ({ lng, type, subject, message }: RequestResponseEmailProps) => {
+  return (
+    <EmailContainer previewText={subject}>
+      <EmailHeader
+        headerText={
+          <div dangerouslySetInnerHTML={{ __html: i18n.t(`backend:email.${type}_request.title`, { lng }) }} />
+        }
+      />
+      <EmailBody>
+        <Text>{subject}</Text>
+        {message && <Text>{message}</Text>}
+
+        <Text><span dangerouslySetInnerHTML={{ __html: i18n.t(`backend:email.${type}_request.text`, { lng, appName: appConfig.name }) }} /></Text>
+
+      </EmailBody>
+
+      <AppLogo />
+      <Footer />
+    </EmailContainer>
+  );
+};
+
+// Template export
+export const Template = RequestResponseEmail;
diff --git a/backend/src/modules/requests/handlers.ts b/backend/src/modules/requests/handlers.ts
index 71542086e..327371349 100644
--- a/backend/src/modules/requests/handlers.ts
+++ b/backend/src/modules/requests/handlers.ts
@@ -1,17 +1,21 @@
 import { OpenAPIHono } from '@hono/zod-openapi';
+import { appConfig } from 'config';
 import { and, count, eq, getTableColumns, ilike, inArray, type SQL, sql } from 'drizzle-orm';
+import i18n from 'i18next';
 import { db } from '#/db/db';
 import { emailsTable } from '#/db/schema/emails';
 import { type RequestModel, requestsTable } from '#/db/schema/requests';
 import { usersTable } from '#/db/schema/users';
 import type { Env } from '#/lib/context';
 import { AppError } from '#/lib/errors';
+import { mailer } from '#/lib/mailer';
 import { sendSlackMessage } from '#/lib/notifications';
 import requestRoutes from '#/modules/requests/routes';
 import { usersBaseQuery } from '#/modules/users/helpers/select';
 import { defaultHook } from '#/utils/default-hook';
 import { getOrderColumn } from '#/utils/order-column';
 import { prepareStringForILikeFilter } from '#/utils/sql';
+import { RequestResponseEmail, RequestResponseEmailProps } from '../../../emails/request-was-sent';
 
 // These requests are only allowed to be created if user has none yet
 const uniqueRequests: RequestModel['type'][] = ['waitlist', 'newsletter'];
@@ -56,6 +60,16 @@ const requestRouteHandlers = app
     if (type === 'newsletter') await sendSlackMessage('Join newsletter request', normalizedEmail);
     if (type === 'contact') await sendSlackMessage(`Request for contact with message: ${message},`, normalizedEmail);
 
+    // Send email
+    const lng = appConfig.defaultLanguage;
+    const subject = i18n.t('backend:email.request.subject', { lng, appName: appConfig.name, requestType: type });
+    const staticProps = { lng, subject, type, message };
+    const recipients = [{ email: normalizedEmail }];
+
+    type Recipient = { email: string };
+
+    mailer.prepareEmails<RequestResponseEmailProps, Recipient>(RequestResponseEmail, staticProps, recipients);
+
     const data = {
       ...createdRequest,
       wasInvited: false,
diff --git a/frontend/src/api.gen/sdk.gen.ts b/frontend/src/api.gen/sdk.gen.ts
index a9930b7e0..4b4b55594 100644
--- a/frontend/src/api.gen/sdk.gen.ts
+++ b/frontend/src/api.gen/sdk.gen.ts
@@ -270,7 +270,7 @@ export const invokeToken = <ThrowOnError extends boolean = true>(options: Option
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -298,7 +298,7 @@ export const getTokenData = <ThrowOnError extends boolean = true>(options: Optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -325,7 +325,7 @@ export const startImpersonation = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -351,7 +351,7 @@ export const stopImpersonation = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -377,7 +377,7 @@ export const signOut = <ThrowOnError extends boolean = true>(options?: Options<S
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -721,7 +721,7 @@ export const signInWithPasskey = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -883,7 +883,7 @@ export const deleteMe = <ThrowOnError extends boolean = true>(options?: Options<
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -909,7 +909,7 @@ export const getMe = <ThrowOnError extends boolean = true>(options?: Options<Get
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -943,7 +943,7 @@ export const updateMe = <ThrowOnError extends boolean = true>(options?: Options<
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -976,7 +976,7 @@ export const toggleMfa = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1006,7 +1006,7 @@ export const getMyAuth = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1032,7 +1032,7 @@ export const getMyMenu = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1058,7 +1058,7 @@ export const getMyInvitations = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1085,7 +1085,7 @@ export const deleteMySessions = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1139,7 +1139,7 @@ export const getUploadToken = <ThrowOnError extends boolean = true>(options: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1167,7 +1167,7 @@ export const unsubscribeMe = <ThrowOnError extends boolean = true>(options: Opti
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1194,7 +1194,7 @@ export const deleteUsers = <ThrowOnError extends boolean = true>(options?: Optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1233,7 +1233,7 @@ export const getUsers = <ThrowOnError extends boolean = true>(options?: Options<
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1260,7 +1260,7 @@ export const getUser = <ThrowOnError extends boolean = true>(options: Options<Ge
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1294,7 +1294,7 @@ export const updateUser = <ThrowOnError extends boolean = true>(options: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1325,7 +1325,7 @@ export const deleteOrganizations = <ThrowOnError extends boolean = true>(options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1360,7 +1360,7 @@ export const getOrganizations = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1388,7 +1388,7 @@ export const createOrganization = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1419,7 +1419,7 @@ export const getOrganization = <ThrowOnError extends boolean = true>(options: Op
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1463,7 +1463,7 @@ export const updateOrganization = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1507,7 +1507,7 @@ export const getContextEntities = <ThrowOnError extends boolean = true>(options?
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1536,7 +1536,7 @@ export const getContextEntity = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1565,7 +1565,7 @@ export const checkSlug = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1596,7 +1596,7 @@ export const systemInvite = <ThrowOnError extends boolean = true>(options?: Opti
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1628,7 +1628,7 @@ export const getPresignedUrl = <ThrowOnError extends boolean = true>(options: Op
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1655,7 +1655,7 @@ export const paddleWebhook = <ThrowOnError extends boolean = true>(options?: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1690,7 +1690,7 @@ export const sendNewsletter = <ThrowOnError extends boolean = true>(options: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1721,7 +1721,7 @@ export const deleteRequests = <ThrowOnError extends boolean = true>(options?: Op
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1756,7 +1756,7 @@ export const getRequests = <ThrowOnError extends boolean = true>(options?: Optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1786,7 +1786,7 @@ export const createRequest = <ThrowOnError extends boolean = true>(options?: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1817,7 +1817,7 @@ export const getMetrics = <ThrowOnError extends boolean = true>(options?: Option
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1844,7 +1844,7 @@ export const getPublicCounts = <ThrowOnError extends boolean = true>(options?: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1879,7 +1879,7 @@ export const shapeProxy = <ThrowOnError extends boolean = true>(options: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1907,7 +1907,7 @@ export const deleteAttachments = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1944,7 +1944,7 @@ export const getAttachments = <ThrowOnError extends boolean = true>(options: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1971,7 +1971,7 @@ export const createAttachment = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2003,7 +2003,7 @@ export const getAttachment = <ThrowOnError extends boolean = true>(options: Opti
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2033,7 +2033,7 @@ export const updateAttachment = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2065,7 +2065,7 @@ export const redirectToAttachment = <ThrowOnError extends boolean = true>(option
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2095,7 +2095,7 @@ export const deleteMemberships = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2130,7 +2130,7 @@ export const membershipInvite = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2166,7 +2166,7 @@ export const updateMembership = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2198,7 +2198,7 @@ export const acceptMembership = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2233,7 +2233,7 @@ export const getMembers = <ThrowOnError extends boolean = true>(options: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2267,7 +2267,7 @@ export const getPendingInvitations = <ThrowOnError extends boolean = true>(optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
diff --git a/locales/en/backend.json b/locales/en/backend.json
index 8dd36ae1e..54d059ba4 100644
--- a/locales/en/backend.json
+++ b/locales/en/backend.json
@@ -25,5 +25,12 @@
   "email.system_invite.subject": "Invitation",
   "email.system_invite.text": "You have been invited to <strong>{{appName}}</strong> by {{senderName}}.",
   "email.system_invite.title": "Join <strong>{{appName}}</strong>",
-  "email.unsubscribe": "Unsubscribe"
+  "email.unsubscribe": "Unsubscribe",
+  "email.request.subject": "We've received your {{requestType}} request for {{appName}}",
+  "email.waitlist_request.title": "You're on the waitlist!",
+  "email.waitlist_request.text": "Thanks for joining the waitlist for {{appName}}. We'll notify you as soon as it's your turn.",
+  "email.newsletter_request.title": "You're subscribed to our newsletter",
+  "email.newsletter_request.text": "Thanks for subscribing to {{appName}} updates. We'll keep you in the loop with news, tips, and product updates.",
+  "email.contact_request.title": "Our team has your request",
+  "email.contact_request.text": "Thanks for reaching out to {{appName}}. Our team will get back to you as soon as possible."
 }

From f0332665a2708aa5a2aaa8e52832a99d308431e7 Mon Sep 17 00:00:00 2001
From: flipvanhaaren <flip@shareworks.nl>
Date: Tue, 30 Sep 2025 15:35:53 +0200
Subject: [PATCH 28/48] improve: ui tunings

---
 backend/src/modules/auth/general/helpers/mfa.ts       |  4 ++--
 frontend/src/modules/auth/passkey-strategy.tsx        |  2 +-
 frontend/src/modules/auth/request-password-form.tsx   |  2 +-
 frontend/src/modules/auth/steps/provider.tsx          |  2 +-
 .../src/modules/marketing/about/call-to-action.tsx    |  5 +++--
 frontend/src/routes/auth-routes.tsx                   | 11 +++++++++--
 locales/en/about.json                                 |  3 ++-
 7 files changed, 19 insertions(+), 10 deletions(-)

diff --git a/backend/src/modules/auth/general/helpers/mfa.ts b/backend/src/modules/auth/general/helpers/mfa.ts
index 57407452e..3eb0903db 100644
--- a/backend/src/modules/auth/general/helpers/mfa.ts
+++ b/backend/src/modules/auth/general/helpers/mfa.ts
@@ -41,8 +41,8 @@ export const initiateMfa = async (ctx: Context<Env>, user: UserModel) => {
   // Set a temporary auth cookie to track confirm MFA session
   await setAuthCookie(ctx, 'confirm-mfa', generatedTokenId, timespan);
 
-  // Return the path to redirect the user to MFA confirmation page
-  return '/auth/authenticate/mfa-confirmation';
+  // Return the path to redirect the user to MFA authentication page
+  return '/auth/authenticate/mfa';
 };
 
 /**
diff --git a/frontend/src/modules/auth/passkey-strategy.tsx b/frontend/src/modules/auth/passkey-strategy.tsx
index 9ca372d57..0febce892 100644
--- a/frontend/src/modules/auth/passkey-strategy.tsx
+++ b/frontend/src/modules/auth/passkey-strategy.tsx
@@ -44,7 +44,7 @@ const PasskeyStrategy = ({
 
   return (
     <div data-mode={mode} className="group flex flex-col space-y-2">
-      <Button type="button" variant="outline" onClick={() => passkeyAuth(email)} className="w-full gap-1.5 truncate">
+      <Button type="button" variant={type === 'mfa' ? 'default' : 'outline'} onClick={() => passkeyAuth(email)} className="w-full gap-1.5 truncate">
         <Fingerprint size={16} />
         <span className="truncate">
           {t('common:sign_in')} {t('common:with').toLowerCase()} {t('common:passkey').toLowerCase()}
diff --git a/frontend/src/modules/auth/request-password-form.tsx b/frontend/src/modules/auth/request-password-form.tsx
index a82e9e404..0825a30ae 100644
--- a/frontend/src/modules/auth/request-password-form.tsx
+++ b/frontend/src/modules/auth/request-password-form.tsx
@@ -38,7 +38,7 @@ export const RequestPasswordForm = ({ email = '' }: { email?: string }) => {
         onChange={(e) => setEmailValue(e.target.value)}
         required
       />
-      <div className="flex flex-col sm:flex-row gap-2">
+      <div className="flex flex-col gap-2">
         <SubmitButton disabled={!emailValue} loading={isPending} onClick={() => requestPasswordEmail(emailValue)}>
           <Send size={16} className="mr-2" />
           {t('common:send_reset_link')}
diff --git a/frontend/src/modules/auth/steps/provider.tsx b/frontend/src/modules/auth/steps/provider.tsx
index cb45533ee..1a8be09dc 100644
--- a/frontend/src/modules/auth/steps/provider.tsx
+++ b/frontend/src/modules/auth/steps/provider.tsx
@@ -13,7 +13,7 @@ export const AuthStepsProvider = ({ children }: { children: ReactNode }) => {
   const { lastUser } = useUserStore();
   const { tokenId, error, severity } = useSearch({ from: '/publicLayout/authLayout/auth/authenticate' });
 
-  const isMfaRoute = !!matchRoute({ to: '/auth/authenticate/mfa-confirmation' });
+  const isMfaRoute = !!matchRoute({ to: '/auth/authenticate/mfa' });
 
   // Initialize email and step
   const initEmail = (!tokenId && lastUser?.email) || '';
diff --git a/frontend/src/modules/marketing/about/call-to-action.tsx b/frontend/src/modules/marketing/about/call-to-action.tsx
index 303d80b8c..d40784442 100644
--- a/frontend/src/modules/marketing/about/call-to-action.tsx
+++ b/frontend/src/modules/marketing/about/call-to-action.tsx
@@ -8,8 +8,9 @@ const CallToAction = () => {
   const ref = useRef(null);
 
   return (
-    <div className="mx-auto grid max-w-4xl">
-      <p className="text-center text-4xl leading-[3.3rem] mb-6">
+    <div className="mx-auto grid max-w-4xl text-center">
+      <p className="font-semibold text-4xl sm:text-6xl lg:text-7xl leading-[4rem] mb-12">{t('about:call_to_action.intro')}</p>
+      <p className="text-2xl sm:text-4xl leading-[3.3rem] mb-12">
         <span className="opacity-50 mr-2">“</span>
         <span className="font-light">{t('about:call_to_action.start')}</span>
         <span className="opacity-50 ml-2">”</span>
diff --git a/frontend/src/routes/auth-routes.tsx b/frontend/src/routes/auth-routes.tsx
index c2b5fe226..23bb46f5d 100644
--- a/frontend/src/routes/auth-routes.tsx
+++ b/frontend/src/routes/auth-routes.tsx
@@ -1,5 +1,6 @@
 import { createRoute, redirect } from '@tanstack/react-router';
 import { appConfig } from 'config';
+import i18n from 'i18next';
 import { z } from 'zod';
 import CreatePasswordForm from '~/modules/auth/create-password-form';
 import EmailVerification from '~/modules/auth/email-verification';
@@ -53,7 +54,7 @@ export const AuthenticateRoute = createRoute({
 });
 
 export const MfaRoute = createRoute({
-  path: '/mfa-confirmation',
+  path: '/mfa',
   validateSearch: authenticateRouteSearch,
   staticData: { isAuth: false },
   head: () => ({ meta: [{ title: appTitle('Authenticate') }] }),
@@ -66,7 +67,13 @@ export const RequestPasswordRoute = createRoute({
   staticData: { isAuth: false },
   head: () => ({ meta: [{ title: appTitle('Request password') }] }),
   getParentRoute: () => AuthLayoutRoute,
-  component: () => <RequestPasswordForm />,
+  component: () => (
+    <>
+      <h1 className="text-2xl text-center">{i18n.t('common:reset_resource', { resource: i18n.t('common:password').toLowerCase() })}</h1>
+      <p className="font-light text-center space-x-1">{i18n.t('common:reset_password.text')}</p>
+      <RequestPasswordForm />
+    </>
+  ),
 });
 
 export const CreatePasswordWithTokenRoute = createRoute({
diff --git a/locales/en/about.json b/locales/en/about.json
index d51d046b9..7760ed007 100644
--- a/locales/en/about.json
+++ b/locales/en/about.json
@@ -1,5 +1,6 @@
 {
-  "call_to_action.start": ".. with a dedicated community, cella can become a fully 🇪🇺 European alternative to build collaborative web apps.",
+  "call_to_action.intro": "Build & deploy in Europe",
+  "call_to_action.start": ".. with a dedicated community, cella can become a European alternative to build sovereign, collaborative web apps.",
   "call_to_action.finish": " Want to join?",
   "feature.hono_text": "A simple, fast server. Web standards, RPC support and great middleware.",
   "feature.vite_text": "With vite and pnpm we have a monorepo with a fast build process.",

From 6f8217f826c03790a45cfa6a11ed07082af0826f Mon Sep 17 00:00:00 2001
From: Flip van Haaren <flip@shareworks.nl>
Date: Tue, 30 Sep 2025 23:30:15 +0200
Subject: [PATCH 29/48] Chore/auth todos (#628)

* fix:mfa helpers

* fix: passkey DRY

* fix: totp DRY

* fix: Cookie naming consistency

* chore: snace_case to kebab-case

* chore: remove todo

---------

Co-authored-by: David Hordiienko <shiraz0david@gmail.com>
---
 .../modules/auth/general/helpers/cookie.ts    |  3 +-
 .../src/modules/auth/general/helpers/mfa.ts   | 25 ++++------
 backend/src/modules/auth/passkeys/handlers.ts | 21 ++------
 .../modules/auth/passkeys/helpers/passkey.ts  | 49 ++++++++++++++++---
 backend/src/modules/auth/passkeys/schema.ts   |  2 +-
 backend/src/modules/auth/totps/handlers.ts    | 18 ++-----
 .../src/modules/auth/totps/helpers/totps.ts   | 20 ++++++++
 backend/src/modules/me/handlers.ts            | 43 +++-------------
 backend/tests/helpers.ts                      |  1 -
 backend/tests/sign-up/basic.test.ts           |  8 +--
 frontend/src/api.gen/sdk.gen.ts               |  2 +-
 frontend/src/api.gen/types.gen.ts             |  4 +-
 frontend/src/api.gen/zod.gen.ts               |  4 +-
 .../src/modules/auth/passkey-credentials.ts   |  2 +-
 14 files changed, 100 insertions(+), 102 deletions(-)

diff --git a/backend/src/modules/auth/general/helpers/cookie.ts b/backend/src/modules/auth/general/helpers/cookie.ts
index 4ff0343dd..8a4b865b8 100644
--- a/backend/src/modules/auth/general/helpers/cookie.ts
+++ b/backend/src/modules/auth/general/helpers/cookie.ts
@@ -8,8 +8,7 @@ import { env } from '../../../../env';
 
 const isProduction = appConfig.mode === 'production';
 
-// TODO totp_challenge?
-type CookieName = TokenType | 'session' | 'totp_key' | 'passkey-challenge' | `oauth_${string}`;
+type CookieName = TokenType | 'session' | 'totp-challenge' | 'passkey-challenge' | `oauth_${string}`;
 
 /**
  * Sets an authentication cookie.
diff --git a/backend/src/modules/auth/general/helpers/mfa.ts b/backend/src/modules/auth/general/helpers/mfa.ts
index 3eb0903db..c6e9c1d00 100644
--- a/backend/src/modules/auth/general/helpers/mfa.ts
+++ b/backend/src/modules/auth/general/helpers/mfa.ts
@@ -26,7 +26,7 @@ export const initiateMfa = async (ctx: Context<Env>, user: UserModel) => {
 
   const timespan = new TimeSpan(10, 'm');
   // Generate a new random token and insert it
-  const [{ token: generatedTokenId }] = await db
+  const [{ token: generatedToken }] = await db
     .insert(tokensTable)
     .values({
       token: nanoid(40),
@@ -36,10 +36,10 @@ export const initiateMfa = async (ctx: Context<Env>, user: UserModel) => {
       createdBy: user.id,
       expiresAt: createDate(timespan), // token expires in 10 minutes
     })
-    .returning({ token: tokensTable.id });
+    .returning({ token: tokensTable.token });
 
   // Set a temporary auth cookie to track confirm MFA session
-  await setAuthCookie(ctx, 'confirm-mfa', generatedTokenId, timespan);
+  await setAuthCookie(ctx, 'confirm-mfa', generatedToken, timespan);
 
   // Return the path to redirect the user to MFA authentication page
   return '/auth/authenticate/mfa';
@@ -53,13 +53,12 @@ export const initiateMfa = async (ctx: Context<Env>, user: UserModel) => {
  * @throws AppError if token is missing, not found, or expired
  */
 export const validateConfirmMfaToken = async (ctx: Context<Env>): Promise<UserModel> => {
-  // TODO should be token itself, Get token ID from cookie
   // TODO on error redirect?
-  const tokenIdFromCookie = await getAuthCookie(ctx, 'confirm-mfa');
-  if (!tokenIdFromCookie) throw new AppError({ status: 401, type: 'confirm-mfa_not_found', severity: 'error' });
+  const tokenFromCookie = await getAuthCookie(ctx, 'confirm-mfa');
+  if (!tokenFromCookie) throw new AppError({ status: 401, type: 'confirm-mfa_not_found', severity: 'error' });
 
   // Fetch token record and associated user
-  const tokenRecord = await getValidToken({ ctx, token: tokenIdFromCookie, invokeToken: false, tokenType: 'confirm-mfa' });
+  const tokenRecord = await getValidToken({ ctx, token: tokenFromCookie, invokeToken: false, tokenType: 'confirm-mfa' });
 
   // Sanity check
   if (!tokenRecord.userId) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error' });
@@ -74,16 +73,12 @@ export const validateConfirmMfaToken = async (ctx: Context<Env>): Promise<UserMo
  * Consumes the MFA token stored in the 'confirm-mfa' cookie.
  * Marks it as used in the database and deletes the cookie.
  */
-// TODO shouldnt this use getValidToken for consistency? Or be a middleware?
 export const consumeMfaToken = async (ctx: Context<Env>): Promise<void> => {
-  const tokenIdFromCookie = await getAuthCookie(ctx, 'confirm-mfa');
-  if (!tokenIdFromCookie) return;
+  const tokenFromCookie = await getAuthCookie(ctx, 'confirm-mfa');
+  if (!tokenFromCookie) return;
 
-  const [tokenRecord] = await db.select().from(tokensTable).where(eq(tokensTable.id, tokenIdFromCookie)).limit(1);
-  if (!tokenRecord) return;
-
-  // Mark token as consumed
-  await db.update(tokensTable).set({ invokedAt: new Date() }).where(eq(tokensTable.id, tokenRecord.id));
+  // Fetch token record and associated user
+  await getValidToken({ ctx, token: tokenFromCookie, tokenType: 'confirm-mfa' });
 
   // Delete cookie
   deleteAuthCookie(ctx, 'confirm-mfa');
diff --git a/backend/src/modules/auth/passkeys/handlers.ts b/backend/src/modules/auth/passkeys/handlers.ts
index 0e9ce9b51..9f3c5dfb1 100644
--- a/backend/src/modules/auth/passkeys/handlers.ts
+++ b/backend/src/modules/auth/passkeys/handlers.ts
@@ -14,7 +14,7 @@ import { getAuthCookie, setAuthCookie } from '#/modules/auth/general/helpers/coo
 import { deviceInfo } from '#/modules/auth/general/helpers/device-info';
 import { consumeMfaToken, validateConfirmMfaToken } from '#/modules/auth/general/helpers/mfa';
 import { setUserSession } from '#/modules/auth/general/helpers/session';
-import { parseAndValidatePasskeyAttestation, verifyPassKeyPublic } from '#/modules/auth/passkeys/helpers/passkey';
+import { parseAndValidatePasskeyAttestation, validatePasskey } from '#/modules/auth/passkeys/helpers/passkey';
 import { usersBaseQuery } from '#/modules/users/helpers/select';
 import { defaultHook } from '#/utils/default-hook';
 import { TimeSpan } from '#/utils/time-span';
@@ -125,7 +125,7 @@ const authPasskeysRouteHandlers = app
    * Signin using passkey
    */
   .openapi(authPasskeysRoutes.signInWithPasskey, async (ctx) => {
-    const { clientDataJSON, authenticatorData, signature, credentialId, email, type } = ctx.req.valid('json');
+    const { email, type, ...passkeyData } = ctx.req.valid('json');
     // Define strategy and session type for metadata/logging purposes
     const meta = { strategy: 'passkey', sessionType: type === 'mfa' ? 'mfa' : 'regular' } as const;
 
@@ -156,22 +156,8 @@ const authPasskeysRouteHandlers = app
     // Fail early if user not found
     if (!user) throw new AppError({ status: 404, type: 'not_found', severity: 'warn', entityType: 'user', meta });
 
-    // Retrieve the passkey challenge from cookie
-    const challengeFromCookie = await getAuthCookie(ctx, 'passkey-challenge');
-    if (!challengeFromCookie) throw new AppError({ status: 401, type: 'invalid_credentials', severity: 'warn', meta });
-
-    // Get passkey credentials
-    const [passkeyRecord] = await db
-      .select()
-      .from(passkeysTable)
-      .where(and(eq(passkeysTable.userId, user.id), eq(passkeysTable.credentialId, credentialId)))
-      .limit(1);
-
-    if (!passkeyRecord) throw new AppError({ status: 404, type: 'passkey_not_found', severity: 'warn', meta });
-
     try {
-      const isValid = await verifyPassKeyPublic(signature, authenticatorData, clientDataJSON, passkeyRecord.publicKey, challengeFromCookie);
-      if (!isValid) throw new AppError({ status: 401, type: 'invalid_token', severity: 'warn', meta });
+      await validatePasskey(ctx, { ...passkeyData, userId: user.id });
     } catch (error) {
       if (error instanceof AppError) throw error;
 
@@ -186,6 +172,7 @@ const authPasskeysRouteHandlers = app
 
     // Consume the MFA token now that TOTP verification succeeded
     await consumeMfaToken(ctx);
+
     // Set user session after successful verification
     await setUserSession(ctx, user, meta.strategy, meta.sessionType);
 
diff --git a/backend/src/modules/auth/passkeys/helpers/passkey.ts b/backend/src/modules/auth/passkeys/helpers/passkey.ts
index 6cd17d3b1..9594124bf 100644
--- a/backend/src/modules/auth/passkeys/helpers/passkey.ts
+++ b/backend/src/modules/auth/passkeys/helpers/passkey.ts
@@ -12,6 +12,12 @@ import {
   parseClientDataJSON,
 } from '@oslojs/webauthn';
 import { appConfig } from 'config';
+import { and, eq } from 'drizzle-orm';
+import { Context } from 'hono';
+import { db } from '#/db/db';
+import { passkeysTable } from '#/db/schema/passkeys';
+import { AppError } from '#/lib/errors';
+import { getAuthCookie } from '../../general/helpers/cookie';
 
 /**
  * Parses and validates passkey attestation data.
@@ -75,6 +81,35 @@ export const parseAndValidatePasskeyAttestation = (
   };
 };
 
+type PasskeyData = {
+  publicKey: string;
+  signature: string;
+  authenticatorObject: string;
+  clientDataJSON: string;
+};
+
+export const validatePasskey = async (ctx: Context, passkeyData: Omit<PasskeyData, 'publicKey'> & { credentialId: string; userId: string }) => {
+  const { userId, credentialId, ...restPasskeyData } = passkeyData;
+
+  // Retrieve the passkey challenge stored in a secure cookie
+  const challengeFromCookie = await getAuthCookie(ctx, 'passkey-challenge');
+  if (!challengeFromCookie) throw new AppError({ status: 401, type: 'invalid_credentials', severity: 'warn' });
+
+  // Fetch passkey record for this user and credential ID
+  const [passkeyRecord] = await db
+    .select()
+    .from(passkeysTable)
+    .where(and(eq(passkeysTable.userId, userId), eq(passkeysTable.credentialId, credentialId)))
+    .limit(1);
+
+  if (!passkeyRecord) throw new AppError({ status: 404, type: 'passkey_not_found', severity: 'warn' });
+
+  // Verify signature against public key and challenge
+  const isValid = await verifyPassKeyPublic({ ...restPasskeyData, publicKey: passkeyRecord.publicKey, challengeFromCookie });
+
+  if (!isValid) throw new AppError({ status: 401, type: 'invalid_token', severity: 'warn' });
+};
+
 /**
  * Verifies a passkey public key signature.
  *
@@ -88,13 +123,13 @@ export const parseAndValidatePasskeyAttestation = (
  * @throws Error if some data is invalid.
  * @returns Boolean indicating whether the signature is valid.
  */
-export const verifyPassKeyPublic = async (
-  signature: string,
-  authenticatorObject: string,
-  clientDataJSON: string,
-  publicKey: string,
-  challengeFromCookie?: string,
-) => {
+const verifyPassKeyPublic = async ({
+  signature,
+  authenticatorObject,
+  clientDataJSON,
+  publicKey,
+  challengeFromCookie,
+}: PasskeyData & { challengeFromCookie?: string }) => {
   // Converting strings to Uint8Arrays
   const decodedSignature = decodeBase64(signature);
   const decodedClientDataJSON = decodeBase64(clientDataJSON);
diff --git a/backend/src/modules/auth/passkeys/schema.ts b/backend/src/modules/auth/passkeys/schema.ts
index 7e4fe099e..8f5da1731 100644
--- a/backend/src/modules/auth/passkeys/schema.ts
+++ b/backend/src/modules/auth/passkeys/schema.ts
@@ -26,7 +26,7 @@ export const passkeyChallengeSchema = z.object({ challengeBase64: z.string(), cr
 export const webAuthnAssertionSchema = z.object({
   credentialId: z.string(),
   clientDataJSON: z.string(),
-  authenticatorData: z.string(),
+  authenticatorObject: z.string(),
   signature: z.string(),
 });
 
diff --git a/backend/src/modules/auth/totps/handlers.ts b/backend/src/modules/auth/totps/handlers.ts
index 863c2d15d..1d7dc45d4 100644
--- a/backend/src/modules/auth/totps/handlers.ts
+++ b/backend/src/modules/auth/totps/handlers.ts
@@ -12,11 +12,10 @@ import { AppError } from '#/lib/errors';
 import { getAuthCookie, setAuthCookie } from '#/modules/auth/general/helpers/cookie';
 import { consumeMfaToken, validateConfirmMfaToken } from '#/modules/auth/general/helpers/mfa';
 import { setUserSession } from '#/modules/auth/general/helpers/session';
-import { signInWithTotp } from '#/modules/auth/totps/helpers/totps';
+import { signInWithTotp, validateTOTP } from '#/modules/auth/totps/helpers/totps';
 import { defaultHook } from '#/utils/default-hook';
 import { TimeSpan } from '#/utils/time-span';
-import authTotpRoutes from './routes';
-import authTotpsRoutes from './routes';
+import { default as authTotpRoutes, default as authTotpsRoutes } from './routes';
 
 const enabledStrategies: readonly string[] = appConfig.enabledAuthStrategies;
 
@@ -36,7 +35,7 @@ const authTotpsRouteHandlers = app
     const manualKey = encodeBase32UpperCase(secretBytes);
 
     // Save the secret in a short-lived cookie (5 minutes)
-    await setAuthCookie(ctx, 'totp_key', manualKey, new TimeSpan(5, 'm'));
+    await setAuthCookie(ctx, 'totp-challenge', manualKey, new TimeSpan(5, 'm'));
 
     // otpauth:// URI for QR scanner apps
     const totpUri = createTOTPKeyURI(appConfig.slug, user.email, secretBytes, appConfig.totpConfig.intervalInSeconds, appConfig.totpConfig.digits);
@@ -51,7 +50,7 @@ const authTotpsRouteHandlers = app
     const user = getContextUser();
 
     // Retrieve the encoded totp secret from cookie
-    const encodedSecret = await getAuthCookie(ctx, 'totp_key');
+    const encodedSecret = await getAuthCookie(ctx, 'totp-challenge');
     if (!encodedSecret) throw new AppError({ status: 400, type: 'invalid_credentials', severity: 'warn' });
 
     // Verify TOTP code
@@ -114,15 +113,8 @@ const authTotpsRouteHandlers = app
 
     // Validate MFA token and retrieve user
     const user = await validateConfirmMfaToken(ctx);
-
-    // Get totp credentials
-    const [credentials] = await db.select().from(totpsTable).where(eq(totpsTable.userId, user.id)).limit(1);
-    if (!credentials) throw new AppError({ status: 404, type: 'not_found', severity: 'warn', meta });
-
     try {
-      // Verify TOTP code using stored secret
-      const isValid = signInWithTotp(code, credentials.secret);
-      if (!isValid) throw new AppError({ status: 401, type: 'invalid_token', severity: 'warn', meta });
+      await validateTOTP({ code, userId: user.id });
     } catch (error) {
       if (error instanceof AppError) throw error;
 
diff --git a/backend/src/modules/auth/totps/helpers/totps.ts b/backend/src/modules/auth/totps/helpers/totps.ts
index a0210b3cf..8fe1ebacd 100644
--- a/backend/src/modules/auth/totps/helpers/totps.ts
+++ b/backend/src/modules/auth/totps/helpers/totps.ts
@@ -1,6 +1,10 @@
 import { decodeBase32 } from '@oslojs/encoding';
 import { verifyTOTPWithGracePeriod } from '@oslojs/otp';
 import { appConfig } from 'config';
+import { eq } from 'drizzle-orm';
+import { db } from '#/db/db';
+import { totpsTable } from '#/db/schema/totps';
+import { AppError } from '#/lib/errors';
 
 const { intervalInSeconds, digits, gracePeriodInSeconds } = appConfig.totpConfig;
 
@@ -19,3 +23,19 @@ export const signInWithTotp = (otp: string, secret: string): boolean => {
 
   return verifyTOTPWithGracePeriod(secretBytes, intervalInSeconds, digits, otp, gracePeriodInSeconds);
 };
+
+/**
+ * Verifies a user's TOTP code.
+ * - Decodes the Base32 secret.
+ * - Checks the OTP against the secret using interval, digits, and grace period.
+ * - Throws errors if user credentials are missing or the OTP is invalid.
+ */
+export const validateTOTP = async ({ code, userId }: { code: string; userId: string }) => {
+  // Get totp credentials
+  const [credentials] = await db.select().from(totpsTable).where(eq(totpsTable.userId, userId)).limit(1);
+  if (!credentials) throw new AppError({ status: 404, type: 'not_found', severity: 'warn' });
+
+  // Verify TOTP code using stored secret
+  const isValid = signInWithTotp(code, credentials.secret);
+  if (!isValid) throw new AppError({ status: 401, type: 'invalid_token', severity: 'warn' });
+};
diff --git a/backend/src/modules/me/handlers.ts b/backend/src/modules/me/handlers.ts
index 88a5484fe..38563db4f 100644
--- a/backend/src/modules/me/handlers.ts
+++ b/backend/src/modules/me/handlers.ts
@@ -19,10 +19,10 @@ import { resolveEntity } from '#/lib/entity';
 import { AppError } from '#/lib/errors';
 import { getParams, getSignature } from '#/lib/transloadit';
 import { isAuthenticated } from '#/middlewares/guard';
-import { deleteAuthCookie, getAuthCookie } from '#/modules/auth/general/helpers/cookie';
+import { deleteAuthCookie } from '#/modules/auth/general/helpers/cookie';
 import { getParsedSessionCookie, setUserSession, validateSession } from '#/modules/auth/general/helpers/session';
-import { verifyPassKeyPublic } from '#/modules/auth/passkeys/helpers/passkey';
-import { signInWithTotp } from '#/modules/auth/totps/helpers/totps';
+import { validatePasskey } from '#/modules/auth/passkeys/helpers/passkey';
+import { validateTOTP } from '#/modules/auth/totps/helpers/totps';
 import { checkSlugAvailable } from '#/modules/entities/helpers/check-slug';
 import { getUserSessions } from '#/modules/me/helpers/get-sessions';
 import { getUserMenuEntities } from '#/modules/me/helpers/get-user-menu-entities';
@@ -64,41 +64,12 @@ const meRouteHandlers = app
     // Determine which MFA strategy user is using
     const strategy: Extract<AuthStrategy, 'passkey' | 'totp'> = passkeyData ? 'passkey' : 'totp';
 
-    // TODO isnt this duplicated logic from passkeys module and totps module?
     try {
       // --- Passkey verification ---
-      if (passkeyData) {
-        const { credentialId, signature, authenticatorData, clientDataJSON } = passkeyData;
-
-        // Retrieve the passkey challenge stored in a secure cookie
-        const challengeFromCookie = await getAuthCookie(ctx, 'passkey-challenge');
-        if (!challengeFromCookie) throw new AppError({ status: 401, type: 'invalid_credentials', severity: 'warn' });
-
-        // Fetch passkey record for this user and credential ID
-        const [passkeyRecord] = await db
-          .select()
-          .from(passkeysTable)
-          .where(and(eq(passkeysTable.userId, user.id), eq(passkeysTable.credentialId, credentialId)))
-          .limit(1);
-
-        if (!passkeyRecord) throw new AppError({ status: 404, type: 'passkey_not_found', severity: 'warn' });
-
-        // Verify signature against public key and challenge
-        const isValid = await verifyPassKeyPublic(signature, authenticatorData, clientDataJSON, passkeyRecord.publicKey, challengeFromCookie);
-
-        if (!isValid) throw new AppError({ status: 401, type: 'invalid_token', severity: 'warn' });
-      }
+      if (passkeyData) await validatePasskey(ctx, { ...passkeyData, userId: user.id });
 
       // --- TOTP verification ---
-      if (totpCode) {
-        // Fetch  TOTP secret for this user
-        const [credentials] = await db.select().from(totpsTable).where(eq(totpsTable.userId, user.id)).limit(1);
-        if (!credentials) throw new AppError({ status: 404, type: 'not_found', severity: 'warn' });
-
-        // Verify  provided TOTP code
-        const isValid = signInWithTotp(totpCode, credentials.secret);
-        if (!isValid) throw new AppError({ status: 401, type: 'invalid_token', severity: 'warn' });
-      }
+      if (totpCode) await validateTOTP({ code: totpCode, userId: user.id });
     } catch (error) {
       if (error instanceof AppError) throw error;
 
@@ -113,9 +84,9 @@ const meRouteHandlers = app
 
     const [updatedUser] = await db.update(usersTable).set({ mfaRequired }).where(eq(usersTable.id, user.id)).returning();
 
-    if (mfaRequired) {
+    if (updatedUser.mfaRequired) {
       // Invalidate all existing regular sessions
-      await db.delete(sessionsTable).where(and(eq(sessionsTable.userId, user.id), eq(sessionsTable.type, 'regular')));
+      await db.delete(sessionsTable).where(and(eq(sessionsTable.userId, updatedUser.id), eq(sessionsTable.type, 'regular')));
 
       // Clear session cookie to enforce fresh login
       deleteAuthCookie(ctx, 'session');
diff --git a/backend/tests/helpers.ts b/backend/tests/helpers.ts
index 58b2cf1ae..b446fb60b 100644
--- a/backend/tests/helpers.ts
+++ b/backend/tests/helpers.ts
@@ -48,7 +48,6 @@ export async function createUser(email: string, password: string) {
  * @param email - The email of the user to retrieve.
  * @returns 
  */
-// TODO not used anymore?
 export async function getUserByEmail(email: string): Promise<UserModel[]> {
   return await db
     .select()
diff --git a/backend/tests/sign-up/basic.test.ts b/backend/tests/sign-up/basic.test.ts
index d5b1fd89b..6e039eb03 100644
--- a/backend/tests/sign-up/basic.test.ts
+++ b/backend/tests/sign-up/basic.test.ts
@@ -1,8 +1,8 @@
-import { testClient } from 'hono/testing'
+import { testClient } from 'hono/testing';
 import { afterEach, beforeAll, describe, expect, it, vi } from 'vitest';
-import { mockFetchRequest, migrateDatabase, clearDatabase, setTestConfig, getAuthApp } from '../setup';
-import { signUpUser, defaultHeaders } from '../fixtures';
-import { getUserByEmail, createUser } from '../helpers';
+import { defaultHeaders, signUpUser } from '../fixtures';
+import { createUser, getUserByEmail } from '../helpers';
+import { clearDatabase, getAuthApp, migrateDatabase, mockFetchRequest, setTestConfig } from '../setup';
 
 setTestConfig({
   enabledAuthStrategies: ['password'],
diff --git a/frontend/src/api.gen/sdk.gen.ts b/frontend/src/api.gen/sdk.gen.ts
index 4b4b55594..c09589c81 100644
--- a/frontend/src/api.gen/sdk.gen.ts
+++ b/frontend/src/api.gen/sdk.gen.ts
@@ -709,7 +709,7 @@ export const generatePasskeyChallenge = <ThrowOnError extends boolean = true>(op
  * @param {signInWithPasskeyData} options
  * @param {string=} options.body.credentialId - `string` (optional)
  * @param {string=} options.body.clientDataJSON - `string` (optional)
- * @param {string=} options.body.authenticatorData - `string` (optional)
+ * @param {string=} options.body.authenticatorObject - `string` (optional)
  * @param {string=} options.body.signature - `string` (optional)
  * @param {enum | enum=} options.body.type - `enum | enum` (optional)
  * @param {string=} options.body.email - `string` (optional)
diff --git a/frontend/src/api.gen/types.gen.ts b/frontend/src/api.gen/types.gen.ts
index 92350a2a9..b48da108c 100644
--- a/frontend/src/api.gen/types.gen.ts
+++ b/frontend/src/api.gen/types.gen.ts
@@ -1235,7 +1235,7 @@ export type SignInWithPasskeyData = {
   body?: {
     credentialId: string;
     clientDataJSON: string;
-    authenticatorData: string;
+    authenticatorObject: string;
     signature: string;
     type: 'authentication' | 'mfa';
     email?: string;
@@ -1731,7 +1731,7 @@ export type ToggleMfaData = {
     passkeyData?: {
       credentialId: string;
       clientDataJSON: string;
-      authenticatorData: string;
+      authenticatorObject: string;
       signature: string;
     };
     totpCode?: string;
diff --git a/frontend/src/api.gen/zod.gen.ts b/frontend/src/api.gen/zod.gen.ts
index cd89bc62c..1eacd3e7b 100644
--- a/frontend/src/api.gen/zod.gen.ts
+++ b/frontend/src/api.gen/zod.gen.ts
@@ -506,7 +506,7 @@ export const zSignInWithPasskeyData = z.object({
     z.object({
       credentialId: z.string(),
       clientDataJSON: z.string(),
-      authenticatorData: z.string(),
+      authenticatorObject: z.string(),
       signature: z.string(),
       type: z.union([z.enum(['authentication']), z.enum(['mfa'])]),
       email: z.optional(z.string()),
@@ -639,7 +639,7 @@ export const zToggleMfaData = z.object({
         z.object({
           credentialId: z.string(),
           clientDataJSON: z.string(),
-          authenticatorData: z.string(),
+          authenticatorObject: z.string(),
           signature: z.string(),
         }),
       ),
diff --git a/frontend/src/modules/auth/passkey-credentials.ts b/frontend/src/modules/auth/passkey-credentials.ts
index 4de45c38f..eda8ecb5d 100644
--- a/frontend/src/modules/auth/passkey-credentials.ts
+++ b/frontend/src/modules/auth/passkey-credentials.ts
@@ -79,7 +79,7 @@ export const getPasskeyVerifyCredential = async (
   return {
     credentialId: encodeBase64(new Uint8Array(rawId)),
     clientDataJSON: encodeBase64(new Uint8Array(response.clientDataJSON)),
-    authenticatorData: encodeBase64(new Uint8Array(response.authenticatorData)),
+    authenticatorObject: encodeBase64(new Uint8Array(response.authenticatorData)),
     signature: encodeBase64(new Uint8Array(response.signature)),
     ...query,
   };

From f90d63b9242ef2a72325d802ca75fabc247e7213 Mon Sep 17 00:00:00 2001
From: David Hordiienko <shiraz0david@gmail.com>
Date: Wed, 1 Oct 2025 17:44:24 +0300
Subject: [PATCH 30/48] improve: avoid db connection on generate-openapi script

---
 backend/package.json                |  2 +-
 backend/scripts/generate-openapi.ts |  5 ++---
 backend/src/db/db.ts                | 27 ++++++++++++++++-----------
 3 files changed, 19 insertions(+), 15 deletions(-)

diff --git a/backend/package.json b/backend/package.json
index ca1b66576..9ed07e65a 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -30,7 +30,7 @@
     "db:clear": "tsx scripts/clear-db.ts",
     "generate:pg": "drizzle-kit generate --config drizzle.config.ts",
     "generate": "pnpm generate:pg",
-    "generate-openapi": "PGLITE=true tsx scripts/generate-openapi.ts || true",
+    "generate-openapi": "tsx scripts/generate-openapi.ts || true",
     "push": "drizzle-kit push",
     "studio": "drizzle-kit studio --config drizzle.config.ts",
     "emails:build": "email build emails",
diff --git a/backend/scripts/generate-openapi.ts b/backend/scripts/generate-openapi.ts
index 639d7a7ea..b1e51b1f1 100644
--- a/backend/scripts/generate-openapi.ts
+++ b/backend/scripts/generate-openapi.ts
@@ -1,11 +1,10 @@
-process.env.NODE_ENV = 'test';
+process.env.AVOID_DB_CONNECTION = 'true';
 
 /** * Generate OpenAPI documentation and save it to a file.
  *
  * This script initializes the OpenAPI documentation for the application,
  * registers necessary schemas, and writes the generated OpenAPI document
- * to a JSON file. For this to work, the mode is set to 'test' with PGLITE=true
- * to avoid any real database connections during the generation process.
+ * to a JSON file. For this to work, AVOID_DB_CONNECTION set to true to avoid any real database connections during generation process.
  */
 (async () => {
   try {
diff --git a/backend/src/db/db.ts b/backend/src/db/db.ts
index d7a6863dc..2ae4e3493 100644
--- a/backend/src/db/db.ts
+++ b/backend/src/db/db.ts
@@ -22,17 +22,22 @@ export const migrateConfig = { migrationsFolder: 'drizzle', migrationsSchema: 'd
 /**
  * Database connection configuration.
  */
-export const connection = env.PGLITE
-  ? process.env.NODE_ENV === 'test'
-    ? // in-memory database for tests
-      {}
-    : // PGLite for quick local development
-      { dataDir: './.db' }
-  : // regular Postgres connection
-    {
-      connectionString: env.DATABASE_URL,
-      connectionTimeoutMillis: 10000,
-    };
+const connection = (() => {
+  if (process.env.AVOID_DB_CONNECTION === 'true') return {};
+
+  if (env.PGLITE) {
+    if (process.env.NODE_ENV === 'test') return {}; // In-memory database for tests
+
+    // PGLite for quick local development
+    return { dataDir: './.db' };
+  }
+
+  // Regular Postgres connection
+  return {
+    connectionString: env.DATABASE_URL,
+    connectionTimeoutMillis: 10000,
+  };
+})();
 
 // biome-ignore lint/suspicious/noExplicitAny: Can be two different types
 type DB = PgDatabase<any> & { $client: PGlite | NodePgClient };

From 9d2999dea268fa0af77c408e826b41b8b81d8cfa Mon Sep 17 00:00:00 2001
From: flipvanhaaren <flip@shareworks.nl>
Date: Wed, 1 Oct 2025 17:20:48 +0200
Subject: [PATCH 31/48] improve: styling passkey and session tiles in user
 settings page

---
 frontend/package.json                         |   38 +-
 frontend/src/api.gen/sdk.gen.ts               |  100 +-
 frontend/src/api.gen/zod.gen.ts               |   80 +-
 .../marketing/about/call-to-action.tsx        |    2 +-
 frontend/src/modules/me/passkeys/tile.tsx     |   43 +-
 frontend/src/modules/me/sessions/tile.tsx     |   69 +-
 frontend/src/modules/me/totp/index.tsx        |    6 +-
 .../src/modules/users/update-user-form.tsx    |    3 +-
 frontend/vite.config.ts                       |    2 +-
 locales/en/about.json                         |    2 +-
 package.json                                  |   12 +-
 pnpm-lock.yaml                                | 2203 +++++++++++------
 12 files changed, 1655 insertions(+), 905 deletions(-)

diff --git a/frontend/package.json b/frontend/package.json
index 9bc89ae4f..c8f3b4297 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -84,7 +84,7 @@
     "@uppy/image-editor": "^4.0.1",
     "@uppy/progress-bar": "^4.3.2",
     "@uppy/provider-views": "^5.0.2",
-    "@uppy/react": "^5.0.3",
+    "@uppy/react": "^5.1.0",
     "@uppy/remote-sources": "^3.0.1",
     "@uppy/screen-capture": "^5.0.1",
     "@uppy/status-bar": "^5.0.1",
@@ -102,7 +102,7 @@
     "dayjs": "^1.11.18",
     "embla-carousel-autoplay": "^8.6.0",
     "embla-carousel-react": "^8.6.0",
-    "gleap": "^14.8.8",
+    "gleap": "^14.8.11",
     "i18next": "^25.5.2",
     "i18next-browser-languagedetector": "^8.2.0",
     "i18next-hmr": "^3.1.5",
@@ -125,7 +125,7 @@
     "react-dom": "^19.1.1",
     "react-error-boundary": "^6.0.0",
     "react-hook-form": "^7.63.0",
-    "react-i18next": "^15.7.3",
+    "react-i18next": "^15.7.4",
     "react-intersection-observer": "^9.16.0",
     "react-lazy-with-preload": "^2.2.1",
     "react-pdf": "^9.2.1",
@@ -139,7 +139,7 @@
     "tailwindcss-animate": "^1.0.7",
     "use-count-up": "^3.0.1",
     "vaul": "^1.1.2",
-    "virtua": "^0.43.4",
+    "virtua": "^0.43.6",
     "vitest": "^3.2.4",
     "workbox-window": "^7.3.0",
     "zod": "4.1.8",
@@ -148,41 +148,41 @@
   },
   "devDependencies": {
     "@chromatic-com/storybook": "^4.1.1",
-    "@hey-api/openapi-ts": "^0.84.3",
+    "@hey-api/openapi-ts": "^0.84.4",
     "@react-scan/vite-plugin-react-scan": "^0.1.8",
     "@rollup/plugin-terser": "^0.4.4",
     "@sentry/vite-plugin": "^3.6.1",
-    "@storybook/addon-a11y": "^9.1.8",
-    "@storybook/addon-docs": "^9.1.8",
-    "@storybook/addon-vitest": "^9.1.8",
-    "@storybook/react-vite": "^9.1.8",
+    "@storybook/addon-a11y": "^9.1.10",
+    "@storybook/addon-docs": "^9.1.10",
+    "@storybook/addon-vitest": "^9.1.10",
+    "@storybook/react-vite": "^9.1.10",
     "@tailwindcss/vite": "^4.1.13",
-    "@tanstack/router-core": "^1.132.6",
-    "@tanstack/router-plugin": "^1.132.6",
+    "@tanstack/router-core": "^1.132.27",
+    "@tanstack/router-plugin": "^1.132.27",
     "@types/canvas-confetti": "^1.9.0",
-    "@types/node": "^24.5.2",
-    "@types/react": "^19.1.13",
+    "@types/node": "^24.6.1",
+    "@types/react": "^19.1.16",
     "@types/react-dom": "^19.1.9",
     "@types/zxcvbn": "^4.4.5",
     "@typescript/native-preview": "7.0.0-dev.20250910.1",
     "@vitejs/plugin-basic-ssl": "^2.1.0",
-    "@vitejs/plugin-react": "^5.0.3",
+    "@vitejs/plugin-react": "^5.0.4",
     "@vitest/browser": "^3.2.4",
     "@vitest/coverage-v8": "^3.2.4",
     "babel-plugin-react-compiler": "19.1.0-rc.3",
-    "cross-env": "^10.0.0",
+    "cross-env": "^10.1.0",
     "hono": "4.9.8",
     "playwright": "^1.55.1",
     "postgres": "^3.4.7",
     "react-scan": "^0.4.3",
     "rollup-plugin-visualizer": "^6.0.3",
-    "storybook": "^9.1.8",
-    "tsx": "^4.20.5",
-    "typescript": "^5.9.2",
+    "storybook": "^9.1.10",
+    "tsx": "^4.20.6",
+    "typescript": "^5.9.3",
     "vite": "^7.1.7",
     "vite-plugin-html": "^3.2.2",
     "vite-plugin-pwa": "^1.0.3",
-    "vite-plugin-static-copy": "^3.1.2",
+    "vite-plugin-static-copy": "^3.1.3",
     "vite-tsconfig-paths": "^5.1.4",
     "wait-on": "^8.0.5",
     "workbox-build": "^7.3.0"
diff --git a/frontend/src/api.gen/sdk.gen.ts b/frontend/src/api.gen/sdk.gen.ts
index c09589c81..8f5d2bebf 100644
--- a/frontend/src/api.gen/sdk.gen.ts
+++ b/frontend/src/api.gen/sdk.gen.ts
@@ -270,7 +270,7 @@ export const invokeToken = <ThrowOnError extends boolean = true>(options: Option
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -298,7 +298,7 @@ export const getTokenData = <ThrowOnError extends boolean = true>(options: Optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -325,7 +325,7 @@ export const startImpersonation = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -351,7 +351,7 @@ export const stopImpersonation = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -377,7 +377,7 @@ export const signOut = <ThrowOnError extends boolean = true>(options?: Options<S
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -721,7 +721,7 @@ export const signInWithPasskey = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -883,7 +883,7 @@ export const deleteMe = <ThrowOnError extends boolean = true>(options?: Options<
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -909,7 +909,7 @@ export const getMe = <ThrowOnError extends boolean = true>(options?: Options<Get
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -943,7 +943,7 @@ export const updateMe = <ThrowOnError extends boolean = true>(options?: Options<
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -976,7 +976,7 @@ export const toggleMfa = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1006,7 +1006,7 @@ export const getMyAuth = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1032,7 +1032,7 @@ export const getMyMenu = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1058,7 +1058,7 @@ export const getMyInvitations = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1085,7 +1085,7 @@ export const deleteMySessions = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1139,7 +1139,7 @@ export const getUploadToken = <ThrowOnError extends boolean = true>(options: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1167,7 +1167,7 @@ export const unsubscribeMe = <ThrowOnError extends boolean = true>(options: Opti
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1194,7 +1194,7 @@ export const deleteUsers = <ThrowOnError extends boolean = true>(options?: Optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1233,7 +1233,7 @@ export const getUsers = <ThrowOnError extends boolean = true>(options?: Options<
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1260,7 +1260,7 @@ export const getUser = <ThrowOnError extends boolean = true>(options: Options<Ge
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1294,7 +1294,7 @@ export const updateUser = <ThrowOnError extends boolean = true>(options: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1325,7 +1325,7 @@ export const deleteOrganizations = <ThrowOnError extends boolean = true>(options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1360,7 +1360,7 @@ export const getOrganizations = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1388,7 +1388,7 @@ export const createOrganization = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1419,7 +1419,7 @@ export const getOrganization = <ThrowOnError extends boolean = true>(options: Op
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1463,7 +1463,7 @@ export const updateOrganization = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1507,7 +1507,7 @@ export const getContextEntities = <ThrowOnError extends boolean = true>(options?
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1536,7 +1536,7 @@ export const getContextEntity = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1565,7 +1565,7 @@ export const checkSlug = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1596,7 +1596,7 @@ export const systemInvite = <ThrowOnError extends boolean = true>(options?: Opti
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1628,7 +1628,7 @@ export const getPresignedUrl = <ThrowOnError extends boolean = true>(options: Op
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1655,7 +1655,7 @@ export const paddleWebhook = <ThrowOnError extends boolean = true>(options?: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1690,7 +1690,7 @@ export const sendNewsletter = <ThrowOnError extends boolean = true>(options: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1721,7 +1721,7 @@ export const deleteRequests = <ThrowOnError extends boolean = true>(options?: Op
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1756,7 +1756,7 @@ export const getRequests = <ThrowOnError extends boolean = true>(options?: Optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1786,7 +1786,7 @@ export const createRequest = <ThrowOnError extends boolean = true>(options?: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1817,7 +1817,7 @@ export const getMetrics = <ThrowOnError extends boolean = true>(options?: Option
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1844,7 +1844,7 @@ export const getPublicCounts = <ThrowOnError extends boolean = true>(options?: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1879,7 +1879,7 @@ export const shapeProxy = <ThrowOnError extends boolean = true>(options: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1907,7 +1907,7 @@ export const deleteAttachments = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1944,7 +1944,7 @@ export const getAttachments = <ThrowOnError extends boolean = true>(options: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1971,7 +1971,7 @@ export const createAttachment = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2003,7 +2003,7 @@ export const getAttachment = <ThrowOnError extends boolean = true>(options: Opti
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2033,7 +2033,7 @@ export const updateAttachment = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2065,7 +2065,7 @@ export const redirectToAttachment = <ThrowOnError extends boolean = true>(option
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2095,7 +2095,7 @@ export const deleteMemberships = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2130,7 +2130,7 @@ export const membershipInvite = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2166,7 +2166,7 @@ export const updateMembership = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2198,7 +2198,7 @@ export const acceptMembership = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2233,7 +2233,7 @@ export const getMembers = <ThrowOnError extends boolean = true>(options: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2267,7 +2267,7 @@ export const getPendingInvitations = <ThrowOnError extends boolean = true>(optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-development-session-v1',
+        name: 'cella-session-v1',
         type: 'apiKey',
       },
     ],
diff --git a/frontend/src/api.gen/zod.gen.ts b/frontend/src/api.gen/zod.gen.ts
index 1eacd3e7b..fda03dfec 100644
--- a/frontend/src/api.gen/zod.gen.ts
+++ b/frontend/src/api.gen/zod.gen.ts
@@ -157,46 +157,46 @@ export const zApiError = z.object({
   message: z.string(),
   type: z.string(),
   status: z.union([
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
-    z.unknown(),
+    z.literal(400),
+    z.literal(401),
+    z.literal(402),
+    z.literal(403),
+    z.literal(404),
+    z.literal(405),
+    z.literal(406),
+    z.literal(407),
+    z.literal(408),
+    z.literal(409),
+    z.literal(410),
+    z.literal(411),
+    z.literal(412),
+    z.literal(413),
+    z.literal(414),
+    z.literal(415),
+    z.literal(416),
+    z.literal(417),
+    z.literal(418),
+    z.literal(421),
+    z.literal(422),
+    z.literal(423),
+    z.literal(424),
+    z.literal(425),
+    z.literal(426),
+    z.literal(428),
+    z.literal(429),
+    z.literal(431),
+    z.literal(451),
+    z.literal(500),
+    z.literal(501),
+    z.literal(502),
+    z.literal(503),
+    z.literal(504),
+    z.literal(505),
+    z.literal(506),
+    z.literal(507),
+    z.literal(508),
+    z.literal(510),
+    z.literal(511),
   ]),
   severity: z.enum(['fatal', 'error', 'warn', 'info', 'debug', 'trace']),
   entityType: z.optional(z.enum(['user', 'organization', 'attachment'])),
diff --git a/frontend/src/modules/marketing/about/call-to-action.tsx b/frontend/src/modules/marketing/about/call-to-action.tsx
index d40784442..600c603e2 100644
--- a/frontend/src/modules/marketing/about/call-to-action.tsx
+++ b/frontend/src/modules/marketing/about/call-to-action.tsx
@@ -9,7 +9,7 @@ const CallToAction = () => {
 
   return (
     <div className="mx-auto grid max-w-4xl text-center">
-      <p className="font-semibold text-4xl sm:text-6xl lg:text-7xl leading-[4rem] mb-12">{t('about:call_to_action.intro')}</p>
+      <p className="font-semibold text-4xl sm:text-5xl lg:text-6xl leading-[4rem] mb-12">{t('about:call_to_action.intro')}</p>
       <p className="text-2xl sm:text-4xl leading-[3.3rem] mb-12">
         <span className="opacity-50 mr-2">“</span>
         <span className="font-light">{t('about:call_to_action.start')}</span>
diff --git a/frontend/src/modules/me/passkeys/tile.tsx b/frontend/src/modules/me/passkeys/tile.tsx
index 14b5ee6ea..d67c1ba5f 100644
--- a/frontend/src/modules/me/passkeys/tile.tsx
+++ b/frontend/src/modules/me/passkeys/tile.tsx
@@ -1,4 +1,5 @@
-import { Monitor, Smartphone, Unlink } from 'lucide-react';
+import { ChevronDown, KeyRound, Monitor, Smartphone, Unlink } from 'lucide-react';
+import { useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import type { Passkey } from '~/modules/me/types';
 import { Badge } from '~/modules/ui/badge';
@@ -16,19 +17,23 @@ interface PasskeyTileProps {
 
 export const PasskeyTile = ({ passkey, handleUnlinkPasskey, isPending, onlyPasskeyLeft }: PasskeyTileProps) => {
   const { t } = useTranslation();
-
   const user = useUserStore((state) => state.user);
 
+  const [expanded, setExpanded] = useState(false);
+
+  const DeviceIcon = passkey.deviceType === 'desktop' ? Monitor : Smartphone;
+
   return (
-    <Card className="w-full">
-      <CardContent className="flex !p-3 items-center gap-3">
-        {passkey.deviceType === 'desktop' ? <Monitor size={32} strokeWidth={1.25} /> : <Smartphone size={32} strokeWidth={1.25} />}
-
-        <div className="flex flex-col gap-1 overflow-hidden">
-          <div className="flex gap-2 items-center">
-            <div className="font-semibold">{passkey.deviceName || t('common:unknown_device')}</div>
-            <Badge size="xs" variant="outline">
-              {passkey.nameOnDevice}
+    <Card className="w-full group/tile sm:has-[button:focus]:ring-2 transition-all" data-expanded={expanded}>
+      <CardContent className="flex !p-2 sm:!p-3 lg:items-center gap-2 sm:gap-3">
+        <DeviceIcon className="w-4 h-4 sm:w-8 sm:h-8 max-sm:mt-0.5" strokeWidth={1.5} />
+
+        <div className="flex flex-col gap-1 w-full overflow-hidden">
+          <div className="flex max-md:flex-col items-start gap-1 md:gap-2">
+            <span className="text-sm">{passkey.deviceName || t('common:unknown_device')}</span>
+            <Badge size="xs" variant="outline" className="truncate flex items-center font-light gap-1 py-0">
+              <KeyRound size={12} />
+              <span className="truncate">{passkey.nameOnDevice}</span>
             </Badge>
           </div>
 
@@ -36,12 +41,24 @@ export const PasskeyTile = ({ passkey, handleUnlinkPasskey, isPending, onlyPassk
             <p className="truncate" aria-describedby={t('common:created_at')}>
               {dateShort(passkey.createdAt)}
             </p>
-            <p className="truncate max-lg:hidden" aria-describedby="OS">
+            <p className="truncate hidden lg:inline max-lg:group-data-[expanded=true]/tile:inline" aria-describedby="OS">
               {passkey.deviceOs}
             </p>
-            <p className="truncate max-md:hidden" aria-describedby={t('common:browser')}>
+            <p className="truncate hidden lg:inline max-lg:group-data-[expanded=true]/tile:inline" aria-describedby={t('common:browser')}>
               {passkey.browser}
             </p>
+
+            <Button
+              variant="link"
+              onClick={() => setExpanded((v) => !v)}
+              aria-expanded={expanded}
+              size="xs"
+              className="lg:hidden p-0 font-light max-sm:text-[0.7rem] h-auto sm:opacity-0 group-hover/tile:opacity-100 focus-visible:opacity-100 focus-visible:ring-transparent ring-offset-0 outline-0 transition-opacity"
+            >
+              <div className="group-data-[expanded=true]/tile:hidden">More</div>
+              <div className="group-data-[expanded=false]/tile:hidden">Less</div>
+              <ChevronDown size="12" className={`ml-1 transition-transform ${expanded ? 'rotate-180' : ''}`} />
+            </Button>
           </div>
         </div>
 
diff --git a/frontend/src/modules/me/sessions/tile.tsx b/frontend/src/modules/me/sessions/tile.tsx
index c91459ce2..9069adb45 100644
--- a/frontend/src/modules/me/sessions/tile.tsx
+++ b/frontend/src/modules/me/sessions/tile.tsx
@@ -1,4 +1,5 @@
-import { Monitor, ShieldCheck, Smartphone, ZapOff } from 'lucide-react';
+import { ChevronDown, Monitor, ShieldCheck, Smartphone, ZapOff } from 'lucide-react';
+import { useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import type { Session } from '~/modules/me/types';
 import { Badge } from '~/modules/ui/badge';
@@ -15,43 +16,65 @@ interface SessionTileProps {
 export const SessionTile = ({ session, handleDeleteSessions, isPending }: SessionTileProps) => {
   const { t } = useTranslation();
 
-  return (
-    <Card className="w-full">
-      <CardContent className="flex !p-3 items-center gap-3">
-        {session.deviceType === 'desktop' ? <Monitor size={32} strokeWidth={1.25} /> : <Smartphone size={32} strokeWidth={1.25} />}
+  const [expanded, setExpanded] = useState(false);
 
-        <div className="flex flex-col gap-1 overflow-hidden">
-          <div className="flex gap-2 items-center">
-            <div className="font-semibold">{session.deviceName || t('common:unknown_device')}</div>
+  const DeviceIcon = session.deviceType === 'desktop' ? Monitor : Smartphone;
 
-            {session.isCurrent && (
-              <Badge size="xs" variant="plain" className="uppercase font-normal text-[10px] py-0">
-                {t('common:current')}
-              </Badge>
-            )}
-            {session.type === 'mfa' && (
-              <Badge size="xs" variant="outline" className="py-0 flex items-center font-normal gap-1 text-green-600 border-green-600">
-                <ShieldCheck size={12} />
-                {t('common:mfa_short')}
-              </Badge>
-            )}
+  return (
+    <Card className="w-full group/tile sm:has-[button:focus]:ring-2 transition-all" data-expanded={expanded}>
+      <CardContent className="flex !p-2 sm:!p-3 lg:items-center gap-2 sm:gap-3">
+        <DeviceIcon className="w-4 h-4 sm:w-8 sm:h-8 max-sm:mt-0.5" strokeWidth={1.5} />
+        <div className="flex flex-col gap-1 w-full overflow-hidden">
+          <div className="flex max-xs:flex-col gap-1 xs:gap-2">
+            <span className="text-sm">{session.deviceName || t('common:unknown_device')}</span>
+            <div className="empty:hidden flex gap-2">
+              {session.type === 'mfa' && (
+                <Badge
+                  size="xs"
+                  variant="outline"
+                  className="py-0 text-[10px] uppercase flex items-center font-normal gap-1 text-green-600 border-green-600"
+                >
+                  <ShieldCheck size={12} />
+                  {t('common:mfa_short')}
+                </Badge>
+              )}
+              {session.isCurrent && (
+                <Badge size="xs" variant="plain" className="uppercase font-normal text-[10px] py-0">
+                  {t('common:current')}
+                </Badge>
+              )}
+            </div>
           </div>
 
-          <div className="flex flex-wrap items-start gap-x-2 md:gap-x-5 gap-y-1 font-light text-sm text-muted-foreground">
+          <div className="flex flex-wrap gap-x-2 md:gap-x-5 gap-y-1 font-light text-xs sm:text-sm text-muted-foreground">
             <p className="truncate" aria-describedby={t('common:period')}>
               {dateShort(session.createdAt)} - {dateShort(session.expiresAt)}
             </p>
             {session.authStrategy && (
-              <p className="truncate max-sm:hidden capitalize" aria-describedby={t('common:strategy')}>
+              <p
+                className="truncate hidden lg:inline capitalize max-lg:group-data-[expanded=true]/tile:inline"
+                aria-describedby={t('common:strategy')}
+              >
                 {t(session.authStrategy)}
               </p>
             )}
-            <p className="truncate max-lg:hidden" aria-describedby={t('common:os')}>
+            <p className="truncate hidden lg:inline max-lg:group-data-[expanded=true]/tile:inline" aria-describedby={t('common:os')}>
               {session.deviceOs}
             </p>
-            <p className="truncate max-md:hidden" aria-describedby={t('common:browser')}>
+            <p className="truncate hidden lg:inline max-lg:group-data-[expanded=true]/tile:inline" aria-describedby={t('common:browser')}>
               {session.browser}
             </p>
+            <Button
+              variant="link"
+              onClick={() => setExpanded((v) => !v)}
+              aria-expanded={expanded}
+              size="xs"
+              className="lg:hidden p-0 font-light max-sm:text-[0.7rem] h-auto sm:opacity-0 group-hover/tile:opacity-100 focus-visible:opacity-100 focus-visible:ring-transparent ring-offset-0 outline-0 transition-opacity"
+            >
+              <div className="group-data-[expanded=true]/tile:hidden">More</div>
+              <div className="group-data-[expanded=false]/tile:hidden">Less</div>
+              <ChevronDown size="12" className={`ml-1 transition-transform ${expanded ? 'rotate-180' : ''}`} />
+            </Button>
           </div>
         </div>
 
diff --git a/frontend/src/modules/me/totp/index.tsx b/frontend/src/modules/me/totp/index.tsx
index 18ca85518..fe76e1c2f 100644
--- a/frontend/src/modules/me/totp/index.tsx
+++ b/frontend/src/modules/me/totp/index.tsx
@@ -1,5 +1,5 @@
 import { onlineManager } from '@tanstack/react-query';
-import { Check, QrCode, Unlink } from 'lucide-react';
+import { Check, RotateCcwKey, Unlink } from 'lucide-react';
 import { Suspense, useRef } from 'react';
 import { useTranslation } from 'react-i18next';
 import { useDialoger } from '~/modules/common/dialoger/use-dialoger';
@@ -46,7 +46,7 @@ const Totp = () => {
     <div className="flex max-sm:flex-col gap-2 mb-6">
       {hasTotp && (
         <div className="flex items-center gap-2 px-3">
-          <QrCode className="w-4 h-4 mr-2" />
+          <RotateCcwKey className="w-4 h-4 mr-2" />
           <Check size={18} strokeWidth={3} className="text-success" />
           <span>{t('common:totp_activated')}</span>
         </div>
@@ -58,7 +58,7 @@ const Totp = () => {
         </Button>
       ) : (
         <Button key="createTotp" type="button" variant="plain" onClick={openSetupTotp}>
-          <QrCode className="w-4 h-4 mr-2" />
+          <RotateCcwKey className="w-4 h-4 mr-2" />
           <span>{t('common:totp_setup')}</span>
         </Button>
       )}
diff --git a/frontend/src/modules/users/update-user-form.tsx b/frontend/src/modules/users/update-user-form.tsx
index e337e849b..2a0c65e6f 100644
--- a/frontend/src/modules/users/update-user-form.tsx
+++ b/frontend/src/modules/users/update-user-form.tsx
@@ -19,7 +19,7 @@ import { toaster } from '~/modules/common/toaster/service';
 import { useUpdateSelfMutation } from '~/modules/me/query';
 import { Button, SubmitButton } from '~/modules/ui/button';
 import { Checkbox } from '~/modules/ui/checkbox';
-import { Form, FormControl, FormDescription, FormField, FormItem, FormLabel, FormMessage } from '~/modules/ui/form';
+import { Form, FormControl, FormField, FormItem, FormLabel, FormMessage } from '~/modules/ui/form';
 import { Input } from '~/modules/ui/input';
 import { Label } from '~/modules/ui/label';
 import { useUpdateUserMutation } from '~/modules/users/query';
@@ -128,7 +128,6 @@ const UpdateUserForm = ({ user, callback, sheet: isSheet, hiddenFields, children
                 {t('common:language')}
                 <span className="ml-1 opacity-50">*</span>
               </FormLabel>
-              <FormDescription>{t('common:placeholder.select_language')}</FormDescription>
               <FormControl>
                 <SelectLanguage options={[...appConfig.languages]} value={field.value ?? appConfig.defaultLanguage} onChange={field.onChange} />
               </FormControl>
diff --git a/frontend/vite.config.ts b/frontend/vite.config.ts
index cb35a98bb..8d3d03786 100644
--- a/frontend/vite.config.ts
+++ b/frontend/vite.config.ts
@@ -24,7 +24,7 @@ const isStorybook = process.env.STORYBOOK === 'true';
 const frontendUrl = new URL(appConfig.frontendUrl);
 
 const viteConfig = {
-  logLevel: 'info',
+  logLevel: 'warn',
   server: {
     host: '0.0.0.0',
     port: Number(frontendUrl.port),
diff --git a/locales/en/about.json b/locales/en/about.json
index 7760ed007..2c48765e6 100644
--- a/locales/en/about.json
+++ b/locales/en/about.json
@@ -7,7 +7,7 @@
   "feature.react_text": "React, i18Next, React Data Grid. Zustand to manage state.",
   "feature.drizzle_text": "Postgres DB with Drizzle ORM. Seeds and easy migrations.",
   "feature.shadcn_text": "Accessible components with Radix, Tailwind and Motion.",
-  "feature.openapi_text": "Autogenerated docs + client SDK using Zod, Scalar and HeyApi.",
+  "feature.openapi_text": "Autogenerated types, zod schemas, client SDK & API docs.",
   "feature.tanstack_text": "Tanstack Router for type-safe routing, Tanstack Query for (offline) caching.",
   "feature.electric_text": "Instant UI updates, realtime sync and offline access.",
   "feature.hono_title": "hono & node",
diff --git a/package.json b/package.json
index 44c2cc332..d43517a3c 100644
--- a/package.json
+++ b/package.json
@@ -56,16 +56,16 @@
   },
   "devDependencies": {
     "@biomejs/biome": "^2.2.4",
-    "@evilmartians/lefthook": "^1.13.3",
+    "@evilmartians/lefthook": "^1.13.6",
     "@typescript/native-preview": "7.0.0-dev.20250910.1",
-    "cross-env": "^10.0.0",
-    "knip": "^5.64.0",
+    "cross-env": "^10.1.0",
+    "knip": "^5.64.1",
     "rimraf": "^6.0.1",
-    "tsx": "^4.20.5",
-    "typescript": "^5.9.2",
+    "tsx": "^4.20.6",
+    "typescript": "^5.9.3",
     "vitest": "^3.2.4"
   },
   "dependencies": {
-    "dotenv": "^17.2.2"
+    "dotenv": "^17.2.3"
   }
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 2248a564e..0d440ec86 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -9,36 +9,36 @@ importers:
   .:
     dependencies:
       dotenv:
-        specifier: ^17.2.2
-        version: 17.2.2
+        specifier: ^17.2.3
+        version: 17.2.3
     devDependencies:
       '@biomejs/biome':
         specifier: ^2.2.4
         version: 2.2.4
       '@evilmartians/lefthook':
-        specifier: ^1.13.3
-        version: 1.13.3
+        specifier: ^1.13.6
+        version: 1.13.6
       '@typescript/native-preview':
         specifier: 7.0.0-dev.20250910.1
         version: 7.0.0-dev.20250910.1
       cross-env:
-        specifier: ^10.0.0
-        version: 10.0.0
+        specifier: ^10.1.0
+        version: 10.1.0
       knip:
-        specifier: ^5.64.0
-        version: 5.64.0(@types/node@24.5.2)(typescript@5.9.2)
+        specifier: ^5.64.1
+        version: 5.64.1(@types/node@24.6.1)(typescript@5.9.3)
       rimraf:
         specifier: ^6.0.1
         version: 6.0.1
       tsx:
-        specifier: ^4.20.5
-        version: 4.20.5
+        specifier: ^4.20.6
+        version: 4.20.6
       typescript:
-        specifier: ^5.9.2
-        version: 5.9.2
+        specifier: ^5.9.3
+        version: 5.9.3
       vitest:
         specifier: ^3.2.4
-        version: 3.2.4(@types/debug@4.1.12)(@types/node@24.5.2)(@vitest/browser@3.2.4)(jiti@2.6.0)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
+        version: 3.2.4(@types/debug@4.1.12)(@types/node@24.6.1)(@vitest/browser@3.2.4)(jiti@2.6.1)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
 
   backend:
     dependencies:
@@ -59,7 +59,7 @@ importers:
         version: 3.896.0
       '@cellajs/permission-manager':
         specifier: ^0.1.0
-        version: 0.1.0(@swc/core@1.7.26)(jiti@2.6.0)(postcss@8.5.6)(tsx@4.20.5)(yaml@2.8.1)
+        version: 0.1.0(@swc/core@1.7.26)(jiti@2.6.1)(postcss@8.5.6)(tsx@4.20.5)(yaml@2.8.1)
       '@dotenv-run/core':
         specifier: ^1.3.8
         version: 1.3.8
@@ -267,7 +267,7 @@ importers:
         version: 13.1.1
       tsup:
         specifier: ^8.5.0
-        version: 8.5.0(@swc/core@1.7.26)(jiti@2.6.0)(postcss@8.5.6)(tsx@4.20.5)(typescript@5.9.2)(yaml@2.8.1)
+        version: 8.5.0(@swc/core@1.7.26)(jiti@2.6.1)(postcss@8.5.6)(tsx@4.20.5)(typescript@5.9.2)(yaml@2.8.1)
       tsx:
         specifier: ^4.20.5
         version: 4.20.5
@@ -304,7 +304,7 @@ importers:
     devDependencies:
       tsup:
         specifier: ^8.3.5
-        version: 8.5.0(@swc/core@1.7.26)(jiti@2.6.0)(postcss@8.5.6)(tsx@4.20.3)(typescript@5.9.2)(yaml@2.8.1)
+        version: 8.5.0(@swc/core@1.7.26)(jiti@2.6.1)(postcss@8.5.6)(tsx@4.20.3)(typescript@5.9.3)(yaml@2.8.1)
       tsx:
         specifier: ^4.19.2
         version: 4.20.3
@@ -361,7 +361,7 @@ importers:
         version: 0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@blocknote/shadcn':
         specifier: 0.33.0
-        version: 0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(highlight.js@11.11.1)(lowlight@3.3.0)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2))
+        version: 0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(highlight.js@11.11.1)(lowlight@3.3.0)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.6.1)(typescript@5.9.3))
       '@electric-sql/client':
         specifier: 1.0.10
         version: 1.0.10
@@ -388,85 +388,85 @@ importers:
         version: 1.4.2
       '@radix-ui/react-accordion':
         specifier: ^1.2.12
-        version: 1.2.12(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.2.12(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-alert-dialog':
         specifier: ^1.1.15
-        version: 1.1.15(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.15(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-avatar':
         specifier: ^1.1.10
-        version: 1.1.10(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.10(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-checkbox':
         specifier: ^1.3.3
-        version: 1.3.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.3.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-collapsible':
         specifier: ^1.1.12
-        version: 1.1.12(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.12(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-context-menu':
         specifier: ^2.2.16
-        version: 2.2.16(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 2.2.16(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-dialog':
         specifier: ^1.1.15
-        version: 1.1.15(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.15(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-dropdown-menu':
         specifier: ^2.1.16
-        version: 2.1.16(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 2.1.16(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-hover-card':
         specifier: ^1.1.15
-        version: 1.1.15(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.15(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-label':
         specifier: ^2.1.7
-        version: 2.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 2.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-popover':
         specifier: ^1.1.15
-        version: 1.1.15(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.15(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-progress':
         specifier: ^1.1.7
-        version: 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-radio-group':
         specifier: ^1.3.8
-        version: 1.3.8(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.3.8(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-scroll-area':
         specifier: ^1.2.10
-        version: 1.2.10(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.2.10(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-select':
         specifier: ^2.2.6
-        version: 2.2.6(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 2.2.6(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-separator':
         specifier: ^1.1.7
-        version: 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-slider':
         specifier: ^1.3.6
-        version: 1.3.6(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.3.6(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-slot':
         specifier: ^1.2.3
-        version: 1.2.3(@types/react@19.1.13)(react@19.1.1)
+        version: 1.2.3(@types/react@19.1.16)(react@19.1.1)
       '@radix-ui/react-switch':
         specifier: ^1.2.6
-        version: 1.2.6(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.2.6(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-tabs':
         specifier: ^1.1.13
-        version: 1.1.13(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.13(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-toast':
         specifier: ^1.2.15
-        version: 1.2.15(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.2.15(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-toggle':
         specifier: ^1.1.10
-        version: 1.1.10(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.10(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-toggle-group':
         specifier: ^1.1.11
-        version: 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-tooltip':
         specifier: ^1.2.8
-        version: 1.2.8(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.2.8(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-visually-hidden':
         specifier: ^1.2.3
-        version: 1.2.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.2.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@sentry/react':
         specifier: ^9.46.0
         version: 9.46.0(react@19.1.1)
       '@t3-oss/env-core':
         specifier: ^0.13.8
-        version: 0.13.8(arktype@2.1.20)(typescript@5.9.2)(zod@4.1.8)
+        version: 0.13.8(arktype@2.1.20)(typescript@5.9.3)(zod@4.1.8)
       '@tailwindcss/typography':
         specifier: ^0.5.19
         version: 0.5.19(tailwindcss@4.1.13)
@@ -487,7 +487,7 @@ importers:
         version: 1.132.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@tanstack/react-router-devtools':
         specifier: 1.132.6
-        version: 1.132.6(@tanstack/react-router@1.132.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(@tanstack/router-core@1.132.6)(@types/node@24.5.2)(csstype@3.1.3)(jiti@2.6.0)(lightningcss@1.30.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.5)(yaml@2.8.1)
+        version: 1.132.6(@tanstack/react-router@1.132.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(@tanstack/router-core@1.132.27)(@types/node@24.6.1)(csstype@3.1.3)(jiti@2.6.1)(lightningcss@1.30.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.6)(yaml@2.8.1)
       '@uppy/audio':
         specifier: ^3.0.1
         version: 3.0.1(@uppy/core@5.0.2)
@@ -513,8 +513,8 @@ importers:
         specifier: ^5.0.2
         version: 5.0.2(@uppy/core@5.0.2)
       '@uppy/react':
-        specifier: ^5.0.3
-        version: 5.0.3(@uppy/core@5.0.2)(@uppy/dashboard@5.0.2(@uppy/core@5.0.2))(@uppy/screen-capture@5.0.1(@uppy/core@5.0.2))(@uppy/webcam@5.0.1(@uppy/core@5.0.2))(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        specifier: ^5.1.0
+        version: 5.1.0(@uppy/core@5.0.2)(@uppy/dashboard@5.0.2(@uppy/core@5.0.2))(@uppy/screen-capture@5.0.1(@uppy/core@5.0.2))(@uppy/status-bar@5.0.1(@uppy/core@5.0.2))(@uppy/webcam@5.0.1(@uppy/core@5.0.2))(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@uppy/remote-sources':
         specifier: ^3.0.1
         version: 3.0.1(@uppy/core@5.0.2)
@@ -550,7 +550,7 @@ importers:
         version: 2.1.1
       cmdk:
         specifier: ^1.1.1
-        version: 1.1.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.1(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       concurrently:
         specifier: ^9.2.1
         version: 9.2.1
@@ -567,11 +567,11 @@ importers:
         specifier: ^8.6.0
         version: 8.6.0(react@19.1.1)
       gleap:
-        specifier: ^14.8.8
-        version: 14.8.8
+        specifier: ^14.8.11
+        version: 14.8.11
       i18next:
         specifier: ^25.5.2
-        version: 25.5.2(typescript@5.9.2)
+        version: 25.5.2(typescript@5.9.3)
       i18next-browser-languagedetector:
         specifier: ^8.2.0
         version: 8.2.0
@@ -636,8 +636,8 @@ importers:
         specifier: ^7.63.0
         version: 7.63.0(react@19.1.1)
       react-i18next:
-        specifier: ^15.7.3
-        version: 15.7.3(i18next@25.5.2(typescript@5.9.2))(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(typescript@5.9.2)
+        specifier: ^15.7.4
+        version: 15.7.4(i18next@25.5.2(typescript@5.9.3))(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(typescript@5.9.3)
       react-intersection-observer:
         specifier: ^9.16.0
         version: 9.16.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
@@ -646,7 +646,7 @@ importers:
         version: 2.2.1
       react-pdf:
         specifier: ^9.2.1
-        version: 9.2.1(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 9.2.1(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       react-resizable-panels:
         specifier: ^3.0.6
         version: 3.0.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
@@ -655,7 +655,7 @@ importers:
         version: 1.3.0(react@19.1.1)
       recharts:
         specifier: ^3.2.1
-        version: 3.2.1(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react-is@18.3.1)(react@19.1.1)(redux@5.0.1)
+        version: 3.2.1(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react-is@18.3.1)(react@19.1.1)(redux@5.0.1)
       slugify:
         specifier: 1.6.6
         version: 1.6.6
@@ -676,13 +676,13 @@ importers:
         version: 3.0.1(react@19.1.1)
       vaul:
         specifier: ^1.1.2
-        version: 1.1.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.2(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       virtua:
-        specifier: ^0.43.4
-        version: 0.43.4(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(solid-js@1.9.9)(vue@3.5.13(typescript@5.9.2))
+        specifier: ^0.43.6
+        version: 0.43.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(solid-js@1.9.9)(vue@3.5.13(typescript@5.9.3))
       vitest:
         specifier: ^3.2.4
-        version: 3.2.4(@types/debug@4.1.12)(@types/node@24.5.2)(@vitest/browser@3.2.4)(jiti@2.6.0)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
+        version: 3.2.4(@types/debug@4.1.12)(@types/node@24.6.1)(@vitest/browser@3.2.4)(jiti@2.6.1)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
       workbox-window:
         specifier: ^7.3.0
         version: 7.3.0
@@ -691,20 +691,20 @@ importers:
         version: 4.1.8
       zustand:
         specifier: ^5.0.8
-        version: 5.0.8(@types/react@19.1.13)(immer@10.1.3)(react@19.1.1)(use-sync-external-store@1.5.0(react@19.1.1))
+        version: 5.0.8(@types/react@19.1.16)(immer@10.1.3)(react@19.1.1)(use-sync-external-store@1.5.0(react@19.1.1))
       zxcvbn:
         specifier: ^4.4.2
         version: 4.4.2
     devDependencies:
       '@chromatic-com/storybook':
         specifier: ^4.1.1
-        version: 4.1.1(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))
+        version: 4.1.1(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
       '@hey-api/openapi-ts':
-        specifier: ^0.84.3
-        version: 0.84.3(magicast@0.3.5)(typescript@5.9.2)
+        specifier: ^0.84.4
+        version: 0.84.4(magicast@0.3.5)(typescript@5.9.3)
       '@react-scan/vite-plugin-react-scan':
         specifier: ^0.1.8
-        version: 0.1.8(react-scan@0.4.3(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react-router-dom@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react-router@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react@19.1.1)(rollup@2.79.2))(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+        version: 0.1.8(react-scan@0.4.3(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react-router-dom@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react-router@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react@19.1.1)(rollup@2.79.2))(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@rollup/plugin-terser':
         specifier: ^0.4.4
         version: 0.4.4(rollup@2.79.2)
@@ -712,38 +712,38 @@ importers:
         specifier: ^3.6.1
         version: 3.6.1
       '@storybook/addon-a11y':
-        specifier: ^9.1.8
-        version: 9.1.8(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))
+        specifier: ^9.1.10
+        version: 9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
       '@storybook/addon-docs':
-        specifier: ^9.1.8
-        version: 9.1.8(@types/react@19.1.13)(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))
+        specifier: ^9.1.10
+        version: 9.1.10(@types/react@19.1.16)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
       '@storybook/addon-vitest':
-        specifier: ^9.1.8
-        version: 9.1.8(@vitest/browser@3.2.4)(@vitest/runner@3.2.4)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))(vitest@3.2.4)
+        specifier: ^9.1.10
+        version: 9.1.10(@vitest/browser@3.2.4)(@vitest/runner@3.2.4)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(vitest@3.2.4)
       '@storybook/react-vite':
-        specifier: ^9.1.8
-        version: 9.1.8(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(rollup@2.79.2)(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))(typescript@5.9.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+        specifier: ^9.1.10
+        version: 9.1.10(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(rollup@2.79.2)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(typescript@5.9.3)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@tailwindcss/vite':
         specifier: ^4.1.13
-        version: 4.1.13(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+        version: 4.1.13(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@tanstack/router-core':
-        specifier: ^1.132.6
-        version: 1.132.6
+        specifier: ^1.132.27
+        version: 1.132.27
       '@tanstack/router-plugin':
-        specifier: ^1.132.6
-        version: 1.132.6(@tanstack/react-router@1.132.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+        specifier: ^1.132.27
+        version: 1.132.27(@tanstack/react-router@1.132.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@types/canvas-confetti':
         specifier: ^1.9.0
         version: 1.9.0
       '@types/node':
-        specifier: ^24.5.2
-        version: 24.5.2
+        specifier: ^24.6.1
+        version: 24.6.1
       '@types/react':
-        specifier: ^19.1.13
-        version: 19.1.13
+        specifier: ^19.1.16
+        version: 19.1.16
       '@types/react-dom':
         specifier: ^19.1.9
-        version: 19.1.9(@types/react@19.1.13)
+        version: 19.1.9(@types/react@19.1.16)
       '@types/zxcvbn':
         specifier: ^4.4.5
         version: 4.4.5
@@ -752,13 +752,13 @@ importers:
         version: 7.0.0-dev.20250910.1
       '@vitejs/plugin-basic-ssl':
         specifier: ^2.1.0
-        version: 2.1.0(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+        version: 2.1.0(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@vitejs/plugin-react':
-        specifier: ^5.0.3
-        version: 5.0.3(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+        specifier: ^5.0.4
+        version: 5.0.4(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@vitest/browser':
         specifier: ^3.2.4
-        version: 3.2.4(playwright@1.55.1)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))(vitest@3.2.4)
+        version: 3.2.4(playwright@1.55.1)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)
       '@vitest/coverage-v8':
         specifier: ^3.2.4
         version: 3.2.4(@vitest/browser@3.2.4)(vitest@3.2.4)
@@ -766,8 +766,8 @@ importers:
         specifier: 19.1.0-rc.3
         version: 19.1.0-rc.3
       cross-env:
-        specifier: ^10.0.0
-        version: 10.0.0
+        specifier: ^10.1.0
+        version: 10.1.0
       hono:
         specifier: 4.9.8
         version: 4.9.8
@@ -779,34 +779,34 @@ importers:
         version: 3.4.7
       react-scan:
         specifier: ^0.4.3
-        version: 0.4.3(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react-router-dom@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react-router@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react@19.1.1)(rollup@2.79.2)
+        version: 0.4.3(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react-router-dom@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react-router@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react@19.1.1)(rollup@2.79.2)
       rollup-plugin-visualizer:
         specifier: ^6.0.3
         version: 6.0.3(rollup@2.79.2)
       storybook:
-        specifier: ^9.1.8
-        version: 9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+        specifier: ^9.1.10
+        version: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       tsx:
-        specifier: ^4.20.5
-        version: 4.20.5
+        specifier: ^4.20.6
+        version: 4.20.6
       typescript:
-        specifier: ^5.9.2
-        version: 5.9.2
+        specifier: ^5.9.3
+        version: 5.9.3
       vite:
         specifier: ^7.1.7
-        version: 7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
+        version: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
       vite-plugin-html:
         specifier: ^3.2.2
-        version: 3.2.2(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+        version: 3.2.2(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       vite-plugin-pwa:
         specifier: ^1.0.3
-        version: 1.0.3(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))(workbox-build@7.3.0(@types/babel__core@7.20.5))(workbox-window@7.3.0)
+        version: 1.0.3(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(workbox-build@7.3.0(@types/babel__core@7.20.5))(workbox-window@7.3.0)
       vite-plugin-static-copy:
-        specifier: ^3.1.2
-        version: 3.1.2(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+        specifier: ^3.1.3
+        version: 3.1.3(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       vite-tsconfig-paths:
         specifier: ^5.1.4
-        version: 5.1.4(typescript@5.9.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+        version: 5.1.4(typescript@5.9.3)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       wait-on:
         specifier: ^8.0.5
         version: 8.0.5
@@ -946,6 +946,7 @@ packages:
   '@aws-sdk/lib-storage@3.896.0':
     resolution: {integrity: sha512-EJWXL/5LxBJFujsOud3+EfRbIwy/SZiWy5ld70RdoqLS/RsfZh9+mZMJGvd3hewy7xHgDYVbxZfDh14bsvfYIQ==}
     engines: {node: '>=18.0.0'}
+    deprecated: This version ignores user provided partSize. Please update to >=3.899.0. Details https://github.com/aws/aws-sdk-js-v3/issues/7379
     peerDependencies:
       '@aws-sdk/client-s3': ^3.896.0
 
@@ -2665,8 +2666,8 @@ packages:
     resolution: {integrity: sha512-d9zaMRSTIKDLhctzH12MtXvJKSSUhaHcjV+2Z+GK+EEY7XKpP5yR4x+N3TAcHTcu963nIr+TMcCb4DBCYX1z6Q==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
 
-  '@evilmartians/lefthook@1.13.3':
-    resolution: {integrity: sha512-vYJcf3jZq7MfSlOZzkgnP5bfVMYRW7qETiiGZ/vDkZCzcGV9hLGSic882JSh2dyAX2azfvIW5Tbq/RSHL9i7mw==}
+  '@evilmartians/lefthook@1.13.6':
+    resolution: {integrity: sha512-79vplrUBWL4Fkt59YkEBdSpqBVhNrY8t5+jEp+wX5QbsmbQLcSULqwS7FmbNRyECa2LWMrUWpe6ENIfNwB4jiw==}
     cpu: [x64, arm64, ia32]
     os: [darwin, linux, win32]
     hasBin: true
@@ -2747,8 +2748,8 @@ packages:
     resolution: {integrity: sha512-+5eg9pgAAM9oSqJQuUtfTKbLz8yieFKN91myyXiLnprqFj8ROfxUKJLr9DKq/hGKyybKT1WxFSetDqCFm80pCA==}
     engines: {node: '>= 16'}
 
-  '@hey-api/openapi-ts@0.84.3':
-    resolution: {integrity: sha512-WFjGGBzmIzGRdHw+CC7g8TSzl4UjdWbNwiDO07a3BUEhSBZbLGidfh+E4SOGbePak6sWptVh9WqO3QrThFH25A==}
+  '@hey-api/openapi-ts@0.84.4':
+    resolution: {integrity: sha512-yKR/KFQVCoAbvkpRM13uYxMUyZl3whwEY8Nj4X9Yra18dWpfzmdTyTxP8KtYzdfNMC9xIw4TAgK5+1FJctENBw==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=22.10.0}
     hasBin: true
     peerDependencies:
@@ -3562,98 +3563,98 @@ packages:
   '@oslojs/webauthn@1.0.0':
     resolution: {integrity: sha512-2ZRpbt3msNURwvjmavzq9vrNlxUnWFBGMYqbC1kO3fYBLskL7r4DiLJT1wbtLoI+hclFwjhl48YhRFBl6RWg1A==}
 
-  '@oxc-resolver/binding-android-arm-eabi@11.8.2':
-    resolution: {integrity: sha512-7hykBf8S24IRbO4ueulT9SfYQjTeSOOimKc/CQrWXIWQy1WTePXSNcPq2RkVHO7DdLM8p8X4DVPYy+850Bo93g==}
+  '@oxc-resolver/binding-android-arm-eabi@11.8.4':
+    resolution: {integrity: sha512-6BjMji0TcvQfJ4EoSunOSyu/SiyHKficBD0V3Y0NxF0beaNnnZ7GYEi2lHmRNnRCuIPK8IuVqQ6XizYau+CkKw==}
     cpu: [arm]
     os: [android]
 
-  '@oxc-resolver/binding-android-arm64@11.8.2':
-    resolution: {integrity: sha512-y41bxENMjlFuLSLCPWd4A+1PR7T5rU9+e7+4alje3sHgrpRmS3hIU+b1Cvck4qmcUgd0I98NmYxRM65kXGEObQ==}
+  '@oxc-resolver/binding-android-arm64@11.8.4':
+    resolution: {integrity: sha512-SxF4X6rzCBS9XNPXKZGoIHIABjfGmtQpEgRBDzpDHx5VTuLAUmwLTHXnVBAZoX5bmnhF79RiMElavzFdJ2cA1A==}
     cpu: [arm64]
     os: [android]
 
-  '@oxc-resolver/binding-darwin-arm64@11.8.2':
-    resolution: {integrity: sha512-P/Zobk9OwQAblAMeiVyOtuX2LjGN8oq5HonvN3mp9S6Kx1GKxREbf5qW+g24Rvhf5WS7et+EmopUGRHSdAItGQ==}
+  '@oxc-resolver/binding-darwin-arm64@11.8.4':
+    resolution: {integrity: sha512-8zWeERrzgscAniE6kh1TQ4E7GJyglYsvdoKrHYLBCbHWD+0/soffiwAYxZuckKEQSc2RXMSPjcu+JTCALaY0Dw==}
     cpu: [arm64]
     os: [darwin]
 
-  '@oxc-resolver/binding-darwin-x64@11.8.2':
-    resolution: {integrity: sha512-EMAQoO9uTiz2H0z71bVzTL77eoBAlN5+KD7HUc9ayYJ5TprU+Oeaml4y4fmsFyspSPN/vGJzEvOWl5GR0adwtw==}
+  '@oxc-resolver/binding-darwin-x64@11.8.4':
+    resolution: {integrity: sha512-BUwggKz8Hi5uEQ0AeVTSun1+sp4lzNcItn+L7fDsHu5Cx0Zueuo10BtVm+dIwmYVVPL5oGYOeD0fS7MKAazKiw==}
     cpu: [x64]
     os: [darwin]
 
-  '@oxc-resolver/binding-freebsd-x64@11.8.2':
-    resolution: {integrity: sha512-Fzeupf4tH9woMm6O/pirEtuzO5docwTrs747Nxqh33OSkz7GbrevyDpx1Q1pc2l3JA2BlDX4zm18tW5ys65bjA==}
+  '@oxc-resolver/binding-freebsd-x64@11.8.4':
+    resolution: {integrity: sha512-fPO5TQhnn8gA6yP4o49lc4Gn8KeDwAp9uYd4PlE3Q00JVqU6cY9WecDhYHrWtiFcyoZ8UVBlIxuhRqT/DP4Z4A==}
     cpu: [x64]
     os: [freebsd]
 
-  '@oxc-resolver/binding-linux-arm-gnueabihf@11.8.2':
-    resolution: {integrity: sha512-r9IiPTwc5STC2JahU/rfkbO2BE14MqAVmFbtF7uW7KFaZX/lUnFltkQ5jpwAgKqcef5aIZTJI95qJ03XZw08Rg==}
+  '@oxc-resolver/binding-linux-arm-gnueabihf@11.8.4':
+    resolution: {integrity: sha512-QuNbdUaVGiP0W0GrXsvCDZjqeL4lZGU7aXlx/S2tCvyTk3wh6skoiLJgqUf/eeqXfUPnzTfntYqyfolzCAyBYA==}
     cpu: [arm]
     os: [linux]
 
-  '@oxc-resolver/binding-linux-arm-musleabihf@11.8.2':
-    resolution: {integrity: sha512-Q5D8FbxOyQYcWn5s9yv+DyFvcMSUXE87hmL9WG6ICdNZiMUA8DmIbzK1xEnOtDjorEFU44bwH3I9SnqL1kyOsg==}
+  '@oxc-resolver/binding-linux-arm-musleabihf@11.8.4':
+    resolution: {integrity: sha512-p/zLMfza8OsC4BDKxqeZ9Qel+4eA/oiMSyKLRkMrTgt6OWQq1d5nHntjfG35Abcw4ev6Q9lRU3NOW5hj0xlUbw==}
     cpu: [arm]
     os: [linux]
 
-  '@oxc-resolver/binding-linux-arm64-gnu@11.8.2':
-    resolution: {integrity: sha512-8g2Y72gavZ8fesZD22cKo0Z8g8epynwShu7M+wpAoOq432IGUyUxPUKB2/nvyogPToaAlb1OsRiX/za8W4h8Aw==}
+  '@oxc-resolver/binding-linux-arm64-gnu@11.8.4':
+    resolution: {integrity: sha512-bvJF9wWxF1+a5YZATlS5JojpOMC7OsnTatA6sXVHoOb7MIigjledYB5ZMAeRrnWWexRMiEX3YSaA46oSfOzmOg==}
     cpu: [arm64]
     os: [linux]
 
-  '@oxc-resolver/binding-linux-arm64-musl@11.8.2':
-    resolution: {integrity: sha512-N3BPWnIDRmHn/xPDZGKnzFwWxwH1hvs3aVnw4jvMAYarPNDZfbAY+fjHSIwkypV+ozMoJ5lK5PzRO5BOtEx2oQ==}
+  '@oxc-resolver/binding-linux-arm64-musl@11.8.4':
+    resolution: {integrity: sha512-gf4nwGBfu+EFwOn5p7/T7VF4jmIdfodwJS9MRkOBHvuAm3LQgCX7O6d3Y80mm0TV7ZMRD/trfW628rHfd5++vQ==}
     cpu: [arm64]
     os: [linux]
 
-  '@oxc-resolver/binding-linux-ppc64-gnu@11.8.2':
-    resolution: {integrity: sha512-AXW2AyjENmzNuZD3Z2TO1QWoZzfULWR1otDzw/+MAVMRXBy3W50XxDqNAflRiLB4o0aI0oDTwMfeyuhVv9Ur8Q==}
+  '@oxc-resolver/binding-linux-ppc64-gnu@11.8.4':
+    resolution: {integrity: sha512-T120R5GIzRd41rYWWKCI6cSYrZjmRQzf3X4xeE1WX396Uabz5DX8KU7RnVHihSK+KDxccCVOFBxcH3ITd+IEpw==}
     cpu: [ppc64]
     os: [linux]
 
-  '@oxc-resolver/binding-linux-riscv64-gnu@11.8.2':
-    resolution: {integrity: sha512-oX+qxJdqOfrJUkGWmcNpu7wiFs6E7KH6hqUORkMAgl4yW+LZxPTz5P4DHvTqTFMywbs9hXVu2KQrdD8ROrdhMQ==}
+  '@oxc-resolver/binding-linux-riscv64-gnu@11.8.4':
+    resolution: {integrity: sha512-PVG7SxBFFjAaQ76p9O/0Xt5mTBlziRwpck+6cRNhy/hbWY/hSt8BFfPqw0EDSfnl40Uuh+NPsHFMnaWWyxbQEg==}
     cpu: [riscv64]
     os: [linux]
 
-  '@oxc-resolver/binding-linux-riscv64-musl@11.8.2':
-    resolution: {integrity: sha512-TG7LpxXjqlpD1aWnAXw6vMgY74KNV92exPixzEj4AKm4LdGsfnSWYTTJcTQ7deFMYxvBGrZ+qEy8DjGx+5w9GQ==}
+  '@oxc-resolver/binding-linux-riscv64-musl@11.8.4':
+    resolution: {integrity: sha512-L0OklUhM2qLGaKvPSyKmwWpoijfc++VJtPyVgz031ShOXyo0WjD0ZGzusyJMsA1a/gdulAmN6CQ/0Sf4LGXEcw==}
     cpu: [riscv64]
     os: [linux]
 
-  '@oxc-resolver/binding-linux-s390x-gnu@11.8.2':
-    resolution: {integrity: sha512-1PpXMq0KMD3CQPn3v/UqU4NM2JFjry+mLIH1d3iNVL2vlwRt9lxRfpXTiyiFJrtroUIyeKhw0QbHbF2UfnZVKQ==}
+  '@oxc-resolver/binding-linux-s390x-gnu@11.8.4':
+    resolution: {integrity: sha512-18Ajz5hqO4cRGuoHzLFUsIPod9GIaIRDiXFg2m6CS3NgVdHx7iCZscplYH7KtjdE42M8nGWYMyyq5BOk7QVgPw==}
     cpu: [s390x]
     os: [linux]
 
-  '@oxc-resolver/binding-linux-x64-gnu@11.8.2':
-    resolution: {integrity: sha512-V1iYhEDbjQzj+o7JgTYVllRgNZ56Tjw0rPBWw03KJQ8Nphy00Vf7AySf22vV0K/93V1lPCgOSbI5/iunRnIfAw==}
+  '@oxc-resolver/binding-linux-x64-gnu@11.8.4':
+    resolution: {integrity: sha512-uHvH4RyYBdQ/lFGV9H+R1ScHg6EBnAhE3mnX+u+mO/btnalvg7j80okuHf8Qw0tLQiP5P1sEBoVeE6zviXY9IA==}
     cpu: [x64]
     os: [linux]
 
-  '@oxc-resolver/binding-linux-x64-musl@11.8.2':
-    resolution: {integrity: sha512-2hYNXEZSUM7qLEk4uuY3GmMqLU+860v+8PzbloVvRRjTWtHsLZyB5w+5p2gel38eaTcSYfZ2zvp3xcSpKDAbaw==}
+  '@oxc-resolver/binding-linux-x64-musl@11.8.4':
+    resolution: {integrity: sha512-X5z44qh5DdJfVhcqXAQFTDFUpcxdpf6DT/lHL5CFcdQGIZxatjc7gFUy05IXPI9xwfq39RValjJBvFovUk9XBw==}
     cpu: [x64]
     os: [linux]
 
-  '@oxc-resolver/binding-wasm32-wasi@11.8.2':
-    resolution: {integrity: sha512-TjFqB+1siSqhd+S64Hf2qbxqWqtFIlld4DDEVotxOjj5//rX/6uwAL1HWnUHSNIni+wpcyQoXPhO3fBgppCvuA==}
+  '@oxc-resolver/binding-wasm32-wasi@11.8.4':
+    resolution: {integrity: sha512-z3906y+cd8RRhBGNwHRrRAFxnKjXsBeL3+rdQjZpBrUyrhhsaV5iKD/ROx64FNJ9GjL/9mfon8A5xx/McYIqHA==}
     engines: {node: '>=14.0.0'}
     cpu: [wasm32]
 
-  '@oxc-resolver/binding-win32-arm64-msvc@11.8.2':
-    resolution: {integrity: sha512-fs0X6RcAC/khWbXIhPaYQjFHkrFVUtC2IOw1QEx2unRoe6M11tlYbY9NHr3VFBC3nwVpodX+b14A7jGMkAQK8A==}
+  '@oxc-resolver/binding-win32-arm64-msvc@11.8.4':
+    resolution: {integrity: sha512-70vXFs74uA3X5iYOkpclbkWlQEF+MI325uAQ+Or2n8HJip2T0SEmuBlyw/sRL2E8zLC4oocb+1g25fmzlDVkmg==}
     cpu: [arm64]
     os: [win32]
 
-  '@oxc-resolver/binding-win32-ia32-msvc@11.8.2':
-    resolution: {integrity: sha512-7oEl1ThswVePprRQFc3tzW9IZgVi5xaus/KP3k56eKi2tYpAM0hBvehD8WBsmpgBEb7pe2pI08h9OZveAddt3Q==}
+  '@oxc-resolver/binding-win32-ia32-msvc@11.8.4':
+    resolution: {integrity: sha512-SEOUAzTvr+nyMia3nx1dMtD7YUxZwuhQ3QAPnxy21261Lj0yT3JY4EIfwWH54lAWWfMdRSRRMFuGeF/dq7XjEw==}
     cpu: [ia32]
     os: [win32]
 
-  '@oxc-resolver/binding-win32-x64-msvc@11.8.2':
-    resolution: {integrity: sha512-MngRjE/gpQpg3QcnWRqxX5Nbr/vZJSG7oxhXeHUeOhdFgg+0xCuGpDtwqFmGGVKnd6FQg0gKVo1MqDAERLkEPA==}
+  '@oxc-resolver/binding-win32-x64-msvc@11.8.4':
+    resolution: {integrity: sha512-1gARIQsOPOU7LJ7jvMyPmZEVMapL/PymeG3J7naOdLZDrIZKX6CTvgawJmETYKt+8icP8M6KbBinrVkKVqFd+A==}
     cpu: [x64]
     os: [win32]
 
@@ -4717,8 +4718,8 @@ packages:
   '@rolldown/pluginutils@1.0.0-beta.27':
     resolution: {integrity: sha512-+d0F4MKMCbeVUJwG96uQ4SgAznZNSq93I3V+9NHA4OpvqG8mRCpGdKmK8l/dl02h2CCDHwW2FqilnTyDcAnqjA==}
 
-  '@rolldown/pluginutils@1.0.0-beta.35':
-    resolution: {integrity: sha512-slYrCpoxJUqzFDDNlvrOYRazQUNRvWPjXA17dAOISY3rDMxX6k8K4cj2H+hEYMHF81HO3uNd5rHVigAWRM5dSg==}
+  '@rolldown/pluginutils@1.0.0-beta.38':
+    resolution: {integrity: sha512-N/ICGKleNhA5nc9XXQG/kkKHJ7S55u0x0XUJbbkmdCnFuoRkM1Il12q9q0eX19+M7KKUEPw/daUPIRnxhcxAIw==}
 
   '@rollup/plugin-babel@5.3.1':
     resolution: {integrity: sha512-WFfdLWU/xVWKeRQnKmIAQULUI7Il0gZnBIH/ZFO069wYIfPu+8zrfp/KMW0atmELoRDq8FbiP3VCss9MhCut7Q==}
@@ -4778,111 +4779,221 @@ packages:
     cpu: [arm]
     os: [android]
 
+  '@rollup/rollup-android-arm-eabi@4.52.3':
+    resolution: {integrity: sha512-h6cqHGZ6VdnwliFG1NXvMPTy/9PS3h8oLh7ImwR+kl+oYnQizgjxsONmmPSb2C66RksfkfIxEVtDSEcJiO0tqw==}
+    cpu: [arm]
+    os: [android]
+
   '@rollup/rollup-android-arm64@4.52.2':
     resolution: {integrity: sha512-cqFSWO5tX2vhC9hJTK8WAiPIm4Q8q/cU8j2HQA0L3E1uXvBYbOZMhE2oFL8n2pKB5sOCHY6bBuHaRwG7TkfJyw==}
     cpu: [arm64]
     os: [android]
 
+  '@rollup/rollup-android-arm64@4.52.3':
+    resolution: {integrity: sha512-wd+u7SLT/u6knklV/ifG7gr5Qy4GUbH2hMWcDauPFJzmCZUAJ8L2bTkVXC2niOIxp8lk3iH/QX8kSrUxVZrOVw==}
+    cpu: [arm64]
+    os: [android]
+
   '@rollup/rollup-darwin-arm64@4.52.2':
     resolution: {integrity: sha512-vngduywkkv8Fkh3wIZf5nFPXzWsNsVu1kvtLETWxTFf/5opZmflgVSeLgdHR56RQh71xhPhWoOkEBvbehwTlVA==}
     cpu: [arm64]
     os: [darwin]
 
+  '@rollup/rollup-darwin-arm64@4.52.3':
+    resolution: {integrity: sha512-lj9ViATR1SsqycwFkJCtYfQTheBdvlWJqzqxwc9f2qrcVrQaF/gCuBRTiTolkRWS6KvNxSk4KHZWG7tDktLgjg==}
+    cpu: [arm64]
+    os: [darwin]
+
   '@rollup/rollup-darwin-x64@4.52.2':
     resolution: {integrity: sha512-h11KikYrUCYTrDj6h939hhMNlqU2fo/X4NB0OZcys3fya49o1hmFaczAiJWVAFgrM1NCP6RrO7lQKeVYSKBPSQ==}
     cpu: [x64]
     os: [darwin]
 
+  '@rollup/rollup-darwin-x64@4.52.3':
+    resolution: {integrity: sha512-+Dyo7O1KUmIsbzx1l+4V4tvEVnVQqMOIYtrxK7ncLSknl1xnMHLgn7gddJVrYPNZfEB8CIi3hK8gq8bDhb3h5A==}
+    cpu: [x64]
+    os: [darwin]
+
   '@rollup/rollup-freebsd-arm64@4.52.2':
     resolution: {integrity: sha512-/eg4CI61ZUkLXxMHyVlmlGrSQZ34xqWlZNW43IAU4RmdzWEx0mQJ2mN/Cx4IHLVZFL6UBGAh+/GXhgvGb+nVxw==}
     cpu: [arm64]
     os: [freebsd]
 
+  '@rollup/rollup-freebsd-arm64@4.52.3':
+    resolution: {integrity: sha512-u9Xg2FavYbD30g3DSfNhxgNrxhi6xVG4Y6i9Ur1C7xUuGDW3banRbXj+qgnIrwRN4KeJ396jchwy9bCIzbyBEQ==}
+    cpu: [arm64]
+    os: [freebsd]
+
   '@rollup/rollup-freebsd-x64@4.52.2':
     resolution: {integrity: sha512-QOWgFH5X9+p+S1NAfOqc0z8qEpJIoUHf7OWjNUGOeW18Mx22lAUOiA9b6r2/vpzLdfxi/f+VWsYjUOMCcYh0Ng==}
     cpu: [x64]
     os: [freebsd]
 
+  '@rollup/rollup-freebsd-x64@4.52.3':
+    resolution: {integrity: sha512-5M8kyi/OX96wtD5qJR89a/3x5x8x5inXBZO04JWhkQb2JWavOWfjgkdvUqibGJeNNaz1/Z1PPza5/tAPXICI6A==}
+    cpu: [x64]
+    os: [freebsd]
+
   '@rollup/rollup-linux-arm-gnueabihf@4.52.2':
     resolution: {integrity: sha512-kDWSPafToDd8LcBYd1t5jw7bD5Ojcu12S3uT372e5HKPzQt532vW+rGFFOaiR0opxePyUkHrwz8iWYEyH1IIQA==}
     cpu: [arm]
     os: [linux]
 
+  '@rollup/rollup-linux-arm-gnueabihf@4.52.3':
+    resolution: {integrity: sha512-IoerZJ4l1wRMopEHRKOO16e04iXRDyZFZnNZKrWeNquh5d6bucjezgd+OxG03mOMTnS1x7hilzb3uURPkJ0OfA==}
+    cpu: [arm]
+    os: [linux]
+
   '@rollup/rollup-linux-arm-musleabihf@4.52.2':
     resolution: {integrity: sha512-gKm7Mk9wCv6/rkzwCiUC4KnevYhlf8ztBrDRT9g/u//1fZLapSRc+eDZj2Eu2wpJ+0RzUKgtNijnVIB4ZxyL+w==}
     cpu: [arm]
     os: [linux]
 
+  '@rollup/rollup-linux-arm-musleabihf@4.52.3':
+    resolution: {integrity: sha512-ZYdtqgHTDfvrJHSh3W22TvjWxwOgc3ThK/XjgcNGP2DIwFIPeAPNsQxrJO5XqleSlgDux2VAoWQ5iJrtaC1TbA==}
+    cpu: [arm]
+    os: [linux]
+
   '@rollup/rollup-linux-arm64-gnu@4.52.2':
     resolution: {integrity: sha512-66lA8vnj5mB/rtDNwPgrrKUOtCLVQypkyDa2gMfOefXK6rcZAxKLO9Fy3GkW8VkPnENv9hBkNOFfGLf6rNKGUg==}
     cpu: [arm64]
     os: [linux]
 
+  '@rollup/rollup-linux-arm64-gnu@4.52.3':
+    resolution: {integrity: sha512-NcViG7A0YtuFDA6xWSgmFb6iPFzHlf5vcqb2p0lGEbT+gjrEEz8nC/EeDHvx6mnGXnGCC1SeVV+8u+smj0CeGQ==}
+    cpu: [arm64]
+    os: [linux]
+
   '@rollup/rollup-linux-arm64-musl@4.52.2':
     resolution: {integrity: sha512-s+OPucLNdJHvuZHuIz2WwncJ+SfWHFEmlC5nKMUgAelUeBUnlB4wt7rXWiyG4Zn07uY2Dd+SGyVa9oyLkVGOjA==}
     cpu: [arm64]
     os: [linux]
 
+  '@rollup/rollup-linux-arm64-musl@4.52.3':
+    resolution: {integrity: sha512-d3pY7LWno6SYNXRm6Ebsq0DJGoiLXTb83AIPCXl9fmtIQs/rXoS8SJxxUNtFbJ5MiOvs+7y34np77+9l4nfFMw==}
+    cpu: [arm64]
+    os: [linux]
+
   '@rollup/rollup-linux-loong64-gnu@4.52.2':
     resolution: {integrity: sha512-8wTRM3+gVMDLLDdaT6tKmOE3lJyRy9NpJUS/ZRWmLCmOPIJhVyXwjBo+XbrrwtV33Em1/eCTd5TuGJm4+DmYjw==}
     cpu: [loong64]
     os: [linux]
 
+  '@rollup/rollup-linux-loong64-gnu@4.52.3':
+    resolution: {integrity: sha512-3y5GA0JkBuirLqmjwAKwB0keDlI6JfGYduMlJD/Rl7fvb4Ni8iKdQs1eiunMZJhwDWdCvrcqXRY++VEBbvk6Eg==}
+    cpu: [loong64]
+    os: [linux]
+
   '@rollup/rollup-linux-ppc64-gnu@4.52.2':
     resolution: {integrity: sha512-6yqEfgJ1anIeuP2P/zhtfBlDpXUb80t8DpbYwXQ3bQd95JMvUaqiX+fKqYqUwZXqdJDd8xdilNtsHM2N0cFm6A==}
     cpu: [ppc64]
     os: [linux]
 
+  '@rollup/rollup-linux-ppc64-gnu@4.52.3':
+    resolution: {integrity: sha512-AUUH65a0p3Q0Yfm5oD2KVgzTKgwPyp9DSXc3UA7DtxhEb/WSPfbG4wqXeSN62OG5gSo18em4xv6dbfcUGXcagw==}
+    cpu: [ppc64]
+    os: [linux]
+
   '@rollup/rollup-linux-riscv64-gnu@4.52.2':
     resolution: {integrity: sha512-sshYUiYVSEI2B6dp4jMncwxbrUqRdNApF2c3bhtLAU0qA8Lrri0p0NauOsTWh3yCCCDyBOjESHMExonp7Nzc0w==}
     cpu: [riscv64]
     os: [linux]
 
+  '@rollup/rollup-linux-riscv64-gnu@4.52.3':
+    resolution: {integrity: sha512-1makPhFFVBqZE+XFg3Dkq+IkQ7JvmUrwwqaYBL2CE+ZpxPaqkGaiWFEWVGyvTwZace6WLJHwjVh/+CXbKDGPmg==}
+    cpu: [riscv64]
+    os: [linux]
+
   '@rollup/rollup-linux-riscv64-musl@4.52.2':
     resolution: {integrity: sha512-duBLgd+3pqC4MMwBrKkFxaZerUxZcYApQVC5SdbF5/e/589GwVvlRUnyqMFbM8iUSb1BaoX/3fRL7hB9m2Pj8Q==}
     cpu: [riscv64]
     os: [linux]
 
+  '@rollup/rollup-linux-riscv64-musl@4.52.3':
+    resolution: {integrity: sha512-OOFJa28dxfl8kLOPMUOQBCO6z3X2SAfzIE276fwT52uXDWUS178KWq0pL7d6p1kz7pkzA0yQwtqL0dEPoVcRWg==}
+    cpu: [riscv64]
+    os: [linux]
+
   '@rollup/rollup-linux-s390x-gnu@4.52.2':
     resolution: {integrity: sha512-tzhYJJidDUVGMgVyE+PmxENPHlvvqm1KILjjZhB8/xHYqAGeizh3GBGf9u6WdJpZrz1aCpIIHG0LgJgH9rVjHQ==}
     cpu: [s390x]
     os: [linux]
 
+  '@rollup/rollup-linux-s390x-gnu@4.52.3':
+    resolution: {integrity: sha512-jMdsML2VI5l+V7cKfZx3ak+SLlJ8fKvLJ0Eoa4b9/vCUrzXKgoKxvHqvJ/mkWhFiyp88nCkM5S2v6nIwRtPcgg==}
+    cpu: [s390x]
+    os: [linux]
+
   '@rollup/rollup-linux-x64-gnu@4.52.2':
     resolution: {integrity: sha512-opH8GSUuVcCSSyHHcl5hELrmnk4waZoVpgn/4FDao9iyE4WpQhyWJ5ryl5M3ocp4qkRuHfyXnGqg8M9oKCEKRA==}
     cpu: [x64]
     os: [linux]
 
+  '@rollup/rollup-linux-x64-gnu@4.52.3':
+    resolution: {integrity: sha512-tPgGd6bY2M2LJTA1uGq8fkSPK8ZLYjDjY+ZLK9WHncCnfIz29LIXIqUgzCR0hIefzy6Hpbe8Th5WOSwTM8E7LA==}
+    cpu: [x64]
+    os: [linux]
+
   '@rollup/rollup-linux-x64-musl@4.52.2':
     resolution: {integrity: sha512-LSeBHnGli1pPKVJ79ZVJgeZWWZXkEe/5o8kcn23M8eMKCUANejchJbF/JqzM4RRjOJfNRhKJk8FuqL1GKjF5oQ==}
     cpu: [x64]
     os: [linux]
 
+  '@rollup/rollup-linux-x64-musl@4.52.3':
+    resolution: {integrity: sha512-BCFkJjgk+WFzP+tcSMXq77ymAPIxsX9lFJWs+2JzuZTLtksJ2o5hvgTdIcZ5+oKzUDMwI0PfWzRBYAydAHF2Mw==}
+    cpu: [x64]
+    os: [linux]
+
   '@rollup/rollup-openharmony-arm64@4.52.2':
     resolution: {integrity: sha512-uPj7MQ6/s+/GOpolavm6BPo+6CbhbKYyZHUDvZ/SmJM7pfDBgdGisFX3bY/CBDMg2ZO4utfhlApkSfZ92yXw7Q==}
     cpu: [arm64]
     os: [openharmony]
 
+  '@rollup/rollup-openharmony-arm64@4.52.3':
+    resolution: {integrity: sha512-KTD/EqjZF3yvRaWUJdD1cW+IQBk4fbQaHYJUmP8N4XoKFZilVL8cobFSTDnjTtxWJQ3JYaMgF4nObY/+nYkumA==}
+    cpu: [arm64]
+    os: [openharmony]
+
   '@rollup/rollup-win32-arm64-msvc@4.52.2':
     resolution: {integrity: sha512-Z9MUCrSgIaUeeHAiNkm3cQyst2UhzjPraR3gYYfOjAuZI7tcFRTOD+4cHLPoS/3qinchth+V56vtqz1Tv+6KPA==}
     cpu: [arm64]
     os: [win32]
 
+  '@rollup/rollup-win32-arm64-msvc@4.52.3':
+    resolution: {integrity: sha512-+zteHZdoUYLkyYKObGHieibUFLbttX2r+58l27XZauq0tcWYYuKUwY2wjeCN9oK1Um2YgH2ibd6cnX/wFD7DuA==}
+    cpu: [arm64]
+    os: [win32]
+
   '@rollup/rollup-win32-ia32-msvc@4.52.2':
     resolution: {integrity: sha512-+GnYBmpjldD3XQd+HMejo+0gJGwYIOfFeoBQv32xF/RUIvccUz20/V6Otdv+57NE70D5pa8W/jVGDoGq0oON4A==}
     cpu: [ia32]
     os: [win32]
 
+  '@rollup/rollup-win32-ia32-msvc@4.52.3':
+    resolution: {integrity: sha512-of1iHkTQSo3kr6dTIRX6t81uj/c/b15HXVsPcEElN5sS859qHrOepM5p9G41Hah+CTqSh2r8Bm56dL2z9UQQ7g==}
+    cpu: [ia32]
+    os: [win32]
+
   '@rollup/rollup-win32-x64-gnu@4.52.2':
     resolution: {integrity: sha512-ApXFKluSB6kDQkAqZOKXBjiaqdF1BlKi+/eqnYe9Ee7U2K3pUDKsIyr8EYm/QDHTJIM+4X+lI0gJc3TTRhd+dA==}
     cpu: [x64]
     os: [win32]
 
+  '@rollup/rollup-win32-x64-gnu@4.52.3':
+    resolution: {integrity: sha512-s0hybmlHb56mWVZQj8ra9048/WZTPLILKxcvcq+8awSZmyiSUZjjem1AhU3Tf4ZKpYhK4mg36HtHDOe8QJS5PQ==}
+    cpu: [x64]
+    os: [win32]
+
   '@rollup/rollup-win32-x64-msvc@4.52.2':
     resolution: {integrity: sha512-ARz+Bs8kY6FtitYM96PqPEVvPXqEZmPZsSkXvyX19YzDqkCaIlhCieLLMI5hxO9SRZ2XtCtm8wxhy0iJ2jxNfw==}
     cpu: [x64]
     os: [win32]
 
+  '@rollup/rollup-win32-x64-msvc@4.52.3':
+    resolution: {integrity: sha512-zGIbEVVXVtauFgl3MRwGWEN36P5ZGenHRMgNw88X5wEhEBpq0XrMEZwOn07+ICrwM17XO5xfMZqh0OldCH5VTA==}
+    cpu: [x64]
+    os: [win32]
+
   '@rrweb/record@2.0.0-alpha.18':
     resolution: {integrity: sha512-WbzcybTEqT+cKkOnzYiyaAYvNzAIxTK9f8qNLNOG9lOqWsmi+qu/W7CEdxHmfjlfgXGw/f7bxGZggAWVaizKqg==}
 
@@ -4962,53 +5073,105 @@ packages:
     engines: {node: '>=10'}
     os: [darwin]
 
+  '@sentry/cli-darwin@2.56.0':
+    resolution: {integrity: sha512-CzXFWbv3GrjU0gFlUM9jt0fvJmyo5ktty4HGxRFfS/eMC6xW58Gg/sEeMVEkdvk5osKooX/YEgfLBdo4zvuWDA==}
+    engines: {node: '>=10'}
+    os: [darwin]
+
   '@sentry/cli-linux-arm64@2.55.0':
     resolution: {integrity: sha512-jNB/0/gFcOuDCaY/TqeuEpsy/k52dwyk1SOV3s1ku4DUsln6govTppeAGRewY3T1Rj9B2vgIWTrnB8KVh9+Rgg==}
     engines: {node: '>=10'}
     cpu: [arm64]
     os: [linux, freebsd, android]
 
+  '@sentry/cli-linux-arm64@2.56.0':
+    resolution: {integrity: sha512-91d5ZlC989j/t+TXor/glPyx6SnLFS/SlJ9fIrHIQohdGKyWWSFb4VKUan8Ok3GYu9SUzKTMByryIOoYEmeGVw==}
+    engines: {node: '>=10'}
+    cpu: [arm64]
+    os: [linux, freebsd, android]
+
   '@sentry/cli-linux-arm@2.55.0':
     resolution: {integrity: sha512-ATjU0PsiWADSPLF/kZroLZ7FPKd5W9TDWHVkKNwIUNTei702LFgTjNeRwOIzTgSvG3yTmVEqtwFQfFN/7hnVXQ==}
     engines: {node: '>=10'}
     cpu: [arm]
     os: [linux, freebsd, android]
 
+  '@sentry/cli-linux-arm@2.56.0':
+    resolution: {integrity: sha512-vQCCMhZLugPmr25XBoP94dpQsFa110qK5SBUVJcRpJKyzMZd+6ueeHNslq2mB0OF4BwL1qd/ZDIa4nxa1+0rjQ==}
+    engines: {node: '>=10'}
+    cpu: [arm]
+    os: [linux, freebsd, android]
+
   '@sentry/cli-linux-i686@2.55.0':
     resolution: {integrity: sha512-8LZjo6PncTM6bWdaggscNOi5r7F/fqRREsCwvd51dcjGj7Kp1plqo9feEzYQ+jq+KUzVCiWfHrUjddFmYyZJrg==}
     engines: {node: '>=10'}
     cpu: [x86, ia32]
     os: [linux, freebsd, android]
 
+  '@sentry/cli-linux-i686@2.56.0':
+    resolution: {integrity: sha512-MZzXuq1Q/TktN81DUs6XSBU752pG3XWSJdZR+NCStIg3l8s3O/Pwh6OcDHTYqgwsYJaGBpA0fP2Afl5XeSAUNg==}
+    engines: {node: '>=10'}
+    cpu: [x86, ia32]
+    os: [linux, freebsd, android]
+
   '@sentry/cli-linux-x64@2.55.0':
     resolution: {integrity: sha512-5LUVvq74Yj2cZZy5g5o/54dcWEaX4rf3myTHy73AKhRj1PABtOkfexOLbF9xSrZy95WXWaXyeH+k5n5z/vtHfA==}
     engines: {node: '>=10'}
     cpu: [x64]
     os: [linux, freebsd, android]
 
+  '@sentry/cli-linux-x64@2.56.0':
+    resolution: {integrity: sha512-INOO2OQ90Y3UzYgHRdrHdKC/0es3YSHLv0iNNgQwllL0YZihSVNYSSrZqcPq8oSDllEy9Vt9oOm/7qEnUP2Kfw==}
+    engines: {node: '>=10'}
+    cpu: [x64]
+    os: [linux, freebsd, android]
+
   '@sentry/cli-win32-arm64@2.55.0':
     resolution: {integrity: sha512-cWIQdzm1pfLwPARsV6dUb8TVd6Y3V1A2VWxjTons3Ift6GvtVmiAe0OWL8t2Yt95i8v61kTD/6Tq21OAaogqzA==}
     engines: {node: '>=10'}
     cpu: [arm64]
     os: [win32]
 
+  '@sentry/cli-win32-arm64@2.56.0':
+    resolution: {integrity: sha512-eUvkVk9KK01q6/qyugQPh7dAxqFPbgOa62QAoSwo11WQFYc3NPgJLilFWLQo+nahHGYKh6PKuCJ5tcqnQq5Hkg==}
+    engines: {node: '>=10'}
+    cpu: [arm64]
+    os: [win32]
+
   '@sentry/cli-win32-i686@2.55.0':
     resolution: {integrity: sha512-ldepCn2t9r4I0wvgk7NRaA7coJyy4rTQAzM66u9j5nTEsUldf66xym6esd5ZZRAaJUjffqvHqUIr/lrieTIrVg==}
     engines: {node: '>=10'}
     cpu: [x86, ia32]
     os: [win32]
 
+  '@sentry/cli-win32-i686@2.56.0':
+    resolution: {integrity: sha512-mpCA8hKXuvT17bl1H/54KOa5i+02VBBHVlOiP3ltyBuQUqfvX/30Zl/86Spy+ikodovZWAHv5e5FpyXbY1/mPw==}
+    engines: {node: '>=10'}
+    cpu: [x86, ia32]
+    os: [win32]
+
   '@sentry/cli-win32-x64@2.55.0':
     resolution: {integrity: sha512-4hPc/I/9tXx+HLTdTGwlagtAfDSIa2AoTUP30tl32NAYQhx9a6niUbPAemK2qfxesiufJ7D2djX83rCw6WnJVA==}
     engines: {node: '>=10'}
     cpu: [x64]
     os: [win32]
 
+  '@sentry/cli-win32-x64@2.56.0':
+    resolution: {integrity: sha512-UV0pXNls+/ViAU/3XsHLLNEHCsRYaGEwJdY3HyGIufSlglxrX6BVApkV9ziGi4WAxcJWLjQdfcEs6V5B+wBy0A==}
+    engines: {node: '>=10'}
+    cpu: [x64]
+    os: [win32]
+
   '@sentry/cli@2.55.0':
     resolution: {integrity: sha512-cynvcIM2xL8ddwELyFRSpZQw4UtFZzoM2rId2l9vg7+wDREPDocMJB9lEQpBIo3eqhp9JswqUT037yjO6iJ5Sw==}
     engines: {node: '>= 10'}
     hasBin: true
 
+  '@sentry/cli@2.56.0':
+    resolution: {integrity: sha512-br6+1nTPUV5EG1oaxLzxv31kREFKr49Y1+3jutfMUz9Nl8VyVP7o9YwakB/YWl+0Vi0NXg5vq7qsd/OOuV5j8w==}
+    engines: {node: '>= 10'}
+    hasBin: true
+
   '@sentry/core@9.46.0':
     resolution: {integrity: sha512-it7JMFqxVproAgEtbLgCVBYtQ9fIb+Bu0JD+cEplTN/Ukpe6GaolyYib5geZqslVxhp2sQgT+58aGvfd/k0N8Q==}
     engines: {node: '>=18'}
@@ -5323,22 +5486,22 @@ packages:
   '@standard-schema/utils@0.3.0':
     resolution: {integrity: sha512-e7Mew686owMaPJVNNLs55PUvgz371nKgwsc4vxE49zsODpJEnxgxRo2y/OKrqueavXgZNMDVj3DdHFlaSAeU8g==}
 
-  '@storybook/addon-a11y@9.1.8':
-    resolution: {integrity: sha512-7I+Ll29aBwgAbpkNpK+BBJ+BmMCS7+Qe8fPh1n4701Hx7FB+laAx8UP+3kbmqCOwCvLU5JU5KJKgUMMGVE/Jww==}
+  '@storybook/addon-a11y@9.1.10':
+    resolution: {integrity: sha512-RhYYtk8nePxVNfP/voW8vS7AiQxWWBgOLNMTeDr9Anjh06mpSWZ/U/zEUNC9TrId5BxnyZJW5Lkg0JUMwvyfjw==}
     peerDependencies:
-      storybook: ^9.1.8
+      storybook: ^9.1.10
 
-  '@storybook/addon-docs@9.1.8':
-    resolution: {integrity: sha512-GVrNVEdNRRo6r1hawfgyy6x+HJqPx1oOHm0U0wz0SGAxgS/Xh6SQVZL+RDoh7NpXkNi1GbezVlT931UsHQTyvQ==}
+  '@storybook/addon-docs@9.1.10':
+    resolution: {integrity: sha512-LYK3oXy/0PgY39FhkYVd9D0bzatLGTsMhaPPwSjBOmZgK0f0yBLqaePy7urUFeHYm/rjwAaRmDJNBqUnGTVoig==}
     peerDependencies:
-      storybook: ^9.1.8
+      storybook: ^9.1.10
 
-  '@storybook/addon-vitest@9.1.8':
-    resolution: {integrity: sha512-F1AgGpIuDxrGXErMRTfF9zUXvGSUgQPbAXggs74p9vz0855nlRMEny1cYY9BtktVr4JGyq+Mz2774hCt9HR3KQ==}
+  '@storybook/addon-vitest@9.1.10':
+    resolution: {integrity: sha512-Ag5OQxOl+1g8jPOWoXJPneuqVNxoQAP1XEOl3/89m1PJhmvxBMkMynBKWqN3LQcDM3YYkMbpO0u1mvcDfhU5Jg==}
     peerDependencies:
       '@vitest/browser': ^3.0.0
       '@vitest/runner': ^3.0.0
-      storybook: ^9.1.8
+      storybook: ^9.1.10
       vitest: ^3.0.0
     peerDependenciesMeta:
       '@vitest/browser':
@@ -5348,16 +5511,16 @@ packages:
       vitest:
         optional: true
 
-  '@storybook/builder-vite@9.1.8':
-    resolution: {integrity: sha512-JjvBag0nM1N51O3VF5++op9Ly5OC8Q+y4PrWLgi2dKhMxJFs8fD9D4PeI/v41PUiQcI0suQxN9BoYoKn2QxUZw==}
+  '@storybook/builder-vite@9.1.10':
+    resolution: {integrity: sha512-0ogI+toZJYaFptcFpRcRPOZ9/NrFUYhiaI09ggeEB1FF9ygHMVsobp4eaj4HjZI6V3x7cQwkd2ZmxAMQDBQuMA==}
     peerDependencies:
-      storybook: ^9.1.8
+      storybook: ^9.1.10
       vite: ^5.0.0 || ^6.0.0 || ^7.0.0
 
-  '@storybook/csf-plugin@9.1.8':
-    resolution: {integrity: sha512-KnrXPz87bn+8ZGkzFEBc7TT5HkWpR1Xz7ojxPclSvkKxTfzazuaw0JlOQMzJoI1+wHXDAIw/4MIsO8HEiaWyfQ==}
+  '@storybook/csf-plugin@9.1.10':
+    resolution: {integrity: sha512-247F/JU0Naxm/RIUnQYpqXeCL0wG8UNJkZe+/GkLjdqzsyML0lb+8OwBsWFfG8zfj6fkjmRU2mF44TnNkzoQcg==}
     peerDependencies:
-      storybook: ^9.1.8
+      storybook: ^9.1.10
 
   '@storybook/global@5.0.0':
     resolution: {integrity: sha512-FcOqPAXACP0I3oJ/ws6/rrPT9WGhu915Cg8D02a9YxLo0DE9zI+a9A5gRGvmQ09fiWPukqI8ZAEoQEdWUKMQdQ==}
@@ -5369,29 +5532,29 @@ packages:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0-beta
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0-beta
 
-  '@storybook/react-dom-shim@9.1.8':
-    resolution: {integrity: sha512-OepccjVZh/KQugTH8/RL2CIyf1g5Lwc5ESC8x8BH3iuYc82WMQBwMJzRI5EofQdirau63NGrqkWCgQASoVreEA==}
+  '@storybook/react-dom-shim@9.1.10':
+    resolution: {integrity: sha512-cxy8GTj73RMJIFPrgqdnMXePGX5iFohM5pDCZ63Te5m5GtzKqsILRXtBBLO6Ouexm/ZYRVznkKiwNKX/Fu24fQ==}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0-beta
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0-beta
-      storybook: ^9.1.8
+      storybook: ^9.1.10
 
-  '@storybook/react-vite@9.1.8':
-    resolution: {integrity: sha512-DIxp76vcelyFOUJupeQEIHXDrSPP6KDXj6Z+Z9thS1HH7JY+OdGtcMLy4fbiD77Zyc8TV9RRZ1D33z2Ot/v9Vw==}
+  '@storybook/react-vite@9.1.10':
+    resolution: {integrity: sha512-k0wWlfoWakoHL3NZ1+38oxRH3WYyprFFX+WUb/4W8axrvpKogvdnxKCul/YB1HH5FcTagIfguamsPjKwB1ZkJg==}
     engines: {node: '>=20.0.0'}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0-beta
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0-beta
-      storybook: ^9.1.8
+      storybook: ^9.1.10
       vite: ^5.0.0 || ^6.0.0 || ^7.0.0
 
-  '@storybook/react@9.1.8':
-    resolution: {integrity: sha512-EULkwHroJ4IDYcjIBj9VpGhaZ9E5b8LI84hlfBkJ9rnK44a/GrK1yFRIusukO58qTJSh2Y7zfAFKNuiaWh3Sfw==}
+  '@storybook/react@9.1.10':
+    resolution: {integrity: sha512-flG3Gn3EHZnxn92C7vrA2U4aGqpOKdf85fL43+J/2k9HF5AIyOFGlcv4LGVyKZ3LOAow/nGBVSXL9961h+ICRA==}
     engines: {node: '>=20.0.0'}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0-beta
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0-beta
-      storybook: ^9.1.8
+      storybook: ^9.1.10
       typescript: '>= 4.9.x'
     peerDependenciesMeta:
       typescript:
@@ -5591,6 +5754,10 @@ packages:
     resolution: {integrity: sha512-GG2R9I6QSlbNR9fEuX2sQCigY6K28w51h2634TWmkaHXlzQw+rWuIWr4nAGM9doA+kWRi1LFSFMvAiG3cOqjXQ==}
     engines: {node: '>=12'}
 
+  '@tanstack/history@1.132.21':
+    resolution: {integrity: sha512-5ziPz3YarKU5cBJoEJ4muV8cy+5W4oWdJMqW7qosMrK5fb9Qfm+QWX+kO3emKJMu4YOUofVu3toEuuD3x1zXKw==}
+    engines: {node: '>=12'}
+
   '@tanstack/query-core@5.87.4':
     resolution: {integrity: sha512-uNsg6zMxraEPDVO2Bn+F3/ctHi+Zsk+MMpcN8h6P7ozqD088F6mFY5TfGM7zuyIrL7HKpDyu6QHfLWiDxh3cuw==}
 
@@ -5641,6 +5808,10 @@ packages:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
 
+  '@tanstack/router-core@1.132.27':
+    resolution: {integrity: sha512-mNx+nba7mXc7sJdX+kYH4rSW8f7Jx/+0hPOkX4XAnqiq7I1ng3gGqmGuf4+2BYTG2aD+aTSPExUPczy9VNgRfQ==}
+    engines: {node: '>=12'}
+
   '@tanstack/router-core@1.132.6':
     resolution: {integrity: sha512-K5DqCnCSaxRw1BN63aZaZCkTKsGTXkAikzlTBSMVeijLE+D5P1Q9+m7xfuhVkr1sa/0yNNeP5VBmw28AZhnoJA==}
     engines: {node: '>=12'}
@@ -5657,16 +5828,16 @@ packages:
       csstype:
         optional: true
 
-  '@tanstack/router-generator@1.132.6':
-    resolution: {integrity: sha512-C09gIsljx72HpOzmjEZp+1YgAmD6DnOpr+UZcdIEgaLtc9hqCZ+JO2YJZuSxsMIRizjovCP+fmcKDSuVUgCwLA==}
+  '@tanstack/router-generator@1.132.27':
+    resolution: {integrity: sha512-dlW33RGxgG0mBF8vRqUs5CeId6wOf4qY6GmT2Pv6NgCVtrD7wsMSM1BasIRufNIxRT6FVnE7rztMy9wN7oCaKg==}
     engines: {node: '>=12'}
 
-  '@tanstack/router-plugin@1.132.6':
-    resolution: {integrity: sha512-PmcMLBY0Y3Fnjo17O/BQm8IrMxJgli6DTT/0+7420+KbYXL8D30BG4xURj0gzYR0Kh7vHO6DK/c6r9NBPa+0zQ==}
+  '@tanstack/router-plugin@1.132.27':
+    resolution: {integrity: sha512-0mo+jdgO7L5hOPGyrmKtyy20ZUfX4LwN30IXS7mhsaSHbZub+XLS3Ta6mDxNLmOXAJLPI3Gc90yI8jVwhizv5Q==}
     engines: {node: '>=12'}
     peerDependencies:
       '@rsbuild/core': '>=1.0.2'
-      '@tanstack/react-router': ^1.132.6
+      '@tanstack/react-router': ^1.132.27
       vite: '>=5.0.0 || >=6.0.0 || >=7.0.0'
       vite-plugin-solid: ^2.11.8
       webpack: '>=5.92.0'
@@ -5682,23 +5853,23 @@ packages:
       webpack:
         optional: true
 
-  '@tanstack/router-utils@1.132.0':
-    resolution: {integrity: sha512-WDnvAi9kO20joLDzlsTvfgXNv+FgQ4G98xAD8r4jKWoTdTTG05DU2sRYimtbdq4Q7E3uVdvyvPdhRy45wan7bw==}
+  '@tanstack/router-utils@1.132.21':
+    resolution: {integrity: sha512-d9MvyhdPaKN78hQOss89bayiv/HR/7FpVHuKTNGEzzYrBWDVIUBd0yMNaBxQBpTg6NuNxtZ01ZJS5VkbedbzJw==}
     engines: {node: '>=12'}
 
   '@tanstack/store@0.7.7':
     resolution: {integrity: sha512-xa6pTan1bcaqYDS9BDpSiS63qa6EoDkPN9RsRaxHuDdVDNntzq3xNwR5YKTU/V3SkSyC9T4YVOPh2zRQN0nhIQ==}
 
-  '@tanstack/virtual-file-routes@1.132.0':
-    resolution: {integrity: sha512-d3do4ih9IdLPBVY4Gb8x7Ho7z0oFDLpxoao7uNVkfWtYU7nc3B+rnnVejXIgprmI5gt1hNzyNDJFr8G/W926GA==}
+  '@tanstack/virtual-file-routes@1.132.21':
+    resolution: {integrity: sha512-+eT+vxZnf2/QPr9ci5aPn7i3MnVyWYNG2DUqiKJXGi7EvuFrXV9r8zDK40QfUTNGdCg9F880YOVe3cTwMCO0zw==}
     engines: {node: '>=12'}
 
   '@testing-library/dom@10.4.1':
     resolution: {integrity: sha512-o4PXJQidqJl82ckFaXUeoAW+XysPLauYI43Abki5hABd853iMhitooc6znOnczgbTYmEP6U6/y1ZyKAIsvMKGg==}
     engines: {node: '>=18'}
 
-  '@testing-library/jest-dom@6.8.0':
-    resolution: {integrity: sha512-WgXcWzVM6idy5JaftTVC8Vs83NKRmGJz4Hqs4oyOuO2J4r/y79vvKZsb+CaGyCSEbUPI6OsewfPd0G1A0/TUZQ==}
+  '@testing-library/jest-dom@6.9.0':
+    resolution: {integrity: sha512-QHdxYMJ0YPGKYofMc6zYvo7LOViVhdc6nPg/OtM2cf9MQrwEcTxFCs7d/GJ5eSyPkHzOiBkc/KfLdFJBHzldtQ==}
     engines: {node: '>=14', npm: '>=6', yarn: '>=1'}
 
   '@testing-library/user-event@14.6.1':
@@ -5930,15 +6101,18 @@ packages:
   '@types/mysql@2.15.26':
     resolution: {integrity: sha512-DSLCOXhkvfS5WNNPbfn2KdICAmk8lLc+/PNvnPnF7gOdMZCxopXduqv0OQ13y/yA/zXTSikZZqVgybUxOEg6YQ==}
 
-  '@types/node@20.19.17':
-    resolution: {integrity: sha512-gfehUI8N1z92kygssiuWvLiwcbOB3IRktR6hTDgJlXMYh5OvkPSRmgfoBUmfZt+vhwJtX7v1Yw4KvvAf7c5QKQ==}
+  '@types/node@20.19.19':
+    resolution: {integrity: sha512-pb1Uqj5WJP7wrcbLU7Ru4QtA0+3kAXrkutGiD26wUKzSMgNNaPARTUDQmElUXp64kh3cWdou3Q0C7qwwxqSFmg==}
 
-  '@types/node@22.18.6':
-    resolution: {integrity: sha512-r8uszLPpeIWbNKtvWRt/DbVi5zbqZyj1PTmhRMqBMvDnaz1QpmSKujUtJLrqGZeoM8v72MfYggDceY4K1itzWQ==}
+  '@types/node@22.18.8':
+    resolution: {integrity: sha512-pAZSHMiagDR7cARo/cch1f3rXy0AEXwsVsVH09FcyeJVAzCnGgmYis7P3JidtTUjyadhTeSo8TgRPswstghDaw==}
 
   '@types/node@24.5.2':
     resolution: {integrity: sha512-FYxk1I7wPv3K2XBaoyH2cTnocQEu8AOZ60hPbsyukMPLv5/5qr7V1i8PLHdl6Zf87I+xZXFvPCXYjiTFq+YSDQ==}
 
+  '@types/node@24.6.1':
+    resolution: {integrity: sha512-ljvjjs3DNXummeIaooB4cLBKg2U6SPI6Hjra/9rRIy7CpM0HpLtG9HptkMKAb4HYWy5S7HUvJEuWgr/y0U8SHw==}
+
   '@types/pako@2.0.4':
     resolution: {integrity: sha512-VWDCbrLeVXJM9fihYodcLiIv0ku+AlOa/TQ1SvYOaBuyrSKgEcro95LJyIsJ4vSo6BXIxOKxiJAat04CmST9Fw==}
 
@@ -5970,6 +6144,9 @@ packages:
   '@types/react@19.1.13':
     resolution: {integrity: sha512-hHkbU/eoO3EG5/MZkuFSKmYqPbSVk5byPFa3e7y/8TybHiLMACgI8seVYlicwk7H5K/rI2px9xrQp/C+AUDTiQ==}
 
+  '@types/react@19.1.16':
+    resolution: {integrity: sha512-WBM/nDbEZmDUORKnh5i1bTnAz6vTohUf9b8esSMu+b24+srbaxa04UbJgWx78CVfNXA20sNu0odEIluZDFdCog==}
+
   '@types/resolve@1.20.2':
     resolution: {integrity: sha512-60BCwRFOZCQhDncwQdxxeOEEkbc5dIMccYLwbxsS4TUNeVECQ/pBJ0j09mrHOl/JJvpRPGwO9SvE4nR2Nb/a4Q==}
 
@@ -6105,8 +6282,8 @@ packages:
     peerDependencies:
       '@uppy/core': ^5.0.2
 
-  '@uppy/components@1.0.2':
-    resolution: {integrity: sha512-IQNABdixuTQv1wLW4ekIqqmHqzZslreutb2Zh+lF/EZaMgO+LRlztMQvCXhgi5NRP+iL7urnssZGvh0SAn76lQ==}
+  '@uppy/components@1.0.3':
+    resolution: {integrity: sha512-94+kddevrHqYbyjPzV5p2Gv1rn0a20kknaJbUs6FEIJzXxSpVu3qA+5JXEVa/HapvS1NVBTmBw8JvnG4FtnC2w==}
 
   '@uppy/core@5.0.2':
     resolution: {integrity: sha512-HY1IIr5Xff6P67MMSlG8JIgK099zFGksTnS8oBdFOGt+42ge7b6RXPH1zMerpteTLGqVfVT1kOrJLoJyTvT+NA==}
@@ -6166,12 +6343,13 @@ packages:
     peerDependencies:
       '@uppy/core': ^5.0.2
 
-  '@uppy/react@5.0.3':
-    resolution: {integrity: sha512-I7/CQyp2e9HcBzcvVmZJU9Q6t8BrDvohnR7pa1RxVFTvgryPNBT0mg3Vo7OqHjRq9uQ6J9N+luKo9KuK3lBG9A==}
+  '@uppy/react@5.1.0':
+    resolution: {integrity: sha512-KkGP7pKdSx+7WPik+a2HjnPq80MPakjIw0AoBbkqQUlyXhOkF7GYtzfJ13ng4odtYob+d7H+MP3EIxX7Bq/09w==}
     peerDependencies:
       '@uppy/core': ^5.0.2
       '@uppy/dashboard': ^5.0.2
       '@uppy/screen-capture': ^5.0.1
+      '@uppy/status-bar': '*'
       '@uppy/webcam': ^5.0.1
       react: ^18.0.0 || ^19.0.0
       react-dom: ^18.0.0 || ^19.0.0
@@ -6180,6 +6358,8 @@ packages:
         optional: true
       '@uppy/screen-capture':
         optional: true
+      '@uppy/status-bar':
+        optional: true
       '@uppy/webcam':
         optional: true
 
@@ -6260,8 +6440,8 @@ packages:
     peerDependencies:
       vite: ^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0
 
-  '@vitejs/plugin-react@5.0.3':
-    resolution: {integrity: sha512-PFVHhosKkofGH0Yzrw1BipSedTH68BFF8ZWy1kfUpCtJcouXXY0+racG8sExw7hw0HoX36813ga5o3LTWZ4FUg==}
+  '@vitejs/plugin-react@5.0.4':
+    resolution: {integrity: sha512-La0KD0vGkVkSk6K+piWDKRUyg8Rl5iAIKRMH0vMJI0Eg47bq1eOxmoObAaQG37WMW9MSyk7Cs8EIWwJC1PtzKA==}
     engines: {node: ^20.19.0 || >=22.12.0}
     peerDependencies:
       vite: ^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0
@@ -6416,8 +6596,8 @@ packages:
     resolution: {integrity: sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==}
     engines: {node: '>=12'}
 
-  ansis@4.1.0:
-    resolution: {integrity: sha512-BGcItUBWSMRgOCe+SVZJ+S7yTRG0eGt9cXAHev72yuGcY23hnLA7Bky5L/xLyPINoSN95geovfBkqoTlNZYa7w==}
+  ansis@4.2.0:
+    resolution: {integrity: sha512-HqZ5rWlFjGiV0tDm3UxxgNRqsOTniqoKZu0pIAfh7TZQMGuZK+hH0drySty0si0QXj1ieop4+SkSfPZBPPkHig==}
     engines: {node: '>=14'}
 
   any-promise@1.3.0:
@@ -6564,8 +6744,8 @@ packages:
   base64-js@1.5.1:
     resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==}
 
-  baseline-browser-mapping@2.8.7:
-    resolution: {integrity: sha512-bxxN2M3a4d1CRoQC//IqsR5XrLh0IJ8TCv2x6Y9N0nckNz/rTjZB3//GGscZziZOxmjP55rzxg/ze7usFI9FqQ==}
+  baseline-browser-mapping@2.8.9:
+    resolution: {integrity: sha512-hY/u2lxLrbecMEWSB0IpGzGyDyeoMFQhCvZd2jGFSE5I17Fh01sYUBPCJtkWERw7zrac9+cIghxm/ytJa2X8iA==}
     hasBin: true
 
   bcp-47-match@2.0.3:
@@ -6677,8 +6857,8 @@ packages:
     resolution: {integrity: sha512-QOSvevhslijgYwRx6Rv7zKdMF8lbRmx+uQGx2+vDc+KI/eBnsy9kit5aj23AgGu3pa4t9AgwbnXWqS+iOY+2aA==}
     engines: {node: '>= 6'}
 
-  caniuse-lite@1.0.30001745:
-    resolution: {integrity: sha512-ywt6i8FzvdgrrrGbr1jZVObnVv6adj+0if2/omv9cmR2oiZs30zL4DIyaptKcbOrBdOIc74QTMoJvSE2QHh5UQ==}
+  caniuse-lite@1.0.30001746:
+    resolution: {integrity: sha512-eA7Ys/DGw+pnkWWSE/id29f2IcPHVoE8wxtvE5JdvD2V28VTDPy1yEeo11Guz0sJ4ZeGRcm3uaTcAqK1LXaphA==}
 
   canvas-confetti@1.9.3:
     resolution: {integrity: sha512-rFfTURMvmVEX1gyXFgn5QMn81bYk70qa0HLzcIOSVEyl57n6o9ItHeBtUSWdvKAPY0xlvBHno4/v3QPrT83q9g==}
@@ -6930,6 +7110,11 @@ packages:
     engines: {node: '>=20'}
     hasBin: true
 
+  cross-env@10.1.0:
+    resolution: {integrity: sha512-GsYosgnACZTADcmEyJctkJIoqAhHjttw7RsFrVoJNXbsWWqaq6Ym+7kZjq6mS45O0jij6vtiReppKQEtqWy6Dw==}
+    engines: {node: '>=20'}
+    hasBin: true
+
   cross-fetch@4.0.0:
     resolution: {integrity: sha512-e4a5N8lVvuLgAWgnCrLr2PP0YyDOTHa9H/Rj54dirp61qXnNq46m82bRhNqIA5VccJtWBvPTFRV3TtvHUKPB1g==}
 
@@ -7221,6 +7406,10 @@ packages:
     resolution: {integrity: sha512-Sf2LSQP+bOlhKWWyhFsn0UsfdK/kCWRv1iuA2gXAwt3dyNabr6QSj00I2V10pidqz69soatm9ZwZvpQMTIOd5Q==}
     engines: {node: '>=12'}
 
+  dotenv@17.2.3:
+    resolution: {integrity: sha512-JVUnt+DUIzu87TABbhPmNfVdBDt18BLOWjMUFJMSi/Qqg7NTYtabbvSNJGOJ7afbRuv9D/lngizHtP7QyLQ+9w==}
+    engines: {node: '>=12'}
+
   drizzle-kit@0.30.3:
     resolution: {integrity: sha512-kT8sgyC2hZrtOh5okhEBiwgx8jx+EjLUFoANFVVkBbxIjcb8XjaUorZ0rwCEUEd7THclI3ZARR64pmxloMW3Aw==}
     hasBin: true
@@ -7350,8 +7539,8 @@ packages:
     engines: {node: '>=0.10.0'}
     hasBin: true
 
-  electron-to-chromium@1.5.223:
-    resolution: {integrity: sha512-qKm55ic6nbEmagFlTFczML33rF90aU+WtrJ9MdTCThrcvDNdUHN4p6QfVN78U06ZmguqXIyMPyYhw2TrbDUwPQ==}
+  electron-to-chromium@1.5.228:
+    resolution: {integrity: sha512-nxkiyuqAn4MJ1QbobwqJILiDtu/jk14hEAWaMiJmNPh1Z+jqoFlBFZjdXwLWGeVSeu9hGLg6+2G9yJaW8rBIFA==}
 
   embla-carousel-autoplay@8.6.0:
     resolution: {integrity: sha512-OBu5G3nwaSXkZCo1A6LTaFMZ8EpkYbwIaH+bPqdBnDGQ2fh4+NbzjXjs2SktoPNKCtflfVMc75njaDHOYXcrsA==}
@@ -7780,6 +7969,10 @@ packages:
     engines: {node: '>= 18.0.0'}
     hasBin: true
 
+  generator-function@2.0.1:
+    resolution: {integrity: sha512-SFdFmIJi+ybC0vjlHN0ZGVGHc3lgE0DxPAT0djjVg+kjOnSqclqmj0KQ7ykTOLP6YxoqOvuAODGdcHJn+43q3g==}
+    engines: {node: '>= 0.4'}
+
   gensync@1.0.0-beta.2:
     resolution: {integrity: sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==}
     engines: {node: '>=6.9.0'}
@@ -7820,8 +8013,8 @@ packages:
   github-from-package@0.0.0:
     resolution: {integrity: sha512-SyHy3T1v2NUXn29OsWdxmK6RwHD+vkj3v8en8AOBZ1wBQ/hCAQ5bAQTD02kW4W9tUp/3Qh6J8r9EvntiyCmOOw==}
 
-  gleap@14.8.8:
-    resolution: {integrity: sha512-gA8slATi5CILv6Te8sLVJIzdKvCnmjprnhHOFx7f1FKzf7yAgfc7yDW/XWuVY7CL2LxQPFIHmkLOl4kzXlRzAQ==}
+  gleap@14.8.11:
+    resolution: {integrity: sha512-NJjSh3lYWSxcPzJjGZ1+efK7jGdweSEBR54XQSFofWjcbKxqBmodegYTnzCsroh4eInuy/vNfrznTmD2SXXmfA==}
 
   glob-parent@5.1.2:
     resolution: {integrity: sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==}
@@ -8224,8 +8417,8 @@ packages:
     resolution: {integrity: sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==}
     engines: {node: '>=8'}
 
-  is-generator-function@1.1.0:
-    resolution: {integrity: sha512-nPUB5km40q9e8UfN/Zc24eLlzdSf9OfKByBw9CIdw4H1giPMeA0OIJvbchsCu4npfI2QcMVBsGEBHKZ7wLTWmQ==}
+  is-generator-function@1.1.2:
+    resolution: {integrity: sha512-upqt1SkGkODW9tsGNG5mtXTXtECizwtS2kA161M+gJPc1xdb/Ax629af6YrTwcOeQHbewrPNlE5Dx7kzvXTizA==}
     engines: {node: '>= 0.4'}
 
   is-glob@4.0.3:
@@ -8392,8 +8585,8 @@ packages:
     resolution: {integrity: sha512-/imKNG4EbWNrVjoNC/1H5/9GFy+tqjGBHCaSsN+P2RnPqjsLmv6UD3Ej+Kj8nBWaRAwyk7kK5ZUc+OEatnTR3A==}
     hasBin: true
 
-  jiti@2.6.0:
-    resolution: {integrity: sha512-VXe6RjJkBPj0ohtqaO8vSWP3ZhAKo66fKrFNCll4BTcwljPLz03pCbaNKfzGP5MbrCYcbJ7v0nOYYwUzTEIdXQ==}
+  jiti@2.6.1:
+    resolution: {integrity: sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ==}
     hasBin: true
 
   joi@18.0.1:
@@ -8521,13 +8714,13 @@ packages:
     resolution: {integrity: sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ==}
     engines: {node: '>=6'}
 
-  knip@5.64.0:
-    resolution: {integrity: sha512-UqDlVXXacGy5YL+PXKrolqRpC7DkGTYs+to67KmWBHIUrTh8SX9gQoGNdFsNZtbj4pCdM/RmC/Rbze555+MhSA==}
+  knip@5.64.1:
+    resolution: {integrity: sha512-80XnLsyeXuyxj1F4+NBtQFHxaRH0xWRw8EKwfQ6EkVZZ0bSz/kqqan08k/Qg8ajWsFPhFq+0S2RbLCBGIQtuOg==}
     engines: {node: '>=18.18.0'}
     hasBin: true
     peerDependencies:
       '@types/node': '>=18'
-      typescript: '>=5.0.4'
+      typescript: '>=5.0.4 <7'
 
   leac@0.6.0:
     resolution: {integrity: sha512-y+SqErxb8h7nE/fiEX07jsbuhrpO9lL8eca7/Y1nuWV2moNlXhyd59iDGcRf6moVyDMbmTNzL40SUyrFU/yDpg==}
@@ -8724,8 +8917,8 @@ packages:
   lru-cache@10.4.3:
     resolution: {integrity: sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==}
 
-  lru-cache@11.2.1:
-    resolution: {integrity: sha512-r8LA6i4LP4EeWOhqBaZZjDWwehd1xUJPCJd9Sv300H0ZmcUER4+JPh7bqqZeqs1o5pgtgvXm+d9UGrB5zZGDiQ==}
+  lru-cache@11.2.2:
+    resolution: {integrity: sha512-F9ODfyqML2coTIsQpSkRHnLSZMtkU8Q+mSfcaIyKwy58u+8k5nvAYeiNhsyMARvzNcXJ9QfWVrcPsC9e9rAxtg==}
     engines: {node: 20 || >=22}
 
   lru-cache@5.1.1:
@@ -9212,8 +9405,8 @@ packages:
     resolution: {integrity: sha512-qFOyK5PjiWZd+QQIh+1jhdb9LpxTF0qs7Pm8o5QHYZ0M3vKqSqzsZaEB6oWlxZ+q2sJBMI/Ktgd2N5ZwQoRHfg==}
     engines: {node: '>= 0.4'}
 
-  oxc-resolver@11.8.2:
-    resolution: {integrity: sha512-SM31gnF1l4T8YA7dkAcBhA+jc336bc8scy0Tetz6ndzGmV6c0R99SRnx6In0V5ffwvn1Isjo9I9EGSLF4xi3TA==}
+  oxc-resolver@11.8.4:
+    resolution: {integrity: sha512-qpimS3tHHEf+kgESMAme+q+rj7aCzMya00u9YdKOKyX2o7q4lozjPo6d7ZTTi979KHEcVOPWdNTueAKdeNq72w==}
 
   p-defer@3.0.0:
     resolution: {integrity: sha512-ugZxsxmtTln604yeYd29EGrNhazN2lywetzpKhfmQjW/VJmhpDmWbiX+h0zL8V91R0UXkhb3KtPmyq9PZw3aYw==}
@@ -9666,8 +9859,8 @@ packages:
   prosemirror-transform@1.10.4:
     resolution: {integrity: sha512-pwDy22nAnGqNR1feOQKHxoFkkUtepoFAd3r2hbEDsnf4wp57kKA36hXsB3njA9FtONBEwSDnDeCiJe+ItD+ykw==}
 
-  prosemirror-view@1.41.1:
-    resolution: {integrity: sha512-cViIhlt1/T5bQMINrmXh43JZcdIgdW1YkOABmIuH5gSt3/HiCZHsLN9d5GvsgzrXn2+zZ8il0kkghisusm7tSA==}
+  prosemirror-view@1.41.2:
+    resolution: {integrity: sha512-PGS/jETmh+Qjmre/6vcG7SNHAKiGc4vKOJmHMPRmvcUl7ISuVtrtHmH06UDUwaim4NDJfZfVMl7U7JkMMETa6g==}
 
   proto-list@1.2.4:
     resolution: {integrity: sha512-vtK/94akxsTMhe0/cbfpR+syPuszcuwhqVjJq26CuNDgFGj682oRBXOP5MJpv2r7JtE8MsiepGIqvvOTBwn2vA==}
@@ -9783,6 +9976,22 @@ packages:
       typescript:
         optional: true
 
+  react-i18next@15.7.4:
+    resolution: {integrity: sha512-nyU8iKNrI5uDJch0z9+Y5XEr34b0wkyYj3Rp+tfbahxtlswxSCjcUL9H0nqXo9IR3/t5Y5PKIA3fx3MfUyR9Xw==}
+    peerDependencies:
+      i18next: '>= 23.4.0'
+      react: '>= 16.8.0'
+      react-dom: '*'
+      react-native: '*'
+      typescript: ^5
+    peerDependenciesMeta:
+      react-dom:
+        optional: true
+      react-native:
+        optional: true
+      typescript:
+        optional: true
+
   react-icons@5.5.0:
     resolution: {integrity: sha512-MEFcXdkP3dLo8uumGI5xN3lDFNsRtrjbOEKDLD7yv76v4wpnEq2Lt2qeHaQOr34I/wPN3s3+N08WkQ+CW37Xiw==}
     peerDependencies:
@@ -10188,6 +10397,11 @@ packages:
     engines: {node: '>=18.0.0', npm: '>=8.0.0'}
     hasBin: true
 
+  rollup@4.52.3:
+    resolution: {integrity: sha512-RIDh866U8agLgiIcdpB+COKnlCreHJLfIhWC3LVflku5YHfpnsIKigRZeFfMfCc4dVcqNVfQQ5gO/afOck064A==}
+    engines: {node: '>=18.0.0', npm: '>=8.0.0'}
+    hasBin: true
+
   rope-sequence@1.3.4:
     resolution: {integrity: sha512-UT5EDe2cu2E/6O4igUr5PSFs23nvvukicWHx6GnOPlHAiiYbzNuCRQCuiUdHJQcqKalLKlrYJnjY0ySGsXNQXQ==}
 
@@ -10429,8 +10643,8 @@ packages:
     resolution: {integrity: sha512-eLoXW/DHyl62zxY4SCaIgnRhuMr6ri4juEYARS8E6sCEqzKpOiE521Ucofdx+KnDZl5xmvGYaaKCk5FEOxJCoQ==}
     engines: {node: '>= 0.4'}
 
-  storybook@9.1.8:
-    resolution: {integrity: sha512-/iP+DvieJ6Mnixy4PFY/KXnhsg/IHIDlTbZqly3EDbveuhsCuIUELfGnj+QSRGf9C6v/f4sZf9sZ3r80ZnKuEA==}
+  storybook@9.1.10:
+    resolution: {integrity: sha512-4+U7gF9hMpGilQmdVJwQaVZZEkD7XwC4ZDmBa51mobaPYelELEMoMfNM2hLyvB2x12gk1IJui1DnwOE4t+MXhw==}
     hasBin: true
     peerDependencies:
       prettier: ^2 || ^3
@@ -10515,8 +10729,8 @@ packages:
     resolution: {integrity: sha512-1tB5mhVo7U+ETBKNf92xT4hrQa3pm0MZ0PQvuDnWgAAGHDsfp4lPSpiS6psrSiet87wyGPh9ft6wmhOMQ0hDiw==}
     engines: {node: '>=14.16'}
 
-  strip-literal@3.0.0:
-    resolution: {integrity: sha512-TcccoMhJOM3OebGhSBEmp3UZ2SfDMZUEBdRA/9ynfLi8yYajyWX3JiXArcJt4Umh4vISpspkQIY8ZZoCqjbviA==}
+  strip-literal@3.1.0:
+    resolution: {integrity: sha512-8r3mkIM/2+PpjHoOtiAW8Rg3jJLHaV7xPwG+YRGrv6FP0wwk/toTpATxWYOW0BKdWwl82VT2tFYi5DlROa0Mxg==}
 
   strnum@2.1.1:
     resolution: {integrity: sha512-7ZvoFTiCnGxBtDqJ//Cu6fWtZtc7Y3x+QOirG15wztbdngGSkht27o2pyGWrVy0b4WAy3jbKmnoK6g5VlVNUUw==}
@@ -10782,6 +10996,11 @@ packages:
     engines: {node: '>=18.0.0'}
     hasBin: true
 
+  tsx@4.20.6:
+    resolution: {integrity: sha512-ytQKuwgmrrkDTFP4LjR0ToE2nqgy886GpvRSpU0JAnrdBYppuY5rLkRUYPU1yCryb24SsKBTL/hlDQAEFVwtZg==}
+    engines: {node: '>=18.0.0'}
+    hasBin: true
+
   tunnel-agent@0.6.0:
     resolution: {integrity: sha512-McnNiV1l8RYeY8tBgEpuodCC1mLUdbSN+CYBL7kJsJNInOP8UjDDEwdk6Mw60vdLLrr5NHKZhMAOSrR2NZuQ+w==}
 
@@ -10841,6 +11060,11 @@ packages:
     engines: {node: '>=14.17'}
     hasBin: true
 
+  typescript@5.9.3:
+    resolution: {integrity: sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==}
+    engines: {node: '>=14.17'}
+    hasBin: true
+
   ua-is-frozen@0.1.2:
     resolution: {integrity: sha512-RwKDW2p3iyWn4UbaxpP2+VxwqXh0jpvdxsYpZ5j/MLLiQOfbsV5shpgQiw93+KMYQPcteeMQ289MaAFzs3G9pw==}
 
@@ -10869,6 +11093,9 @@ packages:
   undici-types@7.12.0:
     resolution: {integrity: sha512-goOacqME2GYyOZZfb5Lgtu+1IDmAlAEu5xnD3+xTzS10hT0vzpf0SPjkXwAw9Jm+4n/mQGDP3LO8CPbYROeBfQ==}
 
+  undici-types@7.13.0:
+    resolution: {integrity: sha512-Ov2Rr9Sx+fRgagJ5AX0qvItZG/JKKoBRAVITs1zk7IqZGTJUwgUr7qoYBpWwakpWilTZFM98rG/AFRocu10iIQ==}
+
   undici@7.16.0:
     resolution: {integrity: sha512-QEg3HPMll0o3t2ourKwOeUAZ159Kn9mx5pnzHRQO8+Wixmh88YdZRiIwat0iNzNNXn0yoEtXJqFpyW7eM8BV7g==}
     engines: {node: '>=20.18.1'}
@@ -11046,8 +11273,8 @@ packages:
   victory-vendor@37.3.6:
     resolution: {integrity: sha512-SbPDPdDBYp+5MJHhBCAyI7wKM3d5ivekigc2Dk2s7pgbZ9wIgIBYGVw4zGHBml/qTFbexrofXW6Gu4noGxrOwQ==}
 
-  virtua@0.43.4:
-    resolution: {integrity: sha512-zS9A2EC3KY9hRjG5NM7t0gPGqkcdOc7HWhuc9KDvKq3yz10sRup5L09axFyWHePr1ppWljpAHtr0BCCsM6tS5Q==}
+  virtua@0.43.6:
+    resolution: {integrity: sha512-FcIkIUibw5SSCywhTbg0R0nKmFhILWCVrAIWesckitsXX5IOrWYqtDpT/GLmIuZIrTB9A/+3DnmL5uvDgKWmFQ==}
     peerDependencies:
       react: '>=16.14.0'
       react-dom: '>=16.14.0'
@@ -11088,8 +11315,8 @@ packages:
       '@vite-pwa/assets-generator':
         optional: true
 
-  vite-plugin-static-copy@3.1.2:
-    resolution: {integrity: sha512-aVmYOzptLVOI2b1jL+cmkF7O6uhRv1u5fvOkQgbohWZp2CbR22kn9ZqkCUIt9umKF7UhdbsEpshn1rf4720QFg==}
+  vite-plugin-static-copy@3.1.3:
+    resolution: {integrity: sha512-U47jgyoJfrvreF87u2udU6dHIXbHhdgGZ7wSEqn6nVHKDOMdRoB2uVc6iqxbEzENN5JvX6djE5cBhQZ2MMBclA==}
     engines: {node: ^18.0.0 || >=20.0.0}
     peerDependencies:
       vite: ^5.0.0 || ^6.0.0 || ^7.0.0
@@ -11476,18 +11703,15 @@ packages:
     resolution: {integrity: sha512-GQHQqAopRhwU8Kt1DDM8NjibDXHC8eoh1erhGAJPEyveY9qqVeXvVikNKrDz69sHowPMorbPUrH/mx8c50eiBQ==}
     engines: {node: '>=18'}
 
-  zod-validation-error@3.5.3:
-    resolution: {integrity: sha512-OT5Y8lbUadqVZCsnyFaTQ4/O2mys4tj7PqhdbBCp7McPwvIEKfPtdA6QfPeFQK2/Rz5LgwmAXRJTugBNBi0btw==}
-    engines: {node: '>=18.0.0'}
-    peerDependencies:
-      zod: ^3.25.0 || ^4.0.0
-
   zod@3.24.1:
     resolution: {integrity: sha512-muH7gBL9sI1nciMZV67X5fTKKBLtwpZ5VBp1vsOQzj1MhrBZ4wlVCm3gedKZWLp0Oyel8sIGfeiz54Su+OVT+A==}
 
   zod@3.25.76:
     resolution: {integrity: sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==}
 
+  zod@4.1.11:
+    resolution: {integrity: sha512-WPsqwxITS2tzx1bzhIKsEs19ABD5vmCVa4xBo2tq/SrV4RNZtfws1EnCWQXM6yh8bD08a1idvkB5MZSBiZsjwg==}
+
   zod@4.1.8:
     resolution: {integrity: sha512-5R1P+WwQqmmMIEACyzSvo4JXHY5WiAFHRMg+zBZKgKS+Q1viRa0C1hmUKtHltoIFKtIdki3pRxkmpP74jnNYHQ==}
 
@@ -12848,12 +13072,12 @@ snapshots:
       emoji-mart: 5.6.0
       hast-util-from-dom: 5.0.1
       prosemirror-dropcursor: 1.8.2
-      prosemirror-highlight: 0.13.0(@shikijs/types@3.2.1)(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)(prosemirror-model@1.25.3)(prosemirror-state@1.4.3)(prosemirror-transform@1.10.4)(prosemirror-view@1.41.1)
+      prosemirror-highlight: 0.13.0(@shikijs/types@3.2.1)(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)(prosemirror-model@1.25.3)(prosemirror-state@1.4.3)(prosemirror-transform@1.10.4)(prosemirror-view@1.41.2)
       prosemirror-model: 1.25.3
       prosemirror-state: 1.4.3
       prosemirror-tables: 1.8.1
       prosemirror-transform: 1.10.4
-      prosemirror-view: 1.41.1
+      prosemirror-view: 1.41.2
       rehype-format: 5.0.1
       rehype-parse: 9.0.1
       rehype-remark: 10.0.1
@@ -12864,7 +13088,7 @@ snapshots:
       remark-stringify: 11.0.0
       unified: 11.0.5
       uuid: 8.3.2
-      y-prosemirror: 1.3.7(prosemirror-model@1.25.3)(prosemirror-state@1.4.3)(prosemirror-view@1.41.1)(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27)
+      y-prosemirror: 1.3.7(prosemirror-model@1.25.3)(prosemirror-state@1.4.3)(prosemirror-view@1.41.2)(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27)
       y-protocols: 1.0.6(yjs@13.6.27)
       yjs: 13.6.27
     optionalDependencies:
@@ -12899,20 +13123,20 @@ snapshots:
       - sugar-high
       - supports-color
 
-  '@blocknote/shadcn@0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(highlight.js@11.11.1)(lowlight@3.3.0)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2))':
+  '@blocknote/shadcn@0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(highlight.js@11.11.1)(lowlight@3.3.0)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.6.1)(typescript@5.9.3))':
     dependencies:
       '@blocknote/core': 0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)
       '@blocknote/react': 0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@hookform/resolvers': 3.10.0(react-hook-form@7.63.0(react@19.1.1))
-      '@radix-ui/react-avatar': 1.1.10(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-dropdown-menu': 2.1.16(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-label': 2.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-popover': 1.1.15(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-select': 2.2.6(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-tabs': 1.1.13(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-toggle': 1.1.10(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-tooltip': 1.2.8(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-avatar': 1.1.10(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-dropdown-menu': 2.1.16(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-label': 2.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-popover': 1.1.15(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-select': 2.2.6(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-tabs': 1.1.13(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-toggle': 1.1.10(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-tooltip': 1.2.8(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       autoprefixer: 10.4.21(postcss@8.5.6)
       class-variance-authority: 0.7.1
       clsx: 2.1.1
@@ -12922,8 +13146,8 @@ snapshots:
       react-dom: 19.1.1(react@19.1.1)
       react-hook-form: 7.63.0(react@19.1.1)
       tailwind-merge: 2.6.0
-      tailwindcss: 3.4.17(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2))
-      tailwindcss-animate: 1.0.7(tailwindcss@3.4.17(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2)))
+      tailwindcss: 3.4.17(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.6.1)(typescript@5.9.3))
+      tailwindcss-animate: 1.0.7(tailwindcss@3.4.17(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.6.1)(typescript@5.9.3)))
       zod: 3.25.76
     transitivePeerDependencies:
       - '@hocuspocus/provider'
@@ -12937,9 +13161,9 @@ snapshots:
       - supports-color
       - ts-node
 
-  '@cellajs/permission-manager@0.1.0(@swc/core@1.7.26)(jiti@2.6.0)(postcss@8.5.6)(tsx@4.20.5)(yaml@2.8.1)':
+  '@cellajs/permission-manager@0.1.0(@swc/core@1.7.26)(jiti@2.6.1)(postcss@8.5.6)(tsx@4.20.5)(yaml@2.8.1)':
     dependencies:
-      tsup: 8.5.0(@swc/core@1.7.26)(jiti@2.6.0)(postcss@8.5.6)(tsx@4.20.5)(typescript@5.9.2)(yaml@2.8.1)
+      tsup: 8.5.0(@swc/core@1.7.26)(jiti@2.6.1)(postcss@8.5.6)(tsx@4.20.5)(typescript@5.9.2)(yaml@2.8.1)
       typescript: 5.9.2
     transitivePeerDependencies:
       - '@microsoft/api-extractor'
@@ -12950,13 +13174,13 @@ snapshots:
       - tsx
       - yaml
 
-  '@chromatic-com/storybook@4.1.1(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))':
+  '@chromatic-com/storybook@4.1.1(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
     dependencies:
       '@neoconfetti/react': 1.0.0
       chromatic: 12.2.0
       filesize: 10.1.6
       jsonfile: 6.2.0
-      storybook: 9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       strip-ansi: 7.1.2
     transitivePeerDependencies:
       - '@chromatic-com/cypress'
@@ -13023,7 +13247,7 @@ snapshots:
     dependencies:
       '@microsoft/fetch-event-source': 2.0.1
     optionalDependencies:
-      '@rollup/rollup-darwin-arm64': 4.52.2
+      '@rollup/rollup-darwin-arm64': 4.52.3
 
   '@electric-sql/pglite@0.3.10': {}
 
@@ -13530,7 +13754,7 @@ snapshots:
 
   '@eslint/js@8.57.1': {}
 
-  '@evilmartians/lefthook@1.13.3': {}
+  '@evilmartians/lefthook@1.13.6': {}
 
   '@faker-js/faker@10.0.0': {}
 
@@ -13605,9 +13829,9 @@ snapshots:
     dependencies:
       '@hapi/hoek': 11.0.7
 
-  '@hey-api/codegen-core@0.2.0(typescript@5.9.2)':
+  '@hey-api/codegen-core@0.2.0(typescript@5.9.3)':
     dependencies:
-      typescript: 5.9.2
+      typescript: 5.9.3
 
   '@hey-api/json-schema-ref-parser@1.1.0':
     dependencies:
@@ -13616,9 +13840,9 @@ snapshots:
       js-yaml: 4.1.0
       lodash: 4.17.21
 
-  '@hey-api/openapi-ts@0.84.3(magicast@0.3.5)(typescript@5.9.2)':
+  '@hey-api/openapi-ts@0.84.4(magicast@0.3.5)(typescript@5.9.3)':
     dependencies:
-      '@hey-api/codegen-core': 0.2.0(typescript@5.9.2)
+      '@hey-api/codegen-core': 0.2.0(typescript@5.9.3)
       '@hey-api/json-schema-ref-parser': 1.1.0
       ansi-colors: 4.1.3
       c12: 2.0.1(magicast@0.3.5)
@@ -13627,7 +13851,7 @@ snapshots:
       handlebars: 4.7.8
       open: 10.1.2
       semver: 7.7.2
-      typescript: 5.9.2
+      typescript: 5.9.3
     transitivePeerDependencies:
       - magicast
 
@@ -13705,7 +13929,7 @@ snapshots:
       '@inquirer/figures': 1.0.12
       '@inquirer/type': 2.0.0
       '@types/mute-stream': 0.0.4
-      '@types/node': 22.18.6
+      '@types/node': 22.18.8
       '@types/wrap-ansi': 3.0.0
       ansi-escapes: 4.3.2
       cli-width: 4.1.0
@@ -13806,14 +14030,14 @@ snapshots:
 
   '@istanbuljs/schema@0.1.3': {}
 
-  '@joshwooding/vite-plugin-react-docgen-typescript@0.6.1(typescript@5.9.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))':
+  '@joshwooding/vite-plugin-react-docgen-typescript@0.6.1(typescript@5.9.3)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
       glob: 10.4.5
       magic-string: 0.30.19
-      react-docgen-typescript: 2.4.0(typescript@5.9.2)
-      vite: 7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
+      react-docgen-typescript: 2.4.0(typescript@5.9.3)
+      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     optionalDependencies:
-      typescript: 5.9.2
+      typescript: 5.9.3
 
   '@jridgewell/gen-mapping@0.3.13':
     dependencies:
@@ -13930,10 +14154,10 @@ snapshots:
 
   '@logtail/types@0.5.6': {}
 
-  '@mdx-js/react@3.1.1(@types/react@19.1.13)(react@19.1.1)':
+  '@mdx-js/react@3.1.1(@types/react@19.1.16)(react@19.1.1)':
     dependencies:
       '@types/mdx': 2.0.13
-      '@types/react': 19.1.13
+      '@types/react': 19.1.16
       react: 19.1.1
 
   '@microsoft/fetch-event-source@2.0.1': {}
@@ -14609,63 +14833,63 @@ snapshots:
       '@oslojs/crypto': 1.0.0
       '@oslojs/encoding': 1.0.0
 
-  '@oxc-resolver/binding-android-arm-eabi@11.8.2':
+  '@oxc-resolver/binding-android-arm-eabi@11.8.4':
     optional: true
 
-  '@oxc-resolver/binding-android-arm64@11.8.2':
+  '@oxc-resolver/binding-android-arm64@11.8.4':
     optional: true
 
-  '@oxc-resolver/binding-darwin-arm64@11.8.2':
+  '@oxc-resolver/binding-darwin-arm64@11.8.4':
     optional: true
 
-  '@oxc-resolver/binding-darwin-x64@11.8.2':
+  '@oxc-resolver/binding-darwin-x64@11.8.4':
     optional: true
 
-  '@oxc-resolver/binding-freebsd-x64@11.8.2':
+  '@oxc-resolver/binding-freebsd-x64@11.8.4':
     optional: true
 
-  '@oxc-resolver/binding-linux-arm-gnueabihf@11.8.2':
+  '@oxc-resolver/binding-linux-arm-gnueabihf@11.8.4':
     optional: true
 
-  '@oxc-resolver/binding-linux-arm-musleabihf@11.8.2':
+  '@oxc-resolver/binding-linux-arm-musleabihf@11.8.4':
     optional: true
 
-  '@oxc-resolver/binding-linux-arm64-gnu@11.8.2':
+  '@oxc-resolver/binding-linux-arm64-gnu@11.8.4':
     optional: true
 
-  '@oxc-resolver/binding-linux-arm64-musl@11.8.2':
+  '@oxc-resolver/binding-linux-arm64-musl@11.8.4':
     optional: true
 
-  '@oxc-resolver/binding-linux-ppc64-gnu@11.8.2':
+  '@oxc-resolver/binding-linux-ppc64-gnu@11.8.4':
     optional: true
 
-  '@oxc-resolver/binding-linux-riscv64-gnu@11.8.2':
+  '@oxc-resolver/binding-linux-riscv64-gnu@11.8.4':
     optional: true
 
-  '@oxc-resolver/binding-linux-riscv64-musl@11.8.2':
+  '@oxc-resolver/binding-linux-riscv64-musl@11.8.4':
     optional: true
 
-  '@oxc-resolver/binding-linux-s390x-gnu@11.8.2':
+  '@oxc-resolver/binding-linux-s390x-gnu@11.8.4':
     optional: true
 
-  '@oxc-resolver/binding-linux-x64-gnu@11.8.2':
+  '@oxc-resolver/binding-linux-x64-gnu@11.8.4':
     optional: true
 
-  '@oxc-resolver/binding-linux-x64-musl@11.8.2':
+  '@oxc-resolver/binding-linux-x64-musl@11.8.4':
     optional: true
 
-  '@oxc-resolver/binding-wasm32-wasi@11.8.2':
+  '@oxc-resolver/binding-wasm32-wasi@11.8.4':
     dependencies:
       '@napi-rs/wasm-runtime': 1.0.5
     optional: true
 
-  '@oxc-resolver/binding-win32-arm64-msvc@11.8.2':
+  '@oxc-resolver/binding-win32-arm64-msvc@11.8.4':
     optional: true
 
-  '@oxc-resolver/binding-win32-ia32-msvc@11.8.2':
+  '@oxc-resolver/binding-win32-ia32-msvc@11.8.4':
     optional: true
 
-  '@oxc-resolver/binding-win32-x64-msvc@11.8.2':
+  '@oxc-resolver/binding-win32-x64-msvc@11.8.4':
     optional: true
 
   '@paddle/paddle-js@1.4.2': {}
@@ -14792,36 +15016,36 @@ snapshots:
 
   '@radix-ui/primitive@1.1.3': {}
 
-  '@radix-ui/react-accordion@1.2.12(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-accordion@1.2.12(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-collapsible': 1.1.12(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-collapsible': 1.1.12(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
 
-  '@radix-ui/react-alert-dialog@1.1.15(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-alert-dialog@1.1.15(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-dialog': 1.1.15(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-dialog': 1.1.15(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.16)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
 
   '@radix-ui/react-arrow@1.1.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
@@ -14841,34 +15065,43 @@ snapshots:
       '@types/react': 19.1.13
       '@types/react-dom': 19.1.9(@types/react@19.1.13)
 
-  '@radix-ui/react-avatar@1.1.10(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-arrow@1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-is-hydrated': 0.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+
+  '@radix-ui/react-avatar@1.1.10(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+    dependencies:
+      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-is-hydrated': 0.1.0(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      react: 19.1.1
+      react-dom: 19.1.1(react@19.1.1)
+    optionalDependencies:
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
 
-  '@radix-ui/react-checkbox@1.3.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-checkbox@1.3.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-size': 1.1.1(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@19.1.16)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
 
   '@radix-ui/react-collapsible@1.1.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
@@ -14886,21 +15119,21 @@ snapshots:
       '@types/react': 19.1.13
       '@types/react-dom': 19.1.9(@types/react@19.1.13)
 
-  '@radix-ui/react-collapsible@1.1.12(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-collapsible@1.1.12(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.16)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
 
   '@radix-ui/react-collection@1.1.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
@@ -14926,6 +15159,18 @@ snapshots:
       '@types/react': 19.1.13
       '@types/react-dom': 19.1.9(@types/react@19.1.13)
 
+  '@radix-ui/react-collection@1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+    dependencies:
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.16)(react@19.1.1)
+      react: 19.1.1
+      react-dom: 19.1.1(react@19.1.1)
+    optionalDependencies:
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+
   '@radix-ui/react-compose-refs@1.1.0(@types/react@19.1.13)(react@19.1.1)':
     dependencies:
       react: 19.1.1
@@ -14938,19 +15183,25 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
-  '@radix-ui/react-context-menu@2.2.16(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-compose-refs@1.1.2(@types/react@19.1.16)(react@19.1.1)':
+    dependencies:
+      react: 19.1.1
+    optionalDependencies:
+      '@types/react': 19.1.16
+
+  '@radix-ui/react-context-menu@2.2.16(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-menu': 2.1.16(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-menu': 2.1.16(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
 
   '@radix-ui/react-context@1.1.0(@types/react@19.1.13)(react@19.1.1)':
     dependencies:
@@ -14970,27 +15221,33 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
-  '@radix-ui/react-dialog@1.1.15(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-context@1.1.2(@types/react@19.1.16)(react@19.1.1)':
+    dependencies:
+      react: 19.1.1
+    optionalDependencies:
+      '@types/react': 19.1.16
+
+  '@radix-ui/react-dialog@1.1.15(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
       aria-hidden: 1.2.6
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
-      react-remove-scroll: 2.7.1(@types/react@19.1.13)(react@19.1.1)
+      react-remove-scroll: 2.7.1(@types/react@19.1.16)(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
 
   '@radix-ui/react-direction@1.1.0(@types/react@19.1.13)(react@19.1.1)':
     dependencies:
@@ -15004,6 +15261,12 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
+  '@radix-ui/react-direction@1.1.1(@types/react@19.1.16)(react@19.1.1)':
+    dependencies:
+      react: 19.1.1
+    optionalDependencies:
+      '@types/react': 19.1.16
+
   '@radix-ui/react-dismissable-layer@1.1.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.0
@@ -15030,20 +15293,33 @@ snapshots:
       '@types/react': 19.1.13
       '@types/react-dom': 19.1.9(@types/react@19.1.13)
 
-  '@radix-ui/react-dropdown-menu@2.1.16(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-dismissable-layer@1.1.11(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-menu': 2.1.16(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-escape-keydown': 1.1.1(@types/react@19.1.16)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+
+  '@radix-ui/react-dropdown-menu@2.1.16(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-menu': 2.1.16(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
+      react: 19.1.1
+      react-dom: 19.1.1(react@19.1.1)
+    optionalDependencies:
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
 
   '@radix-ui/react-focus-guards@1.1.1(@types/react@19.1.13)(react@19.1.1)':
     dependencies:
@@ -15057,6 +15333,12 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
+  '@radix-ui/react-focus-guards@1.1.3(@types/react@19.1.16)(react@19.1.1)':
+    dependencies:
+      react: 19.1.1
+    optionalDependencies:
+      '@types/react': 19.1.16
+
   '@radix-ui/react-focus-scope@1.1.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.1.13)(react@19.1.1)
@@ -15079,22 +15361,33 @@ snapshots:
       '@types/react': 19.1.13
       '@types/react-dom': 19.1.9(@types/react@19.1.13)
 
-  '@radix-ui/react-hover-card@1.1.15(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-focus-scope@1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+    dependencies:
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      react: 19.1.1
+      react-dom: 19.1.1(react@19.1.1)
+    optionalDependencies:
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+
+  '@radix-ui/react-hover-card@1.1.15(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
 
   '@radix-ui/react-icons@1.3.2(react@19.1.1)':
     dependencies:
@@ -15114,63 +15407,70 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
-  '@radix-ui/react-label@2.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-id@1.1.1(@types/react@19.1.16)(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      react: 19.1.1
+    optionalDependencies:
+      '@types/react': 19.1.16
+
+  '@radix-ui/react-label@2.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+    dependencies:
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
 
-  '@radix-ui/react-menu@2.1.16(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-menu@2.1.16(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.16)(react@19.1.1)
       aria-hidden: 1.2.6
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
-      react-remove-scroll: 2.7.1(@types/react@19.1.13)(react@19.1.1)
+      react-remove-scroll: 2.7.1(@types/react@19.1.16)(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
 
-  '@radix-ui/react-popover@1.1.15(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-popover@1.1.15(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
       aria-hidden: 1.2.6
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
-      react-remove-scroll: 2.7.1(@types/react@19.1.13)(react@19.1.1)
+      react-remove-scroll: 2.7.1(@types/react@19.1.16)(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
 
   '@radix-ui/react-popover@1.1.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
@@ -15231,6 +15531,24 @@ snapshots:
       '@types/react': 19.1.13
       '@types/react-dom': 19.1.9(@types/react@19.1.13)
 
+  '@radix-ui/react-popper@1.2.8(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+    dependencies:
+      '@floating-ui/react-dom': 2.1.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-arrow': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-rect': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/rect': 1.1.1
+      react: 19.1.1
+      react-dom: 19.1.1(react@19.1.1)
+    optionalDependencies:
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+
   '@radix-ui/react-portal@1.1.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
@@ -15251,6 +15569,16 @@ snapshots:
       '@types/react': 19.1.13
       '@types/react-dom': 19.1.9(@types/react@19.1.13)
 
+  '@radix-ui/react-portal@1.1.9(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+    dependencies:
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      react: 19.1.1
+      react-dom: 19.1.1(react@19.1.1)
+    optionalDependencies:
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+
   '@radix-ui/react-presence@1.1.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.1.13)(react@19.1.1)
@@ -15261,15 +15589,15 @@ snapshots:
       '@types/react': 19.1.13
       '@types/react-dom': 19.1.9(@types/react@19.1.13)
 
-  '@radix-ui/react-presence@1.1.5(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-presence@1.1.5(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.16)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
 
   '@radix-ui/react-primitive@2.0.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
@@ -15289,33 +15617,42 @@ snapshots:
       '@types/react': 19.1.13
       '@types/react-dom': 19.1.9(@types/react@19.1.13)
 
-  '@radix-ui/react-progress@1.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-primitive@2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.16)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
 
-  '@radix-ui/react-radio-group@1.3.8(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-progress@1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+    dependencies:
+      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      react: 19.1.1
+      react-dom: 19.1.1(react@19.1.1)
+    optionalDependencies:
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+
+  '@radix-ui/react-radio-group@1.3.8(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-size': 1.1.1(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@19.1.16)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
 
   '@radix-ui/react-roving-focus@1.1.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
@@ -15334,39 +15671,39 @@ snapshots:
       '@types/react': 19.1.13
       '@types/react-dom': 19.1.9(@types/react@19.1.13)
 
-  '@radix-ui/react-roving-focus@1.1.11(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-roving-focus@1.1.11(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
 
-  '@radix-ui/react-scroll-area@1.2.10(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-scroll-area@1.2.10(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/number': 1.1.1
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.16)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
 
   '@radix-ui/react-select@2.2.6(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
@@ -15397,33 +15734,62 @@ snapshots:
       '@types/react': 19.1.13
       '@types/react-dom': 19.1.9(@types/react@19.1.13)
 
-  '@radix-ui/react-separator@1.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-select@2.2.6(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/number': 1.1.1
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      aria-hidden: 1.2.6
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
+      react-remove-scroll: 2.7.1(@types/react@19.1.16)(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
 
-  '@radix-ui/react-slider@1.3.6(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-separator@1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+    dependencies:
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      react: 19.1.1
+      react-dom: 19.1.1(react@19.1.1)
+    optionalDependencies:
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+
+  '@radix-ui/react-slider@1.3.6(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/number': 1.1.1
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-size': 1.1.1(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@19.1.16)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
 
   '@radix-ui/react-slot@1.1.0(@types/react@19.1.13)(react@19.1.1)':
     dependencies:
@@ -15439,56 +15805,63 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
-  '@radix-ui/react-switch@1.2.6(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-slot@1.2.3(@types/react@19.1.16)(react@19.1.1)':
+    dependencies:
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      react: 19.1.1
+    optionalDependencies:
+      '@types/react': 19.1.16
+
+  '@radix-ui/react-switch@1.2.6(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-size': 1.1.1(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@19.1.16)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
 
-  '@radix-ui/react-tabs@1.1.13(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-tabs@1.1.13(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
 
-  '@radix-ui/react-toast@1.2.15(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-toast@1.2.15(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
 
   '@radix-ui/react-toggle-group@1.1.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
@@ -15505,20 +15878,20 @@ snapshots:
       '@types/react': 19.1.13
       '@types/react-dom': 19.1.9(@types/react@19.1.13)
 
-  '@radix-ui/react-toggle-group@1.1.11(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-toggle-group@1.1.11(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-toggle': 1.1.10(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-toggle': 1.1.10(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
 
   '@radix-ui/react-toggle@1.1.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
@@ -15531,36 +15904,36 @@ snapshots:
       '@types/react': 19.1.13
       '@types/react-dom': 19.1.9(@types/react@19.1.13)
 
-  '@radix-ui/react-toggle@1.1.10(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-toggle@1.1.10(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
 
-  '@radix-ui/react-tooltip@1.2.8(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-tooltip@1.2.8(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
 
   '@radix-ui/react-use-callback-ref@1.1.0(@types/react@19.1.13)(react@19.1.1)':
     dependencies:
@@ -15574,6 +15947,12 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
+  '@radix-ui/react-use-callback-ref@1.1.1(@types/react@19.1.16)(react@19.1.1)':
+    dependencies:
+      react: 19.1.1
+    optionalDependencies:
+      '@types/react': 19.1.16
+
   '@radix-ui/react-use-controllable-state@1.1.0(@types/react@19.1.13)(react@19.1.1)':
     dependencies:
       '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.13)(react@19.1.1)
@@ -15589,6 +15968,14 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
+  '@radix-ui/react-use-controllable-state@1.2.2(@types/react@19.1.16)(react@19.1.1)':
+    dependencies:
+      '@radix-ui/react-use-effect-event': 0.0.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      react: 19.1.1
+    optionalDependencies:
+      '@types/react': 19.1.16
+
   '@radix-ui/react-use-effect-event@0.0.2(@types/react@19.1.13)(react@19.1.1)':
     dependencies:
       '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.13)(react@19.1.1)
@@ -15596,6 +15983,13 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
+  '@radix-ui/react-use-effect-event@0.0.2(@types/react@19.1.16)(react@19.1.1)':
+    dependencies:
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      react: 19.1.1
+    optionalDependencies:
+      '@types/react': 19.1.16
+
   '@radix-ui/react-use-escape-keydown@1.1.0(@types/react@19.1.13)(react@19.1.1)':
     dependencies:
       '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.13)(react@19.1.1)
@@ -15610,12 +16004,19 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
-  '@radix-ui/react-use-is-hydrated@0.1.0(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-use-escape-keydown@1.1.1(@types/react@19.1.16)(react@19.1.1)':
+    dependencies:
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      react: 19.1.1
+    optionalDependencies:
+      '@types/react': 19.1.16
+
+  '@radix-ui/react-use-is-hydrated@0.1.0(@types/react@19.1.16)(react@19.1.1)':
     dependencies:
       react: 19.1.1
       use-sync-external-store: 1.5.0(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.16
 
   '@radix-ui/react-use-layout-effect@1.1.0(@types/react@19.1.13)(react@19.1.1)':
     dependencies:
@@ -15629,12 +16030,24 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
+  '@radix-ui/react-use-layout-effect@1.1.1(@types/react@19.1.16)(react@19.1.1)':
+    dependencies:
+      react: 19.1.1
+    optionalDependencies:
+      '@types/react': 19.1.16
+
   '@radix-ui/react-use-previous@1.1.1(@types/react@19.1.13)(react@19.1.1)':
     dependencies:
       react: 19.1.1
     optionalDependencies:
       '@types/react': 19.1.13
 
+  '@radix-ui/react-use-previous@1.1.1(@types/react@19.1.16)(react@19.1.1)':
+    dependencies:
+      react: 19.1.1
+    optionalDependencies:
+      '@types/react': 19.1.16
+
   '@radix-ui/react-use-rect@1.1.0(@types/react@19.1.13)(react@19.1.1)':
     dependencies:
       '@radix-ui/rect': 1.1.0
@@ -15649,6 +16062,13 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
+  '@radix-ui/react-use-rect@1.1.1(@types/react@19.1.16)(react@19.1.1)':
+    dependencies:
+      '@radix-ui/rect': 1.1.1
+      react: 19.1.1
+    optionalDependencies:
+      '@types/react': 19.1.16
+
   '@radix-ui/react-use-size@1.1.0(@types/react@19.1.13)(react@19.1.1)':
     dependencies:
       '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.1.13)(react@19.1.1)
@@ -15663,6 +16083,13 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
+  '@radix-ui/react-use-size@1.1.1(@types/react@19.1.16)(react@19.1.1)':
+    dependencies:
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      react: 19.1.1
+    optionalDependencies:
+      '@types/react': 19.1.16
+
   '@radix-ui/react-visually-hidden@1.2.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
@@ -15672,23 +16099,32 @@ snapshots:
       '@types/react': 19.1.13
       '@types/react-dom': 19.1.9(@types/react@19.1.13)
 
+  '@radix-ui/react-visually-hidden@1.2.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+    dependencies:
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      react: 19.1.1
+      react-dom: 19.1.1(react@19.1.1)
+    optionalDependencies:
+      '@types/react': 19.1.16
+      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+
   '@radix-ui/rect@1.1.0': {}
 
   '@radix-ui/rect@1.1.1': {}
 
-  '@react-scan/vite-plugin-react-scan@0.1.8(react-scan@0.4.3(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react-router-dom@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react-router@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react@19.1.1)(rollup@2.79.2))(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))':
+  '@react-scan/vite-plugin-react-scan@0.1.8(react-scan@0.4.3(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react-router-dom@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react-router@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react@19.1.1)(rollup@2.79.2))(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
       '@babel/core': 7.28.4
       '@babel/plugin-transform-react-jsx': 7.27.1(@babel/core@7.28.4)
       '@babel/preset-typescript': 7.27.1(@babel/core@7.28.4)
       babel-plugin-add-react-displayname: 0.0.5
       cheerio: 1.1.2
-      react-scan: 0.4.3(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react-router-dom@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react-router@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react@19.1.1)(rollup@2.79.2)
-      vite: 7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
+      react-scan: 0.4.3(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react-router-dom@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react-router@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react@19.1.1)(rollup@2.79.2)
+      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - supports-color
 
-  '@reduxjs/toolkit@2.9.0(react-redux@9.2.0(@types/react@19.1.13)(react@19.1.1)(redux@5.0.1))(react@19.1.1)':
+  '@reduxjs/toolkit@2.9.0(react-redux@9.2.0(@types/react@19.1.16)(react@19.1.1)(redux@5.0.1))(react@19.1.1)':
     dependencies:
       '@standard-schema/spec': 1.0.0
       '@standard-schema/utils': 0.3.0
@@ -15698,13 +16134,13 @@ snapshots:
       reselect: 5.1.1
     optionalDependencies:
       react: 19.1.1
-      react-redux: 9.2.0(@types/react@19.1.13)(react@19.1.1)(redux@5.0.1)
+      react-redux: 9.2.0(@types/react@19.1.16)(react@19.1.1)(redux@5.0.1)
 
   '@remirror/core-constants@3.0.0': {}
 
   '@rolldown/pluginutils@1.0.0-beta.27': {}
 
-  '@rolldown/pluginutils@1.0.0-beta.35': {}
+  '@rolldown/pluginutils@1.0.0-beta.38': {}
 
   '@rollup/plugin-babel@5.3.1(@babel/core@7.28.4)(@types/babel__core@7.20.5)(rollup@2.79.2)':
     dependencies:
@@ -15764,69 +16200,135 @@ snapshots:
   '@rollup/rollup-android-arm-eabi@4.52.2':
     optional: true
 
+  '@rollup/rollup-android-arm-eabi@4.52.3':
+    optional: true
+
   '@rollup/rollup-android-arm64@4.52.2':
     optional: true
 
+  '@rollup/rollup-android-arm64@4.52.3':
+    optional: true
+
   '@rollup/rollup-darwin-arm64@4.52.2':
     optional: true
 
+  '@rollup/rollup-darwin-arm64@4.52.3':
+    optional: true
+
   '@rollup/rollup-darwin-x64@4.52.2':
     optional: true
 
+  '@rollup/rollup-darwin-x64@4.52.3':
+    optional: true
+
   '@rollup/rollup-freebsd-arm64@4.52.2':
     optional: true
 
+  '@rollup/rollup-freebsd-arm64@4.52.3':
+    optional: true
+
   '@rollup/rollup-freebsd-x64@4.52.2':
     optional: true
 
+  '@rollup/rollup-freebsd-x64@4.52.3':
+    optional: true
+
   '@rollup/rollup-linux-arm-gnueabihf@4.52.2':
     optional: true
 
+  '@rollup/rollup-linux-arm-gnueabihf@4.52.3':
+    optional: true
+
   '@rollup/rollup-linux-arm-musleabihf@4.52.2':
     optional: true
 
+  '@rollup/rollup-linux-arm-musleabihf@4.52.3':
+    optional: true
+
   '@rollup/rollup-linux-arm64-gnu@4.52.2':
     optional: true
 
+  '@rollup/rollup-linux-arm64-gnu@4.52.3':
+    optional: true
+
   '@rollup/rollup-linux-arm64-musl@4.52.2':
     optional: true
 
+  '@rollup/rollup-linux-arm64-musl@4.52.3':
+    optional: true
+
   '@rollup/rollup-linux-loong64-gnu@4.52.2':
     optional: true
 
+  '@rollup/rollup-linux-loong64-gnu@4.52.3':
+    optional: true
+
   '@rollup/rollup-linux-ppc64-gnu@4.52.2':
     optional: true
 
+  '@rollup/rollup-linux-ppc64-gnu@4.52.3':
+    optional: true
+
   '@rollup/rollup-linux-riscv64-gnu@4.52.2':
     optional: true
 
+  '@rollup/rollup-linux-riscv64-gnu@4.52.3':
+    optional: true
+
   '@rollup/rollup-linux-riscv64-musl@4.52.2':
     optional: true
 
+  '@rollup/rollup-linux-riscv64-musl@4.52.3':
+    optional: true
+
   '@rollup/rollup-linux-s390x-gnu@4.52.2':
     optional: true
 
+  '@rollup/rollup-linux-s390x-gnu@4.52.3':
+    optional: true
+
   '@rollup/rollup-linux-x64-gnu@4.52.2':
     optional: true
 
+  '@rollup/rollup-linux-x64-gnu@4.52.3':
+    optional: true
+
   '@rollup/rollup-linux-x64-musl@4.52.2':
     optional: true
 
+  '@rollup/rollup-linux-x64-musl@4.52.3':
+    optional: true
+
   '@rollup/rollup-openharmony-arm64@4.52.2':
     optional: true
 
+  '@rollup/rollup-openharmony-arm64@4.52.3':
+    optional: true
+
   '@rollup/rollup-win32-arm64-msvc@4.52.2':
     optional: true
 
+  '@rollup/rollup-win32-arm64-msvc@4.52.3':
+    optional: true
+
   '@rollup/rollup-win32-ia32-msvc@4.52.2':
     optional: true
 
+  '@rollup/rollup-win32-ia32-msvc@4.52.3':
+    optional: true
+
   '@rollup/rollup-win32-x64-gnu@4.52.2':
     optional: true
 
+  '@rollup/rollup-win32-x64-gnu@4.52.3':
+    optional: true
+
   '@rollup/rollup-win32-x64-msvc@4.52.2':
     optional: true
 
+  '@rollup/rollup-win32-x64-msvc@4.52.3':
+    optional: true
+
   '@rrweb/record@2.0.0-alpha.18':
     dependencies:
       '@rrweb/types': 2.0.0-alpha.18
@@ -15915,7 +16417,7 @@ snapshots:
     dependencies:
       '@babel/core': 7.28.4
       '@sentry/babel-plugin-component-annotate': 3.6.1
-      '@sentry/cli': 2.55.0
+      '@sentry/cli': 2.56.0
       dotenv: 16.6.1
       find-up: 5.0.0
       glob: 9.3.5
@@ -15928,27 +16430,51 @@ snapshots:
   '@sentry/cli-darwin@2.55.0':
     optional: true
 
+  '@sentry/cli-darwin@2.56.0':
+    optional: true
+
   '@sentry/cli-linux-arm64@2.55.0':
     optional: true
 
+  '@sentry/cli-linux-arm64@2.56.0':
+    optional: true
+
   '@sentry/cli-linux-arm@2.55.0':
     optional: true
 
+  '@sentry/cli-linux-arm@2.56.0':
+    optional: true
+
   '@sentry/cli-linux-i686@2.55.0':
     optional: true
 
+  '@sentry/cli-linux-i686@2.56.0':
+    optional: true
+
   '@sentry/cli-linux-x64@2.55.0':
     optional: true
 
+  '@sentry/cli-linux-x64@2.56.0':
+    optional: true
+
   '@sentry/cli-win32-arm64@2.55.0':
     optional: true
 
+  '@sentry/cli-win32-arm64@2.56.0':
+    optional: true
+
   '@sentry/cli-win32-i686@2.55.0':
     optional: true
 
+  '@sentry/cli-win32-i686@2.56.0':
+    optional: true
+
   '@sentry/cli-win32-x64@2.55.0':
     optional: true
 
+  '@sentry/cli-win32-x64@2.56.0':
+    optional: true
+
   '@sentry/cli@2.55.0':
     dependencies:
       https-proxy-agent: 5.0.1
@@ -15969,6 +16495,26 @@ snapshots:
       - encoding
       - supports-color
 
+  '@sentry/cli@2.56.0':
+    dependencies:
+      https-proxy-agent: 5.0.1
+      node-fetch: 2.7.0
+      progress: 2.0.3
+      proxy-from-env: 1.1.0
+      which: 2.0.2
+    optionalDependencies:
+      '@sentry/cli-darwin': 2.56.0
+      '@sentry/cli-linux-arm': 2.56.0
+      '@sentry/cli-linux-arm64': 2.56.0
+      '@sentry/cli-linux-i686': 2.56.0
+      '@sentry/cli-linux-x64': 2.56.0
+      '@sentry/cli-win32-arm64': 2.56.0
+      '@sentry/cli-win32-i686': 2.56.0
+      '@sentry/cli-win32-x64': 2.56.0
+    transitivePeerDependencies:
+      - encoding
+      - supports-color
+
   '@sentry/core@9.46.0': {}
 
   '@sentry/node-core@9.46.0(@opentelemetry/api@1.9.0)(@opentelemetry/context-async-hooks@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/core@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/instrumentation@0.57.2(@opentelemetry/api@1.9.0))(@opentelemetry/resources@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@1.30.1(@opentelemetry/api@1.9.0))(@opentelemetry/semantic-conventions@1.37.0)':
@@ -16471,50 +17017,50 @@ snapshots:
 
   '@standard-schema/utils@0.3.0': {}
 
-  '@storybook/addon-a11y@9.1.8(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))':
+  '@storybook/addon-a11y@9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
     dependencies:
       '@storybook/global': 5.0.0
       axe-core: 4.10.3
-      storybook: 9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
 
-  '@storybook/addon-docs@9.1.8(@types/react@19.1.13)(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))':
+  '@storybook/addon-docs@9.1.10(@types/react@19.1.16)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
     dependencies:
-      '@mdx-js/react': 3.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@storybook/csf-plugin': 9.1.8(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))
+      '@mdx-js/react': 3.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@storybook/csf-plugin': 9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
       '@storybook/icons': 1.6.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@storybook/react-dom-shim': 9.1.8(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))
+      '@storybook/react-dom-shim': 9.1.10(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
-      storybook: 9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       ts-dedent: 2.2.0
     transitivePeerDependencies:
       - '@types/react'
 
-  '@storybook/addon-vitest@9.1.8(@vitest/browser@3.2.4)(@vitest/runner@3.2.4)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))(vitest@3.2.4)':
+  '@storybook/addon-vitest@9.1.10(@vitest/browser@3.2.4)(@vitest/runner@3.2.4)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(vitest@3.2.4)':
     dependencies:
       '@storybook/global': 5.0.0
       '@storybook/icons': 1.6.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       prompts: 2.4.2
-      storybook: 9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       ts-dedent: 2.2.0
     optionalDependencies:
-      '@vitest/browser': 3.2.4(playwright@1.55.1)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))(vitest@3.2.4)
+      '@vitest/browser': 3.2.4(playwright@1.55.1)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)
       '@vitest/runner': 3.2.4
-      vitest: 3.2.4(@types/debug@4.1.12)(@types/node@24.5.2)(@vitest/browser@3.2.4)(jiti@2.6.0)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
+      vitest: 3.2.4(@types/debug@4.1.12)(@types/node@24.6.1)(@vitest/browser@3.2.4)(jiti@2.6.1)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - react
       - react-dom
 
-  '@storybook/builder-vite@9.1.8(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))':
+  '@storybook/builder-vite@9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
-      '@storybook/csf-plugin': 9.1.8(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))
-      storybook: 9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+      '@storybook/csf-plugin': 9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       ts-dedent: 2.2.0
-      vite: 7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
+      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
 
-  '@storybook/csf-plugin@9.1.8(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))':
+  '@storybook/csf-plugin@9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
     dependencies:
-      storybook: 9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       unplugin: 1.16.1
 
   '@storybook/global@5.0.0': {}
@@ -16524,41 +17070,41 @@ snapshots:
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
 
-  '@storybook/react-dom-shim@9.1.8(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))':
+  '@storybook/react-dom-shim@9.1.10(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
     dependencies:
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
-      storybook: 9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
 
-  '@storybook/react-vite@9.1.8(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(rollup@2.79.2)(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))(typescript@5.9.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))':
+  '@storybook/react-vite@9.1.10(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(rollup@2.79.2)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(typescript@5.9.3)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
-      '@joshwooding/vite-plugin-react-docgen-typescript': 0.6.1(typescript@5.9.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+      '@joshwooding/vite-plugin-react-docgen-typescript': 0.6.1(typescript@5.9.3)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@rollup/pluginutils': 5.3.0(rollup@2.79.2)
-      '@storybook/builder-vite': 9.1.8(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
-      '@storybook/react': 9.1.8(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))(typescript@5.9.2)
+      '@storybook/builder-vite': 9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      '@storybook/react': 9.1.10(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(typescript@5.9.3)
       find-up: 7.0.0
       magic-string: 0.30.19
       react: 19.1.1
       react-docgen: 8.0.1
       react-dom: 19.1.1(react@19.1.1)
       resolve: 1.22.10
-      storybook: 9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       tsconfig-paths: 4.2.0
-      vite: 7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
+      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - rollup
       - supports-color
       - typescript
 
-  '@storybook/react@9.1.8(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))(typescript@5.9.2)':
+  '@storybook/react@9.1.10(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(typescript@5.9.3)':
     dependencies:
       '@storybook/global': 5.0.0
-      '@storybook/react-dom-shim': 9.1.8(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)))
+      '@storybook/react-dom-shim': 9.1.10(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
-      storybook: 9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
     optionalDependencies:
-      typescript: 5.9.2
+      typescript: 5.9.3
 
   '@surma/rollup-plugin-off-main-thread@2.2.3':
     dependencies:
@@ -16628,11 +17174,17 @@ snapshots:
       typescript: 5.9.2
       zod: 4.1.8
 
+  '@t3-oss/env-core@0.13.8(arktype@2.1.20)(typescript@5.9.3)(zod@4.1.8)':
+    optionalDependencies:
+      arktype: 2.1.20
+      typescript: 5.9.3
+      zod: 4.1.8
+
   '@tailwindcss/node@4.1.13':
     dependencies:
       '@jridgewell/remapping': 2.3.5
       enhanced-resolve: 5.18.3
-      jiti: 2.6.0
+      jiti: 2.6.1
       lightningcss: 1.30.1
       magic-string: 0.30.19
       source-map-js: 1.2.1
@@ -16697,15 +17249,17 @@ snapshots:
       postcss-selector-parser: 6.0.10
       tailwindcss: 4.1.13
 
-  '@tailwindcss/vite@4.1.13(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))':
+  '@tailwindcss/vite@4.1.13(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
       '@tailwindcss/node': 4.1.13
       '@tailwindcss/oxide': 4.1.13
       tailwindcss: 4.1.13
-      vite: 7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
+      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
 
   '@tanstack/history@1.132.0': {}
 
+  '@tanstack/history@1.132.21': {}
+
   '@tanstack/query-core@5.87.4': {}
 
   '@tanstack/query-devtools@5.87.3': {}
@@ -16736,13 +17290,13 @@ snapshots:
       '@tanstack/query-core': 5.87.4
       react: 19.1.1
 
-  '@tanstack/react-router-devtools@1.132.6(@tanstack/react-router@1.132.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(@tanstack/router-core@1.132.6)(@types/node@24.5.2)(csstype@3.1.3)(jiti@2.6.0)(lightningcss@1.30.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.5)(yaml@2.8.1)':
+  '@tanstack/react-router-devtools@1.132.6(@tanstack/react-router@1.132.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(@tanstack/router-core@1.132.27)(@types/node@24.6.1)(csstype@3.1.3)(jiti@2.6.1)(lightningcss@1.30.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.6)(yaml@2.8.1)':
     dependencies:
       '@tanstack/react-router': 1.132.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@tanstack/router-devtools-core': 1.132.6(@tanstack/router-core@1.132.6)(@types/node@24.5.2)(csstype@3.1.3)(jiti@2.6.0)(lightningcss@1.30.1)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.5)(yaml@2.8.1)
+      '@tanstack/router-devtools-core': 1.132.6(@tanstack/router-core@1.132.27)(@types/node@24.6.1)(csstype@3.1.3)(jiti@2.6.1)(lightningcss@1.30.1)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.6)(yaml@2.8.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
-      vite: 7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
+      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - '@tanstack/router-core'
       - '@types/node'
@@ -16778,6 +17332,16 @@ snapshots:
       react-dom: 19.1.1(react@19.1.1)
       use-sync-external-store: 1.5.0(react@19.1.1)
 
+  '@tanstack/router-core@1.132.27':
+    dependencies:
+      '@tanstack/history': 1.132.21
+      '@tanstack/store': 0.7.7
+      cookie-es: 2.0.0
+      seroval: 1.3.2
+      seroval-plugins: 1.3.3(seroval@1.3.2)
+      tiny-invariant: 1.3.3
+      tiny-warning: 1.0.3
+
   '@tanstack/router-core@1.132.6':
     dependencies:
       '@tanstack/history': 1.132.0
@@ -16788,14 +17352,14 @@ snapshots:
       tiny-invariant: 1.3.3
       tiny-warning: 1.0.3
 
-  '@tanstack/router-devtools-core@1.132.6(@tanstack/router-core@1.132.6)(@types/node@24.5.2)(csstype@3.1.3)(jiti@2.6.0)(lightningcss@1.30.1)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.5)(yaml@2.8.1)':
+  '@tanstack/router-devtools-core@1.132.6(@tanstack/router-core@1.132.27)(@types/node@24.6.1)(csstype@3.1.3)(jiti@2.6.1)(lightningcss@1.30.1)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.6)(yaml@2.8.1)':
     dependencies:
-      '@tanstack/router-core': 1.132.6
+      '@tanstack/router-core': 1.132.27
       clsx: 2.1.1
       goober: 2.1.16(csstype@3.1.3)
       solid-js: 1.9.9
       tiny-invariant: 1.3.3
-      vite: 7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
+      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     optionalDependencies:
       csstype: 3.1.3
     transitivePeerDependencies:
@@ -16811,20 +17375,20 @@ snapshots:
       - tsx
       - yaml
 
-  '@tanstack/router-generator@1.132.6':
+  '@tanstack/router-generator@1.132.27':
     dependencies:
-      '@tanstack/router-core': 1.132.6
-      '@tanstack/router-utils': 1.132.0
-      '@tanstack/virtual-file-routes': 1.132.0
+      '@tanstack/router-core': 1.132.27
+      '@tanstack/router-utils': 1.132.21
+      '@tanstack/virtual-file-routes': 1.132.21
       prettier: 3.6.2
       recast: 0.23.11
       source-map: 0.7.6
-      tsx: 4.20.5
+      tsx: 4.20.6
       zod: 3.25.76
     transitivePeerDependencies:
       - supports-color
 
-  '@tanstack/router-plugin@1.132.6(@tanstack/react-router@1.132.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))':
+  '@tanstack/router-plugin@1.132.27(@tanstack/react-router@1.132.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
       '@babel/core': 7.28.4
       '@babel/plugin-syntax-jsx': 7.27.1(@babel/core@7.28.4)
@@ -16832,27 +17396,27 @@ snapshots:
       '@babel/template': 7.27.2
       '@babel/traverse': 7.28.4
       '@babel/types': 7.28.4
-      '@tanstack/router-core': 1.132.6
-      '@tanstack/router-generator': 1.132.6
-      '@tanstack/router-utils': 1.132.0
-      '@tanstack/virtual-file-routes': 1.132.0
+      '@tanstack/router-core': 1.132.27
+      '@tanstack/router-generator': 1.132.27
+      '@tanstack/router-utils': 1.132.21
+      '@tanstack/virtual-file-routes': 1.132.21
       babel-dead-code-elimination: 1.0.10
       chokidar: 3.6.0
       unplugin: 2.3.10
       zod: 3.25.76
     optionalDependencies:
       '@tanstack/react-router': 1.132.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      vite: 7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
+      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - supports-color
 
-  '@tanstack/router-utils@1.132.0':
+  '@tanstack/router-utils@1.132.21':
     dependencies:
       '@babel/core': 7.28.4
       '@babel/generator': 7.28.3
       '@babel/parser': 7.28.4
       '@babel/preset-typescript': 7.27.1(@babel/core@7.28.4)
-      ansis: 4.1.0
+      ansis: 4.2.0
       diff: 8.0.2
       fast-glob: 3.3.3
       pathe: 2.0.3
@@ -16861,7 +17425,7 @@ snapshots:
 
   '@tanstack/store@0.7.7': {}
 
-  '@tanstack/virtual-file-routes@1.132.0': {}
+  '@tanstack/virtual-file-routes@1.132.21': {}
 
   '@testing-library/dom@10.4.1':
     dependencies:
@@ -16874,7 +17438,7 @@ snapshots:
       picocolors: 1.1.1
       pretty-format: 27.5.1
 
-  '@testing-library/jest-dom@6.8.0':
+  '@testing-library/jest-dom@6.9.0':
     dependencies:
       '@adobe/css-tools': 4.4.4
       aria-query: 5.3.2
@@ -16977,9 +17541,9 @@ snapshots:
       prosemirror-schema-list: 1.5.1
       prosemirror-state: 1.4.3
       prosemirror-tables: 1.8.1
-      prosemirror-trailing-node: 3.0.0(prosemirror-model@1.25.3)(prosemirror-state@1.4.3)(prosemirror-view@1.41.1)
+      prosemirror-trailing-node: 3.0.0(prosemirror-model@1.25.3)(prosemirror-state@1.4.3)(prosemirror-view@1.41.2)
       prosemirror-transform: 1.10.4
-      prosemirror-view: 1.41.1
+      prosemirror-view: 1.41.2
 
   '@tiptap/react@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
@@ -17121,17 +17685,17 @@ snapshots:
 
   '@types/mute-stream@0.0.4':
     dependencies:
-      '@types/node': 24.5.2
+      '@types/node': 22.18.8
 
   '@types/mysql@2.15.26':
     dependencies:
       '@types/node': 24.5.2
 
-  '@types/node@20.19.17':
+  '@types/node@20.19.19':
     dependencies:
       undici-types: 6.21.0
 
-  '@types/node@22.18.6':
+  '@types/node@22.18.8':
     dependencies:
       undici-types: 6.21.0
 
@@ -17139,6 +17703,10 @@ snapshots:
     dependencies:
       undici-types: 7.12.0
 
+  '@types/node@24.6.1':
+    dependencies:
+      undici-types: 7.13.0
+
   '@types/pako@2.0.4': {}
 
   '@types/papaparse@5.3.16':
@@ -17167,15 +17735,24 @@ snapshots:
   '@types/react-dom@19.1.9(@types/react@19.1.13)':
     dependencies:
       '@types/react': 19.1.13
+    optional: true
 
-  '@types/react-reconciler@0.28.9(@types/react@19.1.13)':
+  '@types/react-dom@19.1.9(@types/react@19.1.16)':
     dependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.16
+
+  '@types/react-reconciler@0.28.9(@types/react@19.1.16)':
+    dependencies:
+      '@types/react': 19.1.16
 
   '@types/react@19.1.13':
     dependencies:
       csstype: 3.1.3
 
+  '@types/react@19.1.16':
+    dependencies:
+      csstype: 3.1.3
+
   '@types/resolve@1.20.2': {}
 
   '@types/resolve@1.20.6': {}
@@ -17305,7 +17882,7 @@ snapshots:
       namespace-emitter: 2.0.1
       p-retry: 6.2.1
 
-  '@uppy/components@1.0.2':
+  '@uppy/components@1.0.3':
     dependencies:
       '@uppy/audio': 3.0.1(@uppy/core@5.0.2)
       '@uppy/core': 5.0.2
@@ -17416,9 +17993,9 @@ snapshots:
       p-queue: 8.1.1
       preact: 10.27.2
 
-  '@uppy/react@5.0.3(@uppy/core@5.0.2)(@uppy/dashboard@5.0.2(@uppy/core@5.0.2))(@uppy/screen-capture@5.0.1(@uppy/core@5.0.2))(@uppy/webcam@5.0.1(@uppy/core@5.0.2))(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@uppy/react@5.1.0(@uppy/core@5.0.2)(@uppy/dashboard@5.0.2(@uppy/core@5.0.2))(@uppy/screen-capture@5.0.1(@uppy/core@5.0.2))(@uppy/status-bar@5.0.1(@uppy/core@5.0.2))(@uppy/webcam@5.0.1(@uppy/core@5.0.2))(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@uppy/components': 1.0.2
+      '@uppy/components': 1.0.3
       '@uppy/core': 5.0.2
       '@uppy/utils': 7.0.2
       preact: 10.27.2
@@ -17428,6 +18005,7 @@ snapshots:
     optionalDependencies:
       '@uppy/dashboard': 5.0.2(@uppy/core@5.0.2)
       '@uppy/screen-capture': 5.0.1(@uppy/core@5.0.2)
+      '@uppy/status-bar': 5.0.1(@uppy/core@5.0.2)
       '@uppy/webcam': 5.0.1(@uppy/core@5.0.2)
 
   '@uppy/remote-sources@3.0.1(@uppy/core@5.0.2)':
@@ -17530,9 +18108,9 @@ snapshots:
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
 
-  '@vitejs/plugin-basic-ssl@2.1.0(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))':
+  '@vitejs/plugin-basic-ssl@2.1.0(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
-      vite: 7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
+      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
 
   '@vitejs/plugin-react@4.7.0(vite@5.4.20(@types/node@24.5.2)(lightningcss@1.30.1)(terser@5.44.0))':
     dependencies:
@@ -17546,28 +18124,28 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@vitejs/plugin-react@5.0.3(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))':
+  '@vitejs/plugin-react@5.0.4(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
       '@babel/core': 7.28.4
       '@babel/plugin-transform-react-jsx-self': 7.27.1(@babel/core@7.28.4)
       '@babel/plugin-transform-react-jsx-source': 7.27.1(@babel/core@7.28.4)
-      '@rolldown/pluginutils': 1.0.0-beta.35
+      '@rolldown/pluginutils': 1.0.0-beta.38
       '@types/babel__core': 7.20.5
       react-refresh: 0.17.0
-      vite: 7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
+      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - supports-color
 
-  '@vitest/browser@3.2.4(playwright@1.55.1)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))(vitest@3.2.4)':
+  '@vitest/browser@3.2.4(playwright@1.55.1)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)':
     dependencies:
       '@testing-library/dom': 10.4.1
       '@testing-library/user-event': 14.6.1(@testing-library/dom@10.4.1)
-      '@vitest/mocker': 3.2.4(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+      '@vitest/mocker': 3.2.4(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@vitest/utils': 3.2.4
       magic-string: 0.30.19
       sirv: 3.0.2
       tinyrainbow: 2.0.0
-      vitest: 3.2.4(@types/debug@4.1.12)(@types/node@24.5.2)(@vitest/browser@3.2.4)(jiti@2.6.0)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
+      vitest: 3.2.4(@types/debug@4.1.12)(@types/node@24.6.1)(@vitest/browser@3.2.4)(jiti@2.6.1)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
       ws: 8.18.3
     optionalDependencies:
       playwright: 1.55.1
@@ -17592,9 +18170,9 @@ snapshots:
       std-env: 3.9.0
       test-exclude: 7.0.1
       tinyrainbow: 2.0.0
-      vitest: 3.2.4(@types/debug@4.1.12)(@types/node@24.5.2)(@vitest/browser@3.2.4)(jiti@2.6.0)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
+      vitest: 3.2.4(@types/debug@4.1.12)(@types/node@24.6.1)(@vitest/browser@3.2.4)(jiti@2.6.1)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     optionalDependencies:
-      '@vitest/browser': 3.2.4(playwright@1.55.1)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))(vitest@3.2.4)
+      '@vitest/browser': 3.2.4(playwright@1.55.1)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)
     transitivePeerDependencies:
       - supports-color
 
@@ -17606,13 +18184,13 @@ snapshots:
       chai: 5.3.3
       tinyrainbow: 2.0.0
 
-  '@vitest/mocker@3.2.4(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))':
+  '@vitest/mocker@3.2.4(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
       '@vitest/spy': 3.2.4
       estree-walker: 3.0.3
       magic-string: 0.30.19
     optionalDependencies:
-      vite: 7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
+      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
 
   '@vitest/pretty-format@3.2.4':
     dependencies:
@@ -17622,7 +18200,7 @@ snapshots:
     dependencies:
       '@vitest/utils': 3.2.4
       pathe: 2.0.3
-      strip-literal: 3.0.0
+      strip-literal: 3.1.0
 
   '@vitest/snapshot@3.2.4':
     dependencies:
@@ -17693,11 +18271,11 @@ snapshots:
       csstype: 3.1.3
     optional: true
 
-  '@vue/server-renderer@3.5.13(vue@3.5.13(typescript@5.9.2))':
+  '@vue/server-renderer@3.5.13(vue@3.5.13(typescript@5.9.3))':
     dependencies:
       '@vue/compiler-ssr': 3.5.13
       '@vue/shared': 3.5.13
-      vue: 3.5.13(typescript@5.9.2)
+      vue: 3.5.13(typescript@5.9.3)
     optional: true
 
   '@vue/shared@3.5.13':
@@ -17762,7 +18340,7 @@ snapshots:
 
   ansi-styles@6.2.3: {}
 
-  ansis@4.1.0: {}
+  ansis@4.2.0: {}
 
   any-promise@1.3.0: {}
 
@@ -17846,7 +18424,7 @@ snapshots:
   autoprefixer@10.4.21(postcss@8.5.6):
     dependencies:
       browserslist: 4.26.2
-      caniuse-lite: 1.0.30001745
+      caniuse-lite: 1.0.30001746
       fraction.js: 4.3.7
       normalize-range: 0.1.2
       picocolors: 1.1.1
@@ -17928,7 +18506,7 @@ snapshots:
 
   base64-js@1.5.1: {}
 
-  baseline-browser-mapping@2.8.7: {}
+  baseline-browser-mapping@2.8.9: {}
 
   bcp-47-match@2.0.3: {}
 
@@ -17946,9 +18524,9 @@ snapshots:
 
   bintrees@1.0.2: {}
 
-  bippy@0.3.27(@types/react@19.1.13)(react@19.1.1):
+  bippy@0.3.27(@types/react@19.1.16)(react@19.1.1):
     dependencies:
-      '@types/react-reconciler': 0.28.9(@types/react@19.1.13)
+      '@types/react-reconciler': 0.28.9(@types/react@19.1.16)
       react: 19.1.1
     transitivePeerDependencies:
       - '@types/react'
@@ -17981,9 +18559,9 @@ snapshots:
 
   browserslist@4.26.2:
     dependencies:
-      baseline-browser-mapping: 2.8.7
-      caniuse-lite: 1.0.30001745
-      electron-to-chromium: 1.5.223
+      baseline-browser-mapping: 2.8.9
+      caniuse-lite: 1.0.30001746
+      electron-to-chromium: 1.5.228
       node-releases: 2.0.21
       update-browserslist-db: 1.1.3(browserslist@4.26.2)
 
@@ -18018,7 +18596,7 @@ snapshots:
       defu: 6.1.4
       dotenv: 16.6.1
       giget: 1.2.5
-      jiti: 2.6.0
+      jiti: 2.6.1
       mlly: 1.8.0
       ohash: 1.1.6
       pathe: 1.1.2
@@ -18056,7 +18634,7 @@ snapshots:
 
   camelcase-css@2.0.1: {}
 
-  caniuse-lite@1.0.30001745: {}
+  caniuse-lite@1.0.30001746: {}
 
   canvas-confetti@1.9.3: {}
 
@@ -18187,12 +18765,12 @@ snapshots:
 
   clsx@2.1.1: {}
 
-  cmdk@1.1.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
+  cmdk@1.1.1(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-dialog': 1.1.15(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-dialog': 1.1.15(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     transitivePeerDependencies:
@@ -18297,6 +18875,11 @@ snapshots:
       '@epic-web/invariant': 1.0.0
       cross-spawn: 7.0.6
 
+  cross-env@10.1.0:
+    dependencies:
+      '@epic-web/invariant': 1.0.0
+      cross-spawn: 7.0.6
+
   cross-fetch@4.0.0:
     dependencies:
       node-fetch: 2.7.0
@@ -18566,6 +19149,8 @@ snapshots:
 
   dotenv@17.2.2: {}
 
+  dotenv@17.2.3: {}
+
   drizzle-kit@0.30.3:
     dependencies:
       '@drizzle-team/brocli': 0.10.2
@@ -18627,7 +19212,7 @@ snapshots:
     dependencies:
       jake: 10.9.4
 
-  electron-to-chromium@1.5.223: {}
+  electron-to-chromium@1.5.228: {}
 
   embla-carousel-autoplay@8.6.0(embla-carousel@8.6.0):
     dependencies:
@@ -19253,6 +19838,8 @@ snapshots:
       - supports-color
     optional: true
 
+  generator-function@2.0.1: {}
+
   gensync@1.0.0-beta.2: {}
 
   get-caller-file@2.0.5: {}
@@ -19306,7 +19893,7 @@ snapshots:
   github-from-package@0.0.0:
     optional: true
 
-  gleap@14.8.8:
+  gleap@14.8.11:
     dependencies:
       '@floating-ui/dom': 1.7.4
       '@rrweb/record': 2.0.0-alpha.18
@@ -19713,6 +20300,12 @@ snapshots:
     optionalDependencies:
       typescript: 5.9.2
 
+  i18next@25.5.2(typescript@5.9.3):
+    dependencies:
+      '@babel/runtime': 7.28.4
+    optionalDependencies:
+      typescript: 5.9.3
+
   iconv-lite@0.4.24:
     dependencies:
       safer-buffer: 2.1.2
@@ -19839,9 +20432,10 @@ snapshots:
 
   is-fullwidth-code-point@3.0.0: {}
 
-  is-generator-function@1.1.0:
+  is-generator-function@1.1.2:
     dependencies:
       call-bound: 1.0.4
+      generator-function: 2.0.1
       get-proto: 1.0.1
       has-tostringtag: 1.0.2
       safe-regex-test: 1.1.0
@@ -19988,7 +20582,7 @@ snapshots:
 
   jiti@1.21.7: {}
 
-  jiti@2.6.0: {}
+  jiti@2.6.1: {}
 
   joi@18.0.1:
     dependencies:
@@ -20207,23 +20801,22 @@ snapshots:
 
   kleur@4.1.5: {}
 
-  knip@5.64.0(@types/node@24.5.2)(typescript@5.9.2):
+  knip@5.64.1(@types/node@24.6.1)(typescript@5.9.3):
     dependencies:
       '@nodelib/fs.walk': 1.2.8
-      '@types/node': 24.5.2
+      '@types/node': 24.6.1
       fast-glob: 3.3.3
       formatly: 0.3.0
-      jiti: 2.6.0
+      jiti: 2.6.1
       js-yaml: 4.1.0
       minimist: 1.2.8
-      oxc-resolver: 11.8.2
+      oxc-resolver: 11.8.4
       picocolors: 1.1.1
       picomatch: 4.0.3
       smol-toml: 1.4.2
       strip-json-comments: 5.0.2
-      typescript: 5.9.2
-      zod: 3.25.76
-      zod-validation-error: 3.5.3(zod@3.25.76)
+      typescript: 5.9.3
+      zod: 4.1.11
 
   leac@0.6.0: {}
 
@@ -20380,7 +20973,7 @@ snapshots:
 
   lru-cache@10.4.3: {}
 
-  lru-cache@11.2.1: {}
+  lru-cache@11.2.2: {}
 
   lru-cache@5.1.1:
     dependencies:
@@ -20563,9 +21156,9 @@ snapshots:
     transitivePeerDependencies:
       - react
 
-  merge-refs@1.3.0(@types/react@19.1.13):
+  merge-refs@1.3.0(@types/react@19.1.16):
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.16
 
   merge2@1.4.1: {}
 
@@ -21018,29 +21611,29 @@ snapshots:
       object-keys: 1.1.1
       safe-push-apply: 1.0.0
 
-  oxc-resolver@11.8.2:
+  oxc-resolver@11.8.4:
     dependencies:
       napi-postinstall: 0.3.3
     optionalDependencies:
-      '@oxc-resolver/binding-android-arm-eabi': 11.8.2
-      '@oxc-resolver/binding-android-arm64': 11.8.2
-      '@oxc-resolver/binding-darwin-arm64': 11.8.2
-      '@oxc-resolver/binding-darwin-x64': 11.8.2
-      '@oxc-resolver/binding-freebsd-x64': 11.8.2
-      '@oxc-resolver/binding-linux-arm-gnueabihf': 11.8.2
-      '@oxc-resolver/binding-linux-arm-musleabihf': 11.8.2
-      '@oxc-resolver/binding-linux-arm64-gnu': 11.8.2
-      '@oxc-resolver/binding-linux-arm64-musl': 11.8.2
-      '@oxc-resolver/binding-linux-ppc64-gnu': 11.8.2
-      '@oxc-resolver/binding-linux-riscv64-gnu': 11.8.2
-      '@oxc-resolver/binding-linux-riscv64-musl': 11.8.2
-      '@oxc-resolver/binding-linux-s390x-gnu': 11.8.2
-      '@oxc-resolver/binding-linux-x64-gnu': 11.8.2
-      '@oxc-resolver/binding-linux-x64-musl': 11.8.2
-      '@oxc-resolver/binding-wasm32-wasi': 11.8.2
-      '@oxc-resolver/binding-win32-arm64-msvc': 11.8.2
-      '@oxc-resolver/binding-win32-ia32-msvc': 11.8.2
-      '@oxc-resolver/binding-win32-x64-msvc': 11.8.2
+      '@oxc-resolver/binding-android-arm-eabi': 11.8.4
+      '@oxc-resolver/binding-android-arm64': 11.8.4
+      '@oxc-resolver/binding-darwin-arm64': 11.8.4
+      '@oxc-resolver/binding-darwin-x64': 11.8.4
+      '@oxc-resolver/binding-freebsd-x64': 11.8.4
+      '@oxc-resolver/binding-linux-arm-gnueabihf': 11.8.4
+      '@oxc-resolver/binding-linux-arm-musleabihf': 11.8.4
+      '@oxc-resolver/binding-linux-arm64-gnu': 11.8.4
+      '@oxc-resolver/binding-linux-arm64-musl': 11.8.4
+      '@oxc-resolver/binding-linux-ppc64-gnu': 11.8.4
+      '@oxc-resolver/binding-linux-riscv64-gnu': 11.8.4
+      '@oxc-resolver/binding-linux-riscv64-musl': 11.8.4
+      '@oxc-resolver/binding-linux-s390x-gnu': 11.8.4
+      '@oxc-resolver/binding-linux-x64-gnu': 11.8.4
+      '@oxc-resolver/binding-linux-x64-musl': 11.8.4
+      '@oxc-resolver/binding-wasm32-wasi': 11.8.4
+      '@oxc-resolver/binding-win32-arm64-msvc': 11.8.4
+      '@oxc-resolver/binding-win32-ia32-msvc': 11.8.4
+      '@oxc-resolver/binding-win32-x64-msvc': 11.8.4
 
   p-defer@3.0.0: {}
 
@@ -21130,7 +21723,7 @@ snapshots:
 
   path-scurry@2.0.0:
     dependencies:
-      lru-cache: 11.2.1
+      lru-cache: 11.2.2
       minipass: 7.1.2
 
   path-type@5.0.0: {}
@@ -21287,20 +21880,28 @@ snapshots:
       postcss: 8.5.6
       ts-node: 10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2)
 
-  postcss-load-config@6.0.1(jiti@2.6.0)(postcss@8.5.6)(tsx@4.20.3)(yaml@2.8.1):
+  postcss-load-config@4.0.2(postcss@8.5.6)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.6.1)(typescript@5.9.3)):
     dependencies:
       lilconfig: 3.1.3
+      yaml: 2.8.1
     optionalDependencies:
-      jiti: 2.6.0
+      postcss: 8.5.6
+      ts-node: 10.9.2(@swc/core@1.7.26)(@types/node@24.6.1)(typescript@5.9.3)
+
+  postcss-load-config@6.0.1(jiti@2.6.1)(postcss@8.5.6)(tsx@4.20.3)(yaml@2.8.1):
+    dependencies:
+      lilconfig: 3.1.3
+    optionalDependencies:
+      jiti: 2.6.1
       postcss: 8.5.6
       tsx: 4.20.3
       yaml: 2.8.1
 
-  postcss-load-config@6.0.1(jiti@2.6.0)(postcss@8.5.6)(tsx@4.20.5)(yaml@2.8.1):
+  postcss-load-config@6.0.1(jiti@2.6.1)(postcss@8.5.6)(tsx@4.20.5)(yaml@2.8.1):
     dependencies:
       lilconfig: 3.1.3
     optionalDependencies:
-      jiti: 2.6.0
+      jiti: 2.6.1
       postcss: 8.5.6
       tsx: 4.20.5
       yaml: 2.8.1
@@ -21424,16 +22025,16 @@ snapshots:
     dependencies:
       prosemirror-state: 1.4.3
       prosemirror-transform: 1.10.4
-      prosemirror-view: 1.41.1
+      prosemirror-view: 1.41.2
 
   prosemirror-gapcursor@1.3.2:
     dependencies:
       prosemirror-keymap: 1.2.3
       prosemirror-model: 1.25.3
       prosemirror-state: 1.4.3
-      prosemirror-view: 1.41.1
+      prosemirror-view: 1.41.2
 
-  prosemirror-highlight@0.13.0(@shikijs/types@3.2.1)(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)(prosemirror-model@1.25.3)(prosemirror-state@1.4.3)(prosemirror-transform@1.10.4)(prosemirror-view@1.41.1):
+  prosemirror-highlight@0.13.0(@shikijs/types@3.2.1)(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)(prosemirror-model@1.25.3)(prosemirror-state@1.4.3)(prosemirror-transform@1.10.4)(prosemirror-view@1.41.2):
     optionalDependencies:
       '@shikijs/types': 3.2.1
       '@types/hast': 3.0.4
@@ -21442,13 +22043,13 @@ snapshots:
       prosemirror-model: 1.25.3
       prosemirror-state: 1.4.3
       prosemirror-transform: 1.10.4
-      prosemirror-view: 1.41.1
+      prosemirror-view: 1.41.2
 
   prosemirror-history@1.4.1:
     dependencies:
       prosemirror-state: 1.4.3
       prosemirror-transform: 1.10.4
-      prosemirror-view: 1.41.1
+      prosemirror-view: 1.41.2
       rope-sequence: 1.3.4
 
   prosemirror-inputrules@1.5.0:
@@ -21492,7 +22093,7 @@ snapshots:
     dependencies:
       prosemirror-model: 1.25.3
       prosemirror-transform: 1.10.4
-      prosemirror-view: 1.41.1
+      prosemirror-view: 1.41.2
 
   prosemirror-tables@1.8.1:
     dependencies:
@@ -21500,21 +22101,21 @@ snapshots:
       prosemirror-model: 1.25.3
       prosemirror-state: 1.4.3
       prosemirror-transform: 1.10.4
-      prosemirror-view: 1.41.1
+      prosemirror-view: 1.41.2
 
-  prosemirror-trailing-node@3.0.0(prosemirror-model@1.25.3)(prosemirror-state@1.4.3)(prosemirror-view@1.41.1):
+  prosemirror-trailing-node@3.0.0(prosemirror-model@1.25.3)(prosemirror-state@1.4.3)(prosemirror-view@1.41.2):
     dependencies:
       '@remirror/core-constants': 3.0.0
       escape-string-regexp: 4.0.0
       prosemirror-model: 1.25.3
       prosemirror-state: 1.4.3
-      prosemirror-view: 1.41.1
+      prosemirror-view: 1.41.2
 
   prosemirror-transform@1.10.4:
     dependencies:
       prosemirror-model: 1.25.3
 
-  prosemirror-view@1.41.1:
+  prosemirror-view@1.41.2:
     dependencies:
       prosemirror-model: 1.25.3
       prosemirror-state: 1.4.3
@@ -21603,9 +22204,9 @@ snapshots:
       date-fns-jalali: 4.1.0-0
       react: 19.1.1
 
-  react-docgen-typescript@2.4.0(typescript@5.9.2):
+  react-docgen-typescript@2.4.0(typescript@5.9.3):
     dependencies:
-      typescript: 5.9.2
+      typescript: 5.9.3
 
   react-docgen@8.0.1:
     dependencies:
@@ -21646,6 +22247,16 @@ snapshots:
       react-dom: 19.1.1(react@19.1.1)
       typescript: 5.9.2
 
+  react-i18next@15.7.4(i18next@25.5.2(typescript@5.9.3))(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(typescript@5.9.3):
+    dependencies:
+      '@babel/runtime': 7.28.4
+      html-parse-stringify: 3.0.1
+      i18next: 25.5.2(typescript@5.9.3)
+      react: 19.1.1
+    optionalDependencies:
+      react-dom: 19.1.1(react@19.1.1)
+      typescript: 5.9.3
+
   react-icons@5.5.0(react@19.1.1):
     dependencies:
       react: 19.1.1
@@ -21664,28 +22275,28 @@ snapshots:
 
   react-lazy-with-preload@2.2.1: {}
 
-  react-pdf@9.2.1(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
+  react-pdf@9.2.1(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
     dependencies:
       clsx: 2.1.1
       dequal: 2.0.3
       make-cancellable-promise: 1.3.2
       make-event-props: 1.6.2
-      merge-refs: 1.3.0(@types/react@19.1.13)
+      merge-refs: 1.3.0(@types/react@19.1.16)
       pdfjs-dist: 4.8.69
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
       tiny-invariant: 1.3.3
       warning: 4.0.3
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.16
 
-  react-redux@9.2.0(@types/react@19.1.13)(react@19.1.1)(redux@5.0.1):
+  react-redux@9.2.0(@types/react@19.1.16)(react@19.1.1)(redux@5.0.1):
     dependencies:
       '@types/use-sync-external-store': 0.0.6
       react: 19.1.1
       use-sync-external-store: 1.5.0(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.16
       redux: 5.0.1
 
   react-refresh@0.17.0: {}
@@ -21698,6 +22309,14 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
+  react-remove-scroll-bar@2.3.8(@types/react@19.1.16)(react@19.1.1):
+    dependencies:
+      react: 19.1.1
+      react-style-singleton: 2.2.3(@types/react@19.1.16)(react@19.1.1)
+      tslib: 2.8.1
+    optionalDependencies:
+      '@types/react': 19.1.16
+
   react-remove-scroll@2.6.0(@types/react@19.1.13)(react@19.1.1):
     dependencies:
       react: 19.1.1
@@ -21720,6 +22339,17 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
+  react-remove-scroll@2.7.1(@types/react@19.1.16)(react@19.1.1):
+    dependencies:
+      react: 19.1.1
+      react-remove-scroll-bar: 2.3.8(@types/react@19.1.16)(react@19.1.1)
+      react-style-singleton: 2.2.3(@types/react@19.1.16)(react@19.1.1)
+      tslib: 2.8.1
+      use-callback-ref: 1.3.3(@types/react@19.1.16)(react@19.1.1)
+      use-sidecar: 1.1.3(@types/react@19.1.16)(react@19.1.1)
+    optionalDependencies:
+      '@types/react': 19.1.16
+
   react-resizable-panels@3.0.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
     dependencies:
       react: 19.1.1
@@ -21740,7 +22370,7 @@ snapshots:
     optionalDependencies:
       react-dom: 19.1.1(react@19.1.1)
 
-  react-scan@0.4.3(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react-router-dom@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react-router@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react@19.1.1)(rollup@2.79.2):
+  react-scan@0.4.3(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react-router-dom@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react-router@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react@19.1.1)(rollup@2.79.2):
     dependencies:
       '@babel/core': 7.28.4
       '@babel/generator': 7.28.3
@@ -21750,8 +22380,8 @@ snapshots:
       '@pivanov/utils': 0.0.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@preact/signals': 1.3.2(preact@10.27.2)
       '@rollup/pluginutils': 5.3.0(rollup@2.79.2)
-      '@types/node': 20.19.17
-      bippy: 0.3.27(@types/react@19.1.13)(react@19.1.1)
+      '@types/node': 20.19.19
+      bippy: 0.3.27(@types/react@19.1.16)(react@19.1.1)
       esbuild: 0.25.10
       estree-walker: 3.0.3
       kleur: 4.1.5
@@ -21760,7 +22390,7 @@ snapshots:
       preact: 10.27.2
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
-      tsx: 4.20.5
+      tsx: 4.20.6
     optionalDependencies:
       react-router: 7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       react-router-dom: 7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
@@ -21778,6 +22408,14 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
+  react-style-singleton@2.2.3(@types/react@19.1.16)(react@19.1.1):
+    dependencies:
+      get-nonce: 1.0.1
+      react: 19.1.1
+      tslib: 2.8.1
+    optionalDependencies:
+      '@types/react': 19.1.16
+
   react-use-downloader@1.3.0(react@19.1.1):
     dependencies:
       react: 19.1.1
@@ -21810,9 +22448,9 @@ snapshots:
       tiny-invariant: 1.3.3
       tslib: 2.8.1
 
-  recharts@3.2.1(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react-is@18.3.1)(react@19.1.1)(redux@5.0.1):
+  recharts@3.2.1(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react-is@18.3.1)(react@19.1.1)(redux@5.0.1):
     dependencies:
-      '@reduxjs/toolkit': 2.9.0(react-redux@9.2.0(@types/react@19.1.13)(react@19.1.1)(redux@5.0.1))(react@19.1.1)
+      '@reduxjs/toolkit': 2.9.0(react-redux@9.2.0(@types/react@19.1.16)(react@19.1.1)(redux@5.0.1))(react@19.1.1)
       clsx: 2.1.1
       decimal.js-light: 2.5.1
       es-toolkit: 1.39.10
@@ -21821,7 +22459,7 @@ snapshots:
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
       react-is: 18.3.1
-      react-redux: 9.2.0(@types/react@19.1.13)(react@19.1.1)(redux@5.0.1)
+      react-redux: 9.2.0(@types/react@19.1.16)(react@19.1.1)(redux@5.0.1)
       reselect: 5.1.1
       tiny-invariant: 1.3.3
       use-sync-external-store: 1.5.0(react@19.1.1)
@@ -22198,6 +22836,34 @@ snapshots:
       '@rollup/rollup-win32-x64-msvc': 4.52.2
       fsevents: 2.3.3
 
+  rollup@4.52.3:
+    dependencies:
+      '@types/estree': 1.0.8
+    optionalDependencies:
+      '@rollup/rollup-android-arm-eabi': 4.52.3
+      '@rollup/rollup-android-arm64': 4.52.3
+      '@rollup/rollup-darwin-arm64': 4.52.3
+      '@rollup/rollup-darwin-x64': 4.52.3
+      '@rollup/rollup-freebsd-arm64': 4.52.3
+      '@rollup/rollup-freebsd-x64': 4.52.3
+      '@rollup/rollup-linux-arm-gnueabihf': 4.52.3
+      '@rollup/rollup-linux-arm-musleabihf': 4.52.3
+      '@rollup/rollup-linux-arm64-gnu': 4.52.3
+      '@rollup/rollup-linux-arm64-musl': 4.52.3
+      '@rollup/rollup-linux-loong64-gnu': 4.52.3
+      '@rollup/rollup-linux-ppc64-gnu': 4.52.3
+      '@rollup/rollup-linux-riscv64-gnu': 4.52.3
+      '@rollup/rollup-linux-riscv64-musl': 4.52.3
+      '@rollup/rollup-linux-s390x-gnu': 4.52.3
+      '@rollup/rollup-linux-x64-gnu': 4.52.3
+      '@rollup/rollup-linux-x64-musl': 4.52.3
+      '@rollup/rollup-openharmony-arm64': 4.52.3
+      '@rollup/rollup-win32-arm64-msvc': 4.52.3
+      '@rollup/rollup-win32-ia32-msvc': 4.52.3
+      '@rollup/rollup-win32-x64-gnu': 4.52.3
+      '@rollup/rollup-win32-x64-msvc': 4.52.3
+      fsevents: 2.3.3
+
   rope-sequence@1.3.4: {}
 
   rrdom@2.0.0-alpha.18:
@@ -22455,13 +23121,13 @@ snapshots:
       es-errors: 1.3.0
       internal-slot: 1.1.0
 
-  storybook@9.1.8(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)):
+  storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)):
     dependencies:
       '@storybook/global': 5.0.0
-      '@testing-library/jest-dom': 6.8.0
+      '@testing-library/jest-dom': 6.9.0
       '@testing-library/user-event': 14.6.1(@testing-library/dom@10.4.1)
       '@vitest/expect': 3.2.4
-      '@vitest/mocker': 3.2.4(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+      '@vitest/mocker': 3.2.4(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@vitest/spy': 3.2.4
       better-opn: 3.0.2
       esbuild: 0.25.10
@@ -22577,7 +23243,7 @@ snapshots:
 
   strip-json-comments@5.0.3: {}
 
-  strip-literal@3.0.0:
+  strip-literal@3.1.0:
     dependencies:
       js-tokens: 9.0.1
 
@@ -22618,9 +23284,9 @@ snapshots:
 
   tailwind-merge@3.3.1: {}
 
-  tailwindcss-animate@1.0.7(tailwindcss@3.4.17(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2))):
+  tailwindcss-animate@1.0.7(tailwindcss@3.4.17(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.6.1)(typescript@5.9.3))):
     dependencies:
-      tailwindcss: 3.4.17(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2))
+      tailwindcss: 3.4.17(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.6.1)(typescript@5.9.3))
 
   tailwindcss-animate@1.0.7(tailwindcss@4.1.13):
     dependencies:
@@ -22653,7 +23319,7 @@ snapshots:
     transitivePeerDependencies:
       - ts-node
 
-  tailwindcss@3.4.17(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2)):
+  tailwindcss@3.4.17(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.6.1)(typescript@5.9.3)):
     dependencies:
       '@alloc/quick-lru': 5.2.0
       arg: 5.0.2
@@ -22672,7 +23338,7 @@ snapshots:
       postcss: 8.5.6
       postcss-import: 15.1.0(postcss@8.5.6)
       postcss-js: 4.1.0(postcss@8.5.6)
-      postcss-load-config: 4.0.2(postcss@8.5.6)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2))
+      postcss-load-config: 4.0.2(postcss@8.5.6)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.6.1)(typescript@5.9.3))
       postcss-nested: 6.2.0(postcss@8.5.6)
       postcss-selector-parser: 6.1.2
       resolve: 1.22.10
@@ -22856,9 +23522,30 @@ snapshots:
       '@swc/core': 1.7.26
     optional: true
 
-  tsconfck@3.1.6(typescript@5.9.2):
+  ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.6.1)(typescript@5.9.3):
+    dependencies:
+      '@cspotcode/source-map-support': 0.8.1
+      '@tsconfig/node10': 1.0.11
+      '@tsconfig/node12': 1.0.11
+      '@tsconfig/node14': 1.0.3
+      '@tsconfig/node16': 1.0.4
+      '@types/node': 24.6.1
+      acorn: 8.15.0
+      acorn-walk: 8.3.4
+      arg: 4.1.3
+      create-require: 1.1.1
+      diff: 4.0.2
+      make-error: 1.3.6
+      typescript: 5.9.3
+      v8-compile-cache-lib: 3.0.1
+      yn: 3.1.1
     optionalDependencies:
-      typescript: 5.9.2
+      '@swc/core': 1.7.26
+    optional: true
+
+  tsconfck@3.1.6(typescript@5.9.3):
+    optionalDependencies:
+      typescript: 5.9.3
 
   tsconfig-paths@4.2.0:
     dependencies:
@@ -22868,7 +23555,7 @@ snapshots:
 
   tslib@2.8.1: {}
 
-  tsup@8.5.0(@swc/core@1.7.26)(jiti@2.6.0)(postcss@8.5.6)(tsx@4.20.3)(typescript@5.9.2)(yaml@2.8.1):
+  tsup@8.5.0(@swc/core@1.7.26)(jiti@2.6.1)(postcss@8.5.6)(tsx@4.20.3)(typescript@5.9.3)(yaml@2.8.1):
     dependencies:
       bundle-require: 5.1.0(esbuild@0.25.10)
       cac: 6.7.14
@@ -22879,7 +23566,7 @@ snapshots:
       fix-dts-default-cjs-exports: 1.0.1
       joycon: 3.1.1
       picocolors: 1.1.1
-      postcss-load-config: 6.0.1(jiti@2.6.0)(postcss@8.5.6)(tsx@4.20.3)(yaml@2.8.1)
+      postcss-load-config: 6.0.1(jiti@2.6.1)(postcss@8.5.6)(tsx@4.20.3)(yaml@2.8.1)
       resolve-from: 5.0.0
       rollup: 4.52.2
       source-map: 0.8.0-beta.0
@@ -22890,14 +23577,14 @@ snapshots:
     optionalDependencies:
       '@swc/core': 1.7.26
       postcss: 8.5.6
-      typescript: 5.9.2
+      typescript: 5.9.3
     transitivePeerDependencies:
       - jiti
       - supports-color
       - tsx
       - yaml
 
-  tsup@8.5.0(@swc/core@1.7.26)(jiti@2.6.0)(postcss@8.5.6)(tsx@4.20.5)(typescript@5.9.2)(yaml@2.8.1):
+  tsup@8.5.0(@swc/core@1.7.26)(jiti@2.6.1)(postcss@8.5.6)(tsx@4.20.5)(typescript@5.9.2)(yaml@2.8.1):
     dependencies:
       bundle-require: 5.1.0(esbuild@0.25.10)
       cac: 6.7.14
@@ -22908,7 +23595,7 @@ snapshots:
       fix-dts-default-cjs-exports: 1.0.1
       joycon: 3.1.1
       picocolors: 1.1.1
-      postcss-load-config: 6.0.1(jiti@2.6.0)(postcss@8.5.6)(tsx@4.20.5)(yaml@2.8.1)
+      postcss-load-config: 6.0.1(jiti@2.6.1)(postcss@8.5.6)(tsx@4.20.5)(yaml@2.8.1)
       resolve-from: 5.0.0
       rollup: 4.52.2
       source-map: 0.8.0-beta.0
@@ -22940,6 +23627,13 @@ snapshots:
     optionalDependencies:
       fsevents: 2.3.3
 
+  tsx@4.20.6:
+    dependencies:
+      esbuild: 0.25.10
+      get-tsconfig: 4.10.1
+    optionalDependencies:
+      fsevents: 2.3.3
+
   tunnel-agent@0.6.0:
     dependencies:
       safe-buffer: 5.2.1
@@ -23007,6 +23701,8 @@ snapshots:
 
   typescript@5.9.2: {}
 
+  typescript@5.9.3: {}
+
   ua-is-frozen@0.1.2: {}
 
   ua-parser-js@2.0.5:
@@ -23034,6 +23730,8 @@ snapshots:
 
   undici-types@7.12.0: {}
 
+  undici-types@7.13.0: {}
+
   undici@7.16.0: {}
 
   unicode-canonical-property-names-ecmascript@2.0.1: {}
@@ -23150,6 +23848,13 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
+  use-callback-ref@1.3.3(@types/react@19.1.16)(react@19.1.1):
+    dependencies:
+      react: 19.1.1
+      tslib: 2.8.1
+    optionalDependencies:
+      '@types/react': 19.1.16
+
   use-count-up@3.0.1(react@19.1.1):
     dependencies:
       react: 19.1.1
@@ -23167,6 +23872,14 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
+  use-sidecar@1.1.3(@types/react@19.1.16)(react@19.1.1):
+    dependencies:
+      detect-node-es: 1.1.0
+      react: 19.1.1
+      tslib: 2.8.1
+    optionalDependencies:
+      '@types/react': 19.1.16
+
   use-sync-external-store@1.5.0(react@19.1.1):
     dependencies:
       react: 19.1.1
@@ -23191,9 +23904,9 @@ snapshots:
 
   validate-npm-package-name@5.0.1: {}
 
-  vaul@1.1.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
+  vaul@1.1.2(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
     dependencies:
-      '@radix-ui/react-dialog': 1.1.15(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-dialog': 1.1.15(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     transitivePeerDependencies:
@@ -23238,20 +23951,20 @@ snapshots:
       d3-time: 3.1.0
       d3-timer: 3.0.1
 
-  virtua@0.43.4(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(solid-js@1.9.9)(vue@3.5.13(typescript@5.9.2)):
+  virtua@0.43.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(solid-js@1.9.9)(vue@3.5.13(typescript@5.9.3)):
     optionalDependencies:
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
       solid-js: 1.9.9
-      vue: 3.5.13(typescript@5.9.2)
+      vue: 3.5.13(typescript@5.9.3)
 
-  vite-node@3.2.4(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1):
+  vite-node@3.2.4(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1):
     dependencies:
       cac: 6.7.14
       debug: 4.4.3
       es-module-lexer: 1.7.0
       pathe: 2.0.3
-      vite: 7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
+      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - '@types/node'
       - jiti
@@ -23266,7 +23979,7 @@ snapshots:
       - tsx
       - yaml
 
-  vite-plugin-html@3.2.2(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)):
+  vite-plugin-html@3.2.2(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)):
     dependencies:
       '@rollup/pluginutils': 4.2.1
       colorette: 2.0.20
@@ -23280,35 +23993,35 @@ snapshots:
       html-minifier-terser: 6.1.0
       node-html-parser: 5.4.2
       pathe: 0.2.0
-      vite: 7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
+      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
 
-  vite-plugin-pwa@1.0.3(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))(workbox-build@7.3.0(@types/babel__core@7.20.5))(workbox-window@7.3.0):
+  vite-plugin-pwa@1.0.3(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(workbox-build@7.3.0(@types/babel__core@7.20.5))(workbox-window@7.3.0):
     dependencies:
       debug: 4.4.3
       pretty-bytes: 6.1.1
       tinyglobby: 0.2.15
-      vite: 7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
+      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
       workbox-build: 7.3.0(@types/babel__core@7.20.5)
       workbox-window: 7.3.0
     transitivePeerDependencies:
       - supports-color
 
-  vite-plugin-static-copy@3.1.2(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)):
+  vite-plugin-static-copy@3.1.3(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)):
     dependencies:
       chokidar: 3.6.0
       fs-extra: 11.3.2
       p-map: 7.0.3
       picocolors: 1.1.1
       tinyglobby: 0.2.15
-      vite: 7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
+      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
 
-  vite-tsconfig-paths@5.1.4(typescript@5.9.2)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)):
+  vite-tsconfig-paths@5.1.4(typescript@5.9.3)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)):
     dependencies:
       debug: 4.4.3
       globrex: 0.1.2
-      tsconfck: 3.1.6(typescript@5.9.2)
+      tsconfck: 3.1.6(typescript@5.9.3)
     optionalDependencies:
-      vite: 7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
+      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - supports-color
       - typescript
@@ -23317,35 +24030,35 @@ snapshots:
     dependencies:
       esbuild: 0.21.5
       postcss: 8.5.6
-      rollup: 4.52.2
+      rollup: 4.52.3
     optionalDependencies:
       '@types/node': 24.5.2
       fsevents: 2.3.3
       lightningcss: 1.30.1
       terser: 5.44.0
 
-  vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1):
+  vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1):
     dependencies:
       esbuild: 0.25.10
       fdir: 6.5.0(picomatch@4.0.3)
       picomatch: 4.0.3
       postcss: 8.5.6
-      rollup: 4.52.2
+      rollup: 4.52.3
       tinyglobby: 0.2.15
     optionalDependencies:
-      '@types/node': 24.5.2
+      '@types/node': 24.6.1
       fsevents: 2.3.3
-      jiti: 2.6.0
+      jiti: 2.6.1
       lightningcss: 1.30.1
       terser: 5.44.0
-      tsx: 4.20.5
+      tsx: 4.20.6
       yaml: 2.8.1
 
-  vitest@3.2.4(@types/debug@4.1.12)(@types/node@24.5.2)(@vitest/browser@3.2.4)(jiti@2.6.0)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1):
+  vitest@3.2.4(@types/debug@4.1.12)(@types/node@24.6.1)(@vitest/browser@3.2.4)(jiti@2.6.1)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1):
     dependencies:
       '@types/chai': 5.2.2
       '@vitest/expect': 3.2.4
-      '@vitest/mocker': 3.2.4(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))
+      '@vitest/mocker': 3.2.4(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@vitest/pretty-format': 3.2.4
       '@vitest/runner': 3.2.4
       '@vitest/snapshot': 3.2.4
@@ -23363,13 +24076,13 @@ snapshots:
       tinyglobby: 0.2.15
       tinypool: 1.1.1
       tinyrainbow: 2.0.0
-      vite: 7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
-      vite-node: 3.2.4(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1)
+      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite-node: 3.2.4(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
       why-is-node-running: 2.3.0
     optionalDependencies:
       '@types/debug': 4.1.12
-      '@types/node': 24.5.2
-      '@vitest/browser': 3.2.4(playwright@1.55.1)(vite@7.1.7(@types/node@24.5.2)(jiti@2.6.0)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.5)(yaml@2.8.1))(vitest@3.2.4)
+      '@types/node': 24.6.1
+      '@vitest/browser': 3.2.4(playwright@1.55.1)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)
       jsdom: 26.1.0(canvas@3.2.0)
     transitivePeerDependencies:
       - jiti
@@ -23387,15 +24100,15 @@ snapshots:
 
   void-elements@3.1.0: {}
 
-  vue@3.5.13(typescript@5.9.2):
+  vue@3.5.13(typescript@5.9.3):
     dependencies:
       '@vue/compiler-dom': 3.5.13
       '@vue/compiler-sfc': 3.5.13
       '@vue/runtime-dom': 3.5.13
-      '@vue/server-renderer': 3.5.13(vue@3.5.13(typescript@5.9.2))
+      '@vue/server-renderer': 3.5.13(vue@3.5.13(typescript@5.9.3))
       '@vue/shared': 3.5.13
     optionalDependencies:
-      typescript: 5.9.2
+      typescript: 5.9.3
     optional: true
 
   w3c-keyname@2.2.8: {}
@@ -23472,7 +24185,7 @@ snapshots:
       is-async-function: 2.1.1
       is-date-object: 1.1.0
       is-finalizationregistry: 1.1.1
-      is-generator-function: 1.1.0
+      is-generator-function: 1.1.2
       is-regex: 1.2.1
       is-weakref: 1.1.1
       isarray: 2.0.5
@@ -23658,12 +24371,12 @@ snapshots:
 
   xtend@4.0.2: {}
 
-  y-prosemirror@1.3.7(prosemirror-model@1.25.3)(prosemirror-state@1.4.3)(prosemirror-view@1.41.1)(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27):
+  y-prosemirror@1.3.7(prosemirror-model@1.25.3)(prosemirror-state@1.4.3)(prosemirror-view@1.41.2)(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27):
     dependencies:
       lib0: 0.2.114
       prosemirror-model: 1.25.3
       prosemirror-state: 1.4.3
-      prosemirror-view: 1.41.1
+      prosemirror-view: 1.41.2
       y-protocols: 1.0.6(yjs@13.6.27)
       yjs: 13.6.27
 
@@ -23717,19 +24430,17 @@ snapshots:
 
   yoctocolors@2.1.1: {}
 
-  zod-validation-error@3.5.3(zod@3.25.76):
-    dependencies:
-      zod: 3.25.76
-
   zod@3.24.1: {}
 
   zod@3.25.76: {}
 
+  zod@4.1.11: {}
+
   zod@4.1.8: {}
 
-  zustand@5.0.8(@types/react@19.1.13)(immer@10.1.3)(react@19.1.1)(use-sync-external-store@1.5.0(react@19.1.1)):
+  zustand@5.0.8(@types/react@19.1.16)(immer@10.1.3)(react@19.1.1)(use-sync-external-store@1.5.0(react@19.1.1)):
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.16
       immer: 10.1.3
       react: 19.1.1
       use-sync-external-store: 1.5.0(react@19.1.1)

From 0bccbc65f1bc1b7613af7903794f8cde6fe0700e Mon Sep 17 00:00:00 2001
From: David Hordiienko <90209095+LemonardoD@users.noreply.github.com>
Date: Wed, 1 Oct 2025 18:29:44 +0300
Subject: [PATCH 32/48] Chore/auth todos (#629)

* fix:mfa helpers

* fix: passkey DRY

* fix: totp DRY

* fix: Cookie naming consistency

* chore: snace_case to kebab-case

* chore: remove todo

* chore: stronger type for OAuthFlowType

* chore: sendVerificationEmail emailInUse error

* chore: simplify getTokenData

* improve: handle of membership invite

* fix: toast message

* chore: remove todo, we keep the orig error so it's fine

* refactor: getMyAuth

* chore: verify token delete DRY

* chore: import alias

* fix: create password redirect

* improve: add btn loading on oauth connect

* add todo

* fixes
---
 backend/src/modules/auth/general/handlers.ts  | 28 +++------
 .../helpers/send-verification-email.ts        | 20 ++++++-
 backend/src/modules/auth/general/routes.ts    |  2 +-
 backend/src/modules/auth/oauth/handlers.ts    |  3 +-
 .../modules/auth/oauth/helpers/callback.ts    |  2 +-
 .../modules/auth/oauth/helpers/initiation.ts  | 19 ++++---
 .../helpers/send-oauth-verification-email.ts  | 14 +----
 backend/src/modules/auth/oauth/routes.ts      |  2 +-
 backend/src/modules/auth/passkeys/handlers.ts |  2 +-
 .../modules/auth/passkeys/helpers/passkey.ts  |  2 +-
 backend/src/modules/auth/passkeys/routes.ts   |  8 ++-
 .../src/modules/auth/passwords/handlers.ts    | 13 +++--
 backend/src/modules/auth/passwords/routes.ts  |  4 +-
 backend/src/modules/auth/totps/handlers.ts    |  2 +-
 backend/src/modules/auth/totps/routes.ts      |  2 +-
 backend/src/modules/me/handlers.ts            | 54 ++++--------------
 .../src/modules/me/helpers/get-sessions.ts    | 23 --------
 .../src/modules/me/helpers/get-user-info.ts   | 57 +++++++++++++++++++
 backend/src/modules/me/schema.ts              |  5 +-
 backend/src/modules/memberships/handlers.ts   | 33 ++++++-----
 backend/src/modules/memberships/routes.ts     | 16 ++----
 backend/src/routes.ts                         |  2 +-
 backend/src/utils/get-valid-token.ts          |  4 +-
 backend/src/utils/schema/common.ts            |  2 +-
 backend/src/utils/schema/responses.ts         |  1 +
 frontend/src/api.gen/sdk.gen.ts               | 16 +++---
 frontend/src/api.gen/types.gen.ts             | 18 +++---
 frontend/src/api.gen/zod.gen.ts               | 10 +---
 .../modules/attachments/dialog/handler.tsx    |  2 +-
 .../src/modules/attachments/table/bar.tsx     |  2 +-
 .../src/modules/attachments/table/index.tsx   |  2 +-
 .../src/modules/auth/create-password-form.tsx |  6 +-
 .../modules/auth/steps/provider-context.tsx   |  2 +-
 frontend/src/modules/auth/steps/provider.tsx  |  2 +-
 .../modules/auth/totp-verify-code-form.tsx    |  2 +-
 frontend/src/modules/auth/use-token-check.tsx |  2 +-
 frontend/src/modules/common/sse/provider.tsx  |  2 +-
 .../src/modules/entities/entity-grid/grid.tsx |  2 +-
 .../src/modules/marketing/about/showcase.tsx  |  2 +-
 .../modules/marketing/marketing-config.tsx    |  2 +-
 .../src/modules/me/entity-invitations.tsx     | 55 +++++++++++-------
 frontend/src/modules/me/settings-page.tsx     |  7 ++-
 .../src/modules/organizations/table/bar.tsx   |  2 +-
 .../src/modules/organizations/table/index.tsx |  2 +-
 frontend/src/modules/ui/button.tsx            |  2 +-
 frontend/src/routes-resolver.ts               | 10 ++--
 frontend/src/routes/auth-routes.tsx           |  2 +-
 frontend/src/routes/organization-routes.tsx   |  2 +-
 frontend/src/routes/system-routes.tsx         |  2 +-
 locales/en/common.json                        |  5 +-
 locales/en/errors.json                        |  1 +
 51 files changed, 252 insertions(+), 230 deletions(-)
 delete mode 100644 backend/src/modules/me/helpers/get-sessions.ts
 create mode 100644 backend/src/modules/me/helpers/get-user-info.ts

diff --git a/backend/src/modules/auth/general/handlers.ts b/backend/src/modules/auth/general/handlers.ts
index a3fb0d848..ce55c333a 100644
--- a/backend/src/modules/auth/general/handlers.ts
+++ b/backend/src/modules/auth/general/handlers.ts
@@ -3,7 +3,6 @@ import { appConfig } from 'config';
 import { and, desc, eq, isNotNull, isNull } from 'drizzle-orm';
 import { db } from '#/db/db';
 import { emailsTable } from '#/db/schema/emails';
-import { organizationsTable } from '#/db/schema/organizations';
 import { sessionsTable } from '#/db/schema/sessions';
 import { tokensTable } from '#/db/schema/tokens';
 import { usersTable } from '#/db/schema/users';
@@ -11,6 +10,8 @@ import { type Env, getContextUser } from '#/lib/context';
 import { AppError } from '#/lib/errors';
 import { deleteAuthCookie, getAuthCookie, setAuthCookie } from '#/modules/auth/general/helpers/cookie';
 import { getParsedSessionCookie, setUserSession, validateSession } from '#/modules/auth/general/helpers/session';
+import authGeneralRoutes from '#/modules/auth/general/routes';
+import { handleOAuthVerification } from '#/modules/auth/oauth/helpers/handle-oauth-verification';
 import { handleEmailVerification } from '#/modules/auth/passwords/helpers/handle-email-verification';
 import { usersBaseQuery } from '#/modules/users/helpers/select';
 import { defaultHook } from '#/utils/default-hook';
@@ -18,8 +19,6 @@ import { getValidToken } from '#/utils/get-valid-token';
 import { isExpiredDate } from '#/utils/is-expired-date';
 import { logEvent } from '#/utils/logger';
 import { TimeSpan } from '#/utils/time-span';
-import { handleOAuthVerification } from '../oauth/helpers/handle-oauth-verification';
-import authGeneralRoutes from './routes';
 
 const app = new OpenAPIHono<Env>({ defaultHook });
 
@@ -93,7 +92,6 @@ const authGeneralRouteHandlers = app
   /**
    * Get token data by id (without invoking it)
    */
-  // TODO simplify?
   .openapi(authGeneralRoutes.getTokenData, async (ctx) => {
     // Find token in request
     const { tokenId } = ctx.req.valid('param');
@@ -103,37 +101,27 @@ const authGeneralRouteHandlers = app
     const [tokenRecord] = await db
       .select()
       .from(tokensTable)
-      .where(and(eq(tokensTable.id, tokenId), eq(tokensTable.type, tokenType)));
+      .where(and(eq(tokensTable.id, tokenId), eq(tokensTable.type, tokenType)))
+      .limit(1);
     if (!tokenRecord) throw new AppError({ status: 404, type: 'token_not_found', severity: 'error' });
 
-    const baseData = {
+    const data = {
       email: tokenRecord.email,
       role: tokenRecord.role,
       userId: tokenRecord.userId || '',
     };
 
     // If its NOT an organization invitation, return base data
-    if (!tokenRecord.organizationId) return ctx.json(baseData, 200);
+    if (!tokenRecord.organizationId) return ctx.json(data, 200);
 
     // If it is a membership invitation, check if a new user has been created since invitation was sent (without verifying email)
     const [existingUser] = await usersBaseQuery().where(eq(usersTable.email, tokenRecord.email));
     if (!tokenRecord.userId && existingUser) {
       await db.update(tokensTable).set({ userId: existingUser.id }).where(eq(tokensTable.id, tokenRecord.id));
-      baseData.userId = existingUser.id;
+      data.userId = existingUser.id;
     }
 
-    // Add organization data to base data
-    const [organization] = await db.select().from(organizationsTable).where(eq(organizationsTable.id, tokenRecord.organizationId));
-    if (!organization) throw new AppError({ status: 404, type: 'not_found', severity: 'warn', entityType: 'organization' });
-
-    const dataWithOrg = {
-      ...baseData,
-      organizationId: organization.id || '',
-      organizationName: organization.name || '',
-      organizationSlug: organization.slug || '',
-    };
-
-    return ctx.json(dataWithOrg, 200);
+    return ctx.json(data, 200);
   })
   /**
    * Start impersonation
diff --git a/backend/src/modules/auth/general/helpers/send-verification-email.ts b/backend/src/modules/auth/general/helpers/send-verification-email.ts
index d841ecbac..d22facb4c 100644
--- a/backend/src/modules/auth/general/helpers/send-verification-email.ts
+++ b/backend/src/modules/auth/general/helpers/send-verification-email.ts
@@ -32,13 +32,13 @@ export const sendVerificationEmail = async ({ userId, redirectPath }: Props) =>
     .from(emailsTable)
     .where(and(eq(emailsTable.email, user.email), eq(emailsTable.verified, true)));
 
-  // email verified / TODO email_exists is perhaps wrong text, shouldnt it be email_already_verified?
+  // email verified
   if (emailInUse) {
-    throw new AppError({ status: 409, type: 'email_exists', severity: 'warn', entityType: 'user' });
+    throw new AppError({ status: 422, type: 'email_already_verified', severity: 'warn', entityType: 'user' });
   }
 
   // Delete previous token
-  await db.delete(tokensTable).where(and(eq(tokensTable.userId, user.id), eq(tokensTable.type, 'email-verification')));
+  await deleteVerificationTokens(user.id, 'email-verification');
 
   const token = nanoid(40);
   const email = user.email;
@@ -91,3 +91,17 @@ export const sendVerificationEmail = async ({ userId, redirectPath }: Props) =>
 
   logEvent('info', 'Verification email sent', { userId: user.id });
 };
+
+export const deleteVerificationTokens = async (
+  userId: string,
+  type: Extract<(typeof appConfig.tokenTypes)[number], 'email-verification' | 'oauth-verification'>,
+  oauthAccountId?: string,
+) => {
+  return await db
+    .delete(tokensTable)
+    .where(
+      and(
+        ...[eq(tokensTable.userId, userId), eq(tokensTable.type, type), ...(oauthAccountId ? [eq(tokensTable.oauthAccountId, oauthAccountId)] : [])],
+      ),
+    );
+};
diff --git a/backend/src/modules/auth/general/routes.ts b/backend/src/modules/auth/general/routes.ts
index c7cd170e4..aa8610016 100644
--- a/backend/src/modules/auth/general/routes.ts
+++ b/backend/src/modules/auth/general/routes.ts
@@ -4,9 +4,9 @@ import { createCustomRoute } from '#/lib/custom-routes';
 import { hasSystemAccess, isAuthenticated, isPublicAccess } from '#/middlewares/guard';
 import { isNoBot } from '#/middlewares/is-no-bot';
 import { emailEnumLimiter } from '#/middlewares/rate-limiter/limiters';
+import { emailBodySchema, tokenWithDataSchema } from '#/modules/auth/general/schema';
 import { cookieSchema, locationSchema } from '#/utils/schema/common';
 import { errorResponses, successWithoutDataSchema } from '#/utils/schema/responses';
-import { emailBodySchema, tokenWithDataSchema } from './schema';
 
 const authGeneralRoutes = {
   startImpersonation: createCustomRoute({
diff --git a/backend/src/modules/auth/oauth/handlers.ts b/backend/src/modules/auth/oauth/handlers.ts
index 5acfea357..2c6bd24a6 100644
--- a/backend/src/modules/auth/oauth/handlers.ts
+++ b/backend/src/modules/auth/oauth/handlers.ts
@@ -17,8 +17,8 @@ import {
   microsoftAuth,
 } from '#/modules/auth/oauth/helpers/providers';
 import { transformGithubUserData, transformSocialUserData } from '#/modules/auth/oauth/helpers/transform-user-data';
+import authOAuthRoutes from '#/modules/auth/oauth/routes';
 import { defaultHook } from '#/utils/default-hook';
-import authOAuthRoutes from './routes';
 
 const enabledStrategies: readonly string[] = appConfig.enabledAuthStrategies;
 const enabledOAuthProviders: readonly string[] = appConfig.enabledOAuthProviders;
@@ -135,7 +135,6 @@ const authOAuthRouteHandlers = app
       const githubUserEmails = (await githubUserEmailsResponse.json()) as GithubUserEmailProps[];
       const providerUser = transformGithubUserData(githubUser, githubUserEmails);
 
-      // TODO is it a good idea to have this inside the try catch too?
       return await handleOAuthCallback(ctx, callbackType, providerUser, strategy);
     } catch (error) {
       if (error instanceof AppError) throw error;
diff --git a/backend/src/modules/auth/oauth/helpers/callback.ts b/backend/src/modules/auth/oauth/helpers/callback.ts
index 5c35162ae..4785a991f 100644
--- a/backend/src/modules/auth/oauth/helpers/callback.ts
+++ b/backend/src/modules/auth/oauth/helpers/callback.ts
@@ -14,11 +14,11 @@ import { handleCreateUser } from '#/modules/auth/general/helpers/user';
 import type { Provider } from '#/modules/auth/oauth/helpers/providers';
 import { sendOAuthVerificationEmail } from '#/modules/auth/oauth/helpers/send-oauth-verification-email';
 import type { TransformedUser } from '#/modules/auth/oauth/helpers/transform-user-data';
+import { OAuthFlowType } from '#/modules/auth/oauth/schema';
 import { usersBaseQuery } from '#/modules/users/helpers/select';
 import { getValidSingleUseToken } from '#/utils/get-valid-single-use-token';
 import { isValidRedirectPath } from '#/utils/is-redirect-url';
 import { getIsoDate } from '#/utils/iso-date';
-import { OAuthFlowType } from '../schema';
 
 /**
  * Handles the default OAuth authentication/signup flow.
diff --git a/backend/src/modules/auth/oauth/helpers/initiation.ts b/backend/src/modules/auth/oauth/helpers/initiation.ts
index 60fca79b0..be6dc210d 100644
--- a/backend/src/modules/auth/oauth/helpers/initiation.ts
+++ b/backend/src/modules/auth/oauth/helpers/initiation.ts
@@ -4,12 +4,12 @@ import { Env } from '#/lib/context';
 import { AppError } from '#/lib/errors';
 import { getAuthCookie, setAuthCookie } from '#/modules/auth/general/helpers/cookie';
 import { getParsedSessionCookie, validateSession } from '#/modules/auth/general/helpers/session';
+import { OAuthFlowType } from '#/modules/auth/oauth/schema';
 import { getValidSingleUseToken } from '#/utils/get-valid-single-use-token';
 import { getValidToken } from '#/utils/get-valid-token';
 import { isValidRedirectPath } from '#/utils/is-redirect-url';
 import { logEvent } from '#/utils/logger';
 import { TimeSpan } from '#/utils/time-span';
-import { OAuthFlowType } from '../schema';
 
 export interface OAuthCookiePayload {
   redirectPath: string;
@@ -31,9 +31,14 @@ export interface OAuthCookiePayload {
  * @param codeVerifier - PKCE code verifier (optional)
  * @returns redirect response
  */
-export const handleOAuthInitiation = async (ctx: Context<Env>, provider: string, url: URL, state: string, codeVerifier?: string) => {
-  // TODO Type of type is string, can we somehow get a stronger type from hono/zod/openapi, since it should be type OAuthFlowType?
-  const { type } = ctx.req.query();
+export const handleOAuthInitiation = async (
+  ctx: Context<Env, any, { out: { query: { type: OAuthFlowType } } }>,
+  provider: string,
+  url: URL,
+  state: string,
+  codeVerifier?: string,
+) => {
+  const { type } = ctx.req.valid('query');
 
   const { redirectPath } = await prepareOAuthByContext(ctx);
   const cookieContent = JSON.stringify({ redirectPath, codeVerifier, type });
@@ -138,13 +143,13 @@ const prepareOAuthAcceptInvite = async (ctx: Context<Env>) => {
  * @throws AppError if missing param or user mismatch
  */
 const prepareOAuthConnect = async (ctx: Context<Env>) => {
-  const { sessionToken } = await getParsedSessionCookie(ctx, { redirectOnError: '/auth/authenticate' });
+  const { sessionToken } = await getParsedSessionCookie(ctx, { redirectOnError: '/error' });
 
   // Get user from valid session
   const { user } = await validateSession(sessionToken);
-  if (!user) throw new AppError({ status: 404, type: 'not_found', entityType: 'user', severity: 'error', redirectPath: '/auth/authenticate' });
+  if (!user) throw new AppError({ status: 404, type: 'not_found', entityType: 'user', severity: 'error', redirectPath: '/error' });
 
-  //TODO we do this on callback or not?
+  //TODO we do this on callback or not? handle error query params in /settings
   const redirectPath = '/settings#authentication';
 
   return { connectUserId: user.id, redirectPath };
diff --git a/backend/src/modules/auth/oauth/helpers/send-oauth-verification-email.ts b/backend/src/modules/auth/oauth/helpers/send-oauth-verification-email.ts
index ed649fd7d..6999f00c5 100644
--- a/backend/src/modules/auth/oauth/helpers/send-oauth-verification-email.ts
+++ b/backend/src/modules/auth/oauth/helpers/send-oauth-verification-email.ts
@@ -8,6 +8,7 @@ import { tokensTable } from '#/db/schema/tokens';
 import { usersTable } from '#/db/schema/users';
 import { AppError } from '#/lib/errors';
 import { mailer } from '#/lib/mailer';
+import { deleteVerificationTokens } from '#/modules/auth/general/helpers/send-verification-email';
 import { usersBaseQuery } from '#/modules/users/helpers/select';
 import { logEvent } from '#/utils/logger';
 import { nanoid } from '#/utils/nanoid';
@@ -44,19 +45,8 @@ export const sendOAuthVerificationEmail = async ({ userId, oauthAccountId, redir
     throw new AppError({ status: 409, type: 'email_exists', severity: 'warn', entityType: 'user' });
   }
 
-  // TODO move these queries into another helper that also is used by send-email-verification.ts?
   // Delete previous token
-  await db
-    .delete(tokensTable)
-    .where(
-      and(
-        ...[
-          eq(tokensTable.userId, user.id),
-          eq(tokensTable.type, 'oauth-verification'),
-          ...(oauthAccountId ? [eq(tokensTable.oauthAccountId, oauthAccountId)] : []),
-        ],
-      ),
-    );
+  await deleteVerificationTokens(user.id, 'oauth-verification', oauthAccountId);
 
   const token = nanoid(40);
   const email = oauthAccount?.email ?? user.email;
diff --git a/backend/src/modules/auth/oauth/routes.ts b/backend/src/modules/auth/oauth/routes.ts
index 208d621ce..ecc2f52ac 100644
--- a/backend/src/modules/auth/oauth/routes.ts
+++ b/backend/src/modules/auth/oauth/routes.ts
@@ -2,9 +2,9 @@ import { z } from '@hono/zod-openapi';
 import { createCustomRoute } from '#/lib/custom-routes';
 import { isPublicAccess } from '#/middlewares/guard';
 import { tokenLimiter } from '#/middlewares/rate-limiter/limiters';
+import { oauthCallbackQuerySchema, oauthQuerySchema } from '#/modules/auth/oauth/schema';
 import { locationSchema } from '#/utils/schema/common';
 import { errorResponses } from '#/utils/schema/responses';
-import { oauthCallbackQuerySchema, oauthQuerySchema } from './schema';
 
 const authOAuthRoutes = {
   github: createCustomRoute({
diff --git a/backend/src/modules/auth/passkeys/handlers.ts b/backend/src/modules/auth/passkeys/handlers.ts
index 9f3c5dfb1..eb7a2c7ac 100644
--- a/backend/src/modules/auth/passkeys/handlers.ts
+++ b/backend/src/modules/auth/passkeys/handlers.ts
@@ -15,10 +15,10 @@ import { deviceInfo } from '#/modules/auth/general/helpers/device-info';
 import { consumeMfaToken, validateConfirmMfaToken } from '#/modules/auth/general/helpers/mfa';
 import { setUserSession } from '#/modules/auth/general/helpers/session';
 import { parseAndValidatePasskeyAttestation, validatePasskey } from '#/modules/auth/passkeys/helpers/passkey';
+import authPasskeysRoutes from '#/modules/auth/passkeys/routes';
 import { usersBaseQuery } from '#/modules/users/helpers/select';
 import { defaultHook } from '#/utils/default-hook';
 import { TimeSpan } from '#/utils/time-span';
-import authPasskeysRoutes from './routes';
 
 const enabledStrategies: readonly string[] = appConfig.enabledAuthStrategies;
 
diff --git a/backend/src/modules/auth/passkeys/helpers/passkey.ts b/backend/src/modules/auth/passkeys/helpers/passkey.ts
index 9594124bf..d4d5f14e3 100644
--- a/backend/src/modules/auth/passkeys/helpers/passkey.ts
+++ b/backend/src/modules/auth/passkeys/helpers/passkey.ts
@@ -17,7 +17,7 @@ import { Context } from 'hono';
 import { db } from '#/db/db';
 import { passkeysTable } from '#/db/schema/passkeys';
 import { AppError } from '#/lib/errors';
-import { getAuthCookie } from '../../general/helpers/cookie';
+import { getAuthCookie } from '#/modules/auth/general/helpers/cookie';
 
 /**
  * Parses and validates passkey attestation data.
diff --git a/backend/src/modules/auth/passkeys/routes.ts b/backend/src/modules/auth/passkeys/routes.ts
index 212eb68b7..4b2d3d18e 100644
--- a/backend/src/modules/auth/passkeys/routes.ts
+++ b/backend/src/modules/auth/passkeys/routes.ts
@@ -2,9 +2,15 @@ import { z } from '@hono/zod-openapi';
 import { createCustomRoute } from '#/lib/custom-routes';
 import { isAuthenticated, isPublicAccess } from '#/middlewares/guard';
 import { spamLimiter, tokenLimiter } from '#/middlewares/rate-limiter/limiters';
+import {
+  passkeyChallengeBodySchema,
+  passkeyChallengeSchema,
+  passkeyCreateBodySchema,
+  passkeySchema,
+  passkeyVerificationBodySchema,
+} from '#/modules/auth/passkeys/schema';
 import { cookieSchema, idSchema } from '#/utils/schema/common';
 import { errorResponses, successWithoutDataSchema } from '#/utils/schema/responses';
-import { passkeyChallengeBodySchema, passkeyChallengeSchema, passkeyCreateBodySchema, passkeySchema, passkeyVerificationBodySchema } from './schema';
 
 const authPasskeysRoutes = {
   generatePasskeyChallenge: createCustomRoute({
diff --git a/backend/src/modules/auth/passwords/handlers.ts b/backend/src/modules/auth/passwords/handlers.ts
index 5a825ec73..b33e46f17 100644
--- a/backend/src/modules/auth/passwords/handlers.ts
+++ b/backend/src/modules/auth/passwords/handlers.ts
@@ -16,6 +16,8 @@ import { sendVerificationEmail } from '#/modules/auth/general/helpers/send-verif
 import { setUserSession } from '#/modules/auth/general/helpers/session';
 import { handleCreateUser } from '#/modules/auth/general/helpers/user';
 import { hashPassword, verifyPasswordHash } from '#/modules/auth/passwords/helpers/argon2id';
+import { handleEmailVerification } from '#/modules/auth/passwords/helpers/handle-email-verification';
+import authPasswordsRoutes from '#/modules/auth/passwords/routes';
 import { membershipBaseSelect } from '#/modules/memberships/helpers/select';
 import { usersBaseQuery } from '#/modules/users/helpers/select';
 import { defaultHook } from '#/utils/default-hook';
@@ -25,8 +27,6 @@ import { nanoid } from '#/utils/nanoid';
 import { slugFromEmail } from '#/utils/slug-from-email';
 import { createDate, TimeSpan } from '#/utils/time-span';
 import { CreatePasswordEmail, type CreatePasswordEmailProps } from '../../../../emails/create-password';
-import { handleEmailVerification } from './helpers/handle-email-verification';
-import authPasswordsRoutes from './routes';
 
 const enabledStrategies: readonly string[] = appConfig.enabledAuthStrategies;
 
@@ -203,9 +203,12 @@ const authPasswordsRouteHandlers = app
       db.update(emailsTable).set({ verified: true, verifiedAt: getIsoDate() }).where(eq(emailsTable.email, user.email)),
     ]);
 
-    // TODO(bug) MFA on when user already auth, FE not revalidate session just keep prev one
-    const redirectPath = await initiateMfa(ctx, user);
-    if (redirectPath) return ctx.json({ shouldRedirect: true, redirectPath }, 200);
+    const mfaRedirectPath = await initiateMfa(ctx, user);
+    if (mfaRedirectPath) {
+      // Append fromRoot to avoid redirecting to FE homepage
+      const redirectPath = `${mfaRedirectPath}?fromRoot=true`;
+      return ctx.json({ shouldRedirect: true, redirectPath }, 200);
+    }
 
     await setUserSession(ctx, user, strategy);
     return ctx.json({ shouldRedirect: false }, 200);
diff --git a/backend/src/modules/auth/passwords/routes.ts b/backend/src/modules/auth/passwords/routes.ts
index d7692b895..f52476122 100644
--- a/backend/src/modules/auth/passwords/routes.ts
+++ b/backend/src/modules/auth/passwords/routes.ts
@@ -4,10 +4,10 @@ import { isPublicAccess } from '#/middlewares/guard';
 import { hasValidSingleUseToken } from '#/middlewares/has-valid-single-use-token';
 import { isNoBot } from '#/middlewares/is-no-bot';
 import { emailEnumLimiter, passwordLimiter, spamLimiter, tokenLimiter } from '#/middlewares/rate-limiter/limiters';
+import { emailBodySchema } from '#/modules/auth/general/schema';
+import { emailPasswordBodySchema } from '#/modules/auth/passwords/schema';
 import { cookieSchema, locationSchema, passwordSchema } from '#/utils/schema/common';
 import { errorResponses, redirectResponseSchema, successWithoutDataSchema } from '#/utils/schema/responses';
-import { emailBodySchema } from '../general/schema';
-import { emailPasswordBodySchema } from './schema';
 
 const authPasswordsRoutes = {
   signUp: createCustomRoute({
diff --git a/backend/src/modules/auth/totps/handlers.ts b/backend/src/modules/auth/totps/handlers.ts
index 1d7dc45d4..c8c8606dd 100644
--- a/backend/src/modules/auth/totps/handlers.ts
+++ b/backend/src/modules/auth/totps/handlers.ts
@@ -13,9 +13,9 @@ import { getAuthCookie, setAuthCookie } from '#/modules/auth/general/helpers/coo
 import { consumeMfaToken, validateConfirmMfaToken } from '#/modules/auth/general/helpers/mfa';
 import { setUserSession } from '#/modules/auth/general/helpers/session';
 import { signInWithTotp, validateTOTP } from '#/modules/auth/totps/helpers/totps';
+import { default as authTotpRoutes, default as authTotpsRoutes } from '#/modules/auth/totps/routes';
 import { defaultHook } from '#/utils/default-hook';
 import { TimeSpan } from '#/utils/time-span';
-import { default as authTotpRoutes, default as authTotpsRoutes } from './routes';
 
 const enabledStrategies: readonly string[] = appConfig.enabledAuthStrategies;
 
diff --git a/backend/src/modules/auth/totps/routes.ts b/backend/src/modules/auth/totps/routes.ts
index 3b3ab1f4c..774c4b18e 100644
--- a/backend/src/modules/auth/totps/routes.ts
+++ b/backend/src/modules/auth/totps/routes.ts
@@ -2,9 +2,9 @@ import { z } from '@hono/zod-openapi';
 import { createCustomRoute } from '#/lib/custom-routes';
 import { isAuthenticated, isPublicAccess } from '#/middlewares/guard';
 import { spamLimiter } from '#/middlewares/rate-limiter/limiters';
+import { totpCreateBodySchema } from '#/modules/auth/totps/schema';
 import { cookieSchema } from '#/utils/schema/common';
 import { errorResponses, successWithoutDataSchema } from '#/utils/schema/responses';
-import { totpCreateBodySchema } from './schema';
 
 const authTotpsRoutes = {
   generateTotpKey: createCustomRoute({
diff --git a/backend/src/modules/me/handlers.ts b/backend/src/modules/me/handlers.ts
index 38563db4f..04ae432df 100644
--- a/backend/src/modules/me/handlers.ts
+++ b/backend/src/modules/me/handlers.ts
@@ -1,15 +1,12 @@
 import { OpenAPIHono, type z } from '@hono/zod-openapi';
 import type { EnabledOAuthProvider, MenuSection } from 'config';
 import { appConfig } from 'config';
-import { and, eq, getTableColumns, inArray, isNotNull, isNull, sql } from 'drizzle-orm';
+import { and, eq, inArray, isNotNull, isNull, sql } from 'drizzle-orm';
 import { type SSEStreamingApi, streamSSE } from 'hono/streaming';
 import { db } from '#/db/db';
 import { membershipsTable } from '#/db/schema/memberships';
-import { oauthAccountsTable } from '#/db/schema/oauth-accounts';
-import { passkeysTable } from '#/db/schema/passkeys';
-import { passwordsTable } from '#/db/schema/passwords';
 import { AuthStrategy, sessionsTable } from '#/db/schema/sessions';
-import { totpsTable } from '#/db/schema/totps';
+import { tokensTable } from '#/db/schema/tokens';
 import { unsubscribeTokensTable } from '#/db/schema/unsubscribe-tokens';
 import { usersTable } from '#/db/schema/users';
 import { entityTables } from '#/entity-config';
@@ -24,7 +21,7 @@ import { getParsedSessionCookie, setUserSession, validateSession } from '#/modul
 import { validatePasskey } from '#/modules/auth/passkeys/helpers/passkey';
 import { validateTOTP } from '#/modules/auth/totps/helpers/totps';
 import { checkSlugAvailable } from '#/modules/entities/helpers/check-slug';
-import { getUserSessions } from '#/modules/me/helpers/get-sessions';
+import { getAuthInfo, getUserSessions } from '#/modules/me/helpers/get-user-info';
 import { getUserMenuEntities } from '#/modules/me/helpers/get-user-menu-entities';
 import meRoutes from '#/modules/me/routes';
 import type { menuItemSchema, menuSchema } from '#/modules/me/schema';
@@ -103,47 +100,16 @@ const meRouteHandlers = app
   .openapi(meRoutes.getMyAuth, async (ctx) => {
     const user = getContextUser();
 
-    // TODO put in helper
-    // Queries for user authentication factors
-    // Select passkey fields except for sensitive credential data
-    const { credentialId, publicKey, ...passkeySelect } = getTableColumns(passkeysTable);
-    const getPasskeys = db.select(passkeySelect).from(passkeysTable).where(eq(passkeysTable.userId, user.id));
-
-    const getPassword = db.select().from(passwordsTable).where(eq(passwordsTable.userId, user.id)).limit(1);
-
-    const getTotp = db.select().from(totpsTable).where(eq(totpsTable.userId, user.id));
-
-    // Query to get verified OAuth accounts
-    const getOAuth = db
-      .select({ provider: oauthAccountsTable.provider })
-      .from(oauthAccountsTable)
-      .where(and(eq(oauthAccountsTable.userId, user.id), eq(oauthAccountsTable.verified, true)));
-
-    // Run all queries + fetch user sessions in parallel
-    const [passkeys, password, totps, oauthAccounts, sessions] = await Promise.all([
-      getPasskeys,
-      getPassword,
-      getTotp,
-      getOAuth,
-      getUserSessions(ctx, user.id),
-    ]);
+    // Get auth info + sessions in parallel
+    const [authInfo, sessions] = await Promise.all([getAuthInfo(user.id), getUserSessions(ctx, user.id)]);
 
+    const { oauth, ...restInfo } = authInfo;
     // Filter only providers that are enabled in appConfig
-    const enabledOAuth = oauthAccounts
-      .map((el) => el.provider)
+    const enabledOAuth = oauth
+      .map(({ provider }) => provider)
       .filter((provider): provider is EnabledOAuthProvider => appConfig.enabledOAuthProviders.includes(provider as EnabledOAuthProvider));
 
-    // Return a consolidated JSON response with all relevant auth info
-    return ctx.json(
-      {
-        enabledOAuth,
-        hasTotp: !!totps.length,
-        hasPassword: !!password.length,
-        sessions,
-        passkeys,
-      },
-      200,
-    );
+    return ctx.json({ ...restInfo, enabledOAuth, sessions }, 200);
   })
   /**
    * Get my user menu
@@ -207,12 +173,14 @@ const meRouteHandlers = app
         return db
           .select({
             entity: entitySelect,
+            expiresAt: tokensTable.expiresAt,
             invitedBy: userBaseSelect,
             membership: membershipsTable,
           })
           .from(membershipsTable)
           .leftJoin(usersTable, eq(usersTable.id, membershipsTable.createdBy))
           .innerJoin(entityTable, eq(entityTable.id, membershipsTable[entityIdField]))
+          .innerJoin(tokensTable, eq(tokensTable.id, membershipsTable.tokenId))
           .where(
             and(
               eq(membershipsTable.contextType, entityType),
diff --git a/backend/src/modules/me/helpers/get-sessions.ts b/backend/src/modules/me/helpers/get-sessions.ts
deleted file mode 100644
index c42ee6048..000000000
--- a/backend/src/modules/me/helpers/get-sessions.ts
+++ /dev/null
@@ -1,23 +0,0 @@
-import type { z } from '@hono/zod-openapi';
-import { desc, eq } from 'drizzle-orm';
-import type { Context } from 'hono';
-import { db } from '#/db/db';
-import { sessionsTable } from '#/db/schema/sessions';
-import { Env } from '#/lib/context';
-import { getParsedSessionCookie } from '#/modules/auth/general/helpers/session';
-import type { sessionSchema } from '#/modules/me/schema';
-
-/**
- * Retrieves all sessions for a specific user, and marks the current session.
- *
- * @param ctx - Request/response context.
- * @param userId - ID of the user whose sessions are requested.
- * @returns A list of sessions, with an additional `isCurrent` flag indicating if the session is the current active session.
- */
-export const getUserSessions = async (ctx: Context<Env>, userId: string): Promise<z.infer<typeof sessionSchema>[]> => {
-  const sessions = await db.select().from(sessionsTable).where(eq(sessionsTable.userId, userId)).orderBy(desc(sessionsTable.createdAt));
-  const { sessionToken } = await getParsedSessionCookie(ctx);
-
-  // Destructure/remove token from response
-  return sessions.map(({ token, ...session }) => ({ ...session, isCurrent: sessionToken === token }));
-};
diff --git a/backend/src/modules/me/helpers/get-user-info.ts b/backend/src/modules/me/helpers/get-user-info.ts
new file mode 100644
index 000000000..359f46fc9
--- /dev/null
+++ b/backend/src/modules/me/helpers/get-user-info.ts
@@ -0,0 +1,57 @@
+import type { z } from '@hono/zod-openapi';
+import { and, desc, eq, getTableColumns } from 'drizzle-orm';
+import type { Context } from 'hono';
+import { db } from '#/db/db';
+import { oauthAccountsTable } from '#/db/schema/oauth-accounts';
+import { passkeysTable } from '#/db/schema/passkeys';
+import { passwordsTable } from '#/db/schema/passwords';
+import { sessionsTable } from '#/db/schema/sessions';
+import { totpsTable } from '#/db/schema/totps';
+import { Env } from '#/lib/context';
+import { getParsedSessionCookie } from '#/modules/auth/general/helpers/session';
+import type { sessionSchema } from '#/modules/me/schema';
+
+/**
+ * Fetches all authentication-related data for a user in parallel.
+ *
+ * This includes:
+ * - Passkeys (excluding sensitive fields like credentialId & publicKey)
+ * - Password (limited to one, if set)
+ * - TOTP entries
+ * - Verified OAuth accounts
+ *
+ * @param userId - ID of the user to fetch auth data for
+ * @returns An object containing arrays of passkeys, password, TOTP entries, and OAuth providers
+ */
+export const getAuthInfo = async (userId: string) => {
+  const { credentialId, publicKey, ...passkeySelect } = getTableColumns(passkeysTable);
+  const getPasskeys = db.select(passkeySelect).from(passkeysTable).where(eq(passkeysTable.userId, userId));
+
+  const getPassword = db.select().from(passwordsTable).where(eq(passwordsTable.userId, userId)).limit(1);
+
+  const getTotp = db.select().from(totpsTable).where(eq(totpsTable.userId, userId));
+
+  // Query to get verified OAuth accounts
+  const getOAuth = db
+    .select({ provider: oauthAccountsTable.provider })
+    .from(oauthAccountsTable)
+    .where(and(eq(oauthAccountsTable.userId, userId), eq(oauthAccountsTable.verified, true)));
+
+  const [password, passkeys, totps, oauth] = await Promise.all([getPassword, getPasskeys, getTotp, getOAuth]);
+  return { hasPassword: !!password.length, passkeys, hasTotp: !!totps.length, oauth };
+};
+
+/**
+ * Retrieves all sessions for a specific user, and marks the current session.
+ *
+ * @param ctx - Request/response context.
+ * @param userId - ID of the user whose sessions are requested.
+ * @returns A list of sessions, with an additional `isCurrent` flag indicating if the session is the current active session.
+ */
+export const getUserSessions = async (ctx: Context<Env>, userId: string): Promise<z.infer<typeof sessionSchema>[]> => {
+  const sessions = await db.select().from(sessionsTable).where(eq(sessionsTable.userId, userId)).orderBy(desc(sessionsTable.createdAt));
+  const { sessionToken } = await getParsedSessionCookie(ctx);
+
+  // Destructure/remove token from response
+  return sessions.map(({ token, ...session }) => ({ ...session, isCurrent: sessionToken === token }));
+};
diff --git a/backend/src/modules/me/schema.ts b/backend/src/modules/me/schema.ts
index 98aeeb769..cb5699d40 100644
--- a/backend/src/modules/me/schema.ts
+++ b/backend/src/modules/me/schema.ts
@@ -2,12 +2,12 @@ import { z } from '@hono/zod-openapi';
 import { appConfig, type ContextEntityType } from 'config';
 import { createSelectSchema } from 'drizzle-zod';
 import { sessionsTable } from '#/db/schema/sessions';
+import { passkeySchema, webAuthnAssertionSchema } from '#/modules/auth/passkeys/schema';
+import { totpCreateBodySchema } from '#/modules/auth/totps/schema';
 import { contextEntityBaseSchema, contextEntityWithMembershipSchema, userBaseSchema } from '#/modules/entities/schema';
 import { membershipBaseSchema } from '#/modules/memberships/schema';
 import { enabledOAuthProvidersEnum } from '#/modules/users/schema';
 import { booleanTransformSchema } from '#/utils/schema/common';
-import { passkeySchema, webAuthnAssertionSchema } from '../auth/passkeys/schema';
-import { totpCreateBodySchema } from '../auth/totps/schema';
 
 export const sessionSchema = createSelectSchema(sessionsTable).omit({ token: true }).extend({ isCurrent: z.boolean() });
 
@@ -77,5 +77,6 @@ export const meInvitationsSchema = z.array(
     entity: contextEntityBaseSchema.extend({ organizationId: z.string().optional() }),
     invitedBy: userBaseSchema.nullable(),
     membership: membershipBaseSchema,
+    expiresAt: z.string(),
   }),
 );
diff --git a/backend/src/modules/memberships/handlers.ts b/backend/src/modules/memberships/handlers.ts
index 93af88fdd..2e9a8f9fe 100644
--- a/backend/src/modules/memberships/handlers.ts
+++ b/backend/src/modules/memberships/handlers.ts
@@ -372,19 +372,18 @@ const membershipRouteHandlers = app
   /**
    * Accept - or reject - organization membership invitation
    */
-  .openapi(membershipRoutes.acceptMembership, async (ctx) => {
+  .openapi(membershipRoutes.handleMembershipInvitation, async (ctx) => {
     const { id: membershipId, acceptOrReject } = ctx.req.valid('param');
 
     const user = getContextUser();
 
-    console.log('TODO, reject not handled', acceptOrReject);
-
     // TODO use get membership util
     const [membership] = await db
       .select()
       .from(membershipsTable)
       .where(and(eq(membershipsTable.id, membershipId), isNotNull(membershipsTable.tokenId)))
       .limit(1);
+
     if (!membership) throw new AppError({ status: 404, type: 'membership_not_found', severity: 'error', meta: { membershipId } });
 
     // Make sure correct user accepts invitation (for example another user could have a sessions and click on email invite of another user)
@@ -399,22 +398,26 @@ const membershipRouteHandlers = app
     // Make sure its an organization membership
     if (membership.contextType !== 'organization') throw new AppError({ status: 401, type: 'invalid_token', severity: 'warn' });
 
-    // Activate memberships, can be multiple if there are nested entity memberships. Eg. organization and project
-    // TODO test this in raak for projects and edge cases
-    const activatedMemberships = await db
-      .update(membershipsTable)
-      .set({ tokenId: null, activatedAt: getIsoDate() })
-      .where(and(eq(membershipsTable.tokenId, membership.tokenId)))
-      .returning();
+    if (acceptOrReject === 'accept') {
+      // Activate memberships, can be multiple if there are nested entity memberships. Eg. organization and project
+      // TODO test this in raak for projects and edge cases
+      const activatedMemberships = await db
+        .update(membershipsTable)
+        .set({ tokenId: null, activatedAt: getIsoDate() })
+        .where(and(eq(membershipsTable.tokenId, membership.tokenId)))
+        .returning();
 
-    const entity = await resolveEntity('organization', membership.organizationId);
-    if (!entity) throw new AppError({ status: 404, type: 'not_found', severity: 'error', entityType: 'organization' });
+      eventManager.emit('acceptedMembership', membership);
+
+      logEvent('info', 'Accepted memberships', { ids: activatedMemberships.map((m) => m.id) });
+    }
 
-    eventManager.emit('acceptedMembership', membership);
+    if (acceptOrReject === 'reject') await db.delete(tokensTable).where(and(eq(tokensTable.id, membership.tokenId)));
 
-    logEvent('info', 'Accepted memberships', { ids: activatedMemberships.map((m) => m.id) });
+    const entity = await resolveEntity('organization', membership.organizationId);
+    if (!entity) throw new AppError({ status: 404, type: 'not_found', severity: 'error', entityType: 'organization' });
 
-    return ctx.json({ ...entity, membership }, 200);
+    return ctx.json(entity, 200);
   })
   /**
    * Get members by entity id/slug and type
diff --git a/backend/src/modules/memberships/routes.ts b/backend/src/modules/memberships/routes.ts
index 60fb50f29..aae912f47 100644
--- a/backend/src/modules/memberships/routes.ts
+++ b/backend/src/modules/memberships/routes.ts
@@ -2,6 +2,7 @@ import { z } from '@hono/zod-openapi';
 import { createCustomRoute } from '#/lib/custom-routes';
 import { hasOrgAccess, isAuthenticated, isPublicAccess } from '#/middlewares/guard';
 import { spamLimiter } from '#/middlewares/rate-limiter/limiters';
+import { contextEntityBaseSchema } from '#/modules/entities/schema';
 import {
   memberListQuerySchema,
   membershipCreateBodySchema,
@@ -13,7 +14,6 @@ import {
 import { memberSchema } from '#/modules/users/schema';
 import { entityWithTypeQuerySchema, idInOrgParamSchema, idOrSlugSchema, idsBodySchema, inOrgParamSchema } from '#/utils/schema/common';
 import { errorResponses, paginationSchema, successWithoutDataSchema, successWithRejectedItemsSchema } from '#/utils/schema/responses';
-import { contextEntityWithMembershipSchema } from '../entities/schema';
 
 const membershipRoutes = {
   createMemberships: createCustomRoute({
@@ -99,25 +99,19 @@ const membershipRoutes = {
     },
   }),
 
-  acceptMembership: createCustomRoute({
-    operationId: 'acceptMembership',
+  handleMembershipInvitation: createCustomRoute({
+    operationId: 'handleMembershipInvitation',
     method: 'post',
     path: '/{id}/{acceptOrReject}',
     guard: isAuthenticated,
     tags: ['membership'],
-    summary: 'Accept invitation',
-    // TODO reject flow needs to be added
+    summary: 'Respond to membership invitation',
     description: 'Accepting activates the associated membership. Rejecting adds a rejectedAt timestamp.',
     request: { params: z.object({ id: z.string(), acceptOrReject: z.enum(['accept', 'reject']) }) },
     responses: {
       200: {
         description: 'Invitation was accepted',
-        content: {
-          'application/json': {
-            // TODO why the extend?
-            schema: contextEntityWithMembershipSchema.extend({ createdAt: z.string() }),
-          },
-        },
+        content: { 'application/json': { schema: contextEntityBaseSchema } },
       },
       ...errorResponses,
     },
diff --git a/backend/src/routes.ts b/backend/src/routes.ts
index 1c659ca12..375157f62 100644
--- a/backend/src/routes.ts
+++ b/backend/src/routes.ts
@@ -2,6 +2,7 @@ import attachmentRouteHandlers from '#/modules/attachments/handlers';
 import authGeneralRouteHandlers from '#/modules/auth/general/handlers';
 import authOAuthRouteHandlers from '#/modules/auth/oauth/handlers';
 import authPasskeysRouteHandlers from '#/modules/auth/passkeys/handlers';
+import authPasswordsRouteHandlers from '#/modules/auth/passwords/handlers';
 import authTotpRouteHandlers from '#/modules/auth/totps/handlers';
 import entityRouteHandlers from '#/modules/entities/handlers';
 import meRouteHandlers from '#/modules/me/handlers';
@@ -12,7 +13,6 @@ import requestRouteHandlers from '#/modules/requests/handlers';
 import systemRouteHandlers from '#/modules/system/handlers';
 import userRouteHandlers from '#/modules/users/handlers';
 import baseApp from '#/server';
-import authPasswordsRouteHandlers from './modules/auth/passwords/handlers';
 
 // Define backend routes of your app
 const app = baseApp
diff --git a/backend/src/utils/get-valid-token.ts b/backend/src/utils/get-valid-token.ts
index f0fa38774..ea0801e58 100644
--- a/backend/src/utils/get-valid-token.ts
+++ b/backend/src/utils/get-valid-token.ts
@@ -4,9 +4,9 @@ import { db } from '#/db/db';
 import { type TokenModel, tokensTable } from '#/db/schema/tokens';
 import { Env } from '#/lib/context';
 import { AppError } from '#/lib/errors';
+import { getValidSingleUseToken } from '#/utils/get-valid-single-use-token';
 import { isExpiredDate } from '#/utils/is-expired-date';
-import { getValidSingleUseToken } from './get-valid-single-use-token';
-import { nanoid } from './nanoid';
+import { nanoid } from '#/utils/nanoid';
 
 type BaseProps = {
   ctx: Context<Env>;
diff --git a/backend/src/utils/schema/common.ts b/backend/src/utils/schema/common.ts
index ee9890d0c..ebdca8e06 100644
--- a/backend/src/utils/schema/common.ts
+++ b/backend/src/utils/schema/common.ts
@@ -1,7 +1,7 @@
 import { z } from '@hono/zod-openapi';
 import { appConfig } from 'config';
 import { t } from 'i18next';
-import { isCDNUrl } from '../is-cdn-url';
+import { isCDNUrl } from '#/utils/is-cdn-url';
 
 /** Schema to use boolean parameters (transform string to boolean) */
 export const booleanTransformSchema = z
diff --git a/backend/src/utils/schema/responses.ts b/backend/src/utils/schema/responses.ts
index 29dceaa19..9a6125a44 100644
--- a/backend/src/utils/schema/responses.ts
+++ b/backend/src/utils/schema/responses.ts
@@ -10,6 +10,7 @@ type Responses = Parameters<typeof createRoute>[0]['responses'];
 /**
  * Schema for responses that may include a redirect.
  */
+// TODO refine don't require redirectPath by TS
 export const redirectResponseSchema = z
   .object({
     shouldRedirect: z.boolean(),
diff --git a/frontend/src/api.gen/sdk.gen.ts b/frontend/src/api.gen/sdk.gen.ts
index 8f5d2bebf..f8c6da5a3 100644
--- a/frontend/src/api.gen/sdk.gen.ts
+++ b/frontend/src/api.gen/sdk.gen.ts
@@ -3,9 +3,6 @@
 import type { Client, Options as Options2, TDataShape } from './client';
 import { client } from './client.gen';
 import type {
-  AcceptMembershipData,
-  AcceptMembershipErrors,
-  AcceptMembershipResponses,
   CheckEmailData,
   CheckEmailErrors,
   CheckEmailResponses,
@@ -134,6 +131,9 @@ import type {
   GoogleCallbackErrors,
   GoogleData,
   GoogleErrors,
+  HandleMembershipInvitationData,
+  HandleMembershipInvitationErrors,
+  HandleMembershipInvitationResponses,
   InvokeTokenData,
   InvokeTokenErrors,
   MembershipInviteData,
@@ -2180,20 +2180,20 @@ export const updateMembership = <ThrowOnError extends boolean = true>(options: O
 };
 
 /**
- * Accept invitation
+ * Respond to membership invitation
  * 🛡️ Requires authentication
  *
  * Accepting activates the associated membership. Rejecting adds a rejectedAt timestamp.
  *
- * **POST /{orgIdOrSlug}/memberships/{id}/{acceptOrReject}** ·· [acceptMembership](http://localhost:4000/docs#tag/membership/post/{orgIdOrSlug}/memberships/{id}/{acceptOrReject}) ·· _membership_
+ * **POST /{orgIdOrSlug}/memberships/{id}/{acceptOrReject}** ·· [handleMembershipInvitation](http://localhost:4000/docs#tag/membership/post/{orgIdOrSlug}/memberships/{id}/{acceptOrReject}) ·· _membership_
  *
- * @param {acceptMembershipData} options
+ * @param {handleMembershipInvitationData} options
  * @param {string} options.path.id - `string`
  * @param {enum} options.path.acceptorreject - `enum`
  * @returns Possible status codes: 200, 400, 401, 403, 404, 429
  */
-export const acceptMembership = <ThrowOnError extends boolean = true>(options: Options<AcceptMembershipData, ThrowOnError>) => {
-  return (options.client ?? client).post<AcceptMembershipResponses, AcceptMembershipErrors, ThrowOnError, 'data'>({
+export const handleMembershipInvitation = <ThrowOnError extends boolean = true>(options: Options<HandleMembershipInvitationData, ThrowOnError>) => {
+  return (options.client ?? client).post<HandleMembershipInvitationResponses, HandleMembershipInvitationErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
     security: [
       {
diff --git a/frontend/src/api.gen/types.gen.ts b/frontend/src/api.gen/types.gen.ts
index b48da108c..b82588193 100644
--- a/frontend/src/api.gen/types.gen.ts
+++ b/frontend/src/api.gen/types.gen.ts
@@ -1972,6 +1972,7 @@ export type GetMyInvitationsResponses = {
     membership: MembershipBaseSchema & {
       [key: string]: unknown;
     };
+    expiresAt: string;
   }>;
 };
 
@@ -4049,7 +4050,7 @@ export type UpdateMembershipResponses = {
 
 export type UpdateMembershipResponse = UpdateMembershipResponses[keyof UpdateMembershipResponses];
 
-export type AcceptMembershipData = {
+export type HandleMembershipInvitationData = {
   body?: never;
   path: {
     id: string;
@@ -4059,7 +4060,7 @@ export type AcceptMembershipData = {
   url: '/{orgIdOrSlug}/memberships/{id}/{acceptOrReject}';
 };
 
-export type AcceptMembershipErrors = {
+export type HandleMembershipInvitationErrors = {
   /**
    * Bad request: problem processing request.
    */
@@ -4092,21 +4093,16 @@ export type AcceptMembershipErrors = {
   };
 };
 
-export type AcceptMembershipError = AcceptMembershipErrors[keyof AcceptMembershipErrors];
+export type HandleMembershipInvitationError = HandleMembershipInvitationErrors[keyof HandleMembershipInvitationErrors];
 
-export type AcceptMembershipResponses = {
+export type HandleMembershipInvitationResponses = {
   /**
    * Invitation was accepted
    */
-  200: ContextEntityBaseSchema & {
-    membership: MembershipBaseSchema & {
-      [key: string]: unknown;
-    };
-    createdAt: string;
-  };
+  200: ContextEntityBaseSchema;
 };
 
-export type AcceptMembershipResponse = AcceptMembershipResponses[keyof AcceptMembershipResponses];
+export type HandleMembershipInvitationResponse = HandleMembershipInvitationResponses[keyof HandleMembershipInvitationResponses];
 
 export type GetMembersData = {
   body?: never;
diff --git a/frontend/src/api.gen/zod.gen.ts b/frontend/src/api.gen/zod.gen.ts
index fda03dfec..98a7037ef 100644
--- a/frontend/src/api.gen/zod.gen.ts
+++ b/frontend/src/api.gen/zod.gen.ts
@@ -727,6 +727,7 @@ export const zGetMyInvitationsResponse = z.array(
     ),
     invitedBy: zUserBaseSchema.and(z.union([z.record(z.string(), z.unknown()), z.null()])),
     membership: zMembershipBaseSchema.and(z.record(z.string(), z.unknown())),
+    expiresAt: z.string(),
   }),
 );
 
@@ -1441,7 +1442,7 @@ export const zUpdateMembershipResponse = z.object({
   organizationId: z.string(),
 });
 
-export const zAcceptMembershipData = z.object({
+export const zHandleMembershipInvitationData = z.object({
   body: z.optional(z.never()),
   path: z.object({
     id: z.string(),
@@ -1453,12 +1454,7 @@ export const zAcceptMembershipData = z.object({
 /**
  * Invitation was accepted
  */
-export const zAcceptMembershipResponse = zContextEntityBaseSchema.and(
-  z.object({
-    membership: zMembershipBaseSchema.and(z.record(z.string(), z.unknown())),
-    createdAt: z.string(),
-  }),
-);
+export const zHandleMembershipInvitationResponse = zContextEntityBaseSchema;
 
 export const zGetMembersData = z.object({
   body: z.optional(z.never()),
diff --git a/frontend/src/modules/attachments/dialog/handler.tsx b/frontend/src/modules/attachments/dialog/handler.tsx
index 7dc9250c0..5cdf69220 100644
--- a/frontend/src/modules/attachments/dialog/handler.tsx
+++ b/frontend/src/modules/attachments/dialog/handler.tsx
@@ -1,10 +1,10 @@
 import { useParams, useSearch } from '@tanstack/react-router';
 import { memo, useEffect } from 'react';
 import AttachmentDialog from '~/modules/attachments/dialog';
+import { clearAttachmentDialogSearchParams } from '~/modules/attachments/dialog/clear-search-params';
 import { LocalFileStorage } from '~/modules/attachments/helpers/local-file-storage';
 import { useDialoger } from '~/modules/common/dialoger/use-dialoger';
 import { fallbackContentRef } from '~/utils/fallback-content-ref';
-import { clearAttachmentDialogSearchParams } from './clear-search-params';
 
 const AttachmentDialogHandler = memo(() => {
   const { attachmentDialogId, groupId } = useSearch({ strict: false });
diff --git a/frontend/src/modules/attachments/table/bar.tsx b/frontend/src/modules/attachments/table/bar.tsx
index 10050beed..1f438e552 100644
--- a/frontend/src/modules/attachments/table/bar.tsx
+++ b/frontend/src/modules/attachments/table/bar.tsx
@@ -6,6 +6,7 @@ import type { Attachment } from '~/api.gen';
 import DeleteAttachments from '~/modules/attachments/delete-attachments';
 import type { AttachmentsTableProps } from '~/modules/attachments/table';
 import { useAttachmentsUploadDialog } from '~/modules/attachments/table/helpers';
+import type { AttachmentsRouteSearchParams } from '~/modules/attachments/types';
 import { AlertWrap } from '~/modules/common/alert-wrap';
 import ColumnsView from '~/modules/common/data-table/columns-view';
 import { TableBarButton } from '~/modules/common/data-table/table-bar-button';
@@ -17,7 +18,6 @@ import type { BaseTableBarProps } from '~/modules/common/data-table/types';
 import { useDialoger } from '~/modules/common/dialoger/use-dialoger';
 import { FocusView } from '~/modules/common/focus-view';
 import { useInfiniteQueryTotal } from '~/query/hooks/use-infinite-query-total';
-import type { AttachmentsRouteSearchParams } from '../types';
 
 type AttachmentsTableBarProps = AttachmentsTableProps &
   BaseTableBarProps<Attachment, AttachmentsRouteSearchParams> & {
diff --git a/frontend/src/modules/attachments/table/index.tsx b/frontend/src/modules/attachments/table/index.tsx
index fbae45c8e..86408b9af 100644
--- a/frontend/src/modules/attachments/table/index.tsx
+++ b/frontend/src/modules/attachments/table/index.tsx
@@ -14,12 +14,12 @@ import { attachmentsQueryOptions } from '~/modules/attachments/query';
 import { useAttachmentUpdateMutation } from '~/modules/attachments/query-mutations';
 import { AttachmentsTableBar } from '~/modules/attachments/table/bar';
 import { useColumns } from '~/modules/attachments/table/columns';
+import type { AttachmentsRouteSearchParams } from '~/modules/attachments/types';
 import ContentPlaceholder from '~/modules/common/content-placeholder';
 import { DataTable } from '~/modules/common/data-table';
 import { useSortColumns } from '~/modules/common/data-table/sort-columns';
 import type { EntityPage } from '~/modules/entities/types';
 import { isCDNUrl } from '~/utils/is-cdn-url';
-import type { AttachmentsRouteSearchParams } from '../types';
 
 const LIMIT = appConfig.requestLimits.attachments;
 
diff --git a/frontend/src/modules/auth/create-password-form.tsx b/frontend/src/modules/auth/create-password-form.tsx
index 8d1136026..ce5a1c1dc 100644
--- a/frontend/src/modules/auth/create-password-form.tsx
+++ b/frontend/src/modules/auth/create-password-form.tsx
@@ -42,9 +42,9 @@ const CreatePasswordForm = () => {
     error: resetPasswordError,
   } = useMutation<CreatePasswordResponse, ApiError, CreatePasswordData['body'] & CreatePasswordData['path']>({
     mutationFn: ({ tokenId, password }) => createPassword({ path: { tokenId }, body: { password } }),
-    onSuccess: () => {
-      toaster(t('common:success.password-reset'), 'success');
-      navigate({ to: appConfig.defaultRedirectPath });
+    onSuccess: ({ redirectPath }) => {
+      toaster(t('common:success.password_reset'), 'success');
+      navigate({ to: redirectPath ?? appConfig.defaultRedirectPath });
     },
   });
 
diff --git a/frontend/src/modules/auth/steps/provider-context.tsx b/frontend/src/modules/auth/steps/provider-context.tsx
index 485dae2a8..4c6b9c1a0 100644
--- a/frontend/src/modules/auth/steps/provider-context.tsx
+++ b/frontend/src/modules/auth/steps/provider-context.tsx
@@ -1,6 +1,6 @@
 import { createContext, useContext } from 'react';
 import type { ApiError } from '~/lib/api';
-import type { AuthStep, TokenData } from '../types';
+import type { AuthStep, TokenData } from '~/modules/auth/types';
 
 interface AuthContextProps {
   step: AuthStep;
diff --git a/frontend/src/modules/auth/steps/provider.tsx b/frontend/src/modules/auth/steps/provider.tsx
index 1a8be09dc..ec3409487 100644
--- a/frontend/src/modules/auth/steps/provider.tsx
+++ b/frontend/src/modules/auth/steps/provider.tsx
@@ -2,10 +2,10 @@ import { useMatchRoute, useSearch } from '@tanstack/react-router';
 import { appConfig } from 'config';
 import { type ReactNode, useEffect, useState } from 'react';
 import type { ApiError } from '~/lib/api';
+import { AuthContext } from '~/modules/auth/steps/provider-context';
 import type { AuthStep } from '~/modules/auth/types';
 import { useGetTokenData } from '~/modules/auth/use-token-check';
 import { useUserStore } from '~/store/user';
-import { AuthContext } from './provider-context';
 
 // TODO refactor to store?
 export const AuthStepsProvider = ({ children }: { children: ReactNode }) => {
diff --git a/frontend/src/modules/auth/totp-verify-code-form.tsx b/frontend/src/modules/auth/totp-verify-code-form.tsx
index 4742faeaf..0dd2a8b0b 100644
--- a/frontend/src/modules/auth/totp-verify-code-form.tsx
+++ b/frontend/src/modules/auth/totp-verify-code-form.tsx
@@ -6,8 +6,8 @@ import type z from 'zod';
 import { zCreateTotpData } from '~/api.gen/zod.gen';
 import { Button, SubmitButton } from '~/modules/ui/button';
 import { Form, FormControl, FormField, FormItem, FormLabel, FormMessage } from '~/modules/ui/form';
+import { InputOTP, InputOTPGroup, InputOTPSlot } from '~/modules/ui/totp';
 import { defaultOnInvalid } from '~/utils/form-on-invalid';
-import { InputOTP, InputOTPGroup, InputOTPSlot } from '../ui/totp';
 
 const formSchema = zCreateTotpData.shape.body;
 type FormValues = z.infer<typeof formSchema>;
diff --git a/frontend/src/modules/auth/use-token-check.tsx b/frontend/src/modules/auth/use-token-check.tsx
index 0b94f9ec6..599d869cd 100644
--- a/frontend/src/modules/auth/use-token-check.tsx
+++ b/frontend/src/modules/auth/use-token-check.tsx
@@ -7,7 +7,7 @@ import type { TokenData } from '~/modules/auth/types';
 /**
  *  Get token data by ID.
  *
- * @param type Type of the token (`"email_verification" | "password_reset" | "invitation"`)
+ * @param type Type of the token (`"email-verification" | "password-reset" | "invitation"`)
  * @param tokenId Token ID to check
  * @param enabled (Default true) Enable the query
  */
diff --git a/frontend/src/modules/common/sse/provider.tsx b/frontend/src/modules/common/sse/provider.tsx
index 61b412019..ef4f03ee9 100644
--- a/frontend/src/modules/common/sse/provider.tsx
+++ b/frontend/src/modules/common/sse/provider.tsx
@@ -1,8 +1,8 @@
 import { appConfig } from 'config';
 import { createElement, type FC, useEffect, useState } from 'react';
 import { useOnlineManager } from '~/hooks/use-online-manager';
+import { SSEContext } from '~/modules/common/sse/use-sse';
 import { getAndSetMe, getAndSetMenu } from '~/modules/me/helpers';
-import { SSEContext } from './use-sse';
 
 type Props = React.PropsWithChildren;
 
diff --git a/frontend/src/modules/entities/entity-grid/grid.tsx b/frontend/src/modules/entities/entity-grid/grid.tsx
index afe505181..cca20a8e8 100644
--- a/frontend/src/modules/entities/entity-grid/grid.tsx
+++ b/frontend/src/modules/entities/entity-grid/grid.tsx
@@ -6,9 +6,9 @@ import type { GetContextEntitiesData } from '~/api.gen';
 import ContentPlaceholder from '~/modules/common/content-placeholder';
 import { InfiniteLoader } from '~/modules/common/data-table/infinine-loader';
 import type { EntityGridWrapperProps } from '~/modules/entities/entity-grid';
+import { GridSkeleton } from '~/modules/entities/entity-grid/skeleton';
 import { EntityTile } from '~/modules/entities/entity-grid/tile';
 import type { contextEntitiesQueryOptions } from '~/modules/entities/query';
-import { GridSkeleton } from './skeleton';
 
 export type EntitySearch = Pick<NonNullable<GetContextEntitiesData['query']>, 'sort' | 'q' | 'role'>;
 
diff --git a/frontend/src/modules/marketing/about/showcase.tsx b/frontend/src/modules/marketing/about/showcase.tsx
index 2080373be..d191ea852 100644
--- a/frontend/src/modules/marketing/about/showcase.tsx
+++ b/frontend/src/modules/marketing/about/showcase.tsx
@@ -3,7 +3,7 @@ import { ArrowUpRight } from 'lucide-react';
 import { lazy, Suspense } from 'react';
 import { useTranslation } from 'react-i18next';
 import Spinner from '~/modules/common/spinner';
-import { showcaseItems } from '../marketing-config';
+import { showcaseItems } from '~/modules/marketing/marketing-config';
 
 const DeviceMockup = lazy(() => import('~/modules/marketing/device-mockup'));
 
diff --git a/frontend/src/modules/marketing/marketing-config.tsx b/frontend/src/modules/marketing/marketing-config.tsx
index 2ca7dbf4d..444c117fe 100644
--- a/frontend/src/modules/marketing/marketing-config.tsx
+++ b/frontend/src/modules/marketing/marketing-config.tsx
@@ -2,8 +2,8 @@ import { appConfig, type EntityType } from 'config';
 import { Building2, Cloud, Github, type LucideIcon, Users } from 'lucide-react';
 import type { AboutCard } from '~/modules/marketing/about/cards';
 import type { PricingPlan } from '~/modules/marketing/about/pricing';
+import { ShowcaseItem } from '~/modules/marketing/about/showcase';
 import { nanoid } from '~/utils/nanoid';
-import { ShowcaseItem } from './about/showcase';
 
 /*************************************************************************************************
  * Nav
diff --git a/frontend/src/modules/me/entity-invitations.tsx b/frontend/src/modules/me/entity-invitations.tsx
index ede0b3e43..0f1e97bcb 100644
--- a/frontend/src/modules/me/entity-invitations.tsx
+++ b/frontend/src/modules/me/entity-invitations.tsx
@@ -1,7 +1,13 @@
 import { useMutation, useSuspenseQuery } from '@tanstack/react-query';
 import { Link } from '@tanstack/react-router';
 import { useTranslation } from 'react-i18next';
-import { AcceptMembershipData, type AcceptMembershipResponse, type ApiError, acceptMembership, type GetMyInvitationsResponse } from '~/api.gen';
+import {
+  type ApiError,
+  type GetMyInvitationsResponse,
+  HandleMembershipInvitationData,
+  type HandleMembershipInvitationResponse,
+  handleMembershipInvitation,
+} from '~/api.gen';
 import { AvatarWrap } from '~/modules/common/avatar-wrap';
 import { ExpandableList } from '~/modules/common/expandable-list';
 import { toaster } from '~/modules/common/toaster/service';
@@ -23,15 +29,16 @@ export const EntityInvitations = () => {
   const queryOptions = meInvitationsQueryOptions();
   const { data: invites } = useSuspenseQuery(queryOptions);
 
-  const { mutate: _acceptMembership } = useMutation<AcceptMembershipResponse, ApiError, AcceptMembershipData['path']>({
-    mutationFn: ({ id, acceptOrReject }) => acceptMembership({ path: { id, acceptOrReject } }),
-    onSuccess: async (acceptedEntity) => {
+  const { mutate: handleInvitation } = useMutation<HandleMembershipInvitationResponse, ApiError, HandleMembershipInvitationData['path']>({
+    mutationFn: ({ id, acceptOrReject }) => handleMembershipInvitation({ path: { id, acceptOrReject } }),
+    onSuccess: async (settledEntity, { acceptOrReject }) => {
       await getAndSetMenu();
       queryClient.setQueryData<GetMyInvitationsResponse>(meKeys.invites, (oldData) => {
         if (!oldData) return oldData;
-        return oldData.filter((invite) => invite.entity.id !== acceptedEntity.id);
+        return oldData.filter((invite) => invite.entity.id !== settledEntity.id);
       });
-      toaster(t('common:invitation_accepted'), 'success');
+
+      toaster(t(`common:invitation_settled`, { action: acceptOrReject === 'accept' ? 'accepted' : 'rejected' }), 'success');
     },
   });
 
@@ -52,11 +59,14 @@ export const EntityInvitations = () => {
           </div>
           <ExpandableList
             items={invites}
-            renderItem={({ entity, invitedBy, membership }) => {
+            renderItem={({ entity, invitedBy, expiresAt, membership }) => {
               const { to, params, search } = getEntityRoute({ ...entity, membership: null });
+              const actionButtons = [
+                { label: t('common:accept'), variant: 'darkSuccess', action: 'accept' },
+                { label: t('common:reject'), variant: 'destructive', action: 'reject' },
+              ] as const;
 
-              // TODO
-              const isExpired = new Date(membership.createdAt as string) < new Date();
+              const isExpired = new Date(expiresAt) < new Date();
               return (
                 <div className="grid grid-cols-4 col-end- items-center gap-4 py-2">
                   <Link to={to} params={params} search={search} draggable="false" className="flex space-x-2 items-center outline-0 ring-0 group">
@@ -72,16 +82,23 @@ export const EntityInvitations = () => {
                     </span>
                   </Link>
                   {invitedBy ? <UserCell user={invitedBy} tabIndex={0} /> : '-'}
-                  {/* TODO */}
-                  <span>{isExpired ? 'Expired' : dateShort(membership.createdAt as string)}</span>
-                  <Button
-                    className="w-[60%] ml-auto"
-                    size="xs"
-                    variant="darkSuccess"
-                    onClick={() => _acceptMembership({ id: membership.id, acceptOrReject: 'accept' })}
-                  >
-                    {t('common:accept')}
-                  </Button>
+                  <span>{isExpired ? 'Expired' : dateShort(expiresAt)}</span>
+
+                  <div className="flex flex-col sm:flex-row gap-2 items-end justify-end">
+                    {/* TODO disable on expired it will auto clean by DB, or add button request invite? */}
+                    {actionButtons.map(({ label, variant, action }) => (
+                      <Button
+                        disabled={isExpired}
+                        className="w-[40%]"
+                        key={action}
+                        size="xs"
+                        variant={variant}
+                        onClick={() => handleInvitation({ id: membership.id, acceptOrReject: action })}
+                      >
+                        {label}
+                      </Button>
+                    ))}
+                  </div>
                 </div>
               );
             }}
diff --git a/frontend/src/modules/me/settings-page.tsx b/frontend/src/modules/me/settings-page.tsx
index 1f6f5814d..62b5eccc9 100644
--- a/frontend/src/modules/me/settings-page.tsx
+++ b/frontend/src/modules/me/settings-page.tsx
@@ -43,6 +43,8 @@ const UserSettingsPage = () => {
   const deleteButtonRef = useRef(null);
 
   const [disabledResetPassword, setDisabledResetPassword] = useState(false);
+  const [loadingProvider, setLoadingProvider] = useState<EnabledOAuthProvider | null>(null);
+
   const invertClass = mode === 'dark' ? 'invert' : '';
 
   const { mutate: requestPasswordChange } = useMutation<RequestPasswordResponse, ApiError | Error, NonNullable<RequestPasswordData['body']>>({
@@ -82,8 +84,9 @@ const UserSettingsPage = () => {
     if (!onlineManager.isOnline()) return toaster(t('common:action.offline.text'), 'warning');
 
     // Proceed to OAuth URL with redirect and connect
-    // TODO show spinner/loading like in auth page?
     try {
+      setLoadingProvider(provider);
+
       const baseUrl = `${appConfig.backendAuthUrl}/${provider}`;
       const params = new URLSearchParams({ type: 'connect', redirect: encodeURIComponent(window.location.pathname) });
 
@@ -91,6 +94,7 @@ const UserSettingsPage = () => {
       window.location.assign(providerUrl);
     } catch (error) {
       toaster(t('common:url_malformed'), 'error');
+      setLoadingProvider(null);
     }
   };
 
@@ -211,6 +215,7 @@ const UserSettingsPage = () => {
                         return (
                           // Assert is necessary because apps might not have all providers enabled
                           <Button
+                            loading={loadingProvider === provider.id}
                             key={provider.id}
                             type="button"
                             variant="plain"
diff --git a/frontend/src/modules/organizations/table/bar.tsx b/frontend/src/modules/organizations/table/bar.tsx
index 7d5242653..fb0056c58 100644
--- a/frontend/src/modules/organizations/table/bar.tsx
+++ b/frontend/src/modules/organizations/table/bar.tsx
@@ -19,10 +19,10 @@ import { toaster } from '~/modules/common/toaster/service';
 import UnsavedBadge from '~/modules/common/unsaved-badge';
 import CreateOrganizationForm from '~/modules/organizations/create-organization-form';
 import DeleteOrganizations from '~/modules/organizations/delete-organizations';
+import type { OrganizationsRouteSearchParams } from '~/modules/organizations/types';
 import CreateNewsletterForm from '~/modules/system/create-newsletter-form';
 import NewsletterPreview from '~/modules/system/newsletter-preview';
 import { useInfiniteQueryTotal } from '~/query/hooks/use-infinite-query-total';
-import type { OrganizationsRouteSearchParams } from '../types';
 
 type OrganizationsTableBarProps = BaseTableBarProps<Organization, OrganizationsRouteSearchParams>;
 
diff --git a/frontend/src/modules/organizations/table/index.tsx b/frontend/src/modules/organizations/table/index.tsx
index 793e6546f..d485cbeb1 100644
--- a/frontend/src/modules/organizations/table/index.tsx
+++ b/frontend/src/modules/organizations/table/index.tsx
@@ -15,8 +15,8 @@ import { useMemberUpdateMutation } from '~/modules/memberships/query-mutations';
 import { organizationsQueryOptions } from '~/modules/organizations/query';
 import { OrganizationsTableBar } from '~/modules/organizations/table/bar';
 import { useColumns } from '~/modules/organizations/table/columns';
+import type { OrganizationsRouteSearchParams } from '~/modules/organizations/types';
 import { useUserStore } from '~/store/user';
-import type { OrganizationsRouteSearchParams } from '../types';
 
 const LIMIT = appConfig.requestLimits.organizations;
 
diff --git a/frontend/src/modules/ui/button.tsx b/frontend/src/modules/ui/button.tsx
index 366606596..6abf13564 100644
--- a/frontend/src/modules/ui/button.tsx
+++ b/frontend/src/modules/ui/button.tsx
@@ -69,7 +69,7 @@ const Button = React.forwardRef<HTMLButtonElement, ButtonProps>(
     return (
       <Comp className={cn(baseStyle, loading && 'relative')} ref={ref} disabled={loading || disabled} {...props}>
         {loading && (
-          <div className="absolute inset-0 flex items-center justify-center bg-background/75">
+          <div className={cn(baseStyle, 'absolute inset-0 flex items-center justify-center bg-background/75')}>
             <Loader2 className="animate-spin text-primary" />
           </div>
         )}
diff --git a/frontend/src/routes-resolver.ts b/frontend/src/routes-resolver.ts
index bd6883900..90e7d84f6 100644
--- a/frontend/src/routes-resolver.ts
+++ b/frontend/src/routes-resolver.ts
@@ -1,8 +1,8 @@
-import type { UserBaseSchema } from './api.gen';
-import type { EntityPage } from './modules/entities/types';
-import type { UserMenuItem } from './modules/me/types';
-import type { EntityRoute } from './modules/navigation/types';
-import { baseEntityRoutes } from './routes-config';
+import type { UserBaseSchema } from '~/api.gen';
+import type { EntityPage } from '~/modules/entities/types';
+import type { UserMenuItem } from '~/modules/me/types';
+import type { EntityRoute } from '~/modules/navigation/types';
+import { baseEntityRoutes } from '~/routes-config';
 
 /**
  * App-specific entity path resolver
diff --git a/frontend/src/routes/auth-routes.tsx b/frontend/src/routes/auth-routes.tsx
index 23bb46f5d..906ccc74d 100644
--- a/frontend/src/routes/auth-routes.tsx
+++ b/frontend/src/routes/auth-routes.tsx
@@ -42,7 +42,7 @@ export const AuthenticateRoute = createRoute({
     if (cause !== 'enter' || search.fromRoot) return;
 
     // If stored user, redirect to home
-    const storedUser = useUserStore.getState().user;
+    const { user: storedUser } = useUserStore.getState();
     if (!storedUser) return;
     throw redirect({ to: appConfig.defaultRedirectPath, replace: true });
   },
diff --git a/frontend/src/routes/organization-routes.tsx b/frontend/src/routes/organization-routes.tsx
index 0015afc5a..3aaff55db 100644
--- a/frontend/src/routes/organization-routes.tsx
+++ b/frontend/src/routes/organization-routes.tsx
@@ -6,10 +6,10 @@ import ErrorNotice from '~/modules/common/error-notice';
 import { organizationQueryOptions } from '~/modules/organizations/query';
 import { queryClient } from '~/query/query-client';
 import { AppLayoutRoute } from '~/routes/base-routes';
+import { attachmentsRouteSearchParamsSchema, membersRouteSearchParamsSchema } from '~/routes/search-params-schemas';
 import { useToastStore } from '~/store/toast';
 import appTitle from '~/utils/app-title';
 import { noDirectAccess } from '~/utils/no-direct-access';
-import { attachmentsRouteSearchParamsSchema, membersRouteSearchParamsSchema } from './search-params-schemas';
 
 //Lazy-loaded components
 const OrganizationPage = lazy(() => import('~/modules/organizations/organization-page'));
diff --git a/frontend/src/routes/system-routes.tsx b/frontend/src/routes/system-routes.tsx
index bc2bc6530..35fcf11c3 100644
--- a/frontend/src/routes/system-routes.tsx
+++ b/frontend/src/routes/system-routes.tsx
@@ -3,9 +3,9 @@ import { lazy, Suspense } from 'react';
 import ErrorNotice from '~/modules/common/error-notice';
 import SystemPage from '~/modules/system/system-page';
 import { AppLayoutRoute } from '~/routes/base-routes';
+import { organizationsRouteSearchParamsSchema, requestsRouteSearchParamsSchema, usersRouteSearchParamsSchema } from '~/routes/search-params-schemas';
 import appTitle from '~/utils/app-title';
 import { noDirectAccess } from '~/utils/no-direct-access';
-import { organizationsRouteSearchParamsSchema, requestsRouteSearchParamsSchema, usersRouteSearchParamsSchema } from './search-params-schemas';
 
 // Lazy-loaded route components
 const OrganizationsTable = lazy(() => import('~/modules/organizations/table'));
diff --git a/locales/en/common.json b/locales/en/common.json
index e54317108..5a20aa35c 100644
--- a/locales/en/common.json
+++ b/locales/en/common.json
@@ -146,7 +146,7 @@
   "in_waitlist": "{{appName}} will soon contact you for early access!",
   "introduction": "Introduction",
   "invalid.url": "URL must start with https://",
-  "invitation_accepted": "Invitation has been accepted!",
+  "invitation_settled": "Invitation has been {{action}}!",
   "invite": "Invite",
   "invite_accept_proceed": "Sign up to proceed",
   "invite_by_email": "Invite with email addresses",
@@ -483,5 +483,6 @@
   "require_mfa": "Secure Account with MFA",
   "require_mfa.text": "Your account does not have MFA enabled. Enabling MFA helps secure your account.",
   "enable_resource": "Enable {{resource}}",
-  "mfa_enable_confirmation.text": "Enabling Multi-Factor Authentication adds an extra layer of security to your account."
+  "mfa_enable_confirmation.text": "Enabling Multi-Factor Authentication adds an extra layer of security to your account.",
+  "reject": "Reject"
 }
diff --git a/locales/en/errors.json b/locales/en/errors.json
index 800e684ab..70bc38d54 100644
--- a/locales/en/errors.json
+++ b/locales/en/errors.json
@@ -10,6 +10,7 @@
   "delete_resources": "{{resources}} could not be deleted",
   "duplicate_creation": "Item already exist",
   "email_exists": "Email already exists",
+  "email_already_verified": "Email already verified",
   "email-verification_expired": "Email verification token expired",
   "email-verification_expired.text": "Use forgot password to verify.",
   "oauth-verification_expired": "OAuth verification token expired",

From 9f61e82e6b9778c9fd5248c3aaa08f6757f843ac Mon Sep 17 00:00:00 2001
From: flipvanhaaren <flip@shareworks.nl>
Date: Wed, 1 Oct 2025 19:03:42 +0200
Subject: [PATCH 33/48] improve: use lastUser as state for mfa

---
 .../src/modules/auth/general/helpers/mfa.ts   |   2 +-
 frontend/src/api.gen/sdk.gen.ts               | 100 +++++++++---------
 frontend/src/modules/auth/{steps => }/mfa.tsx |  20 ++--
 frontend/src/modules/auth/steps/index.tsx     |   3 -
 frontend/src/modules/auth/steps/provider.tsx  |  10 +-
 frontend/src/modules/auth/steps/sign-in.tsx   |   4 +-
 frontend/src/modules/common/down-alert.tsx    |   2 +-
 frontend/src/routes/auth-routes.tsx           |   8 +-
 frontend/src/routes/route-tree.tsx            |   3 +-
 frontend/src/store/user.ts                    |   9 ++
 locales/en/common.json                        |   2 +-
 11 files changed, 86 insertions(+), 77 deletions(-)
 rename frontend/src/modules/auth/{steps => }/mfa.tsx (74%)

diff --git a/backend/src/modules/auth/general/helpers/mfa.ts b/backend/src/modules/auth/general/helpers/mfa.ts
index c6e9c1d00..c2c46077c 100644
--- a/backend/src/modules/auth/general/helpers/mfa.ts
+++ b/backend/src/modules/auth/general/helpers/mfa.ts
@@ -42,7 +42,7 @@ export const initiateMfa = async (ctx: Context<Env>, user: UserModel) => {
   await setAuthCookie(ctx, 'confirm-mfa', generatedToken, timespan);
 
   // Return the path to redirect the user to MFA authentication page
-  return '/auth/authenticate/mfa';
+  return '/auth/mfa';
 };
 
 /**
diff --git a/frontend/src/api.gen/sdk.gen.ts b/frontend/src/api.gen/sdk.gen.ts
index f8c6da5a3..3d8d58944 100644
--- a/frontend/src/api.gen/sdk.gen.ts
+++ b/frontend/src/api.gen/sdk.gen.ts
@@ -270,7 +270,7 @@ export const invokeToken = <ThrowOnError extends boolean = true>(options: Option
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -298,7 +298,7 @@ export const getTokenData = <ThrowOnError extends boolean = true>(options: Optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -325,7 +325,7 @@ export const startImpersonation = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -351,7 +351,7 @@ export const stopImpersonation = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -377,7 +377,7 @@ export const signOut = <ThrowOnError extends boolean = true>(options?: Options<S
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -721,7 +721,7 @@ export const signInWithPasskey = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -883,7 +883,7 @@ export const deleteMe = <ThrowOnError extends boolean = true>(options?: Options<
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -909,7 +909,7 @@ export const getMe = <ThrowOnError extends boolean = true>(options?: Options<Get
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -943,7 +943,7 @@ export const updateMe = <ThrowOnError extends boolean = true>(options?: Options<
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -976,7 +976,7 @@ export const toggleMfa = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1006,7 +1006,7 @@ export const getMyAuth = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1032,7 +1032,7 @@ export const getMyMenu = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1058,7 +1058,7 @@ export const getMyInvitations = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1085,7 +1085,7 @@ export const deleteMySessions = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1139,7 +1139,7 @@ export const getUploadToken = <ThrowOnError extends boolean = true>(options: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1167,7 +1167,7 @@ export const unsubscribeMe = <ThrowOnError extends boolean = true>(options: Opti
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1194,7 +1194,7 @@ export const deleteUsers = <ThrowOnError extends boolean = true>(options?: Optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1233,7 +1233,7 @@ export const getUsers = <ThrowOnError extends boolean = true>(options?: Options<
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1260,7 +1260,7 @@ export const getUser = <ThrowOnError extends boolean = true>(options: Options<Ge
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1294,7 +1294,7 @@ export const updateUser = <ThrowOnError extends boolean = true>(options: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1325,7 +1325,7 @@ export const deleteOrganizations = <ThrowOnError extends boolean = true>(options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1360,7 +1360,7 @@ export const getOrganizations = <ThrowOnError extends boolean = true>(options?:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1388,7 +1388,7 @@ export const createOrganization = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1419,7 +1419,7 @@ export const getOrganization = <ThrowOnError extends boolean = true>(options: Op
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1463,7 +1463,7 @@ export const updateOrganization = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1507,7 +1507,7 @@ export const getContextEntities = <ThrowOnError extends boolean = true>(options?
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1536,7 +1536,7 @@ export const getContextEntity = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1565,7 +1565,7 @@ export const checkSlug = <ThrowOnError extends boolean = true>(options?: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1596,7 +1596,7 @@ export const systemInvite = <ThrowOnError extends boolean = true>(options?: Opti
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1628,7 +1628,7 @@ export const getPresignedUrl = <ThrowOnError extends boolean = true>(options: Op
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1655,7 +1655,7 @@ export const paddleWebhook = <ThrowOnError extends boolean = true>(options?: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1690,7 +1690,7 @@ export const sendNewsletter = <ThrowOnError extends boolean = true>(options: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1721,7 +1721,7 @@ export const deleteRequests = <ThrowOnError extends boolean = true>(options?: Op
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1756,7 +1756,7 @@ export const getRequests = <ThrowOnError extends boolean = true>(options?: Optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1786,7 +1786,7 @@ export const createRequest = <ThrowOnError extends boolean = true>(options?: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1817,7 +1817,7 @@ export const getMetrics = <ThrowOnError extends boolean = true>(options?: Option
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1844,7 +1844,7 @@ export const getPublicCounts = <ThrowOnError extends boolean = true>(options?: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1879,7 +1879,7 @@ export const shapeProxy = <ThrowOnError extends boolean = true>(options: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1907,7 +1907,7 @@ export const deleteAttachments = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1944,7 +1944,7 @@ export const getAttachments = <ThrowOnError extends boolean = true>(options: Opt
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -1971,7 +1971,7 @@ export const createAttachment = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2003,7 +2003,7 @@ export const getAttachment = <ThrowOnError extends boolean = true>(options: Opti
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2033,7 +2033,7 @@ export const updateAttachment = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2065,7 +2065,7 @@ export const redirectToAttachment = <ThrowOnError extends boolean = true>(option
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2095,7 +2095,7 @@ export const deleteMemberships = <ThrowOnError extends boolean = true>(options:
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2130,7 +2130,7 @@ export const membershipInvite = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2166,7 +2166,7 @@ export const updateMembership = <ThrowOnError extends boolean = true>(options: O
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2198,7 +2198,7 @@ export const handleMembershipInvitation = <ThrowOnError extends boolean = true>(
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2233,7 +2233,7 @@ export const getMembers = <ThrowOnError extends boolean = true>(options: Options
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
@@ -2267,7 +2267,7 @@ export const getPendingInvitations = <ThrowOnError extends boolean = true>(optio
     security: [
       {
         in: 'cookie',
-        name: 'cella-session-v1',
+        name: 'cella-development-session-v1',
         type: 'apiKey',
       },
     ],
diff --git a/frontend/src/modules/auth/steps/mfa.tsx b/frontend/src/modules/auth/mfa.tsx
similarity index 74%
rename from frontend/src/modules/auth/steps/mfa.tsx
rename to frontend/src/modules/auth/mfa.tsx
index 2cd788a71..5cf3d4419 100644
--- a/frontend/src/modules/auth/steps/mfa.tsx
+++ b/frontend/src/modules/auth/mfa.tsx
@@ -4,18 +4,19 @@ import { useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import { signOut } from '~/api.gen';
 import PasskeyStrategy from '~/modules/auth/passkey-strategy';
-import { useAuthStepsContext } from '~/modules/auth/steps/provider-context';
 import { TotpStrategy } from '~/modules/auth/totp-strategy';
 import { toaster } from '~/modules/common/toaster/service';
 import { Button } from '~/modules/ui/button';
+import { useUserStore } from '~/store/user';
 
 /**
- * Handles multifactor authentication step in the authentication process.
+ * Handles multifactor authentication in the authentication flows.
  */
-export const MfaStep = () => {
+export const Mfa = () => {
   const { t } = useTranslation();
   const navigate = useNavigate();
-  const { email, resetSteps } = useAuthStepsContext();
+
+  const { lastUser, clearUserStore } = useUserStore();
 
   const [isActive, setIsActive] = useState(false);
 
@@ -24,18 +25,25 @@ export const MfaStep = () => {
       await signOut();
       toaster(t('common:success.cancel_mfa'), 'success');
     } catch (error) {
+      // TODO log to sentry?
     } finally {
-      resetSteps();
+      clearUserStore();
       navigate({ to: '/auth/authenticate', replace: true });
     }
   };
 
+  // If somehow undefined return to authenticate
+  if (!lastUser?.email) {
+    navigate({ to: '/auth/authenticate', replace: true });
+    return <></>;
+  }
+
   return (
     <>
       <h1 className="text-2xl text-center">{t('common:mfa_header')}</h1>
 
       <Button variant="ghost" onClick={handleCancelMfa} className="mx-auto flex max-w-full truncate font-light sm:text-xl bg-foreground/10">
-        <span className="truncate">{email}</span>
+        <span className="truncate">{lastUser.email}</span>
         <ChevronDown size={16} className="ml-1" />
       </Button>
 
diff --git a/frontend/src/modules/auth/steps/index.tsx b/frontend/src/modules/auth/steps/index.tsx
index caf5d3d85..11ae0083a 100644
--- a/frontend/src/modules/auth/steps/index.tsx
+++ b/frontend/src/modules/auth/steps/index.tsx
@@ -1,4 +1,3 @@
-import { Outlet } from '@tanstack/react-router';
 import { appConfig } from 'config';
 import { useTranslation } from 'react-i18next';
 import OAuthProviders from '~/modules/auth/oauth-providers';
@@ -47,8 +46,6 @@ const AuthSteps = () => {
       {step === 'signIn' && <SignInStep />}
       {step === 'signUp' && <SignUpStep />}
 
-      {step === 'mfa' && <Outlet />}
-
       {step === 'waitlist' && <WaitlistStep />}
       {step === 'inviteOnly' && <InviteOnlyStep />}
       {step === 'error' && <AuthErrorStep />}
diff --git a/frontend/src/modules/auth/steps/provider.tsx b/frontend/src/modules/auth/steps/provider.tsx
index ec3409487..4986d50fa 100644
--- a/frontend/src/modules/auth/steps/provider.tsx
+++ b/frontend/src/modules/auth/steps/provider.tsx
@@ -1,4 +1,4 @@
-import { useMatchRoute, useSearch } from '@tanstack/react-router';
+import { useSearch } from '@tanstack/react-router';
 import { appConfig } from 'config';
 import { type ReactNode, useEffect, useState } from 'react';
 import type { ApiError } from '~/lib/api';
@@ -9,12 +9,9 @@ import { useUserStore } from '~/store/user';
 
 // TODO refactor to store?
 export const AuthStepsProvider = ({ children }: { children: ReactNode }) => {
-  const matchRoute = useMatchRoute();
   const { lastUser } = useUserStore();
   const { tokenId, error, severity } = useSearch({ from: '/publicLayout/authLayout/auth/authenticate' });
 
-  const isMfaRoute = !!matchRoute({ to: '/auth/authenticate/mfa' });
-
   // Initialize email and step
   const initEmail = (!tokenId && lastUser?.email) || '';
   const initStep: AuthStep = !tokenId && lastUser?.email ? 'signIn' : 'checkEmail';
@@ -36,11 +33,6 @@ export const AuthStepsProvider = ({ children }: { children: ReactNode }) => {
     setAuthError(null);
   };
 
-  // Handle MFA from query params
-  useEffect(() => {
-    if (isMfaRoute) setStepState('mfa');
-  }, [isMfaRoute]);
-
   useEffect(() => {
     if (!error) return;
 
diff --git a/frontend/src/modules/auth/steps/sign-in.tsx b/frontend/src/modules/auth/steps/sign-in.tsx
index 570155684..4b7f36592 100644
--- a/frontend/src/modules/auth/steps/sign-in.tsx
+++ b/frontend/src/modules/auth/steps/sign-in.tsx
@@ -34,7 +34,7 @@ export const SignInStep = () => {
 
   const passwordRef = useRef<HTMLInputElement>(null);
 
-  const { lastUser, clearUserStore } = useUserStore();
+  const { lastUser, clearUserStore, setLastUser } = useUserStore();
   const { redirect: encodedRedirect, tokenId } = useSearch({ from: '/publicLayout/authLayout/auth/authenticate' });
 
   const redirect = decodeURIComponent(encodedRedirect || '');
@@ -51,6 +51,8 @@ export const SignInStep = () => {
     mutationFn: (body) => signIn({ body }),
     onSuccess: ({ redirectPath: apiRedirectPath }) => {
       if (apiRedirectPath) {
+        // TODO refactor conditional like this
+        if (apiRedirectPath === '/auth/mfa') setLastUser({ email, mfaRequired: true });
         navigate({ to: apiRedirectPath, replace: true });
         return;
       }
diff --git a/frontend/src/modules/common/down-alert.tsx b/frontend/src/modules/common/down-alert.tsx
index 75d63bf46..a7365ea64 100644
--- a/frontend/src/modules/common/down-alert.tsx
+++ b/frontend/src/modules/common/down-alert.tsx
@@ -80,7 +80,7 @@ export const DownAlert = () => {
     };
   }, [downAlert, isOnline]);
 
-  // Triggered by Failed to fetch err on serv helth check and runs a delayed health check fn to wait for backend recovery
+  // Triggered by Failed to fetch err on server health check and runs a delayed health check fn to wait for backend recovery
   useEffect(() => {
     if (downAlert !== 'backend_not_ready' || dismissedAlerts.backend_not_ready || !isOnline) return;
 
diff --git a/frontend/src/routes/auth-routes.tsx b/frontend/src/routes/auth-routes.tsx
index 906ccc74d..83604a207 100644
--- a/frontend/src/routes/auth-routes.tsx
+++ b/frontend/src/routes/auth-routes.tsx
@@ -5,10 +5,10 @@ import { z } from 'zod';
 import CreatePasswordForm from '~/modules/auth/create-password-form';
 import EmailVerification from '~/modules/auth/email-verification';
 import AuthPage from '~/modules/auth/layout';
+import { Mfa } from '~/modules/auth/mfa';
 import { RequestPasswordForm } from '~/modules/auth/request-password-form';
 import { SignOut } from '~/modules/auth/sign-out';
 import AuthSteps from '~/modules/auth/steps';
-import { MfaStep } from '~/modules/auth/steps/mfa';
 import { AuthStepsProvider } from '~/modules/auth/steps/provider';
 import Unsubscribed from '~/modules/auth/unsubscribed';
 import { errorSearchSchema, PublicLayoutRoute } from '~/routes/base-routes';
@@ -54,12 +54,12 @@ export const AuthenticateRoute = createRoute({
 });
 
 export const MfaRoute = createRoute({
-  path: '/mfa',
+  path: '/auth/mfa',
   validateSearch: authenticateRouteSearch,
   staticData: { isAuth: false },
   head: () => ({ meta: [{ title: appTitle('Authenticate') }] }),
-  getParentRoute: () => AuthenticateRoute,
-  component: () => <MfaStep />,
+  getParentRoute: () => AuthLayoutRoute,
+  component: () => <Mfa />,
 });
 
 export const RequestPasswordRoute = createRoute({
diff --git a/frontend/src/routes/route-tree.tsx b/frontend/src/routes/route-tree.tsx
index f12514aab..db8dc354a 100644
--- a/frontend/src/routes/route-tree.tsx
+++ b/frontend/src/routes/route-tree.tsx
@@ -31,7 +31,8 @@ export const routeTree = RootRoute.addChildren([
     ErrorNoticeRoute,
     SignOutRoute,
     AuthLayoutRoute.addChildren([
-      AuthenticateRoute.addChildren([MfaRoute]),
+      AuthenticateRoute,
+      MfaRoute,
       RequestPasswordRoute,
       CreatePasswordWithTokenRoute,
       EmailVerificationRoute,
diff --git a/frontend/src/store/user.ts b/frontend/src/store/user.ts
index 2633d320b..d20a40256 100644
--- a/frontend/src/store/user.ts
+++ b/frontend/src/store/user.ts
@@ -13,6 +13,7 @@ interface UserStoreState {
   enabledOAuth: MeAuthData['enabledOAuth']; // Current user's oauth options
   lastUser: Partial<MeUser> | null; // Last signed-out user's data (email, name, passkey, id, slug)
   setUser: (user: MeUser, skipLastUser?: boolean) => void; // Sets current user and updates lastUser
+  setLastUser: (lastUser: Partial<MeUser>) => void; // Sets last user (used for MFA)
   setMeAuthData: (data: Partial<Pick<MeAuthData, 'hasTotp' | 'enabledOAuth'> & { hasPasskey: boolean }>) => void; // Sets current user auth info
   updateUser: (user: User) => void; // Updates current user and adjusts lastUser
   clearUserStore: () => void; // Resets the store.
@@ -61,6 +62,14 @@ export const useUserStore = create<UserStoreState>()(
 
           i18n.changeLanguage(user.language || 'en');
         },
+        setLastUser: (lastUser) => {
+          set((state) => {
+            state.lastUser = {
+              email: lastUser.email,
+              mfaRequired: lastUser.mfaRequired,
+            };
+          });
+        },
         setMeAuthData: (data) => {
           set((state) => {
             state.hasPasskey = data.hasPasskey ?? state.hasPasskey;
diff --git a/locales/en/common.json b/locales/en/common.json
index 5a20aa35c..c796f3cd7 100644
--- a/locales/en/common.json
+++ b/locales/en/common.json
@@ -230,7 +230,7 @@
   "notification_email.text": "Receive announcements and product updates through this email address.",
   "notifications": "Notifications",
   "oauth": "OAuth providers",
-  "oauth.text": "Connect your account with a popular identity provider.",
+  "oauth.text": "Sign in with an identity provider that you already use.",
   "offline": "Offline",
   "offline_access": "Offline access",
   "offline_access_off.text": "{{appName}} cleared offline cache and stopped syncing.",

From 0f55bed646c80a370546f57f165c2288d2858fe9 Mon Sep 17 00:00:00 2001
From: David Hordiienko <shiraz0david@gmail.com>
Date: Thu, 2 Oct 2025 09:48:16 +0300
Subject: [PATCH 34/48] fix: pending count

---
 .../src/modules/entities/helpers/counts/member.ts   |  6 +++---
 frontend/src/modules/memberships/query-mutations.ts | 13 +++++++++++++
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/backend/src/modules/entities/helpers/counts/member.ts b/backend/src/modules/entities/helpers/counts/member.ts
index e79cb264a..2d5fec1b1 100644
--- a/backend/src/modules/entities/helpers/counts/member.ts
+++ b/backend/src/modules/entities/helpers/counts/member.ts
@@ -1,5 +1,5 @@
 import { appConfig, type ContextEntityType } from 'config';
-import { and, count, eq, isNotNull, sql } from 'drizzle-orm';
+import { and, count, eq, isNotNull, isNull, sql } from 'drizzle-orm';
 import { db } from '#/db/db';
 import { membershipsTable } from '#/db/schema/memberships';
 import { tokensTable } from '#/db/schema/tokens';
@@ -25,7 +25,7 @@ export const getMemberCountsQuery = (entityType: ContextEntityType) => {
       invites: count().as('invites'),
     })
     .from(tokensTable)
-    .where(and(eq(tokensTable.type, 'invitation'), isNotNull(tokensTable.entityType)))
+    .where(and(eq(tokensTable.type, 'invitation'), isNotNull(tokensTable.entityType), isNull(tokensTable.invokedAt)))
     .groupBy(tokensTable[targetEntityIdField])
     .as('invites');
 
@@ -53,7 +53,7 @@ export const getMemberCountsQuery = (entityType: ContextEntityType) => {
  *
  * @param entityType - The entity to filter by, or null for all entities.
  * @param id - id to filter the count by a specific entity instance.
- * @returns - The count of admins, members, pending and total members.
+ * @returns The count of admins, members, pending and total members.
  */
 export function getMemberCounts(entityType: ContextEntityType, id: string) {
   const query = getMemberCountsQuery(entityType);
diff --git a/frontend/src/modules/memberships/query-mutations.ts b/frontend/src/modules/memberships/query-mutations.ts
index 2b7653011..805f5eb26 100644
--- a/frontend/src/modules/memberships/query-mutations.ts
+++ b/frontend/src/modules/memberships/query-mutations.ts
@@ -42,6 +42,7 @@ export const useInviteMemberMutation = () =>
         path: { orgIdOrSlug: entity.organizationId || entity.id },
       }),
     onSuccess: ({ invitesSentCount }, { entity }) => {
+      // TODO make SSE for updating pending counts and table
       const { id, slug, entityType, organizationId } = entity;
       if (invitesSentCount) {
         // If the entity is not an organization but belongs to one, update its cache too
@@ -66,6 +67,18 @@ export const useInviteMemberMutation = () =>
 
           return updateInvitesCount(oldEntity, invitesSentCount);
         });
+
+        const queries = queryClient.getQueriesData<EntityPage>({
+          queryKey: [entityType],
+          predicate: (query) => {
+            const oldEntity = query.state.data as EntityPage | undefined;
+            return !!oldEntity && oldEntity.id === id; // only update matching entity
+          },
+        });
+
+        for (const [key] of queries) {
+          queryClient.setQueryData<EntityPage>(key, (entity) => (entity ? updateInvitesCount(entity, invitesSentCount) : entity));
+        }
       }
     },
     onError,

From 536a0f532742c9845fe9193fba8c501de2953665 Mon Sep 17 00:00:00 2001
From: David Hordiienko <shiraz0david@gmail.com>
Date: Thu, 2 Oct 2025 12:14:14 +0300
Subject: [PATCH 35/48] fix(createMemberships):  usage of existingUser
 membeship

---
 backend/src/modules/memberships/handlers.ts | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/backend/src/modules/memberships/handlers.ts b/backend/src/modules/memberships/handlers.ts
index 2e9a8f9fe..0e1d87a59 100644
--- a/backend/src/modules/memberships/handlers.ts
+++ b/backend/src/modules/memberships/handlers.ts
@@ -103,7 +103,7 @@ const membershipRouteHandlers = app
           db
             .update(tokensTable)
             .set({
-              entityType: entityType,
+              entityType,
               [targetEntityIdField]: entityId,
               ...(associatedEntity && { [associatedEntity.field]: associatedEntity.id }),
               expiresAt: createDate(new TimeSpan(7, 'd')),
@@ -146,15 +146,16 @@ const membershipRouteHandlers = app
     // Process existing users
     await Promise.all(
       existingUsers.map(async ({ id: userId, email }) => {
+        const userMemberships = memberships.filter((m) => m.userId === userId);
         // Check if the user is already a member of the target entity
-        const targetMembership = memberships.find((m) => m.contextType === entityType && m[targetEntityIdField] === entityId);
+        const targetMembership = userMemberships.find((m) => m.contextType === entityType && m[targetEntityIdField] === entityId);
         if (targetMembership) {
           logEvent('info', `User already member of ${entityType}`, { userId: userId, [targetEntityIdField]: entityId });
           return;
         }
 
         // Check for organization memberships
-        const hasOrgMembership = memberships.some((m) => m.contextType === 'organization' && m.organizationId === organization.id);
+        const hasOrgMembership = userMemberships.some((m) => m.contextType === 'organization' && m.organizationId === organization.id);
         // Determine if membership should be created instantly
         const instantCreateMembership = (entityType !== 'organization' && hasOrgMembership) || (user.role === 'admin' && userId === user.id);
 
@@ -163,7 +164,7 @@ const membershipRouteHandlers = app
 
         // Check for associated memberships
         const addAssociatedMembership = associatedEntity
-          ? memberships.some((m) => m.contextType === associatedEntity.type && m[associatedEntity.field] === associatedEntity.id)
+          ? userMemberships.some((m) => m.contextType === associatedEntity.type && m[associatedEntity.field] === associatedEntity.id)
           : false;
 
         const createdMembership = await insertMembership({ userId, role, entity, addAssociatedMembership });

From ee36b8bcfa952221795818a7bf952094c139aafb Mon Sep 17 00:00:00 2001
From: flipvanhaaren <flip@shareworks.nl>
Date: Thu, 2 Oct 2025 12:54:27 +0200
Subject: [PATCH 36/48] improve: auth store, remove context

---
 backend/src/modules/auth/general/handlers.ts  |  2 +-
 backend/src/modules/auth/general/routes.ts    |  4 +-
 .../src/modules/auth/passwords/handlers.ts    |  9 ----
 backend/src/modules/auth/passwords/routes.ts  | 23 --------
 backend/src/modules/requests/routes.ts        |  4 +-
 frontend/src/api.gen/sdk.gen.ts               | 30 ++---------
 frontend/src/api.gen/types.gen.ts             | 46 ----------------
 frontend/src/api.gen/zod.gen.ts               | 12 -----
 .../index.tsx => authenticate-page.tsx}       | 31 ++++++++---
 .../src/modules/auth/email-verification.tsx   |  2 +-
 .../modules/auth/{steps => }/legal-notice.tsx |  0
 .../src/modules/auth/steps/auth-error.tsx     | 27 ++++++++++
 .../src/modules/auth/steps/check-email.tsx    | 15 ++++--
 frontend/src/modules/auth/steps/error.tsx     | 17 ------
 .../modules/auth/steps/provider-context.tsx   | 20 -------
 frontend/src/modules/auth/steps/provider.tsx  | 53 -------------------
 frontend/src/modules/auth/steps/sign-in.tsx   |  4 +-
 frontend/src/modules/auth/steps/sign-up.tsx   | 13 ++---
 frontend/src/modules/auth/steps/waitlist.tsx  |  6 +--
 frontend/src/modules/auth/types.ts            |  2 +-
 frontend/src/modules/common/error-notice.tsx  |  4 +-
 frontend/src/query/on-error.ts                |  2 +
 frontend/src/routes/auth-routes.tsx           | 22 +++++---
 frontend/src/routes/home-routes.tsx           |  6 ++-
 frontend/src/routes/route-tree.tsx            |  2 +
 frontend/src/store/alert.ts                   |  3 ++
 frontend/src/store/auth.ts                    | 29 ++++++++++
 frontend/src/store/blob.ts                    |  3 ++
 frontend/src/store/draft.ts                   |  3 ++
 29 files changed, 143 insertions(+), 251 deletions(-)
 rename frontend/src/modules/auth/{steps/index.tsx => authenticate-page.tsx} (69%)
 rename frontend/src/modules/auth/{steps => }/legal-notice.tsx (100%)
 create mode 100644 frontend/src/modules/auth/steps/auth-error.tsx
 delete mode 100644 frontend/src/modules/auth/steps/error.tsx
 delete mode 100644 frontend/src/modules/auth/steps/provider-context.tsx
 delete mode 100644 frontend/src/modules/auth/steps/provider.tsx
 create mode 100644 frontend/src/store/auth.ts

diff --git a/backend/src/modules/auth/general/handlers.ts b/backend/src/modules/auth/general/handlers.ts
index ce55c333a..8e3a09e8f 100644
--- a/backend/src/modules/auth/general/handlers.ts
+++ b/backend/src/modules/auth/general/handlers.ts
@@ -60,7 +60,7 @@ const authGeneralRouteHandlers = app
     return ctx.json(true, 200);
   })
   /**
-   * Consume token and redirect with single use session token in cookie
+   * Validate and consume token and redirect with single use session token in cookie
    */
   .openapi(authGeneralRoutes.invokeToken, async (ctx) => {
     const { token, type: tokenType } = ctx.req.valid('param');
diff --git a/backend/src/modules/auth/general/routes.ts b/backend/src/modules/auth/general/routes.ts
index aa8610016..dbbb66c55 100644
--- a/backend/src/modules/auth/general/routes.ts
+++ b/backend/src/modules/auth/general/routes.ts
@@ -94,9 +94,9 @@ const authGeneralRoutes = {
     guard: isPublicAccess,
     middleware: isNoBot,
     tags: ['auth'],
-    summary: 'Refresh token',
+    summary: 'Invoke token session',
     description:
-      'Validates email token (for password reset, email verification or invitations) and redirects user to backend with a refreshed token in a cookie.',
+      'Validates and invokes a token (for password reset, email verification, invitations, mfa) and redirects user to backend with a one-purpose, single-use token session in a cookie.',
     request: {
       params: z.object({ type: z.enum(appConfig.tokenTypes), token: z.string() }),
     },
diff --git a/backend/src/modules/auth/passwords/handlers.ts b/backend/src/modules/auth/passwords/handlers.ts
index b33e46f17..f08954dc5 100644
--- a/backend/src/modules/auth/passwords/handlers.ts
+++ b/backend/src/modules/auth/passwords/handlers.ts
@@ -16,7 +16,6 @@ import { sendVerificationEmail } from '#/modules/auth/general/helpers/send-verif
 import { setUserSession } from '#/modules/auth/general/helpers/session';
 import { handleCreateUser } from '#/modules/auth/general/helpers/user';
 import { hashPassword, verifyPasswordHash } from '#/modules/auth/passwords/helpers/argon2id';
-import { handleEmailVerification } from '#/modules/auth/passwords/helpers/handle-email-verification';
 import authPasswordsRoutes from '#/modules/auth/passwords/routes';
 import { membershipBaseSelect } from '#/modules/memberships/helpers/select';
 import { usersBaseQuery } from '#/modules/users/helpers/select';
@@ -115,14 +114,6 @@ const authPasswordsRouteHandlers = app
 
     return ctx.json({ shouldRedirect: true, redirectPath }, 200);
   })
-  /**
-   * Verify email
-   */
-  .openapi(authPasswordsRoutes.verifyEmail, async (ctx) => {
-    const token = getContextToken();
-
-    return handleEmailVerification(ctx, token);
-  })
   /**
    * Request reset password email
    */
diff --git a/backend/src/modules/auth/passwords/routes.ts b/backend/src/modules/auth/passwords/routes.ts
index f52476122..ee9434c47 100644
--- a/backend/src/modules/auth/passwords/routes.ts
+++ b/backend/src/modules/auth/passwords/routes.ts
@@ -63,29 +63,6 @@ const authPasswordsRoutes = {
     },
   }),
 
-  verifyEmail: createCustomRoute({
-    operationId: 'verifyEmail',
-    method: 'get',
-    path: '/verify-email/{tokenId}',
-    guard: isPublicAccess,
-    middleware: [tokenLimiter('email-verification'), hasValidSingleUseToken('email-verification')],
-    tags: ['auth'],
-    summary: 'Verify email by token',
-    description: "Verifies a user's email using a single-use session token in cookie. Grants a session upon success.",
-    security: [],
-    request: {
-      params: z.object({ tokenId: z.string() }),
-      query: z.object({ redirect: z.string().optional() }),
-    },
-    responses: {
-      302: {
-        description: 'Session created and redirected',
-        headers: locationSchema,
-      },
-      ...errorResponses,
-    },
-  }),
-
   requestPassword: createCustomRoute({
     operationId: 'requestPassword',
     method: 'post',
diff --git a/backend/src/modules/requests/routes.ts b/backend/src/modules/requests/routes.ts
index 0138cf4f7..96df67cf8 100644
--- a/backend/src/modules/requests/routes.ts
+++ b/backend/src/modules/requests/routes.ts
@@ -1,7 +1,7 @@
 import { createCustomRoute } from '#/lib/custom-routes';
 import { hasSystemAccess, isAuthenticated, isPublicAccess } from '#/middlewares/guard';
 import { isNoBot } from '#/middlewares/is-no-bot';
-import { spamLimiter } from '#/middlewares/rate-limiter/limiters';
+import { emailEnumLimiter, spamLimiter } from '#/middlewares/rate-limiter/limiters';
 import { requestCreateBodySchema, requestListQuerySchema, requestSchema } from '#/modules/requests/schema';
 import { idsBodySchema } from '#/utils/schema/common';
 import { errorResponses, paginationSchema, successWithoutDataSchema } from '#/utils/schema/responses';
@@ -12,7 +12,7 @@ const requestRoutes = {
     method: 'post',
     path: '/',
     guard: isPublicAccess,
-    middleware: [isNoBot, spamLimiter],
+    middleware: [isNoBot, emailEnumLimiter, spamLimiter],
     tags: ['requests'],
     summary: 'Create request',
     description: 'Submits a new *request* to the system. Supported types include contact form, newsletter signup, and waitlist entry.',
diff --git a/frontend/src/api.gen/sdk.gen.ts b/frontend/src/api.gen/sdk.gen.ts
index 3d8d58944..526b17eab 100644
--- a/frontend/src/api.gen/sdk.gen.ts
+++ b/frontend/src/api.gen/sdk.gen.ts
@@ -208,8 +208,6 @@ import type {
   UpdateUserData,
   UpdateUserErrors,
   UpdateUserResponses,
-  VerifyEmailData,
-  VerifyEmailErrors,
 } from './types.gen';
 
 export type Options<TData extends TDataShape = TDataShape, ThrowOnError extends boolean = boolean> = Options2<TData, ThrowOnError> & {
@@ -252,10 +250,10 @@ export const checkEmail = <ThrowOnError extends boolean = true>(options?: Option
 };
 
 /**
- * Refresh token
+ * Invoke token session
  * 🌐 Public access
  *
- * Validates email token (for password reset, email verification or invitations) and redirects user to backend with a refreshed token in a cookie.
+ * Validates and invokes a token (for password reset, email verification, invitations, mfa) and redirects user to backend with a one-purpose, single-use token session in a cookie.
  *
  * **GET /auth/invoke-token/{type}/{token}** ·· [invokeToken](http://localhost:4000/docs#tag/auth/get/auth/invoke-token/{type}/{token}) ·· _auth_
  *
@@ -526,28 +524,6 @@ export const signUpWithToken = <ThrowOnError extends boolean = true>(options: Op
   });
 };
 
-/**
- * Verify email by token
- * 🌐 Public access
- * ⏳ token_email-verification (10/h)
- *
- * Verifies a user's email using a single-use session token in cookie. Grants a session upon success.
- *
- * **GET /auth/verify-email/{tokenId}** ·· [verifyEmail](http://localhost:4000/docs#tag/auth/get/auth/verify-email/{tokenId}) ·· _auth_
- *
- * @param {verifyEmailData} options
- * @param {string} options.path.tokenid - `string`
- * @param {string=} options.query.redirect - `string` (optional)
- * @returns Possible status codes: 302, 400, 401, 403, 404, 429
- */
-export const verifyEmail = <ThrowOnError extends boolean = true>(options: Options<VerifyEmailData, ThrowOnError>) => {
-  return (options.client ?? client).get<unknown, VerifyEmailErrors, ThrowOnError, 'data'>({
-    responseStyle: 'data',
-    url: '/auth/verify-email/{tokenId}',
-    ...options,
-  });
-};
-
 /**
  * Request new password
  * 🌐 Public access
@@ -1768,7 +1744,7 @@ export const getRequests = <ThrowOnError extends boolean = true>(options?: Optio
 /**
  * Create request
  * 🌐 Public access
- * ⏳ Spam (10/h)
+ * ⏳ Email (5/h), Spam (10/h)
  *
  * Submits a new *request* to the system. Supported types include contact form, newsletter signup, and waitlist entry.
  *
diff --git a/frontend/src/api.gen/types.gen.ts b/frontend/src/api.gen/types.gen.ts
index b82588193..530229033 100644
--- a/frontend/src/api.gen/types.gen.ts
+++ b/frontend/src/api.gen/types.gen.ts
@@ -843,52 +843,6 @@ export type SignUpWithTokenResponses = {
 
 export type SignUpWithTokenResponse = SignUpWithTokenResponses[keyof SignUpWithTokenResponses];
 
-export type VerifyEmailData = {
-  body?: never;
-  path: {
-    tokenId: string;
-  };
-  query?: {
-    redirect?: string;
-  };
-  url: '/auth/verify-email/{tokenId}';
-};
-
-export type VerifyEmailErrors = {
-  /**
-   * Bad request: problem processing request.
-   */
-  400: ApiError & {
-    status?: 400;
-  };
-  /**
-   * Unauthorized: authentication required.
-   */
-  401: ApiError & {
-    status?: 401;
-  };
-  /**
-   * Forbidden: insufficient permissions.
-   */
-  403: ApiError & {
-    status?: 403;
-  };
-  /**
-   * Not found: resource does not exist.
-   */
-  404: ApiError & {
-    status?: 404;
-  };
-  /**
-   * Rate limit: too many requests.
-   */
-  429: ApiError & {
-    status?: 429;
-  };
-};
-
-export type VerifyEmailError = VerifyEmailErrors[keyof VerifyEmailErrors];
-
 export type RequestPasswordData = {
   body?: {
     email: string;
diff --git a/frontend/src/api.gen/zod.gen.ts b/frontend/src/api.gen/zod.gen.ts
index 98a7037ef..16ff9103d 100644
--- a/frontend/src/api.gen/zod.gen.ts
+++ b/frontend/src/api.gen/zod.gen.ts
@@ -379,18 +379,6 @@ export const zSignUpWithTokenResponse = z.object({
   redirectPath: z.optional(z.string()),
 });
 
-export const zVerifyEmailData = z.object({
-  body: z.optional(z.never()),
-  path: z.object({
-    tokenId: z.string(),
-  }),
-  query: z.optional(
-    z.object({
-      redirect: z.optional(z.string()),
-    }),
-  ),
-});
-
 export const zRequestPasswordData = z.object({
   body: z.optional(
     z.object({
diff --git a/frontend/src/modules/auth/steps/index.tsx b/frontend/src/modules/auth/authenticate-page.tsx
similarity index 69%
rename from frontend/src/modules/auth/steps/index.tsx
rename to frontend/src/modules/auth/authenticate-page.tsx
index 11ae0083a..490481893 100644
--- a/frontend/src/modules/auth/steps/index.tsx
+++ b/frontend/src/modules/auth/authenticate-page.tsx
@@ -1,16 +1,19 @@
+import { useSearch } from '@tanstack/react-router';
 import { appConfig } from 'config';
+import { useEffect } from 'react';
 import { useTranslation } from 'react-i18next';
 import OAuthProviders from '~/modules/auth/oauth-providers';
 import PasskeyStrategy from '~/modules/auth/passkey-strategy';
 import { CheckEmailStep } from '~/modules/auth/steps/check-email';
-import { AuthErrorStep } from '~/modules/auth/steps/error';
 import { InviteOnlyStep } from '~/modules/auth/steps/invite-only';
-import { useAuthStepsContext } from '~/modules/auth/steps/provider-context';
 import { SignInStep } from '~/modules/auth/steps/sign-in';
 import { SignUpStep } from '~/modules/auth/steps/sign-up';
 import { WaitlistStep } from '~/modules/auth/steps/waitlist';
 import type { AuthStep } from '~/modules/auth/types';
+import Spinner from '~/modules/common/spinner';
+import { useAuthStore } from '~/store/auth';
 import { useUserStore } from '~/store/user';
+import { useGetTokenData } from './use-token-check';
 
 const enabledStrategies: readonly string[] = appConfig.enabledAuthStrategies;
 
@@ -32,11 +35,26 @@ export interface StepBaseProp {
   emailEnabled: boolean;
 }
 
-const AuthSteps = () => {
+const AuthenticatePage = () => {
   const { t } = useTranslation();
+
+  const { tokenId } = useSearch({ from: '/publicLayout/authLayout/auth/authenticate' });
+
   const { lastUser } = useUserStore();
+  const { step, email, setStep } = useAuthStore();
+
+  const { data: tokenData, isLoading } = useGetTokenData('invitation', tokenId, !!tokenId);
+
+  // If token, proceed to sign up with token. If last user and no token, use last user as email
+  useEffect(() => {
+    if (lastUser?.email && !tokenId) return setStep('signIn', lastUser.email);
+
+    if (!tokenData?.email) return;
+    setStep(tokenData.userId ? 'signIn' : 'signUp', tokenData.email);
+  }, [tokenData, lastUser]);
 
-  const { step, email } = useAuthStepsContext();
+  // Loading invitation token
+  if (isLoading) return <Spinner className="h-10 w-10" />;
 
   // Render form based on current step
   return (
@@ -44,11 +62,10 @@ const AuthSteps = () => {
       {step === 'checkEmail' && <CheckEmailStep />}
 
       {step === 'signIn' && <SignInStep />}
-      {step === 'signUp' && <SignUpStep />}
+      {step === 'signUp' && <SignUpStep tokenData={tokenData} />}
 
       {step === 'waitlist' && <WaitlistStep />}
       {step === 'inviteOnly' && <InviteOnlyStep />}
-      {step === 'error' && <AuthErrorStep />}
 
       {/* Show passkey and oauth options conditionally */}
       {['checkEmail', 'signIn', 'signUp'].includes(step) && (
@@ -68,4 +85,4 @@ const AuthSteps = () => {
   );
 };
 
-export default AuthSteps;
+export default AuthenticatePage;
diff --git a/frontend/src/modules/auth/email-verification.tsx b/frontend/src/modules/auth/email-verification.tsx
index 6270c33f6..47c1bafe6 100644
--- a/frontend/src/modules/auth/email-verification.tsx
+++ b/frontend/src/modules/auth/email-verification.tsx
@@ -1,6 +1,6 @@
 import { useParams, useSearch } from '@tanstack/react-router';
 import { useTranslation } from 'react-i18next';
-import { LegalNotice } from '~/modules/auth/steps/legal-notice';
+import { LegalNotice } from '~/modules/auth/legal-notice';
 
 const EmailVerification = () => {
   const { t } = useTranslation();
diff --git a/frontend/src/modules/auth/steps/legal-notice.tsx b/frontend/src/modules/auth/legal-notice.tsx
similarity index 100%
rename from frontend/src/modules/auth/steps/legal-notice.tsx
rename to frontend/src/modules/auth/legal-notice.tsx
diff --git a/frontend/src/modules/auth/steps/auth-error.tsx b/frontend/src/modules/auth/steps/auth-error.tsx
new file mode 100644
index 000000000..5e3d15be1
--- /dev/null
+++ b/frontend/src/modules/auth/steps/auth-error.tsx
@@ -0,0 +1,27 @@
+import { Link } from '@tanstack/react-router';
+import { LogIn } from 'lucide-react';
+import { useTranslation } from 'react-i18next';
+import ErrorNotice from '~/modules/common/error-notice';
+import { ResendMembershipInviteButton } from '~/modules/memberships/resend-membership-invitation';
+import { buttonVariants } from '~/modules/ui/button';
+import { useAuthStore } from '~/store/auth';
+
+/**
+ * Displays an error notice in authentication layout.
+ */
+export const AuthError = () => {
+  const { t } = useTranslation();
+
+  const { email, error } = useAuthStore();
+
+  return (
+    <ErrorNotice error={error} level={'public'}>
+      <Link to="/auth/authenticate" replace className={buttonVariants({ size: 'lg' })}>
+        <LogIn size={16} className="mr-2" />
+        {t('common:sign_in')}
+      </Link>
+
+      {error?.type === 'invite_takes_priority' && <ResendMembershipInviteButton resendData={{ email }} buttonProps={{ size: 'lg' }} />}
+    </ErrorNotice>
+  );
+};
diff --git a/frontend/src/modules/auth/steps/check-email.tsx b/frontend/src/modules/auth/steps/check-email.tsx
index 22e95b07b..36ffd4336 100644
--- a/frontend/src/modules/auth/steps/check-email.tsx
+++ b/frontend/src/modules/auth/steps/check-email.tsx
@@ -1,5 +1,6 @@
 import { zodResolver } from '@hookform/resolvers/zod';
 import { useMutation } from '@tanstack/react-query';
+import { useNavigate } from '@tanstack/react-router';
 import { appConfig } from 'config';
 import { ArrowRight } from 'lucide-react';
 import { useForm } from 'react-hook-form';
@@ -8,11 +9,11 @@ import type { z } from 'zod';
 import { type CheckEmailData, type CheckEmailResponse, checkEmail } from '~/api.gen';
 import { zCheckEmailData } from '~/api.gen/zod.gen';
 import type { ApiError } from '~/lib/api';
-import { useAuthStepsContext } from '~/modules/auth/steps/provider-context';
 import type { AuthStep } from '~/modules/auth/types';
 import { SubmitButton } from '~/modules/ui/button';
 import { Form, FormControl, FormField, FormItem, FormMessage } from '~/modules/ui/form';
 import { Input } from '~/modules/ui/input';
+import { useAuthStore } from '~/store/auth';
 import { defaultOnInvalid } from '~/utils/form-on-invalid';
 
 const enabledStrategies: readonly string[] = appConfig.enabledAuthStrategies;
@@ -28,7 +29,9 @@ type FormValues = z.infer<typeof formSchema>;
  */
 export const CheckEmailStep = () => {
   const { t } = useTranslation();
-  const { setStep } = useAuthStepsContext();
+  const navigate = useNavigate();
+
+  const { setStep, setError } = useAuthStore();
 
   const isMobile = window.innerWidth < 640;
   const title = appConfig.has.registrationEnabled ? t('common:sign_in_or_up') : t('common:sign_in');
@@ -44,9 +47,11 @@ export const CheckEmailStep = () => {
     onError: (error: ApiError) => {
       let nextStep: AuthStep = 'inviteOnly';
 
-      // If there is an unclaimed invitation token, redirect to error page
-      if (error.type === 'invite_takes_priority') return setStep('error', form.getValues('email'), error);
-
+      // If there is an unclaimed invitation token, redirect to auth error page
+      if (error.type === 'invite_takes_priority') {
+        setError(error);
+        navigate({ to: '/auth/error' });
+      }
       // If registration is enabled or user has a token, proceed to sign up
       if (appConfig.has.registrationEnabled) nextStep = 'signUp';
       // If registration is disabled and user has no token, proceed to waitlist
diff --git a/frontend/src/modules/auth/steps/error.tsx b/frontend/src/modules/auth/steps/error.tsx
deleted file mode 100644
index cbca8f778..000000000
--- a/frontend/src/modules/auth/steps/error.tsx
+++ /dev/null
@@ -1,17 +0,0 @@
-import { useAuthStepsContext } from '~/modules/auth/steps/provider-context';
-import ErrorNotice from '~/modules/common/error-notice';
-import { ResendMembershipInviteButton } from '~/modules/memberships/resend-membership-invitation';
-
-/**
- * Displays an authentication error notice.
- * If the error type is `invite_takes_priority`, shows a button to resend the invite.
- */
-export const AuthErrorStep = () => {
-  const { email, authError } = useAuthStepsContext();
-
-  return (
-    <ErrorNotice error={authError} level={'public'}>
-      {authError?.type === 'invite_takes_priority' && <ResendMembershipInviteButton resendData={{ email }} buttonProps={{ size: 'lg' }} />}
-    </ErrorNotice>
-  );
-};
diff --git a/frontend/src/modules/auth/steps/provider-context.tsx b/frontend/src/modules/auth/steps/provider-context.tsx
deleted file mode 100644
index 4c6b9c1a0..000000000
--- a/frontend/src/modules/auth/steps/provider-context.tsx
+++ /dev/null
@@ -1,20 +0,0 @@
-import { createContext, useContext } from 'react';
-import type { ApiError } from '~/lib/api';
-import type { AuthStep, TokenData } from '~/modules/auth/types';
-
-interface AuthContextProps {
-  step: AuthStep;
-  email: string;
-  authError: ApiError | null;
-  tokenData?: TokenData;
-  setStep: (step: AuthStep, email: string, error?: ApiError) => void;
-  resetSteps: () => void;
-}
-
-export const AuthContext = createContext<AuthContextProps | undefined>(undefined);
-
-export const useAuthStepsContext = () => {
-  const context = useContext(AuthContext);
-  if (!context) throw new Error('useAuthStepsContext must be used within an AuthProvider');
-  return context;
-};
diff --git a/frontend/src/modules/auth/steps/provider.tsx b/frontend/src/modules/auth/steps/provider.tsx
deleted file mode 100644
index 4986d50fa..000000000
--- a/frontend/src/modules/auth/steps/provider.tsx
+++ /dev/null
@@ -1,53 +0,0 @@
-import { useSearch } from '@tanstack/react-router';
-import { appConfig } from 'config';
-import { type ReactNode, useEffect, useState } from 'react';
-import type { ApiError } from '~/lib/api';
-import { AuthContext } from '~/modules/auth/steps/provider-context';
-import type { AuthStep } from '~/modules/auth/types';
-import { useGetTokenData } from '~/modules/auth/use-token-check';
-import { useUserStore } from '~/store/user';
-
-// TODO refactor to store?
-export const AuthStepsProvider = ({ children }: { children: ReactNode }) => {
-  const { lastUser } = useUserStore();
-  const { tokenId, error, severity } = useSearch({ from: '/publicLayout/authLayout/auth/authenticate' });
-
-  // Initialize email and step
-  const initEmail = (!tokenId && lastUser?.email) || '';
-  const initStep: AuthStep = !tokenId && lastUser?.email ? 'signIn' : 'checkEmail';
-
-  const [email, setEmail] = useState(initEmail);
-  const [step, setStepState] = useState<AuthStep>(initStep);
-  const [authError, setAuthError] = useState<ApiError | null>(null);
-
-  const { data: tokenData } = useGetTokenData('invitation', tokenId, !!tokenId);
-
-  const setStep = (newStep: AuthStep, newEmail: string, error?: ApiError) => {
-    setStepState(newStep);
-    setEmail(newEmail);
-    if (error) setAuthError(error);
-  };
-
-  const resetSteps = () => {
-    setStepState('checkEmail');
-    setAuthError(null);
-  };
-
-  useEffect(() => {
-    if (!error) return;
-
-    if (error === 'sign_up_restricted') {
-      setStepState(appConfig.has.waitlist ? 'waitlist' : 'inviteOnly');
-    } else setStepState('error');
-  }, [error, severity]);
-
-  // If token is provided, directly set email and step based on token data
-  useEffect(() => {
-    if (!tokenId || !tokenData?.email) return;
-
-    setEmail(tokenData.email);
-    setStepState(tokenData.userId ? 'signIn' : 'signUp');
-  }, [tokenData]);
-
-  return <AuthContext.Provider value={{ step, email, authError, tokenData, setStep, resetSteps }}>{children}</AuthContext.Provider>;
-};
diff --git a/frontend/src/modules/auth/steps/sign-in.tsx b/frontend/src/modules/auth/steps/sign-in.tsx
index 4b7f36592..704937d67 100644
--- a/frontend/src/modules/auth/steps/sign-in.tsx
+++ b/frontend/src/modules/auth/steps/sign-in.tsx
@@ -11,10 +11,10 @@ import { type SignInData, type SignInResponse, signIn } from '~/api.gen';
 import { zSignUpData } from '~/api.gen/zod.gen';
 import type { ApiError } from '~/lib/api';
 import { RequestPasswordDialog } from '~/modules/auth/request-password-dialog';
-import { useAuthStepsContext } from '~/modules/auth/steps/provider-context';
 import { Button, SubmitButton } from '~/modules/ui/button';
 import { Form, FormControl, FormField, FormItem, FormMessage } from '~/modules/ui/form';
 import { Input } from '~/modules/ui/input';
+import { useAuthStore } from '~/store/auth';
 import { useUserStore } from '~/store/user';
 import { defaultOnInvalid } from '~/utils/form-on-invalid';
 
@@ -30,7 +30,7 @@ type FormValues = z.infer<typeof formSchema>;
 export const SignInStep = () => {
   const { t } = useTranslation();
   const navigate = useNavigate();
-  const { email, resetSteps } = useAuthStepsContext();
+  const { email, resetSteps } = useAuthStore();
 
   const passwordRef = useRef<HTMLInputElement>(null);
 
diff --git a/frontend/src/modules/auth/steps/sign-up.tsx b/frontend/src/modules/auth/steps/sign-up.tsx
index 7b45d871f..3e7744e43 100644
--- a/frontend/src/modules/auth/steps/sign-up.tsx
+++ b/frontend/src/modules/auth/steps/sign-up.tsx
@@ -10,12 +10,13 @@ import type { z } from 'zod';
 import { type SignUpData, type SignUpResponse, type SignUpWithTokenData, type SignUpWithTokenResponse, signUp, signUpWithToken } from '~/api.gen';
 import { zSignUpData } from '~/api.gen/zod.gen';
 import type { ApiError } from '~/lib/api';
-import { LegalNotice } from '~/modules/auth/steps/legal-notice';
-import { useAuthStepsContext } from '~/modules/auth/steps/provider-context';
+import { LegalNotice } from '~/modules/auth/legal-notice';
 import { Button, SubmitButton } from '~/modules/ui/button';
 import { Form, FormControl, FormField, FormItem, FormMessage } from '~/modules/ui/form';
 import { Input } from '~/modules/ui/input';
+import { useAuthStore } from '~/store/auth';
 import { defaultOnInvalid } from '~/utils/form-on-invalid';
+import { TokenData } from '../types';
 
 const PasswordStrength = lazy(() => import('~/modules/auth/password-strength'));
 
@@ -28,11 +29,11 @@ type FormValues = z.infer<typeof formSchema>;
 /**
  * Handles user sign-up, including standard registration and invitation token flow.
  */
-export const SignUpStep = () => {
+export const SignUpStep = ({ tokenData }: { tokenData?: TokenData }) => {
   const { t } = useTranslation();
   const navigate = useNavigate();
 
-  const { email, tokenData, setStep, resetSteps } = useAuthStepsContext();
+  const { email, resetSteps } = useAuthStore();
 
   const { tokenId } = useSearch({ from: '/publicLayout/authLayout/auth/authenticate' });
 
@@ -42,10 +43,6 @@ export const SignUpStep = () => {
   const { mutate: _signUp, isPending } = useMutation<SignUpResponse, ApiError, NonNullable<SignUpData['body']>>({
     mutationFn: (body) => signUp({ body }),
     onSuccess: () => navigate({ to: '/auth/email-verification/$reason', params: { reason: 'signup' }, replace: true }),
-    onError: (error: ApiError) => {
-      // If there is an unclaimed invitation token, redirect to error page
-      if (error.type === 'invite_takes_priority') return setStep('error', form.getValues('email'), error);
-    },
   });
 
   // Handle sign up with token to accept invitation
diff --git a/frontend/src/modules/auth/steps/waitlist.tsx b/frontend/src/modules/auth/steps/waitlist.tsx
index 7cd44ea5a..7dd096791 100644
--- a/frontend/src/modules/auth/steps/waitlist.tsx
+++ b/frontend/src/modules/auth/steps/waitlist.tsx
@@ -1,9 +1,9 @@
 import { ChevronDown, Lock } from 'lucide-react';
 import { useTranslation } from 'react-i18next';
-import { LegalNotice } from '~/modules/auth/steps/legal-notice';
-import { useAuthStepsContext } from '~/modules/auth/steps/provider-context';
+import { LegalNotice } from '~/modules/auth/legal-notice';
 import { WaitlistForm } from '~/modules/requests/waitlist-form';
 import { Button } from '~/modules/ui/button';
+import { useAuthStore } from '~/store/auth';
 
 /**
  * Renders the waitlist request step, including:
@@ -14,7 +14,7 @@ import { Button } from '~/modules/ui/button';
 export const WaitlistStep = () => {
   const { t } = useTranslation();
 
-  const { email, resetSteps } = useAuthStepsContext();
+  const { email, resetSteps } = useAuthStore();
 
   return (
     <>
diff --git a/frontend/src/modules/auth/types.ts b/frontend/src/modules/auth/types.ts
index fcacda3f4..90cb14fcc 100644
--- a/frontend/src/modules/auth/types.ts
+++ b/frontend/src/modules/auth/types.ts
@@ -9,4 +9,4 @@ export interface PasskeyCredentialProps {
 
 export type TokenData = GetTokenDataResponse;
 
-export type AuthStep = 'checkEmail' | 'signIn' | 'signUp' | 'inviteOnly' | 'waitlist' | 'error' | 'mfa';
+export type AuthStep = 'checkEmail' | 'signIn' | 'signUp' | 'inviteOnly' | 'waitlist' | 'mfa';
diff --git a/frontend/src/modules/common/error-notice.tsx b/frontend/src/modules/common/error-notice.tsx
index a1858468c..05895597f 100644
--- a/frontend/src/modules/common/error-notice.tsx
+++ b/frontend/src/modules/common/error-notice.tsx
@@ -21,9 +21,7 @@ interface ErrorNoticeProps {
 }
 
 export const handleAskForHelp = (ref: RefObject<HTMLButtonElement | null>) => {
-  if (!window.Gleap) {
-    return contactFormHandler(ref);
-  }
+  if (!window.Gleap) return contactFormHandler(ref);
   window.Gleap.openConversations();
 };
 
diff --git a/frontend/src/query/on-error.ts b/frontend/src/query/on-error.ts
index 2e7fcde0d..d68f633a5 100644
--- a/frontend/src/query/on-error.ts
+++ b/frontend/src/query/on-error.ts
@@ -33,6 +33,8 @@ const getErrorMessage = ({ type, entityType, message, status }: ApiError) => {
 export const onError = (error: Error | ApiError) => {
   if (error instanceof ApiError) {
     const statusCode = Number(error.status);
+
+    // TODO maybe just me?
     const isCasualSessionAttempt = error.path && ['/me', '/me/menu'].includes(error.path);
 
     // Maintenance mode
diff --git a/frontend/src/routes/auth-routes.tsx b/frontend/src/routes/auth-routes.tsx
index 83604a207..66d61cc05 100644
--- a/frontend/src/routes/auth-routes.tsx
+++ b/frontend/src/routes/auth-routes.tsx
@@ -2,16 +2,17 @@ import { createRoute, redirect } from '@tanstack/react-router';
 import { appConfig } from 'config';
 import i18n from 'i18next';
 import { z } from 'zod';
+import AuthenticatePage from '~/modules/auth/authenticate-page';
 import CreatePasswordForm from '~/modules/auth/create-password-form';
 import EmailVerification from '~/modules/auth/email-verification';
 import AuthPage from '~/modules/auth/layout';
 import { Mfa } from '~/modules/auth/mfa';
 import { RequestPasswordForm } from '~/modules/auth/request-password-form';
 import { SignOut } from '~/modules/auth/sign-out';
-import AuthSteps from '~/modules/auth/steps';
-import { AuthStepsProvider } from '~/modules/auth/steps/provider';
+import { AuthError } from '~/modules/auth/steps/auth-error';
 import Unsubscribed from '~/modules/auth/unsubscribed';
 import { errorSearchSchema, PublicLayoutRoute } from '~/routes/base-routes';
+import { useAuthStore } from '~/store/auth';
 import { useUserStore } from '~/store/user';
 import appTitle from '~/utils/app-title';
 
@@ -38,6 +39,8 @@ export const AuthenticateRoute = createRoute({
   head: () => ({ meta: [{ title: appTitle('Authenticate') }] }),
   getParentRoute: () => AuthLayoutRoute,
   beforeLoad: async ({ cause, search }) => {
+    useAuthStore.getState().resetSteps();
+
     // Only check auth if entering to prevent loop
     if (cause !== 'enter' || search.fromRoot) return;
 
@@ -46,11 +49,7 @@ export const AuthenticateRoute = createRoute({
     if (!storedUser) return;
     throw redirect({ to: appConfig.defaultRedirectPath, replace: true });
   },
-  component: () => (
-    <AuthStepsProvider>
-      <AuthSteps />
-    </AuthStepsProvider>
-  ),
+  component: () => <AuthenticatePage />,
 });
 
 export const MfaRoute = createRoute({
@@ -101,6 +100,15 @@ export const UnsubscribedRoute = createRoute({
   component: () => <Unsubscribed />,
 });
 
+export const AuthErrorRoute = createRoute({
+  path: '/auth/error',
+  validateSearch: z.object({ provider: z.string().optional() }),
+  staticData: { isAuth: false },
+  head: () => ({ meta: [{ title: appTitle('Authentication error') }] }),
+  getParentRoute: () => AuthLayoutRoute,
+  component: () => <AuthError />,
+});
+
 export const SignOutRoute = createRoute({
   path: '/sign-out',
   validateSearch: z.object({ force: z.boolean().optional() }),
diff --git a/frontend/src/routes/home-routes.tsx b/frontend/src/routes/home-routes.tsx
index 75006eeff..f3b116f99 100644
--- a/frontend/src/routes/home-routes.tsx
+++ b/frontend/src/routes/home-routes.tsx
@@ -31,7 +31,8 @@ export const HomeAliasRoute = createRoute({
   staticData: { isAuth: true },
   head: () => ({ meta: [{ title: appTitle('Home') }] }),
   getParentRoute: () => AppLayoutRoute,
-  beforeLoad: ({ search, cause }) => {
+  onEnter: ({ search, cause }) => {
+    // TODO this might cause a race condition (hence onEnter is used)
     if (cause !== 'enter' || search.skipWelcome) return;
     const { user } = useUserStore.getState();
     if (user.userFlags.finishedOnboarding) return;
@@ -49,7 +50,8 @@ export const WelcomeRoute = createRoute({
   staticData: { isAuth: true },
   head: () => ({ meta: [{ title: appTitle('Welcome') }] }),
   getParentRoute: () => AppLayoutRoute,
-  beforeLoad: () => {
+  onEnter: () => {
+    // TODO this might cause a race condition (hence onEnter is used)
     const { user } = useUserStore.getState();
     if (user.userFlags.finishedOnboarding) throw redirect({ to: '/home' });
   },
diff --git a/frontend/src/routes/route-tree.tsx b/frontend/src/routes/route-tree.tsx
index db8dc354a..afea9cc95 100644
--- a/frontend/src/routes/route-tree.tsx
+++ b/frontend/src/routes/route-tree.tsx
@@ -1,5 +1,6 @@
 import type { NavItemId } from '~/modules/navigation/types';
 import {
+  AuthErrorRoute,
   AuthenticateRoute,
   AuthLayoutRoute,
   CreatePasswordWithTokenRoute,
@@ -37,6 +38,7 @@ export const routeTree = RootRoute.addChildren([
       CreatePasswordWithTokenRoute,
       EmailVerificationRoute,
       UnsubscribedRoute,
+      AuthErrorRoute,
     ]),
   ]),
   AppLayoutRoute.addChildren([
diff --git a/frontend/src/store/alert.ts b/frontend/src/store/alert.ts
index 688d46f6c..79483ee6e 100644
--- a/frontend/src/store/alert.ts
+++ b/frontend/src/store/alert.ts
@@ -17,6 +17,9 @@ interface AlertStoreState {
 // Initial store state, using config to determine maintenance mode
 const initStore: Pick<AlertStoreState, 'alertsSeen' | 'downAlert'> = { downAlert: appConfig.maintenance ? 'maintenance' : null, alertsSeen: [] };
 
+/**
+ * Store for app-wide alerts and UI specific alerts in `alertsSeen`.
+ */
 export const useAlertStore = create<AlertStoreState>()(
   devtools(
     immer(
diff --git a/frontend/src/store/auth.ts b/frontend/src/store/auth.ts
new file mode 100644
index 000000000..35f1d87b8
--- /dev/null
+++ b/frontend/src/store/auth.ts
@@ -0,0 +1,29 @@
+import { create } from 'zustand';
+import { ApiError } from '~/lib/api';
+import type { AuthStep } from '~/modules/auth/types';
+
+type State = {
+  step: AuthStep;
+  email: string;
+  error: ApiError | null;
+};
+
+type Actions = {
+  setStep: (step: AuthStep, email: string) => void;
+  setEmail: (email: string) => void;
+  setError: (error: ApiError) => void;
+  resetSteps: () => void;
+};
+
+const initial: State = { step: 'checkEmail', email: '', error: null };
+
+/**
+ * Simple authenticate store for managing email and step state.
+ */
+export const useAuthStore = create<State & Actions>((set) => ({
+  ...initial,
+  setStep: (step, email) => set(() => ({ step, email })),
+  setEmail: (email) => set(() => ({ email })),
+  setError: (error) => set(() => ({ error })),
+  resetSteps: () => set(() => ({ ...initial })),
+}));
diff --git a/frontend/src/store/blob.ts b/frontend/src/store/blob.ts
index ae942e33b..3ec787d04 100644
--- a/frontend/src/store/blob.ts
+++ b/frontend/src/store/blob.ts
@@ -15,6 +15,9 @@ interface BlobStoreState {
   clearAll: () => void;
 }
 
+/**
+ * Blok store to manage cached indexedDb files as long as you leave the browser tab open.
+ */
 export const useBlobStore = create<BlobStoreState>()(
   devtools(
     persist(
diff --git a/frontend/src/store/draft.ts b/frontend/src/store/draft.ts
index 785b35e62..83d4f5e0b 100644
--- a/frontend/src/store/draft.ts
+++ b/frontend/src/store/draft.ts
@@ -12,6 +12,9 @@ interface DraftStoreState {
   clearForms(): void; // Clears all stored drafts
 }
 
+/**
+ * Draft store for having auto draft functionality on forms that use useDraftForm.
+ */
 export const useDraftStore = create<DraftStoreState>()(
   immer(
     persist(

From 04fb8e90e4a1767528691b4cc55ce1384b74b76b Mon Sep 17 00:00:00 2001
From: flipvanhaaren <flip@shareworks.nl>
Date: Thu, 2 Oct 2025 20:43:26 +0200
Subject: [PATCH 37/48] improve: better token handling

---
 backend/src/lib/errors.ts                     |    6 +
 backend/src/lib/transloadit.ts                |    4 +-
 backend/src/modules/auth/general/handlers.ts  |   12 +-
 .../modules/auth/general/helpers/cookie.ts    |    2 +-
 .../src/modules/auth/general/helpers/mfa.ts   |    3 +-
 .../helpers/send-verification-email.ts        |    2 +-
 .../modules/auth/general/helpers/session.ts   |    3 +-
 backend/src/modules/auth/general/routes.ts    |    3 +-
 backend/src/modules/auth/oauth/handlers.ts    |    7 +-
 .../modules/auth/oauth/helpers/callback.ts    |    3 +-
 .../modules/auth/oauth/helpers/initiation.ts  |    9 +-
 .../helpers/send-oauth-verification-email.ts  |    2 +-
 backend/src/modules/auth/passkeys/handlers.ts |    4 +-
 .../modules/auth/passkeys/helpers/passkey.ts  |    3 +-
 .../src/modules/auth/passwords/handlers.ts    |    2 +-
 backend/src/modules/me/handlers.ts            |    2 +-
 backend/src/modules/memberships/handlers.ts   |   64 +-
 backend/src/modules/memberships/routes.ts     |   11 +-
 backend/src/modules/system/handlers.ts        |    2 +-
 backend/src/permissions/get-context-entity.ts |    2 +-
 backend/src/permissions/get-product-entity.ts |    3 +-
 .../src/utils/get-valid-single-use-token.ts   |   15 +-
 backend/src/utils/get-valid-token.ts          |   44 +-
 backend/src/utils/schema/common.ts            |    5 +
 frontend/package.json                         |   28 +-
 frontend/src/api.gen/sdk.gen.ts               |    1 +
 frontend/src/api.gen/types.gen.ts             |    6 +-
 frontend/src/api.gen/zod.gen.ts               |    6 +-
 .../auth-error.tsx => auth-error-page.tsx}    |   18 +-
 ...word-form.tsx => create-password-page.tsx} |    4 +-
 ...cation.tsx => email-verification-page.tsx} |    4 +-
 frontend/src/modules/auth/layout.tsx          |    2 +-
 .../modules/auth/{mfa.tsx => mfa-page.tsx}    |    8 +-
 frontend/src/modules/auth/sign-out.tsx        |    2 +
 ...unsubscribed.tsx => unsubscribed-page.tsx} |    0
 frontend/src/modules/common/error-notice.tsx  |   16 +-
 frontend/src/modules/me/settings-page.tsx     |    2 +
 .../modules/memberships/query-mutations.ts    |    2 +-
 .../resend-membership-invitation.tsx          |   10 +-
 frontend/src/query/on-error.ts                |    1 -
 frontend/src/routes/auth-routes.tsx           |   38 +-
 locales/en/backend.json                       |    4 +-
 locales/en/common.json                        |    2 +-
 locales/en/errors.json                        |  128 +-
 pnpm-lock.yaml                                | 2384 +++++++++--------
 45 files changed, 1537 insertions(+), 1342 deletions(-)
 rename frontend/src/modules/auth/{steps/auth-error.tsx => auth-error-page.tsx} (54%)
 rename frontend/src/modules/auth/{create-password-form.tsx => create-password-page.tsx} (98%)
 rename frontend/src/modules/auth/{email-verification.tsx => email-verification-page.tsx} (91%)
 rename frontend/src/modules/auth/{mfa.tsx => mfa-page.tsx} (90%)
 rename frontend/src/modules/auth/{unsubscribed.tsx => unsubscribed-page.tsx} (100%)

diff --git a/backend/src/lib/errors.ts b/backend/src/lib/errors.ts
index 295611320..83c7c57ce 100644
--- a/backend/src/lib/errors.ts
+++ b/backend/src/lib/errors.ts
@@ -119,6 +119,12 @@ export const handleAppError: ErrorHandler<Env> = (err, ctx) => {
     redirectUrl.searchParams.set('error', type);
     redirectUrl.searchParams.set('severity', severity);
 
+    // TODO(improve) this is not a great for SOC
+    if (ctx.req.query('tokenId')) {
+      const tokenId = ctx.req.query('tokenId');
+      redirectUrl.searchParams.set('tokenId', tokenId!!);
+    }
+
     return ctx.redirect(redirectUrl, 302);
   }
 
diff --git a/backend/src/lib/transloadit.ts b/backend/src/lib/transloadit.ts
index e45c3240a..fcd6bb6dd 100644
--- a/backend/src/lib/transloadit.ts
+++ b/backend/src/lib/transloadit.ts
@@ -14,7 +14,7 @@ export const getParams = (templateId: UploadTemplateId, isPublic: boolean, sub:
 
   const authKey = env.TRANSLOADIT_KEY;
   const authSecret = env.TRANSLOADIT_SECRET;
-  if (!authKey || !authSecret) throw Error('missing_auth_key');
+  if (!authKey || !authSecret) throw Error('auth_key_not_found');
 
   const template = uploadTemplates[templateId];
 
@@ -45,7 +45,7 @@ export const getParams = (templateId: UploadTemplateId, isPublic: boolean, sub:
 
 export const getSignature = (paramsString: string) => {
   const authSecret = env.TRANSLOADIT_SECRET;
-  if (!authSecret) throw Error('missing_auth_key');
+  if (!authSecret) throw Error('auth_key_not_found');
 
   const signatureBytes = crypto.createHmac('sha384', authSecret).update(Buffer.from(paramsString, 'utf-8'));
   // The final signature needs the hash name in front, so
diff --git a/backend/src/modules/auth/general/handlers.ts b/backend/src/modules/auth/general/handlers.ts
index 8e3a09e8f..51a09bf2f 100644
--- a/backend/src/modules/auth/general/handlers.ts
+++ b/backend/src/modules/auth/general/handlers.ts
@@ -60,17 +60,17 @@ const authGeneralRouteHandlers = app
     return ctx.json(true, 200);
   })
   /**
-   * Validate and consume token and redirect with single use session token in cookie
+   * Validate and invoke token by creating a single use session token in cookie
    */
   .openapi(authGeneralRoutes.invokeToken, async (ctx) => {
     const { token, type: tokenType } = ctx.req.valid('param');
 
-    // Check if token exists and create a new refresh token
-    const tokenRecord = await getValidToken({ ctx, token, tokenType, invokeToken: true });
-    if (!tokenRecord.singleUseToken) throw new AppError({ status: 500, type: 'invalid_token', severity: 'error', redirectPath: '/error' });
+    // Check if token exists and create a new single use token session
+    const tokenRecord = await getValidToken({ ctx, token, tokenType, invokeToken: true, redirectPath: '/auth/error' });
+    if (!tokenRecord.singleUseToken) throw new AppError({ status: 500, type: 'invalid_token', severity: 'error', redirectPath: '/auth/error' });
 
-    // Set cookie using token type as name. Content is single use token. Expires in 10 minutes or until used.
-    await setAuthCookie(ctx, tokenRecord.type, tokenRecord.singleUseToken, new TimeSpan(10, 'm'));
+    // Set cookie using token type as name. Content is single use token. Expires in 5 minutes or until used.
+    await setAuthCookie(ctx, tokenRecord.type, tokenRecord.singleUseToken, new TimeSpan(5, 'm'));
 
     // If verification email, we process it immediately and redirect to app
     if (tokenRecord.type === 'email-verification') return handleEmailVerification(ctx, tokenRecord);
diff --git a/backend/src/modules/auth/general/helpers/cookie.ts b/backend/src/modules/auth/general/helpers/cookie.ts
index 8a4b865b8..ee833de6a 100644
--- a/backend/src/modules/auth/general/helpers/cookie.ts
+++ b/backend/src/modules/auth/general/helpers/cookie.ts
@@ -8,7 +8,7 @@ import { env } from '../../../../env';
 
 const isProduction = appConfig.mode === 'production';
 
-type CookieName = TokenType | 'session' | 'totp-challenge' | 'passkey-challenge' | `oauth_${string}`;
+type CookieName = TokenType | 'session' | 'totp-challenge' | 'passkey-challenge' | `oauth-state-${string}` | 'oauth-redirect';
 
 /**
  * Sets an authentication cookie.
diff --git a/backend/src/modules/auth/general/helpers/mfa.ts b/backend/src/modules/auth/general/helpers/mfa.ts
index c2c46077c..1925957ec 100644
--- a/backend/src/modules/auth/general/helpers/mfa.ts
+++ b/backend/src/modules/auth/general/helpers/mfa.ts
@@ -53,9 +53,8 @@ export const initiateMfa = async (ctx: Context<Env>, user: UserModel) => {
  * @throws AppError if token is missing, not found, or expired
  */
 export const validateConfirmMfaToken = async (ctx: Context<Env>): Promise<UserModel> => {
-  // TODO on error redirect?
   const tokenFromCookie = await getAuthCookie(ctx, 'confirm-mfa');
-  if (!tokenFromCookie) throw new AppError({ status: 401, type: 'confirm-mfa_not_found', severity: 'error' });
+  if (!tokenFromCookie) throw new AppError({ status: 401, type: 'confirm-mfa_not_found', severity: 'error', redirectPath: '/auth/error' });
 
   // Fetch token record and associated user
   const tokenRecord = await getValidToken({ ctx, token: tokenFromCookie, invokeToken: false, tokenType: 'confirm-mfa' });
diff --git a/backend/src/modules/auth/general/helpers/send-verification-email.ts b/backend/src/modules/auth/general/helpers/send-verification-email.ts
index d22facb4c..80cb79d29 100644
--- a/backend/src/modules/auth/general/helpers/send-verification-email.ts
+++ b/backend/src/modules/auth/general/helpers/send-verification-email.ts
@@ -75,7 +75,7 @@ export const sendVerificationEmail = async ({ userId, redirectPath }: Props) =>
   const lng = user.language;
 
   // Create verification link: go to
-  const verifyPath = `/auth/invoke-token/${tokenRecord.type}/${tokenRecord.token}`;
+  const verifyPath = `/auth/invoke-token/${tokenRecord.type}/${tokenRecord.token}?tokenId=${tokenRecord.id}`;
   const verificationURL = new URL(verifyPath, appConfig.backendUrl);
 
   if (redirectPath) verificationURL.searchParams.set('redirect', encodeURIComponent(redirectPath));
diff --git a/backend/src/modules/auth/general/helpers/session.ts b/backend/src/modules/auth/general/helpers/session.ts
index 6b290c14c..aa3c91ad5 100644
--- a/backend/src/modules/auth/general/helpers/session.ts
+++ b/backend/src/modules/auth/general/helpers/session.ts
@@ -32,7 +32,7 @@ export const setUserSession = async (ctx: Context<Env>, user: UserModel, strateg
     if (!allowAll && (!ip || !allowList.includes(ip))) throw new AppError({ status: 403, type: 'system_access_forbidden', severity: 'warn' });
   }
 
-  // // Delete previous session (skip if impersonation)
+  // TODO why is this commented out? // Delete previous session (skip if impersonation)
   // if (type !== 'impersonation') {
   //   const existingSession = deleteAuthCookie(ctx, 'session');
 
@@ -43,6 +43,7 @@ export const setUserSession = async (ctx: Context<Env>, user: UserModel, strateg
   //     await db.delete(sessionsTable).where(eq(sessionsTable.token, existingSessionToken));
   //   }
   // }
+
   // Get device information
   const device = deviceInfo(ctx);
 
diff --git a/backend/src/modules/auth/general/routes.ts b/backend/src/modules/auth/general/routes.ts
index dbbb66c55..8c4a79f7f 100644
--- a/backend/src/modules/auth/general/routes.ts
+++ b/backend/src/modules/auth/general/routes.ts
@@ -99,10 +99,11 @@ const authGeneralRoutes = {
       'Validates and invokes a token (for password reset, email verification, invitations, mfa) and redirects user to backend with a one-purpose, single-use token session in a cookie.',
     request: {
       params: z.object({ type: z.enum(appConfig.tokenTypes), token: z.string() }),
+      query: z.object({ tokenId: z.string() }),
     },
     responses: {
       302: {
-        description: 'Redirect with refreshed token in cookie',
+        description: 'Redirect with token session',
         headers: locationSchema,
       },
       ...errorResponses,
diff --git a/backend/src/modules/auth/oauth/handlers.ts b/backend/src/modules/auth/oauth/handlers.ts
index 2c6bd24a6..ab80a1314 100644
--- a/backend/src/modules/auth/oauth/handlers.ts
+++ b/backend/src/modules/auth/oauth/handlers.ts
@@ -39,7 +39,6 @@ function isOAuthEnabled(provider: EnabledOAuthProvider): boolean {
   return enabledOAuthProviders.includes(provider);
 }
 
-// TODO make this generic for all modules?
 const app = new OpenAPIHono<Env>({ defaultHook });
 
 const authOAuthRouteHandlers = app
@@ -111,7 +110,7 @@ const authOAuthRouteHandlers = app
     }
 
     // Verify cookie by `state` (CSRF protection)
-    const oauthCookie = await getAuthCookie(ctx, `oauth_${state}`);
+    const oauthCookie = await getAuthCookie(ctx, `oauth-state-${state}`);
     const cookiePayload: OAuthCookiePayload | null = oauthCookie ? JSON.parse(oauthCookie) : null;
 
     if (!state || !cookiePayload) {
@@ -165,7 +164,7 @@ const authOAuthRouteHandlers = app
     }
 
     // Verify cookie by `state` (CSRF protection) & PKCE validation
-    const oauthCookie = await getAuthCookie(ctx, `oauth_${state}`);
+    const oauthCookie = await getAuthCookie(ctx, `oauth-state-${state}`);
     const cookiePayload: OAuthCookiePayload | null = oauthCookie ? JSON.parse(oauthCookie) : null;
 
     if (!code || !cookiePayload || !cookiePayload.codeVerifier) {
@@ -213,7 +212,7 @@ const authOAuthRouteHandlers = app
     }
 
     // Verify cookie by `state` (CSRF protection) & PKCE validation
-    const oauthCookie = await getAuthCookie(ctx, `oauth_${state}`);
+    const oauthCookie = await getAuthCookie(ctx, `oauth-state-${state}`);
     const cookiePayload: OAuthCookiePayload | null = oauthCookie ? JSON.parse(oauthCookie) : null;
 
     if (!code || !cookiePayload || !cookiePayload.codeVerifier) {
diff --git a/backend/src/modules/auth/oauth/helpers/callback.ts b/backend/src/modules/auth/oauth/helpers/callback.ts
index 4785a991f..50ecc9962 100644
--- a/backend/src/modules/auth/oauth/helpers/callback.ts
+++ b/backend/src/modules/auth/oauth/helpers/callback.ts
@@ -356,8 +356,9 @@ const handleUnverifiedOAuthAccount = async (
  * @param ctx - The request context.
  * @returns A validated redirect path string.
  */
+// TODO is see nowhere a setAuthCookie for this cookie name?
 const getOAuthRedirectPath = async (ctx: Context<Env>): Promise<string> => {
-  const redirect = await getAuthCookie(ctx, 'oauth_redirect');
+  const redirect = await getAuthCookie(ctx, 'oauth-redirect');
 
   return isValidRedirectPath(redirect) || appConfig.defaultRedirectPath;
 };
diff --git a/backend/src/modules/auth/oauth/helpers/initiation.ts b/backend/src/modules/auth/oauth/helpers/initiation.ts
index be6dc210d..e36a6f682 100644
--- a/backend/src/modules/auth/oauth/helpers/initiation.ts
+++ b/backend/src/modules/auth/oauth/helpers/initiation.ts
@@ -43,8 +43,7 @@ export const handleOAuthInitiation = async (
   const { redirectPath } = await prepareOAuthByContext(ctx);
   const cookieContent = JSON.stringify({ redirectPath, codeVerifier, type });
 
-  // TODO state in name? perhaps in content instead? reconsider cookie lifecycle security and cleanliness
-  await setAuthCookie(ctx, `oauth_${state}`, cookieContent, new TimeSpan(5, 'm'));
+  await setAuthCookie(ctx, `oauth-state-${state}`, cookieContent, new TimeSpan(5, 'm'));
 
   logEvent('info', 'User redirected to OAuth provider', { strategy: 'oauth', provider, type });
 
@@ -128,7 +127,7 @@ const prepareOAuthAcceptInvite = async (ctx: Context<Env>) => {
   const tokenRecord = await getValidToken({ ctx, token, invokeToken: false, tokenType: 'invitation', redirectPath: '/auth/authenticate' });
 
   const redirectPath = tokenRecord.entityType
-    ? `${appConfig.backendAuthUrl}/invoke-token/${tokenRecord.type}/${tokenRecord.token}`
+    ? `${appConfig.backendAuthUrl}/invoke-token/${tokenRecord.type}/${tokenRecord.token}?tokenId=${tokenRecord.id}`
     : appConfig.defaultRedirectPath;
 
   return { redirectPath };
@@ -143,11 +142,11 @@ const prepareOAuthAcceptInvite = async (ctx: Context<Env>) => {
  * @throws AppError if missing param or user mismatch
  */
 const prepareOAuthConnect = async (ctx: Context<Env>) => {
-  const { sessionToken } = await getParsedSessionCookie(ctx, { redirectOnError: '/error' });
+  const { sessionToken } = await getParsedSessionCookie(ctx, { redirectOnError: '/auth/error' });
 
   // Get user from valid session
   const { user } = await validateSession(sessionToken);
-  if (!user) throw new AppError({ status: 404, type: 'not_found', entityType: 'user', severity: 'error', redirectPath: '/error' });
+  if (!user) throw new AppError({ status: 404, type: 'not_found', entityType: 'user', severity: 'error', redirectPath: '/auth/error' });
 
   //TODO we do this on callback or not? handle error query params in /settings
   const redirectPath = '/settings#authentication';
diff --git a/backend/src/modules/auth/oauth/helpers/send-oauth-verification-email.ts b/backend/src/modules/auth/oauth/helpers/send-oauth-verification-email.ts
index 6999f00c5..0389f8c5c 100644
--- a/backend/src/modules/auth/oauth/helpers/send-oauth-verification-email.ts
+++ b/backend/src/modules/auth/oauth/helpers/send-oauth-verification-email.ts
@@ -84,7 +84,7 @@ export const sendOAuthVerificationEmail = async ({ userId, oauthAccountId, redir
   const lng = user.language;
 
   // Create verification link: go to
-  const verifyPath = `/auth/invoke-token/${tokenRecord.type}/${tokenRecord.token}`;
+  const verifyPath = `/auth/invoke-token/${tokenRecord.type}/${tokenRecord.token}?tokenId=${tokenRecord.id}`;
   const verificationURL = new URL(verifyPath, appConfig.backendUrl);
 
   if (redirectPath) verificationURL.searchParams.set('redirect', encodeURIComponent(redirectPath));
diff --git a/backend/src/modules/auth/passkeys/handlers.ts b/backend/src/modules/auth/passkeys/handlers.ts
index eb7a2c7ac..5d9b2e12f 100644
--- a/backend/src/modules/auth/passkeys/handlers.ts
+++ b/backend/src/modules/auth/passkeys/handlers.ts
@@ -10,7 +10,7 @@ import { totpsTable } from '#/db/schema/totps';
 import { type UserModel, usersTable } from '#/db/schema/users';
 import { type Env, getContextUser } from '#/lib/context';
 import { AppError } from '#/lib/errors';
-import { getAuthCookie, setAuthCookie } from '#/modules/auth/general/helpers/cookie';
+import { deleteAuthCookie, getAuthCookie, setAuthCookie } from '#/modules/auth/general/helpers/cookie';
 import { deviceInfo } from '#/modules/auth/general/helpers/device-info';
 import { consumeMfaToken, validateConfirmMfaToken } from '#/modules/auth/general/helpers/mfa';
 import { setUserSession } from '#/modules/auth/general/helpers/session';
@@ -33,6 +33,8 @@ const authPasskeysRouteHandlers = app
     const user = getContextUser();
 
     const challengeFromCookie = await getAuthCookie(ctx, 'passkey-challenge');
+    deleteAuthCookie(ctx, 'passkey-challenge');
+
     if (!challengeFromCookie) throw new AppError({ status: 401, type: 'invalid_credentials', severity: 'error' });
 
     const { credentialId, publicKey } = parseAndValidatePasskeyAttestation(clientDataJSON, attestationObject, challengeFromCookie);
diff --git a/backend/src/modules/auth/passkeys/helpers/passkey.ts b/backend/src/modules/auth/passkeys/helpers/passkey.ts
index d4d5f14e3..e3da0fc0a 100644
--- a/backend/src/modules/auth/passkeys/helpers/passkey.ts
+++ b/backend/src/modules/auth/passkeys/helpers/passkey.ts
@@ -17,7 +17,7 @@ import { Context } from 'hono';
 import { db } from '#/db/db';
 import { passkeysTable } from '#/db/schema/passkeys';
 import { AppError } from '#/lib/errors';
-import { getAuthCookie } from '#/modules/auth/general/helpers/cookie';
+import { deleteAuthCookie, getAuthCookie } from '#/modules/auth/general/helpers/cookie';
 
 /**
  * Parses and validates passkey attestation data.
@@ -93,6 +93,7 @@ export const validatePasskey = async (ctx: Context, passkeyData: Omit<PasskeyDat
 
   // Retrieve the passkey challenge stored in a secure cookie
   const challengeFromCookie = await getAuthCookie(ctx, 'passkey-challenge');
+  deleteAuthCookie(ctx, 'passkey-challenge');
   if (!challengeFromCookie) throw new AppError({ status: 401, type: 'invalid_credentials', severity: 'warn' });
 
   // Fetch passkey record for this user and credential ID
diff --git a/backend/src/modules/auth/passwords/handlers.ts b/backend/src/modules/auth/passwords/handlers.ts
index f08954dc5..412a3b4e6 100644
--- a/backend/src/modules/auth/passwords/handlers.ts
+++ b/backend/src/modules/auth/passwords/handlers.ts
@@ -146,7 +146,7 @@ const authPasswordsRouteHandlers = app
 
     // Send email
     const lng = user.language;
-    const createPasswordLink = `${appConfig.backendAuthUrl}/invoke-token/${tokenRecord.type}/${tokenRecord.token}`;
+    const createPasswordLink = `${appConfig.backendAuthUrl}/invoke-token/${tokenRecord.type}/${tokenRecord.token}?tokenId${tokenRecord.id}`;
     const subject = i18n.t('backend:email.create_password.subject', { lng, appName: appConfig.name });
     const staticProps = { createPasswordLink, subject, lng };
     const recipients = [{ email: user.email }];
diff --git a/backend/src/modules/me/handlers.ts b/backend/src/modules/me/handlers.ts
index 04ae432df..62524a8b4 100644
--- a/backend/src/modules/me/handlers.ts
+++ b/backend/src/modules/me/handlers.ts
@@ -313,7 +313,7 @@ const meRouteHandlers = app
 
       throw new AppError({
         status: 500,
-        type: 'missing_auth_key',
+        type: 'auth_key_not_found',
         severity: 'error',
         ...(error instanceof Error ? { originalError: error } : {}),
       });
diff --git a/backend/src/modules/memberships/handlers.ts b/backend/src/modules/memberships/handlers.ts
index 0e1d87a59..966e7a7fc 100644
--- a/backend/src/modules/memberships/handlers.ts
+++ b/backend/src/modules/memberships/handlers.ts
@@ -16,7 +16,7 @@ import { sendSSEToUsers } from '#/lib/sse';
 import { getAssociatedEntityDetails, insertMembership } from '#/modules/memberships/helpers';
 import { membershipBaseSelect } from '#/modules/memberships/helpers/select';
 import membershipRoutes from '#/modules/memberships/routes';
-import { memberSelect, userSelect } from '#/modules/users/helpers/select';
+import { memberSelect, userSelect, usersBaseQuery } from '#/modules/users/helpers/select';
 import { getValidContextEntity } from '#/permissions/get-context-entity';
 import { defaultHook } from '#/utils/default-hook';
 import { getIsoDate } from '#/utils/iso-date';
@@ -224,10 +224,10 @@ const membershipRouteHandlers = app
     );
 
     // Prepare and send invitation emails
-    const recipients = insertedTokens.map(({ email, token }) => ({
+    const recipients = insertedTokens.map(({ email, token, id }) => ({
       email,
       name: slugFromEmail(email),
-      memberInviteLink: `${appConfig.backendAuthUrl}/invoke-token/invitation/${token}`,
+      memberInviteLink: `${appConfig.backendAuthUrl}/invoke-token/invitation/${token}?tokenId=${id}`,
     }));
 
     const emailProps = {
@@ -382,23 +382,24 @@ const membershipRouteHandlers = app
     const [membership] = await db
       .select()
       .from(membershipsTable)
-      .where(and(eq(membershipsTable.id, membershipId), isNotNull(membershipsTable.tokenId)))
+      .where(
+        and(
+          eq(membershipsTable.id, membershipId),
+          eq(membershipsTable.userId, user.id),
+          eq(membershipsTable.contextType, 'organization'),
+          isNotNull(membershipsTable.tokenId),
+        ),
+      )
       .limit(1);
 
     if (!membership) throw new AppError({ status: 404, type: 'membership_not_found', severity: 'error', meta: { membershipId } });
 
-    // Make sure correct user accepts invitation (for example another user could have a sessions and click on email invite of another user)
-    if (user.id !== membership.userId) throw new AppError({ status: 401, type: 'user_mismatch', severity: 'error' });
-
     // Can't accept already active membership
     if (membership.activatedAt) throw new AppError({ status: 400, type: 'membership_already_active', severity: 'error', meta: { membershipId } });
 
     // Can't accept membership without token
     if (!membership.tokenId) throw new AppError({ status: 400, type: 'membership_without_token', severity: 'error', meta: { membershipId } });
 
-    // Make sure its an organization membership
-    if (membership.contextType !== 'organization') throw new AppError({ status: 401, type: 'invalid_token', severity: 'warn' });
-
     if (acceptOrReject === 'accept') {
       // Activate memberships, can be multiple if there are nested entity memberships. Eg. organization and project
       // TODO test this in raak for projects and edge cases
@@ -528,16 +529,14 @@ const membershipRouteHandlers = app
    */
   .openapi(membershipRoutes.resendInvitation, async (ctx) => {
     const { email, tokenId } = ctx.req.valid('json');
-    const normalizedEmail = email.toLowerCase().trim();
-
-    const filters = [
-      eq(tokensTable.type, 'invitation'),
-      eq(tokensTable.email, normalizedEmail),
-      isNotNull(tokensTable.entityType),
-      isNotNull(tokensTable.role),
-      isNull(tokensTable.invokedAt),
-    ];
-    if (tokenId) filters.push(eq(tokensTable.id, tokenId));
+
+    const normalizedEmail = email?.toLowerCase().trim();
+
+    const filters = [eq(tokensTable.type, 'invitation'), isNotNull(tokensTable.entityType), isNotNull(tokensTable.role)];
+
+    if (normalizedEmail) filters.push(eq(tokensTable.email, normalizedEmail));
+    else if (tokenId) filters.push(eq(tokensTable.id, tokenId));
+    else throw new AppError({ status: 400, type: 'invalid_request', severity: 'error' });
 
     // Retrieve token
     const [oldToken] = await db
@@ -547,18 +546,18 @@ const membershipRouteHandlers = app
       .orderBy(desc(tokensTable.createdAt))
       .limit(1);
 
-    if (!oldToken) throw new AppError({ status: 404, type: 'not_found', severity: 'warn' });
+    if (!oldToken) throw new AppError({ status: 404, type: 'token_not_found', severity: 'error' });
 
     const { entityType, role, email: userEmail } = oldToken;
 
-    if (!entityType || !role) throw new AppError({ status: 401, type: 'invalid_request', severity: 'warn' });
+    if (!entityType || !role) throw new AppError({ status: 500, type: 'server_error', severity: 'error' });
 
     const entityIdField = appConfig.entityIdFields[entityType];
     const entityId = oldToken[entityIdField];
-    if (!entityId) throw new AppError({ status: 404, type: 'not_found', severity: 'warn' });
+    if (!entityId) throw new AppError({ status: 500, type: 'server_error', entityType, severity: 'error' });
 
     const entity = await resolveEntity(entityType, entityId);
-    if (!entity) throw new AppError({ status: 404, type: 'not_found', severity: 'warn', entityType });
+    if (!entity) throw new AppError({ status: 404, type: 'not_found', severity: 'error', entityType });
 
     // Insert token first
     const [{ newTokenId, newToken }] = await db
@@ -568,6 +567,8 @@ const membershipRouteHandlers = app
         id: nanoid(),
         token: nanoid(40), // unique hashed token
         expiresAt: createDate(new TimeSpan(7, 'd')),
+        invokedAt: null,
+        singleUseToken: null,
       })
       .returning({ newTokenId: tokensTable.id, newToken: tokensTable.token });
 
@@ -584,10 +585,23 @@ const membershipRouteHandlers = app
     const recipient = {
       email: userEmail,
       name: slugFromEmail(userEmail),
-      memberInviteLink: `${appConfig.backendAuthUrl}/invoke-token/${oldToken.type}/${newToken}`,
+      memberInviteLink: `${appConfig.backendAuthUrl}/invoke-token/${oldToken.type}/${newToken}?tokenId=${newTokenId}`,
     };
 
+    let senderName = 'System';
+    let senderThumbnailUrl: null | string = null;
+
+    // Get original sender
+    if (oldToken.createdBy) {
+      const [sender] = await usersBaseQuery().where(eq(usersTable.id, oldToken.createdBy)).limit(1);
+
+      senderName = sender.name;
+      senderThumbnailUrl = sender.thumbnailUrl;
+    }
+
     const emailProps = {
+      senderName,
+      senderThumbnailUrl,
       entityName: entity.name,
       role,
       subject: i18n.t('backend:email.member_invite.subject', {
diff --git a/backend/src/modules/memberships/routes.ts b/backend/src/modules/memberships/routes.ts
index aae912f47..9def43d04 100644
--- a/backend/src/modules/memberships/routes.ts
+++ b/backend/src/modules/memberships/routes.ts
@@ -12,7 +12,14 @@ import {
   pendingInvitationSchema,
 } from '#/modules/memberships/schema';
 import { memberSchema } from '#/modules/users/schema';
-import { entityWithTypeQuerySchema, idInOrgParamSchema, idOrSlugSchema, idsBodySchema, inOrgParamSchema } from '#/utils/schema/common';
+import {
+  emailOrTokenIdQuerySchema,
+  entityWithTypeQuerySchema,
+  idInOrgParamSchema,
+  idOrSlugSchema,
+  idsBodySchema,
+  inOrgParamSchema,
+} from '#/utils/schema/common';
 import { errorResponses, paginationSchema, successWithoutDataSchema, successWithRejectedItemsSchema } from '#/utils/schema/responses';
 
 const membershipRoutes = {
@@ -177,7 +184,7 @@ const membershipRoutes = {
     description: 'Resends an invitation email to a new or existing user using the provided email address and token ID.',
     security: [],
     request: {
-      body: { content: { 'application/json': { schema: z.object({ email: z.email(), tokenId: z.string().optional() }) } } },
+      body: { content: { 'application/json': { schema: emailOrTokenIdQuerySchema } } },
     },
     responses: {
       200: {
diff --git a/backend/src/modules/system/handlers.ts b/backend/src/modules/system/handlers.ts
index b9d93682a..d589f30ea 100644
--- a/backend/src/modules/system/handlers.ts
+++ b/backend/src/modules/system/handlers.ts
@@ -147,7 +147,7 @@ const systemRouteHandlers = app
       email: t.email,
       lng,
       name: slugFromEmail(t.email),
-      systemInviteLink: `${appConfig.backendAuthUrl}/invoke-token/${t.type}/${t.token}`,
+      systemInviteLink: `${appConfig.backendAuthUrl}/invoke-token/${t.type}/${t.id}?token=${t.token}`,
     }));
     type Recipient = (typeof recipients)[number];
 
diff --git a/backend/src/permissions/get-context-entity.ts b/backend/src/permissions/get-context-entity.ts
index df36f24b0..bb020e351 100644
--- a/backend/src/permissions/get-context-entity.ts
+++ b/backend/src/permissions/get-context-entity.ts
@@ -47,7 +47,7 @@ export const getValidContextEntity = async <T extends ContextEntityType>(
   const membership = memberships.find((m) => m[entityIdField] === entity.id && m.contextType === entityType) || null;
 
   if (!isAllowed) {
-    if (!membership) throw new AppError({ status: 403, type: 'missing_membership', severity: 'error', entityType });
+    if (!membership) throw new AppError({ status: 403, type: 'membership_not_found', severity: 'error', entityType });
 
     // Step 4: Validate organization alignment
     const organization = getContextOrganization();
diff --git a/backend/src/permissions/get-product-entity.ts b/backend/src/permissions/get-product-entity.ts
index 4a7593793..a4e0b51be 100644
--- a/backend/src/permissions/get-product-entity.ts
+++ b/backend/src/permissions/get-product-entity.ts
@@ -45,7 +45,8 @@ export const getValidProductEntity = async <K extends ProductEntityType>(
     const entityId = (entity as Record<string, unknown>)[entityIdField];
 
     const membership = memberships.find((m) => m.contextType === contextEntityType && m[entityIdField] === entityId);
-    if (!membership) throw new AppError({ status: 403, type: 'missing_membership', severity: 'error', entityType: contextEntityType, meta: entity });
+    if (!membership)
+      throw new AppError({ status: 403, type: 'membership_not_found', severity: 'error', entityType: contextEntityType, meta: entity });
 
     // Step 4: Validate organization alignment
     const organization = getContextOrganization();
diff --git a/backend/src/utils/get-valid-single-use-token.ts b/backend/src/utils/get-valid-single-use-token.ts
index 8d1a19476..9d1551cb0 100644
--- a/backend/src/utils/get-valid-single-use-token.ts
+++ b/backend/src/utils/get-valid-single-use-token.ts
@@ -5,6 +5,7 @@ import { db } from '#/db/db';
 import { type TokenModel, tokensTable } from '#/db/schema/tokens';
 import { AppError } from '#/lib/errors';
 import { getAuthCookie } from '#/modules/auth/general/helpers/cookie';
+import { isExpiredDate } from './is-expired-date';
 
 type Props = {
   ctx: Context;
@@ -24,21 +25,19 @@ export const getValidSingleUseToken = async ({ ctx, tokenType, redirectPath }: P
   const singleUseToken = await getAuthCookie(ctx, tokenType);
   if (!singleUseToken) throw new AppError({ status: 400, type: 'invalid_request', severity: 'error', redirectPath });
 
-  const condition = [
-    eq(tokensTable.type, tokenType), // Match token type
-    eq(tokensTable.singleUseToken, singleUseToken), // Match token value
-  ];
-
+  // Get token record that matches type and singleUseToken value
   const [tokenRecord] = await db
     .select()
     .from(tokensTable)
-    .where(and(...condition))
+    .where(and(eq(tokensTable.type, tokenType), eq(tokensTable.singleUseToken, singleUseToken)))
     .limit(1);
 
   if (!tokenRecord) throw new AppError({ status: 404, type: `${tokenType}_not_found`, severity: 'error', redirectPath });
 
-  // Sanity check
-  if (tokenType && tokenRecord.type !== tokenType) throw new AppError({ status: 401, type: 'invalid_token', severity: 'error', redirectPath });
+  // Token expired
+  if (isExpiredDate(tokenRecord.expiresAt)) {
+    throw new AppError({ status: 401, type: `${tokenRecord.type}_expired`, severity: 'warn', redirectPath });
+  }
 
   return tokenRecord;
 };
diff --git a/backend/src/utils/get-valid-token.ts b/backend/src/utils/get-valid-token.ts
index ea0801e58..29baedcb8 100644
--- a/backend/src/utils/get-valid-token.ts
+++ b/backend/src/utils/get-valid-token.ts
@@ -1,12 +1,14 @@
-import { and, eq, gt, isNull } from 'drizzle-orm';
+import { and, eq } from 'drizzle-orm';
 import { Context } from 'hono';
 import { db } from '#/db/db';
 import { type TokenModel, tokensTable } from '#/db/schema/tokens';
 import { Env } from '#/lib/context';
 import { AppError } from '#/lib/errors';
-import { getValidSingleUseToken } from '#/utils/get-valid-single-use-token';
+import { getAuthCookie } from '#/modules/auth/general/helpers/cookie';
+import { getParsedSessionCookie, validateSession } from '#/modules/auth/general/helpers/session';
 import { isExpiredDate } from '#/utils/is-expired-date';
 import { nanoid } from '#/utils/nanoid';
+import { createDate, TimeSpan } from './time-span';
 
 type BaseProps = {
   ctx: Context<Env>;
@@ -28,36 +30,44 @@ type BaseProps = {
  * @throws AppError if the token is not found, expired, or of an invalid type.
  */
 export const getValidToken = async ({ ctx, token, tokenType, invokeToken = true, redirectPath }: BaseProps): Promise<TokenModel> => {
-  const condition = [
-    isNull(tokensTable.invokedAt), // Token not yet invoked
-    gt(tokensTable.expiresAt, new Date()), // Token not expired
-    eq(tokensTable.token, token), // Match token value
-  ];
-
-  if (tokenType) condition.push(eq(tokensTable.type, tokenType));
-
+  // Get token record that matches (possibly invoked) token
   let [tokenRecord] = await db
     .select()
     .from(tokensTable)
-    .where(and(...condition))
+    .where(and(eq(tokensTable.token, token), eq(tokensTable.type, tokenType)))
     .limit(1);
 
-  // If token not found, perhaps user already has the single-use token
-  if (!tokenRecord) tokenRecord = await getValidSingleUseToken({ ctx, tokenType, redirectPath });
+  if (!tokenRecord) throw new AppError({ status: 401, type: `${tokenType}_not_found`, severity: 'warn', redirectPath });
+
+  // If token doesn't match a possible existing auth session, abort
+  let existingSessionToken: string | null = null;
+  try {
+    const { sessionToken } = await getParsedSessionCookie(ctx, { redirectOnError: redirectPath });
+    existingSessionToken = sessionToken;
+  } catch (err) {}
+  if (existingSessionToken) {
+    // Get user from valid session
+    const { user } = await validateSession(existingSessionToken);
+    if (user?.id && tokenRecord.userId !== user.id) throw new AppError({ status: 400, type: 'user_mismatch', severity: 'warn', redirectPath });
+  }
 
   // Token expired
   if (isExpiredDate(tokenRecord.expiresAt)) {
     throw new AppError({ status: 401, type: `${tokenRecord.type}_expired`, severity: 'warn', redirectPath });
   }
 
-  // Sanity check
-  if (tokenType && tokenRecord.type !== tokenType) throw new AppError({ status: 401, type: 'invalid_token', severity: 'error', redirectPath });
+  // If token already invoked but not expired, last resort is to check if user still has the single use token session
+  // If that isnt present anymore, we consider the token expired anyways
+  if (tokenRecord.invokedAt) {
+    const singleUseToken = await getAuthCookie(ctx, tokenType);
+    if (!singleUseToken) throw new AppError({ status: 401, type: `${tokenRecord.type}_expired`, severity: 'warn', redirectPath });
+  }
 
-  // Create single use session token and mark token as invoked
+  // Create single use session token, mark token as invoked, and update expiresAt to 5 min from now
   if (invokeToken) {
     const [invokedTokenRecord] = await db
       .update(tokensTable)
-      .set({ singleUseToken: nanoid(40), invokedAt: new Date() })
+      .set({ singleUseToken: nanoid(40), invokedAt: new Date(), expiresAt: createDate(new TimeSpan(5, 'm')) })
       .where(eq(tokensTable.id, tokenRecord.id))
       .returning();
     return invokedTokenRecord;
diff --git a/backend/src/utils/schema/common.ts b/backend/src/utils/schema/common.ts
index ebdca8e06..5c12a26b0 100644
--- a/backend/src/utils/schema/common.ts
+++ b/backend/src/utils/schema/common.ts
@@ -100,6 +100,11 @@ export const paginationQuerySchema = z.object({
     .refine(limitRefine, t('invalid_limit', { max: limitMax })),
 });
 
+export const emailOrTokenIdQuerySchema = z.union([
+  z.object({ email: z.string().email(), tokenId: z.undefined() }),
+  z.object({ email: z.undefined(), tokenId: z.string() }),
+]);
+
 /*************************************************************************************************
  * Common body schemas
  ************************************************************************************************/
diff --git a/frontend/package.json b/frontend/package.json
index c8f3b4297..f96eeeec6 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -74,8 +74,8 @@
     "@tanstack/react-query": "5.87.4",
     "@tanstack/react-query-devtools": "5.87.4",
     "@tanstack/react-query-persist-client": "5.87.4",
-    "@tanstack/react-router": "1.132.6",
-    "@tanstack/react-router-devtools": "1.132.6",
+    "@tanstack/react-router": "1.132.31",
+    "@tanstack/react-router-devtools": "1.132.31",
     "@uppy/audio": "^3.0.1",
     "@uppy/core": "^5.0.2",
     "@uppy/dashboard": "^5.0.2",
@@ -103,7 +103,7 @@
     "embla-carousel-autoplay": "^8.6.0",
     "embla-carousel-react": "^8.6.0",
     "gleap": "^14.8.11",
-    "i18next": "^25.5.2",
+    "i18next": "^25.5.3",
     "i18next-browser-languagedetector": "^8.2.0",
     "i18next-hmr": "^3.1.5",
     "i18next-http-backend": "^3.0.2",
@@ -119,10 +119,10 @@
     "pdfjs-dist": "4.8.69",
     "player.style": "^0.2.0",
     "qrcode.react": "^4.2.0",
-    "react": "^19.1.1",
+    "react": "^19.2.0",
     "react-data-grid": "7.0.0-beta.57",
     "react-day-picker": "^9.11.0",
-    "react-dom": "^19.1.1",
+    "react-dom": "^19.2.0",
     "react-error-boundary": "^6.0.0",
     "react-hook-form": "^7.63.0",
     "react-i18next": "^15.7.4",
@@ -135,7 +135,7 @@
     "slugify": "1.6.6",
     "sonner": "^2.0.7",
     "tailwind-merge": "^3.3.1",
-    "tailwindcss": "^4.1.13",
+    "tailwindcss": "^4.1.14",
     "tailwindcss-animate": "^1.0.7",
     "use-count-up": "^3.0.1",
     "vaul": "^1.1.2",
@@ -156,13 +156,13 @@
     "@storybook/addon-docs": "^9.1.10",
     "@storybook/addon-vitest": "^9.1.10",
     "@storybook/react-vite": "^9.1.10",
-    "@tailwindcss/vite": "^4.1.13",
-    "@tanstack/router-core": "^1.132.27",
-    "@tanstack/router-plugin": "^1.132.27",
+    "@tailwindcss/vite": "^4.1.14",
+    "@tanstack/router-core": "^1.132.31",
+    "@tanstack/router-plugin": "^1.132.31",
     "@types/canvas-confetti": "^1.9.0",
-    "@types/node": "^24.6.1",
-    "@types/react": "^19.1.16",
-    "@types/react-dom": "^19.1.9",
+    "@types/node": "^24.6.2",
+    "@types/react": "^19.2.0",
+    "@types/react-dom": "^19.2.0",
     "@types/zxcvbn": "^4.4.5",
     "@typescript/native-preview": "7.0.0-dev.20250910.1",
     "@vitejs/plugin-basic-ssl": "^2.1.0",
@@ -175,11 +175,11 @@
     "playwright": "^1.55.1",
     "postgres": "^3.4.7",
     "react-scan": "^0.4.3",
-    "rollup-plugin-visualizer": "^6.0.3",
+    "rollup-plugin-visualizer": "^6.0.4",
     "storybook": "^9.1.10",
     "tsx": "^4.20.6",
     "typescript": "^5.9.3",
-    "vite": "^7.1.7",
+    "vite": "^7.1.8",
     "vite-plugin-html": "^3.2.2",
     "vite-plugin-pwa": "^1.0.3",
     "vite-plugin-static-copy": "^3.1.3",
diff --git a/frontend/src/api.gen/sdk.gen.ts b/frontend/src/api.gen/sdk.gen.ts
index 526b17eab..e43fd6b13 100644
--- a/frontend/src/api.gen/sdk.gen.ts
+++ b/frontend/src/api.gen/sdk.gen.ts
@@ -260,6 +260,7 @@ export const checkEmail = <ThrowOnError extends boolean = true>(options?: Option
  * @param {invokeTokenData} options
  * @param {enum} options.path.type - `enum`
  * @param {string} options.path.token - `string`
+ * @param {string} options.query.tokenid - `string`
  * @returns Possible status codes: 302, 400, 401, 403, 404, 429
  */
 export const invokeToken = <ThrowOnError extends boolean = true>(options: Options<InvokeTokenData, ThrowOnError>) => {
diff --git a/frontend/src/api.gen/types.gen.ts b/frontend/src/api.gen/types.gen.ts
index 530229033..f39cdc473 100644
--- a/frontend/src/api.gen/types.gen.ts
+++ b/frontend/src/api.gen/types.gen.ts
@@ -263,7 +263,9 @@ export type InvokeTokenData = {
     type: 'email-verification' | 'oauth-verification' | 'password-reset' | 'invitation' | 'confirm-mfa';
     token: string;
   };
-  query?: never;
+  query: {
+    tokenId: string;
+  };
   url: '/auth/invoke-token/{type}/{token}';
 };
 
@@ -4220,7 +4222,7 @@ export type GetPendingInvitationsResponse = GetPendingInvitationsResponses[keyof
 
 export type ResendInvitationData = {
   body?: {
-    email: string;
+    email?: string;
     tokenId?: string;
   };
   path?: never;
diff --git a/frontend/src/api.gen/zod.gen.ts b/frontend/src/api.gen/zod.gen.ts
index 16ff9103d..64f280b05 100644
--- a/frontend/src/api.gen/zod.gen.ts
+++ b/frontend/src/api.gen/zod.gen.ts
@@ -229,7 +229,9 @@ export const zInvokeTokenData = z.object({
     type: z.enum(['email-verification', 'oauth-verification', 'password-reset', 'invitation', 'confirm-mfa']),
     token: z.string(),
   }),
-  query: z.optional(z.never()),
+  query: z.object({
+    tokenId: z.string(),
+  }),
 });
 
 export const zGetTokenDataData = z.object({
@@ -1531,7 +1533,7 @@ export const zGetPendingInvitationsResponse = z.object({
 export const zResendInvitationData = z.object({
   body: z.optional(
     z.object({
-      email: z.email(),
+      email: z.optional(z.email()),
       tokenId: z.optional(z.string()),
     }),
   ),
diff --git a/frontend/src/modules/auth/steps/auth-error.tsx b/frontend/src/modules/auth/auth-error-page.tsx
similarity index 54%
rename from frontend/src/modules/auth/steps/auth-error.tsx
rename to frontend/src/modules/auth/auth-error-page.tsx
index 5e3d15be1..b521c94f1 100644
--- a/frontend/src/modules/auth/steps/auth-error.tsx
+++ b/frontend/src/modules/auth/auth-error-page.tsx
@@ -1,4 +1,4 @@
-import { Link } from '@tanstack/react-router';
+import { Link, useSearch } from '@tanstack/react-router';
 import { LogIn } from 'lucide-react';
 import { useTranslation } from 'react-i18next';
 import ErrorNotice from '~/modules/common/error-notice';
@@ -9,19 +9,27 @@ import { useAuthStore } from '~/store/auth';
 /**
  * Displays an error notice in authentication layout.
  */
-export const AuthError = () => {
+const AuthErrorPage = () => {
   const { t } = useTranslation();
 
+  const { error: errorType, tokenId } = useSearch({ from: '/publicLayout/authLayout/auth/error' });
+
   const { email, error } = useAuthStore();
 
+  // Show a resend invitation button if necessary
+  const showResendButton = error?.type === 'invite_takes_priority' || errorType === 'invitation_expired';
+  const resendData = tokenId ? { tokenId } : email ? { email } : false;
+
   return (
     <ErrorNotice error={error} level={'public'}>
-      <Link to="/auth/authenticate" replace className={buttonVariants({ size: 'lg' })}>
+      {showResendButton && resendData && <ResendMembershipInviteButton resendData={resendData} />}
+
+      <Link to="/auth/authenticate" replace className={buttonVariants({ variant: showResendButton ? 'plain' : 'default' })}>
         <LogIn size={16} className="mr-2" />
         {t('common:sign_in')}
       </Link>
-
-      {error?.type === 'invite_takes_priority' && <ResendMembershipInviteButton resendData={{ email }} buttonProps={{ size: 'lg' }} />}
     </ErrorNotice>
   );
 };
+
+export default AuthErrorPage;
diff --git a/frontend/src/modules/auth/create-password-form.tsx b/frontend/src/modules/auth/create-password-page.tsx
similarity index 98%
rename from frontend/src/modules/auth/create-password-form.tsx
rename to frontend/src/modules/auth/create-password-page.tsx
index ce5a1c1dc..b10a6aabd 100644
--- a/frontend/src/modules/auth/create-password-form.tsx
+++ b/frontend/src/modules/auth/create-password-page.tsx
@@ -24,7 +24,7 @@ const PasswordStrength = lazy(() => import('~/modules/auth/password-strength'));
 const formSchema = z.object({ password: z.string().min(8).max(100) });
 type FormValues = z.infer<typeof formSchema>;
 
-const CreatePasswordForm = () => {
+const CreatePasswordPage = () => {
   const { t } = useTranslation();
   const navigate = useNavigate();
 
@@ -109,4 +109,4 @@ const CreatePasswordForm = () => {
   );
 };
 
-export default CreatePasswordForm;
+export default CreatePasswordPage;
diff --git a/frontend/src/modules/auth/email-verification.tsx b/frontend/src/modules/auth/email-verification-page.tsx
similarity index 91%
rename from frontend/src/modules/auth/email-verification.tsx
rename to frontend/src/modules/auth/email-verification-page.tsx
index 47c1bafe6..640bf1fb1 100644
--- a/frontend/src/modules/auth/email-verification.tsx
+++ b/frontend/src/modules/auth/email-verification-page.tsx
@@ -2,7 +2,7 @@ import { useParams, useSearch } from '@tanstack/react-router';
 import { useTranslation } from 'react-i18next';
 import { LegalNotice } from '~/modules/auth/legal-notice';
 
-const EmailVerification = () => {
+const EmailVerificationPage = () => {
   const { t } = useTranslation();
 
   const { reason } = useParams({ from: '/publicLayout/authLayout/auth/email-verification/$reason' });
@@ -20,4 +20,4 @@ const EmailVerification = () => {
   );
 };
 
-export default EmailVerification;
+export default EmailVerificationPage;
diff --git a/frontend/src/modules/auth/layout.tsx b/frontend/src/modules/auth/layout.tsx
index 8e60b9d12..aff3a2624 100644
--- a/frontend/src/modules/auth/layout.tsx
+++ b/frontend/src/modules/auth/layout.tsx
@@ -27,7 +27,7 @@ const AuthLayout = () => {
       </Suspense>
 
       <div className="mt-auto mb-auto">
-        <div className="mx-auto mb-40 mt-8 flex flex-col justify-center gap-4 w-[90vw] xs:w-80 sm:w-116 transition-all will-change-transform duration-500 ease-out opacity-0 group-data-[started=false]:scale-95 translate-y-4 group-data-[started=true]:opacity-100">
+        <div className="mx-auto mb-40 mt-8 flex flex-col justify-center gap-4 w-[90vw] xs:w-80 sm:w-116 has-[.error-notice]:sm:w-200 transition-all will-change-transform duration-500 ease-out opacity-0 group-data-[started=false]:scale-95 translate-y-4 group-data-[started=true]:opacity-100">
           <Outlet />
 
           <Link to="/about" className="hover:opacity-90 p-4 active:scale-95 mx-auto rounded-md focus-effect">
diff --git a/frontend/src/modules/auth/mfa.tsx b/frontend/src/modules/auth/mfa-page.tsx
similarity index 90%
rename from frontend/src/modules/auth/mfa.tsx
rename to frontend/src/modules/auth/mfa-page.tsx
index 5cf3d4419..f14971d25 100644
--- a/frontend/src/modules/auth/mfa.tsx
+++ b/frontend/src/modules/auth/mfa-page.tsx
@@ -1,3 +1,4 @@
+import * as Sentry from '@sentry/react';
 import { useNavigate } from '@tanstack/react-router';
 import { ChevronDown } from 'lucide-react';
 import { useState } from 'react';
@@ -12,7 +13,7 @@ import { useUserStore } from '~/store/user';
 /**
  * Handles multifactor authentication in the authentication flows.
  */
-export const Mfa = () => {
+const MfaPage = () => {
   const { t } = useTranslation();
   const navigate = useNavigate();
 
@@ -25,7 +26,8 @@ export const Mfa = () => {
       await signOut();
       toaster(t('common:success.cancel_mfa'), 'success');
     } catch (error) {
-      // TODO log to sentry?
+      Sentry.captureException(error);
+      console.error('Failed to retrieve data:', error);
     } finally {
       clearUserStore();
       navigate({ to: '/auth/authenticate', replace: true });
@@ -54,3 +56,5 @@ export const Mfa = () => {
     </>
   );
 };
+
+export default MfaPage;
diff --git a/frontend/src/modules/auth/sign-out.tsx b/frontend/src/modules/auth/sign-out.tsx
index a08031b3b..88c136c72 100644
--- a/frontend/src/modules/auth/sign-out.tsx
+++ b/frontend/src/modules/auth/sign-out.tsx
@@ -1,3 +1,4 @@
+import * as Sentry from '@sentry/react';
 import { useNavigate, useSearch } from '@tanstack/react-router';
 import { Heart } from 'lucide-react';
 import { useEffect, useRef } from 'react';
@@ -29,6 +30,7 @@ export const SignOut = () => {
         navigate({ to: '/about', replace: true });
       } catch (error) {
         console.error('Sign out error:', error);
+        Sentry.captureException(error);
         toaster(t('common:already_signed_out'), 'warning');
         navigate({ to: '/about', replace: true });
       }
diff --git a/frontend/src/modules/auth/unsubscribed.tsx b/frontend/src/modules/auth/unsubscribed-page.tsx
similarity index 100%
rename from frontend/src/modules/auth/unsubscribed.tsx
rename to frontend/src/modules/auth/unsubscribed-page.tsx
diff --git a/frontend/src/modules/common/error-notice.tsx b/frontend/src/modules/common/error-notice.tsx
index 05895597f..2c34f863b 100644
--- a/frontend/src/modules/common/error-notice.tsx
+++ b/frontend/src/modules/common/error-notice.tsx
@@ -100,12 +100,12 @@ const ErrorNotice = ({ error, children, resetErrorBoundary, level }: ErrorNotice
   return (
     <>
       {level === 'root' && <Dialoger />}
-      <div className="container flex flex-col min-h-[calc(100vh-10rem)] items-center">
+      <div className="container flex flex-col min-h-[calc(100vh-10rem)] items-center error-notice">
         <div className="mt-auto mb-auto">
-          <Card className="max-w-[80vw] sm:max-w-[36rem] m-4">
-            <CardHeader className="text-center">
-              <CardTitle className="text-2xl mb-2 justify-center">{title}</CardTitle>
-              <CardDescription className="text-foreground/80 text-lg flex-col gap-2">
+          <Card className="max-w-[80vw] sm:max-w-[36rem] mt-8 bg-transparent border-none">
+            <CardHeader className="text-center p-0">
+              <CardTitle className="text-2xl font-normal mb-2 justify-center">{title}</CardTitle>
+              <CardDescription className="font-light flex-col gap-2 p-0">
                 <span className="block">{message}</span>
                 <span className="block mt-2 font-light">
                   <span className="block">{severity === 'warn' && t('error:contact_mistake')}</span>
@@ -114,7 +114,7 @@ const ErrorNotice = ({ error, children, resetErrorBoundary, level }: ErrorNotice
               </CardDescription>
             </CardHeader>
             {error && 'status' in error && (
-              <CardContent className="whitespace-pre-wrap text-red-600 font-mono pb-4">
+              <CardContent className="whitespace-pre-wrap text-red-600 font-mono p-0 pb-4">
                 {error.type && (
                   <Button
                     variant="link"
@@ -161,7 +161,7 @@ const ErrorNotice = ({ error, children, resetErrorBoundary, level }: ErrorNotice
                 </AnimatePresence>
               </CardContent>
             )}
-            <CardFooter className="flex gap-2 max-sm:flex-col max-sm:items-stretch flex-wrap mt-8 justify-center">
+            <CardFooter className="flex gap-2 max-sm:flex-col max-sm:items-stretch flex-wrap mt-8 p-0 justify-center">
               {children ? (
                 children
               ) : (
@@ -170,7 +170,7 @@ const ErrorNotice = ({ error, children, resetErrorBoundary, level }: ErrorNotice
                     <Home size={16} className="mr-2" />
                     {t('common:home')}
                   </Button>
-                  {!location.pathname.startsWith('/error') && severity !== 'info' && (
+                  {!location.pathname.endsWith('/error') && severity !== 'info' && (
                     <Button onClick={handleReload}>
                       <RefreshCw size={16} className="mr-2" />
                       {t('common:reload')}
diff --git a/frontend/src/modules/me/settings-page.tsx b/frontend/src/modules/me/settings-page.tsx
index 62b5eccc9..4dbe6be85 100644
--- a/frontend/src/modules/me/settings-page.tsx
+++ b/frontend/src/modules/me/settings-page.tsx
@@ -1,3 +1,4 @@
+import * as Sentry from '@sentry/react';
 import { onlineManager, useMutation } from '@tanstack/react-query';
 import { appConfig, type EnabledOAuthProvider } from 'config';
 import { Check, Send, Trash } from 'lucide-react';
@@ -93,6 +94,7 @@ const UserSettingsPage = () => {
       const providerUrl = `${baseUrl}?${params.toString()}`;
       window.location.assign(providerUrl);
     } catch (error) {
+      Sentry.captureException(error);
       toaster(t('common:url_malformed'), 'error');
       setLoadingProvider(null);
     }
diff --git a/frontend/src/modules/memberships/query-mutations.ts b/frontend/src/modules/memberships/query-mutations.ts
index 805f5eb26..d0f6ef149 100644
--- a/frontend/src/modules/memberships/query-mutations.ts
+++ b/frontend/src/modules/memberships/query-mutations.ts
@@ -42,8 +42,8 @@ export const useInviteMemberMutation = () =>
         path: { orgIdOrSlug: entity.organizationId || entity.id },
       }),
     onSuccess: ({ invitesSentCount }, { entity }) => {
-      // TODO make SSE for updating pending counts and table
       const { id, slug, entityType, organizationId } = entity;
+
       if (invitesSentCount) {
         // If the entity is not an organization but belongs to one, update its cache too
         if (entityType !== 'organization' && organizationId) {
diff --git a/frontend/src/modules/memberships/resend-membership-invitation.tsx b/frontend/src/modules/memberships/resend-membership-invitation.tsx
index d49085dc6..2d64ad1ae 100644
--- a/frontend/src/modules/memberships/resend-membership-invitation.tsx
+++ b/frontend/src/modules/memberships/resend-membership-invitation.tsx
@@ -15,7 +15,6 @@ type ResendButtonPrpos = {
   callback?: () => void;
 };
 
-// TODO refactor to resend token or refresh token with token refresh functionality that is upcoming
 export const ResendMembershipInviteButton = ({ resendData, wrapperClassName, buttonProps, callback }: ResendButtonPrpos) => {
   const { t } = useTranslation();
   const [disabledResetPassword, setDisabledResetPassword] = useState(false);
@@ -45,7 +44,14 @@ export const ResendMembershipInviteButton = ({ resendData, wrapperClassName, but
       className={wrapperClassName}
       toolTipContent={disabledResetPassword ? t('common:retry_resend_invitation.text') : t('common:resend_invitation.text')}
     >
-      <Button {...buttonProps} aria-label="Resend invitation" onClick={resendInvitationClick} loading={isPending} disabled={disabledResetPassword}>
+      <Button
+        {...buttonProps}
+        className="max-sm:w-full"
+        aria-label="Resend invitation"
+        onClick={resendInvitationClick}
+        loading={isPending}
+        disabled={disabledResetPassword}
+      >
         <Mail size={16} className="mr-2" />
         {t('common:resend')}
       </Button>
diff --git a/frontend/src/query/on-error.ts b/frontend/src/query/on-error.ts
index d68f633a5..8bd5523e8 100644
--- a/frontend/src/query/on-error.ts
+++ b/frontend/src/query/on-error.ts
@@ -34,7 +34,6 @@ export const onError = (error: Error | ApiError) => {
   if (error instanceof ApiError) {
     const statusCode = Number(error.status);
 
-    // TODO maybe just me?
     const isCasualSessionAttempt = error.path && ['/me', '/me/menu'].includes(error.path);
 
     // Maintenance mode
diff --git a/frontend/src/routes/auth-routes.tsx b/frontend/src/routes/auth-routes.tsx
index 66d61cc05..bb3ef1169 100644
--- a/frontend/src/routes/auth-routes.tsx
+++ b/frontend/src/routes/auth-routes.tsx
@@ -2,28 +2,28 @@ import { createRoute, redirect } from '@tanstack/react-router';
 import { appConfig } from 'config';
 import i18n from 'i18next';
 import { z } from 'zod';
+import AuthErrorPage from '~/modules/auth/auth-error-page';
 import AuthenticatePage from '~/modules/auth/authenticate-page';
-import CreatePasswordForm from '~/modules/auth/create-password-form';
-import EmailVerification from '~/modules/auth/email-verification';
+import CreatePasswordPage from '~/modules/auth/create-password-page';
+import EmailVerificationPage from '~/modules/auth/email-verification-page';
 import AuthPage from '~/modules/auth/layout';
-import { Mfa } from '~/modules/auth/mfa';
+import MfaPage from '~/modules/auth/mfa-page';
 import { RequestPasswordForm } from '~/modules/auth/request-password-form';
 import { SignOut } from '~/modules/auth/sign-out';
-import { AuthError } from '~/modules/auth/steps/auth-error';
-import Unsubscribed from '~/modules/auth/unsubscribed';
+import UnsubscribedPage from '~/modules/auth/unsubscribed-page';
 import { errorSearchSchema, PublicLayoutRoute } from '~/routes/base-routes';
 import { useAuthStore } from '~/store/auth';
 import { useUserStore } from '~/store/user';
 import appTitle from '~/utils/app-title';
 
-const authenticateRouteSearch = z
-  .object({
-    tokenId: z.string().optional(),
-    token: z.string().optional(),
-    redirect: z.string().optional(),
-    fromRoot: z.boolean().optional(),
-  })
-  .extend(errorSearchSchema.shape);
+const authenticateRouteSearch = z.object({
+  tokenId: z.string().optional(),
+  token: z.string().optional(),
+  redirect: z.string().optional(),
+  fromRoot: z.boolean().optional(),
+});
+
+const authErrorRouteSearch = z.object({ tokenId: z.string().optional() }).extend(errorSearchSchema.shape);
 
 export const AuthLayoutRoute = createRoute({
   id: 'authLayout',
@@ -58,7 +58,7 @@ export const MfaRoute = createRoute({
   staticData: { isAuth: false },
   head: () => ({ meta: [{ title: appTitle('Authenticate') }] }),
   getParentRoute: () => AuthLayoutRoute,
-  component: () => <Mfa />,
+  component: () => <MfaPage />,
 });
 
 export const RequestPasswordRoute = createRoute({
@@ -80,7 +80,7 @@ export const CreatePasswordWithTokenRoute = createRoute({
   staticData: { isAuth: false },
   head: () => ({ meta: [{ title: appTitle('Create password') }] }),
   getParentRoute: () => AuthLayoutRoute,
-  component: () => <CreatePasswordForm />,
+  component: () => <CreatePasswordPage />,
 });
 
 export const EmailVerificationRoute = createRoute({
@@ -89,7 +89,7 @@ export const EmailVerificationRoute = createRoute({
   staticData: { isAuth: false },
   head: () => ({ meta: [{ title: appTitle('Email verification') }] }),
   getParentRoute: () => AuthLayoutRoute,
-  component: () => <EmailVerification />,
+  component: () => <EmailVerificationPage />,
 });
 
 export const UnsubscribedRoute = createRoute({
@@ -97,16 +97,16 @@ export const UnsubscribedRoute = createRoute({
   staticData: { isAuth: false },
   head: () => ({ meta: [{ title: appTitle('Unsubscribed') }] }),
   getParentRoute: () => AuthLayoutRoute,
-  component: () => <Unsubscribed />,
+  component: () => <UnsubscribedPage />,
 });
 
 export const AuthErrorRoute = createRoute({
   path: '/auth/error',
-  validateSearch: z.object({ provider: z.string().optional() }),
+  validateSearch: authErrorRouteSearch,
   staticData: { isAuth: false },
   head: () => ({ meta: [{ title: appTitle('Authentication error') }] }),
   getParentRoute: () => AuthLayoutRoute,
-  component: () => <AuthError />,
+  component: () => <AuthErrorPage />,
 });
 
 export const SignOutRoute = createRoute({
diff --git a/locales/en/backend.json b/locales/en/backend.json
index 54d059ba4..986591ddf 100644
--- a/locales/en/backend.json
+++ b/locales/en/backend.json
@@ -4,7 +4,7 @@
   "email.create_password.ignore": "Ignore this email if you don't want to change your password or didn't request it.",
   "email.create_password.preview": "Reset your {{appName}} password",
   "email.create_password.subject": "Reset password",
-  "email.create_password.text": "A password reset link has been requested for your <strong>{{appName}}</strong> account.",
+  "email.create_password.text": "A password reset link has been requested for your {{appName}} account.",
   "email.email_verification.preview": "Complete {{appName}} sign up",
   "email.email_verification.title": "Verify your email for {{appName}}",
   "email.email_verification.subject": "Verify email",
@@ -17,7 +17,7 @@
   "email.invite_expires": "This link will expire in 7 days.",
   "email.member_invite.preview": "Invited to {{entityName}} on {{appName}}",
   "email.member_invite.subject": "Invitation to {{entityName}}",
-  "email.member_invite.text": "{{senderName}} has invited you to join <strong>{{entityName}}</strong> on <strong>{{appName}}</strong> as a <strong>{{role}}</strong>",
+  "email.member_invite.text": "{{senderName}} has invited you to join {{entityName}} on {{appName}} as a {{role}}.",
   "email.member_invite.title": "You have been invited to join <strong>{{entityName}}</strong>",
   "email.newsletter.title": "You received a newsletter as a member of {{orgName}}",
   "email.support_email": "Contact support",
diff --git a/locales/en/common.json b/locales/en/common.json
index c796f3cd7..2de43a727 100644
--- a/locales/en/common.json
+++ b/locales/en/common.json
@@ -308,7 +308,7 @@
   "requests": "Requests",
   "requests.text": "Requests per minute",
   "resend": "Resend",
-  "resend_invitation.text": "Send a duplicate invitation with a new expiration date.",
+  "resend_invitation.text": "Receive a new invitation by email with a new expiration date.",
   "reset": "Reset",
   "reset_password.text": "Enter your email to receive a link to renew your password.",
   "reset_resource": "Reset {{resource}}",
diff --git a/locales/en/errors.json b/locales/en/errors.json
index 70bc38d54..dc94d5a1d 100644
--- a/locales/en/errors.json
+++ b/locales/en/errors.json
@@ -2,6 +2,11 @@
   "bad_request_action": "Bad request: Server could not process the request",
   "body_too_large": "Request body too large",
   "body_too_large.text": "The request body is too large. Please try again later or contact support.",
+  "confirm-mfa_expired": "Verification step expired",
+  "confirm-mfa_expired.text": "Your verification token has expired or is invalid. Please sign in again to continue.",
+  "confirm-mfa_not_found": "Verification failed",
+  "confirm-mfa_not_found.text": "We couldn't complete the second verification process. Please sign in again to continue.",
+  "connect_user_not_found": "Failed to connect account, user data missing.",
   "contact_mistake": "If you believe this to be a mistake, please contact support.",
   "create_resource": "{{resource}} could not be created",
   "delete_resource": "{{resource}} could not be deleted",
@@ -9,17 +14,14 @@
   "delete_resource_forbidden.text": "You do not have enough permission to delete this {{resourceLowerCase}}.",
   "delete_resources": "{{resources}} could not be deleted",
   "duplicate_creation": "Item already exist",
-  "email_exists": "Email already exists",
   "email_already_verified": "Email already verified",
+  "email_exists": "Email already exists",
   "email-verification_expired": "Email verification token expired",
-  "email-verification_expired.text": "Use forgot password to verify.",
-  "oauth-verification_expired": "OAuth verification token expired",
-  "oauth-verification_expired.text": "Go to sign in to restart the authentication process.",
+  "email-verification_expired.text": "Go to sign in and click forgot password to restart verification.",
   "email-verification_not_found": "Can't verify email",
   "email-verification_not_found.text": "Go to sign in to restart the authentication process.",
-  "oauth-verification_not_found": "Can't verify",
-  "oauth-verification_not_found.text": "Go to sign in to restart the authentication process.",
   "error": "Error",
+  "error.local_file_not_found": "File not found. This file was stored locally on a specific browser and therefore is not accessible by other browsers or devices.",
   "error.text": "Unknown error.",
   "expired_token": "Token has expired",
   "expired_token.text": "You provided an expired token.",
@@ -32,18 +34,18 @@
   "form.disabled": "Feld is disabled",
   "form.invalid_arguments": "Invalid arguments",
   "form.invalid_date": "Invalid date",
+  "form.invalid_element": "One or more elements in the array are invalid.",
   "form.invalid_enum_value": "Invalid value, expected one of the allowed options",
   "form.invalid_format": "Format of the input is invalid.",
-  "form.invalid_key": "Provided key is not allowed.",
-  "form.invalid_element": "One or more elements in the array are invalid.",
-  "form.invalid_value": "Provided value is not acceptable.",
   "form.invalid_intersection_types": "Value does not match all required types",
+  "form.invalid_key": "Provided key is not allowed.",
   "form.invalid_literal": "Value does not match the expected literal",
   "form.invalid_return_type": "Invalid return type",
   "form.invalid_string": "Invalid string format",
   "form.invalid_type": "Invalid type",
   "form.invalid_union": "Value does not match any of the expected types",
   "form.invalid_union_discriminator": "Invalid discriminator value for union",
+  "form.invalid_value": "Provided value is not acceptable.",
   "form.max": "Value is too big",
   "form.maxLength": "Too long",
   "form.min": "Value is too small",
@@ -61,11 +63,21 @@
   "form.valueAsNumber": "Must be a valid number",
   "image_upload_failed": "Image upload failed. Try again later",
   "impersonation_failed": "Impersonation failed",
+  "insecure_request": "Insecure request",
+  "insecure_request.text": "To protect your data, we can't process this request.",
+  "invalid_between_num": "{{name}} must be between {{min}} and {{max}} characters",
+  "invalid_cdn_url": "URL must start with the configured CDN URL",
   "invalid_credentials": "Invalid credentials",
   "invalid_credentials.text": "The credentials used for authentication are invalid.",
+  "invalid_domain": "Domain must not contain @, no special chars and at least one dot (.) in between.",
   "invalid_email": "Invalid email address",
   "invalid_email_or_password": "Invalid email or password",
   "invalid_invitation": "Invitation could not be processed",
+  "invalid_limit": "Limit must be a number, that  greater than 0 and less than or equal to {{max}}",
+  "invalid_max_items": "The number of {{name}} cannot exceed {{max}}.",
+  "invalid_min_items": "Please add at least {{min}} {{name}} to the list.",
+  "invalid_name": "Name may only contain letters, numbers, spaces and these characters: ,.'-",
+  "invalid_offset": "Offset must be number, that greater or equal to 0",
   "invalid_origin": "Invalid origin",
   "invalid_param": "Invalid parameters",
   "invalid_param.text": "If you copied a URL, please check if it is correct and complete.",
@@ -76,31 +88,31 @@
   "invalid_role.text": "Your permissions are insufficient or invalid.",
   "invalid_session": "Not authenticated",
   "invalid_session.text": "Your session has expired or is invalid. Please sign in again.",
+  "invalid_slug": "Slug may only contain alphanumeric characters or up to three hyphens, and cannot begin or end with a hyphen.",
   "invalid_state": "Invalid state",
-  "insecure_request": "Insecure request",
-  "insecure_request.text": "To protect your data, we can't process this request.",
   "invalid_state.text": "Could not complete the authentication process.",
   "invalid_token": "Invalid token",
-  "invitation_expired": "Invitation has expired",
-  "invitation_expired.text": "The token you provided has expired. Please use reply-to in the invitation email to request a new one.",
+  "invalid_url": "URL must start with https://",
+  "invitation_expired": "Invitation token has expired",
+  "invitation_expired.text": "The link can only be used once and it has expired. Resend a new link per email using the button below.",
+  "invitation_not_for_you": "The user currently signed in doesn't match with the invitation. Please sign out and click the link in your email again or contact support.",
   "invitation_not_found": "Invitation not found",
   "invitation_not_found.text": "The token is used or doesn't exist. Please sign in directly or use reply-to in the invitation email to request a new one.",
-  "invalid_limit": "Limit must be a number, that  greater than 0 and less than or equal to {{max}}",
-  "invalid_offset": "Offset must be number, that greater or equal to 0",
-  "invalid_domain": "Domain must not contain @, no special chars and at least one dot (.) in between.",
-  "invalid_min_items": "Please add at least {{min}} {{name}} to the list.",
-  "invalid_max_items": "The number of {{name}} cannot exceed {{max}}.",
-  "invalid_between_num": "{{name}} must be between {{min}} and {{max}} characters",
-  "invalid_name": "Name may only contain letters, numbers, spaces and these characters: ,.'-",
-  "invalid_slug": "Slug may only contain alphanumeric characters or up to three hyphens, and cannot begin or end with a hyphen.",
-  "invalid_url": "URL must start with https://",
-  "invalid_cdn_url": "URL must start with the configured CDN URL",
+  "invite_takes_priority": "Invitation pending",
+  "invite_takes_priority.text": "You should already have an invitation in your email inbox. Please use the link in the email to proceed. Can't find it? Click 'Resend' to receive a new invitation link.",
   "load_more_failed": "Could not load more data. Try reloading or come back later.",
   "maybe_bot": "Suspicious activity.",
-  "invitation_not_for_you": "The user currently signed in doesn't match with the invitation. Please sign out and click the link in your email again or contact support.",
   "maybe_bot.text": "We have detected unusual activity. Please try again later or contact support.",
-  "missing_auth_key": "Missing authentication key",
-  "missing_auth_key.text": "An authentication key is missing. Please contact support.",
+  "membership_already_active": "Membership active",
+  "membership_already_active.text": "This membership has already been activated.",
+  "membership_not_found": "Membership not found",
+  "membership_not_found.text": "The membership you are trying to access does not exist or has been deleted.",
+  "membership_without_token": "Membership cannot be activated",
+  "membership_without_token.text": "This membership cannot be activated because it lacks a valid token.",
+  "mfa_disable_verification": "To disable MFA, you need either an active MFA session less than 1 hour old, or verification through a passkey or authenticator app.",
+  "mfa_schema_requirement": "Email is required for login and must be omitted for MFA",
+  "auth_key_not_found": "Missing authentication key",
+  "auth_key_not_found.text": "An authentication key is missing. Please contact support.",
   "name_required": "Name is required",
   "network_error": "Network error. Please check your network connection or try again later.",
   "newsletter_sign_up": "Unable to submit your email address. Please try again later.",
@@ -117,38 +129,33 @@
   "no_user_found": "No user found",
   "not_found": "Not found",
   "not_found.text": "This resource does not exist or has been deleted.",
-  "token_not_found": "Token is invalid.",
-  "connect_user_not_found": "Failed to connect account, user data missing.",
-  "verification_not_found": "Failed to verify email, token missing or invalid.",
+  "oauth_conflict": "OAuth conflict",
+  "oauth_conflict.text": "There is a conflict with the OAuth account you tried to connect.",
+  "oauth_email_exists": "Not allowed to connect.",
+  "oauth_email_exists.text": "The email of the account you tried to connect, already belongs to an existing user. If that's you, please sign first and go to settings to connect this account.",
   "oauth_failed": "OAuth failed",
   "oauth_failed.text": "OAuth authentication failed. Please try again or use another method.",
-  "oauth_wrong_email": "Email doesn't match",
-  "oauth_wrong_email.text": "It's not possible to link accounts with different emails while accepting an invitation. Please use another authentication method.",
   "oauth_taken": "Not allowed to connect.",
-  "membership_not_found": "Membership not found",
-  "membership_not_found.text": "The membership you are trying to access does not exist or has been deleted.",
-  "membership_without_token": "Membership cannot be activated",
-  "membership_without_token.text": "This membership cannot be activated because it lacks a valid token.",
-  "membership_already_active": "Membership active",
-  "membership_already_active.text": "This membership has already been activated.",
   "oauth_taken.text": "The account you tried to connect is already linked to a different user.",
-  "oauth_email_exists": "Not allowed to connect.",
-  "oauth_email_exists.text": "The email of the account you tried to connect, already belongs to an existing user. If that's you, please sign first and go to settings to connect this account.",
-  "oauth_conflict": "OAuth conflict",
-  "oauth_conflict.text": "There is a conflict with the OAuth account you tried to connect.",
+  "oauth_wrong_email": "Email doesn't match",
+  "oauth_wrong_email.text": "It's not possible to link accounts with different emails while accepting an invitation. Please use another authentication method.",
+  "oauth-verification_expired": "OAuth verification token expired",
+  "oauth-verification_expired.text": "Go to sign in to restart the authentication process.",
+  "oauth-verification_not_found": "Can't verify",
+  "oauth-verification_not_found.text": "Go to sign in to restart the authentication process.",
+  "organization_mismatch": "This item is linked to a different organization than the one you're currently using. Please switch to the appropriate organization or ask your administrator for access.",
   "organization_missing": "Organization missing",
   "organization_missing.text": "Organization slug or id is required to perform this action.",
   "page_not_found": "Page not found",
   "page_not_found.text": "This page didn't exist or has been deleted.",
-  "passkey_registration_failed": "Passkey registration failed. Try again later.",
-  "single_use_token_invalid": "Short-lived session invalid",
   "passkey_not_found": "Passkey not recognized",
   "passkey_not_found.text": "We couldn`t verify this passkey. It may not belong to your account or has been removed.",
+  "passkey_registration_failed": "Passkey registration failed. Try again later.",
+  "passkey_unlink_failed": "Unlinking passkey failed. Try again later.",
   "passkey_verification_failed": "Passkey verification failed",
   "passkey_verification_failed.text": "Passkey verification failed. Please try again or use another method.",
-  "passkey_unlink_failed": "Unlinking passkey failed. Try again later.",
   "password-reset_expired": "Password reset token has expired",
-  "password-reset_expired.text": "The token you provided has expired. Use forgot password to request a new one.",
+  "password-reset_expired.text": "The token you provided has expired. Go to sign in and click forgot password to request a new one.",
   "password-reset_not_found": "Can't reset password",
   "password-reset_not_found.text": "The token is used or doesn't exist. Use forgot password to request a new one.",
   "reorder_resource": "{{resource}} reorder failed.",
@@ -168,15 +175,24 @@
   "route_not_found.text": "The server could not find the requested route.",
   "server_error": "Server error",
   "server_error.text": "Your request could not be completed.",
+  "session_expired": "Session Expired",
+  "session_expired.text": "Your authentication session has expired. Please log in again to continue.",
   "sign_up_restricted": "Invite only",
   "sign_up_restricted.text": "We are currently invite-only. Can't wait? Contact us for an invite.",
+  "single_use_token_invalid": "Short-lived session invalid",
   "slug_exists": "Slug already exists",
   "sync_failed": "Sync failed",
   "sync_failed.text": "Connecting with sync service failed. Please try again later.",
   "system_access_forbidden": "System access forbidden",
   "system_access_forbidden.text": "Access denied: signing in as system admin from this IP is not permitted.",
+  "token_not_found": "Token not found",
+  "token_not_found.text": "Token could not be found. It has been used, replaced or has otherwise become invalid.",
   "too_many_requests": "Too many requests. Please try again later.",
   "too_many_requests.text": "To safeguard user data, we prevent suspicious activity by momentarily restricting requests. Please come back later or contact support.",
+  "totp_remove_failed": "TOTP unlink failed. Try again later.",
+  "totp_setup_failed": "TOTP setup failed. Try again later.",
+  "totp_verification_failed": "TOTP verification failed",
+  "totp_verification_failed.text": "TOTP verification failed. Please try again or use another method.",
   "try_again_later": "Error has been reported. Please try again later or contact support.",
   "unable_to_verify": "Unable to verify",
   "unauthorized": "Unauthorized",
@@ -188,22 +204,6 @@
   "unsupported_oauth.text": "This authentication provider is currently not supported. Please use another authentication method.",
   "update_resource": "{{resource}} could not be updated. Try again later.",
   "user_mismatch": "User mismatch",
-  "user_mismatch.text": "The user you are trying to access is not the same as the one authenticated.",
-  "invite_takes_priority": "Invitation pending",
-  "invite_takes_priority.text": "You should already have an invitation in your email inbox. Please use the link in the email to proceed. Can't find it? Click 'Resend' to receive a new invitation link.",
-  "missing_membership": "You don`t have access yet. Ask an admin to invite you so you can get started.",
-  "organization_mismatch": "This item is linked to a different organization than the one you're currently using. Please switch to the appropriate organization or ask your administrator for access.",
-  "session_expired": "Session Expired",
-  "session_expired.text": "Your authentication session has expired. Please log in again to continue.",
-  "confirm-mfa_not_found": "Verification failed",
-  "confirm-mfa_not_found.text": "We couldn't complete the second verification process. Please sign in again to continue.",
-  "confirm-mfa_expired": "Verification step expired",
-  "confirm-mfa_expired.text": "Your verification token has expired or is invalid. Please sign in again to continue.",
-  "totp_verification_failed": "TOTP verification failed",
-  "totp_verification_failed.text": "TOTP verification failed. Please try again or use another method.",
-  "totp_setup_failed": "TOTP setup failed. Try again later.",
-  "totp_remove_failed": "TOTP unlink failed. Try again later.",
-  "mfa_schema_requirement": "Email is required for login and must be omitted for MFA",
-  "mfa_disable_verification": "To disable MFA, you need either an active MFA session less than 1 hour old, or verification through a passkey or authenticator app.",
-  "error.local_file_not_found": "File not found. This file was stored locally on a specific browser and therefore is not accessible by other browsers or devices."
-}
+  "user_mismatch.text": "You are already signed in as a user. And this user doesn't match with the link you used.",
+  "verification_not_found": "Failed to verify email, token missing or invalid."
+}
\ No newline at end of file
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 0d440ec86..7223d34d4 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -26,7 +26,7 @@ importers:
         version: 10.1.0
       knip:
         specifier: ^5.64.1
-        version: 5.64.1(@types/node@24.6.1)(typescript@5.9.3)
+        version: 5.64.1(@types/node@24.6.2)(typescript@5.9.3)
       rimraf:
         specifier: ^6.0.1
         version: 6.0.1
@@ -38,7 +38,7 @@ importers:
         version: 5.9.3
       vitest:
         specifier: ^3.2.4
-        version: 3.2.4(@types/debug@4.1.12)(@types/node@24.6.1)(@vitest/browser@3.2.4)(jiti@2.6.1)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+        version: 3.2.4(@types/debug@4.1.12)(@types/node@24.6.2)(@vitest/browser@3.2.4)(jiti@2.6.1)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
 
   backend:
     dependencies:
@@ -167,7 +167,7 @@ importers:
         version: 9.0.2
       jsx-email:
         specifier: ^2.7.3
-        version: 2.7.3(@emotion/is-prop-valid@1.3.1)(@jsx-email/plugin-inline@1.0.1)(@jsx-email/plugin-minify@1.0.1)(@jsx-email/plugin-pretty@1.0.0)(@types/node@24.5.2)(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(lightningcss@1.30.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(terser@5.44.0)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2))(typescript@5.9.2)
+        version: 2.7.3(@emotion/is-prop-valid@1.3.1)(@jsx-email/plugin-inline@1.0.1)(@jsx-email/plugin-minify@1.0.1)(@jsx-email/plugin-pretty@1.0.0)(@types/node@24.5.2)(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(lightningcss@1.30.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(terser@5.44.0)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2))(typescript@5.9.2)
       locales:
         specifier: workspace:*
         version: link:../locales
@@ -358,28 +358,28 @@ importers:
         version: 0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)
       '@blocknote/react':
         specifier: 0.33.0
-        version: 0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@blocknote/shadcn':
         specifier: 0.33.0
-        version: 0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(highlight.js@11.11.1)(lowlight@3.3.0)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.6.1)(typescript@5.9.3))
+        version: 0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(highlight.js@11.11.1)(lowlight@3.3.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(tsx@4.20.6)(yaml@2.8.1)
       '@electric-sql/client':
         specifier: 1.0.10
         version: 1.0.10
       '@electric-sql/react':
         specifier: 1.0.10
-        version: 1.0.10(react@19.1.1)
+        version: 1.0.10(react@19.2.0)
       '@floating-ui/dom':
         specifier: ^1.7.4
         version: 1.7.4
       '@floating-ui/react':
         specifier: ^0.27.16
-        version: 0.27.16(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 0.27.16(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@github/mini-throttle':
         specifier: ^2.1.1
         version: 2.1.1
       '@hookform/resolvers':
         specifier: ^5.2.2
-        version: 5.2.2(react-hook-form@7.63.0(react@19.1.1))
+        version: 5.2.2(react-hook-form@7.63.0(react@19.2.0))
       '@oslojs/encoding':
         specifier: ^1.1.0
         version: 1.1.0
@@ -388,106 +388,106 @@ importers:
         version: 1.4.2
       '@radix-ui/react-accordion':
         specifier: ^1.2.12
-        version: 1.2.12(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.2.12(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@radix-ui/react-alert-dialog':
         specifier: ^1.1.15
-        version: 1.1.15(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.15(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@radix-ui/react-avatar':
         specifier: ^1.1.10
-        version: 1.1.10(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.10(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@radix-ui/react-checkbox':
         specifier: ^1.3.3
-        version: 1.3.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.3.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@radix-ui/react-collapsible':
         specifier: ^1.1.12
-        version: 1.1.12(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.12(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@radix-ui/react-context-menu':
         specifier: ^2.2.16
-        version: 2.2.16(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 2.2.16(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@radix-ui/react-dialog':
         specifier: ^1.1.15
-        version: 1.1.15(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.15(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@radix-ui/react-dropdown-menu':
         specifier: ^2.1.16
-        version: 2.1.16(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 2.1.16(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@radix-ui/react-hover-card':
         specifier: ^1.1.15
-        version: 1.1.15(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.15(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@radix-ui/react-label':
         specifier: ^2.1.7
-        version: 2.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 2.1.7(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@radix-ui/react-popover':
         specifier: ^1.1.15
-        version: 1.1.15(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.15(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@radix-ui/react-progress':
         specifier: ^1.1.7
-        version: 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.7(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@radix-ui/react-radio-group':
         specifier: ^1.3.8
-        version: 1.3.8(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.3.8(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@radix-ui/react-scroll-area':
         specifier: ^1.2.10
-        version: 1.2.10(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.2.10(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@radix-ui/react-select':
         specifier: ^2.2.6
-        version: 2.2.6(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 2.2.6(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@radix-ui/react-separator':
         specifier: ^1.1.7
-        version: 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.7(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@radix-ui/react-slider':
         specifier: ^1.3.6
-        version: 1.3.6(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.3.6(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@radix-ui/react-slot':
         specifier: ^1.2.3
-        version: 1.2.3(@types/react@19.1.16)(react@19.1.1)
+        version: 1.2.3(@types/react@19.2.0)(react@19.2.0)
       '@radix-ui/react-switch':
         specifier: ^1.2.6
-        version: 1.2.6(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.2.6(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@radix-ui/react-tabs':
         specifier: ^1.1.13
-        version: 1.1.13(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.13(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@radix-ui/react-toast':
         specifier: ^1.2.15
-        version: 1.2.15(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.2.15(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@radix-ui/react-toggle':
         specifier: ^1.1.10
-        version: 1.1.10(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.10(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@radix-ui/react-toggle-group':
         specifier: ^1.1.11
-        version: 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.11(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@radix-ui/react-tooltip':
         specifier: ^1.2.8
-        version: 1.2.8(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.2.8(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@radix-ui/react-visually-hidden':
         specifier: ^1.2.3
-        version: 1.2.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.2.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@sentry/react':
         specifier: ^9.46.0
-        version: 9.46.0(react@19.1.1)
+        version: 9.46.0(react@19.2.0)
       '@t3-oss/env-core':
         specifier: ^0.13.8
         version: 0.13.8(arktype@2.1.20)(typescript@5.9.3)(zod@4.1.8)
       '@tailwindcss/typography':
         specifier: ^0.5.19
-        version: 0.5.19(tailwindcss@4.1.13)
+        version: 0.5.19(tailwindcss@4.1.14)
       '@tanstack/query-sync-storage-persister':
         specifier: 5.87.4
         version: 5.87.4
       '@tanstack/react-query':
         specifier: 5.87.4
-        version: 5.87.4(react@19.1.1)
+        version: 5.87.4(react@19.2.0)
       '@tanstack/react-query-devtools':
         specifier: 5.87.4
-        version: 5.87.4(@tanstack/react-query@5.87.4(react@19.1.1))(react@19.1.1)
+        version: 5.87.4(@tanstack/react-query@5.87.4(react@19.2.0))(react@19.2.0)
       '@tanstack/react-query-persist-client':
         specifier: 5.87.4
-        version: 5.87.4(@tanstack/react-query@5.87.4(react@19.1.1))(react@19.1.1)
+        version: 5.87.4(@tanstack/react-query@5.87.4(react@19.2.0))(react@19.2.0)
       '@tanstack/react-router':
-        specifier: 1.132.6
-        version: 1.132.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        specifier: 1.132.31
+        version: 1.132.31(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@tanstack/react-router-devtools':
-        specifier: 1.132.6
-        version: 1.132.6(@tanstack/react-router@1.132.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(@tanstack/router-core@1.132.27)(@types/node@24.6.1)(csstype@3.1.3)(jiti@2.6.1)(lightningcss@1.30.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.6)(yaml@2.8.1)
+        specifier: 1.132.31
+        version: 1.132.31(@tanstack/react-router@1.132.31(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(@tanstack/router-core@1.132.31)(@types/node@24.6.2)(csstype@3.1.3)(jiti@1.21.7)(lightningcss@1.30.1)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.6)(yaml@2.8.1)
       '@uppy/audio':
         specifier: ^3.0.1
         version: 3.0.1(@uppy/core@5.0.2)
@@ -514,7 +514,7 @@ importers:
         version: 5.0.2(@uppy/core@5.0.2)
       '@uppy/react':
         specifier: ^5.1.0
-        version: 5.1.0(@uppy/core@5.0.2)(@uppy/dashboard@5.0.2(@uppy/core@5.0.2))(@uppy/screen-capture@5.0.1(@uppy/core@5.0.2))(@uppy/status-bar@5.0.1(@uppy/core@5.0.2))(@uppy/webcam@5.0.1(@uppy/core@5.0.2))(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 5.1.0(@uppy/core@5.0.2)(@uppy/dashboard@5.0.2(@uppy/core@5.0.2))(@uppy/screen-capture@5.0.1(@uppy/core@5.0.2))(@uppy/status-bar@5.0.1(@uppy/core@5.0.2))(@uppy/webcam@5.0.1(@uppy/core@5.0.2))(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@uppy/remote-sources':
         specifier: ^3.0.1
         version: 3.0.1(@uppy/core@5.0.2)
@@ -538,7 +538,7 @@ importers:
         version: 5.0.1(@uppy/core@5.0.2)
       '@vis.gl/react-google-maps':
         specifier: ^1.5.5
-        version: 1.5.5(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.5.5(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       canvas-confetti:
         specifier: ^1.9.3
         version: 1.9.3
@@ -550,7 +550,7 @@ importers:
         version: 2.1.1
       cmdk:
         specifier: ^1.1.1
-        version: 1.1.1(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.1(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       concurrently:
         specifier: ^9.2.1
         version: 9.2.1
@@ -565,13 +565,13 @@ importers:
         version: 8.6.0(embla-carousel@8.6.0)
       embla-carousel-react:
         specifier: ^8.6.0
-        version: 8.6.0(react@19.1.1)
+        version: 8.6.0(react@19.2.0)
       gleap:
         specifier: ^14.8.11
         version: 14.8.11
       i18next:
-        specifier: ^25.5.2
-        version: 25.5.2(typescript@5.9.3)
+        specifier: ^25.5.3
+        version: 25.5.3(typescript@5.9.3)
       i18next-browser-languagedetector:
         specifier: ^8.2.0
         version: 8.2.0
@@ -589,7 +589,7 @@ importers:
         version: 10.1.3
       input-otp:
         specifier: ^1.4.2
-        version: 1.4.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.4.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       jspdf:
         specifier: ^3.0.3
         version: 3.0.3
@@ -601,10 +601,10 @@ importers:
         version: link:../locales
       lucide-react:
         specifier: ^0.542.0
-        version: 0.542.0(react@19.1.1)
+        version: 0.542.0(react@19.2.0)
       motion:
         specifier: ^12.23.22
-        version: 12.23.22(@emotion/is-prop-valid@1.3.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 12.23.22(@emotion/is-prop-valid@1.3.1)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       nanoid:
         specifier: ^5.1.6
         version: 5.1.6
@@ -613,76 +613,76 @@ importers:
         version: 4.8.69
       player.style:
         specifier: ^0.2.0
-        version: 0.2.0(react@19.1.1)
+        version: 0.2.0(react@19.2.0)
       qrcode.react:
         specifier: ^4.2.0
-        version: 4.2.0(react@19.1.1)
+        version: 4.2.0(react@19.2.0)
       react:
-        specifier: ^19.1.1
-        version: 19.1.1
+        specifier: ^19.2.0
+        version: 19.2.0
       react-data-grid:
         specifier: 7.0.0-beta.57
-        version: 7.0.0-beta.57(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 7.0.0-beta.57(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       react-day-picker:
         specifier: ^9.11.0
-        version: 9.11.0(react@19.1.1)
+        version: 9.11.0(react@19.2.0)
       react-dom:
-        specifier: ^19.1.1
-        version: 19.1.1(react@19.1.1)
+        specifier: ^19.2.0
+        version: 19.2.0(react@19.2.0)
       react-error-boundary:
         specifier: ^6.0.0
-        version: 6.0.0(react@19.1.1)
+        version: 6.0.0(react@19.2.0)
       react-hook-form:
         specifier: ^7.63.0
-        version: 7.63.0(react@19.1.1)
+        version: 7.63.0(react@19.2.0)
       react-i18next:
         specifier: ^15.7.4
-        version: 15.7.4(i18next@25.5.2(typescript@5.9.3))(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(typescript@5.9.3)
+        version: 15.7.4(i18next@25.5.3(typescript@5.9.3))(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(typescript@5.9.3)
       react-intersection-observer:
         specifier: ^9.16.0
-        version: 9.16.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 9.16.0(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       react-lazy-with-preload:
         specifier: ^2.2.1
         version: 2.2.1
       react-pdf:
         specifier: ^9.2.1
-        version: 9.2.1(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 9.2.1(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       react-resizable-panels:
         specifier: ^3.0.6
-        version: 3.0.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 3.0.6(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       react-use-downloader:
         specifier: ^1.3.0
-        version: 1.3.0(react@19.1.1)
+        version: 1.3.0(react@19.2.0)
       recharts:
         specifier: ^3.2.1
-        version: 3.2.1(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react-is@18.3.1)(react@19.1.1)(redux@5.0.1)
+        version: 3.2.1(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react-is@18.3.1)(react@19.2.0)(redux@5.0.1)
       slugify:
         specifier: 1.6.6
         version: 1.6.6
       sonner:
         specifier: ^2.0.7
-        version: 2.0.7(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 2.0.7(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       tailwind-merge:
         specifier: ^3.3.1
         version: 3.3.1
       tailwindcss:
-        specifier: ^4.1.13
-        version: 4.1.13
+        specifier: ^4.1.14
+        version: 4.1.14
       tailwindcss-animate:
         specifier: ^1.0.7
-        version: 1.0.7(tailwindcss@4.1.13)
+        version: 1.0.7(tailwindcss@4.1.14)
       use-count-up:
         specifier: ^3.0.1
-        version: 3.0.1(react@19.1.1)
+        version: 3.0.1(react@19.2.0)
       vaul:
         specifier: ^1.1.2
-        version: 1.1.2(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.2(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       virtua:
         specifier: ^0.43.6
-        version: 0.43.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(solid-js@1.9.9)(vue@3.5.13(typescript@5.9.3))
+        version: 0.43.6(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(solid-js@1.9.9)(vue@3.5.13(typescript@5.9.3))
       vitest:
         specifier: ^3.2.4
-        version: 3.2.4(@types/debug@4.1.12)(@types/node@24.6.1)(@vitest/browser@3.2.4)(jiti@2.6.1)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+        version: 3.2.4(@types/debug@4.1.12)(@types/node@24.6.2)(@vitest/browser@3.2.4)(jiti@1.21.7)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
       workbox-window:
         specifier: ^7.3.0
         version: 7.3.0
@@ -691,20 +691,20 @@ importers:
         version: 4.1.8
       zustand:
         specifier: ^5.0.8
-        version: 5.0.8(@types/react@19.1.16)(immer@10.1.3)(react@19.1.1)(use-sync-external-store@1.5.0(react@19.1.1))
+        version: 5.0.8(@types/react@19.2.0)(immer@10.1.3)(react@19.2.0)(use-sync-external-store@1.6.0(react@19.2.0))
       zxcvbn:
         specifier: ^4.4.2
         version: 4.4.2
     devDependencies:
       '@chromatic-com/storybook':
         specifier: ^4.1.1
-        version: 4.1.1(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
+        version: 4.1.1(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
       '@hey-api/openapi-ts':
         specifier: ^0.84.4
         version: 0.84.4(magicast@0.3.5)(typescript@5.9.3)
       '@react-scan/vite-plugin-react-scan':
         specifier: ^0.1.8
-        version: 0.1.8(react-scan@0.4.3(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react-router-dom@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react-router@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react@19.1.1)(rollup@2.79.2))(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+        version: 0.1.8(react-scan@0.4.3(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react-router-dom@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react-router@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react@19.2.0)(rollup@2.79.2))(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@rollup/plugin-terser':
         specifier: ^0.4.4
         version: 0.4.4(rollup@2.79.2)
@@ -713,37 +713,37 @@ importers:
         version: 3.6.1
       '@storybook/addon-a11y':
         specifier: ^9.1.10
-        version: 9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
+        version: 9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
       '@storybook/addon-docs':
         specifier: ^9.1.10
-        version: 9.1.10(@types/react@19.1.16)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
+        version: 9.1.10(@types/react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
       '@storybook/addon-vitest':
         specifier: ^9.1.10
-        version: 9.1.10(@vitest/browser@3.2.4)(@vitest/runner@3.2.4)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(vitest@3.2.4)
+        version: 9.1.10(@vitest/browser@3.2.4)(@vitest/runner@3.2.4)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(vitest@3.2.4)
       '@storybook/react-vite':
         specifier: ^9.1.10
-        version: 9.1.10(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(rollup@2.79.2)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(typescript@5.9.3)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+        version: 9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(rollup@2.79.2)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(typescript@5.9.3)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@tailwindcss/vite':
-        specifier: ^4.1.13
-        version: 4.1.13(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+        specifier: ^4.1.14
+        version: 4.1.14(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@tanstack/router-core':
-        specifier: ^1.132.27
-        version: 1.132.27
+        specifier: ^1.132.31
+        version: 1.132.31
       '@tanstack/router-plugin':
-        specifier: ^1.132.27
-        version: 1.132.27(@tanstack/react-router@1.132.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+        specifier: ^1.132.31
+        version: 1.132.31(@tanstack/react-router@1.132.31(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@types/canvas-confetti':
         specifier: ^1.9.0
         version: 1.9.0
       '@types/node':
-        specifier: ^24.6.1
-        version: 24.6.1
+        specifier: ^24.6.2
+        version: 24.6.2
       '@types/react':
-        specifier: ^19.1.16
-        version: 19.1.16
+        specifier: ^19.2.0
+        version: 19.2.0
       '@types/react-dom':
-        specifier: ^19.1.9
-        version: 19.1.9(@types/react@19.1.16)
+        specifier: ^19.2.0
+        version: 19.2.0(@types/react@19.2.0)
       '@types/zxcvbn':
         specifier: ^4.4.5
         version: 4.4.5
@@ -752,13 +752,13 @@ importers:
         version: 7.0.0-dev.20250910.1
       '@vitejs/plugin-basic-ssl':
         specifier: ^2.1.0
-        version: 2.1.0(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+        version: 2.1.0(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@vitejs/plugin-react':
         specifier: ^5.0.4
-        version: 5.0.4(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+        version: 5.0.4(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@vitest/browser':
         specifier: ^3.2.4
-        version: 3.2.4(playwright@1.55.1)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)
+        version: 3.2.4(playwright@1.55.1)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)
       '@vitest/coverage-v8':
         specifier: ^3.2.4
         version: 3.2.4(@vitest/browser@3.2.4)(vitest@3.2.4)
@@ -779,13 +779,13 @@ importers:
         version: 3.4.7
       react-scan:
         specifier: ^0.4.3
-        version: 0.4.3(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react-router-dom@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react-router@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react@19.1.1)(rollup@2.79.2)
+        version: 0.4.3(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react-router-dom@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react-router@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react@19.2.0)(rollup@2.79.2)
       rollup-plugin-visualizer:
-        specifier: ^6.0.3
-        version: 6.0.3(rollup@2.79.2)
+        specifier: ^6.0.4
+        version: 6.0.4(rollup@2.79.2)
       storybook:
         specifier: ^9.1.10
-        version: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+        version: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       tsx:
         specifier: ^4.20.6
         version: 4.20.6
@@ -793,20 +793,20 @@ importers:
         specifier: ^5.9.3
         version: 5.9.3
       vite:
-        specifier: ^7.1.7
-        version: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+        specifier: ^7.1.8
+        version: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
       vite-plugin-html:
         specifier: ^3.2.2
-        version: 3.2.2(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+        version: 3.2.2(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       vite-plugin-pwa:
         specifier: ^1.0.3
-        version: 1.0.3(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(workbox-build@7.3.0(@types/babel__core@7.20.5))(workbox-window@7.3.0)
+        version: 1.0.3(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(workbox-build@7.3.0(@types/babel__core@7.20.5))(workbox-window@7.3.0)
       vite-plugin-static-copy:
         specifier: ^3.1.3
-        version: 3.1.3(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+        version: 3.1.3(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       vite-tsconfig-paths:
         specifier: ^5.1.4
-        version: 5.1.4(typescript@5.9.3)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+        version: 5.1.4(typescript@5.9.3)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       wait-on:
         specifier: ^8.0.5
         version: 8.0.5
@@ -5655,65 +5655,65 @@ packages:
       zod:
         optional: true
 
-  '@tailwindcss/node@4.1.13':
-    resolution: {integrity: sha512-eq3ouolC1oEFOAvOMOBAmfCIqZBJuvWvvYWh5h5iOYfe1HFC6+GZ6EIL0JdM3/niGRJmnrOc+8gl9/HGUaaptw==}
+  '@tailwindcss/node@4.1.14':
+    resolution: {integrity: sha512-hpz+8vFk3Ic2xssIA3e01R6jkmsAhvkQdXlEbRTk6S10xDAtiQiM3FyvZVGsucefq764euO/b8WUW9ysLdThHw==}
 
-  '@tailwindcss/oxide-android-arm64@4.1.13':
-    resolution: {integrity: sha512-BrpTrVYyejbgGo57yc8ieE+D6VT9GOgnNdmh5Sac6+t0m+v+sKQevpFVpwX3pBrM2qKrQwJ0c5eDbtjouY/+ew==}
+  '@tailwindcss/oxide-android-arm64@4.1.14':
+    resolution: {integrity: sha512-a94ifZrGwMvbdeAxWoSuGcIl6/DOP5cdxagid7xJv6bwFp3oebp7y2ImYsnZBMTwjn5Ev5xESvS3FFYUGgPODQ==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [android]
 
-  '@tailwindcss/oxide-darwin-arm64@4.1.13':
-    resolution: {integrity: sha512-YP+Jksc4U0KHcu76UhRDHq9bx4qtBftp9ShK/7UGfq0wpaP96YVnnjFnj3ZFrUAjc5iECzODl/Ts0AN7ZPOANQ==}
+  '@tailwindcss/oxide-darwin-arm64@4.1.14':
+    resolution: {integrity: sha512-HkFP/CqfSh09xCnrPJA7jud7hij5ahKyWomrC3oiO2U9i0UjP17o9pJbxUN0IJ471GTQQmzwhp0DEcpbp4MZTA==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [darwin]
 
-  '@tailwindcss/oxide-darwin-x64@4.1.13':
-    resolution: {integrity: sha512-aAJ3bbwrn/PQHDxCto9sxwQfT30PzyYJFG0u/BWZGeVXi5Hx6uuUOQEI2Fa43qvmUjTRQNZnGqe9t0Zntexeuw==}
+  '@tailwindcss/oxide-darwin-x64@4.1.14':
+    resolution: {integrity: sha512-eVNaWmCgdLf5iv6Qd3s7JI5SEFBFRtfm6W0mphJYXgvnDEAZ5sZzqmI06bK6xo0IErDHdTA5/t7d4eTfWbWOFw==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [darwin]
 
-  '@tailwindcss/oxide-freebsd-x64@4.1.13':
-    resolution: {integrity: sha512-Wt8KvASHwSXhKE/dJLCCWcTSVmBj3xhVhp/aF3RpAhGeZ3sVo7+NTfgiN8Vey/Fi8prRClDs6/f0KXPDTZE6nQ==}
+  '@tailwindcss/oxide-freebsd-x64@4.1.14':
+    resolution: {integrity: sha512-QWLoRXNikEuqtNb0dhQN6wsSVVjX6dmUFzuuiL09ZeXju25dsei2uIPl71y2Ic6QbNBsB4scwBoFnlBfabHkEw==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [freebsd]
 
-  '@tailwindcss/oxide-linux-arm-gnueabihf@4.1.13':
-    resolution: {integrity: sha512-mbVbcAsW3Gkm2MGwA93eLtWrwajz91aXZCNSkGTx/R5eb6KpKD5q8Ueckkh9YNboU8RH7jiv+ol/I7ZyQ9H7Bw==}
+  '@tailwindcss/oxide-linux-arm-gnueabihf@4.1.14':
+    resolution: {integrity: sha512-VB4gjQni9+F0VCASU+L8zSIyjrLLsy03sjcR3bM0V2g4SNamo0FakZFKyUQ96ZVwGK4CaJsc9zd/obQy74o0Fw==}
     engines: {node: '>= 10'}
     cpu: [arm]
     os: [linux]
 
-  '@tailwindcss/oxide-linux-arm64-gnu@4.1.13':
-    resolution: {integrity: sha512-wdtfkmpXiwej/yoAkrCP2DNzRXCALq9NVLgLELgLim1QpSfhQM5+ZxQQF8fkOiEpuNoKLp4nKZ6RC4kmeFH0HQ==}
+  '@tailwindcss/oxide-linux-arm64-gnu@4.1.14':
+    resolution: {integrity: sha512-qaEy0dIZ6d9vyLnmeg24yzA8XuEAD9WjpM5nIM1sUgQ/Zv7cVkharPDQcmm/t/TvXoKo/0knI3me3AGfdx6w1w==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [linux]
 
-  '@tailwindcss/oxide-linux-arm64-musl@4.1.13':
-    resolution: {integrity: sha512-hZQrmtLdhyqzXHB7mkXfq0IYbxegaqTmfa1p9MBj72WPoDD3oNOh1Lnxf6xZLY9C3OV6qiCYkO1i/LrzEdW2mg==}
+  '@tailwindcss/oxide-linux-arm64-musl@4.1.14':
+    resolution: {integrity: sha512-ISZjT44s59O8xKsPEIesiIydMG/sCXoMBCqsphDm/WcbnuWLxxb+GcvSIIA5NjUw6F8Tex7s5/LM2yDy8RqYBQ==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [linux]
 
-  '@tailwindcss/oxide-linux-x64-gnu@4.1.13':
-    resolution: {integrity: sha512-uaZTYWxSXyMWDJZNY1Ul7XkJTCBRFZ5Fo6wtjrgBKzZLoJNrG+WderJwAjPzuNZOnmdrVg260DKwXCFtJ/hWRQ==}
+  '@tailwindcss/oxide-linux-x64-gnu@4.1.14':
+    resolution: {integrity: sha512-02c6JhLPJj10L2caH4U0zF8Hji4dOeahmuMl23stk0MU1wfd1OraE7rOloidSF8W5JTHkFdVo/O7uRUJJnUAJg==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
 
-  '@tailwindcss/oxide-linux-x64-musl@4.1.13':
-    resolution: {integrity: sha512-oXiPj5mi4Hdn50v5RdnuuIms0PVPI/EG4fxAfFiIKQh5TgQgX7oSuDWntHW7WNIi/yVLAiS+CRGW4RkoGSSgVQ==}
+  '@tailwindcss/oxide-linux-x64-musl@4.1.14':
+    resolution: {integrity: sha512-TNGeLiN1XS66kQhxHG/7wMeQDOoL0S33x9BgmydbrWAb9Qw0KYdd8o1ifx4HOGDWhVmJ+Ul+JQ7lyknQFilO3Q==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
 
-  '@tailwindcss/oxide-wasm32-wasi@4.1.13':
-    resolution: {integrity: sha512-+LC2nNtPovtrDwBc/nqnIKYh/W2+R69FA0hgoeOn64BdCX522u19ryLh3Vf3F8W49XBcMIxSe665kwy21FkhvA==}
+  '@tailwindcss/oxide-wasm32-wasi@4.1.14':
+    resolution: {integrity: sha512-uZYAsaW/jS/IYkd6EWPJKW/NlPNSkWkBlaeVBi/WsFQNP05/bzkebUL8FH1pdsqx4f2fH/bWFcUABOM9nfiJkQ==}
     engines: {node: '>=14.0.0'}
     cpu: [wasm32]
     bundledDependencies:
@@ -5724,20 +5724,20 @@ packages:
       - '@emnapi/wasi-threads'
       - tslib
 
-  '@tailwindcss/oxide-win32-arm64-msvc@4.1.13':
-    resolution: {integrity: sha512-dziTNeQXtoQ2KBXmrjCxsuPk3F3CQ/yb7ZNZNA+UkNTeiTGgfeh+gH5Pi7mRncVgcPD2xgHvkFCh/MhZWSgyQg==}
+  '@tailwindcss/oxide-win32-arm64-msvc@4.1.14':
+    resolution: {integrity: sha512-Az0RnnkcvRqsuoLH2Z4n3JfAef0wElgzHD5Aky/e+0tBUxUhIeIqFBTMNQvmMRSP15fWwmvjBxZ3Q8RhsDnxAA==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [win32]
 
-  '@tailwindcss/oxide-win32-x64-msvc@4.1.13':
-    resolution: {integrity: sha512-3+LKesjXydTkHk5zXX01b5KMzLV1xl2mcktBJkje7rhFUpUlYJy7IMOLqjIRQncLTa1WZZiFY/foAeB5nmaiTw==}
+  '@tailwindcss/oxide-win32-x64-msvc@4.1.14':
+    resolution: {integrity: sha512-ttblVGHgf68kEE4om1n/n44I0yGPkCPbLsqzjvybhpwa6mKKtgFfAzy6btc3HRmuW7nHe0OOrSeNP9sQmmH9XA==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [win32]
 
-  '@tailwindcss/oxide@4.1.13':
-    resolution: {integrity: sha512-CPgsM1IpGRa880sMbYmG1s4xhAy3xEt1QULgTJGQmZUeNgXFR7s1YxYygmJyBGtou4SyEosGAGEeYqY7R53bIA==}
+  '@tailwindcss/oxide@4.1.14':
+    resolution: {integrity: sha512-23yx+VUbBwCg2x5XWdB8+1lkPajzLmALEfMb51zZUBYaYVPDQvBSD/WYDqiVyBIo2BZFa3yw1Rpy3G2Jp+K0dw==}
     engines: {node: '>= 10'}
 
   '@tailwindcss/typography@0.5.19':
@@ -5745,17 +5745,13 @@ packages:
     peerDependencies:
       tailwindcss: '>=3.0.0 || insiders || >=4.0.0-alpha.20 || >=4.0.0-beta.1'
 
-  '@tailwindcss/vite@4.1.13':
-    resolution: {integrity: sha512-0PmqLQ010N58SbMTJ7BVJ4I2xopiQn/5i6nlb4JmxzQf8zcS5+m2Cv6tqh+sfDwtIdjoEnOvwsGQ1hkUi8QEHQ==}
+  '@tailwindcss/vite@4.1.14':
+    resolution: {integrity: sha512-BoFUoU0XqgCUS1UXWhmDJroKKhNXeDzD7/XwabjkDIAbMnc4ULn5e2FuEuBbhZ6ENZoSYzKlzvZ44Yr6EUDUSA==}
     peerDependencies:
       vite: ^5.2.0 || ^6 || ^7
 
-  '@tanstack/history@1.132.0':
-    resolution: {integrity: sha512-GG2R9I6QSlbNR9fEuX2sQCigY6K28w51h2634TWmkaHXlzQw+rWuIWr4nAGM9doA+kWRi1LFSFMvAiG3cOqjXQ==}
-    engines: {node: '>=12'}
-
-  '@tanstack/history@1.132.21':
-    resolution: {integrity: sha512-5ziPz3YarKU5cBJoEJ4muV8cy+5W4oWdJMqW7qosMrK5fb9Qfm+QWX+kO3emKJMu4YOUofVu3toEuuD3x1zXKw==}
+  '@tanstack/history@1.132.31':
+    resolution: {integrity: sha512-UCHM2uS0t/uSszqPEo+SBSSoQVeQ+LlOWAVBl5SA7+AedeAbKafIPjFn8huZCXNLAYb0WKV2+wETr7lDK9uz7g==}
     engines: {node: '>=12'}
 
   '@tanstack/query-core@5.87.4':
@@ -5787,16 +5783,16 @@ packages:
     peerDependencies:
       react: ^18 || ^19
 
-  '@tanstack/react-router-devtools@1.132.6':
-    resolution: {integrity: sha512-NwcStEA5ePPGvuogDONuQX5oDL+Wl3NI7N5HiI9rqcOSY5kF85DfaMrTBADS8r1CCY7NMjRrjULEfgR8Z1CrxA==}
+  '@tanstack/react-router-devtools@1.132.31':
+    resolution: {integrity: sha512-EiO+t6s1K8igqqtxCO0GLG6KoJgaIsv9JAZMcJV+z/BspElGQwGDBzTtWYcHd9NOP2Yw7OCkAhM8ihwMbzWJNQ==}
     engines: {node: '>=12'}
     peerDependencies:
-      '@tanstack/react-router': ^1.132.6
+      '@tanstack/react-router': ^1.132.31
       react: '>=18.0.0 || >=19.0.0'
       react-dom: '>=18.0.0 || >=19.0.0'
 
-  '@tanstack/react-router@1.132.6':
-    resolution: {integrity: sha512-YfRHfEzOS2TtrP0+nQ98aUvqQBg6uNRZPzOT4X35lLOwmXJbK8dTzlZva5KhfT5wrkZfU5N8jSc0COB+ALwkLQ==}
+  '@tanstack/react-router@1.132.31':
+    resolution: {integrity: sha512-bgYgffI9TQhi8Zc/I5DMQEO4WOcDNtSll66Eb3/+k3iuI59ovVB/CiVCGjqdT8+2YBBj2x0saRDjsF00vj5+Yg==}
     engines: {node: '>=12'}
     peerDependencies:
       react: '>=18.0.0 || >=19.0.0'
@@ -5808,19 +5804,15 @@ packages:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
 
-  '@tanstack/router-core@1.132.27':
-    resolution: {integrity: sha512-mNx+nba7mXc7sJdX+kYH4rSW8f7Jx/+0hPOkX4XAnqiq7I1ng3gGqmGuf4+2BYTG2aD+aTSPExUPczy9VNgRfQ==}
-    engines: {node: '>=12'}
-
-  '@tanstack/router-core@1.132.6':
-    resolution: {integrity: sha512-K5DqCnCSaxRw1BN63aZaZCkTKsGTXkAikzlTBSMVeijLE+D5P1Q9+m7xfuhVkr1sa/0yNNeP5VBmw28AZhnoJA==}
+  '@tanstack/router-core@1.132.31':
+    resolution: {integrity: sha512-74W+J5N1NuPcuWDwsBAjCgK4ahtIRaB51KdegYrD1AeSNqiV4u8KzOzHKAAZD01UipQApUbpJbzFrHq0XQ9BHw==}
     engines: {node: '>=12'}
 
-  '@tanstack/router-devtools-core@1.132.6':
-    resolution: {integrity: sha512-j1r97ox6cSMXX6Rh8I+ReFelGoRyrCE030/7auZpxO/hhVfQHcTeIhMwXh9/I54XIEx70SnG6UVEUKuP9AhT8g==}
+  '@tanstack/router-devtools-core@1.132.31':
+    resolution: {integrity: sha512-GwymJRm21hkluQMjOkXn+mBNPMyWlpzQut8mqEObh1cnF3zUsYT5YkCFV8ePA0jb/YVdjK/AfCAgSlhyIa09IA==}
     engines: {node: '>=12'}
     peerDependencies:
-      '@tanstack/router-core': ^1.132.6
+      '@tanstack/router-core': ^1.132.31
       csstype: ^3.0.10
       solid-js: '>=1.9.5'
       tiny-invariant: ^1.3.3
@@ -5828,16 +5820,16 @@ packages:
       csstype:
         optional: true
 
-  '@tanstack/router-generator@1.132.27':
-    resolution: {integrity: sha512-dlW33RGxgG0mBF8vRqUs5CeId6wOf4qY6GmT2Pv6NgCVtrD7wsMSM1BasIRufNIxRT6FVnE7rztMy9wN7oCaKg==}
+  '@tanstack/router-generator@1.132.31':
+    resolution: {integrity: sha512-6Ys47sBR3jxet3CaqnF/ykV44R8HLQoT5ZbDqi6f2At6TXYe/+VELRSApC+cq1yjVJwp6Ot5Hm6mYWewh69bdQ==}
     engines: {node: '>=12'}
 
-  '@tanstack/router-plugin@1.132.27':
-    resolution: {integrity: sha512-0mo+jdgO7L5hOPGyrmKtyy20ZUfX4LwN30IXS7mhsaSHbZub+XLS3Ta6mDxNLmOXAJLPI3Gc90yI8jVwhizv5Q==}
+  '@tanstack/router-plugin@1.132.31':
+    resolution: {integrity: sha512-5/n6VxA6tFLFyewjl1+Av0Qsxmr/WpnAR2UlccS7ZaYli3bvNPJSZd3dy9EphEAXeSbqvFT29nQ/ox8EmGTonQ==}
     engines: {node: '>=12'}
     peerDependencies:
       '@rsbuild/core': '>=1.0.2'
-      '@tanstack/react-router': ^1.132.27
+      '@tanstack/react-router': ^1.132.31
       vite: '>=5.0.0 || >=6.0.0 || >=7.0.0'
       vite-plugin-solid: ^2.11.8
       webpack: '>=5.92.0'
@@ -5853,23 +5845,23 @@ packages:
       webpack:
         optional: true
 
-  '@tanstack/router-utils@1.132.21':
-    resolution: {integrity: sha512-d9MvyhdPaKN78hQOss89bayiv/HR/7FpVHuKTNGEzzYrBWDVIUBd0yMNaBxQBpTg6NuNxtZ01ZJS5VkbedbzJw==}
+  '@tanstack/router-utils@1.132.31':
+    resolution: {integrity: sha512-uf8mQ3wV58K8TL5XXBoWhkYxmCV7LLWbbf6AvcxdhnCnBNmXBGlY+T8RdsRnXyI2Iyp2HfHaVZ+8H3CEQedXfw==}
     engines: {node: '>=12'}
 
   '@tanstack/store@0.7.7':
     resolution: {integrity: sha512-xa6pTan1bcaqYDS9BDpSiS63qa6EoDkPN9RsRaxHuDdVDNntzq3xNwR5YKTU/V3SkSyC9T4YVOPh2zRQN0nhIQ==}
 
-  '@tanstack/virtual-file-routes@1.132.21':
-    resolution: {integrity: sha512-+eT+vxZnf2/QPr9ci5aPn7i3MnVyWYNG2DUqiKJXGi7EvuFrXV9r8zDK40QfUTNGdCg9F880YOVe3cTwMCO0zw==}
+  '@tanstack/virtual-file-routes@1.132.31':
+    resolution: {integrity: sha512-rxS8Cm2nIXroLqkm9pE/8X2lFNuvcTIIiFi5VH4PwzvKscAuaW3YRMN1WmaGDI2mVEn+GLaoY6Kc3jOczL5i4w==}
     engines: {node: '>=12'}
 
   '@testing-library/dom@10.4.1':
     resolution: {integrity: sha512-o4PXJQidqJl82ckFaXUeoAW+XysPLauYI43Abki5hABd853iMhitooc6znOnczgbTYmEP6U6/y1ZyKAIsvMKGg==}
     engines: {node: '>=18'}
 
-  '@testing-library/jest-dom@6.9.0':
-    resolution: {integrity: sha512-QHdxYMJ0YPGKYofMc6zYvo7LOViVhdc6nPg/OtM2cf9MQrwEcTxFCs7d/GJ5eSyPkHzOiBkc/KfLdFJBHzldtQ==}
+  '@testing-library/jest-dom@6.9.1':
+    resolution: {integrity: sha512-zIcONa+hVtVSSep9UT3jZ5rizo2BsxgyDYU7WFD5eICBE7no3881HGeb/QkGfsJs6JTkY1aQhT7rIPC7e+0nnA==}
     engines: {node: '>=14', npm: '>=6', yarn: '>=1'}
 
   '@testing-library/user-event@14.6.1':
@@ -6110,8 +6102,8 @@ packages:
   '@types/node@24.5.2':
     resolution: {integrity: sha512-FYxk1I7wPv3K2XBaoyH2cTnocQEu8AOZ60hPbsyukMPLv5/5qr7V1i8PLHdl6Zf87I+xZXFvPCXYjiTFq+YSDQ==}
 
-  '@types/node@24.6.1':
-    resolution: {integrity: sha512-ljvjjs3DNXummeIaooB4cLBKg2U6SPI6Hjra/9rRIy7CpM0HpLtG9HptkMKAb4HYWy5S7HUvJEuWgr/y0U8SHw==}
+  '@types/node@24.6.2':
+    resolution: {integrity: sha512-d2L25Y4j+W3ZlNAeMKcy7yDsK425ibcAOO2t7aPTz6gNMH0z2GThtwENCDc0d/Pw9wgyRqE5Px1wkV7naz8ang==}
 
   '@types/pako@2.0.4':
     resolution: {integrity: sha512-VWDCbrLeVXJM9fihYodcLiIv0ku+AlOa/TQ1SvYOaBuyrSKgEcro95LJyIsJ4vSo6BXIxOKxiJAat04CmST9Fw==}
@@ -6131,10 +6123,10 @@ packages:
   '@types/raf@3.4.3':
     resolution: {integrity: sha512-c4YAvMedbPZ5tEyxzQdMoOhhJ4RD3rngZIdwC2/qDN3d7JpEhB6fiBRKVY1lg5B7Wk+uPBjn5f39j1/2MY1oOw==}
 
-  '@types/react-dom@19.1.9':
-    resolution: {integrity: sha512-qXRuZaOsAdXKFyOhRBg6Lqqc0yay13vN7KrIg4L7N4aaHN68ma9OK3NE1BoDFgFOTfM7zg+3/8+2n8rLUH3OKQ==}
+  '@types/react-dom@19.2.0':
+    resolution: {integrity: sha512-brtBs0MnE9SMx7px208g39lRmC5uHZs96caOJfTjFcYSLHNamvaSMfJNagChVNkup2SdtOxKX1FDBkRSJe1ZAg==}
     peerDependencies:
-      '@types/react': ^19.0.0
+      '@types/react': ^19.2.0
 
   '@types/react-reconciler@0.28.9':
     resolution: {integrity: sha512-HHM3nxyUZ3zAylX8ZEyrDNd2XZOnQ0D5XfunJF5FLQnZbHHYq4UWvW1QfelQNXv1ICNkwYhfxjwfnqivYB6bFg==}
@@ -6144,8 +6136,8 @@ packages:
   '@types/react@19.1.13':
     resolution: {integrity: sha512-hHkbU/eoO3EG5/MZkuFSKmYqPbSVk5byPFa3e7y/8TybHiLMACgI8seVYlicwk7H5K/rI2px9xrQp/C+AUDTiQ==}
 
-  '@types/react@19.1.16':
-    resolution: {integrity: sha512-WBM/nDbEZmDUORKnh5i1bTnAz6vTohUf9b8esSMu+b24+srbaxa04UbJgWx78CVfNXA20sNu0odEIluZDFdCog==}
+  '@types/react@19.2.0':
+    resolution: {integrity: sha512-1LOH8xovvsKsCBq1wnT4ntDUdCJKmnEakhsuoUSy6ExlHCkGP2hqnatagYTgFk6oeL0VU31u7SNjunPN+GchtA==}
 
   '@types/resolve@1.20.2':
     resolution: {integrity: sha512-60BCwRFOZCQhDncwQdxxeOEEkbc5dIMccYLwbxsS4TUNeVECQ/pBJ0j09mrHOl/JJvpRPGwO9SvE4nR2Nb/a4Q==}
@@ -6744,8 +6736,8 @@ packages:
   base64-js@1.5.1:
     resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==}
 
-  baseline-browser-mapping@2.8.9:
-    resolution: {integrity: sha512-hY/u2lxLrbecMEWSB0IpGzGyDyeoMFQhCvZd2jGFSE5I17Fh01sYUBPCJtkWERw7zrac9+cIghxm/ytJa2X8iA==}
+  baseline-browser-mapping@2.8.10:
+    resolution: {integrity: sha512-uLfgBi+7IBNay8ECBO2mVMGZAc1VgZWEChxm4lv+TobGdG82LnXMjuNGo/BSSZZL4UmkWhxEHP2f5ziLNwGWMA==}
     hasBin: true
 
   bcp-47-match@2.0.3:
@@ -6795,8 +6787,8 @@ packages:
     resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==}
     engines: {node: '>=8'}
 
-  browserslist@4.26.2:
-    resolution: {integrity: sha512-ECFzp6uFOSB+dcZ5BK/IBaGWssbSYBHvuMeMt3MMFyhI0Z8SqGgEkBLARgpRH3hutIgPVsALcMwbDrJqPxQ65A==}
+  browserslist@4.26.3:
+    resolution: {integrity: sha512-lAUU+02RFBuCKQPj/P6NgjlbCnLBMp4UtgTx7vNHd3XSIJF87s9a5rA3aH2yw3GS9DqZAUbOtZdCCiZeVRqt0w==}
     engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
     hasBin: true
 
@@ -8279,6 +8271,14 @@ packages:
       typescript:
         optional: true
 
+  i18next@25.5.3:
+    resolution: {integrity: sha512-joFqorDeQ6YpIXni944upwnuHBf5IoPMuqAchGVeQLdWC2JOjxgM9V8UGLhNIIH/Q8QleRxIi0BSRQehSrDLcg==}
+    peerDependencies:
+      typescript: ^5
+    peerDependenciesMeta:
+      typescript:
+        optional: true
+
   iconv-lite@0.4.24:
     resolution: {integrity: sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==}
     engines: {node: '>=0.10.0'}
@@ -9949,6 +9949,11 @@ packages:
     peerDependencies:
       react: ^19.1.1
 
+  react-dom@19.2.0:
+    resolution: {integrity: sha512-UlbRu4cAiGaIewkPyiRGJk0imDN2T3JjieT6spoL2UeSf5od4n5LB/mQ4ejmxhCFT1tYe8IvaFulzynWovsEFQ==}
+    peerDependencies:
+      react: ^19.2.0
+
   react-error-boundary@6.0.0:
     resolution: {integrity: sha512-gdlJjD7NWr0IfkPlaREN2d9uUZUlksrfOx7SX62VRerwXbMY6ftGCIZua1VG1aXFNOimhISsTq+Owp725b9SiA==}
     peerDependencies:
@@ -10137,6 +10142,10 @@ packages:
     resolution: {integrity: sha512-w8nqGImo45dmMIfljjMwOGtbmC/mk4CMYhWIicdSflH91J9TyCyczcPFXJzrZ/ZXcgGRFeP6BU0BEJTw6tZdfQ==}
     engines: {node: '>=0.10.0'}
 
+  react@19.2.0:
+    resolution: {integrity: sha512-tmbWg6W31tQLeB5cdIBOicJDJRR2KzXsV7uSK9iNfLWQ5bIZfxuPEHp7M8wiHyHnn0DD1i7w3Zmin0FtkrwoCQ==}
+    engines: {node: '>=0.10.0'}
+
   read-cache@1.0.0:
     resolution: {integrity: sha512-Owdv/Ft7IjOgm/i0xvNDZ1LrRANRfew4b2prF3OWMQLxLfu3bS8FVhCsrSCMK4lR56Y9ya+AThoTpDCTxCmpRA==}
 
@@ -10374,8 +10383,8 @@ packages:
     engines: {node: 20 || >=22}
     hasBin: true
 
-  rollup-plugin-visualizer@6.0.3:
-    resolution: {integrity: sha512-ZU41GwrkDcCpVoffviuM9Clwjy5fcUxlz0oMoTXTYsK+tcIFzbdacnrr2n8TXcHxbGKKXtOdjxM2HUS4HjkwIw==}
+  rollup-plugin-visualizer@6.0.4:
+    resolution: {integrity: sha512-q8Q7J/6YofkmaGW1sH/fPRAz37x/+pd7VBuaUU7lwvOS/YikuiiEU9jeb9PH8XHiq50XFrUsBbOxeAMYQ7KZkg==}
     engines: {node: '>=18'}
     hasBin: true
     peerDependencies:
@@ -10456,6 +10465,9 @@ packages:
   scheduler@0.26.0:
     resolution: {integrity: sha512-NlHwttCI/l5gCPR3D1nNXtWABUmBwvZpEQiD4IXSbIDq8BzLIK/7Ir5gTFSGZDUu37K5cMNp0hFtzO38sC7gWA==}
 
+  scheduler@0.27.0:
+    resolution: {integrity: sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q==}
+
   secure-json-parse@4.0.0:
     resolution: {integrity: sha512-dxtLJO6sc35jWidmLxo7ij+Eg48PM/kleBsxpC8QJE0qJICe+KawkDQmvCMZUr9u7WKVHgMW6vy3fQ7zMiFZMA==}
 
@@ -10781,16 +10793,16 @@ packages:
     engines: {node: '>=14.0.0'}
     hasBin: true
 
-  tailwindcss@3.4.17:
-    resolution: {integrity: sha512-w33E2aCvSDP0tW9RZuNXadXlkHXqFzSkQew/aIa2i/Sj8fThxwovwlXHSPXTbAHwEIhBFXAedUhP2tueAKP8Og==}
+  tailwindcss@3.4.18:
+    resolution: {integrity: sha512-6A2rnmW5xZMdw11LYjhcI5846rt9pbLSabY5XPxo+XWdxwZaFEn47Go4NzFiHu9sNNmr/kXivP1vStfvMaK1GQ==}
     engines: {node: '>=14.0.0'}
     hasBin: true
 
-  tailwindcss@4.1.13:
-    resolution: {integrity: sha512-i+zidfmTqtwquj4hMEwdjshYYgMbOrPzb9a0M3ZgNa0JMoZeFC6bxZvO8yr8ozS6ix2SDz0+mvryPeBs2TFE+w==}
+  tailwindcss@4.1.14:
+    resolution: {integrity: sha512-b7pCxjGO98LnxVkKjaZSDeNuljC4ueKUddjENJOADtubtdo8llTaJy7HwBMeLNSSo2N5QIAgklslK1+Ir8r6CA==}
 
-  tapable@2.2.3:
-    resolution: {integrity: sha512-ZL6DDuAlRlLGghwcfmSn9sK3Hr6ArtyudlSAiCqQ6IfE+b+HHbydbYDIG15IfS5do+7XQQBdBiubF/cV2dnDzg==}
+  tapable@2.3.0:
+    resolution: {integrity: sha512-g9ljZiwki/LfxmQADO3dEY1CbpmXT5Hm2fJ+QaGKwSXUylMybePR7/67YW7jOrrvjEgL1Fmz5kzyAjWVWLlucg==}
     engines: {node: '>=6'}
 
   tar-fs@2.1.4:
@@ -11216,8 +11228,8 @@ packages:
       '@types/react':
         optional: true
 
-  use-sync-external-store@1.5.0:
-    resolution: {integrity: sha512-Rb46I4cGGVBmjamjphe8L/UnvJD+uPPtTkNvX5mZgqdbavhI4EbgIWJiIHXJ8bc/i9EQGPRh4DwEURJ552Do0A==}
+  use-sync-external-store@1.6.0:
+    resolution: {integrity: sha512-Pp6GSwGP/NrPIrxVFAIkOQeyw8lFenOHijQWkUTrDvrF4ALqylP2C/KCkeS9dpUM3KvYRQhna5vt7IL95+ZQ9w==}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
 
@@ -11360,8 +11372,8 @@ packages:
       terser:
         optional: true
 
-  vite@7.1.7:
-    resolution: {integrity: sha512-VbA8ScMvAISJNJVbRDTJdCwqQoAareR/wutevKanhR2/1EkoXVZVkkORaYm/tNVCjP/UDTKtcw3bAkwOUdedmA==}
+  vite@7.1.8:
+    resolution: {integrity: sha512-oBXvfSHEOL8jF+R9Am7h59Up07kVVGH1NrFGFoEG6bPDZP3tGpQhvkBpy5x7U6+E6wZCu9OihsWgJqDbQIm8LQ==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
@@ -12340,7 +12352,7 @@ snapshots:
     dependencies:
       '@babel/compat-data': 7.28.4
       '@babel/helper-validator-option': 7.27.1
-      browserslist: 4.26.2
+      browserslist: 4.26.3
       lru-cache: 5.1.1
       semver: 6.3.1
 
@@ -13101,19 +13113,19 @@ snapshots:
       - sugar-high
       - supports-color
 
-  '@blocknote/react@0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@blocknote/react@0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@blocknote/core': 0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)
       '@emoji-mart/data': 1.2.1
-      '@floating-ui/react': 0.26.28(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@floating-ui/react': 0.26.28(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
       '@tiptap/pm': 2.26.2
-      '@tiptap/react': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@tiptap/react': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       emoji-mart: 5.6.0
       lodash.merge: 4.6.2
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
-      react-icons: 5.5.0(react@19.1.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
+      react-icons: 5.5.0(react@19.2.0)
     transitivePeerDependencies:
       - '@hocuspocus/provider'
       - '@types/hast'
@@ -13123,31 +13135,31 @@ snapshots:
       - sugar-high
       - supports-color
 
-  '@blocknote/shadcn@0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(highlight.js@11.11.1)(lowlight@3.3.0)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.6.1)(typescript@5.9.3))':
+  '@blocknote/shadcn@0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(highlight.js@11.11.1)(lowlight@3.3.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(tsx@4.20.6)(yaml@2.8.1)':
     dependencies:
       '@blocknote/core': 0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)
-      '@blocknote/react': 0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@hookform/resolvers': 3.10.0(react-hook-form@7.63.0(react@19.1.1))
-      '@radix-ui/react-avatar': 1.1.10(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-dropdown-menu': 2.1.16(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-label': 2.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-popover': 1.1.15(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-select': 2.2.6(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-tabs': 1.1.13(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-toggle': 1.1.10(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-tooltip': 1.2.8(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@blocknote/react': 0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@hookform/resolvers': 3.10.0(react-hook-form@7.63.0(react@19.2.0))
+      '@radix-ui/react-avatar': 1.1.10(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-dropdown-menu': 2.1.16(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-label': 2.1.7(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-popover': 1.1.15(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-select': 2.2.6(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-tabs': 1.1.13(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-toggle': 1.1.10(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-tooltip': 1.2.8(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       autoprefixer: 10.4.21(postcss@8.5.6)
       class-variance-authority: 0.7.1
       clsx: 2.1.1
-      lucide-react: 0.542.0(react@19.1.1)
+      lucide-react: 0.542.0(react@19.2.0)
       postcss: 8.5.6
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
-      react-hook-form: 7.63.0(react@19.1.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
+      react-hook-form: 7.63.0(react@19.2.0)
       tailwind-merge: 2.6.0
-      tailwindcss: 3.4.17(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.6.1)(typescript@5.9.3))
-      tailwindcss-animate: 1.0.7(tailwindcss@3.4.17(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.6.1)(typescript@5.9.3)))
+      tailwindcss: 3.4.18(tsx@4.20.6)(yaml@2.8.1)
+      tailwindcss-animate: 1.0.7(tailwindcss@3.4.18(tsx@4.20.6)(yaml@2.8.1))
       zod: 3.25.76
     transitivePeerDependencies:
       - '@hocuspocus/provider'
@@ -13159,7 +13171,8 @@ snapshots:
       - refractor
       - sugar-high
       - supports-color
-      - ts-node
+      - tsx
+      - yaml
 
   '@cellajs/permission-manager@0.1.0(@swc/core@1.7.26)(jiti@2.6.1)(postcss@8.5.6)(tsx@4.20.5)(yaml@2.8.1)':
     dependencies:
@@ -13174,13 +13187,13 @@ snapshots:
       - tsx
       - yaml
 
-  '@chromatic-com/storybook@4.1.1(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
+  '@chromatic-com/storybook@4.1.1(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
     dependencies:
       '@neoconfetti/react': 1.0.0
       chromatic: 12.2.0
       filesize: 10.1.6
       jsonfile: 6.2.0
-      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       strip-ansi: 7.1.2
     transitivePeerDependencies:
       - '@chromatic-com/cypress'
@@ -13251,12 +13264,12 @@ snapshots:
 
   '@electric-sql/pglite@0.3.10': {}
 
-  '@electric-sql/react@1.0.10(react@19.1.1)':
+  '@electric-sql/react@1.0.10(react@19.2.0)':
     dependencies:
       '@electric-sql/client': 1.0.10
-      use-sync-external-store: 1.5.0(react@19.1.1)
+      use-sync-external-store: 1.6.0(react@19.2.0)
     optionalDependencies:
-      react: 19.1.1
+      react: 19.2.0
 
   '@emnapi/core@1.5.0':
     dependencies:
@@ -13773,20 +13786,26 @@ snapshots:
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
 
-  '@floating-ui/react@0.26.28(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@floating-ui/react-dom@2.1.6(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
-      '@floating-ui/react-dom': 2.1.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@floating-ui/dom': 1.7.4
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
+
+  '@floating-ui/react@0.26.28(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
+    dependencies:
+      '@floating-ui/react-dom': 2.1.6(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@floating-ui/utils': 0.2.10
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
       tabbable: 6.2.0
 
-  '@floating-ui/react@0.27.16(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@floating-ui/react@0.27.16(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
-      '@floating-ui/react-dom': 2.1.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@floating-ui/react-dom': 2.1.6(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@floating-ui/utils': 0.2.10
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
       tabbable: 6.2.0
 
   '@floating-ui/utils@0.2.10': {}
@@ -13890,14 +13909,14 @@ snapshots:
       hono: 4.9.8
       zod: 4.1.8
 
-  '@hookform/resolvers@3.10.0(react-hook-form@7.63.0(react@19.1.1))':
+  '@hookform/resolvers@3.10.0(react-hook-form@7.63.0(react@19.2.0))':
     dependencies:
-      react-hook-form: 7.63.0(react@19.1.1)
+      react-hook-form: 7.63.0(react@19.2.0)
 
-  '@hookform/resolvers@5.2.2(react-hook-form@7.63.0(react@19.1.1))':
+  '@hookform/resolvers@5.2.2(react-hook-form@7.63.0(react@19.2.0))':
     dependencies:
       '@standard-schema/utils': 0.3.0
-      react-hook-form: 7.63.0(react@19.1.1)
+      react-hook-form: 7.63.0(react@19.2.0)
 
   '@humanwhocodes/config-array@0.13.0':
     dependencies:
@@ -14030,12 +14049,12 @@ snapshots:
 
   '@istanbuljs/schema@0.1.3': {}
 
-  '@joshwooding/vite-plugin-react-docgen-typescript@0.6.1(typescript@5.9.3)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
+  '@joshwooding/vite-plugin-react-docgen-typescript@0.6.1(typescript@5.9.3)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
       glob: 10.4.5
       magic-string: 0.30.19
       react-docgen-typescript: 2.4.0(typescript@5.9.3)
-      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     optionalDependencies:
       typescript: 5.9.3
 
@@ -14088,13 +14107,13 @@ snapshots:
       '@adobe/css-tools': 4.4.4
       hast-util-select: 6.0.4
       hast-util-to-string: 3.0.1
-      jsx-email: 2.7.3(@emotion/is-prop-valid@1.3.1)(@jsx-email/plugin-inline@1.0.1)(@jsx-email/plugin-minify@1.0.1)(@jsx-email/plugin-pretty@1.0.0)(@types/node@24.5.2)(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(lightningcss@1.30.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(terser@5.44.0)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2))(typescript@5.9.2)
+      jsx-email: 2.7.3(@emotion/is-prop-valid@1.3.1)(@jsx-email/plugin-inline@1.0.1)(@jsx-email/plugin-minify@1.0.1)(@jsx-email/plugin-pretty@1.0.0)(@types/node@24.5.2)(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(lightningcss@1.30.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(terser@5.44.0)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2))(typescript@5.9.2)
       unist-util-remove: 4.0.0
       unist-util-visit: 5.0.0
 
   '@jsx-email/plugin-minify@1.0.1(jsx-email@2.7.3)':
     dependencies:
-      jsx-email: 2.7.3(@emotion/is-prop-valid@1.3.1)(@jsx-email/plugin-inline@1.0.1)(@jsx-email/plugin-minify@1.0.1)(@jsx-email/plugin-pretty@1.0.0)(@types/node@24.5.2)(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(lightningcss@1.30.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(terser@5.44.0)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2))(typescript@5.9.2)
+      jsx-email: 2.7.3(@emotion/is-prop-valid@1.3.1)(@jsx-email/plugin-inline@1.0.1)(@jsx-email/plugin-minify@1.0.1)(@jsx-email/plugin-pretty@1.0.0)(@types/node@24.5.2)(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(lightningcss@1.30.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(terser@5.44.0)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2))(typescript@5.9.2)
       rehype-minify-attribute-whitespace: 4.0.1
       rehype-minify-css-style: 4.0.1
       rehype-minify-enumerated-attribute: 5.0.2
@@ -14116,7 +14135,7 @@ snapshots:
 
   '@jsx-email/plugin-pretty@1.0.0(jsx-email@2.7.3)':
     dependencies:
-      jsx-email: 2.7.3(@emotion/is-prop-valid@1.3.1)(@jsx-email/plugin-inline@1.0.1)(@jsx-email/plugin-minify@1.0.1)(@jsx-email/plugin-pretty@1.0.0)(@types/node@24.5.2)(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(lightningcss@1.30.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(terser@5.44.0)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2))(typescript@5.9.2)
+      jsx-email: 2.7.3(@emotion/is-prop-valid@1.3.1)(@jsx-email/plugin-inline@1.0.1)(@jsx-email/plugin-minify@1.0.1)(@jsx-email/plugin-pretty@1.0.0)(@types/node@24.5.2)(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(lightningcss@1.30.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(terser@5.44.0)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2))(typescript@5.9.2)
       pretty: 2.0.0
 
   '@libsql/client-wasm@0.14.0':
@@ -14154,11 +14173,11 @@ snapshots:
 
   '@logtail/types@0.5.6': {}
 
-  '@mdx-js/react@3.1.1(@types/react@19.1.16)(react@19.1.1)':
+  '@mdx-js/react@3.1.1(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
       '@types/mdx': 2.0.13
-      '@types/react': 19.1.16
-      react: 19.1.1
+      '@types/react': 19.2.0
+      react: 19.2.0
 
   '@microsoft/fetch-event-source@2.0.1': {}
 
@@ -14959,10 +14978,10 @@ snapshots:
   '@petamoriken/float16@3.9.2':
     optional: true
 
-  '@pivanov/utils@0.0.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@pivanov/utils@0.0.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
 
   '@pkgjs/parseargs@0.11.0':
     optional: true
@@ -15016,160 +15035,160 @@ snapshots:
 
   '@radix-ui/primitive@1.1.3': {}
 
-  '@radix-ui/react-accordion@1.2.12(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-accordion@1.2.12(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-collapsible': 1.1.12(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-collapsible': 1.1.12(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-alert-dialog@1.1.15(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-alert-dialog@1.1.15(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-dialog': 1.1.15(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.16)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-dialog': 1.1.15(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-arrow@1.1.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-arrow@1.1.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
       '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react-dom': 19.2.0(@types/react@19.1.13)
 
-  '@radix-ui/react-arrow@1.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-arrow@1.1.7(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
       '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react-dom': 19.2.0(@types/react@19.1.13)
 
-  '@radix-ui/react-arrow@1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-arrow@1.1.7(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
-
-  '@radix-ui/react-avatar@1.1.10(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
-    dependencies:
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-is-hydrated': 0.1.0(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
+
+  '@radix-ui/react-avatar@1.1.10(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
+    dependencies:
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-is-hydrated': 0.1.0(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-checkbox@1.3.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-checkbox@1.3.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-size': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-collapsible@1.1.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-collapsible@1.1.1(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.0
       '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.1.13)(react@19.1.1)
       '@radix-ui/react-context': 1.1.1(@types/react@19.1.13)(react@19.1.1)
       '@radix-ui/react-id': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-presence': 1.1.1(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.13)(react@19.1.1)
       '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.1.13)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
       '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react-dom': 19.2.0(@types/react@19.1.13)
 
-  '@radix-ui/react-collapsible@1.1.12(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-collapsible@1.1.12(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-collection@1.1.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-collection@1.1.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.1.13)(react@19.1.1)
       '@radix-ui/react-context': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-slot': 1.1.0(@types/react@19.1.13)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
       '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react-dom': 19.2.0(@types/react@19.1.13)
 
-  '@radix-ui/react-collection@1.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-collection@1.1.7(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
       '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-slot': 1.2.3(@types/react@19.1.13)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
       '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react-dom': 19.2.0(@types/react@19.1.13)
 
-  '@radix-ui/react-collection@1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-collection@1.1.7(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.16)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
   '@radix-ui/react-compose-refs@1.1.0(@types/react@19.1.13)(react@19.1.1)':
     dependencies:
@@ -15183,25 +15202,25 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
-  '@radix-ui/react-compose-refs@1.1.2(@types/react@19.1.16)(react@19.1.1)':
+  '@radix-ui/react-compose-refs@1.1.2(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
-      react: 19.1.1
+      react: 19.2.0
     optionalDependencies:
-      '@types/react': 19.1.16
+      '@types/react': 19.2.0
 
-  '@radix-ui/react-context-menu@2.2.16(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-context-menu@2.2.16(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-menu': 2.1.16(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-menu': 2.1.16(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
   '@radix-ui/react-context@1.1.0(@types/react@19.1.13)(react@19.1.1)':
     dependencies:
@@ -15221,33 +15240,33 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
-  '@radix-ui/react-context@1.1.2(@types/react@19.1.16)(react@19.1.1)':
+  '@radix-ui/react-context@1.1.2(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
-      react: 19.1.1
+      react: 19.2.0
     optionalDependencies:
-      '@types/react': 19.1.16
+      '@types/react': 19.2.0
 
-  '@radix-ui/react-dialog@1.1.15(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-dialog@1.1.15(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.0)(react@19.2.0)
       aria-hidden: 1.2.6
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
-      react-remove-scroll: 2.7.1(@types/react@19.1.16)(react@19.1.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
+      react-remove-scroll: 2.7.1(@types/react@19.2.0)(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
   '@radix-ui/react-direction@1.1.0(@types/react@19.1.13)(react@19.1.1)':
     dependencies:
@@ -15261,65 +15280,65 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
-  '@radix-ui/react-direction@1.1.1(@types/react@19.1.16)(react@19.1.1)':
+  '@radix-ui/react-direction@1.1.1(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
-      react: 19.1.1
+      react: 19.2.0
     optionalDependencies:
-      '@types/react': 19.1.16
+      '@types/react': 19.2.0
 
-  '@radix-ui/react-dismissable-layer@1.1.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-dismissable-layer@1.1.1(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.0
       '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.13)(react@19.1.1)
       '@radix-ui/react-use-escape-keydown': 1.1.0(@types/react@19.1.13)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
       '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react-dom': 19.2.0(@types/react@19.1.13)
 
-  '@radix-ui/react-dismissable-layer@1.1.11(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-dismissable-layer@1.1.11(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
       '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.13)(react@19.1.1)
       '@radix-ui/react-use-escape-keydown': 1.1.1(@types/react@19.1.13)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
       '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react-dom': 19.2.0(@types/react@19.1.13)
 
-  '@radix-ui/react-dismissable-layer@1.1.11(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-dismissable-layer@1.1.11(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-escape-keydown': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-escape-keydown': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-dropdown-menu@2.1.16(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-dropdown-menu@2.1.16(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-menu': 2.1.16(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-menu': 2.1.16(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
   '@radix-ui/react-focus-guards@1.1.1(@types/react@19.1.13)(react@19.1.1)':
     dependencies:
@@ -15333,61 +15352,61 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
-  '@radix-ui/react-focus-guards@1.1.3(@types/react@19.1.16)(react@19.1.1)':
+  '@radix-ui/react-focus-guards@1.1.3(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
-      react: 19.1.1
+      react: 19.2.0
     optionalDependencies:
-      '@types/react': 19.1.16
+      '@types/react': 19.2.0
 
-  '@radix-ui/react-focus-scope@1.1.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-focus-scope@1.1.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.13)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
       '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react-dom': 19.2.0(@types/react@19.1.13)
 
-  '@radix-ui/react-focus-scope@1.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-focus-scope@1.1.7(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.13)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
       '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react-dom': 19.2.0(@types/react@19.1.13)
 
-  '@radix-ui/react-focus-scope@1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-focus-scope@1.1.7(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-hover-card@1.1.15(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-hover-card@1.1.15(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
   '@radix-ui/react-icons@1.3.2(react@19.1.1)':
     dependencies:
@@ -15407,84 +15426,84 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
-  '@radix-ui/react-id@1.1.1(@types/react@19.1.16)(react@19.1.1)':
+  '@radix-ui/react-id@1.1.1(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      react: 19.1.1
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
     optionalDependencies:
-      '@types/react': 19.1.16
+      '@types/react': 19.2.0
 
-  '@radix-ui/react-label@2.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-label@2.1.7(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-menu@2.1.16(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-menu@2.1.16(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.0)(react@19.2.0)
       aria-hidden: 1.2.6
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
-      react-remove-scroll: 2.7.1(@types/react@19.1.16)(react@19.1.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
+      react-remove-scroll: 2.7.1(@types/react@19.2.0)(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-popover@1.1.15(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-popover@1.1.15(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.0)(react@19.2.0)
       aria-hidden: 1.2.6
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
-      react-remove-scroll: 2.7.1(@types/react@19.1.16)(react@19.1.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
+      react-remove-scroll: 2.7.1(@types/react@19.2.0)(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-popover@1.1.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-popover@1.1.2(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.0
       '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.1.13)(react@19.1.1)
       '@radix-ui/react-context': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-dismissable-layer': 1.1.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-dismissable-layer': 1.1.1(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-focus-guards': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-focus-scope': 1.1.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-focus-scope': 1.1.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-id': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-popper': 1.2.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-portal': 1.1.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-popper': 1.2.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-portal': 1.1.2(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-presence': 1.1.1(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-slot': 1.1.0(@types/react@19.1.13)(react@19.1.1)
       '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.13)(react@19.1.1)
       aria-hidden: 1.2.6
@@ -15493,15 +15512,15 @@ snapshots:
       react-remove-scroll: 2.6.0(@types/react@19.1.13)(react@19.1.1)
     optionalDependencies:
       '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react-dom': 19.2.0(@types/react@19.1.13)
 
-  '@radix-ui/react-popper@1.2.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-popper@1.2.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@floating-ui/react-dom': 2.1.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-arrow': 1.1.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-arrow': 1.1.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.1.13)(react@19.1.1)
       '@radix-ui/react-context': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.13)(react@19.1.1)
       '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.1.13)(react@19.1.1)
       '@radix-ui/react-use-rect': 1.1.0(@types/react@19.1.13)(react@19.1.1)
@@ -15511,15 +15530,15 @@ snapshots:
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
       '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react-dom': 19.2.0(@types/react@19.1.13)
 
-  '@radix-ui/react-popper@1.2.8(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-popper@1.2.8(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@floating-ui/react-dom': 2.1.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-arrow': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-arrow': 1.1.7(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
       '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.13)(react@19.1.1)
       '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.13)(react@19.1.1)
       '@radix-ui/react-use-rect': 1.1.1(@types/react@19.1.13)(react@19.1.1)
@@ -15529,57 +15548,57 @@ snapshots:
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
       '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
-
-  '@radix-ui/react-popper@1.2.8(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
-    dependencies:
-      '@floating-ui/react-dom': 2.1.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-arrow': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-rect': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-size': 1.1.1(@types/react@19.1.16)(react@19.1.1)
+      '@types/react-dom': 19.2.0(@types/react@19.1.13)
+
+  '@radix-ui/react-popper@1.2.8(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
+    dependencies:
+      '@floating-ui/react-dom': 2.1.6(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-arrow': 1.1.7(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-rect': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.0)(react@19.2.0)
       '@radix-ui/rect': 1.1.1
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-portal@1.1.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-portal@1.1.2(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.1.13)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
       '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react-dom': 19.2.0(@types/react@19.1.13)
 
-  '@radix-ui/react-portal@1.1.9(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-portal@1.1.9(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.13)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
       '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react-dom': 19.2.0(@types/react@19.1.13)
 
-  '@radix-ui/react-portal@1.1.9(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-portal@1.1.9(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-presence@1.1.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-presence@1.1.1(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.1.13)(react@19.1.1)
       '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.1.13)(react@19.1.1)
@@ -15587,209 +15606,209 @@ snapshots:
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
       '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react-dom': 19.2.0(@types/react@19.1.13)
 
-  '@radix-ui/react-presence@1.1.5(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-presence@1.1.5(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-primitive@2.0.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-primitive@2.0.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/react-slot': 1.1.0(@types/react@19.1.13)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
       '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react-dom': 19.2.0(@types/react@19.1.13)
 
-  '@radix-ui/react-primitive@2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-primitive@2.1.3(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/react-slot': 1.2.3(@types/react@19.1.13)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
       '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react-dom': 19.2.0(@types/react@19.1.13)
 
-  '@radix-ui/react-primitive@2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-primitive@2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.16)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-progress@1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-progress@1.1.7(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-radio-group@1.3.8(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-radio-group@1.3.8(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-size': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-roving-focus@1.1.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-roving-focus@1.1.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.0
-      '@radix-ui/react-collection': 1.1.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-collection': 1.1.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.1.13)(react@19.1.1)
       '@radix-ui/react-context': 1.1.0(@types/react@19.1.13)(react@19.1.1)
       '@radix-ui/react-direction': 1.1.0(@types/react@19.1.13)(react@19.1.1)
       '@radix-ui/react-id': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.13)(react@19.1.1)
       '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.13)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
       '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react-dom': 19.2.0(@types/react@19.1.13)
 
-  '@radix-ui/react-roving-focus@1.1.11(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-roving-focus@1.1.11(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-scroll-area@1.2.10(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-scroll-area@1.2.10(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@radix-ui/number': 1.1.1
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-select@2.2.6(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-select@2.2.6(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/number': 1.1.1
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
       '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
       '@radix-ui/react-direction': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-id': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-slot': 1.2.3(@types/react@19.1.13)(react@19.1.1)
       '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.13)(react@19.1.1)
       '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.13)(react@19.1.1)
       '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.13)(react@19.1.1)
       '@radix-ui/react-use-previous': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       aria-hidden: 1.2.6
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
       react-remove-scroll: 2.7.1(@types/react@19.1.13)(react@19.1.1)
     optionalDependencies:
       '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react-dom': 19.2.0(@types/react@19.1.13)
 
-  '@radix-ui/react-select@2.2.6(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-select@2.2.6(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@radix-ui/number': 1.1.1
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       aria-hidden: 1.2.6
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
-      react-remove-scroll: 2.7.1(@types/react@19.1.16)(react@19.1.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
+      react-remove-scroll: 2.7.1(@types/react@19.2.0)(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-separator@1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-separator@1.1.7(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-slider@1.3.6(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-slider@1.3.6(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@radix-ui/number': 1.1.1
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-size': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
   '@radix-ui/react-slot@1.1.0(@types/react@19.1.13)(react@19.1.1)':
     dependencies:
@@ -15805,135 +15824,135 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
-  '@radix-ui/react-slot@1.2.3(@types/react@19.1.16)(react@19.1.1)':
+  '@radix-ui/react-slot@1.2.3(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      react: 19.1.1
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
     optionalDependencies:
-      '@types/react': 19.1.16
+      '@types/react': 19.2.0
 
-  '@radix-ui/react-switch@1.2.6(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-switch@1.2.6(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-size': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-tabs@1.1.13(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-tabs@1.1.13(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-toast@1.2.15(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-toast@1.2.15(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-toggle-group@1.1.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-toggle-group@1.1.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.0
       '@radix-ui/react-context': 1.1.0(@types/react@19.1.13)(react@19.1.1)
       '@radix-ui/react-direction': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-roving-focus': 1.1.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-toggle': 1.1.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-roving-focus': 1.1.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-toggle': 1.1.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.13)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
       '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react-dom': 19.2.0(@types/react@19.1.13)
 
-  '@radix-ui/react-toggle-group@1.1.11(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-toggle-group@1.1.11(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-toggle': 1.1.10(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-toggle': 1.1.10(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-toggle@1.1.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-toggle@1.1.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.0
-      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.13)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
       '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react-dom': 19.2.0(@types/react@19.1.13)
 
-  '@radix-ui/react-toggle@1.1.10(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-toggle@1.1.10(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-tooltip@1.2.8(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-tooltip@1.2.8(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
   '@radix-ui/react-use-callback-ref@1.1.0(@types/react@19.1.13)(react@19.1.1)':
     dependencies:
@@ -15947,11 +15966,11 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
-  '@radix-ui/react-use-callback-ref@1.1.1(@types/react@19.1.16)(react@19.1.1)':
+  '@radix-ui/react-use-callback-ref@1.1.1(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
-      react: 19.1.1
+      react: 19.2.0
     optionalDependencies:
-      '@types/react': 19.1.16
+      '@types/react': 19.2.0
 
   '@radix-ui/react-use-controllable-state@1.1.0(@types/react@19.1.13)(react@19.1.1)':
     dependencies:
@@ -15968,13 +15987,13 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
-  '@radix-ui/react-use-controllable-state@1.2.2(@types/react@19.1.16)(react@19.1.1)':
+  '@radix-ui/react-use-controllable-state@1.2.2(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
-      '@radix-ui/react-use-effect-event': 0.0.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      react: 19.1.1
+      '@radix-ui/react-use-effect-event': 0.0.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
     optionalDependencies:
-      '@types/react': 19.1.16
+      '@types/react': 19.2.0
 
   '@radix-ui/react-use-effect-event@0.0.2(@types/react@19.1.13)(react@19.1.1)':
     dependencies:
@@ -15983,12 +16002,12 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
-  '@radix-ui/react-use-effect-event@0.0.2(@types/react@19.1.16)(react@19.1.1)':
+  '@radix-ui/react-use-effect-event@0.0.2(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      react: 19.1.1
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
     optionalDependencies:
-      '@types/react': 19.1.16
+      '@types/react': 19.2.0
 
   '@radix-ui/react-use-escape-keydown@1.1.0(@types/react@19.1.13)(react@19.1.1)':
     dependencies:
@@ -16004,19 +16023,19 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
-  '@radix-ui/react-use-escape-keydown@1.1.1(@types/react@19.1.16)(react@19.1.1)':
+  '@radix-ui/react-use-escape-keydown@1.1.1(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      react: 19.1.1
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
     optionalDependencies:
-      '@types/react': 19.1.16
+      '@types/react': 19.2.0
 
-  '@radix-ui/react-use-is-hydrated@0.1.0(@types/react@19.1.16)(react@19.1.1)':
+  '@radix-ui/react-use-is-hydrated@0.1.0(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
-      react: 19.1.1
-      use-sync-external-store: 1.5.0(react@19.1.1)
+      react: 19.2.0
+      use-sync-external-store: 1.6.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
+      '@types/react': 19.2.0
 
   '@radix-ui/react-use-layout-effect@1.1.0(@types/react@19.1.13)(react@19.1.1)':
     dependencies:
@@ -16030,11 +16049,11 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
-  '@radix-ui/react-use-layout-effect@1.1.1(@types/react@19.1.16)(react@19.1.1)':
+  '@radix-ui/react-use-layout-effect@1.1.1(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
-      react: 19.1.1
+      react: 19.2.0
     optionalDependencies:
-      '@types/react': 19.1.16
+      '@types/react': 19.2.0
 
   '@radix-ui/react-use-previous@1.1.1(@types/react@19.1.13)(react@19.1.1)':
     dependencies:
@@ -16042,11 +16061,11 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
-  '@radix-ui/react-use-previous@1.1.1(@types/react@19.1.16)(react@19.1.1)':
+  '@radix-ui/react-use-previous@1.1.1(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
-      react: 19.1.1
+      react: 19.2.0
     optionalDependencies:
-      '@types/react': 19.1.16
+      '@types/react': 19.2.0
 
   '@radix-ui/react-use-rect@1.1.0(@types/react@19.1.13)(react@19.1.1)':
     dependencies:
@@ -16062,12 +16081,12 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
-  '@radix-ui/react-use-rect@1.1.1(@types/react@19.1.16)(react@19.1.1)':
+  '@radix-ui/react-use-rect@1.1.1(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
       '@radix-ui/rect': 1.1.1
-      react: 19.1.1
+      react: 19.2.0
     optionalDependencies:
-      '@types/react': 19.1.16
+      '@types/react': 19.2.0
 
   '@radix-ui/react-use-size@1.1.0(@types/react@19.1.13)(react@19.1.1)':
     dependencies:
@@ -16083,48 +16102,48 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
-  '@radix-ui/react-use-size@1.1.1(@types/react@19.1.16)(react@19.1.1)':
+  '@radix-ui/react-use-size@1.1.1(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      react: 19.1.1
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
     optionalDependencies:
-      '@types/react': 19.1.16
+      '@types/react': 19.2.0
 
-  '@radix-ui/react-visually-hidden@1.2.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-visually-hidden@1.2.3(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
       '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react-dom': 19.2.0(@types/react@19.1.13)
 
-  '@radix-ui/react-visually-hidden@1.2.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-visually-hidden@1.2.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
-      '@types/react-dom': 19.1.9(@types/react@19.1.16)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
   '@radix-ui/rect@1.1.0': {}
 
   '@radix-ui/rect@1.1.1': {}
 
-  '@react-scan/vite-plugin-react-scan@0.1.8(react-scan@0.4.3(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react-router-dom@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react-router@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react@19.1.1)(rollup@2.79.2))(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
+  '@react-scan/vite-plugin-react-scan@0.1.8(react-scan@0.4.3(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react-router-dom@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react-router@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react@19.2.0)(rollup@2.79.2))(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
       '@babel/core': 7.28.4
       '@babel/plugin-transform-react-jsx': 7.27.1(@babel/core@7.28.4)
       '@babel/preset-typescript': 7.27.1(@babel/core@7.28.4)
       babel-plugin-add-react-displayname: 0.0.5
       cheerio: 1.1.2
-      react-scan: 0.4.3(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react-router-dom@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react-router@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react@19.1.1)(rollup@2.79.2)
-      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      react-scan: 0.4.3(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react-router-dom@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react-router@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react@19.2.0)(rollup@2.79.2)
+      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - supports-color
 
-  '@reduxjs/toolkit@2.9.0(react-redux@9.2.0(@types/react@19.1.16)(react@19.1.1)(redux@5.0.1))(react@19.1.1)':
+  '@reduxjs/toolkit@2.9.0(react-redux@9.2.0(@types/react@19.2.0)(react@19.2.0)(redux@5.0.1))(react@19.2.0)':
     dependencies:
       '@standard-schema/spec': 1.0.0
       '@standard-schema/utils': 0.3.0
@@ -16133,8 +16152,8 @@ snapshots:
       redux-thunk: 3.1.0(redux@5.0.1)
       reselect: 5.1.1
     optionalDependencies:
-      react: 19.1.1
-      react-redux: 9.2.0(@types/react@19.1.16)(react@19.1.1)(redux@5.0.1)
+      react: 19.2.0
+      react-redux: 9.2.0(@types/react@19.2.0)(react@19.2.0)(redux@5.0.1)
 
   '@remirror/core-constants@3.0.0': {}
 
@@ -16587,12 +16606,12 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@sentry/react@9.46.0(react@19.1.1)':
+  '@sentry/react@9.46.0(react@19.2.0)':
     dependencies:
       '@sentry/browser': 9.46.0
       '@sentry/core': 9.46.0
       hoist-non-react-statics: 3.3.2
-      react: 19.1.1
+      react: 19.2.0
 
   '@sentry/vite-plugin@3.6.1':
     dependencies:
@@ -17017,92 +17036,92 @@ snapshots:
 
   '@standard-schema/utils@0.3.0': {}
 
-  '@storybook/addon-a11y@9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
+  '@storybook/addon-a11y@9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
     dependencies:
       '@storybook/global': 5.0.0
       axe-core: 4.10.3
-      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
 
-  '@storybook/addon-docs@9.1.10(@types/react@19.1.16)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
+  '@storybook/addon-docs@9.1.10(@types/react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
     dependencies:
-      '@mdx-js/react': 3.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@storybook/csf-plugin': 9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
-      '@storybook/icons': 1.6.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@storybook/react-dom-shim': 9.1.10(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
-      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      '@mdx-js/react': 3.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@storybook/csf-plugin': 9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
+      '@storybook/icons': 1.6.0(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@storybook/react-dom-shim': 9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       ts-dedent: 2.2.0
     transitivePeerDependencies:
       - '@types/react'
 
-  '@storybook/addon-vitest@9.1.10(@vitest/browser@3.2.4)(@vitest/runner@3.2.4)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(vitest@3.2.4)':
+  '@storybook/addon-vitest@9.1.10(@vitest/browser@3.2.4)(@vitest/runner@3.2.4)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(vitest@3.2.4)':
     dependencies:
       '@storybook/global': 5.0.0
-      '@storybook/icons': 1.6.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@storybook/icons': 1.6.0(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       prompts: 2.4.2
-      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       ts-dedent: 2.2.0
     optionalDependencies:
-      '@vitest/browser': 3.2.4(playwright@1.55.1)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)
+      '@vitest/browser': 3.2.4(playwright@1.55.1)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)
       '@vitest/runner': 3.2.4
-      vitest: 3.2.4(@types/debug@4.1.12)(@types/node@24.6.1)(@vitest/browser@3.2.4)(jiti@2.6.1)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vitest: 3.2.4(@types/debug@4.1.12)(@types/node@24.6.2)(@vitest/browser@3.2.4)(jiti@1.21.7)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - react
       - react-dom
 
-  '@storybook/builder-vite@9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
+  '@storybook/builder-vite@9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
-      '@storybook/csf-plugin': 9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
-      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      '@storybook/csf-plugin': 9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       ts-dedent: 2.2.0
-      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
 
-  '@storybook/csf-plugin@9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
+  '@storybook/csf-plugin@9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
     dependencies:
-      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       unplugin: 1.16.1
 
   '@storybook/global@5.0.0': {}
 
-  '@storybook/icons@1.6.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@storybook/icons@1.6.0(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
 
-  '@storybook/react-dom-shim@9.1.10(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
+  '@storybook/react-dom-shim@9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
     dependencies:
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
-      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
 
-  '@storybook/react-vite@9.1.10(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(rollup@2.79.2)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(typescript@5.9.3)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
+  '@storybook/react-vite@9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(rollup@2.79.2)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(typescript@5.9.3)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
-      '@joshwooding/vite-plugin-react-docgen-typescript': 0.6.1(typescript@5.9.3)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      '@joshwooding/vite-plugin-react-docgen-typescript': 0.6.1(typescript@5.9.3)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@rollup/pluginutils': 5.3.0(rollup@2.79.2)
-      '@storybook/builder-vite': 9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
-      '@storybook/react': 9.1.10(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(typescript@5.9.3)
+      '@storybook/builder-vite': 9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      '@storybook/react': 9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(typescript@5.9.3)
       find-up: 7.0.0
       magic-string: 0.30.19
-      react: 19.1.1
+      react: 19.2.0
       react-docgen: 8.0.1
-      react-dom: 19.1.1(react@19.1.1)
+      react-dom: 19.2.0(react@19.2.0)
       resolve: 1.22.10
-      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       tsconfig-paths: 4.2.0
-      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - rollup
       - supports-color
       - typescript
 
-  '@storybook/react@9.1.10(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(typescript@5.9.3)':
+  '@storybook/react@9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(typescript@5.9.3)':
     dependencies:
       '@storybook/global': 5.0.0
-      '@storybook/react-dom-shim': 9.1.10(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
-      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      '@storybook/react-dom-shim': 9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
     optionalDependencies:
       typescript: 5.9.3
 
@@ -17180,7 +17199,7 @@ snapshots:
       typescript: 5.9.3
       zod: 4.1.8
 
-  '@tailwindcss/node@4.1.13':
+  '@tailwindcss/node@4.1.14':
     dependencies:
       '@jridgewell/remapping': 2.3.5
       enhanced-resolve: 5.18.3
@@ -17188,77 +17207,75 @@ snapshots:
       lightningcss: 1.30.1
       magic-string: 0.30.19
       source-map-js: 1.2.1
-      tailwindcss: 4.1.13
+      tailwindcss: 4.1.14
 
-  '@tailwindcss/oxide-android-arm64@4.1.13':
+  '@tailwindcss/oxide-android-arm64@4.1.14':
     optional: true
 
-  '@tailwindcss/oxide-darwin-arm64@4.1.13':
+  '@tailwindcss/oxide-darwin-arm64@4.1.14':
     optional: true
 
-  '@tailwindcss/oxide-darwin-x64@4.1.13':
+  '@tailwindcss/oxide-darwin-x64@4.1.14':
     optional: true
 
-  '@tailwindcss/oxide-freebsd-x64@4.1.13':
+  '@tailwindcss/oxide-freebsd-x64@4.1.14':
     optional: true
 
-  '@tailwindcss/oxide-linux-arm-gnueabihf@4.1.13':
+  '@tailwindcss/oxide-linux-arm-gnueabihf@4.1.14':
     optional: true
 
-  '@tailwindcss/oxide-linux-arm64-gnu@4.1.13':
+  '@tailwindcss/oxide-linux-arm64-gnu@4.1.14':
     optional: true
 
-  '@tailwindcss/oxide-linux-arm64-musl@4.1.13':
+  '@tailwindcss/oxide-linux-arm64-musl@4.1.14':
     optional: true
 
-  '@tailwindcss/oxide-linux-x64-gnu@4.1.13':
+  '@tailwindcss/oxide-linux-x64-gnu@4.1.14':
     optional: true
 
-  '@tailwindcss/oxide-linux-x64-musl@4.1.13':
+  '@tailwindcss/oxide-linux-x64-musl@4.1.14':
     optional: true
 
-  '@tailwindcss/oxide-wasm32-wasi@4.1.13':
+  '@tailwindcss/oxide-wasm32-wasi@4.1.14':
     optional: true
 
-  '@tailwindcss/oxide-win32-arm64-msvc@4.1.13':
+  '@tailwindcss/oxide-win32-arm64-msvc@4.1.14':
     optional: true
 
-  '@tailwindcss/oxide-win32-x64-msvc@4.1.13':
+  '@tailwindcss/oxide-win32-x64-msvc@4.1.14':
     optional: true
 
-  '@tailwindcss/oxide@4.1.13':
+  '@tailwindcss/oxide@4.1.14':
     dependencies:
       detect-libc: 2.1.1
       tar: 7.5.1
     optionalDependencies:
-      '@tailwindcss/oxide-android-arm64': 4.1.13
-      '@tailwindcss/oxide-darwin-arm64': 4.1.13
-      '@tailwindcss/oxide-darwin-x64': 4.1.13
-      '@tailwindcss/oxide-freebsd-x64': 4.1.13
-      '@tailwindcss/oxide-linux-arm-gnueabihf': 4.1.13
-      '@tailwindcss/oxide-linux-arm64-gnu': 4.1.13
-      '@tailwindcss/oxide-linux-arm64-musl': 4.1.13
-      '@tailwindcss/oxide-linux-x64-gnu': 4.1.13
-      '@tailwindcss/oxide-linux-x64-musl': 4.1.13
-      '@tailwindcss/oxide-wasm32-wasi': 4.1.13
-      '@tailwindcss/oxide-win32-arm64-msvc': 4.1.13
-      '@tailwindcss/oxide-win32-x64-msvc': 4.1.13
-
-  '@tailwindcss/typography@0.5.19(tailwindcss@4.1.13)':
+      '@tailwindcss/oxide-android-arm64': 4.1.14
+      '@tailwindcss/oxide-darwin-arm64': 4.1.14
+      '@tailwindcss/oxide-darwin-x64': 4.1.14
+      '@tailwindcss/oxide-freebsd-x64': 4.1.14
+      '@tailwindcss/oxide-linux-arm-gnueabihf': 4.1.14
+      '@tailwindcss/oxide-linux-arm64-gnu': 4.1.14
+      '@tailwindcss/oxide-linux-arm64-musl': 4.1.14
+      '@tailwindcss/oxide-linux-x64-gnu': 4.1.14
+      '@tailwindcss/oxide-linux-x64-musl': 4.1.14
+      '@tailwindcss/oxide-wasm32-wasi': 4.1.14
+      '@tailwindcss/oxide-win32-arm64-msvc': 4.1.14
+      '@tailwindcss/oxide-win32-x64-msvc': 4.1.14
+
+  '@tailwindcss/typography@0.5.19(tailwindcss@4.1.14)':
     dependencies:
       postcss-selector-parser: 6.0.10
-      tailwindcss: 4.1.13
+      tailwindcss: 4.1.14
 
-  '@tailwindcss/vite@4.1.13(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
+  '@tailwindcss/vite@4.1.14(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
-      '@tailwindcss/node': 4.1.13
-      '@tailwindcss/oxide': 4.1.13
-      tailwindcss: 4.1.13
-      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
-
-  '@tanstack/history@1.132.0': {}
+      '@tailwindcss/node': 4.1.14
+      '@tailwindcss/oxide': 4.1.14
+      tailwindcss: 4.1.14
+      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
 
-  '@tanstack/history@1.132.21': {}
+  '@tanstack/history@1.132.31': {}
 
   '@tanstack/query-core@5.87.4': {}
 
@@ -17273,30 +17290,30 @@ snapshots:
       '@tanstack/query-core': 5.87.4
       '@tanstack/query-persist-client-core': 5.87.4
 
-  '@tanstack/react-query-devtools@5.87.4(@tanstack/react-query@5.87.4(react@19.1.1))(react@19.1.1)':
+  '@tanstack/react-query-devtools@5.87.4(@tanstack/react-query@5.87.4(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@tanstack/query-devtools': 5.87.3
-      '@tanstack/react-query': 5.87.4(react@19.1.1)
-      react: 19.1.1
+      '@tanstack/react-query': 5.87.4(react@19.2.0)
+      react: 19.2.0
 
-  '@tanstack/react-query-persist-client@5.87.4(@tanstack/react-query@5.87.4(react@19.1.1))(react@19.1.1)':
+  '@tanstack/react-query-persist-client@5.87.4(@tanstack/react-query@5.87.4(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@tanstack/query-persist-client-core': 5.87.4
-      '@tanstack/react-query': 5.87.4(react@19.1.1)
-      react: 19.1.1
+      '@tanstack/react-query': 5.87.4(react@19.2.0)
+      react: 19.2.0
 
-  '@tanstack/react-query@5.87.4(react@19.1.1)':
+  '@tanstack/react-query@5.87.4(react@19.2.0)':
     dependencies:
       '@tanstack/query-core': 5.87.4
-      react: 19.1.1
+      react: 19.2.0
 
-  '@tanstack/react-router-devtools@1.132.6(@tanstack/react-router@1.132.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(@tanstack/router-core@1.132.27)(@types/node@24.6.1)(csstype@3.1.3)(jiti@2.6.1)(lightningcss@1.30.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.6)(yaml@2.8.1)':
+  '@tanstack/react-router-devtools@1.132.31(@tanstack/react-router@1.132.31(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(@tanstack/router-core@1.132.31)(@types/node@24.6.2)(csstype@3.1.3)(jiti@1.21.7)(lightningcss@1.30.1)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.6)(yaml@2.8.1)':
     dependencies:
-      '@tanstack/react-router': 1.132.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@tanstack/router-devtools-core': 1.132.6(@tanstack/router-core@1.132.27)(@types/node@24.6.1)(csstype@3.1.3)(jiti@2.6.1)(lightningcss@1.30.1)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.6)(yaml@2.8.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
-      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      '@tanstack/react-router': 1.132.31(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@tanstack/router-devtools-core': 1.132.31(@tanstack/router-core@1.132.31)(@types/node@24.6.2)(csstype@3.1.3)(jiti@1.21.7)(lightningcss@1.30.1)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.6)(yaml@2.8.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
+      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - '@tanstack/router-core'
       - '@types/node'
@@ -17314,27 +17331,27 @@ snapshots:
       - tsx
       - yaml
 
-  '@tanstack/react-router@1.132.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@tanstack/react-router@1.132.31(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
-      '@tanstack/history': 1.132.0
-      '@tanstack/react-store': 0.7.7(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@tanstack/router-core': 1.132.6
+      '@tanstack/history': 1.132.31
+      '@tanstack/react-store': 0.7.7(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@tanstack/router-core': 1.132.31
       isbot: 5.1.31
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
       tiny-invariant: 1.3.3
       tiny-warning: 1.0.3
 
-  '@tanstack/react-store@0.7.7(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@tanstack/react-store@0.7.7(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@tanstack/store': 0.7.7
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
-      use-sync-external-store: 1.5.0(react@19.1.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
+      use-sync-external-store: 1.6.0(react@19.2.0)
 
-  '@tanstack/router-core@1.132.27':
+  '@tanstack/router-core@1.132.31':
     dependencies:
-      '@tanstack/history': 1.132.21
+      '@tanstack/history': 1.132.31
       '@tanstack/store': 0.7.7
       cookie-es: 2.0.0
       seroval: 1.3.2
@@ -17342,24 +17359,14 @@ snapshots:
       tiny-invariant: 1.3.3
       tiny-warning: 1.0.3
 
-  '@tanstack/router-core@1.132.6':
+  '@tanstack/router-devtools-core@1.132.31(@tanstack/router-core@1.132.31)(@types/node@24.6.2)(csstype@3.1.3)(jiti@1.21.7)(lightningcss@1.30.1)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.6)(yaml@2.8.1)':
     dependencies:
-      '@tanstack/history': 1.132.0
-      '@tanstack/store': 0.7.7
-      cookie-es: 2.0.0
-      seroval: 1.3.2
-      seroval-plugins: 1.3.3(seroval@1.3.2)
-      tiny-invariant: 1.3.3
-      tiny-warning: 1.0.3
-
-  '@tanstack/router-devtools-core@1.132.6(@tanstack/router-core@1.132.27)(@types/node@24.6.1)(csstype@3.1.3)(jiti@2.6.1)(lightningcss@1.30.1)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.6)(yaml@2.8.1)':
-    dependencies:
-      '@tanstack/router-core': 1.132.27
+      '@tanstack/router-core': 1.132.31
       clsx: 2.1.1
       goober: 2.1.16(csstype@3.1.3)
       solid-js: 1.9.9
       tiny-invariant: 1.3.3
-      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     optionalDependencies:
       csstype: 3.1.3
     transitivePeerDependencies:
@@ -17375,11 +17382,11 @@ snapshots:
       - tsx
       - yaml
 
-  '@tanstack/router-generator@1.132.27':
+  '@tanstack/router-generator@1.132.31':
     dependencies:
-      '@tanstack/router-core': 1.132.27
-      '@tanstack/router-utils': 1.132.21
-      '@tanstack/virtual-file-routes': 1.132.21
+      '@tanstack/router-core': 1.132.31
+      '@tanstack/router-utils': 1.132.31
+      '@tanstack/virtual-file-routes': 1.132.31
       prettier: 3.6.2
       recast: 0.23.11
       source-map: 0.7.6
@@ -17388,7 +17395,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@tanstack/router-plugin@1.132.27(@tanstack/react-router@1.132.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
+  '@tanstack/router-plugin@1.132.31(@tanstack/react-router@1.132.31(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
       '@babel/core': 7.28.4
       '@babel/plugin-syntax-jsx': 7.27.1(@babel/core@7.28.4)
@@ -17396,21 +17403,21 @@ snapshots:
       '@babel/template': 7.27.2
       '@babel/traverse': 7.28.4
       '@babel/types': 7.28.4
-      '@tanstack/router-core': 1.132.27
-      '@tanstack/router-generator': 1.132.27
-      '@tanstack/router-utils': 1.132.21
-      '@tanstack/virtual-file-routes': 1.132.21
+      '@tanstack/router-core': 1.132.31
+      '@tanstack/router-generator': 1.132.31
+      '@tanstack/router-utils': 1.132.31
+      '@tanstack/virtual-file-routes': 1.132.31
       babel-dead-code-elimination: 1.0.10
       chokidar: 3.6.0
       unplugin: 2.3.10
       zod: 3.25.76
     optionalDependencies:
-      '@tanstack/react-router': 1.132.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      '@tanstack/react-router': 1.132.31(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - supports-color
 
-  '@tanstack/router-utils@1.132.21':
+  '@tanstack/router-utils@1.132.31':
     dependencies:
       '@babel/core': 7.28.4
       '@babel/generator': 7.28.3
@@ -17425,7 +17432,7 @@ snapshots:
 
   '@tanstack/store@0.7.7': {}
 
-  '@tanstack/virtual-file-routes@1.132.21': {}
+  '@tanstack/virtual-file-routes@1.132.31': {}
 
   '@testing-library/dom@10.4.1':
     dependencies:
@@ -17438,7 +17445,7 @@ snapshots:
       picocolors: 1.1.1
       pretty-format: 27.5.1
 
-  '@testing-library/jest-dom@6.9.0':
+  '@testing-library/jest-dom@6.9.1':
     dependencies:
       '@adobe/css-tools': 4.4.4
       aria-query: 5.3.2
@@ -17545,7 +17552,7 @@ snapshots:
       prosemirror-transform: 1.10.4
       prosemirror-view: 1.41.2
 
-  '@tiptap/react@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@tiptap/react@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
       '@tiptap/extension-bubble-menu': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)
@@ -17553,9 +17560,9 @@ snapshots:
       '@tiptap/pm': 2.26.2
       '@types/use-sync-external-store': 0.0.6
       fast-deep-equal: 3.1.3
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
-      use-sync-external-store: 1.5.0(react@19.1.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
+      use-sync-external-store: 1.6.0(react@19.2.0)
 
   '@transloadit/prettier-bytes@0.3.5': {}
 
@@ -17703,7 +17710,7 @@ snapshots:
     dependencies:
       undici-types: 7.12.0
 
-  '@types/node@24.6.1':
+  '@types/node@24.6.2':
     dependencies:
       undici-types: 7.13.0
 
@@ -17732,24 +17739,24 @@ snapshots:
   '@types/raf@3.4.3':
     optional: true
 
-  '@types/react-dom@19.1.9(@types/react@19.1.13)':
+  '@types/react-dom@19.2.0(@types/react@19.1.13)':
     dependencies:
       '@types/react': 19.1.13
     optional: true
 
-  '@types/react-dom@19.1.9(@types/react@19.1.16)':
+  '@types/react-dom@19.2.0(@types/react@19.2.0)':
     dependencies:
-      '@types/react': 19.1.16
+      '@types/react': 19.2.0
 
-  '@types/react-reconciler@0.28.9(@types/react@19.1.16)':
+  '@types/react-reconciler@0.28.9(@types/react@19.2.0)':
     dependencies:
-      '@types/react': 19.1.16
+      '@types/react': 19.2.0
 
   '@types/react@19.1.13':
     dependencies:
       csstype: 3.1.3
 
-  '@types/react@19.1.16':
+  '@types/react@19.2.0':
     dependencies:
       csstype: 3.1.3
 
@@ -17993,15 +18000,15 @@ snapshots:
       p-queue: 8.1.1
       preact: 10.27.2
 
-  '@uppy/react@5.1.0(@uppy/core@5.0.2)(@uppy/dashboard@5.0.2(@uppy/core@5.0.2))(@uppy/screen-capture@5.0.1(@uppy/core@5.0.2))(@uppy/status-bar@5.0.1(@uppy/core@5.0.2))(@uppy/webcam@5.0.1(@uppy/core@5.0.2))(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@uppy/react@5.1.0(@uppy/core@5.0.2)(@uppy/dashboard@5.0.2(@uppy/core@5.0.2))(@uppy/screen-capture@5.0.1(@uppy/core@5.0.2))(@uppy/status-bar@5.0.1(@uppy/core@5.0.2))(@uppy/webcam@5.0.1(@uppy/core@5.0.2))(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@uppy/components': 1.0.3
       '@uppy/core': 5.0.2
       '@uppy/utils': 7.0.2
       preact: 10.27.2
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
-      use-sync-external-store: 1.5.0(react@19.1.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
+      use-sync-external-store: 1.6.0(react@19.2.0)
     optionalDependencies:
       '@uppy/dashboard': 5.0.2(@uppy/core@5.0.2)
       '@uppy/screen-capture': 5.0.1(@uppy/core@5.0.2)
@@ -18101,16 +18108,16 @@ snapshots:
       '@uppy/utils': 7.0.2
       preact: 10.27.2
 
-  '@vis.gl/react-google-maps@1.5.5(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@vis.gl/react-google-maps@1.5.5(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@types/google.maps': 3.58.1
       fast-deep-equal: 3.1.3
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
 
-  '@vitejs/plugin-basic-ssl@2.1.0(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
+  '@vitejs/plugin-basic-ssl@2.1.0(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
-      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
 
   '@vitejs/plugin-react@4.7.0(vite@5.4.20(@types/node@24.5.2)(lightningcss@1.30.1)(terser@5.44.0))':
     dependencies:
@@ -18124,7 +18131,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@vitejs/plugin-react@5.0.4(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
+  '@vitejs/plugin-react@5.0.4(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
       '@babel/core': 7.28.4
       '@babel/plugin-transform-react-jsx-self': 7.27.1(@babel/core@7.28.4)
@@ -18132,20 +18139,20 @@ snapshots:
       '@rolldown/pluginutils': 1.0.0-beta.38
       '@types/babel__core': 7.20.5
       react-refresh: 0.17.0
-      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - supports-color
 
-  '@vitest/browser@3.2.4(playwright@1.55.1)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)':
+  '@vitest/browser@3.2.4(playwright@1.55.1)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)':
     dependencies:
       '@testing-library/dom': 10.4.1
       '@testing-library/user-event': 14.6.1(@testing-library/dom@10.4.1)
-      '@vitest/mocker': 3.2.4(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      '@vitest/mocker': 3.2.4(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@vitest/utils': 3.2.4
       magic-string: 0.30.19
       sirv: 3.0.2
       tinyrainbow: 2.0.0
-      vitest: 3.2.4(@types/debug@4.1.12)(@types/node@24.6.1)(@vitest/browser@3.2.4)(jiti@2.6.1)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vitest: 3.2.4(@types/debug@4.1.12)(@types/node@24.6.2)(@vitest/browser@3.2.4)(jiti@1.21.7)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
       ws: 8.18.3
     optionalDependencies:
       playwright: 1.55.1
@@ -18155,6 +18162,26 @@ snapshots:
       - utf-8-validate
       - vite
 
+  '@vitest/browser@3.2.4(playwright@1.55.1)(vite@7.1.8(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)':
+    dependencies:
+      '@testing-library/dom': 10.4.1
+      '@testing-library/user-event': 14.6.1(@testing-library/dom@10.4.1)
+      '@vitest/mocker': 3.2.4(vite@7.1.8(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      '@vitest/utils': 3.2.4
+      magic-string: 0.30.19
+      sirv: 3.0.2
+      tinyrainbow: 2.0.0
+      vitest: 3.2.4(@types/debug@4.1.12)(@types/node@24.6.2)(@vitest/browser@3.2.4)(jiti@2.6.1)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      ws: 8.18.3
+    optionalDependencies:
+      playwright: 1.55.1
+    transitivePeerDependencies:
+      - bufferutil
+      - msw
+      - utf-8-validate
+      - vite
+    optional: true
+
   '@vitest/coverage-v8@3.2.4(@vitest/browser@3.2.4)(vitest@3.2.4)':
     dependencies:
       '@ampproject/remapping': 2.3.0
@@ -18170,9 +18197,9 @@ snapshots:
       std-env: 3.9.0
       test-exclude: 7.0.1
       tinyrainbow: 2.0.0
-      vitest: 3.2.4(@types/debug@4.1.12)(@types/node@24.6.1)(@vitest/browser@3.2.4)(jiti@2.6.1)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vitest: 3.2.4(@types/debug@4.1.12)(@types/node@24.6.2)(@vitest/browser@3.2.4)(jiti@1.21.7)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     optionalDependencies:
-      '@vitest/browser': 3.2.4(playwright@1.55.1)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)
+      '@vitest/browser': 3.2.4(playwright@1.55.1)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)
     transitivePeerDependencies:
       - supports-color
 
@@ -18184,13 +18211,21 @@ snapshots:
       chai: 5.3.3
       tinyrainbow: 2.0.0
 
-  '@vitest/mocker@3.2.4(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
+  '@vitest/mocker@3.2.4(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
+    dependencies:
+      '@vitest/spy': 3.2.4
+      estree-walker: 3.0.3
+      magic-string: 0.30.19
+    optionalDependencies:
+      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+
+  '@vitest/mocker@3.2.4(vite@7.1.8(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
       '@vitest/spy': 3.2.4
       estree-walker: 3.0.3
       magic-string: 0.30.19
     optionalDependencies:
-      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.8(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
 
   '@vitest/pretty-format@3.2.4':
     dependencies:
@@ -18423,7 +18458,7 @@ snapshots:
 
   autoprefixer@10.4.21(postcss@8.5.6):
     dependencies:
-      browserslist: 4.26.2
+      browserslist: 4.26.3
       caniuse-lite: 1.0.30001746
       fraction.js: 4.3.7
       normalize-range: 0.1.2
@@ -18506,7 +18541,7 @@ snapshots:
 
   base64-js@1.5.1: {}
 
-  baseline-browser-mapping@2.8.9: {}
+  baseline-browser-mapping@2.8.10: {}
 
   bcp-47-match@2.0.3: {}
 
@@ -18524,10 +18559,10 @@ snapshots:
 
   bintrees@1.0.2: {}
 
-  bippy@0.3.27(@types/react@19.1.16)(react@19.1.1):
+  bippy@0.3.27(@types/react@19.2.0)(react@19.2.0):
     dependencies:
-      '@types/react-reconciler': 0.28.9(@types/react@19.1.16)
-      react: 19.1.1
+      '@types/react-reconciler': 0.28.9(@types/react@19.2.0)
+      react: 19.2.0
     transitivePeerDependencies:
       - '@types/react'
 
@@ -18557,13 +18592,13 @@ snapshots:
     dependencies:
       fill-range: 7.1.1
 
-  browserslist@4.26.2:
+  browserslist@4.26.3:
     dependencies:
-      baseline-browser-mapping: 2.8.9
+      baseline-browser-mapping: 2.8.10
       caniuse-lite: 1.0.30001746
       electron-to-chromium: 1.5.228
       node-releases: 2.0.21
-      update-browserslist-db: 1.1.3(browserslist@4.26.2)
+      update-browserslist-db: 1.1.3(browserslist@4.26.3)
 
   buffer-equal-constant-time@1.0.1: {}
 
@@ -18660,9 +18695,9 @@ snapshots:
 
   ccount@2.0.1: {}
 
-  ce-la-react@0.3.1(react@19.1.1):
+  ce-la-react@0.3.1(react@19.2.0):
     dependencies:
-      react: 19.1.1
+      react: 19.2.0
 
   chai@5.3.3:
     dependencies:
@@ -18765,14 +18800,14 @@ snapshots:
 
   clsx@2.1.1: {}
 
-  cmdk@1.1.1(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
+  cmdk@1.1.1(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0):
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-dialog': 1.1.15(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.1.16)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-dialog': 1.1.15(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     transitivePeerDependencies:
       - '@types/react'
       - '@types/react-dom'
@@ -18856,7 +18891,7 @@ snapshots:
 
   core-js-compat@3.45.1:
     dependencies:
-      browserslist: 4.26.2
+      browserslist: 4.26.3
 
   core-js@3.45.1:
     optional: true
@@ -19218,11 +19253,11 @@ snapshots:
     dependencies:
       embla-carousel: 8.6.0
 
-  embla-carousel-react@8.6.0(react@19.1.1):
+  embla-carousel-react@8.6.0(react@19.2.0):
     dependencies:
       embla-carousel: 8.6.0
       embla-carousel-reactive-utils: 8.6.0(embla-carousel@8.6.0)
-      react: 19.1.1
+      react: 19.2.0
 
   embla-carousel-reactive-utils@8.6.0(embla-carousel@8.6.0):
     dependencies:
@@ -19252,7 +19287,7 @@ snapshots:
   enhanced-resolve@5.18.3:
     dependencies:
       graceful-fs: 4.2.11
-      tapable: 2.2.3
+      tapable: 2.3.0
 
   entities@2.2.0: {}
 
@@ -19769,15 +19804,15 @@ snapshots:
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
 
-  framer-motion@12.23.22(@emotion/is-prop-valid@1.3.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
+  framer-motion@12.23.22(@emotion/is-prop-valid@1.3.1)(react-dom@19.2.0(react@19.2.0))(react@19.2.0):
     dependencies:
       motion-dom: 12.23.21
       motion-utils: 12.23.6
       tslib: 2.8.1
     optionalDependencies:
       '@emotion/is-prop-valid': 1.3.1
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
 
   fs-constants@1.0.0:
     optional: true
@@ -20300,7 +20335,7 @@ snapshots:
     optionalDependencies:
       typescript: 5.9.2
 
-  i18next@25.5.2(typescript@5.9.3):
+  i18next@25.5.3(typescript@5.9.3):
     dependencies:
       '@babel/runtime': 7.28.4
     optionalDependencies:
@@ -20351,10 +20386,10 @@ snapshots:
 
   inline-style-parser@0.2.4: {}
 
-  input-otp@1.4.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
+  input-otp@1.4.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0):
     dependencies:
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
 
   inquirer-file-selector@0.4.0:
     dependencies:
@@ -20706,7 +20741,7 @@ snapshots:
       json-schema: 0.4.0
       verror: 1.10.0
 
-  jsx-email@2.7.3(@emotion/is-prop-valid@1.3.1)(@jsx-email/plugin-inline@1.0.1)(@jsx-email/plugin-minify@1.0.1)(@jsx-email/plugin-pretty@1.0.0)(@types/node@24.5.2)(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(lightningcss@1.30.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(terser@5.44.0)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2))(typescript@5.9.2):
+  jsx-email@2.7.3(@emotion/is-prop-valid@1.3.1)(@jsx-email/plugin-inline@1.0.1)(@jsx-email/plugin-minify@1.0.1)(@jsx-email/plugin-pretty@1.0.0)(@types/node@24.5.2)(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(lightningcss@1.30.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(terser@5.44.0)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2))(typescript@5.9.2):
     dependencies:
       '@dot/log': 0.1.5
       '@jsx-email/doiuse-email': 1.0.4
@@ -20715,12 +20750,12 @@ snapshots:
       '@jsx-email/plugin-pretty': 1.0.0(jsx-email@2.7.3)
       '@parcel/watcher': 2.5.1
       '@radix-ui/colors': 3.0.0
-      '@radix-ui/react-collapsible': 1.1.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-collapsible': 1.1.1(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-icons': 1.3.2(react@19.1.1)
-      '@radix-ui/react-popover': 1.1.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-select': 2.2.6(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-popover': 1.1.2(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-select': 2.2.6(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-slot': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-toggle-group': 1.1.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-toggle-group': 1.1.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@unocss/core': 0.65.4
       '@unocss/preset-rem-to-px': 0.65.4
       '@unocss/preset-typography': 0.65.4
@@ -20801,10 +20836,10 @@ snapshots:
 
   kleur@4.1.5: {}
 
-  knip@5.64.1(@types/node@24.6.1)(typescript@5.9.3):
+  knip@5.64.1(@types/node@24.6.2)(typescript@5.9.3):
     dependencies:
       '@nodelib/fs.walk': 1.2.8
-      '@types/node': 24.6.1
+      '@types/node': 24.6.2
       fast-glob: 3.3.3
       formatly: 0.3.0
       jiti: 2.6.1
@@ -20979,9 +21014,9 @@ snapshots:
     dependencies:
       yallist: 3.1.1
 
-  lucide-react@0.542.0(react@19.1.1):
+  lucide-react@0.542.0(react@19.2.0):
     dependencies:
-      react: 19.1.1
+      react: 19.2.0
 
   lz-string@1.5.0: {}
 
@@ -21150,15 +21185,15 @@ snapshots:
 
   mdurl@2.0.0: {}
 
-  media-chrome@4.13.1(react@19.1.1):
+  media-chrome@4.13.1(react@19.2.0):
     dependencies:
-      ce-la-react: 0.3.1(react@19.1.1)
+      ce-la-react: 0.3.1(react@19.2.0)
     transitivePeerDependencies:
       - react
 
-  merge-refs@1.3.0(@types/react@19.1.16):
+  merge-refs@1.3.0(@types/react@19.2.0):
     optionalDependencies:
-      '@types/react': 19.1.16
+      '@types/react': 19.2.0
 
   merge2@1.4.1: {}
 
@@ -21440,14 +21475,14 @@ snapshots:
 
   motion-utils@12.23.6: {}
 
-  motion@12.23.22(@emotion/is-prop-valid@1.3.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
+  motion@12.23.22(@emotion/is-prop-valid@1.3.1)(react-dom@19.2.0(react@19.2.0))(react@19.2.0):
     dependencies:
-      framer-motion: 12.23.22(@emotion/is-prop-valid@1.3.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      framer-motion: 12.23.22(@emotion/is-prop-valid@1.3.1)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       tslib: 2.8.1
     optionalDependencies:
       '@emotion/is-prop-valid': 1.3.1
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
 
   mri@1.2.0: {}
 
@@ -21844,9 +21879,9 @@ snapshots:
       mlly: 1.8.0
       pathe: 2.0.3
 
-  player.style@0.2.0(react@19.1.1):
+  player.style@0.2.0(react@19.2.0):
     dependencies:
-      media-chrome: 4.13.1(react@19.1.1)
+      media-chrome: 4.13.1(react@19.2.0)
     transitivePeerDependencies:
       - react
 
@@ -21880,13 +21915,14 @@ snapshots:
       postcss: 8.5.6
       ts-node: 10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2)
 
-  postcss-load-config@4.0.2(postcss@8.5.6)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.6.1)(typescript@5.9.3)):
+  postcss-load-config@6.0.1(jiti@1.21.7)(postcss@8.5.6)(tsx@4.20.6)(yaml@2.8.1):
     dependencies:
       lilconfig: 3.1.3
-      yaml: 2.8.1
     optionalDependencies:
+      jiti: 1.21.7
       postcss: 8.5.6
-      ts-node: 10.9.2(@swc/core@1.7.26)(@types/node@24.6.1)(typescript@5.9.3)
+      tsx: 4.20.6
+      yaml: 2.8.1
 
   postcss-load-config@6.0.1(jiti@2.6.1)(postcss@8.5.6)(tsx@4.20.3)(yaml@2.8.1):
     dependencies:
@@ -22153,9 +22189,9 @@ snapshots:
 
   punycode@2.3.1: {}
 
-  qrcode.react@4.2.0(react@19.1.1):
+  qrcode.react@4.2.0(react@19.2.0):
     dependencies:
-      react: 19.1.1
+      react: 19.2.0
 
   qs@6.5.3: {}
 
@@ -22191,18 +22227,18 @@ snapshots:
       strip-json-comments: 2.0.1
     optional: true
 
-  react-data-grid@7.0.0-beta.57(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
+  react-data-grid@7.0.0-beta.57(react-dom@19.2.0(react@19.2.0))(react@19.2.0):
     dependencies:
       clsx: 2.1.1
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
 
-  react-day-picker@9.11.0(react@19.1.1):
+  react-day-picker@9.11.0(react@19.2.0):
     dependencies:
       '@date-fns/tz': 1.4.1
       date-fns: 4.1.0
       date-fns-jalali: 4.1.0-0
-      react: 19.1.1
+      react: 19.2.0
 
   react-docgen-typescript@2.4.0(typescript@5.9.3):
     dependencies:
@@ -22228,14 +22264,19 @@ snapshots:
       react: 19.1.1
       scheduler: 0.26.0
 
-  react-error-boundary@6.0.0(react@19.1.1):
+  react-dom@19.2.0(react@19.2.0):
+    dependencies:
+      react: 19.2.0
+      scheduler: 0.27.0
+
+  react-error-boundary@6.0.0(react@19.2.0):
     dependencies:
       '@babel/runtime': 7.28.4
-      react: 19.1.1
+      react: 19.2.0
 
-  react-hook-form@7.63.0(react@19.1.1):
+  react-hook-form@7.63.0(react@19.2.0):
     dependencies:
-      react: 19.1.1
+      react: 19.2.0
 
   react-i18next@15.7.3(i18next@25.5.2(typescript@5.9.2))(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(typescript@5.9.2):
     dependencies:
@@ -22247,25 +22288,25 @@ snapshots:
       react-dom: 19.1.1(react@19.1.1)
       typescript: 5.9.2
 
-  react-i18next@15.7.4(i18next@25.5.2(typescript@5.9.3))(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(typescript@5.9.3):
+  react-i18next@15.7.4(i18next@25.5.3(typescript@5.9.3))(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(typescript@5.9.3):
     dependencies:
       '@babel/runtime': 7.28.4
       html-parse-stringify: 3.0.1
-      i18next: 25.5.2(typescript@5.9.3)
-      react: 19.1.1
+      i18next: 25.5.3(typescript@5.9.3)
+      react: 19.2.0
     optionalDependencies:
-      react-dom: 19.1.1(react@19.1.1)
+      react-dom: 19.2.0(react@19.2.0)
       typescript: 5.9.3
 
-  react-icons@5.5.0(react@19.1.1):
+  react-icons@5.5.0(react@19.2.0):
     dependencies:
-      react: 19.1.1
+      react: 19.2.0
 
-  react-intersection-observer@9.16.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
+  react-intersection-observer@9.16.0(react-dom@19.2.0(react@19.2.0))(react@19.2.0):
     dependencies:
-      react: 19.1.1
+      react: 19.2.0
     optionalDependencies:
-      react-dom: 19.1.1(react@19.1.1)
+      react-dom: 19.2.0(react@19.2.0)
 
   react-is@16.13.1: {}
 
@@ -22275,28 +22316,28 @@ snapshots:
 
   react-lazy-with-preload@2.2.1: {}
 
-  react-pdf@9.2.1(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
+  react-pdf@9.2.1(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0):
     dependencies:
       clsx: 2.1.1
       dequal: 2.0.3
       make-cancellable-promise: 1.3.2
       make-event-props: 1.6.2
-      merge-refs: 1.3.0(@types/react@19.1.16)
+      merge-refs: 1.3.0(@types/react@19.2.0)
       pdfjs-dist: 4.8.69
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
       tiny-invariant: 1.3.3
       warning: 4.0.3
     optionalDependencies:
-      '@types/react': 19.1.16
+      '@types/react': 19.2.0
 
-  react-redux@9.2.0(@types/react@19.1.16)(react@19.1.1)(redux@5.0.1):
+  react-redux@9.2.0(@types/react@19.2.0)(react@19.2.0)(redux@5.0.1):
     dependencies:
       '@types/use-sync-external-store': 0.0.6
-      react: 19.1.1
-      use-sync-external-store: 1.5.0(react@19.1.1)
+      react: 19.2.0
+      use-sync-external-store: 1.6.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
+      '@types/react': 19.2.0
       redux: 5.0.1
 
   react-refresh@0.17.0: {}
@@ -22309,13 +22350,13 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
-  react-remove-scroll-bar@2.3.8(@types/react@19.1.16)(react@19.1.1):
+  react-remove-scroll-bar@2.3.8(@types/react@19.2.0)(react@19.2.0):
     dependencies:
-      react: 19.1.1
-      react-style-singleton: 2.2.3(@types/react@19.1.16)(react@19.1.1)
+      react: 19.2.0
+      react-style-singleton: 2.2.3(@types/react@19.2.0)(react@19.2.0)
       tslib: 2.8.1
     optionalDependencies:
-      '@types/react': 19.1.16
+      '@types/react': 19.2.0
 
   react-remove-scroll@2.6.0(@types/react@19.1.13)(react@19.1.1):
     dependencies:
@@ -22339,21 +22380,21 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
-  react-remove-scroll@2.7.1(@types/react@19.1.16)(react@19.1.1):
+  react-remove-scroll@2.7.1(@types/react@19.2.0)(react@19.2.0):
     dependencies:
-      react: 19.1.1
-      react-remove-scroll-bar: 2.3.8(@types/react@19.1.16)(react@19.1.1)
-      react-style-singleton: 2.2.3(@types/react@19.1.16)(react@19.1.1)
+      react: 19.2.0
+      react-remove-scroll-bar: 2.3.8(@types/react@19.2.0)(react@19.2.0)
+      react-style-singleton: 2.2.3(@types/react@19.2.0)(react@19.2.0)
       tslib: 2.8.1
-      use-callback-ref: 1.3.3(@types/react@19.1.16)(react@19.1.1)
-      use-sidecar: 1.1.3(@types/react@19.1.16)(react@19.1.1)
+      use-callback-ref: 1.3.3(@types/react@19.2.0)(react@19.2.0)
+      use-sidecar: 1.1.3(@types/react@19.2.0)(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.16
+      '@types/react': 19.2.0
 
-  react-resizable-panels@3.0.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
+  react-resizable-panels@3.0.6(react-dom@19.2.0(react@19.2.0))(react@19.2.0):
     dependencies:
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
 
   react-router-dom@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
     dependencies:
@@ -22361,6 +22402,13 @@ snapshots:
       react-dom: 19.1.1(react@19.1.1)
       react-router: 7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
 
+  react-router-dom@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0):
+    dependencies:
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
+      react-router: 7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+    optional: true
+
   react-router@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
     dependencies:
       cookie: 1.0.2
@@ -22370,30 +22418,40 @@ snapshots:
     optionalDependencies:
       react-dom: 19.1.1(react@19.1.1)
 
-  react-scan@0.4.3(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react-router-dom@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react-router@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react@19.1.1)(rollup@2.79.2):
+  react-router@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0):
+    dependencies:
+      cookie: 1.0.2
+      react: 19.2.0
+      set-cookie-parser: 2.7.1
+      turbo-stream: 2.4.0
+    optionalDependencies:
+      react-dom: 19.2.0(react@19.2.0)
+    optional: true
+
+  react-scan@0.4.3(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react-router-dom@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react-router@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react@19.2.0)(rollup@2.79.2):
     dependencies:
       '@babel/core': 7.28.4
       '@babel/generator': 7.28.3
       '@babel/types': 7.28.4
       '@clack/core': 0.3.5
       '@clack/prompts': 0.8.2
-      '@pivanov/utils': 0.0.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@pivanov/utils': 0.0.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@preact/signals': 1.3.2(preact@10.27.2)
       '@rollup/pluginutils': 5.3.0(rollup@2.79.2)
       '@types/node': 20.19.19
-      bippy: 0.3.27(@types/react@19.1.16)(react@19.1.1)
+      bippy: 0.3.27(@types/react@19.2.0)(react@19.2.0)
       esbuild: 0.25.10
       estree-walker: 3.0.3
       kleur: 4.1.5
       mri: 1.2.0
       playwright: 1.55.1
       preact: 10.27.2
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
       tsx: 4.20.6
     optionalDependencies:
-      react-router: 7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      react-router-dom: 7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      react-router: 7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      react-router-dom: 7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       unplugin: 2.1.0
     transitivePeerDependencies:
       - '@types/react'
@@ -22408,20 +22466,22 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
-  react-style-singleton@2.2.3(@types/react@19.1.16)(react@19.1.1):
+  react-style-singleton@2.2.3(@types/react@19.2.0)(react@19.2.0):
     dependencies:
       get-nonce: 1.0.1
-      react: 19.1.1
+      react: 19.2.0
       tslib: 2.8.1
     optionalDependencies:
-      '@types/react': 19.1.16
+      '@types/react': 19.2.0
 
-  react-use-downloader@1.3.0(react@19.1.1):
+  react-use-downloader@1.3.0(react@19.2.0):
     dependencies:
-      react: 19.1.1
+      react: 19.2.0
 
   react@19.1.1: {}
 
+  react@19.2.0: {}
+
   read-cache@1.0.0:
     dependencies:
       pify: 2.3.0
@@ -22448,21 +22508,21 @@ snapshots:
       tiny-invariant: 1.3.3
       tslib: 2.8.1
 
-  recharts@3.2.1(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react-is@18.3.1)(react@19.1.1)(redux@5.0.1):
+  recharts@3.2.1(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react-is@18.3.1)(react@19.2.0)(redux@5.0.1):
     dependencies:
-      '@reduxjs/toolkit': 2.9.0(react-redux@9.2.0(@types/react@19.1.16)(react@19.1.1)(redux@5.0.1))(react@19.1.1)
+      '@reduxjs/toolkit': 2.9.0(react-redux@9.2.0(@types/react@19.2.0)(react@19.2.0)(redux@5.0.1))(react@19.2.0)
       clsx: 2.1.1
       decimal.js-light: 2.5.1
       es-toolkit: 1.39.10
       eventemitter3: 5.0.1
       immer: 10.1.3
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
       react-is: 18.3.1
-      react-redux: 9.2.0(@types/react@19.1.16)(react@19.1.1)(redux@5.0.1)
+      react-redux: 9.2.0(@types/react@19.2.0)(react@19.2.0)(redux@5.0.1)
       reselect: 5.1.1
       tiny-invariant: 1.3.3
-      use-sync-external-store: 1.5.0(react@19.1.1)
+      use-sync-external-store: 1.6.0(react@19.2.0)
       victory-vendor: 37.3.6
     transitivePeerDependencies:
       - '@types/react'
@@ -22795,7 +22855,7 @@ snapshots:
       glob: 11.0.3
       package-json-from-dist: 1.0.1
 
-  rollup-plugin-visualizer@6.0.3(rollup@2.79.2):
+  rollup-plugin-visualizer@6.0.4(rollup@2.79.2):
     dependencies:
       open: 8.4.2
       picomatch: 4.0.3
@@ -22928,6 +22988,8 @@ snapshots:
 
   scheduler@0.26.0: {}
 
+  scheduler@0.27.0: {}
+
   secure-json-parse@4.0.0: {}
 
   selderee@0.11.0:
@@ -23069,10 +23131,10 @@ snapshots:
     dependencies:
       atomic-sleep: 1.0.0
 
-  sonner@2.0.7(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
+  sonner@2.0.7(react-dom@19.2.0(react@19.2.0))(react@19.2.0):
     dependencies:
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
 
   source-map-js@1.2.1: {}
 
@@ -23121,13 +23183,13 @@ snapshots:
       es-errors: 1.3.0
       internal-slot: 1.1.0
 
-  storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)):
+  storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)):
     dependencies:
       '@storybook/global': 5.0.0
-      '@testing-library/jest-dom': 6.9.0
+      '@testing-library/jest-dom': 6.9.1
       '@testing-library/user-event': 14.6.1(@testing-library/dom@10.4.1)
       '@vitest/expect': 3.2.4
-      '@vitest/mocker': 3.2.4(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      '@vitest/mocker': 3.2.4(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@vitest/spy': 3.2.4
       better-opn: 3.0.2
       esbuild: 0.25.10
@@ -23284,13 +23346,13 @@ snapshots:
 
   tailwind-merge@3.3.1: {}
 
-  tailwindcss-animate@1.0.7(tailwindcss@3.4.17(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.6.1)(typescript@5.9.3))):
+  tailwindcss-animate@1.0.7(tailwindcss@3.4.18(tsx@4.20.6)(yaml@2.8.1)):
     dependencies:
-      tailwindcss: 3.4.17(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.6.1)(typescript@5.9.3))
+      tailwindcss: 3.4.18(tsx@4.20.6)(yaml@2.8.1)
 
-  tailwindcss-animate@1.0.7(tailwindcss@4.1.13):
+  tailwindcss-animate@1.0.7(tailwindcss@4.1.14):
     dependencies:
-      tailwindcss: 4.1.13
+      tailwindcss: 4.1.14
 
   tailwindcss@3.4.15(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2)):
     dependencies:
@@ -23319,7 +23381,7 @@ snapshots:
     transitivePeerDependencies:
       - ts-node
 
-  tailwindcss@3.4.17(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.6.1)(typescript@5.9.3)):
+  tailwindcss@3.4.18(tsx@4.20.6)(yaml@2.8.1):
     dependencies:
       '@alloc/quick-lru': 5.2.0
       arg: 5.0.2
@@ -23338,17 +23400,18 @@ snapshots:
       postcss: 8.5.6
       postcss-import: 15.1.0(postcss@8.5.6)
       postcss-js: 4.1.0(postcss@8.5.6)
-      postcss-load-config: 4.0.2(postcss@8.5.6)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.6.1)(typescript@5.9.3))
+      postcss-load-config: 6.0.1(jiti@1.21.7)(postcss@8.5.6)(tsx@4.20.6)(yaml@2.8.1)
       postcss-nested: 6.2.0(postcss@8.5.6)
       postcss-selector-parser: 6.1.2
       resolve: 1.22.10
       sucrase: 3.35.0
     transitivePeerDependencies:
-      - ts-node
+      - tsx
+      - yaml
 
-  tailwindcss@4.1.13: {}
+  tailwindcss@4.1.14: {}
 
-  tapable@2.2.3: {}
+  tapable@2.3.0: {}
 
   tar-fs@2.1.4:
     dependencies:
@@ -23522,27 +23585,6 @@ snapshots:
       '@swc/core': 1.7.26
     optional: true
 
-  ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.6.1)(typescript@5.9.3):
-    dependencies:
-      '@cspotcode/source-map-support': 0.8.1
-      '@tsconfig/node10': 1.0.11
-      '@tsconfig/node12': 1.0.11
-      '@tsconfig/node14': 1.0.3
-      '@tsconfig/node16': 1.0.4
-      '@types/node': 24.6.1
-      acorn: 8.15.0
-      acorn-walk: 8.3.4
-      arg: 4.1.3
-      create-require: 1.1.1
-      diff: 4.0.2
-      make-error: 1.3.6
-      typescript: 5.9.3
-      v8-compile-cache-lib: 3.0.1
-      yn: 3.1.1
-    optionalDependencies:
-      '@swc/core': 1.7.26
-    optional: true
-
   tsconfck@3.1.6(typescript@5.9.3):
     optionalDependencies:
       typescript: 5.9.3
@@ -23826,9 +23868,9 @@ snapshots:
 
   upath@1.2.0: {}
 
-  update-browserslist-db@1.1.3(browserslist@4.26.2):
+  update-browserslist-db@1.1.3(browserslist@4.26.3):
     dependencies:
-      browserslist: 4.26.2
+      browserslist: 4.26.3
       escalade: 3.2.0
       picocolors: 1.1.1
 
@@ -23848,21 +23890,21 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
-  use-callback-ref@1.3.3(@types/react@19.1.16)(react@19.1.1):
+  use-callback-ref@1.3.3(@types/react@19.2.0)(react@19.2.0):
     dependencies:
-      react: 19.1.1
+      react: 19.2.0
       tslib: 2.8.1
     optionalDependencies:
-      '@types/react': 19.1.16
+      '@types/react': 19.2.0
 
-  use-count-up@3.0.1(react@19.1.1):
+  use-count-up@3.0.1(react@19.2.0):
     dependencies:
-      react: 19.1.1
-      use-elapsed-time: 3.0.2(react@19.1.1)
+      react: 19.2.0
+      use-elapsed-time: 3.0.2(react@19.2.0)
 
-  use-elapsed-time@3.0.2(react@19.1.1):
+  use-elapsed-time@3.0.2(react@19.2.0):
     dependencies:
-      react: 19.1.1
+      react: 19.2.0
 
   use-sidecar@1.1.3(@types/react@19.1.13)(react@19.1.1):
     dependencies:
@@ -23872,17 +23914,17 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
-  use-sidecar@1.1.3(@types/react@19.1.16)(react@19.1.1):
+  use-sidecar@1.1.3(@types/react@19.2.0)(react@19.2.0):
     dependencies:
       detect-node-es: 1.1.0
-      react: 19.1.1
+      react: 19.2.0
       tslib: 2.8.1
     optionalDependencies:
-      '@types/react': 19.1.16
+      '@types/react': 19.2.0
 
-  use-sync-external-store@1.5.0(react@19.1.1):
+  use-sync-external-store@1.6.0(react@19.2.0):
     dependencies:
-      react: 19.1.1
+      react: 19.2.0
 
   util-deprecate@1.0.2: {}
 
@@ -23904,11 +23946,11 @@ snapshots:
 
   validate-npm-package-name@5.0.1: {}
 
-  vaul@1.1.2(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
+  vaul@1.1.2(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0):
     dependencies:
-      '@radix-ui/react-dialog': 1.1.15(@types/react-dom@19.1.9(@types/react@19.1.16))(@types/react@19.1.16)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-dialog': 1.1.15(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     transitivePeerDependencies:
       - '@types/react'
       - '@types/react-dom'
@@ -23951,20 +23993,41 @@ snapshots:
       d3-time: 3.1.0
       d3-timer: 3.0.1
 
-  virtua@0.43.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(solid-js@1.9.9)(vue@3.5.13(typescript@5.9.3)):
+  virtua@0.43.6(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(solid-js@1.9.9)(vue@3.5.13(typescript@5.9.3)):
     optionalDependencies:
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
       solid-js: 1.9.9
       vue: 3.5.13(typescript@5.9.3)
 
-  vite-node@3.2.4(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1):
+  vite-node@3.2.4(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1):
+    dependencies:
+      cac: 6.7.14
+      debug: 4.4.3
+      es-module-lexer: 1.7.0
+      pathe: 2.0.3
+      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+    transitivePeerDependencies:
+      - '@types/node'
+      - jiti
+      - less
+      - lightningcss
+      - sass
+      - sass-embedded
+      - stylus
+      - sugarss
+      - supports-color
+      - terser
+      - tsx
+      - yaml
+
+  vite-node@3.2.4(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1):
     dependencies:
       cac: 6.7.14
       debug: 4.4.3
       es-module-lexer: 1.7.0
       pathe: 2.0.3
-      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.8(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - '@types/node'
       - jiti
@@ -23979,7 +24042,7 @@ snapshots:
       - tsx
       - yaml
 
-  vite-plugin-html@3.2.2(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)):
+  vite-plugin-html@3.2.2(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)):
     dependencies:
       '@rollup/pluginutils': 4.2.1
       colorette: 2.0.20
@@ -23993,35 +24056,35 @@ snapshots:
       html-minifier-terser: 6.1.0
       node-html-parser: 5.4.2
       pathe: 0.2.0
-      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
 
-  vite-plugin-pwa@1.0.3(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(workbox-build@7.3.0(@types/babel__core@7.20.5))(workbox-window@7.3.0):
+  vite-plugin-pwa@1.0.3(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(workbox-build@7.3.0(@types/babel__core@7.20.5))(workbox-window@7.3.0):
     dependencies:
       debug: 4.4.3
       pretty-bytes: 6.1.1
       tinyglobby: 0.2.15
-      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
       workbox-build: 7.3.0(@types/babel__core@7.20.5)
       workbox-window: 7.3.0
     transitivePeerDependencies:
       - supports-color
 
-  vite-plugin-static-copy@3.1.3(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)):
+  vite-plugin-static-copy@3.1.3(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)):
     dependencies:
       chokidar: 3.6.0
       fs-extra: 11.3.2
       p-map: 7.0.3
       picocolors: 1.1.1
       tinyglobby: 0.2.15
-      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
 
-  vite-tsconfig-paths@5.1.4(typescript@5.9.3)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)):
+  vite-tsconfig-paths@5.1.4(typescript@5.9.3)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)):
     dependencies:
       debug: 4.4.3
       globrex: 0.1.2
       tsconfck: 3.1.6(typescript@5.9.3)
     optionalDependencies:
-      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - supports-color
       - typescript
@@ -24037,7 +24100,7 @@ snapshots:
       lightningcss: 1.30.1
       terser: 5.44.0
 
-  vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1):
+  vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1):
     dependencies:
       esbuild: 0.25.10
       fdir: 6.5.0(picomatch@4.0.3)
@@ -24046,7 +24109,24 @@ snapshots:
       rollup: 4.52.3
       tinyglobby: 0.2.15
     optionalDependencies:
-      '@types/node': 24.6.1
+      '@types/node': 24.6.2
+      fsevents: 2.3.3
+      jiti: 1.21.7
+      lightningcss: 1.30.1
+      terser: 5.44.0
+      tsx: 4.20.6
+      yaml: 2.8.1
+
+  vite@7.1.8(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1):
+    dependencies:
+      esbuild: 0.25.10
+      fdir: 6.5.0(picomatch@4.0.3)
+      picomatch: 4.0.3
+      postcss: 8.5.6
+      rollup: 4.52.3
+      tinyglobby: 0.2.15
+    optionalDependencies:
+      '@types/node': 24.6.2
       fsevents: 2.3.3
       jiti: 2.6.1
       lightningcss: 1.30.1
@@ -24054,11 +24134,11 @@ snapshots:
       tsx: 4.20.6
       yaml: 2.8.1
 
-  vitest@3.2.4(@types/debug@4.1.12)(@types/node@24.6.1)(@vitest/browser@3.2.4)(jiti@2.6.1)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1):
+  vitest@3.2.4(@types/debug@4.1.12)(@types/node@24.6.2)(@vitest/browser@3.2.4)(jiti@1.21.7)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1):
     dependencies:
       '@types/chai': 5.2.2
       '@vitest/expect': 3.2.4
-      '@vitest/mocker': 3.2.4(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      '@vitest/mocker': 3.2.4(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@vitest/pretty-format': 3.2.4
       '@vitest/runner': 3.2.4
       '@vitest/snapshot': 3.2.4
@@ -24076,13 +24156,57 @@ snapshots:
       tinyglobby: 0.2.15
       tinypool: 1.1.1
       tinyrainbow: 2.0.0
-      vite: 7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
-      vite-node: 3.2.4(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite-node: 3.2.4(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
       why-is-node-running: 2.3.0
     optionalDependencies:
       '@types/debug': 4.1.12
-      '@types/node': 24.6.1
-      '@vitest/browser': 3.2.4(playwright@1.55.1)(vite@7.1.7(@types/node@24.6.1)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)
+      '@types/node': 24.6.2
+      '@vitest/browser': 3.2.4(playwright@1.55.1)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)
+      jsdom: 26.1.0(canvas@3.2.0)
+    transitivePeerDependencies:
+      - jiti
+      - less
+      - lightningcss
+      - msw
+      - sass
+      - sass-embedded
+      - stylus
+      - sugarss
+      - supports-color
+      - terser
+      - tsx
+      - yaml
+
+  vitest@3.2.4(@types/debug@4.1.12)(@types/node@24.6.2)(@vitest/browser@3.2.4)(jiti@2.6.1)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1):
+    dependencies:
+      '@types/chai': 5.2.2
+      '@vitest/expect': 3.2.4
+      '@vitest/mocker': 3.2.4(vite@7.1.8(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      '@vitest/pretty-format': 3.2.4
+      '@vitest/runner': 3.2.4
+      '@vitest/snapshot': 3.2.4
+      '@vitest/spy': 3.2.4
+      '@vitest/utils': 3.2.4
+      chai: 5.3.3
+      debug: 4.4.3
+      expect-type: 1.2.2
+      magic-string: 0.30.19
+      pathe: 2.0.3
+      picomatch: 4.0.3
+      std-env: 3.9.0
+      tinybench: 2.9.0
+      tinyexec: 0.3.2
+      tinyglobby: 0.2.15
+      tinypool: 1.1.1
+      tinyrainbow: 2.0.0
+      vite: 7.1.8(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite-node: 3.2.4(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      why-is-node-running: 2.3.0
+    optionalDependencies:
+      '@types/debug': 4.1.12
+      '@types/node': 24.6.2
+      '@vitest/browser': 3.2.4(playwright@1.55.1)(vite@7.1.8(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)
       jsdom: 26.1.0(canvas@3.2.0)
     transitivePeerDependencies:
       - jiti
@@ -24438,12 +24562,12 @@ snapshots:
 
   zod@4.1.8: {}
 
-  zustand@5.0.8(@types/react@19.1.16)(immer@10.1.3)(react@19.1.1)(use-sync-external-store@1.5.0(react@19.1.1)):
+  zustand@5.0.8(@types/react@19.2.0)(immer@10.1.3)(react@19.2.0)(use-sync-external-store@1.6.0(react@19.2.0)):
     optionalDependencies:
-      '@types/react': 19.1.16
+      '@types/react': 19.2.0
       immer: 10.1.3
-      react: 19.1.1
-      use-sync-external-store: 1.5.0(react@19.1.1)
+      react: 19.2.0
+      use-sync-external-store: 1.6.0(react@19.2.0)
 
   zwitch@2.0.4: {}
 

From e78892877d4a8f556a6ba549b8d6dab704f33fdd Mon Sep 17 00:00:00 2001
From: flipvanhaaren <flip@shareworks.nl>
Date: Fri, 3 Oct 2025 10:11:10 +0200
Subject: [PATCH 38/48] improve: css/styling

---
 frontend/src/modules/common/avatar-wrap.tsx         |  4 ++--
 frontend/src/modules/common/page/header.tsx         |  4 +---
 .../me/{settings-page.tsx => account-page.tsx}      |  6 +++---
 frontend/src/modules/me/entity-invitations.tsx      |  2 +-
 frontend/src/modules/navigation/account-sheet.tsx   | 13 ++++++++++---
 .../src/modules/organizations/table/columns.tsx     |  2 +-
 frontend/src/modules/ui/avatar.tsx                  |  2 +-
 frontend/src/modules/users/profile-page.tsx         |  4 ++--
 frontend/src/modules/users/user-cell.tsx            |  8 +-------
 frontend/src/routes/route-tree.tsx                  |  4 ++--
 frontend/src/routes/user-routes.tsx                 | 10 +++++-----
 locales/en/common.json                              |  7 ++++---
 12 files changed, 33 insertions(+), 33 deletions(-)
 rename frontend/src/modules/me/{settings-page.tsx => account-page.tsx} (98%)

diff --git a/frontend/src/modules/common/avatar-wrap.tsx b/frontend/src/modules/common/avatar-wrap.tsx
index f86571615..b9781cdc3 100644
--- a/frontend/src/modules/common/avatar-wrap.tsx
+++ b/frontend/src/modules/common/avatar-wrap.tsx
@@ -34,14 +34,14 @@ const AvatarWrap = memo(({ type, id, name, icon: Icon, url, className, ...props
       key={url ? 'image' : 'fallback'}
       {...props}
       data-type={type}
-      className={cn('group bg-muted rounded-md data-[type=user]:rounded-full overflow-hidden', className)}
+      className={cn('group rounded-md data-[type=user]:rounded-full overflow-hidden', className)}
     >
       {url ? (
         <AvatarImage src={url} draggable="false" />
       ) : (
         <AvatarFallback className={avatarBackground}>
           <span className="sr-only">{name}</span>
-          <div className="text-black opacity-80 font-semibold flex h-full items-center justify-center">{name?.charAt(0).toUpperCase() || '-'}</div>
+          <div className="text-black opacity-40 font-semibold flex h-full items-center justify-center">{name?.charAt(0).toUpperCase() || '-'}</div>
         </AvatarFallback>
       )}
     </Avatar>
diff --git a/frontend/src/modules/common/page/header.tsx b/frontend/src/modules/common/page/header.tsx
index db8748390..c0029af39 100644
--- a/frontend/src/modules/common/page/header.tsx
+++ b/frontend/src/modules/common/page/header.tsx
@@ -40,9 +40,7 @@ const PageHeader = ({ entity, panel, parent, disableScroll, ...coverProps }: Pag
           type={entity.entityType}
           url={entity.thumbnailUrl}
           className={
-            entity.entityType === 'user'
-              ? 'h-26 w-26 -mt-12 text-4xl ml-2 mr-3 border-bg border-opacity-50 border-2 rounded-full'
-              : 'm-2 text-xl h-12 w-12'
+            entity.entityType === 'user' ? 'h-26 w-26 -mt-13 text-4xl mx-3 shadow-[0_0_0_4px_rgba(0,0,0,0.1)] rounded-full' : 'm-2 text-xl h-12 w-12'
           }
         />
 
diff --git a/frontend/src/modules/me/settings-page.tsx b/frontend/src/modules/me/account-page.tsx
similarity index 98%
rename from frontend/src/modules/me/settings-page.tsx
rename to frontend/src/modules/me/account-page.tsx
index 4dbe6be85..b760e1032 100644
--- a/frontend/src/modules/me/settings-page.tsx
+++ b/frontend/src/modules/me/account-page.tsx
@@ -35,7 +35,7 @@ const tabs = [
 
 const enabledStrategies = appConfig.enabledAuthStrategies;
 
-const UserSettingsPage = () => {
+const UserAccountPage = () => {
   const { t } = useTranslation();
   const { user } = useUserStore();
   const mode = useUIStore((state) => state.mode);
@@ -104,7 +104,7 @@ const UserSettingsPage = () => {
     <div className="container md:flex md:flex-row my-4 md:mt-8 mx-auto gap-4 ">
       <div className="max-md:hidden mx-auto md:min-w-48 md:w-[30%] md:mt-3">
         <StickyBox className="z-10 max-md:block!">
-          <SimpleHeader className="p-3" heading="common:settings" text="common:settings.text" />
+          <SimpleHeader className="p-3" heading="common:my_account" text="common:my_account.text" />
           <PageAside tabs={tabs} className="py-2" setFocus />
         </StickyBox>
       </div>
@@ -278,4 +278,4 @@ const UserSettingsPage = () => {
   );
 };
 
-export default UserSettingsPage;
+export default UserAccountPage;
diff --git a/frontend/src/modules/me/entity-invitations.tsx b/frontend/src/modules/me/entity-invitations.tsx
index 0f1e97bcb..a1ad1ca86 100644
--- a/frontend/src/modules/me/entity-invitations.tsx
+++ b/frontend/src/modules/me/entity-invitations.tsx
@@ -72,7 +72,7 @@ export const EntityInvitations = () => {
                   <Link to={to} params={params} search={search} draggable="false" className="flex space-x-2 items-center outline-0 ring-0 group">
                     <AvatarWrap
                       type="organization"
-                      className="h-10 w-10 group-active:translate-y-[.05rem] group-hover:font-bold"
+                      className="h-10 w-10 group-active:translate-y-[.05rem]"
                       id={entity.id}
                       name={entity.name}
                       url={entity.thumbnailUrl}
diff --git a/frontend/src/modules/navigation/account-sheet.tsx b/frontend/src/modules/navigation/account-sheet.tsx
index 6a25eabec..b0027c727 100644
--- a/frontend/src/modules/navigation/account-sheet.tsx
+++ b/frontend/src/modules/navigation/account-sheet.tsx
@@ -73,7 +73,7 @@ export const AccountSheet = () => {
             style={user.bannerUrl ? { backgroundImage: `url(${user.bannerUrl})` } : {}}
           >
             <AvatarWrap
-              className="h-16 w-16 absolute top-4 text-2xl left-[50%] -ml-8 border-bg border-2 rounded-full"
+              className="h-16 w-16 absolute top-4 text-2xl left-[50%] -ml-8 rounded-full shadow-[0_0_0_4px_rgba(0,0,0,0.1)]"
               type="user"
               id={user.id}
               name={user.name}
@@ -87,10 +87,17 @@ export const AccountSheet = () => {
             isOnline={isOnline}
             icon={CircleUserRound}
             id="btn-profile"
-            label={t('common:view_item', { item: t('common:profile').toLowerCase() })}
+            label={t('common:view_resource', { resource: t('common:profile').toLowerCase() })}
             action={`/users/${user.slug}`}
           />
-          <AccountButton offlineAccess={false} isOnline={isOnline} icon={Settings} id="btn-account" label={t('common:settings')} action="/settings" />
+          <AccountButton
+            offlineAccess={false}
+            isOnline={isOnline}
+            icon={Settings}
+            id="btn-account"
+            label={t('common:my_account')}
+            action="/account"
+          />
           {isSystemAdmin && (
             <AccountButton
               offlineAccess={false}
diff --git a/frontend/src/modules/organizations/table/columns.tsx b/frontend/src/modules/organizations/table/columns.tsx
index eef1a5393..fbec1427e 100644
--- a/frontend/src/modules/organizations/table/columns.tsx
+++ b/frontend/src/modules/organizations/table/columns.tsx
@@ -36,7 +36,7 @@ export const useColumns = () => {
           >
             <AvatarWrap
               type="organization"
-              className="h-8 w-8 group-active:translate-y-[.05rem] group-hover:font-bold"
+              className="h-8 w-8 group-active:translate-y-[.05rem]"
               id={row.id}
               name={row.name}
               url={row.thumbnailUrl}
diff --git a/frontend/src/modules/ui/avatar.tsx b/frontend/src/modules/ui/avatar.tsx
index a277101fc..4451618ef 100644
--- a/frontend/src/modules/ui/avatar.tsx
+++ b/frontend/src/modules/ui/avatar.tsx
@@ -9,7 +9,7 @@ const Avatar = React.forwardRef<React.ComponentRef<typeof AvatarPrimitive.Root>,
 Avatar.displayName = AvatarPrimitive.Root.displayName;
 
 const AvatarImage = React.forwardRef<React.ComponentRef<typeof AvatarPrimitive.Image>, React.ComponentPropsWithoutRef<typeof AvatarPrimitive.Image>>(
-  ({ className, ...props }, ref) => <AvatarPrimitive.Image ref={ref} className={cn('aspect-square h-full w-full', className)} {...props} />,
+  ({ className, ...props }, ref) => <AvatarPrimitive.Image ref={ref} className={cn('aspect-square h-full w-full bg-muted', className)} {...props} />,
 );
 AvatarImage.displayName = AvatarPrimitive.Image.displayName;
 
diff --git a/frontend/src/modules/users/profile-page.tsx b/frontend/src/modules/users/profile-page.tsx
index 04c968bc5..dad02f6d4 100644
--- a/frontend/src/modules/users/profile-page.tsx
+++ b/frontend/src/modules/users/profile-page.tsx
@@ -76,13 +76,13 @@ const UserProfilePage = ({ idOrSlug, isSheet, orgIdOrSlug }: Props) => {
           isSelf && (
             <div className="max-xs:hidden flex items-center p-2">
               <Link
-                to="/settings"
+                to="/account"
                 draggable="false"
                 tabIndex={0}
                 className="inline-flex items-center justify-center whitespace-nowrap h-9 rounded-md px-3 text-sm font-medium ring-offset-background transition-colors focus-effect bg-primary text-primary-foreground hover:bg-primary/80"
               >
                 <Settings size={16} />
-                <span className="max-sm:hidden ml-1">{t('common:settings')}</span>
+                <span className="max-sm:hidden ml-1">{t('common:my_account')}</span>
               </Link>
             </div>
           )
diff --git a/frontend/src/modules/users/user-cell.tsx b/frontend/src/modules/users/user-cell.tsx
index 7b5e5dde8..7de3c953a 100644
--- a/frontend/src/modules/users/user-cell.tsx
+++ b/frontend/src/modules/users/user-cell.tsx
@@ -49,13 +49,7 @@ export const UserCell = ({ user, orgIdOrSlug, tabIndex }: BaseProps & { user: Us
         });
       }}
     >
-      <AvatarWrap
-        type="user"
-        className="h-8 w-8 group-active:translate-y-[.05rem] group-hover:font-bold"
-        id={user.id}
-        name={user.name}
-        url={user.thumbnailUrl}
-      />
+      <AvatarWrap type="user" className="h-8 w-8 group-active:translate-y-[.05rem]" id={user.id} name={user.name} url={user.thumbnailUrl} />
       <span className="[.isCompact_&]:hidden group-hover:underline underline-offset-3 decoration-foreground/20 group-active:decoration-foreground/50 group-active:translate-y-[.05rem] truncate font-medium">
         {user.name || '-'}
       </span>
diff --git a/frontend/src/routes/route-tree.tsx b/frontend/src/routes/route-tree.tsx
index afea9cc95..f393efece 100644
--- a/frontend/src/routes/route-tree.tsx
+++ b/frontend/src/routes/route-tree.tsx
@@ -15,7 +15,7 @@ import { HomeAliasRoute, HomeRoute, WelcomeRoute } from '~/routes/home-routes';
 import { AboutRoute, AccessibilityRoute, ContactRoute, LegalRoute } from '~/routes/marketing-routes';
 import { OrganizationAttachmentsRoute, OrganizationMembersRoute, OrganizationRoute, OrganizationSettingsRoute } from '~/routes/organization-routes';
 import { MetricsRoute, OrganizationsTableRoute, RequestsTableRoute, SystemRoute, UsersTableRoute } from '~/routes/system-routes';
-import { UserInOrganizationProfileRoute, UserProfileRoute, UserSettingsRoute } from '~/routes/user-routes';
+import { UserAccountRoute, UserInOrganizationProfileRoute, UserProfileRoute } from '~/routes/user-routes';
 
 //App-specific route imports here
 //...
@@ -48,7 +48,7 @@ export const routeTree = RootRoute.addChildren([
     SystemRoute.addChildren([UsersTableRoute, OrganizationsTableRoute, RequestsTableRoute, MetricsRoute]),
     UserProfileRoute,
     UserInOrganizationProfileRoute,
-    UserSettingsRoute,
+    UserAccountRoute,
     OrganizationRoute.addChildren([OrganizationMembersRoute, OrganizationAttachmentsRoute, OrganizationSettingsRoute]),
 
     // App-specific routes here
diff --git a/frontend/src/routes/user-routes.tsx b/frontend/src/routes/user-routes.tsx
index c95c10060..d802fa6e0 100644
--- a/frontend/src/routes/user-routes.tsx
+++ b/frontend/src/routes/user-routes.tsx
@@ -9,7 +9,7 @@ import { AppLayoutRoute } from '~/routes/base-routes';
 import appTitle from '~/utils/app-title';
 
 const UserProfilePage = lazy(() => import('~/modules/users/profile-page'));
-const UserSettingsPage = lazy(() => import('~/modules/me/settings-page'));
+const UserAccountPage = lazy(() => import('~/modules/me/account-page'));
 
 export const UserProfileRoute = createRoute({
   path: '/users/$idOrSlug',
@@ -59,10 +59,10 @@ export const UserInOrganizationProfileRoute = createRoute({
   },
 });
 
-export const UserSettingsRoute = createRoute({
-  path: '/settings',
+export const UserAccountRoute = createRoute({
+  path: '/account',
   staticData: { isAuth: true },
-  head: () => ({ meta: [{ title: appTitle('Settings') }] }),
+  head: () => ({ meta: [{ title: appTitle('My account') }] }),
   getParentRoute: () => AppLayoutRoute,
   loader: async () => {
     const userAuthOptions = meAuthQueryOptions();
@@ -72,7 +72,7 @@ export const UserSettingsRoute = createRoute({
   component: () => {
     return (
       <Suspense fallback={<Spinner className="mt-[45vh] h-10 w-10" />}>
-        <UserSettingsPage />
+        <UserAccountPage />
       </Suspense>
     );
   },
diff --git a/locales/en/common.json b/locales/en/common.json
index 2de43a727..d198217a8 100644
--- a/locales/en/common.json
+++ b/locales/en/common.json
@@ -345,7 +345,7 @@
   "sessions": "Sessions",
   "sessions.text": "Here you can view and terminate your active sessions. Terminating a session will sign you out from that device.",
   "settings": "Settings",
-  "settings.text": "Update your account settings and preferences",
+  "my_account.text": "Update your account settings and preferences",
   "short_name": "Short name",
   "show_advanced_settings": "Show advanced settings",
   "show_all": "Show all",
@@ -468,7 +468,7 @@
   "verify_signin": "Verify & sign in",
   "Video": "Video",
   "view": "View",
-  "view_item": "View {{item}}",
+  "view_resource": "View {{resource}}",
   "visit": "Visit",
   "waitlist": "Waitlist",
   "waitlist_request": "Join waitlist",
@@ -484,5 +484,6 @@
   "require_mfa.text": "Your account does not have MFA enabled. Enabling MFA helps secure your account.",
   "enable_resource": "Enable {{resource}}",
   "mfa_enable_confirmation.text": "Enabling Multi-Factor Authentication adds an extra layer of security to your account.",
-  "reject": "Reject"
+  "reject": "Reject",
+  "my_account": "My account"
 }

From 19b83a5068388dcedfdcf05b9d5df17bc4d265db Mon Sep 17 00:00:00 2001
From: flipvanhaaren <flip@shareworks.nl>
Date: Sat, 4 Oct 2025 12:46:51 +0200
Subject: [PATCH 39/48] improve: openapi consistency

---
 backend/package.json                          |   42 +-
 backend/src/lib/docs.ts                       |   10 +-
 backend/src/modules/auth/general/handlers.ts  |   10 +-
 backend/src/modules/auth/general/routes.ts    |   26 +-
 backend/src/modules/auth/passkeys/handlers.ts |    4 +-
 backend/src/modules/auth/passkeys/routes.ts   |    8 +-
 .../src/modules/auth/passwords/handlers.ts    |    4 +-
 backend/src/modules/auth/passwords/routes.ts  |    8 +-
 backend/src/modules/auth/totps/handlers.ts    |    6 +-
 backend/src/modules/auth/totps/routes.ts      |   11 +-
 backend/src/modules/entities/handlers.ts      |   11 +-
 backend/src/modules/entities/routes.ts        |    9 +-
 backend/src/modules/entities/schema.ts        |   31 +-
 backend/src/modules/me/handlers.ts            |    4 +-
 backend/src/modules/me/routes.ts              |    8 +-
 backend/src/modules/me/schema.ts              |    6 +-
 backend/src/modules/memberships/handlers.ts   |    2 +-
 backend/src/modules/memberships/routes.ts     |    7 +-
 backend/src/modules/organizations/routes.ts   |    3 +-
 backend/src/modules/organizations/schema.ts   |    6 +-
 backend/src/modules/requests/handlers.ts      |    2 +-
 backend/src/modules/requests/routes.ts        |   11 +-
 backend/src/modules/system/handlers.ts        |    4 +-
 backend/src/modules/system/routes.ts          |   18 +-
 backend/src/utils/schema/common.ts            |    4 +-
 backend/src/utils/schema/responses.ts         |   11 +-
 frontend/package.json                         |   28 +-
 frontend/src/api.gen/sdk.gen.ts               |   44 +-
 frontend/src/api.gen/types.gen.ts             |  229 +-
 frontend/src/api.gen/zod.gen.ts               |  224 +-
 .../src/modules/auth/passkey-strategy.tsx     |    5 +-
 frontend/src/modules/auth/totp-strategy.tsx   |    5 +-
 frontend/src/modules/common/error-notice.tsx  |    4 +-
 .../src/modules/common/form-fields/slug.tsx   |   16 +-
 .../src/modules/entities/entity-grid/grid.tsx |    2 +-
 frontend/src/modules/entities/query.ts        |   16 +-
 frontend/src/modules/entities/types.ts        |    3 +-
 frontend/src/modules/home/index.tsx           |    1 +
 frontend/src/modules/me/passkeys/list.tsx     |    2 +-
 frontend/src/modules/me/query.ts              |   10 +-
 .../resend-membership-invitation.tsx          |   10 +-
 frontend/src/modules/navigation/search.tsx    |   19 +-
 .../modules/system/create-newsletter-form.tsx |    8 +-
 package.json                                  |    2 +-
 pnpm-lock.yaml                                | 3551 +++++++----------
 45 files changed, 1873 insertions(+), 2572 deletions(-)

diff --git a/backend/package.json b/backend/package.json
index 9ed07e65a..467f9ec30 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -40,19 +40,19 @@
   },
   "dependencies": {
     "@asteasolutions/zod-to-openapi": "8.1.0",
-    "@aws-sdk/client-s3": "^3.896.0",
-    "@aws-sdk/cloudfront-signer": "^3.893.0",
-    "@aws-sdk/lib-storage": "^3.896.0",
-    "@aws-sdk/s3-request-presigner": "^3.896.0",
+    "@aws-sdk/client-s3": "^3.901.0",
+    "@aws-sdk/cloudfront-signer": "^3.901.0",
+    "@aws-sdk/lib-storage": "^3.901.0",
+    "@aws-sdk/s3-request-presigner": "^3.901.0",
     "@cellajs/permission-manager": "^0.1.0",
     "@dotenv-run/core": "^1.3.8",
     "@electric-sql/pglite": "^0.3.10",
     "@getbrevo/brevo": "2.5.0",
-    "@hono/node-server": "^1.19.4",
+    "@hono/node-server": "^1.19.5",
     "@hono/zod-openapi": "1.1.3",
     "@logtail/node": "^0.5.6",
     "@node-rs/argon2": "^2.0.2",
-    "@novu/api": "^1.6.0",
+    "@novu/api": "^1.7.0",
     "@opentelemetry/api": "^1.9.0",
     "@opentelemetry/instrumentation-http": "^0.205.0",
     "@opentelemetry/resources": "^2.1.0",
@@ -64,19 +64,19 @@
     "@oslojs/otp": "^1.1.0",
     "@oslojs/webauthn": "^1.0.0",
     "@paddle/paddle-node-sdk": "^3.2.1",
-    "@scalar/hono-api-reference": "^0.9.19",
+    "@scalar/hono-api-reference": "^0.9.20",
     "@sendgrid/mail": "^8.1.6",
-    "@sentry/cli": "^2.55.0",
+    "@sentry/cli": "^2.56.0",
     "@sentry/node": "^9.46.0",
     "@sentry/profiling-node": "^9.46.0",
     "@t3-oss/env-core": "^0.13.8",
     "arctic": "^3.7.0",
     "config": "workspace:*",
-    "drizzle-orm": "^0.44.5",
+    "drizzle-orm": "^0.44.6",
     "drizzle-zod": "0.8.3",
     "enforce-unique": "^1.3.0",
     "hono": "4.9.8",
-    "i18next": "^25.5.2",
+    "i18next": "^25.5.3",
     "isbot": "^5.1.31",
     "jsdom": "^26.1.0",
     "jsonwebtoken": "^9.0.2",
@@ -85,13 +85,13 @@
     "nanoid": "^5.1.6",
     "node-html-parser": "^7.0.1",
     "pg": "^8.16.3",
-    "pino": "^9.11.0",
+    "pino": "^9.13.1",
     "pino-http": "^10.5.0",
     "prom-client": "^15.1.3",
     "rate-limiter-flexible": "^7.4.0",
-    "react": "^19.1.1",
-    "react-dom": "^19.1.1",
-    "react-i18next": "^15.7.3",
+    "react": "^19.2.0",
+    "react-dom": "^19.2.0",
+    "react-i18next": "^15.7.4",
     "slugify": "^1.6.6",
     "ua-parser-js": "^2.0.5",
     "zod": "4.1.8"
@@ -102,22 +102,22 @@
     "@ngrok/ngrok": "^1.5.2",
     "@types/jsdom": "^21.1.7",
     "@types/jsonwebtoken": "^9.0.10",
-    "@types/node": "^24.5.2",
+    "@types/node": "^24.6.2",
     "@types/papaparse": "^5.3.16",
     "@types/pg": "^8.15.5",
-    "@types/react": "^19.1.13",
+    "@types/react": "^19.2.0",
     "@types/ua-parser-js": "^0.7.39",
     "@typescript/native-preview": "7.0.0-dev.20250910.1",
     "chalk": "^5.6.2",
     "commander": "^14.0.1",
-    "cross-env": "^10.0.0",
-    "dotenv": "^17.2.2",
-    "drizzle-kit": "^0.31.4",
+    "cross-env": "^10.1.0",
+    "dotenv": "^17.2.3",
+    "drizzle-kit": "^0.31.5",
     "papaparse": "^5.5.3",
     "pino-pretty": "^13.1.1",
     "tsup": "^8.5.0",
-    "tsx": "^4.20.5",
-    "typescript": "^5.9.2"
+    "tsx": "^4.20.6",
+    "typescript": "^5.9.3"
   },
   "exports": {
     "types": "./dist/src/index.d.ts"
diff --git a/backend/src/lib/docs.ts b/backend/src/lib/docs.ts
index 7ff574612..ed94d86ba 100644
--- a/backend/src/lib/docs.ts
+++ b/backend/src/lib/docs.ts
@@ -46,16 +46,16 @@ const docs = async (app: OpenAPIHono<Env>, skipScalar = false) => {
       "Authentication cookie. Copy the cookie from your network tab and paste it here. If you don't have it, you need to sign in or sign up first.",
   });
 
+  // Register lower-level (base) schemas
+  registry.register('ContextEntityBaseSchema', contextEntityBaseSchema);
+  registry.register('MembershipBaseSchema', membershipBaseSchema);
+  registry.register('UserBaseSchema', userBaseSchema);
+
   // Register entity schemas
   registry.register('User', userSchema);
   registry.register('Organization', organizationSchema);
   registry.register('Attachment', attachmentSchema);
 
-  // Register lower-level (base) schemas
-  registry.register('UserBaseSchema', userBaseSchema);
-  registry.register('MembershipBaseSchema', membershipBaseSchema);
-  registry.register('ContextEntityBaseSchema', contextEntityBaseSchema);
-
   registry.register('MenuSchema', menuSchema);
   registry.register('ApiError', apiErrorSchema);
 
diff --git a/backend/src/modules/auth/general/handlers.ts b/backend/src/modules/auth/general/handlers.ts
index 51a09bf2f..994ba9e29 100644
--- a/backend/src/modules/auth/general/handlers.ts
+++ b/backend/src/modules/auth/general/handlers.ts
@@ -57,7 +57,7 @@ const authGeneralRouteHandlers = app
 
     if (!user) throw new AppError({ status: 404, type: 'not_found', severity: 'warn', entityType: 'user' });
 
-    return ctx.json(true, 200);
+    return ctx.body(null, 204);
   })
   /**
    * Validate and invoke token by creating a single use session token in cookie
@@ -138,7 +138,7 @@ const authGeneralRouteHandlers = app
 
     logEvent('info', 'Started impersonation', { adminId: adminUser.id, targetUserId });
 
-    return ctx.json(true, 200);
+    return ctx.body(null, 204);
   })
   /**
    * Stop impersonation
@@ -166,7 +166,7 @@ const authGeneralRouteHandlers = app
 
     logEvent('info', 'Stopped impersonation', { adminId: adminUserId || 'na', targetUserId: session.userId });
 
-    return ctx.json(true, 200);
+    return ctx.body(null, 204);
   })
   /**
    * Sign out
@@ -180,7 +180,7 @@ const authGeneralRouteHandlers = app
 
       logEvent('info', 'User mfa canceled');
 
-      return ctx.json(true, 200);
+      return ctx.body(null, 204);
     }
 
     // Find session & invalidate
@@ -191,7 +191,7 @@ const authGeneralRouteHandlers = app
 
     logEvent('info', 'User signed out', { userId: currentSession.userId });
 
-    return ctx.json(true, 200);
+    return ctx.body(null, 204);
   });
 
 export default authGeneralRouteHandlers;
diff --git a/backend/src/modules/auth/general/routes.ts b/backend/src/modules/auth/general/routes.ts
index 8c4a79f7f..ce4091674 100644
--- a/backend/src/modules/auth/general/routes.ts
+++ b/backend/src/modules/auth/general/routes.ts
@@ -6,7 +6,7 @@ import { isNoBot } from '#/middlewares/is-no-bot';
 import { emailEnumLimiter } from '#/middlewares/rate-limiter/limiters';
 import { emailBodySchema, tokenWithDataSchema } from '#/modules/auth/general/schema';
 import { cookieSchema, locationSchema } from '#/utils/schema/common';
-import { errorResponses, successWithoutDataSchema } from '#/utils/schema/responses';
+import { errorResponses } from '#/utils/schema/responses';
 
 const authGeneralRoutes = {
   startImpersonation: createCustomRoute({
@@ -19,16 +19,11 @@ const authGeneralRoutes = {
     description: 'Allows a system admin to impersonate a specific user by ID, returning a temporary impersonation session.',
     request: { query: z.object({ targetUserId: z.string() }) },
     responses: {
-      200: {
+      204: {
         description: 'Impersonating',
         headers: z.object({
           'Set-Cookie': cookieSchema,
         }),
-        content: {
-          'application/json': {
-            schema: successWithoutDataSchema,
-          },
-        },
       },
       ...errorResponses,
     },
@@ -43,13 +38,8 @@ const authGeneralRoutes = {
     summary: 'Stop impersonating',
     description: 'Ends impersonation by clearing the current impersonation session and restoring the admin context.',
     responses: {
-      200: {
+      204: {
         description: 'Stopped impersonating',
-        content: {
-          'application/json': {
-            schema: successWithoutDataSchema,
-          },
-        },
       },
       ...errorResponses,
     },
@@ -75,13 +65,8 @@ const authGeneralRoutes = {
       },
     },
     responses: {
-      200: {
+      204: {
         description: 'Email exists',
-        content: {
-          'application/json': {
-            schema: successWithoutDataSchema,
-          },
-        },
       },
       ...errorResponses,
     },
@@ -142,9 +127,8 @@ const authGeneralRoutes = {
     summary: 'Sign out',
     description: 'Signs out the *current user* and clears the active session.',
     responses: {
-      200: {
+      204: {
         description: 'User signed out',
-        content: { 'application/json': { schema: successWithoutDataSchema } },
       },
       ...errorResponses,
     },
diff --git a/backend/src/modules/auth/passkeys/handlers.ts b/backend/src/modules/auth/passkeys/handlers.ts
index 5d9b2e12f..065f1844f 100644
--- a/backend/src/modules/auth/passkeys/handlers.ts
+++ b/backend/src/modules/auth/passkeys/handlers.ts
@@ -79,7 +79,7 @@ const authPasskeysRouteHandlers = app
       await db.update(usersTable).set({ mfaRequired: false }).where(eq(usersTable.id, user.id));
     }
 
-    return ctx.json(true, 200);
+    return ctx.body(null, 204);
   })
   /**
    * Passkey challenge
@@ -178,7 +178,7 @@ const authPasskeysRouteHandlers = app
     // Set user session after successful verification
     await setUserSession(ctx, user, meta.strategy, meta.sessionType);
 
-    return ctx.json(true, 200);
+    return ctx.body(null, 204);
   });
 
 export default authPasskeysRouteHandlers;
diff --git a/backend/src/modules/auth/passkeys/routes.ts b/backend/src/modules/auth/passkeys/routes.ts
index 4b2d3d18e..7e295a542 100644
--- a/backend/src/modules/auth/passkeys/routes.ts
+++ b/backend/src/modules/auth/passkeys/routes.ts
@@ -10,7 +10,7 @@ import {
   passkeyVerificationBodySchema,
 } from '#/modules/auth/passkeys/schema';
 import { cookieSchema, idSchema } from '#/utils/schema/common';
-import { errorResponses, successWithoutDataSchema } from '#/utils/schema/responses';
+import { errorResponses } from '#/utils/schema/responses';
 
 const authPasskeysRoutes = {
   generatePasskeyChallenge: createCustomRoute({
@@ -72,9 +72,8 @@ const authPasskeysRoutes = {
       params: z.object({ id: idSchema }),
     },
     responses: {
-      200: {
+      204: {
         description: 'Passkey deleted',
-        content: { 'application/json': { schema: successWithoutDataSchema } },
       },
       ...errorResponses,
     },
@@ -93,10 +92,9 @@ const authPasskeysRoutes = {
       body: { content: { 'application/json': { schema: passkeyVerificationBodySchema } } },
     },
     responses: {
-      200: {
+      204: {
         description: 'Passkey verified',
         headers: z.object({ 'Set-Cookie': cookieSchema }),
-        content: { 'application/json': { schema: successWithoutDataSchema } },
       },
       ...errorResponses,
     },
diff --git a/backend/src/modules/auth/passwords/handlers.ts b/backend/src/modules/auth/passwords/handlers.ts
index 412a3b4e6..3d084dedb 100644
--- a/backend/src/modules/auth/passwords/handlers.ts
+++ b/backend/src/modules/auth/passwords/handlers.ts
@@ -61,7 +61,7 @@ const authPasswordsRouteHandlers = app
 
     sendVerificationEmail({ userId: user.id });
 
-    return ctx.json(true, 200);
+    return ctx.body(null, 204);
   })
   /**
    * Sign up with email & password to accept (system or membership) invitations.
@@ -157,7 +157,7 @@ const authPasswordsRouteHandlers = app
 
     logEvent('info', 'Create password link sent', { userId: user.id });
 
-    return ctx.json(true, 200);
+    return ctx.body(null, 204);
   })
   /**
    * Create password with single use session token in cookie
diff --git a/backend/src/modules/auth/passwords/routes.ts b/backend/src/modules/auth/passwords/routes.ts
index ee9434c47..2a595b079 100644
--- a/backend/src/modules/auth/passwords/routes.ts
+++ b/backend/src/modules/auth/passwords/routes.ts
@@ -7,7 +7,7 @@ import { emailEnumLimiter, passwordLimiter, spamLimiter, tokenLimiter } from '#/
 import { emailBodySchema } from '#/modules/auth/general/schema';
 import { emailPasswordBodySchema } from '#/modules/auth/passwords/schema';
 import { cookieSchema, locationSchema, passwordSchema } from '#/utils/schema/common';
-import { errorResponses, redirectResponseSchema, successWithoutDataSchema } from '#/utils/schema/responses';
+import { errorResponses, redirectResponseSchema } from '#/utils/schema/responses';
 
 const authPasswordsRoutes = {
   signUp: createCustomRoute({
@@ -26,10 +26,9 @@ const authPasswordsRoutes = {
       },
     },
     responses: {
-      200: {
+      204: {
         description: 'User signed up',
         headers: z.object({ 'Set-Cookie': cookieSchema }),
-        content: { 'application/json': { schema: successWithoutDataSchema } },
       },
       302: {
         headers: locationSchema,
@@ -77,9 +76,8 @@ const authPasswordsRoutes = {
       body: { content: { 'application/json': { schema: emailBodySchema } } },
     },
     responses: {
-      200: {
+      204: {
         description: 'Password reset email sent',
-        content: { 'application/json': { schema: successWithoutDataSchema } },
       },
       ...errorResponses,
     },
diff --git a/backend/src/modules/auth/totps/handlers.ts b/backend/src/modules/auth/totps/handlers.ts
index c8c8606dd..0588a6f2c 100644
--- a/backend/src/modules/auth/totps/handlers.ts
+++ b/backend/src/modules/auth/totps/handlers.ts
@@ -71,7 +71,7 @@ const authTotpsRouteHandlers = app
     // Save encoded secret key in database
     await db.insert(totpsTable).values({ userId: user.id, secret: encodedSecret });
 
-    return ctx.json(true, 200);
+    return ctx.body(null, 204);
   })
   /**
    * Unlink TOTP
@@ -93,7 +93,7 @@ const authTotpsRouteHandlers = app
       await db.update(usersTable).set({ mfaRequired: false }).where(eq(usersTable.id, user.id));
     }
 
-    return ctx.json(true, 200);
+    return ctx.body(null, 204);
   })
   /**
    * Verify TOTP
@@ -133,7 +133,7 @@ const authTotpsRouteHandlers = app
     // Set user session after successful verification
     await setUserSession(ctx, user, meta.strategy, meta.sessionType);
 
-    return ctx.json(true, 200);
+    return ctx.body(null, 204);
   });
 
 export default authTotpsRouteHandlers;
diff --git a/backend/src/modules/auth/totps/routes.ts b/backend/src/modules/auth/totps/routes.ts
index 774c4b18e..53e2b4977 100644
--- a/backend/src/modules/auth/totps/routes.ts
+++ b/backend/src/modules/auth/totps/routes.ts
@@ -4,7 +4,7 @@ import { isAuthenticated, isPublicAccess } from '#/middlewares/guard';
 import { spamLimiter } from '#/middlewares/rate-limiter/limiters';
 import { totpCreateBodySchema } from '#/modules/auth/totps/schema';
 import { cookieSchema } from '#/utils/schema/common';
-import { errorResponses, successWithoutDataSchema } from '#/utils/schema/responses';
+import { errorResponses } from '#/utils/schema/responses';
 
 const authTotpsRoutes = {
   generateTotpKey: createCustomRoute({
@@ -43,9 +43,8 @@ const authTotpsRoutes = {
     },
 
     responses: {
-      200: {
+      204: {
         description: 'TOTP created',
-        content: { 'application/json': { schema: successWithoutDataSchema } },
       },
       ...errorResponses,
     },
@@ -61,9 +60,8 @@ const authTotpsRoutes = {
     description: 'Delete TOTP credential for current user.',
     security: [],
     responses: {
-      200: {
+      204: {
         description: 'TOTP deleted',
-        content: { 'application/json': { schema: successWithoutDataSchema } },
       },
       ...errorResponses,
     },
@@ -84,10 +82,9 @@ const authTotpsRoutes = {
       body: { content: { 'application/json': { schema: totpCreateBodySchema } } },
     },
     responses: {
-      200: {
+      204: {
         description: 'TOTP verified',
         headers: z.object({ 'Set-Cookie': cookieSchema }),
-        content: { 'application/json': { schema: successWithoutDataSchema } },
       },
       ...errorResponses,
     },
diff --git a/backend/src/modules/entities/handlers.ts b/backend/src/modules/entities/handlers.ts
index 61486c7cd..e4ede8028 100644
--- a/backend/src/modules/entities/handlers.ts
+++ b/backend/src/modules/entities/handlers.ts
@@ -9,7 +9,6 @@ import { type Env, getContextUser } from '#/lib/context';
 import { checkSlugAvailable } from '#/modules/entities/helpers/check-slug';
 import { getMemberCountsQuery } from '#/modules/entities/helpers/counts/member';
 import entityRoutes from '#/modules/entities/routes';
-import type { contextEntitiesResponseSchema } from '#/modules/entities/schema';
 import { membershipBaseSelect } from '#/modules/memberships/helpers/select';
 import type { membershipCountSchema } from '#/modules/organizations/schema';
 import { getValidContextEntity } from '#/permissions/get-context-entity';
@@ -140,7 +139,7 @@ const entityRouteHandlers = app
         // Fetch items and total count in parallel
         const [items, [{ total }]] = await Promise.all([
           query.limit(limit).offset(offset),
-          db.select({ total: count() }).from(query.as('entitiCount')),
+          db.select({ total: count() }).from(query.as('entityCount')),
         ]);
 
         return { items, total };
@@ -148,12 +147,10 @@ const entityRouteHandlers = app
     );
 
     // Map items per entity type
-    const items = Object.fromEntries(appConfig.contextEntityTypes.map((entityType, i) => [entityType, queryResults[i].items])) as z.infer<
-      typeof contextEntitiesResponseSchema
-    >['items'];
+    const items = queryResults[0].items;
 
     // Compute grand total
-    const total = queryResults.reduce((sum, result) => sum + (result.total ?? 0), 0);
+    const total = queryResults[0].total;
 
     // Return response
     return ctx.json({ items, total }, 200);
@@ -177,7 +174,7 @@ const entityRouteHandlers = app
 
     const slugAvailable = await checkSlugAvailable(slug, entityType);
 
-    return ctx.json(slugAvailable, 200);
+    return slugAvailable ? ctx.body(null, 204) : ctx.body(null, 409);
   });
 
 export default entityRouteHandlers;
diff --git a/backend/src/modules/entities/routes.ts b/backend/src/modules/entities/routes.ts
index 5c1769aae..71dbf95f0 100644
--- a/backend/src/modules/entities/routes.ts
+++ b/backend/src/modules/entities/routes.ts
@@ -1,9 +1,9 @@
 import { z } from '@hono/zod-openapi';
 import { createCustomRoute } from '#/lib/custom-routes';
 import { isAuthenticated } from '#/middlewares/guard';
-import { contextEntitiesQuerySchema, contextEntitiesResponseSchema, contextEntityBaseSchema } from '#/modules/entities/schema';
+import { contextEntitiesQuerySchema, contextEntityBaseSchema, contextEntityWithCountsSchema } from '#/modules/entities/schema';
 import { contextEntityTypeSchema, entityParamSchema, entityTypeSchema, slugSchema } from '#/utils/schema/common';
-import { errorResponses, successWithoutDataSchema } from '#/utils/schema/responses';
+import { errorResponses, paginationSchema } from '#/utils/schema/responses';
 
 const entityRoutes = {
   checkSlug: createCustomRoute({
@@ -19,9 +19,8 @@ const entityRoutes = {
       body: { content: { 'application/json': { schema: z.object({ slug: slugSchema, entityType: entityTypeSchema }) } } },
     },
     responses: {
-      200: {
+      204: {
         description: 'Slug is available',
-        content: { 'application/json': { schema: successWithoutDataSchema } },
       },
       ...errorResponses,
     },
@@ -41,7 +40,7 @@ const entityRoutes = {
     responses: {
       200: {
         description: 'Context entities',
-        content: { 'application/json': { schema: contextEntitiesResponseSchema } },
+        content: { 'application/json': { schema: paginationSchema(contextEntityWithCountsSchema) } },
       },
       ...errorResponses,
     },
diff --git a/backend/src/modules/entities/schema.ts b/backend/src/modules/entities/schema.ts
index a722dcbe0..fbf1df708 100644
--- a/backend/src/modules/entities/schema.ts
+++ b/backend/src/modules/entities/schema.ts
@@ -1,5 +1,5 @@
 import { z } from '@hono/zod-openapi';
-import { appConfig, type ContextEntityType } from 'config';
+import { appConfig } from 'config';
 import { membershipBaseSchema } from '#/modules/memberships/schema';
 import { membershipCountSchema } from '#/modules/organizations/schema';
 import { contextEntityTypeSchema, idSchema, imageUrlSchema, nameSchema, paginationQuerySchema, slugSchema } from '#/utils/schema/common';
@@ -16,7 +16,16 @@ export const contextEntityBaseSchema = z
   .openapi('ContextEntityBaseSchema');
 
 // Extend base entity schema with membership base data
-export const contextEntityWithMembershipSchema = contextEntityBaseSchema.extend({ membership: membershipBaseSchema });
+export const contextEntityWithMembershipSchema = contextEntityBaseSchema.extend({
+  membership: membershipBaseSchema,
+  createdAt: z.string(),
+});
+
+export const contextEntityWithCountsSchema = contextEntityBaseSchema.extend({
+  membership: z.object({ ...membershipBaseSchema.shape }).nullable(),
+  createdAt: z.string(),
+  membershipCounts: membershipCountSchema,
+});
 
 // Declared here to avoid circular dependencies
 export const userBaseSchema = contextEntityBaseSchema
@@ -45,21 +54,3 @@ export const contextEntitiesQuerySchema = paginationQuerySchema.extend({
     .optional()
     .transform((val) => val === 'true'),
 });
-
-const fullContextEntitySchema = contextEntityBaseSchema.extend({
-  createdAt: z.string(),
-  membership: membershipBaseSchema.nullable(),
-  membershipCounts: membershipCountSchema,
-});
-
-const contextEntitiesDataSchema = z.object(
-  appConfig.contextEntityTypes.reduce(
-    (acc, entityType) => {
-      acc[entityType] = z.array(fullContextEntitySchema);
-      return acc;
-    },
-    {} as Record<ContextEntityType, z.ZodArray<typeof fullContextEntitySchema>>,
-  ),
-);
-
-export const contextEntitiesResponseSchema = z.object({ items: contextEntitiesDataSchema, total: z.number() });
diff --git a/backend/src/modules/me/handlers.ts b/backend/src/modules/me/handlers.ts
index 62524a8b4..60ca17dc4 100644
--- a/backend/src/modules/me/handlers.ts
+++ b/backend/src/modules/me/handlers.ts
@@ -268,7 +268,7 @@ const meRouteHandlers = app
     deleteAuthCookie(ctx, 'session');
     logEvent('info', 'User deleted itself', { userId: user.id });
 
-    return ctx.json(true, 200);
+    return ctx.body(null, 204);
   })
   /**
    * Delete one of my entity memberships
@@ -288,7 +288,7 @@ const meRouteHandlers = app
 
     logEvent('info', 'User left entity', { userId: user.id });
 
-    return ctx.json(true, 200);
+    return ctx.body(null, 204);
   })
   /**
    * Get upload token
diff --git a/backend/src/modules/me/routes.ts b/backend/src/modules/me/routes.ts
index 7c9810cd4..8a29e809d 100644
--- a/backend/src/modules/me/routes.ts
+++ b/backend/src/modules/me/routes.ts
@@ -12,7 +12,7 @@ import {
 } from '#/modules/me/schema';
 import { userFlagsSchema, userSchema, userUpdateBodySchema } from '#/modules/users/schema';
 import { entityWithTypeQuerySchema, locationSchema } from '#/utils/schema/common';
-import { errorResponses, successWithoutDataSchema, successWithRejectedItemsSchema } from '#/utils/schema/responses';
+import { errorResponses, successWithRejectedItemsSchema } from '#/utils/schema/responses';
 
 const meRoutes = {
   getMe: createCustomRoute({
@@ -101,9 +101,8 @@ const meRoutes = {
     description:
       "Deletes the *current user*. This also removes the user's memberships (cascade) and sets references to the user to `null` where applicable.",
     responses: {
-      200: {
+      204: {
         description: 'User deleted',
-        content: { 'application/json': { schema: successWithoutDataSchema } },
       },
       ...errorResponses,
     },
@@ -162,9 +161,8 @@ const meRoutes = {
       query: entityWithTypeQuerySchema,
     },
     responses: {
-      200: {
+      204: {
         description: 'Membership removed',
-        content: { 'application/json': { schema: successWithoutDataSchema } },
       },
       ...errorResponses,
     },
diff --git a/backend/src/modules/me/schema.ts b/backend/src/modules/me/schema.ts
index cb5699d40..c41218a0c 100644
--- a/backend/src/modules/me/schema.ts
+++ b/backend/src/modules/me/schema.ts
@@ -19,8 +19,8 @@ export const meAuthDataSchema = z.object({
   passkeys: z.array(passkeySchema),
 });
 
-export const menuItemSchema = contextEntityWithMembershipSchema.omit({ bannerUrl: true }).extend({
-  createdAt: z.string(),
+// TODO can we remove this in favour of a standardized contextEntityWithMembershipSchema?
+export const menuItemSchema = contextEntityWithMembershipSchema.extend({
   modifiedAt: z.string().nullable(),
   organizationId: membershipBaseSchema.shape.organizationId.optional(),
 });
@@ -75,7 +75,7 @@ export const toggleMfaBodySchema = z.object({
 export const meInvitationsSchema = z.array(
   z.object({
     entity: contextEntityBaseSchema.extend({ organizationId: z.string().optional() }),
-    invitedBy: userBaseSchema.nullable(),
+    invitedBy: z.object({ ...userBaseSchema.shape }).nullable(),
     membership: membershipBaseSchema,
     expiresAt: z.string(),
   }),
diff --git a/backend/src/modules/memberships/handlers.ts b/backend/src/modules/memberships/handlers.ts
index 966e7a7fc..1fc7a56d1 100644
--- a/backend/src/modules/memberships/handlers.ts
+++ b/backend/src/modules/memberships/handlers.ts
@@ -615,7 +615,7 @@ const membershipRouteHandlers = app
 
     logEvent('info', 'Invitation has been resent', { [entityIdField]: entity.id });
 
-    return ctx.json(true, 200);
+    return ctx.body(null, 204);
   });
 
 export default membershipRouteHandlers;
diff --git a/backend/src/modules/memberships/routes.ts b/backend/src/modules/memberships/routes.ts
index 9def43d04..12a87d9e8 100644
--- a/backend/src/modules/memberships/routes.ts
+++ b/backend/src/modules/memberships/routes.ts
@@ -20,7 +20,7 @@ import {
   idsBodySchema,
   inOrgParamSchema,
 } from '#/utils/schema/common';
-import { errorResponses, paginationSchema, successWithoutDataSchema, successWithRejectedItemsSchema } from '#/utils/schema/responses';
+import { errorResponses, paginationSchema, successWithRejectedItemsSchema } from '#/utils/schema/responses';
 
 const membershipRoutes = {
   createMemberships: createCustomRoute({
@@ -184,12 +184,11 @@ const membershipRoutes = {
     description: 'Resends an invitation email to a new or existing user using the provided email address and token ID.',
     security: [],
     request: {
-      body: { content: { 'application/json': { schema: emailOrTokenIdQuerySchema } } },
+      body: { required: true, content: { 'application/json': { schema: emailOrTokenIdQuerySchema } } },
     },
     responses: {
-      200: {
+      204: {
         description: 'Invitation email sent',
-        content: { 'application/json': { schema: successWithoutDataSchema } },
       },
       ...errorResponses,
     },
diff --git a/backend/src/modules/organizations/routes.ts b/backend/src/modules/organizations/routes.ts
index 37c1ffb30..a1e264a65 100644
--- a/backend/src/modules/organizations/routes.ts
+++ b/backend/src/modules/organizations/routes.ts
@@ -1,7 +1,6 @@
 import { createCustomRoute } from '#/lib/custom-routes';
 import { hasSystemAccess, isAuthenticated } from '#/middlewares/guard';
 import {
-  fullCountsSchema,
   organizationCreateBodySchema,
   organizationListQuerySchema,
   organizationSchema,
@@ -54,7 +53,7 @@ const organizationRoutes = {
         description: 'Organizations',
         content: {
           'application/json': {
-            schema: paginationSchema(organizationSchema.extend({ counts: fullCountsSchema })),
+            schema: paginationSchema(organizationSchema),
           },
         },
       },
diff --git a/backend/src/modules/organizations/schema.ts b/backend/src/modules/organizations/schema.ts
index 4218f999b..fd082822f 100644
--- a/backend/src/modules/organizations/schema.ts
+++ b/backend/src/modules/organizations/schema.ts
@@ -43,12 +43,14 @@ export const organizationSchema = z
     languages: z.array(languageSchema).min(1),
     emailDomains: z.array(z.string()),
     authStrategies: z.array(z.enum(authStrategiesEnum)),
-    membership: membershipBaseSchema.nullable(),
+    // TODO(blocking) is required to prevent the $ref MembershipBaseSchema itself from becoming nullable
+    // https://github.com/asteasolutions/zod-to-openapi/issues/258
+    membership: z.object({ ...membershipBaseSchema.shape }).nullable(),
     counts: fullCountsSchema,
   })
   .openapi('Organization');
 
-export const organizationWithMembershipSchema = organizationSchema.extend({ membership: membershipBaseSchema });
+export const organizationWithMembershipSchema = organizationSchema.extend({ membership: z.object({ ...membershipBaseSchema.shape }) });
 
 export const organizationCreateBodySchema = z.object({
   name: validNameSchema,
diff --git a/backend/src/modules/requests/handlers.ts b/backend/src/modules/requests/handlers.ts
index 327371349..12496c783 100644
--- a/backend/src/modules/requests/handlers.ts
+++ b/backend/src/modules/requests/handlers.ts
@@ -123,7 +123,7 @@ const requestRouteHandlers = app
     // Delete the requests
     await db.delete(requestsTable).where(inArray(requestsTable.id, toDeleteIds));
 
-    return ctx.json(true, 200);
+    return ctx.body(null, 204);
   });
 
 export default requestRouteHandlers;
diff --git a/backend/src/modules/requests/routes.ts b/backend/src/modules/requests/routes.ts
index 96df67cf8..19ee3a2c1 100644
--- a/backend/src/modules/requests/routes.ts
+++ b/backend/src/modules/requests/routes.ts
@@ -4,7 +4,7 @@ import { isNoBot } from '#/middlewares/is-no-bot';
 import { emailEnumLimiter, spamLimiter } from '#/middlewares/rate-limiter/limiters';
 import { requestCreateBodySchema, requestListQuerySchema, requestSchema } from '#/modules/requests/schema';
 import { idsBodySchema } from '#/utils/schema/common';
-import { errorResponses, paginationSchema, successWithoutDataSchema } from '#/utils/schema/responses';
+import { errorResponses, paginationSchema } from '#/utils/schema/responses';
 
 const requestRoutes = {
   createRequest: createCustomRoute({
@@ -70,13 +70,8 @@ const requestRoutes = {
       },
     },
     responses: {
-      200: {
-        description: 'Requests',
-        content: {
-          'application/json': {
-            schema: successWithoutDataSchema,
-          },
-        },
+      204: {
+        description: 'Requests deleted',
       },
       ...errorResponses,
     },
diff --git a/backend/src/modules/system/handlers.ts b/backend/src/modules/system/handlers.ts
index d589f30ea..16b00e02c 100644
--- a/backend/src/modules/system/handlers.ts
+++ b/backend/src/modules/system/handlers.ts
@@ -219,7 +219,7 @@ const systemRouteHandlers = app
       logError('Error handling paddle webhook', error);
     }
 
-    return ctx.json(true, 200);
+    return ctx.body(null, 204);
   })
   /**
    * Send newsletter to members of one or more organizations matching one ore more roles.
@@ -305,7 +305,7 @@ const systemRouteHandlers = app
 
     logEvent('info', 'Newsletter sent', { count: recipients.length });
 
-    return ctx.json(true, 200);
+    return ctx.body(null, 204);
   });
 
 export default systemRouteHandlers;
diff --git a/backend/src/modules/system/routes.ts b/backend/src/modules/system/routes.ts
index 6c0edf1fc..51bb06d33 100644
--- a/backend/src/modules/system/routes.ts
+++ b/backend/src/modules/system/routes.ts
@@ -4,7 +4,7 @@ import { hasSystemAccess, isAuthenticated, isPublicAccess } from '#/middlewares/
 import { tokenLimiter } from '#/middlewares/rate-limiter/limiters';
 import { inviteBodySchema, preasignedURLQuerySchema, sendNewsletterBodySchema } from '#/modules/system/schema';
 import { booleanTransformSchema } from '#/utils/schema/common';
-import { errorResponses, successWithoutDataSchema, successWithRejectedItemsSchema } from '#/utils/schema/responses';
+import { errorResponses, successWithRejectedItemsSchema } from '#/utils/schema/responses';
 
 const systemRoutes = {
   createInvite: createCustomRoute({
@@ -53,13 +53,8 @@ const systemRoutes = {
       },
     },
     responses: {
-      200: {
-        description: 'Organization',
-        content: {
-          'application/json': {
-            schema: successWithoutDataSchema,
-          },
-        },
+      204: {
+        description: 'Newsletter sent',
       },
       ...errorResponses,
     },
@@ -103,13 +98,8 @@ const systemRoutes = {
       },
     },
     responses: {
-      200: {
+      204: {
         description: 'Paddle webhook received',
-        content: {
-          'application/json': {
-            schema: successWithoutDataSchema,
-          },
-        },
       },
       ...errorResponses,
     },
diff --git a/backend/src/utils/schema/common.ts b/backend/src/utils/schema/common.ts
index 5c12a26b0..da4ad0307 100644
--- a/backend/src/utils/schema/common.ts
+++ b/backend/src/utils/schema/common.ts
@@ -101,8 +101,8 @@ export const paginationQuerySchema = z.object({
 });
 
 export const emailOrTokenIdQuerySchema = z.union([
-  z.object({ email: z.string().email(), tokenId: z.undefined() }),
-  z.object({ email: z.undefined(), tokenId: z.string() }),
+  z.object({ email: z.email(), tokenId: z.string().optional() }),
+  z.object({ email: z.email().optional(), tokenId: z.string() }),
 ]);
 
 /*************************************************************************************************
diff --git a/backend/src/utils/schema/responses.ts b/backend/src/utils/schema/responses.ts
index 9a6125a44..980527912 100644
--- a/backend/src/utils/schema/responses.ts
+++ b/backend/src/utils/schema/responses.ts
@@ -20,17 +20,16 @@ export const redirectResponseSchema = z
     message: 'redirectPath is required when shouldRedirect is true',
   });
 
-/**
- * Schema for a response without data.
- */
-export const successWithoutDataSchema = z.boolean();
-
 /**
  * Schema for a response with paginated data
  *
  * @param schema - The schema for the items in the paginated data. Data object has `items` and `total` properties.
  */
-export const paginationSchema = <T extends z.ZodTypeAny>(schema: T) => z.object({ items: schema.array(), total: z.number() });
+export const paginationSchema = <O, I>(schema: z.ZodType<O, I>) =>
+  z.object({
+    items: z.array(schema),
+    total: z.number(),
+  });
 
 /**
  * Schema for a successful response with disallowed IDs.
diff --git a/frontend/package.json b/frontend/package.json
index f96eeeec6..ae949ae3c 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -34,8 +34,8 @@
     "@blocknote/core": "0.33.0",
     "@blocknote/react": "0.33.0",
     "@blocknote/shadcn": "0.33.0",
-    "@electric-sql/client": "1.0.10",
-    "@electric-sql/react": "1.0.10",
+    "@electric-sql/client": "1.0.13",
+    "@electric-sql/react": "1.0.13",
     "@floating-ui/dom": "^1.7.4",
     "@floating-ui/react": "^0.27.16",
     "@github/mini-throttle": "^2.1.1",
@@ -70,12 +70,12 @@
     "@sentry/react": "^9.46.0",
     "@t3-oss/env-core": "^0.13.8",
     "@tailwindcss/typography": "^0.5.19",
-    "@tanstack/query-sync-storage-persister": "5.87.4",
-    "@tanstack/react-query": "5.87.4",
-    "@tanstack/react-query-devtools": "5.87.4",
-    "@tanstack/react-query-persist-client": "5.87.4",
-    "@tanstack/react-router": "1.132.31",
-    "@tanstack/react-router-devtools": "1.132.31",
+    "@tanstack/query-sync-storage-persister": "^5.90.2",
+    "@tanstack/react-query": "^5.90.2",
+    "@tanstack/react-query-devtools": "^5.90.2",
+    "@tanstack/react-query-persist-client": "^5.90.2",
+    "@tanstack/react-router": "^1.132.33",
+    "@tanstack/react-router-devtools": "^1.132.33",
     "@uppy/audio": "^3.0.1",
     "@uppy/core": "^5.0.2",
     "@uppy/dashboard": "^5.0.2",
@@ -117,7 +117,7 @@
     "motion": "^12.23.22",
     "nanoid": "^5.1.6",
     "pdfjs-dist": "4.8.69",
-    "player.style": "^0.2.0",
+    "player.style": "^0.3.0",
     "qrcode.react": "^4.2.0",
     "react": "^19.2.0",
     "react-data-grid": "7.0.0-beta.57",
@@ -139,10 +139,10 @@
     "tailwindcss-animate": "^1.0.7",
     "use-count-up": "^3.0.1",
     "vaul": "^1.1.2",
-    "virtua": "^0.43.6",
+    "virtua": "^0.44.0",
     "vitest": "^3.2.4",
     "workbox-window": "^7.3.0",
-    "zod": "4.1.8",
+    "zod": "4.1.11",
     "zustand": "^5.0.8",
     "zxcvbn": "^4.4.2"
   },
@@ -157,8 +157,8 @@
     "@storybook/addon-vitest": "^9.1.10",
     "@storybook/react-vite": "^9.1.10",
     "@tailwindcss/vite": "^4.1.14",
-    "@tanstack/router-core": "^1.132.31",
-    "@tanstack/router-plugin": "^1.132.31",
+    "@tanstack/router-core": "^1.132.33",
+    "@tanstack/router-plugin": "^1.132.33",
     "@types/canvas-confetti": "^1.9.0",
     "@types/node": "^24.6.2",
     "@types/react": "^19.2.0",
@@ -179,7 +179,7 @@
     "storybook": "^9.1.10",
     "tsx": "^4.20.6",
     "typescript": "^5.9.3",
-    "vite": "^7.1.8",
+    "vite": "^7.1.9",
     "vite-plugin-html": "^3.2.2",
     "vite-plugin-pwa": "^1.0.3",
     "vite-plugin-static-copy": "^3.1.3",
diff --git a/frontend/src/api.gen/sdk.gen.ts b/frontend/src/api.gen/sdk.gen.ts
index e43fd6b13..e48e0e564 100644
--- a/frontend/src/api.gen/sdk.gen.ts
+++ b/frontend/src/api.gen/sdk.gen.ts
@@ -235,7 +235,7 @@ export type Options<TData extends TDataShape = TDataShape, ThrowOnError extends
  *
  * @param {checkEmailData} options
  * @param {string=} options.body.email - `string` (optional)
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ * @returns Possible status codes: 204, 400, 401, 403, 404, 429
  */
 export const checkEmail = <ThrowOnError extends boolean = true>(options?: Options<CheckEmailData, ThrowOnError>) => {
   return (options?.client ?? client).post<CheckEmailResponses, CheckEmailErrors, ThrowOnError, 'data'>({
@@ -316,7 +316,7 @@ export const getTokenData = <ThrowOnError extends boolean = true>(options: Optio
  *
  * @param {startImpersonationData} options
  * @param {string} options.query.targetuserid - `string`
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ * @returns Possible status codes: 204, 400, 401, 403, 404, 429
  */
 export const startImpersonation = <ThrowOnError extends boolean = true>(options: Options<StartImpersonationData, ThrowOnError>) => {
   return (options.client ?? client).get<StartImpersonationResponses, StartImpersonationErrors, ThrowOnError, 'data'>({
@@ -342,7 +342,7 @@ export const startImpersonation = <ThrowOnError extends boolean = true>(options:
  * **GET /auth/impersonation/stop** ·· [stopImpersonation](http://localhost:4000/docs#tag/auth/get/auth/impersonation/stop) ·· _auth_
  *
  * @param {stopImpersonationData} options
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ * @returns Possible status codes: 204, 400, 401, 403, 404, 429
  */
 export const stopImpersonation = <ThrowOnError extends boolean = true>(options?: Options<StopImpersonationData, ThrowOnError>) => {
   return (options?.client ?? client).get<StopImpersonationResponses, StopImpersonationErrors, ThrowOnError, 'data'>({
@@ -368,7 +368,7 @@ export const stopImpersonation = <ThrowOnError extends boolean = true>(options?:
  * **GET /auth/sign-out** ·· [signOut](http://localhost:4000/docs#tag/auth/get/auth/sign-out) ·· _auth_
  *
  * @param {signOutData} options
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ * @returns Possible status codes: 204, 400, 401, 403, 404, 429
  */
 export const signOut = <ThrowOnError extends boolean = true>(options?: Options<SignOutData, ThrowOnError>) => {
   return (options?.client ?? client).get<SignOutResponses, SignOutErrors, ThrowOnError, 'data'>({
@@ -413,7 +413,7 @@ export const generateTotpKey = <ThrowOnError extends boolean = true>(options?: O
  * **DELETE /auth/totp** ·· [deleteTotp](http://localhost:4000/docs#tag/auth/delete/auth/totp) ·· _auth_
  *
  * @param {deleteTotpData} options
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ * @returns Possible status codes: 204, 400, 401, 403, 404, 429
  */
 export const deleteTotp = <ThrowOnError extends boolean = true>(options?: Options<DeleteTotpData, ThrowOnError>) => {
   return (options?.client ?? client).delete<DeleteTotpResponses, DeleteTotpErrors, ThrowOnError, 'data'>({
@@ -433,7 +433,7 @@ export const deleteTotp = <ThrowOnError extends boolean = true>(options?: Option
  *
  * @param {createTotpData} options
  * @param {string=} options.body.code - `string` (optional)
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ * @returns Possible status codes: 204, 400, 401, 403, 404, 429
  */
 export const createTotp = <ThrowOnError extends boolean = true>(options: Options<CreateTotpData, ThrowOnError>) => {
   return (options.client ?? client).post<CreateTotpResponses, CreateTotpErrors, ThrowOnError, 'data'>({
@@ -458,7 +458,7 @@ export const createTotp = <ThrowOnError extends boolean = true>(options: Options
  *
  * @param {signInWithTotpData} options
  * @param {string=} options.body.code - `string` (optional)
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ * @returns Possible status codes: 204, 400, 401, 403, 404, 429
  */
 export const signInWithTotp = <ThrowOnError extends boolean = true>(options?: Options<SignInWithTotpData, ThrowOnError>) => {
   return (options?.client ?? client).post<SignInWithTotpResponses, SignInWithTotpErrors, ThrowOnError, 'data'>({
@@ -484,7 +484,7 @@ export const signInWithTotp = <ThrowOnError extends boolean = true>(options?: Op
  * @param {signUpData} options
  * @param {string=} options.body.email - `string` (optional)
  * @param {string=} options.body.password - `string` (optional)
- * @returns Possible status codes: 200, 302, 400, 401, 403, 404, 429
+ * @returns Possible status codes: 204, 302, 400, 401, 403, 404, 429
  */
 export const signUp = <ThrowOnError extends boolean = true>(options?: Options<SignUpData, ThrowOnError>) => {
   return (options?.client ?? client).post<SignUpResponses, SignUpErrors, ThrowOnError, 'data'>({
@@ -536,7 +536,7 @@ export const signUpWithToken = <ThrowOnError extends boolean = true>(options: Op
  *
  * @param {requestPasswordData} options
  * @param {string=} options.body.email - `string` (optional)
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ * @returns Possible status codes: 204, 400, 401, 403, 404, 429
  */
 export const requestPassword = <ThrowOnError extends boolean = true>(options?: Options<RequestPasswordData, ThrowOnError>) => {
   return (options?.client ?? client).post<RequestPasswordResponses, RequestPasswordErrors, ThrowOnError, 'data'>({
@@ -638,7 +638,7 @@ export const createPasskey = <ThrowOnError extends boolean = true>(options: Opti
  *
  * @param {deletePasskeyData} options
  * @param {string} options.path.id - `string`
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ * @returns Possible status codes: 204, 400, 401, 403, 404, 429
  */
 export const deletePasskey = <ThrowOnError extends boolean = true>(options: Options<DeletePasskeyData, ThrowOnError>) => {
   return (options.client ?? client).delete<DeletePasskeyResponses, DeletePasskeyErrors, ThrowOnError, 'data'>({
@@ -690,7 +690,7 @@ export const generatePasskeyChallenge = <ThrowOnError extends boolean = true>(op
  * @param {string=} options.body.signature - `string` (optional)
  * @param {enum | enum=} options.body.type - `enum | enum` (optional)
  * @param {string=} options.body.email - `string` (optional)
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ * @returns Possible status codes: 204, 400, 401, 403, 404, 429
  */
 export const signInWithPasskey = <ThrowOnError extends boolean = true>(options?: Options<SignInWithPasskeyData, ThrowOnError>) => {
   return (options?.client ?? client).post<SignInWithPasskeyResponses, SignInWithPasskeyErrors, ThrowOnError, 'data'>({
@@ -852,7 +852,7 @@ export const microsoftCallback = <ThrowOnError extends boolean = true>(options:
  * **DELETE /me** ·· [deleteMe](http://localhost:4000/docs#tag/me/delete/me) ·· _me_
  *
  * @param {deleteMeData} options
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ * @returns Possible status codes: 204, 400, 401, 403, 404, 429
  */
 export const deleteMe = <ThrowOnError extends boolean = true>(options?: Options<DeleteMeData, ThrowOnError>) => {
   return (options?.client ?? client).delete<DeleteMeResponses, DeleteMeErrors, ThrowOnError, 'data'>({
@@ -1086,7 +1086,7 @@ export const deleteMySessions = <ThrowOnError extends boolean = true>(options?:
  * @param {deleteMyMembershipData} options
  * @param {string | string} options.query.idorslug - `string | string`
  * @param {enum} options.query.entitytype - `enum`
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ * @returns Possible status codes: 204, 400, 401, 403, 404, 429
  */
 export const deleteMyMembership = <ThrowOnError extends boolean = true>(options: Options<DeleteMyMembershipData, ThrowOnError>) => {
   return (options.client ?? client).delete<DeleteMyMembershipResponses, DeleteMyMembershipErrors, ThrowOnError, 'data'>({
@@ -1534,7 +1534,7 @@ export const getContextEntity = <ThrowOnError extends boolean = true>(options: O
  * @param {checkSlugData} options
  * @param {string=} options.body.slug - `string` (optional)
  * @param {enum=} options.body.entityType - `enum` (optional)
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ * @returns Possible status codes: 204, 400, 401, 403, 404, 429
  */
 export const checkSlug = <ThrowOnError extends boolean = true>(options?: Options<CheckSlugData, ThrowOnError>) => {
   return (options?.client ?? client).post<CheckSlugResponses, CheckSlugErrors, ThrowOnError, 'data'>({
@@ -1624,7 +1624,7 @@ export const getPresignedUrl = <ThrowOnError extends boolean = true>(options: Op
  * **POST /system/paddle-webhook** ·· [paddleWebhook](http://localhost:4000/docs#tag/system/post/system/paddle-webhook) ·· _system_
  *
  * @param {paddleWebhookData} options
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ * @returns Possible status codes: 204, 400, 401, 403, 404, 429
  */
 export const paddleWebhook = <ThrowOnError extends boolean = true>(options?: Options<PaddleWebhookData, ThrowOnError>) => {
   return (options?.client ?? client).post<PaddleWebhookResponses, PaddleWebhookErrors, ThrowOnError, 'data'>({
@@ -1659,7 +1659,7 @@ export const paddleWebhook = <ThrowOnError extends boolean = true>(options?: Opt
  * @param {any[]=} options.body.roles - `any[]` (optional)
  * @param {string=} options.body.subject - `string` (optional)
  * @param {string=} options.body.content - `string` (optional)
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ * @returns Possible status codes: 204, 400, 401, 403, 404, 429
  */
 export const sendNewsletter = <ThrowOnError extends boolean = true>(options: Options<SendNewsletterData, ThrowOnError>) => {
   return (options.client ?? client).post<SendNewsletterResponses, SendNewsletterErrors, ThrowOnError, 'data'>({
@@ -1690,7 +1690,7 @@ export const sendNewsletter = <ThrowOnError extends boolean = true>(options: Opt
  *
  * @param {deleteRequestsData} options
  * @param {any[]=} options.body.ids - `any[]` (optional)
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ * @returns Possible status codes: 204, 400, 401, 403, 404, 429
  */
 export const deleteRequests = <ThrowOnError extends boolean = true>(options?: Options<DeleteRequestsData, ThrowOnError>) => {
   return (options?.client ?? client).delete<DeleteRequestsResponses, DeleteRequestsErrors, ThrowOnError, 'data'>({
@@ -2263,18 +2263,16 @@ export const getPendingInvitations = <ThrowOnError extends boolean = true>(optio
  * **POST /{orgIdOrSlug}/memberships/resend-invitation** ·· [resendInvitation](http://localhost:4000/docs#tag/memberships/post/{orgIdOrSlug}/memberships/resend-invitation) ·· _memberships_
  *
  * @param {resendInvitationData} options
- * @param {string=} options.body.email - `string` (optional)
- * @param {string=} options.body.tokenId - `string` (optional)
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ * @returns Possible status codes: 204, 400, 401, 403, 404, 429
  */
-export const resendInvitation = <ThrowOnError extends boolean = true>(options?: Options<ResendInvitationData, ThrowOnError>) => {
-  return (options?.client ?? client).post<ResendInvitationResponses, ResendInvitationErrors, ThrowOnError, 'data'>({
+export const resendInvitation = <ThrowOnError extends boolean = true>(options: Options<ResendInvitationData, ThrowOnError>) => {
+  return (options.client ?? client).post<ResendInvitationResponses, ResendInvitationErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
     url: '/{orgIdOrSlug}/memberships/resend-invitation',
     ...options,
     headers: {
       'Content-Type': 'application/json',
-      ...options?.headers,
+      ...options.headers,
     },
   });
 };
diff --git a/frontend/src/api.gen/types.gen.ts b/frontend/src/api.gen/types.gen.ts
index f39cdc473..6d71b527a 100644
--- a/frontend/src/api.gen/types.gen.ts
+++ b/frontend/src/api.gen/types.gen.ts
@@ -4,6 +4,36 @@ export type ClientOptions = {
   baseUrl: 'http://localhost:4000' | (string & {});
 };
 
+export type ContextEntityBaseSchema = {
+  id: string;
+  entityType: 'organization';
+  slug: string;
+  name: string;
+  thumbnailUrl?: string | null;
+  bannerUrl?: string | null;
+};
+
+export type MembershipBaseSchema = {
+  id: string;
+  contextType: 'organization';
+  userId: string;
+  role: 'member' | 'admin';
+  archived: boolean;
+  muted: boolean;
+  order: number;
+  organizationId: string;
+};
+
+export type UserBaseSchema = {
+  id: string;
+  slug: string;
+  name: string;
+  thumbnailUrl?: string | null;
+  bannerUrl?: string | null;
+  email: string;
+  entityType: 'user';
+};
+
 export type User = {
   createdAt: string;
   id: string;
@@ -30,17 +60,6 @@ export type User = {
   modifiedBy: string | null;
 };
 
-export type MembershipBaseSchema = {
-  id: string;
-  contextType: 'organization';
-  userId: string;
-  role: 'member' | 'admin';
-  archived: boolean;
-  muted: boolean;
-  order: number;
-  organizationId: string;
-} | null;
-
 export type Organization = {
   createdAt: string;
   id: string;
@@ -66,7 +85,16 @@ export type Organization = {
   createdBy: string | null;
   modifiedAt: string | null;
   modifiedBy: string | null;
-  membership: MembershipBaseSchema;
+  membership: {
+    id: string;
+    contextType: 'organization';
+    userId: string;
+    role: 'member' | 'admin';
+    archived: boolean;
+    muted: boolean;
+    order: number;
+    organizationId: string;
+  } | null;
   counts: {
     membership: {
       admin: number;
@@ -101,25 +129,6 @@ export type Attachment = {
   convertedUrl: string | null;
 };
 
-export type UserBaseSchema = {
-  id: string;
-  slug: string;
-  name: string;
-  thumbnailUrl?: string | null;
-  bannerUrl?: string | null;
-  email: string;
-  entityType: 'user';
-};
-
-export type ContextEntityBaseSchema = {
-  id: string;
-  entityType: 'organization';
-  slug: string;
-  name: string;
-  thumbnailUrl?: string | null;
-  bannerUrl?: string | null;
-};
-
 export type MenuSchema = {
   organization: Array<{
     id: string;
@@ -127,25 +136,19 @@ export type MenuSchema = {
     slug: string;
     name: string;
     thumbnailUrl?: string | null;
-    membership: MembershipBaseSchema & {
-      [key: string]: unknown;
-    };
+    bannerUrl?: string | null;
+    membership: MembershipBaseSchema;
     createdAt: string;
     modifiedAt: string | null;
     organizationId?: string;
-    submenu?: Array<{
-      id: string;
-      entityType: 'organization';
-      slug: string;
-      name: string;
-      thumbnailUrl?: string | null;
-      membership: MembershipBaseSchema & {
-        [key: string]: unknown;
-      };
-      createdAt: string;
-      modifiedAt: string | null;
-      organizationId?: string;
-    }>;
+    submenu?: Array<
+      ContextEntityBaseSchema & {
+        membership: MembershipBaseSchema;
+        createdAt: string;
+        modifiedAt: string | null;
+        organizationId?: string;
+      }
+    >;
   }>;
 };
 
@@ -252,7 +255,7 @@ export type CheckEmailResponses = {
   /**
    * Email exists
    */
-  200: boolean;
+  204: void;
 };
 
 export type CheckEmailResponse = CheckEmailResponses[keyof CheckEmailResponses];
@@ -414,7 +417,7 @@ export type StartImpersonationResponses = {
   /**
    * Impersonating
    */
-  200: boolean;
+  204: void;
 };
 
 export type StartImpersonationResponse = StartImpersonationResponses[keyof StartImpersonationResponses];
@@ -465,7 +468,7 @@ export type StopImpersonationResponses = {
   /**
    * Stopped impersonating
    */
-  200: boolean;
+  204: void;
 };
 
 export type StopImpersonationResponse = StopImpersonationResponses[keyof StopImpersonationResponses];
@@ -516,7 +519,7 @@ export type SignOutResponses = {
   /**
    * User signed out
    */
-  200: boolean;
+  204: void;
 };
 
 export type SignOutResponse = SignOutResponses[keyof SignOutResponses];
@@ -621,7 +624,7 @@ export type DeleteTotpResponses = {
   /**
    * TOTP deleted
    */
-  200: boolean;
+  204: void;
 };
 
 export type DeleteTotpResponse = DeleteTotpResponses[keyof DeleteTotpResponses];
@@ -674,7 +677,7 @@ export type CreateTotpResponses = {
   /**
    * TOTP created
    */
-  200: boolean;
+  204: void;
 };
 
 export type CreateTotpResponse = CreateTotpResponses[keyof CreateTotpResponses];
@@ -727,7 +730,7 @@ export type SignInWithTotpResponses = {
   /**
    * TOTP verified
    */
-  200: boolean;
+  204: void;
 };
 
 export type SignInWithTotpResponse = SignInWithTotpResponses[keyof SignInWithTotpResponses];
@@ -781,7 +784,7 @@ export type SignUpResponses = {
   /**
    * User signed up
    */
-  200: boolean;
+  204: void;
 };
 
 export type SignUpResponse = SignUpResponses[keyof SignUpResponses];
@@ -893,7 +896,7 @@ export type RequestPasswordResponses = {
   /**
    * Password reset email sent
    */
-  200: boolean;
+  204: void;
 };
 
 export type RequestPasswordResponse = RequestPasswordResponses[keyof RequestPasswordResponses];
@@ -1125,7 +1128,7 @@ export type DeletePasskeyResponses = {
   /**
    * Passkey deleted
    */
-  200: boolean;
+  204: void;
 };
 
 export type DeletePasskeyResponse = DeletePasskeyResponses[keyof DeletePasskeyResponses];
@@ -1240,7 +1243,7 @@ export type SignInWithPasskeyResponses = {
   /**
    * Passkey verified
    */
-  200: boolean;
+  204: void;
 };
 
 export type SignInWithPasskeyResponse = SignInWithPasskeyResponses[keyof SignInWithPasskeyResponses];
@@ -1564,7 +1567,7 @@ export type DeleteMeResponses = {
   /**
    * User deleted
    */
-  200: boolean;
+  204: void;
 };
 
 export type DeleteMeResponse = DeleteMeResponses[keyof DeleteMeResponses];
@@ -1921,13 +1924,16 @@ export type GetMyInvitationsResponses = {
     entity: ContextEntityBaseSchema & {
       organizationId?: string;
     };
-    invitedBy: UserBaseSchema &
-      ({
-        [key: string]: unknown;
-      } | null);
-    membership: MembershipBaseSchema & {
-      [key: string]: unknown;
-    };
+    invitedBy: {
+      id: string;
+      slug: string;
+      name: string;
+      thumbnailUrl?: string | null;
+      bannerUrl?: string | null;
+      email: string;
+      entityType: 'user';
+    } | null;
+    membership: MembershipBaseSchema;
     expiresAt: string;
   }>;
 };
@@ -2039,7 +2045,7 @@ export type DeleteMyMembershipResponses = {
   /**
    * Membership removed
    */
-  200: boolean;
+  204: void;
 };
 
 export type DeleteMyMembershipResponse = DeleteMyMembershipResponses[keyof DeleteMyMembershipResponses];
@@ -2275,11 +2281,7 @@ export type GetUsersResponses = {
   200: {
     items: Array<
       User & {
-        memberships: Array<
-          MembershipBaseSchema & {
-            [key: string]: unknown;
-          }
-        >;
+        memberships: Array<MembershipBaseSchema>;
       }
     >;
     total: number;
@@ -2511,11 +2513,7 @@ export type GetOrganizationsResponses = {
    * Organizations
    */
   200: {
-    items: Array<
-      Organization & {
-        [key: string]: unknown;
-      }
-    >;
+    items: Array<Organization>;
     total: number;
   };
 };
@@ -2572,8 +2570,15 @@ export type CreateOrganizationResponses = {
    * Organization was created
    */
   200: Organization & {
-    membership?: MembershipBaseSchema & {
-      [key: string]: unknown;
+    membership?: {
+      id: string;
+      contextType: 'organization';
+      userId: string;
+      role: 'member' | 'admin';
+      archived: boolean;
+      muted: boolean;
+      order: number;
+      organizationId: string;
     };
   };
 };
@@ -2763,20 +2768,27 @@ export type GetContextEntitiesResponses = {
    * Context entities
    */
   200: {
-    items: {
-      organization: Array<
-        ContextEntityBaseSchema & {
-          createdAt: string;
-          membership: MembershipBaseSchema;
-          membershipCounts: {
-            admin: number;
-            member: number;
-            pending: number;
-            total: number;
-          };
-        }
-      >;
-    };
+    items: Array<
+      ContextEntityBaseSchema & {
+        membership: {
+          id: string;
+          contextType: 'organization';
+          userId: string;
+          role: 'member' | 'admin';
+          archived: boolean;
+          muted: boolean;
+          order: number;
+          organizationId: string;
+        } | null;
+        createdAt: string;
+        membershipCounts: {
+          admin: number;
+          member: number;
+          pending: number;
+          total: number;
+        };
+      }
+    >;
     total: number;
   };
 };
@@ -2887,7 +2899,7 @@ export type CheckSlugResponses = {
   /**
    * Slug is available
    */
-  200: boolean;
+  204: void;
 };
 
 export type CheckSlugResponse = CheckSlugResponses[keyof CheckSlugResponses];
@@ -3049,7 +3061,7 @@ export type PaddleWebhookResponses = {
   /**
    * Paddle webhook received
    */
-  200: boolean;
+  204: void;
 };
 
 export type PaddleWebhookResponse = PaddleWebhookResponses[keyof PaddleWebhookResponses];
@@ -3105,9 +3117,9 @@ export type SendNewsletterError = SendNewsletterErrors[keyof SendNewsletterError
 
 export type SendNewsletterResponses = {
   /**
-   * Organization
+   * Newsletter sent
    */
-  200: boolean;
+  204: void;
 };
 
 export type SendNewsletterResponse = SendNewsletterResponses[keyof SendNewsletterResponses];
@@ -3158,9 +3170,9 @@ export type DeleteRequestsError = DeleteRequestsErrors[keyof DeleteRequestsError
 
 export type DeleteRequestsResponses = {
   /**
-   * Requests
+   * Requests deleted
    */
-  200: boolean;
+  204: void;
 };
 
 export type DeleteRequestsResponse = DeleteRequestsResponses[keyof DeleteRequestsResponses];
@@ -4138,9 +4150,7 @@ export type GetMembersResponses = {
       lastStartedAt: string | null;
       lastSignInAt: string | null;
       modifiedBy: string | null;
-      membership: MembershipBaseSchema & {
-        [key: string]: unknown;
-      };
+      membership: MembershipBaseSchema;
     }>;
     total: number;
   };
@@ -4221,10 +4231,15 @@ export type GetPendingInvitationsResponses = {
 export type GetPendingInvitationsResponse = GetPendingInvitationsResponses[keyof GetPendingInvitationsResponses];
 
 export type ResendInvitationData = {
-  body?: {
-    email?: string;
-    tokenId?: string;
-  };
+  body:
+    | {
+        email: string;
+        tokenId?: string;
+      }
+    | {
+        email?: string;
+        tokenId: string;
+      };
   path?: never;
   query?: never;
   url: '/{orgIdOrSlug}/memberships/resend-invitation';
@@ -4269,7 +4284,7 @@ export type ResendInvitationResponses = {
   /**
    * Invitation email sent
    */
-  200: boolean;
+  204: void;
 };
 
 export type ResendInvitationResponse = ResendInvitationResponses[keyof ResendInvitationResponses];
diff --git a/frontend/src/api.gen/zod.gen.ts b/frontend/src/api.gen/zod.gen.ts
index 64f280b05..b79498dff 100644
--- a/frontend/src/api.gen/zod.gen.ts
+++ b/frontend/src/api.gen/zod.gen.ts
@@ -2,6 +2,36 @@
 
 import { z } from 'zod';
 
+export const zContextEntityBaseSchema = z.object({
+  id: z.string(),
+  entityType: z.enum(['organization']),
+  slug: z.string(),
+  name: z.string(),
+  thumbnailUrl: z.optional(z.union([z.string(), z.null()])),
+  bannerUrl: z.optional(z.union([z.string(), z.null()])),
+});
+
+export const zMembershipBaseSchema = z.object({
+  id: z.string(),
+  contextType: z.enum(['organization']),
+  userId: z.string(),
+  role: z.enum(['member', 'admin']),
+  archived: z.boolean(),
+  muted: z.boolean(),
+  order: z.number().gte(-140737488355328).lte(140737488355327),
+  organizationId: z.string(),
+});
+
+export const zUserBaseSchema = z.object({
+  id: z.string(),
+  slug: z.string(),
+  name: z.string(),
+  thumbnailUrl: z.optional(z.union([z.string(), z.null()])),
+  bannerUrl: z.optional(z.union([z.string(), z.null()])),
+  email: z.email(),
+  entityType: z.enum(['user']),
+});
+
 export const zUser = z.object({
   createdAt: z.string(),
   id: z.string(),
@@ -28,20 +58,6 @@ export const zUser = z.object({
   modifiedBy: z.union([z.string(), z.null()]),
 });
 
-export const zMembershipBaseSchema = z.union([
-  z.object({
-    id: z.string(),
-    contextType: z.enum(['organization']),
-    userId: z.string(),
-    role: z.enum(['member', 'admin']),
-    archived: z.boolean(),
-    muted: z.boolean(),
-    order: z.number().gte(-140737488355328).lte(140737488355327),
-    organizationId: z.string(),
-  }),
-  z.null(),
-]);
-
 export const zOrganization = z.object({
   createdAt: z.string(),
   id: z.string(),
@@ -67,7 +83,19 @@ export const zOrganization = z.object({
   createdBy: z.union([z.string(), z.null()]),
   modifiedAt: z.union([z.string(), z.null()]),
   modifiedBy: z.union([z.string(), z.null()]),
-  membership: zMembershipBaseSchema,
+  membership: z.union([
+    z.object({
+      id: z.string(),
+      contextType: z.enum(['organization']),
+      userId: z.string(),
+      role: z.enum(['member', 'admin']),
+      archived: z.boolean(),
+      muted: z.boolean(),
+      order: z.number().gte(-140737488355328).lte(140737488355327),
+      organizationId: z.string(),
+    }),
+    z.null(),
+  ]),
   counts: z.object({
     membership: z.object({
       admin: z.number(),
@@ -102,25 +130,6 @@ export const zAttachment = z.object({
   convertedUrl: z.union([z.string(), z.null()]),
 });
 
-export const zUserBaseSchema = z.object({
-  id: z.string(),
-  slug: z.string(),
-  name: z.string(),
-  thumbnailUrl: z.optional(z.union([z.string(), z.null()])),
-  bannerUrl: z.optional(z.union([z.string(), z.null()])),
-  email: z.email(),
-  entityType: z.enum(['user']),
-});
-
-export const zContextEntityBaseSchema = z.object({
-  id: z.string(),
-  entityType: z.enum(['organization']),
-  slug: z.string(),
-  name: z.string(),
-  thumbnailUrl: z.optional(z.union([z.string(), z.null()])),
-  bannerUrl: z.optional(z.union([z.string(), z.null()])),
-});
-
 export const zMenuSchema = z.object({
   organization: z.array(
     z.object({
@@ -129,23 +138,22 @@ export const zMenuSchema = z.object({
       slug: z.string(),
       name: z.string(),
       thumbnailUrl: z.optional(z.union([z.string(), z.null()])),
-      membership: zMembershipBaseSchema.and(z.record(z.string(), z.unknown())),
+      bannerUrl: z.optional(z.union([z.string(), z.null()])),
+      membership: zMembershipBaseSchema,
       createdAt: z.string(),
       modifiedAt: z.union([z.string(), z.null()]),
       organizationId: z.optional(z.string()),
       submenu: z.optional(
         z.array(
-          z.object({
-            id: z.string(),
-            entityType: z.enum(['organization']),
-            slug: z.string(),
-            name: z.string(),
-            thumbnailUrl: z.optional(z.union([z.string(), z.null()])),
-            membership: zMembershipBaseSchema.and(z.record(z.string(), z.unknown())),
-            createdAt: z.string(),
-            modifiedAt: z.union([z.string(), z.null()]),
-            organizationId: z.optional(z.string()),
-          }),
+          z.union([
+            zContextEntityBaseSchema,
+            z.object({
+              membership: zMembershipBaseSchema,
+              createdAt: z.string(),
+              modifiedAt: z.union([z.string(), z.null()]),
+              organizationId: z.optional(z.string()),
+            }),
+          ]),
         ),
       ),
     }),
@@ -221,7 +229,7 @@ export const zCheckEmailData = z.object({
 /**
  * Email exists
  */
-export const zCheckEmailResponse = z.boolean();
+export const zCheckEmailResponse = z.void();
 
 export const zInvokeTokenData = z.object({
   body: z.optional(z.never()),
@@ -267,7 +275,7 @@ export const zStartImpersonationData = z.object({
 /**
  * Impersonating
  */
-export const zStartImpersonationResponse = z.boolean();
+export const zStartImpersonationResponse = z.void();
 
 export const zStopImpersonationData = z.object({
   body: z.optional(z.never()),
@@ -278,7 +286,7 @@ export const zStopImpersonationData = z.object({
 /**
  * Stopped impersonating
  */
-export const zStopImpersonationResponse = z.boolean();
+export const zStopImpersonationResponse = z.void();
 
 export const zSignOutData = z.object({
   body: z.optional(z.never()),
@@ -289,7 +297,7 @@ export const zSignOutData = z.object({
 /**
  * User signed out
  */
-export const zSignOutResponse = z.boolean();
+export const zSignOutResponse = z.void();
 
 export const zGenerateTotpKeyData = z.object({
   body: z.optional(z.never()),
@@ -314,7 +322,7 @@ export const zDeleteTotpData = z.object({
 /**
  * TOTP deleted
  */
-export const zDeleteTotpResponse = z.boolean();
+export const zDeleteTotpResponse = z.void();
 
 export const zCreateTotpData = z.object({
   body: z.object({
@@ -327,7 +335,7 @@ export const zCreateTotpData = z.object({
 /**
  * TOTP created
  */
-export const zCreateTotpResponse = z.boolean();
+export const zCreateTotpResponse = z.void();
 
 export const zSignInWithTotpData = z.object({
   body: z.optional(
@@ -342,7 +350,7 @@ export const zSignInWithTotpData = z.object({
 /**
  * TOTP verified
  */
-export const zSignInWithTotpResponse = z.boolean();
+export const zSignInWithTotpResponse = z.void();
 
 export const zSignUpData = z.object({
   body: z.optional(
@@ -358,7 +366,7 @@ export const zSignUpData = z.object({
 /**
  * User signed up
  */
-export const zSignUpResponse = z.boolean();
+export const zSignUpResponse = z.void();
 
 export const zSignUpWithTokenData = z.object({
   body: z.optional(
@@ -394,7 +402,7 @@ export const zRequestPasswordData = z.object({
 /**
  * Password reset email sent
  */
-export const zRequestPasswordResponse = z.boolean();
+export const zRequestPasswordResponse = z.void();
 
 export const zCreatePasswordData = z.object({
   body: z.optional(
@@ -470,7 +478,7 @@ export const zDeletePasskeyData = z.object({
 /**
  * Passkey deleted
  */
-export const zDeletePasskeyResponse = z.boolean();
+export const zDeletePasskeyResponse = z.void();
 
 export const zGeneratePasskeyChallengeData = z.object({
   body: z.optional(
@@ -509,7 +517,7 @@ export const zSignInWithPasskeyData = z.object({
 /**
  * Passkey verified
  */
-export const zSignInWithPasskeyResponse = z.boolean();
+export const zSignInWithPasskeyResponse = z.void();
 
 export const zGithubData = z.object({
   body: z.optional(z.never()),
@@ -583,7 +591,7 @@ export const zDeleteMeData = z.object({
 /**
  * User deleted
  */
-export const zDeleteMeResponse = z.boolean();
+export const zDeleteMeResponse = z.void();
 
 export const zGetMeData = z.object({
   body: z.optional(z.never()),
@@ -715,8 +723,19 @@ export const zGetMyInvitationsResponse = z.array(
         organizationId: z.optional(z.string()),
       }),
     ),
-    invitedBy: zUserBaseSchema.and(z.union([z.record(z.string(), z.unknown()), z.null()])),
-    membership: zMembershipBaseSchema.and(z.record(z.string(), z.unknown())),
+    invitedBy: z.union([
+      z.object({
+        id: z.string(),
+        slug: z.string(),
+        name: z.string(),
+        thumbnailUrl: z.optional(z.union([z.string(), z.null()])),
+        bannerUrl: z.optional(z.union([z.string(), z.null()])),
+        email: z.email(),
+        entityType: z.enum(['user']),
+      }),
+      z.null(),
+    ]),
+    membership: zMembershipBaseSchema,
     expiresAt: z.string(),
   }),
 );
@@ -751,7 +770,7 @@ export const zDeleteMyMembershipData = z.object({
 /**
  * Membership removed
  */
-export const zDeleteMyMembershipResponse = z.boolean();
+export const zDeleteMyMembershipResponse = z.void();
 
 export const zGetUploadTokenData = z.object({
   body: z.optional(z.never()),
@@ -831,7 +850,7 @@ export const zGetUsersResponse = z.object({
     z.union([
       zUser,
       z.object({
-        memberships: z.array(z.union([zMembershipBaseSchema, z.record(z.string(), z.unknown())])),
+        memberships: z.array(zMembershipBaseSchema),
       }),
     ]),
   ),
@@ -910,7 +929,7 @@ export const zGetOrganizationsData = z.object({
  * Organizations
  */
 export const zGetOrganizationsResponse = z.object({
-  items: z.array(z.union([zOrganization, z.record(z.string(), z.unknown())])),
+  items: z.array(zOrganization),
   total: z.number(),
 });
 
@@ -928,7 +947,18 @@ export const zCreateOrganizationData = z.object({
  */
 export const zCreateOrganizationResponse = zOrganization.and(
   z.object({
-    membership: z.optional(zMembershipBaseSchema.and(z.record(z.string(), z.unknown()))),
+    membership: z.optional(
+      z.object({
+        id: z.string(),
+        contextType: z.enum(['organization']),
+        userId: z.string(),
+        role: z.enum(['member', 'admin']),
+        archived: z.boolean(),
+        muted: z.boolean(),
+        order: z.number().gte(-140737488355328).lte(140737488355327),
+        organizationId: z.string(),
+      }),
+    ),
   }),
 );
 
@@ -1002,23 +1032,33 @@ export const zGetContextEntitiesData = z.object({
  * Context entities
  */
 export const zGetContextEntitiesResponse = z.object({
-  items: z.object({
-    organization: z.array(
-      z.union([
-        zContextEntityBaseSchema,
-        z.object({
-          createdAt: z.string(),
-          membership: zMembershipBaseSchema,
-          membershipCounts: z.object({
-            admin: z.number(),
-            member: z.number(),
-            pending: z.number(),
-            total: z.number(),
+  items: z.array(
+    z.union([
+      zContextEntityBaseSchema,
+      z.object({
+        membership: z.union([
+          z.object({
+            id: z.string(),
+            contextType: z.enum(['organization']),
+            userId: z.string(),
+            role: z.enum(['member', 'admin']),
+            archived: z.boolean(),
+            muted: z.boolean(),
+            order: z.number().gte(-140737488355328).lte(140737488355327),
+            organizationId: z.string(),
           }),
+          z.null(),
+        ]),
+        createdAt: z.string(),
+        membershipCounts: z.object({
+          admin: z.number(),
+          member: z.number(),
+          pending: z.number(),
+          total: z.number(),
         }),
-      ]),
-    ),
-  }),
+      }),
+    ]),
+  ),
   total: z.number(),
 });
 
@@ -1051,7 +1091,7 @@ export const zCheckSlugData = z.object({
 /**
  * Slug is available
  */
-export const zCheckSlugResponse = z.boolean();
+export const zCheckSlugResponse = z.void();
 
 export const zSystemInviteData = z.object({
   body: z.optional(
@@ -1095,7 +1135,7 @@ export const zPaddleWebhookData = z.object({
 /**
  * Paddle webhook received
  */
-export const zPaddleWebhookResponse = z.boolean();
+export const zPaddleWebhookResponse = z.void();
 
 export const zSendNewsletterData = z.object({
   body: z.object({
@@ -1113,9 +1153,9 @@ export const zSendNewsletterData = z.object({
 });
 
 /**
- * Organization
+ * Newsletter sent
  */
-export const zSendNewsletterResponse = z.boolean();
+export const zSendNewsletterResponse = z.void();
 
 export const zDeleteRequestsData = z.object({
   body: z.optional(
@@ -1128,9 +1168,9 @@ export const zDeleteRequestsData = z.object({
 });
 
 /**
- * Requests
+ * Requests deleted
  */
-export const zDeleteRequestsResponse = z.boolean();
+export const zDeleteRequestsResponse = z.void();
 
 export const zGetRequestsData = z.object({
   body: z.optional(z.never()),
@@ -1490,7 +1530,7 @@ export const zGetMembersResponse = z.object({
       lastStartedAt: z.union([z.string(), z.null()]),
       lastSignInAt: z.union([z.string(), z.null()]),
       modifiedBy: z.union([z.string(), z.null()]),
-      membership: zMembershipBaseSchema.and(z.record(z.string(), z.unknown())),
+      membership: zMembershipBaseSchema,
     }),
   ),
   total: z.number(),
@@ -1531,12 +1571,16 @@ export const zGetPendingInvitationsResponse = z.object({
 });
 
 export const zResendInvitationData = z.object({
-  body: z.optional(
+  body: z.union([
     z.object({
-      email: z.optional(z.email()),
+      email: z.email(),
       tokenId: z.optional(z.string()),
     }),
-  ),
+    z.object({
+      email: z.optional(z.email()),
+      tokenId: z.string(),
+    }),
+  ]),
   path: z.optional(z.never()),
   query: z.optional(z.never()),
 });
@@ -1544,4 +1588,4 @@ export const zResendInvitationData = z.object({
 /**
  * Invitation email sent
  */
-export const zResendInvitationResponse = z.boolean();
+export const zResendInvitationResponse = z.void();
diff --git a/frontend/src/modules/auth/passkey-strategy.tsx b/frontend/src/modules/auth/passkey-strategy.tsx
index 0febce892..7b26ec427 100644
--- a/frontend/src/modules/auth/passkey-strategy.tsx
+++ b/frontend/src/modules/auth/passkey-strategy.tsx
@@ -30,9 +30,8 @@ const PasskeyStrategy = ({
       // Send signed response to BE to complete authentication
       return await signInWithPasskey({ body });
     },
-    onSuccess: (success) => {
-      if (success) navigate({ to: redirectPath, replace: true });
-      else toaster(t('error:passkey_verification_failed'), 'error');
+    onSuccess: () => {
+      navigate({ to: redirectPath, replace: true });
     },
     onError: (error) => {
       if (type === 'mfa' && error instanceof ApiError) {
diff --git a/frontend/src/modules/auth/totp-strategy.tsx b/frontend/src/modules/auth/totp-strategy.tsx
index c57561782..2d203aaa0 100644
--- a/frontend/src/modules/auth/totp-strategy.tsx
+++ b/frontend/src/modules/auth/totp-strategy.tsx
@@ -20,9 +20,8 @@ export const TotpStrategy = ({ isActive, setIsActive }: { isActive: boolean; set
 
   const { mutate: totpSignIn } = useMutation<SignInWithTotpResponse, ApiError | Error, NonNullable<SignInWithTotpData['body']>>({
     mutationFn: async (body) => await signInWithTotp({ body }),
-    onSuccess: (success) => {
-      if (success) navigate({ to: appConfig.defaultRedirectPath, replace: true });
-      else toaster(t('error:totp_verification_failed'), 'error');
+    onSuccess: () => {
+      navigate({ to: appConfig.defaultRedirectPath, replace: true });
     },
     onError: () => toaster(t('error:totp_verification_failed'), 'error'),
   });
diff --git a/frontend/src/modules/common/error-notice.tsx b/frontend/src/modules/common/error-notice.tsx
index 2c34f863b..21bc11621 100644
--- a/frontend/src/modules/common/error-notice.tsx
+++ b/frontend/src/modules/common/error-notice.tsx
@@ -105,7 +105,7 @@ const ErrorNotice = ({ error, children, resetErrorBoundary, level }: ErrorNotice
           <Card className="max-w-[80vw] sm:max-w-[36rem] mt-8 bg-transparent border-none">
             <CardHeader className="text-center p-0">
               <CardTitle className="text-2xl font-normal mb-2 justify-center">{title}</CardTitle>
-              <CardDescription className="font-light flex-col gap-2 p-0">
+              <CardDescription className="text-base flex-col gap-2 p-0">
                 <span className="block">{message}</span>
                 <span className="block mt-2 font-light">
                   <span className="block">{severity === 'warn' && t('error:contact_mistake')}</span>
@@ -114,7 +114,7 @@ const ErrorNotice = ({ error, children, resetErrorBoundary, level }: ErrorNotice
               </CardDescription>
             </CardHeader>
             {error && 'status' in error && (
-              <CardContent className="whitespace-pre-wrap text-red-600 font-mono p-0 pb-4">
+              <CardContent className="whitespace-pre-wrap text-red-600 font-mono px-0 py-4">
                 {error.type && (
                   <Button
                     variant="link"
diff --git a/frontend/src/modules/common/form-fields/slug.tsx b/frontend/src/modules/common/form-fields/slug.tsx
index 6a051981d..47da529a2 100644
--- a/frontend/src/modules/common/form-fields/slug.tsx
+++ b/frontend/src/modules/common/form-fields/slug.tsx
@@ -5,7 +5,7 @@ import { useEffect, useState } from 'react';
 import { type FieldValues, type Path, useFormContext, useWatch } from 'react-hook-form';
 import { useTranslation } from 'react-i18next';
 import slugify from 'slugify';
-import { type CheckSlugData, checkSlug as checkSlugAvailable } from '~/api.gen';
+import { type CheckSlugData, CheckSlugResponse, checkSlug } from '~/api.gen';
 import { useMeasure } from '~/hooks/use-measure';
 import { useOnlineManager } from '~/hooks/use-online-manager';
 import type { ApiError } from '~/lib/api';
@@ -53,15 +53,17 @@ export const SlugFormField = <TFieldValues extends FieldValues>({
   const slug = useWatch({ control: form.control, name: name });
 
   // Check if slug is available
-  const { mutate: checkAvailability } = useMutation<boolean, ApiError, NonNullable<CheckSlugData['body']>>({
+  const { mutate: checkAvailability } = useMutation<CheckSlugResponse, ApiError, NonNullable<CheckSlugData['body']>>({
     mutationKey: [name],
     mutationFn: async (body) => {
-      return await checkSlugAvailable({ body });
+      return await checkSlug({ body });
     },
-    onSuccess: (isAvailable) => {
-      if (isValidSlug(slug)) form.clearErrors(name);
-      if (isAvailable && isValidSlug(slug)) return setSlugAvailable('available');
-      // Slug is not available
+    onSuccess: () => {
+      if (!isValidSlug(slug)) return;
+      form.clearErrors(name);
+      setSlugAvailable('available');
+    },
+    onError: () => {
       form.setError(name, { type: 'manual', message: t('error:slug_exists') });
       setSlugAvailable('notAvailable');
     },
diff --git a/frontend/src/modules/entities/entity-grid/grid.tsx b/frontend/src/modules/entities/entity-grid/grid.tsx
index cca20a8e8..a7e56f639 100644
--- a/frontend/src/modules/entities/entity-grid/grid.tsx
+++ b/frontend/src/modules/entities/entity-grid/grid.tsx
@@ -27,7 +27,7 @@ export const BaseEntityGrid = ({ queryOptions, tileComponent: TileComponent = En
     fetchNextPage,
   } = useSuspenseInfiniteQuery({
     ...queryOptions,
-    select: (data) => data.pages.flatMap(({ items }) => items[entityType]),
+    select: (data) => data.pages.flatMap(({ items }) => items.filter((e) => e.entityType === entityType)),
   });
 
   const isFiltered = !!searchVars.q;
diff --git a/frontend/src/modules/entities/query.ts b/frontend/src/modules/entities/query.ts
index aa3e68398..5e2707986 100644
--- a/frontend/src/modules/entities/query.ts
+++ b/frontend/src/modules/entities/query.ts
@@ -45,7 +45,7 @@ export const searchContextEntitiesQueryOptions = ({
     staleTime: 0,
     enabled: q.trim().length > 0, // to avoid issues with spaces
     initialData: {
-      items: Object.fromEntries(appConfig.contextEntityTypes.map((t) => [t, []])) as { [P in ContextEntityType]: [] },
+      items: [],
       total: 0,
     },
     placeholderData: keepPreviousData,
@@ -76,26 +76,14 @@ export const contextEntitiesQueryOptions = ({
 }: Omit<NonNullable<GetContextEntitiesData['query']>, 'targetOrgId' | 'orgAffiliated' | 'order' | 'limit'> & { limit?: number }) => {
   const limit = String(baseLimit);
   const orgAffiliated = 'false';
-  const { initialPageParam } = baseInfiniteQueryOptions;
 
   return infiniteQueryOptions({
     queryKey: entitiesKeys.grid.context({ q, sort, targetUserId, types, role }),
-    initialPageParam,
     queryFn: async ({ pageParam: { page, offset: _offset }, signal }) => {
       const offset = String(_offset || (page || 0) * Number(limit));
       return await getContextEntities({ query: { q, sort, types, role, targetUserId, excludeArchived, orgAffiliated, offset, limit }, signal });
     },
-    getNextPageParam: (lastPage, allPages) => {
-      const total = lastPage.total;
-
-      const fetchedCount = allPages.reduce((acc, page) => {
-        const pageCount = Object.values(page.items).reduce((sum, arr) => sum + arr.length, 0);
-        return acc + pageCount;
-      }, 0);
-
-      if (fetchedCount >= total) return undefined;
-      return { page: allPages.length, offset: fetchedCount };
-    },
+    ...baseInfiniteQueryOptions,
     staleTime: 0,
   });
 };
diff --git a/frontend/src/modules/entities/types.ts b/frontend/src/modules/entities/types.ts
index b9d6e3562..371414f9d 100644
--- a/frontend/src/modules/entities/types.ts
+++ b/frontend/src/modules/entities/types.ts
@@ -1,4 +1,3 @@
-import type { ContextEntityType } from 'config';
 import type { ContextEntityBaseSchema, GetContextEntitiesResponse, MembershipBaseSchema, Organization } from '~/api.gen';
 
 export type EntityPage = ContextEntityBaseSchema & {
@@ -8,4 +7,4 @@ export type EntityPage = ContextEntityBaseSchema & {
 };
 
 export type ContextEntityItems = GetContextEntitiesResponse['items'];
-export type EntityGridItem = ContextEntityItems[ContextEntityType][number];
+export type EntityGridItem = ContextEntityItems[number];
diff --git a/frontend/src/modules/home/index.tsx b/frontend/src/modules/home/index.tsx
index 5d9a5d8f7..ca1de40cb 100644
--- a/frontend/src/modules/home/index.tsx
+++ b/frontend/src/modules/home/index.tsx
@@ -13,6 +13,7 @@ const Home = () => {
 
   useEffect(() => {
     (async () => {
+      // TODO
       getContextEntities();
     })();
 
diff --git a/frontend/src/modules/me/passkeys/list.tsx b/frontend/src/modules/me/passkeys/list.tsx
index 90d8d5872..ad4e2765e 100644
--- a/frontend/src/modules/me/passkeys/list.tsx
+++ b/frontend/src/modules/me/passkeys/list.tsx
@@ -24,7 +24,7 @@ const PasskeysList = () => {
   const handleUnlinkPasskey = (id: string) => {
     if (!onlineManager.isOnline()) return toaster(t('common:action.offline.text'), 'warning');
     if (user.mfaRequired && passkeys.length <= 1) return toaster(t('common:unlink_mfa_last', { method: 'the last passkey' }), 'info');
-    deletePasskey(id);
+    deletePasskey({ id });
   };
   return (
     <div className="mb-6">
diff --git a/frontend/src/modules/me/query.ts b/frontend/src/modules/me/query.ts
index 4a9cfae99..27b904f07 100644
--- a/frontend/src/modules/me/query.ts
+++ b/frontend/src/modules/me/query.ts
@@ -1,6 +1,6 @@
 import { queryOptions, useMutation } from '@tanstack/react-query';
 import { t } from 'i18next';
-import type { ToggleMfaData, User } from '~/api.gen';
+import type { DeletePasskeyData, DeletePasskeyResponse, ToggleMfaData, User } from '~/api.gen';
 import { createPasskey, deletePasskey, deleteTotp, getMyInvitations, toggleMfa, type UpdateMeData, updateMe } from '~/api.gen';
 import type { ApiError } from '~/lib/api';
 import { getPasskeyRegistrationCredential } from '~/modules/auth/passkey-credentials';
@@ -144,10 +144,10 @@ export const useCreatePasskeyMutation = () => {
  * @returns The mutation hook for deleting passkey.
  */
 export const useDeletePasskeyMutation = () => {
-  return useMutation<boolean, ApiError, string>({
+  return useMutation<DeletePasskeyResponse, ApiError, DeletePasskeyData['path']>({
     mutationKey: meKeys.delete.passkey,
-    mutationFn: (id: string) => deletePasskey({ path: { id } }),
-    onSuccess: (_data, id) => {
+    mutationFn: ({ id }) => deletePasskey({ path: { id } }),
+    onSuccess: (_data, { id }) => {
       queryClient.setQueryData<MeAuthData>(meKeys.auth, (oldData) => {
         if (!oldData) return oldData;
         return {
@@ -170,7 +170,7 @@ export const useDeletePasskeyMutation = () => {
  * @returns The mutation hook for unlink totp.
  */
 export const useDeleteTotpMutation = () => {
-  return useMutation<boolean, ApiError, void>({
+  return useMutation<DeletePasskeyResponse, ApiError, void>({
     mutationKey: meKeys.delete.totp,
     mutationFn: () => deleteTotp(),
     onSuccess: () => {
diff --git a/frontend/src/modules/memberships/resend-membership-invitation.tsx b/frontend/src/modules/memberships/resend-membership-invitation.tsx
index 2d64ad1ae..b7edc1cc7 100644
--- a/frontend/src/modules/memberships/resend-membership-invitation.tsx
+++ b/frontend/src/modules/memberships/resend-membership-invitation.tsx
@@ -9,7 +9,7 @@ import { TooltipButton } from '~/modules/common/tooltip-button';
 import { Button, type ButtonProps } from '~/modules/ui/button';
 
 type ResendButtonPrpos = {
-  resendData: NonNullable<ResendInvitationData['body']>;
+  resendData: ResendInvitationData['body'];
   buttonProps?: ButtonProps;
   wrapperClassName?: string;
   callback?: () => void;
@@ -21,12 +21,10 @@ export const ResendMembershipInviteButton = ({ resendData, wrapperClassName, but
 
   const { mutate: resend, isPending } = useMutation<ResendInvitationResponse, ApiError, ResendInvitationData['body']>({
     mutationFn: (body) => resendInvitation({ body }),
-    onSuccess: (success) => {
+    onSuccess: () => {
       useDialoger.getState().remove();
-      if (success) {
-        toaster(t('common:success.resend_invitation'), 'success');
-        if (callback) callback();
-      }
+      toaster(t('common:success.resend_invitation'), 'success');
+      if (callback) callback();
     },
     onError: () => document.getElementById('reset-email-field')?.focus(),
     onSettled: () => setTimeout(() => setDisabledResetPassword(false), 60000),
diff --git a/frontend/src/modules/navigation/search.tsx b/frontend/src/modules/navigation/search.tsx
index 4d9fdff16..6e354eeab 100644
--- a/frontend/src/modules/navigation/search.tsx
+++ b/frontend/src/modules/navigation/search.tsx
@@ -1,10 +1,10 @@
 import { useQueries } from '@tanstack/react-query';
 import { useNavigate } from '@tanstack/react-router';
-import { appConfig } from 'config';
+import { appConfig, ContextEntityType } from 'config';
 import { History, Search, X } from 'lucide-react';
 import { useRef, useState } from 'react';
 import { useTranslation } from 'react-i18next';
-import type { ContextEntityBaseSchema, UserBaseSchema } from '~/api.gen';
+import type { ContextEntityBaseSchema, GetContextEntitiesResponse, UserBaseSchema } from '~/api.gen';
 import useFocusByRef from '~/hooks/use-focus-by-ref';
 import ContentPlaceholder from '~/modules/common/content-placeholder';
 import { useDialoger } from '~/modules/common/dialoger/use-dialoger';
@@ -62,12 +62,21 @@ export const AppSearch = () => {
     combine: ([contextEntitiesResult, usersResult]) => {
       const usersData = usersResult.data;
       const entitiesData = contextEntitiesResult.data;
-
       const combinedTotal = (usersData.total || 0) + (entitiesData.total || 0);
+
+      const groupedEntities = entitiesData?.items?.reduce(
+        (acc, entity) => {
+          const type = entity.entityType;
+          (acc[type] ??= []).push(entity);
+          return acc;
+        },
+        {} as Record<ContextEntityType, GetContextEntitiesResponse['items'][number][]>,
+      );
+
       return {
         data: {
           user: usersData.items,
-          ...entitiesData.items,
+          ...groupedEntities,
         },
         notFound: combinedTotal === 0, // true if there are no results
         isFetching: usersResult.isFetching || contextEntitiesResult.isFetching,
@@ -161,7 +170,7 @@ export const AppSearch = () => {
             </>
           )}
           {appConfig.pageEntityTypes.map((entityType) => (
-            <SearchResultBlock key={entityType} results={data[entityType]} entityType={entityType} onSelect={onSelectItem} />
+            <SearchResultBlock key={entityType} results={data[entityType] ?? []} entityType={entityType} onSelect={onSelectItem} />
           ))}
         </CommandList>
       </ScrollArea>
diff --git a/frontend/src/modules/system/create-newsletter-form.tsx b/frontend/src/modules/system/create-newsletter-form.tsx
index 190cba55d..008588b3f 100644
--- a/frontend/src/modules/system/create-newsletter-form.tsx
+++ b/frontend/src/modules/system/create-newsletter-form.tsx
@@ -6,7 +6,7 @@ import { useMemo, useState } from 'react';
 import type { UseFormProps } from 'react-hook-form';
 import { useTranslation } from 'react-i18next';
 import type { z } from 'zod';
-import { type SendNewsletterData, sendNewsletter } from '~/api.gen';
+import { type SendNewsletterData, SendNewsletterResponse, sendNewsletter } from '~/api.gen';
 import { zSendNewsletterData } from '~/api.gen/zod.gen';
 import { useFormWithDraft } from '~/hooks/use-draft-form';
 import type { ApiError } from '~/lib/api';
@@ -48,7 +48,11 @@ const CreateNewsletterForm = ({ organizationIds, callback }: CreateNewsletterFor
   const form = useFormWithDraft<FormValues>(formContainerId, { formOptions });
 
   // Send newsletter
-  const { mutate: _sendNewsletter, isPending } = useMutation<boolean, ApiError, { body: SendNewsletterData['body'] } & SendNewsletterData['query']>({
+  const { mutate: _sendNewsletter, isPending } = useMutation<
+    SendNewsletterResponse,
+    ApiError,
+    { body: SendNewsletterData['body'] } & SendNewsletterData['query']
+  >({
     mutationFn: async ({ body, toSelf }) => {
       return await sendNewsletter({ body, query: { toSelf } });
     },
diff --git a/package.json b/package.json
index d43517a3c..732475c27 100644
--- a/package.json
+++ b/package.json
@@ -55,7 +55,7 @@
     "test": "pnpm -r --parallel test"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.2.4",
+    "@biomejs/biome": "^2.2.5",
     "@evilmartians/lefthook": "^1.13.6",
     "@typescript/native-preview": "7.0.0-dev.20250910.1",
     "cross-env": "^10.1.0",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 7223d34d4..8760e8632 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -13,8 +13,8 @@ importers:
         version: 17.2.3
     devDependencies:
       '@biomejs/biome':
-        specifier: ^2.2.4
-        version: 2.2.4
+        specifier: ^2.2.5
+        version: 2.2.5
       '@evilmartians/lefthook':
         specifier: ^1.13.6
         version: 1.13.6
@@ -46,20 +46,20 @@ importers:
         specifier: 8.1.0
         version: 8.1.0(zod@4.1.8)
       '@aws-sdk/client-s3':
-        specifier: ^3.896.0
-        version: 3.896.0
+        specifier: ^3.901.0
+        version: 3.901.0
       '@aws-sdk/cloudfront-signer':
-        specifier: ^3.893.0
-        version: 3.893.0
+        specifier: ^3.901.0
+        version: 3.901.0
       '@aws-sdk/lib-storage':
-        specifier: ^3.896.0
-        version: 3.896.0(@aws-sdk/client-s3@3.896.0)
+        specifier: ^3.901.0
+        version: 3.901.0(@aws-sdk/client-s3@3.901.0)
       '@aws-sdk/s3-request-presigner':
-        specifier: ^3.896.0
-        version: 3.896.0
+        specifier: ^3.901.0
+        version: 3.901.0
       '@cellajs/permission-manager':
         specifier: ^0.1.0
-        version: 0.1.0(@swc/core@1.7.26)(jiti@2.6.1)(postcss@8.5.6)(tsx@4.20.5)(yaml@2.8.1)
+        version: 0.1.0(@swc/core@1.7.26)(jiti@2.6.1)(postcss@8.5.6)(tsx@4.20.6)(yaml@2.8.1)
       '@dotenv-run/core':
         specifier: ^1.3.8
         version: 1.3.8
@@ -70,8 +70,8 @@ importers:
         specifier: 2.5.0
         version: 2.5.0
       '@hono/node-server':
-        specifier: ^1.19.4
-        version: 1.19.4(hono@4.9.8)
+        specifier: ^1.19.5
+        version: 1.19.5(hono@4.9.8)
       '@hono/zod-openapi':
         specifier: 1.1.3
         version: 1.1.3(hono@4.9.8)(zod@4.1.8)
@@ -82,8 +82,8 @@ importers:
         specifier: ^2.0.2
         version: 2.0.2
       '@novu/api':
-        specifier: ^1.6.0
-        version: 1.6.0
+        specifier: ^1.7.0
+        version: 1.7.0
       '@opentelemetry/api':
         specifier: ^1.9.0
         version: 1.9.0
@@ -118,14 +118,14 @@ importers:
         specifier: ^3.2.1
         version: 3.2.1
       '@scalar/hono-api-reference':
-        specifier: ^0.9.19
-        version: 0.9.19(hono@4.9.8)
+        specifier: ^0.9.20
+        version: 0.9.20(hono@4.9.8)
       '@sendgrid/mail':
         specifier: ^8.1.6
         version: 8.1.6
       '@sentry/cli':
-        specifier: ^2.55.0
-        version: 2.55.0
+        specifier: ^2.56.0
+        version: 2.56.0
       '@sentry/node':
         specifier: ^9.46.0
         version: 9.46.0
@@ -134,7 +134,7 @@ importers:
         version: 9.46.0
       '@t3-oss/env-core':
         specifier: ^0.13.8
-        version: 0.13.8(arktype@2.1.20)(typescript@5.9.2)(zod@4.1.8)
+        version: 0.13.8(arktype@2.1.20)(typescript@5.9.3)(zod@4.1.8)
       arctic:
         specifier: ^3.7.0
         version: 3.7.0
@@ -142,11 +142,11 @@ importers:
         specifier: workspace:*
         version: link:../config
       drizzle-orm:
-        specifier: ^0.44.5
-        version: 0.44.5(@electric-sql/pglite@0.3.10)(@libsql/client-wasm@0.14.0)(@opentelemetry/api@1.9.0)(@types/pg@8.15.5)(gel@2.0.2)(pg@8.16.3)(postgres@3.4.7)
+        specifier: ^0.44.6
+        version: 0.44.6(@electric-sql/pglite@0.3.10)(@libsql/client-wasm@0.14.0)(@opentelemetry/api@1.9.0)(@types/pg@8.15.5)(gel@2.0.2)(pg@8.16.3)(postgres@3.4.7)
       drizzle-zod:
         specifier: 0.8.3
-        version: 0.8.3(drizzle-orm@0.44.5(@electric-sql/pglite@0.3.10)(@libsql/client-wasm@0.14.0)(@opentelemetry/api@1.9.0)(@types/pg@8.15.5)(gel@2.0.2)(pg@8.16.3)(postgres@3.4.7))(zod@4.1.8)
+        version: 0.8.3(drizzle-orm@0.44.6(@electric-sql/pglite@0.3.10)(@libsql/client-wasm@0.14.0)(@opentelemetry/api@1.9.0)(@types/pg@8.15.5)(gel@2.0.2)(pg@8.16.3)(postgres@3.4.7))(zod@4.1.8)
       enforce-unique:
         specifier: ^1.3.0
         version: 1.3.0
@@ -154,8 +154,8 @@ importers:
         specifier: 4.9.8
         version: 4.9.8
       i18next:
-        specifier: ^25.5.2
-        version: 25.5.2(typescript@5.9.2)
+        specifier: ^25.5.3
+        version: 25.5.3(typescript@5.9.3)
       isbot:
         specifier: ^5.1.31
         version: 5.1.31
@@ -167,7 +167,7 @@ importers:
         version: 9.0.2
       jsx-email:
         specifier: ^2.7.3
-        version: 2.7.3(@emotion/is-prop-valid@1.3.1)(@jsx-email/plugin-inline@1.0.1)(@jsx-email/plugin-minify@1.0.1)(@jsx-email/plugin-pretty@1.0.0)(@types/node@24.5.2)(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(lightningcss@1.30.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(terser@5.44.0)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2))(typescript@5.9.2)
+        version: 2.7.3(@emotion/is-prop-valid@1.3.1)(@jsx-email/plugin-inline@1.0.1)(@jsx-email/plugin-minify@1.0.1)(@jsx-email/plugin-pretty@1.0.0)(@types/node@24.6.2)(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(lightningcss@1.30.1)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(terser@5.44.0)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.6.2)(typescript@5.9.3))(typescript@5.9.3)
       locales:
         specifier: workspace:*
         version: link:../locales
@@ -181,8 +181,8 @@ importers:
         specifier: ^8.16.3
         version: 8.16.3
       pino:
-        specifier: ^9.11.0
-        version: 9.11.0
+        specifier: ^9.13.1
+        version: 9.13.1
       pino-http:
         specifier: ^10.5.0
         version: 10.5.0
@@ -193,14 +193,14 @@ importers:
         specifier: ^7.4.0
         version: 7.4.0
       react:
-        specifier: ^19.1.1
-        version: 19.1.1
+        specifier: ^19.2.0
+        version: 19.2.0
       react-dom:
-        specifier: ^19.1.1
-        version: 19.1.1(react@19.1.1)
+        specifier: ^19.2.0
+        version: 19.2.0(react@19.2.0)
       react-i18next:
-        specifier: ^15.7.3
-        version: 15.7.3(i18next@25.5.2(typescript@5.9.2))(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(typescript@5.9.2)
+        specifier: ^15.7.4
+        version: 15.7.4(i18next@25.5.3(typescript@5.9.3))(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(typescript@5.9.3)
       slugify:
         specifier: ^1.6.6
         version: 1.6.6
@@ -227,8 +227,8 @@ importers:
         specifier: ^9.0.10
         version: 9.0.10
       '@types/node':
-        specifier: ^24.5.2
-        version: 24.5.2
+        specifier: ^24.6.2
+        version: 24.6.2
       '@types/papaparse':
         specifier: ^5.3.16
         version: 5.3.16
@@ -236,8 +236,8 @@ importers:
         specifier: ^8.15.5
         version: 8.15.5
       '@types/react':
-        specifier: ^19.1.13
-        version: 19.1.13
+        specifier: ^19.2.0
+        version: 19.2.0
       '@types/ua-parser-js':
         specifier: ^0.7.39
         version: 0.7.39
@@ -251,14 +251,14 @@ importers:
         specifier: ^14.0.1
         version: 14.0.1
       cross-env:
-        specifier: ^10.0.0
-        version: 10.0.0
+        specifier: ^10.1.0
+        version: 10.1.0
       dotenv:
-        specifier: ^17.2.2
-        version: 17.2.2
+        specifier: ^17.2.3
+        version: 17.2.3
       drizzle-kit:
-        specifier: ^0.31.4
-        version: 0.31.4
+        specifier: ^0.31.5
+        version: 0.31.5
       papaparse:
         specifier: ^5.5.3
         version: 5.5.3
@@ -267,13 +267,13 @@ importers:
         version: 13.1.1
       tsup:
         specifier: ^8.5.0
-        version: 8.5.0(@swc/core@1.7.26)(jiti@2.6.1)(postcss@8.5.6)(tsx@4.20.5)(typescript@5.9.2)(yaml@2.8.1)
+        version: 8.5.0(@swc/core@1.7.26)(jiti@2.6.1)(postcss@8.5.6)(tsx@4.20.6)(typescript@5.9.3)(yaml@2.8.1)
       tsx:
-        specifier: ^4.20.5
-        version: 4.20.5
+        specifier: ^4.20.6
+        version: 4.20.6
       typescript:
-        specifier: ^5.9.2
-        version: 5.9.2
+        specifier: ^5.9.3
+        version: 5.9.3
 
   cli/create-cella:
     dependencies:
@@ -363,11 +363,11 @@ importers:
         specifier: 0.33.0
         version: 0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(highlight.js@11.11.1)(lowlight@3.3.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(tsx@4.20.6)(yaml@2.8.1)
       '@electric-sql/client':
-        specifier: 1.0.10
-        version: 1.0.10
+        specifier: 1.0.13
+        version: 1.0.13
       '@electric-sql/react':
-        specifier: 1.0.10
-        version: 1.0.10(react@19.2.0)
+        specifier: 1.0.13
+        version: 1.0.13(react@19.2.0)
       '@floating-ui/dom':
         specifier: ^1.7.4
         version: 1.7.4
@@ -466,28 +466,28 @@ importers:
         version: 9.46.0(react@19.2.0)
       '@t3-oss/env-core':
         specifier: ^0.13.8
-        version: 0.13.8(arktype@2.1.20)(typescript@5.9.3)(zod@4.1.8)
+        version: 0.13.8(arktype@2.1.20)(typescript@5.9.3)(zod@4.1.11)
       '@tailwindcss/typography':
         specifier: ^0.5.19
         version: 0.5.19(tailwindcss@4.1.14)
       '@tanstack/query-sync-storage-persister':
-        specifier: 5.87.4
-        version: 5.87.4
+        specifier: ^5.90.2
+        version: 5.90.2
       '@tanstack/react-query':
-        specifier: 5.87.4
-        version: 5.87.4(react@19.2.0)
+        specifier: ^5.90.2
+        version: 5.90.2(react@19.2.0)
       '@tanstack/react-query-devtools':
-        specifier: 5.87.4
-        version: 5.87.4(@tanstack/react-query@5.87.4(react@19.2.0))(react@19.2.0)
+        specifier: ^5.90.2
+        version: 5.90.2(@tanstack/react-query@5.90.2(react@19.2.0))(react@19.2.0)
       '@tanstack/react-query-persist-client':
-        specifier: 5.87.4
-        version: 5.87.4(@tanstack/react-query@5.87.4(react@19.2.0))(react@19.2.0)
+        specifier: ^5.90.2
+        version: 5.90.2(@tanstack/react-query@5.90.2(react@19.2.0))(react@19.2.0)
       '@tanstack/react-router':
-        specifier: 1.132.31
-        version: 1.132.31(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+        specifier: ^1.132.33
+        version: 1.132.33(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@tanstack/react-router-devtools':
-        specifier: 1.132.31
-        version: 1.132.31(@tanstack/react-router@1.132.31(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(@tanstack/router-core@1.132.31)(@types/node@24.6.2)(csstype@3.1.3)(jiti@1.21.7)(lightningcss@1.30.1)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.6)(yaml@2.8.1)
+        specifier: ^1.132.33
+        version: 1.132.33(@tanstack/react-router@1.132.33(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(@tanstack/router-core@1.132.33)(@types/node@24.6.2)(csstype@3.1.3)(jiti@1.21.7)(lightningcss@1.30.1)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.6)(yaml@2.8.1)
       '@uppy/audio':
         specifier: ^3.0.1
         version: 3.0.1(@uppy/core@5.0.2)
@@ -612,8 +612,8 @@ importers:
         specifier: 4.8.69
         version: 4.8.69
       player.style:
-        specifier: ^0.2.0
-        version: 0.2.0(react@19.2.0)
+        specifier: ^0.3.0
+        version: 0.3.0(react@19.2.0)
       qrcode.react:
         specifier: ^4.2.0
         version: 4.2.0(react@19.2.0)
@@ -678,8 +678,8 @@ importers:
         specifier: ^1.1.2
         version: 1.1.2(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       virtua:
-        specifier: ^0.43.6
-        version: 0.43.6(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(solid-js@1.9.9)(vue@3.5.13(typescript@5.9.3))
+        specifier: ^0.44.0
+        version: 0.44.0(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(solid-js@1.9.9)(vue@3.5.13(typescript@5.9.3))
       vitest:
         specifier: ^3.2.4
         version: 3.2.4(@types/debug@4.1.12)(@types/node@24.6.2)(@vitest/browser@3.2.4)(jiti@1.21.7)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
@@ -687,8 +687,8 @@ importers:
         specifier: ^7.3.0
         version: 7.3.0
       zod:
-        specifier: 4.1.8
-        version: 4.1.8
+        specifier: 4.1.11
+        version: 4.1.11
       zustand:
         specifier: ^5.0.8
         version: 5.0.8(@types/react@19.2.0)(immer@10.1.3)(react@19.2.0)(use-sync-external-store@1.6.0(react@19.2.0))
@@ -698,13 +698,13 @@ importers:
     devDependencies:
       '@chromatic-com/storybook':
         specifier: ^4.1.1
-        version: 4.1.1(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
+        version: 4.1.1(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
       '@hey-api/openapi-ts':
         specifier: ^0.84.4
         version: 0.84.4(magicast@0.3.5)(typescript@5.9.3)
       '@react-scan/vite-plugin-react-scan':
         specifier: ^0.1.8
-        version: 0.1.8(react-scan@0.4.3(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react-router-dom@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react-router@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react@19.2.0)(rollup@2.79.2))(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+        version: 0.1.8(react-scan@0.4.3(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react-router-dom@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react-router@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react@19.2.0)(rollup@2.79.2))(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@rollup/plugin-terser':
         specifier: ^0.4.4
         version: 0.4.4(rollup@2.79.2)
@@ -713,25 +713,25 @@ importers:
         version: 3.6.1
       '@storybook/addon-a11y':
         specifier: ^9.1.10
-        version: 9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
+        version: 9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
       '@storybook/addon-docs':
         specifier: ^9.1.10
-        version: 9.1.10(@types/react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
+        version: 9.1.10(@types/react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
       '@storybook/addon-vitest':
         specifier: ^9.1.10
-        version: 9.1.10(@vitest/browser@3.2.4)(@vitest/runner@3.2.4)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(vitest@3.2.4)
+        version: 9.1.10(@vitest/browser@3.2.4)(@vitest/runner@3.2.4)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(vitest@3.2.4)
       '@storybook/react-vite':
         specifier: ^9.1.10
-        version: 9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(rollup@2.79.2)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(typescript@5.9.3)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+        version: 9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(rollup@2.79.2)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(typescript@5.9.3)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@tailwindcss/vite':
         specifier: ^4.1.14
-        version: 4.1.14(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+        version: 4.1.14(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@tanstack/router-core':
-        specifier: ^1.132.31
-        version: 1.132.31
+        specifier: ^1.132.33
+        version: 1.132.33
       '@tanstack/router-plugin':
-        specifier: ^1.132.31
-        version: 1.132.31(@tanstack/react-router@1.132.31(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+        specifier: ^1.132.33
+        version: 1.132.33(@tanstack/react-router@1.132.33(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@types/canvas-confetti':
         specifier: ^1.9.0
         version: 1.9.0
@@ -752,13 +752,13 @@ importers:
         version: 7.0.0-dev.20250910.1
       '@vitejs/plugin-basic-ssl':
         specifier: ^2.1.0
-        version: 2.1.0(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+        version: 2.1.0(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@vitejs/plugin-react':
         specifier: ^5.0.4
-        version: 5.0.4(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+        version: 5.0.4(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@vitest/browser':
         specifier: ^3.2.4
-        version: 3.2.4(playwright@1.55.1)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)
+        version: 3.2.4(playwright@1.55.1)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)
       '@vitest/coverage-v8':
         specifier: ^3.2.4
         version: 3.2.4(@vitest/browser@3.2.4)(vitest@3.2.4)
@@ -785,7 +785,7 @@ importers:
         version: 6.0.4(rollup@2.79.2)
       storybook:
         specifier: ^9.1.10
-        version: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+        version: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       tsx:
         specifier: ^4.20.6
         version: 4.20.6
@@ -793,20 +793,20 @@ importers:
         specifier: ^5.9.3
         version: 5.9.3
       vite:
-        specifier: ^7.1.8
-        version: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+        specifier: ^7.1.9
+        version: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
       vite-plugin-html:
         specifier: ^3.2.2
-        version: 3.2.2(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+        version: 3.2.2(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       vite-plugin-pwa:
         specifier: ^1.0.3
-        version: 1.0.3(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(workbox-build@7.3.0(@types/babel__core@7.20.5))(workbox-window@7.3.0)
+        version: 1.0.3(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(workbox-build@7.3.0(@types/babel__core@7.20.5))(workbox-window@7.3.0)
       vite-plugin-static-copy:
         specifier: ^3.1.3
-        version: 3.1.3(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+        version: 3.1.3(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       vite-tsconfig-paths:
         specifier: ^5.1.4
-        version: 5.1.4(typescript@5.9.3)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+        version: 5.1.4(typescript@5.9.3)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       wait-on:
         specifier: ^8.0.5
         version: 8.0.5
@@ -899,142 +899,141 @@ packages:
   '@aws-crypto/util@5.2.0':
     resolution: {integrity: sha512-4RkU9EsI6ZpBve5fseQlGNUWKMa1RLPQ1dnjnQoe07ldfIzcsGb5hC5W0Dm7u423KWzawlrpbjXBrXCEv9zazQ==}
 
-  '@aws-sdk/client-s3@3.896.0':
-    resolution: {integrity: sha512-UETVuMLQRqgrWxTnavotY0TlB/jaR9sL3hkIFPx4KtjmigNBdwRaiVfOuTnIXKd+w9RPINYG//nnrK+5gIyZkA==}
+  '@aws-sdk/client-s3@3.901.0':
+    resolution: {integrity: sha512-wyKhZ51ur1tFuguZ6PgrUsot9KopqD0Tmxw8O8P/N3suQDxFPr0Yo7Y77ezDRDZQ95Ml3C0jlvx79HCo8VxdWA==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/client-sso@3.896.0':
-    resolution: {integrity: sha512-mpE3mrNili1dcvEvxaYjyoib8HlRXkb2bY5a3WeK++KObFY+HUujKtgQmiNSRX5YwQszm//fTrmGMmv9zpMcKg==}
+  '@aws-sdk/client-sso@3.901.0':
+    resolution: {integrity: sha512-sGyDjjkJ7ppaE+bAKL/Q5IvVCxtoyBIzN+7+hWTS/mUxWJ9EOq9238IqmVIIK6sYNIzEf9yhobfMARasPYVTNg==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/cloudfront-signer@3.893.0':
-    resolution: {integrity: sha512-SL2z8C9tRgZaqwJ1pbxQaBrUTb1DnFzqLEOJzYGrV9BWk5+LYm6KCK5XmBXzHICaKQL4YtigO7lNUU8SGEaw9Q==}
+  '@aws-sdk/cloudfront-signer@3.901.0':
+    resolution: {integrity: sha512-+yOAdoL57A9Y5OZJcU8m5zMoYCSHTzGp7StXsdt2h2oYLTa5r+fQXJU+P+6DVmVbDpy1ApeuZJOU4Q5LiiOpYg==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/core@3.896.0':
-    resolution: {integrity: sha512-uJaoyWKeGNyCyeI+cIJrD7LEB4iF/W8/x2ij7zg32OFpAAJx96N34/e+XSKp/xkJpO5FKiBOskKLnHeUsJsAPA==}
+  '@aws-sdk/core@3.901.0':
+    resolution: {integrity: sha512-brKAc3y64tdhyuEf+OPIUln86bRTqkLgb9xkd6kUdIeA5+qmp/N6amItQz+RN4k4O3kqkCPYnAd3LonTKluobw==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/credential-provider-env@3.896.0':
-    resolution: {integrity: sha512-Cnqhupdkp825ICySrz4QTI64Nq3AmUAscPW8dueanni0avYBDp7RBppX4H0+6icqN569B983XNfQ0YSImQhfhg==}
+  '@aws-sdk/credential-provider-env@3.901.0':
+    resolution: {integrity: sha512-5hAdVl3tBuARh3zX5MLJ1P/d+Kr5kXtDU3xm1pxUEF4xt2XkEEpwiX5fbkNkz2rbh3BCt2gOHsAbh6b3M7n+DA==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/credential-provider-http@3.896.0':
-    resolution: {integrity: sha512-CN0fTCKCUA1OTSx1c76o8XyJCy2WoI/av3J8r8mL6GmxTerhLRyzDy/MwxzPjTYPoL+GLEg6V4a9fRkWj1hBUA==}
+  '@aws-sdk/credential-provider-http@3.901.0':
+    resolution: {integrity: sha512-Ggr7+0M6QZEsrqRkK7iyJLf4LkIAacAxHz9c4dm9hnDdU7vqrlJm6g73IxMJXWN1bIV7IxfpzB11DsRrB/oNjQ==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/credential-provider-ini@3.896.0':
-    resolution: {integrity: sha512-+rbYG98czzwZLTYHJasK+VBjnIeXk73mRpZXHvaa4kDNxBezdN2YsoGNpLlPSxPdbpq18LY3LRtkdFTaT6DIQA==}
+  '@aws-sdk/credential-provider-ini@3.901.0':
+    resolution: {integrity: sha512-zxadcDS0hNJgv8n4hFYJNOXyfjaNE1vvqIiF/JzZSQpSSYXzCd+WxXef5bQh+W3giDtRUmkvP5JLbamEFjZKyw==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/credential-provider-node@3.896.0':
-    resolution: {integrity: sha512-J0Jm+56MNngk1PIyqoJFf5FC2fjA4CYXlqODqNRDtid7yk7HB9W3UTtvxofmii5KJOLcHGNPdGnHWKkUc+xYgw==}
+  '@aws-sdk/credential-provider-node@3.901.0':
+    resolution: {integrity: sha512-dPuFzMF7L1s/lQyT3wDxqLe82PyTH+5o1jdfseTEln64LJMl0ZMWaKX/C1UFNDxaTd35Cgt1bDbjjAWHMiKSFQ==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/credential-provider-process@3.896.0':
-    resolution: {integrity: sha512-UfWVMQPZy7dus40c4LWxh5vQ+I51z0q4vf09Eqas5848e9DrGRG46GYIuc/gy+4CqEypjbg/XNMjnZfGLHxVnQ==}
+  '@aws-sdk/credential-provider-process@3.901.0':
+    resolution: {integrity: sha512-/IWgmgM3Cl1wTdJA5HqKMAojxLkYchh5kDuphApxKhupLu6Pu0JBOHU8A5GGeFvOycyaVwosod6zDduINZxe+A==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/credential-provider-sso@3.896.0':
-    resolution: {integrity: sha512-77Te8WrVdLABKlv7QyetXP6aYEX1UORiahLA1PXQb/p66aFBw18Xc6JiN/6zJ4RqdyV1Xr9rwYBwGYua93ANIA==}
+  '@aws-sdk/credential-provider-sso@3.901.0':
+    resolution: {integrity: sha512-SjmqZQHmqFSET7+6xcZgtH7yEyh5q53LN87GqwYlJZ6KJ5oNw11acUNEhUOL1xTSJEvaWqwTIkS2zqrzLcM9bw==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/credential-provider-web-identity@3.896.0':
-    resolution: {integrity: sha512-gwMwZWumo+V0xJplO8j2HIb1TfPsF9fbcRGXS0CanEvjg4fF2Xs1pOQl2oCw3biPZpxHB0plNZjqSF2eneGg9g==}
+  '@aws-sdk/credential-provider-web-identity@3.901.0':
+    resolution: {integrity: sha512-NYjy/6NLxH9m01+pfpB4ql8QgAorJcu8tw69kzHwUd/ql6wUDTbC7HcXqtKlIwWjzjgj2BKL7j6SyFapgCuafA==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/lib-storage@3.896.0':
-    resolution: {integrity: sha512-EJWXL/5LxBJFujsOud3+EfRbIwy/SZiWy5ld70RdoqLS/RsfZh9+mZMJGvd3hewy7xHgDYVbxZfDh14bsvfYIQ==}
+  '@aws-sdk/lib-storage@3.901.0':
+    resolution: {integrity: sha512-wbsDLyqP6eWuipME0klToroZVMY+8xKiFILyZDQ1ZKy5kNa0dEOokE78mlat+GsP2ygW+Zv5il7LDPskRpaEOQ==}
     engines: {node: '>=18.0.0'}
-    deprecated: This version ignores user provided partSize. Please update to >=3.899.0. Details https://github.com/aws/aws-sdk-js-v3/issues/7379
     peerDependencies:
-      '@aws-sdk/client-s3': ^3.896.0
+      '@aws-sdk/client-s3': ^3.901.0
 
-  '@aws-sdk/middleware-bucket-endpoint@3.893.0':
-    resolution: {integrity: sha512-H+wMAoFC73T7M54OFIezdHXR9/lH8TZ3Cx1C3MEBb2ctlzQrVCd8LX8zmOtcGYC8plrRwV+8rNPe0FMqecLRew==}
+  '@aws-sdk/middleware-bucket-endpoint@3.901.0':
+    resolution: {integrity: sha512-mPF3N6eZlVs9G8aBSzvtoxR1RZqMo1aIwR+X8BAZSkhfj55fVF2no4IfPXfdFO3I66N+zEQ8nKoB0uTATWrogQ==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/middleware-expect-continue@3.893.0':
-    resolution: {integrity: sha512-PEZkvD6k0X9sacHkvkVF4t2QyQEAzd35OJ2bIrjWCfc862TwukMMJ1KErRmQ1WqKXHKF4L0ed5vtWaO/8jVLNA==}
+  '@aws-sdk/middleware-expect-continue@3.901.0':
+    resolution: {integrity: sha512-bwq9nj6MH38hlJwOY9QXIDwa6lI48UsaZpaXbdD71BljEIRlxDzfB4JaYb+ZNNK7RIAdzsP/K05mJty6KJAQHw==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/middleware-flexible-checksums@3.896.0':
-    resolution: {integrity: sha512-bB3W/IFG7HNNziACOp1aZVGGnrIahXc0PxZoU055JirEGQtDFIU1ZD7S9zLKmy9FFUvQsAeRL9nDFHbx8cwx/w==}
+  '@aws-sdk/middleware-flexible-checksums@3.901.0':
+    resolution: {integrity: sha512-63lcKfggVUFyXhE4SsFXShCTCyh7ZHEqXLyYEL4DwX+VWtxutf9t9m3fF0TNUYDE8eEGWiRXhegj8l4FjuW+wA==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/middleware-host-header@3.893.0':
-    resolution: {integrity: sha512-qL5xYRt80ahDfj9nDYLhpCNkDinEXvjLe/Qen/Y/u12+djrR2MB4DRa6mzBCkLkdXDtf0WAoW2EZsNCfGrmOEQ==}
+  '@aws-sdk/middleware-host-header@3.901.0':
+    resolution: {integrity: sha512-yWX7GvRmqBtbNnUW7qbre3GvZmyYwU0WHefpZzDTYDoNgatuYq6LgUIQ+z5C04/kCRoFkAFrHag8a3BXqFzq5A==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/middleware-location-constraint@3.893.0':
-    resolution: {integrity: sha512-MlbBc7Ttb1ekbeeeFBU4DeEZOLb5s0Vl4IokvO17g6yJdLk4dnvZro9zdXl3e7NXK+kFxHRBFZe55p/42mVgDA==}
+  '@aws-sdk/middleware-location-constraint@3.901.0':
+    resolution: {integrity: sha512-MuCS5R2ngNoYifkVt05CTULvYVWX0dvRT0/Md4jE3a0u0yMygYy31C1zorwfE/SUgAQXyLmUx8ATmPp9PppImQ==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/middleware-logger@3.893.0':
-    resolution: {integrity: sha512-ZqzMecjju5zkBquSIfVfCORI/3Mge21nUY4nWaGQy+NUXehqCGG4W7AiVpiHGOcY2cGJa7xeEkYcr2E2U9U0AA==}
+  '@aws-sdk/middleware-logger@3.901.0':
+    resolution: {integrity: sha512-UoHebjE7el/tfRo8/CQTj91oNUm+5Heus5/a4ECdmWaSCHCS/hXTsU3PTTHAY67oAQR8wBLFPfp3mMvXjB+L2A==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/middleware-recursion-detection@3.893.0':
-    resolution: {integrity: sha512-H7Zotd9zUHQAr/wr3bcWHULYhEeoQrF54artgsoUGIf/9emv6LzY89QUccKIxYd6oHKNTrTyXm9F0ZZrzXNxlg==}
+  '@aws-sdk/middleware-recursion-detection@3.901.0':
+    resolution: {integrity: sha512-Wd2t8qa/4OL0v/oDpCHHYkgsXJr8/ttCxrvCKAt0H1zZe2LlRhY9gpDVKqdertfHrHDj786fOvEQA28G1L75Dg==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/middleware-sdk-s3@3.896.0':
-    resolution: {integrity: sha512-hlPu/AZ5Afa4ZafP+aXIjRtKm7BX57lurA+TJ+7nXm1Az8Du3Sg2tZXP2/GfqTztLIFQYj/Jy5smkJ0+1HNAPQ==}
+  '@aws-sdk/middleware-sdk-s3@3.901.0':
+    resolution: {integrity: sha512-prgjVC3fDT2VIlmQPiw/cLee8r4frTam9GILRUVQyDdNtshNwV3MiaSCLzzQJjKJlLgnBLNUHJCSmvUVtg+3iA==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/middleware-ssec@3.893.0':
-    resolution: {integrity: sha512-e4ccCiAnczv9mMPheKjgKxZQN473mcup+3DPLVNnIw5GRbQoDqPSB70nUzfORKZvM7ar7xLMPxNR8qQgo1C8Rg==}
+  '@aws-sdk/middleware-ssec@3.901.0':
+    resolution: {integrity: sha512-YiLLJmA3RvjL38mFLuu8fhTTGWtp2qT24VqpucgfoyziYcTgIQkJJmKi90Xp6R6/3VcArqilyRgM1+x8i/em+Q==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/middleware-user-agent@3.896.0':
-    resolution: {integrity: sha512-so/3tZH34YIeqG/QJgn5ZinnmHRdXV1ehsj4wVUrezL/dVW86jfwIkQIwpw8roOC657UoUf91c9FDhCxs3J5aQ==}
+  '@aws-sdk/middleware-user-agent@3.901.0':
+    resolution: {integrity: sha512-Zby4F03fvD9xAgXGPywyk4bC1jCbnyubMEYChLYohD+x20ULQCf+AimF/Btn7YL+hBpzh1+RmqmvZcx+RgwgNQ==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/nested-clients@3.896.0':
-    resolution: {integrity: sha512-KaHALB6DIXScJL/ExmonADr3jtTV6dpOHoEeTRSskJ/aW+rhZo7kH8SLmrwOT/qX8d5tza17YyR/oRkIKY6Eaw==}
+  '@aws-sdk/nested-clients@3.901.0':
+    resolution: {integrity: sha512-feAAAMsVwctk2Tms40ONybvpfJPLCmSdI+G+OTrNpizkGLNl6ik2Ng2RzxY6UqOfN8abqKP/DOUj1qYDRDG8ag==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/region-config-resolver@3.893.0':
-    resolution: {integrity: sha512-/cJvh3Zsa+Of0Zbg7vl9wp/kZtdb40yk/2+XcroAMVPO9hPvmS9r/UOm6tO7FeX4TtkRFwWaQJiTZTgSdsPY+Q==}
+  '@aws-sdk/region-config-resolver@3.901.0':
+    resolution: {integrity: sha512-7F0N888qVLHo4CSQOsnkZ4QAp8uHLKJ4v3u09Ly5k4AEStrSlFpckTPyUx6elwGL+fxGjNE2aakK8vEgzzCV0A==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/s3-request-presigner@3.896.0':
-    resolution: {integrity: sha512-pAlxvB1UmbgyfW8JyJy30FXfsfcWAbtR5gCO25mR5PPwuBQgzQR6lf/L4zbp+ZsSNhlKsvroe537oW5EXYk6Dw==}
+  '@aws-sdk/s3-request-presigner@3.901.0':
+    resolution: {integrity: sha512-G/0G5tL3beETs2zkI0YQuM2SkrAsYJSe2vN2XtouVSN5c9v6EiSvdSsHAqMhLebnSs2suUkq0JO9ZotbXkUfMQ==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/signature-v4-multi-region@3.896.0':
-    resolution: {integrity: sha512-txiQDEZXL9tlNP8mbnNaDtuHBYc/FCqaZ8Y76qnfM3o6CTIn0t0tTAlnx1CyFe4EaikVBgQuZvj5KfNA8PmlzA==}
+  '@aws-sdk/signature-v4-multi-region@3.901.0':
+    resolution: {integrity: sha512-2IWxbll/pRucp1WQkHi2W5E2SVPGBvk4Is923H7gpNksbVFws18ItjMM8ZpGm44cJEoy1zR5gjhLFklatpuoOw==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/token-providers@3.896.0':
-    resolution: {integrity: sha512-WBoD+RY7tUfW9M+wGrZ2vdveR+ziZOjGHWFY3lcGnDvI8KE+fcSccEOTxgJBNBS5Z8B+WHKU2sZjb+Z7QqGwjw==}
+  '@aws-sdk/token-providers@3.901.0':
+    resolution: {integrity: sha512-pJEr1Ggbc/uVTDqp9IbNu9hdr0eQf3yZix3s4Nnyvmg4xmJSGAlbPC9LrNr5u3CDZoc8Z9CuLrvbP4MwYquNpQ==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/types@3.893.0':
-    resolution: {integrity: sha512-Aht1nn5SnA0N+Tjv0dzhAY7CQbxVtmq1bBR6xI0MhG7p2XYVh1wXuKTzrldEvQWwA3odOYunAfT9aBiKZx9qIg==}
+  '@aws-sdk/types@3.901.0':
+    resolution: {integrity: sha512-FfEM25hLEs4LoXsLXQ/q6X6L4JmKkKkbVFpKD4mwfVHtRVQG6QxJiCPcrkcPISquiy6esbwK2eh64TWbiD60cg==}
     engines: {node: '>=18.0.0'}
 
   '@aws-sdk/util-arn-parser@3.893.0':
     resolution: {integrity: sha512-u8H4f2Zsi19DGnwj5FSZzDMhytYF/bCh37vAtBsn3cNDL3YG578X5oc+wSX54pM3tOxS+NY7tvOAo52SW7koUA==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/util-endpoints@3.895.0':
-    resolution: {integrity: sha512-MhxBvWbwxmKknuggO2NeMwOVkHOYL98pZ+1ZRI5YwckoCL3AvISMnPJgfN60ww6AIXHGpkp+HhpFdKOe8RHSEg==}
+  '@aws-sdk/util-endpoints@3.901.0':
+    resolution: {integrity: sha512-5nZP3hGA8FHEtKvEQf4Aww5QZOkjLW1Z+NixSd+0XKfHvA39Ah5sZboScjLx0C9kti/K3OGW1RCx5K9Zc3bZqg==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/util-format-url@3.893.0':
-    resolution: {integrity: sha512-VmAvcedZfQlekiSFJ9y/+YjuCFT3b/vXImbkqjYoD4gbsDjmKm5lxo/w1p9ch0s602obRPLMkh9H20YgXnmwEA==}
+  '@aws-sdk/util-format-url@3.901.0':
+    resolution: {integrity: sha512-GGUnJKrh3OF1F3YRSWtwPLbN904Fcfxf03gujyq1rcrDRPEkzoZB+2BzNkB27SsU6lAlwNq+4aRlZRVUloPiag==}
     engines: {node: '>=18.0.0'}
 
   '@aws-sdk/util-locate-window@3.893.0':
     resolution: {integrity: sha512-T89pFfgat6c8nMmpI8eKjBcDcgJq36+m9oiXbcUzeU55MP9ZuGgBomGjGnHaEyF36jenW9gmg3NfZDm0AO2XPg==}
     engines: {node: '>=18.0.0'}
 
-  '@aws-sdk/util-user-agent-browser@3.893.0':
-    resolution: {integrity: sha512-PE9NtbDBW6Kgl1bG6A5fF3EPo168tnkj8TgMcT0sg4xYBWsBpq0bpJZRh+Jm5Bkwiw9IgTCLjEU7mR6xWaMB9w==}
+  '@aws-sdk/util-user-agent-browser@3.901.0':
+    resolution: {integrity: sha512-Ntb6V/WFI21Ed4PDgL/8NSfoZQQf9xzrwNgiwvnxgAl/KvAvRBgQtqj5gHsDX8Nj2YmJuVoHfH9BGjL9VQ4WNg==}
 
-  '@aws-sdk/util-user-agent-node@3.896.0':
-    resolution: {integrity: sha512-jegizucAwoxyBddKl0kRGNEgRHcfGuMeyhP1Nf+wIUmHz/9CxobIajqcVk/KRNLdZY5mSn7YG2VtP3z0BcBb0w==}
+  '@aws-sdk/util-user-agent-node@3.901.0':
+    resolution: {integrity: sha512-l59KQP5TY7vPVUfEURc7P5BJKuNg1RSsAKBQW7LHLECXjLqDUbo2SMLrexLBEoArSt6E8QOrIN0C8z/0Xk0jYw==}
     engines: {node: '>=18.0.0'}
     peerDependencies:
       aws-crt: '>=1.0.0'
@@ -1042,8 +1041,8 @@ packages:
       aws-crt:
         optional: true
 
-  '@aws-sdk/xml-builder@3.894.0':
-    resolution: {integrity: sha512-E6EAMc9dT1a2DOdo4zyOf3fp5+NJ2wI+mcm7RaW1baFIWDwcb99PpvWoV7YEiK7oaBDshuOEGWKUSYXdW+JYgA==}
+  '@aws-sdk/xml-builder@3.901.0':
+    resolution: {integrity: sha512-pxFCkuAP7Q94wMTNPAwi6hEtNrp/BdFf+HOrIEeFQsk4EoOmpKY3I6S+u6A9Wg295J80Kh74LqDWM22ux3z6Aw==}
     engines: {node: '>=18.0.0'}
 
   '@aws/lambda-invoke-store@0.0.1':
@@ -1591,55 +1590,55 @@ packages:
     resolution: {integrity: sha512-6zABk/ECA/QYSCQ1NGiVwwbQerUCZ+TQbp64Q3AgmfNvurHH0j8TtXa1qbShXA6qqkpAj4V5W8pP6mLe1mcMqA==}
     engines: {node: '>=18'}
 
-  '@biomejs/biome@2.2.4':
-    resolution: {integrity: sha512-TBHU5bUy/Ok6m8c0y3pZiuO/BZoY/OcGxoLlrfQof5s8ISVwbVBdFINPQZyFfKwil8XibYWb7JMwnT8wT4WVPg==}
+  '@biomejs/biome@2.2.5':
+    resolution: {integrity: sha512-zcIi+163Rc3HtyHbEO7CjeHq8DjQRs40HsGbW6vx2WI0tg8mYQOPouhvHSyEnCBAorfYNnKdR64/IxO7xQ5faw==}
     engines: {node: '>=14.21.3'}
     hasBin: true
 
-  '@biomejs/cli-darwin-arm64@2.2.4':
-    resolution: {integrity: sha512-RJe2uiyaloN4hne4d2+qVj3d3gFJFbmrr5PYtkkjei1O9c+BjGXgpUPVbi8Pl8syumhzJjFsSIYkcLt2VlVLMA==}
+  '@biomejs/cli-darwin-arm64@2.2.5':
+    resolution: {integrity: sha512-MYT+nZ38wEIWVcL5xLyOhYQQ7nlWD0b/4mgATW2c8dvq7R4OQjt/XGXFkXrmtWmQofaIM14L7V8qIz/M+bx5QQ==}
     engines: {node: '>=14.21.3'}
     cpu: [arm64]
     os: [darwin]
 
-  '@biomejs/cli-darwin-x64@2.2.4':
-    resolution: {integrity: sha512-cFsdB4ePanVWfTnPVaUX+yr8qV8ifxjBKMkZwN7gKb20qXPxd/PmwqUH8mY5wnM9+U0QwM76CxFyBRJhC9tQwg==}
+  '@biomejs/cli-darwin-x64@2.2.5':
+    resolution: {integrity: sha512-FLIEl73fv0R7dI10EnEiZLw+IMz3mWLnF95ASDI0kbx6DDLJjWxE5JxxBfmG+udz1hIDd3fr5wsuP7nwuTRdAg==}
     engines: {node: '>=14.21.3'}
     cpu: [x64]
     os: [darwin]
 
-  '@biomejs/cli-linux-arm64-musl@2.2.4':
-    resolution: {integrity: sha512-7TNPkMQEWfjvJDaZRSkDCPT/2r5ESFPKx+TEev+I2BXDGIjfCZk2+b88FOhnJNHtksbOZv8ZWnxrA5gyTYhSsQ==}
+  '@biomejs/cli-linux-arm64-musl@2.2.5':
+    resolution: {integrity: sha512-5Ov2wgAFwqDvQiESnu7b9ufD1faRa+40uwrohgBopeY84El2TnBDoMNXx6iuQdreoFGjwW8vH6k68G21EpNERw==}
     engines: {node: '>=14.21.3'}
     cpu: [arm64]
     os: [linux]
 
-  '@biomejs/cli-linux-arm64@2.2.4':
-    resolution: {integrity: sha512-M/Iz48p4NAzMXOuH+tsn5BvG/Jb07KOMTdSVwJpicmhN309BeEyRyQX+n1XDF0JVSlu28+hiTQ2L4rZPvu7nMw==}
+  '@biomejs/cli-linux-arm64@2.2.5':
+    resolution: {integrity: sha512-5DjiiDfHqGgR2MS9D+AZ8kOfrzTGqLKywn8hoXpXXlJXIECGQ32t+gt/uiS2XyGBM2XQhR6ztUvbjZWeccFMoQ==}
     engines: {node: '>=14.21.3'}
     cpu: [arm64]
     os: [linux]
 
-  '@biomejs/cli-linux-x64-musl@2.2.4':
-    resolution: {integrity: sha512-m41nFDS0ksXK2gwXL6W6yZTYPMH0LughqbsxInSKetoH6morVj43szqKx79Iudkp8WRT5SxSh7qVb8KCUiewGg==}
+  '@biomejs/cli-linux-x64-musl@2.2.5':
+    resolution: {integrity: sha512-AVqLCDb/6K7aPNIcxHaTQj01sl1m989CJIQFQEaiQkGr2EQwyOpaATJ473h+nXDUuAcREhccfRpe/tu+0wu0eQ==}
     engines: {node: '>=14.21.3'}
     cpu: [x64]
     os: [linux]
 
-  '@biomejs/cli-linux-x64@2.2.4':
-    resolution: {integrity: sha512-orr3nnf2Dpb2ssl6aihQtvcKtLySLta4E2UcXdp7+RTa7mfJjBgIsbS0B9GC8gVu0hjOu021aU8b3/I1tn+pVQ==}
+  '@biomejs/cli-linux-x64@2.2.5':
+    resolution: {integrity: sha512-fq9meKm1AEXeAWan3uCg6XSP5ObA6F/Ovm89TwaMiy1DNIwdgxPkNwxlXJX8iM6oRbFysYeGnT0OG8diCWb9ew==}
     engines: {node: '>=14.21.3'}
     cpu: [x64]
     os: [linux]
 
-  '@biomejs/cli-win32-arm64@2.2.4':
-    resolution: {integrity: sha512-NXnfTeKHDFUWfxAefa57DiGmu9VyKi0cDqFpdI+1hJWQjGJhJutHPX0b5m+eXvTKOaf+brU+P0JrQAZMb5yYaQ==}
+  '@biomejs/cli-win32-arm64@2.2.5':
+    resolution: {integrity: sha512-xaOIad4wBambwJa6mdp1FigYSIF9i7PCqRbvBqtIi9y29QtPVQ13sDGtUnsRoe6SjL10auMzQ6YAe+B3RpZXVg==}
     engines: {node: '>=14.21.3'}
     cpu: [arm64]
     os: [win32]
 
-  '@biomejs/cli-win32-x64@2.2.4':
-    resolution: {integrity: sha512-3Y4V4zVRarVh/B/eSHczR4LYoSVyv3Dfuvm3cWs5w/HScccS0+Wt/lHOcDTRYeHjQmMYVC3rIRWqyN2EI52+zg==}
+  '@biomejs/cli-win32-x64@2.2.5':
+    resolution: {integrity: sha512-F/jhuXCssPFAuciMhHKk00xnCAxJRS/pUzVfXYmOMUp//XW7mO6QeCjsjvnm8L4AO/dG2VOB0O+fJPiJ2uXtIw==}
     engines: {node: '>=14.21.3'}
     cpu: [x64]
     os: [win32]
@@ -1735,14 +1734,14 @@ packages:
   '@drizzle-team/brocli@0.10.2':
     resolution: {integrity: sha512-z33Il7l5dKjUgGULTqBsQBQwckHh5AbIuxhdsIxDDiZAzBOrZO6q9ogcWC65kU382AfynTfgNumVcNIjuIua6w==}
 
-  '@electric-sql/client@1.0.10':
-    resolution: {integrity: sha512-KcP6R2OGiruxbhAa0wMGiRIfpXDQQ8vznBmn34kG/UJ11sqA4NQBhoPhSsKkCPs5EKc2DoS6bcnqLkIHFdxmvg==}
+  '@electric-sql/client@1.0.13':
+    resolution: {integrity: sha512-bx+Obm4EpkZRVpN48kUg9Q2u9H0zTh/wnM4R0LVtoa5Nl/axDq/uL6ZpmhCwo+Y377oln4l4YNyok/wxNkOeqA==}
 
   '@electric-sql/pglite@0.3.10':
     resolution: {integrity: sha512-1XtXXprd848aR4hvjNqBc3Gc86zNGmd60x+MgOUShbHYxt+J76N8A81DqTEl275T8xBD0vdTgqR/dJ4yJyz0NQ==}
 
-  '@electric-sql/react@1.0.10':
-    resolution: {integrity: sha512-MqzLXYH8Fk/8gHVH4Wi9/YJUOaz9xtMoXHyX1hEZ2ZHqgOb/OJECCWyGJ66L4+dfSVux1VL+CM89N/rFMMbXvA==}
+  '@electric-sql/react@1.0.13':
+    resolution: {integrity: sha512-oSadXVPJyffQi+am/QcJzqVnpk85hd7qYd0vdj6aNxA+vUzfCmULiG3tFtvs52hM88+76KJ1CjJr0CjNRh5tyg==}
     peerDependencies:
       react: '>=18.3.1 <20.0.0'
     peerDependenciesMeta:
@@ -2764,8 +2763,8 @@ packages:
       y-protocols: ^1.0.6
       yjs: ^13.6.8
 
-  '@hono/node-server@1.19.4':
-    resolution: {integrity: sha512-AWKQZ/YkHUBSHeL/5Ld8FWgUs6wFf4TxGYxqp9wLZxRdFuHBpXmgOq+CuDoL4vllkZLzovCf5HBJnypiy3EtHA==}
+  '@hono/node-server@1.19.5':
+    resolution: {integrity: sha512-iBuhh+uaaggeAuf+TftcjZyWh2GEgZcVGXkNtskLVoWaXhnJtC5HLHrU8W1KHDoucqO1MswwglmkWLFyiDn4WQ==}
     engines: {node: '>=18.14.1'}
     peerDependencies:
       hono: ^4
@@ -3170,8 +3169,8 @@ packages:
     resolution: {integrity: sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==}
     engines: {node: '>= 8'}
 
-  '@novu/api@1.6.0':
-    resolution: {integrity: sha512-Zi2FzlQw2m5s2rPTrcJ2YuD8Q0P/7H343RsGwyXSqWwajQpjTnWV3us0PzIr8m0oK0H5wDxi9LkGYoHHHFYbfg==}
+  '@novu/api@1.7.0':
+    resolution: {integrity: sha512-MujRrk/UrTFAMlwsZZFwRdgupqARJKwYj0sINmcYAW0g8ets+vSewXEQMsaynGwDiFh8C4oDQlhmxWc+pT3NWA==}
     hasBin: true
     peerDependencies:
       '@modelcontextprotocol/sdk': '>=1.5.0 <1.10.0'
@@ -3563,98 +3562,98 @@ packages:
   '@oslojs/webauthn@1.0.0':
     resolution: {integrity: sha512-2ZRpbt3msNURwvjmavzq9vrNlxUnWFBGMYqbC1kO3fYBLskL7r4DiLJT1wbtLoI+hclFwjhl48YhRFBl6RWg1A==}
 
-  '@oxc-resolver/binding-android-arm-eabi@11.8.4':
-    resolution: {integrity: sha512-6BjMji0TcvQfJ4EoSunOSyu/SiyHKficBD0V3Y0NxF0beaNnnZ7GYEi2lHmRNnRCuIPK8IuVqQ6XizYau+CkKw==}
+  '@oxc-resolver/binding-android-arm-eabi@11.9.0':
+    resolution: {integrity: sha512-4AxaG6TkSBQ2FiC5oGZEJQ35DjsSfAbW6/AJauebq4EzIPVOIgDJCF4de+PvX/Xi9BkNw6VtJuMXJdWW97iEAA==}
     cpu: [arm]
     os: [android]
 
-  '@oxc-resolver/binding-android-arm64@11.8.4':
-    resolution: {integrity: sha512-SxF4X6rzCBS9XNPXKZGoIHIABjfGmtQpEgRBDzpDHx5VTuLAUmwLTHXnVBAZoX5bmnhF79RiMElavzFdJ2cA1A==}
+  '@oxc-resolver/binding-android-arm64@11.9.0':
+    resolution: {integrity: sha512-oOEg7rUd2M6YlmRkvPcszJ6KO6TaLGN21oDdcs27gbTVYbQQtCWYbZz5jRW5zEBJu6dopoWVx+shJNGtG1qDFw==}
     cpu: [arm64]
     os: [android]
 
-  '@oxc-resolver/binding-darwin-arm64@11.8.4':
-    resolution: {integrity: sha512-8zWeERrzgscAniE6kh1TQ4E7GJyglYsvdoKrHYLBCbHWD+0/soffiwAYxZuckKEQSc2RXMSPjcu+JTCALaY0Dw==}
+  '@oxc-resolver/binding-darwin-arm64@11.9.0':
+    resolution: {integrity: sha512-fM6zE/j6o3C1UIkcZPV7C1f186R7w97guY2N4lyNLlhlgwwhd46acnOezLARvRNU5oyKNev4PvOJhGCCDnFMGg==}
     cpu: [arm64]
     os: [darwin]
 
-  '@oxc-resolver/binding-darwin-x64@11.8.4':
-    resolution: {integrity: sha512-BUwggKz8Hi5uEQ0AeVTSun1+sp4lzNcItn+L7fDsHu5Cx0Zueuo10BtVm+dIwmYVVPL5oGYOeD0fS7MKAazKiw==}
+  '@oxc-resolver/binding-darwin-x64@11.9.0':
+    resolution: {integrity: sha512-Bg3Orw7gAxbUqQlt64YPWvHDVo3bo2JfI26Qmzv6nKo7mIMTDhQKl7YmywtLNMYbX0IgUM4qu1V90euu+WCDOw==}
     cpu: [x64]
     os: [darwin]
 
-  '@oxc-resolver/binding-freebsd-x64@11.8.4':
-    resolution: {integrity: sha512-fPO5TQhnn8gA6yP4o49lc4Gn8KeDwAp9uYd4PlE3Q00JVqU6cY9WecDhYHrWtiFcyoZ8UVBlIxuhRqT/DP4Z4A==}
+  '@oxc-resolver/binding-freebsd-x64@11.9.0':
+    resolution: {integrity: sha512-eBqVZqTETH6miBfIZXvpzUe98WATz2+Sh+LEFwuRpGsTsKkIpTyb4p1kwylCLkxrd3Yx7wkxQku+L0AMEGBiAA==}
     cpu: [x64]
     os: [freebsd]
 
-  '@oxc-resolver/binding-linux-arm-gnueabihf@11.8.4':
-    resolution: {integrity: sha512-QuNbdUaVGiP0W0GrXsvCDZjqeL4lZGU7aXlx/S2tCvyTk3wh6skoiLJgqUf/eeqXfUPnzTfntYqyfolzCAyBYA==}
+  '@oxc-resolver/binding-linux-arm-gnueabihf@11.9.0':
+    resolution: {integrity: sha512-QgCk/IJnGBvpbc8rYTVgO+A3m3edJjH1zfv8Nvx7fmsxpbXwWH2l4b4tY3/SLMzasxsp7x7k87+HWt095bI5Lg==}
     cpu: [arm]
     os: [linux]
 
-  '@oxc-resolver/binding-linux-arm-musleabihf@11.8.4':
-    resolution: {integrity: sha512-p/zLMfza8OsC4BDKxqeZ9Qel+4eA/oiMSyKLRkMrTgt6OWQq1d5nHntjfG35Abcw4ev6Q9lRU3NOW5hj0xlUbw==}
+  '@oxc-resolver/binding-linux-arm-musleabihf@11.9.0':
+    resolution: {integrity: sha512-xkJH0jldIXD2GwoHpCDEF0ucJ7fvRETCL+iFLctM679o7qeDXvtzsO/E401EgFFXcWBJNKXWvH+ZfdYMKyowfA==}
     cpu: [arm]
     os: [linux]
 
-  '@oxc-resolver/binding-linux-arm64-gnu@11.8.4':
-    resolution: {integrity: sha512-bvJF9wWxF1+a5YZATlS5JojpOMC7OsnTatA6sXVHoOb7MIigjledYB5ZMAeRrnWWexRMiEX3YSaA46oSfOzmOg==}
+  '@oxc-resolver/binding-linux-arm64-gnu@11.9.0':
+    resolution: {integrity: sha512-TWq+y2psMzbMtZB9USAq2bSA7NV1TMmh9lhAFbMGQ8Yp2YV4BRC/HilD6qF++efQl6shueGBFOv0LVe9BUXaIA==}
     cpu: [arm64]
     os: [linux]
 
-  '@oxc-resolver/binding-linux-arm64-musl@11.8.4':
-    resolution: {integrity: sha512-gf4nwGBfu+EFwOn5p7/T7VF4jmIdfodwJS9MRkOBHvuAm3LQgCX7O6d3Y80mm0TV7ZMRD/trfW628rHfd5++vQ==}
+  '@oxc-resolver/binding-linux-arm64-musl@11.9.0':
+    resolution: {integrity: sha512-8WwGLfXk7yttc6rD6g53+RnYfX5B8xOot1ffthLn8oCXzVRO4cdChlmeHStxwLD/MWx8z8BGeyfyINNrsh9N2w==}
     cpu: [arm64]
     os: [linux]
 
-  '@oxc-resolver/binding-linux-ppc64-gnu@11.8.4':
-    resolution: {integrity: sha512-T120R5GIzRd41rYWWKCI6cSYrZjmRQzf3X4xeE1WX396Uabz5DX8KU7RnVHihSK+KDxccCVOFBxcH3ITd+IEpw==}
+  '@oxc-resolver/binding-linux-ppc64-gnu@11.9.0':
+    resolution: {integrity: sha512-ZWiAXfan6actlSzayaFS/kYO2zD6k1k0fmLb1opbujXYMKepEnjjVOvKdzCIYR/zKzudqI39dGc+ywqVdsPIpQ==}
     cpu: [ppc64]
     os: [linux]
 
-  '@oxc-resolver/binding-linux-riscv64-gnu@11.8.4':
-    resolution: {integrity: sha512-PVG7SxBFFjAaQ76p9O/0Xt5mTBlziRwpck+6cRNhy/hbWY/hSt8BFfPqw0EDSfnl40Uuh+NPsHFMnaWWyxbQEg==}
+  '@oxc-resolver/binding-linux-riscv64-gnu@11.9.0':
+    resolution: {integrity: sha512-p9mCSb+Bym+eycNo9k+81wQ5SAE31E+/rtfbDmF4/7krPotkEjPsEBSc3rqunRwO+FtsUn7H68JLY7hlai49eQ==}
     cpu: [riscv64]
     os: [linux]
 
-  '@oxc-resolver/binding-linux-riscv64-musl@11.8.4':
-    resolution: {integrity: sha512-L0OklUhM2qLGaKvPSyKmwWpoijfc++VJtPyVgz031ShOXyo0WjD0ZGzusyJMsA1a/gdulAmN6CQ/0Sf4LGXEcw==}
+  '@oxc-resolver/binding-linux-riscv64-musl@11.9.0':
+    resolution: {integrity: sha512-/SePuVxgFhLPciRwsJ8kLVltr+rxh0b6riGFuoPnFXBbHFclKnjNIt3TfqzUj0/vOnslXw3cVGPpmtkm2TgCgg==}
     cpu: [riscv64]
     os: [linux]
 
-  '@oxc-resolver/binding-linux-s390x-gnu@11.8.4':
-    resolution: {integrity: sha512-18Ajz5hqO4cRGuoHzLFUsIPod9GIaIRDiXFg2m6CS3NgVdHx7iCZscplYH7KtjdE42M8nGWYMyyq5BOk7QVgPw==}
+  '@oxc-resolver/binding-linux-s390x-gnu@11.9.0':
+    resolution: {integrity: sha512-zLuEjlYIzfnr1Ei2UZYQBbCTa/9deh+BEjO9rh1ai8BfEq4uj6RupTtNpgHfgAsEYdqOBVExw9EU1S6SW3RCAw==}
     cpu: [s390x]
     os: [linux]
 
-  '@oxc-resolver/binding-linux-x64-gnu@11.8.4':
-    resolution: {integrity: sha512-uHvH4RyYBdQ/lFGV9H+R1ScHg6EBnAhE3mnX+u+mO/btnalvg7j80okuHf8Qw0tLQiP5P1sEBoVeE6zviXY9IA==}
+  '@oxc-resolver/binding-linux-x64-gnu@11.9.0':
+    resolution: {integrity: sha512-cxdg73WG+aVlPu/k4lEQPRVOhWunYOUglW6OSzclZLJJAXZU0tSZ5ymKaqPRkfTsyNSAafj1cA1XYd+P9UxBgw==}
     cpu: [x64]
     os: [linux]
 
-  '@oxc-resolver/binding-linux-x64-musl@11.8.4':
-    resolution: {integrity: sha512-X5z44qh5DdJfVhcqXAQFTDFUpcxdpf6DT/lHL5CFcdQGIZxatjc7gFUy05IXPI9xwfq39RValjJBvFovUk9XBw==}
+  '@oxc-resolver/binding-linux-x64-musl@11.9.0':
+    resolution: {integrity: sha512-sy5nkVdMvNgqcx9sIY7G6U9TYZUZC4cmMGw/wKhJNuuD2/HFGtbje62ttXSwBAbVbmJ2GgZ4ZUo/S1OMyU+/OA==}
     cpu: [x64]
     os: [linux]
 
-  '@oxc-resolver/binding-wasm32-wasi@11.8.4':
-    resolution: {integrity: sha512-z3906y+cd8RRhBGNwHRrRAFxnKjXsBeL3+rdQjZpBrUyrhhsaV5iKD/ROx64FNJ9GjL/9mfon8A5xx/McYIqHA==}
+  '@oxc-resolver/binding-wasm32-wasi@11.9.0':
+    resolution: {integrity: sha512-dfi/a0Xh6o6nOLbJdaYuy7txncEcwkRHp9DGGZaAP7zxDiepkBZ6ewSJODQrWwhjVmMteXo+XFzEOMjsC7WUtQ==}
     engines: {node: '>=14.0.0'}
     cpu: [wasm32]
 
-  '@oxc-resolver/binding-win32-arm64-msvc@11.8.4':
-    resolution: {integrity: sha512-70vXFs74uA3X5iYOkpclbkWlQEF+MI325uAQ+Or2n8HJip2T0SEmuBlyw/sRL2E8zLC4oocb+1g25fmzlDVkmg==}
+  '@oxc-resolver/binding-win32-arm64-msvc@11.9.0':
+    resolution: {integrity: sha512-b1yKr+eFwyi8pZMjAQwW352rXpaHAmz7FLK03vFIxdyWzWiiL6S3UrfMu+nKQud38963zu4wNNLm7rdXQazgRA==}
     cpu: [arm64]
     os: [win32]
 
-  '@oxc-resolver/binding-win32-ia32-msvc@11.8.4':
-    resolution: {integrity: sha512-SEOUAzTvr+nyMia3nx1dMtD7YUxZwuhQ3QAPnxy21261Lj0yT3JY4EIfwWH54lAWWfMdRSRRMFuGeF/dq7XjEw==}
+  '@oxc-resolver/binding-win32-ia32-msvc@11.9.0':
+    resolution: {integrity: sha512-DxRT+1HjCpRH8qYCmGHzgsRCYiK+X14PUM9Fb+aD4TljplA7MdDQXqMISTb4zBZ70AuclvlXKTbW+K1GZop3xA==}
     cpu: [ia32]
     os: [win32]
 
-  '@oxc-resolver/binding-win32-x64-msvc@11.8.4':
-    resolution: {integrity: sha512-1gARIQsOPOU7LJ7jvMyPmZEVMapL/PymeG3J7naOdLZDrIZKX6CTvgawJmETYKt+8icP8M6KbBinrVkKVqFd+A==}
+  '@oxc-resolver/binding-win32-x64-msvc@11.9.0':
+    resolution: {integrity: sha512-gE3QJvhh0Yj9cSAkkHjRLKPmC7BTJeiaB5YyhVKVUwbnWQgTszV92lZ9pvZtNPEghP7jPbhEs4c6983A0ojQwA==}
     cpu: [x64]
     os: [win32]
 
@@ -4774,223 +4773,113 @@ packages:
       rollup:
         optional: true
 
-  '@rollup/rollup-android-arm-eabi@4.52.2':
-    resolution: {integrity: sha512-o3pcKzJgSGt4d74lSZ+OCnHwkKBeAbFDmbEm5gg70eA8VkyCuC/zV9TwBnmw6VjDlRdF4Pshfb+WE9E6XY1PoQ==}
-    cpu: [arm]
-    os: [android]
-
-  '@rollup/rollup-android-arm-eabi@4.52.3':
-    resolution: {integrity: sha512-h6cqHGZ6VdnwliFG1NXvMPTy/9PS3h8oLh7ImwR+kl+oYnQizgjxsONmmPSb2C66RksfkfIxEVtDSEcJiO0tqw==}
+  '@rollup/rollup-android-arm-eabi@4.52.4':
+    resolution: {integrity: sha512-BTm2qKNnWIQ5auf4deoetINJm2JzvihvGb9R6K/ETwKLql/Bb3Eg2H1FBp1gUb4YGbydMA3jcmQTR73q7J+GAA==}
     cpu: [arm]
     os: [android]
 
-  '@rollup/rollup-android-arm64@4.52.2':
-    resolution: {integrity: sha512-cqFSWO5tX2vhC9hJTK8WAiPIm4Q8q/cU8j2HQA0L3E1uXvBYbOZMhE2oFL8n2pKB5sOCHY6bBuHaRwG7TkfJyw==}
-    cpu: [arm64]
-    os: [android]
-
-  '@rollup/rollup-android-arm64@4.52.3':
-    resolution: {integrity: sha512-wd+u7SLT/u6knklV/ifG7gr5Qy4GUbH2hMWcDauPFJzmCZUAJ8L2bTkVXC2niOIxp8lk3iH/QX8kSrUxVZrOVw==}
+  '@rollup/rollup-android-arm64@4.52.4':
+    resolution: {integrity: sha512-P9LDQiC5vpgGFgz7GSM6dKPCiqR3XYN1WwJKA4/BUVDjHpYsf3iBEmVz62uyq20NGYbiGPR5cNHI7T1HqxNs2w==}
     cpu: [arm64]
     os: [android]
 
-  '@rollup/rollup-darwin-arm64@4.52.2':
-    resolution: {integrity: sha512-vngduywkkv8Fkh3wIZf5nFPXzWsNsVu1kvtLETWxTFf/5opZmflgVSeLgdHR56RQh71xhPhWoOkEBvbehwTlVA==}
-    cpu: [arm64]
-    os: [darwin]
-
-  '@rollup/rollup-darwin-arm64@4.52.3':
-    resolution: {integrity: sha512-lj9ViATR1SsqycwFkJCtYfQTheBdvlWJqzqxwc9f2qrcVrQaF/gCuBRTiTolkRWS6KvNxSk4KHZWG7tDktLgjg==}
+  '@rollup/rollup-darwin-arm64@4.52.4':
+    resolution: {integrity: sha512-QRWSW+bVccAvZF6cbNZBJwAehmvG9NwfWHwMy4GbWi/BQIA/laTIktebT2ipVjNncqE6GLPxOok5hsECgAxGZg==}
     cpu: [arm64]
     os: [darwin]
 
-  '@rollup/rollup-darwin-x64@4.52.2':
-    resolution: {integrity: sha512-h11KikYrUCYTrDj6h939hhMNlqU2fo/X4NB0OZcys3fya49o1hmFaczAiJWVAFgrM1NCP6RrO7lQKeVYSKBPSQ==}
+  '@rollup/rollup-darwin-x64@4.52.4':
+    resolution: {integrity: sha512-hZgP05pResAkRJxL1b+7yxCnXPGsXU0fG9Yfd6dUaoGk+FhdPKCJ5L1Sumyxn8kvw8Qi5PvQ8ulenUbRjzeCTw==}
     cpu: [x64]
     os: [darwin]
 
-  '@rollup/rollup-darwin-x64@4.52.3':
-    resolution: {integrity: sha512-+Dyo7O1KUmIsbzx1l+4V4tvEVnVQqMOIYtrxK7ncLSknl1xnMHLgn7gddJVrYPNZfEB8CIi3hK8gq8bDhb3h5A==}
-    cpu: [x64]
-    os: [darwin]
-
-  '@rollup/rollup-freebsd-arm64@4.52.2':
-    resolution: {integrity: sha512-/eg4CI61ZUkLXxMHyVlmlGrSQZ34xqWlZNW43IAU4RmdzWEx0mQJ2mN/Cx4IHLVZFL6UBGAh+/GXhgvGb+nVxw==}
-    cpu: [arm64]
-    os: [freebsd]
-
-  '@rollup/rollup-freebsd-arm64@4.52.3':
-    resolution: {integrity: sha512-u9Xg2FavYbD30g3DSfNhxgNrxhi6xVG4Y6i9Ur1C7xUuGDW3banRbXj+qgnIrwRN4KeJ396jchwy9bCIzbyBEQ==}
+  '@rollup/rollup-freebsd-arm64@4.52.4':
+    resolution: {integrity: sha512-xmc30VshuBNUd58Xk4TKAEcRZHaXlV+tCxIXELiE9sQuK3kG8ZFgSPi57UBJt8/ogfhAF5Oz4ZSUBN77weM+mQ==}
     cpu: [arm64]
     os: [freebsd]
 
-  '@rollup/rollup-freebsd-x64@4.52.2':
-    resolution: {integrity: sha512-QOWgFH5X9+p+S1NAfOqc0z8qEpJIoUHf7OWjNUGOeW18Mx22lAUOiA9b6r2/vpzLdfxi/f+VWsYjUOMCcYh0Ng==}
-    cpu: [x64]
-    os: [freebsd]
-
-  '@rollup/rollup-freebsd-x64@4.52.3':
-    resolution: {integrity: sha512-5M8kyi/OX96wtD5qJR89a/3x5x8x5inXBZO04JWhkQb2JWavOWfjgkdvUqibGJeNNaz1/Z1PPza5/tAPXICI6A==}
+  '@rollup/rollup-freebsd-x64@4.52.4':
+    resolution: {integrity: sha512-WdSLpZFjOEqNZGmHflxyifolwAiZmDQzuOzIq9L27ButpCVpD7KzTRtEG1I0wMPFyiyUdOO+4t8GvrnBLQSwpw==}
     cpu: [x64]
     os: [freebsd]
 
-  '@rollup/rollup-linux-arm-gnueabihf@4.52.2':
-    resolution: {integrity: sha512-kDWSPafToDd8LcBYd1t5jw7bD5Ojcu12S3uT372e5HKPzQt532vW+rGFFOaiR0opxePyUkHrwz8iWYEyH1IIQA==}
-    cpu: [arm]
-    os: [linux]
-
-  '@rollup/rollup-linux-arm-gnueabihf@4.52.3':
-    resolution: {integrity: sha512-IoerZJ4l1wRMopEHRKOO16e04iXRDyZFZnNZKrWeNquh5d6bucjezgd+OxG03mOMTnS1x7hilzb3uURPkJ0OfA==}
+  '@rollup/rollup-linux-arm-gnueabihf@4.52.4':
+    resolution: {integrity: sha512-xRiOu9Of1FZ4SxVbB0iEDXc4ddIcjCv2aj03dmW8UrZIW7aIQ9jVJdLBIhxBI+MaTnGAKyvMwPwQnoOEvP7FgQ==}
     cpu: [arm]
     os: [linux]
 
-  '@rollup/rollup-linux-arm-musleabihf@4.52.2':
-    resolution: {integrity: sha512-gKm7Mk9wCv6/rkzwCiUC4KnevYhlf8ztBrDRT9g/u//1fZLapSRc+eDZj2Eu2wpJ+0RzUKgtNijnVIB4ZxyL+w==}
+  '@rollup/rollup-linux-arm-musleabihf@4.52.4':
+    resolution: {integrity: sha512-FbhM2p9TJAmEIEhIgzR4soUcsW49e9veAQCziwbR+XWB2zqJ12b4i/+hel9yLiD8pLncDH4fKIPIbt5238341Q==}
     cpu: [arm]
     os: [linux]
 
-  '@rollup/rollup-linux-arm-musleabihf@4.52.3':
-    resolution: {integrity: sha512-ZYdtqgHTDfvrJHSh3W22TvjWxwOgc3ThK/XjgcNGP2DIwFIPeAPNsQxrJO5XqleSlgDux2VAoWQ5iJrtaC1TbA==}
-    cpu: [arm]
-    os: [linux]
-
-  '@rollup/rollup-linux-arm64-gnu@4.52.2':
-    resolution: {integrity: sha512-66lA8vnj5mB/rtDNwPgrrKUOtCLVQypkyDa2gMfOefXK6rcZAxKLO9Fy3GkW8VkPnENv9hBkNOFfGLf6rNKGUg==}
-    cpu: [arm64]
-    os: [linux]
-
-  '@rollup/rollup-linux-arm64-gnu@4.52.3':
-    resolution: {integrity: sha512-NcViG7A0YtuFDA6xWSgmFb6iPFzHlf5vcqb2p0lGEbT+gjrEEz8nC/EeDHvx6mnGXnGCC1SeVV+8u+smj0CeGQ==}
-    cpu: [arm64]
-    os: [linux]
-
-  '@rollup/rollup-linux-arm64-musl@4.52.2':
-    resolution: {integrity: sha512-s+OPucLNdJHvuZHuIz2WwncJ+SfWHFEmlC5nKMUgAelUeBUnlB4wt7rXWiyG4Zn07uY2Dd+SGyVa9oyLkVGOjA==}
+  '@rollup/rollup-linux-arm64-gnu@4.52.4':
+    resolution: {integrity: sha512-4n4gVwhPHR9q/g8lKCyz0yuaD0MvDf7dV4f9tHt0C73Mp8h38UCtSCSE6R9iBlTbXlmA8CjpsZoujhszefqueg==}
     cpu: [arm64]
     os: [linux]
 
-  '@rollup/rollup-linux-arm64-musl@4.52.3':
-    resolution: {integrity: sha512-d3pY7LWno6SYNXRm6Ebsq0DJGoiLXTb83AIPCXl9fmtIQs/rXoS8SJxxUNtFbJ5MiOvs+7y34np77+9l4nfFMw==}
+  '@rollup/rollup-linux-arm64-musl@4.52.4':
+    resolution: {integrity: sha512-u0n17nGA0nvi/11gcZKsjkLj1QIpAuPFQbR48Subo7SmZJnGxDpspyw2kbpuoQnyK+9pwf3pAoEXerJs/8Mi9g==}
     cpu: [arm64]
     os: [linux]
 
-  '@rollup/rollup-linux-loong64-gnu@4.52.2':
-    resolution: {integrity: sha512-8wTRM3+gVMDLLDdaT6tKmOE3lJyRy9NpJUS/ZRWmLCmOPIJhVyXwjBo+XbrrwtV33Em1/eCTd5TuGJm4+DmYjw==}
-    cpu: [loong64]
-    os: [linux]
-
-  '@rollup/rollup-linux-loong64-gnu@4.52.3':
-    resolution: {integrity: sha512-3y5GA0JkBuirLqmjwAKwB0keDlI6JfGYduMlJD/Rl7fvb4Ni8iKdQs1eiunMZJhwDWdCvrcqXRY++VEBbvk6Eg==}
+  '@rollup/rollup-linux-loong64-gnu@4.52.4':
+    resolution: {integrity: sha512-0G2c2lpYtbTuXo8KEJkDkClE/+/2AFPdPAbmaHoE870foRFs4pBrDehilMcrSScrN/fB/1HTaWO4bqw+ewBzMQ==}
     cpu: [loong64]
     os: [linux]
 
-  '@rollup/rollup-linux-ppc64-gnu@4.52.2':
-    resolution: {integrity: sha512-6yqEfgJ1anIeuP2P/zhtfBlDpXUb80t8DpbYwXQ3bQd95JMvUaqiX+fKqYqUwZXqdJDd8xdilNtsHM2N0cFm6A==}
+  '@rollup/rollup-linux-ppc64-gnu@4.52.4':
+    resolution: {integrity: sha512-teSACug1GyZHmPDv14VNbvZFX779UqWTsd7KtTM9JIZRDI5NUwYSIS30kzI8m06gOPB//jtpqlhmraQ68b5X2g==}
     cpu: [ppc64]
     os: [linux]
 
-  '@rollup/rollup-linux-ppc64-gnu@4.52.3':
-    resolution: {integrity: sha512-AUUH65a0p3Q0Yfm5oD2KVgzTKgwPyp9DSXc3UA7DtxhEb/WSPfbG4wqXeSN62OG5gSo18em4xv6dbfcUGXcagw==}
-    cpu: [ppc64]
-    os: [linux]
-
-  '@rollup/rollup-linux-riscv64-gnu@4.52.2':
-    resolution: {integrity: sha512-sshYUiYVSEI2B6dp4jMncwxbrUqRdNApF2c3bhtLAU0qA8Lrri0p0NauOsTWh3yCCCDyBOjESHMExonp7Nzc0w==}
-    cpu: [riscv64]
-    os: [linux]
-
-  '@rollup/rollup-linux-riscv64-gnu@4.52.3':
-    resolution: {integrity: sha512-1makPhFFVBqZE+XFg3Dkq+IkQ7JvmUrwwqaYBL2CE+ZpxPaqkGaiWFEWVGyvTwZace6WLJHwjVh/+CXbKDGPmg==}
-    cpu: [riscv64]
-    os: [linux]
-
-  '@rollup/rollup-linux-riscv64-musl@4.52.2':
-    resolution: {integrity: sha512-duBLgd+3pqC4MMwBrKkFxaZerUxZcYApQVC5SdbF5/e/589GwVvlRUnyqMFbM8iUSb1BaoX/3fRL7hB9m2Pj8Q==}
+  '@rollup/rollup-linux-riscv64-gnu@4.52.4':
+    resolution: {integrity: sha512-/MOEW3aHjjs1p4Pw1Xk4+3egRevx8Ji9N6HUIA1Ifh8Q+cg9dremvFCUbOX2Zebz80BwJIgCBUemjqhU5XI5Eg==}
     cpu: [riscv64]
     os: [linux]
 
-  '@rollup/rollup-linux-riscv64-musl@4.52.3':
-    resolution: {integrity: sha512-OOFJa28dxfl8kLOPMUOQBCO6z3X2SAfzIE276fwT52uXDWUS178KWq0pL7d6p1kz7pkzA0yQwtqL0dEPoVcRWg==}
+  '@rollup/rollup-linux-riscv64-musl@4.52.4':
+    resolution: {integrity: sha512-1HHmsRyh845QDpEWzOFtMCph5Ts+9+yllCrREuBR/vg2RogAQGGBRC8lDPrPOMnrdOJ+mt1WLMOC2Kao/UwcvA==}
     cpu: [riscv64]
     os: [linux]
 
-  '@rollup/rollup-linux-s390x-gnu@4.52.2':
-    resolution: {integrity: sha512-tzhYJJidDUVGMgVyE+PmxENPHlvvqm1KILjjZhB8/xHYqAGeizh3GBGf9u6WdJpZrz1aCpIIHG0LgJgH9rVjHQ==}
-    cpu: [s390x]
-    os: [linux]
-
-  '@rollup/rollup-linux-s390x-gnu@4.52.3':
-    resolution: {integrity: sha512-jMdsML2VI5l+V7cKfZx3ak+SLlJ8fKvLJ0Eoa4b9/vCUrzXKgoKxvHqvJ/mkWhFiyp88nCkM5S2v6nIwRtPcgg==}
+  '@rollup/rollup-linux-s390x-gnu@4.52.4':
+    resolution: {integrity: sha512-seoeZp4L/6D1MUyjWkOMRU6/iLmCU2EjbMTyAG4oIOs1/I82Y5lTeaxW0KBfkUdHAWN7j25bpkt0rjnOgAcQcA==}
     cpu: [s390x]
     os: [linux]
 
-  '@rollup/rollup-linux-x64-gnu@4.52.2':
-    resolution: {integrity: sha512-opH8GSUuVcCSSyHHcl5hELrmnk4waZoVpgn/4FDao9iyE4WpQhyWJ5ryl5M3ocp4qkRuHfyXnGqg8M9oKCEKRA==}
+  '@rollup/rollup-linux-x64-gnu@4.52.4':
+    resolution: {integrity: sha512-Wi6AXf0k0L7E2gteNsNHUs7UMwCIhsCTs6+tqQ5GPwVRWMaflqGec4Sd8n6+FNFDw9vGcReqk2KzBDhCa1DLYg==}
     cpu: [x64]
     os: [linux]
 
-  '@rollup/rollup-linux-x64-gnu@4.52.3':
-    resolution: {integrity: sha512-tPgGd6bY2M2LJTA1uGq8fkSPK8ZLYjDjY+ZLK9WHncCnfIz29LIXIqUgzCR0hIefzy6Hpbe8Th5WOSwTM8E7LA==}
+  '@rollup/rollup-linux-x64-musl@4.52.4':
+    resolution: {integrity: sha512-dtBZYjDmCQ9hW+WgEkaffvRRCKm767wWhxsFW3Lw86VXz/uJRuD438/XvbZT//B96Vs8oTA8Q4A0AfHbrxP9zw==}
     cpu: [x64]
     os: [linux]
 
-  '@rollup/rollup-linux-x64-musl@4.52.2':
-    resolution: {integrity: sha512-LSeBHnGli1pPKVJ79ZVJgeZWWZXkEe/5o8kcn23M8eMKCUANejchJbF/JqzM4RRjOJfNRhKJk8FuqL1GKjF5oQ==}
-    cpu: [x64]
-    os: [linux]
-
-  '@rollup/rollup-linux-x64-musl@4.52.3':
-    resolution: {integrity: sha512-BCFkJjgk+WFzP+tcSMXq77ymAPIxsX9lFJWs+2JzuZTLtksJ2o5hvgTdIcZ5+oKzUDMwI0PfWzRBYAydAHF2Mw==}
-    cpu: [x64]
-    os: [linux]
-
-  '@rollup/rollup-openharmony-arm64@4.52.2':
-    resolution: {integrity: sha512-uPj7MQ6/s+/GOpolavm6BPo+6CbhbKYyZHUDvZ/SmJM7pfDBgdGisFX3bY/CBDMg2ZO4utfhlApkSfZ92yXw7Q==}
-    cpu: [arm64]
-    os: [openharmony]
-
-  '@rollup/rollup-openharmony-arm64@4.52.3':
-    resolution: {integrity: sha512-KTD/EqjZF3yvRaWUJdD1cW+IQBk4fbQaHYJUmP8N4XoKFZilVL8cobFSTDnjTtxWJQ3JYaMgF4nObY/+nYkumA==}
+  '@rollup/rollup-openharmony-arm64@4.52.4':
+    resolution: {integrity: sha512-1ox+GqgRWqaB1RnyZXL8PD6E5f7YyRUJYnCqKpNzxzP0TkaUh112NDrR9Tt+C8rJ4x5G9Mk8PQR3o7Ku2RKqKA==}
     cpu: [arm64]
     os: [openharmony]
 
-  '@rollup/rollup-win32-arm64-msvc@4.52.2':
-    resolution: {integrity: sha512-Z9MUCrSgIaUeeHAiNkm3cQyst2UhzjPraR3gYYfOjAuZI7tcFRTOD+4cHLPoS/3qinchth+V56vtqz1Tv+6KPA==}
-    cpu: [arm64]
-    os: [win32]
-
-  '@rollup/rollup-win32-arm64-msvc@4.52.3':
-    resolution: {integrity: sha512-+zteHZdoUYLkyYKObGHieibUFLbttX2r+58l27XZauq0tcWYYuKUwY2wjeCN9oK1Um2YgH2ibd6cnX/wFD7DuA==}
+  '@rollup/rollup-win32-arm64-msvc@4.52.4':
+    resolution: {integrity: sha512-8GKr640PdFNXwzIE0IrkMWUNUomILLkfeHjXBi/nUvFlpZP+FA8BKGKpacjW6OUUHaNI6sUURxR2U2g78FOHWQ==}
     cpu: [arm64]
     os: [win32]
 
-  '@rollup/rollup-win32-ia32-msvc@4.52.2':
-    resolution: {integrity: sha512-+GnYBmpjldD3XQd+HMejo+0gJGwYIOfFeoBQv32xF/RUIvccUz20/V6Otdv+57NE70D5pa8W/jVGDoGq0oON4A==}
+  '@rollup/rollup-win32-ia32-msvc@4.52.4':
+    resolution: {integrity: sha512-AIy/jdJ7WtJ/F6EcfOb2GjR9UweO0n43jNObQMb6oGxkYTfLcnN7vYYpG+CN3lLxrQkzWnMOoNSHTW54pgbVxw==}
     cpu: [ia32]
     os: [win32]
 
-  '@rollup/rollup-win32-ia32-msvc@4.52.3':
-    resolution: {integrity: sha512-of1iHkTQSo3kr6dTIRX6t81uj/c/b15HXVsPcEElN5sS859qHrOepM5p9G41Hah+CTqSh2r8Bm56dL2z9UQQ7g==}
-    cpu: [ia32]
-    os: [win32]
-
-  '@rollup/rollup-win32-x64-gnu@4.52.2':
-    resolution: {integrity: sha512-ApXFKluSB6kDQkAqZOKXBjiaqdF1BlKi+/eqnYe9Ee7U2K3pUDKsIyr8EYm/QDHTJIM+4X+lI0gJc3TTRhd+dA==}
-    cpu: [x64]
-    os: [win32]
-
-  '@rollup/rollup-win32-x64-gnu@4.52.3':
-    resolution: {integrity: sha512-s0hybmlHb56mWVZQj8ra9048/WZTPLILKxcvcq+8awSZmyiSUZjjem1AhU3Tf4ZKpYhK4mg36HtHDOe8QJS5PQ==}
-    cpu: [x64]
-    os: [win32]
-
-  '@rollup/rollup-win32-x64-msvc@4.52.2':
-    resolution: {integrity: sha512-ARz+Bs8kY6FtitYM96PqPEVvPXqEZmPZsSkXvyX19YzDqkCaIlhCieLLMI5hxO9SRZ2XtCtm8wxhy0iJ2jxNfw==}
+  '@rollup/rollup-win32-x64-gnu@4.52.4':
+    resolution: {integrity: sha512-UF9KfsH9yEam0UjTwAgdK0anlQ7c8/pWPU2yVjyWcF1I1thABt6WXE47cI71pGiZ8wGvxohBoLnxM04L/wj8mQ==}
     cpu: [x64]
     os: [win32]
 
-  '@rollup/rollup-win32-x64-msvc@4.52.3':
-    resolution: {integrity: sha512-zGIbEVVXVtauFgl3MRwGWEN36P5ZGenHRMgNw88X5wEhEBpq0XrMEZwOn07+ICrwM17XO5xfMZqh0OldCH5VTA==}
+  '@rollup/rollup-win32-x64-msvc@4.52.4':
+    resolution: {integrity: sha512-bf9PtUa0u8IXDVxzRToFQKsNCRz9qLYfR/MpECxl4mRoWYjAeFjgxj1XdZr2M/GNVpT05p+LgQOHopYDlUu6/w==}
     cpu: [x64]
     os: [win32]
 
@@ -5003,22 +4892,22 @@ packages:
   '@rrweb/utils@2.0.0-alpha.18':
     resolution: {integrity: sha512-qV8azQYo9RuwW4NGRtOiQfTBdHNL1B0Q//uRLMbCSjbaKqJYd88Js17Bdskj65a0Vgp2dwTLPIZ0gK47dfjfaA==}
 
-  '@scalar/core@0.3.17':
-    resolution: {integrity: sha512-G6tP+2oorFA90szI8DGiEQ23SmobiuhN93GfTJNpFMhz/kdEtC4lcYawAxL1tWkZhlK/QYRcaCZcVzmpTUgBCA==}
+  '@scalar/core@0.3.18':
+    resolution: {integrity: sha512-STi6LiJTqOYwz4VhKi61SYhqOTT8TJ3M//XQyT3OwwfY0iBR/HNKUNnHsIWJdwaoGO4Ida5jj4L0JmpKtwQxTQ==}
     engines: {node: '>=20'}
 
-  '@scalar/hono-api-reference@0.9.19':
-    resolution: {integrity: sha512-MeBdIwuAAhwvsUt1f9174wASu0C8b4WrXuVdC/6FjrsTxLHSbJVx+XFzZAKF5ex+1kaXjvYrm3fiovRFHLyfJA==}
+  '@scalar/hono-api-reference@0.9.20':
+    resolution: {integrity: sha512-KZX+fN9E3UcH8HBDIuwm3e4bSonxnEEiRW2XdqHMPK3ToMrz4ulxckZL2/ByIuzzogO7umq7eRieJchfH61SHg==}
     engines: {node: '>=20'}
     peerDependencies:
       hono: ^4.0.0
 
-  '@scalar/openapi-types@0.3.7':
-    resolution: {integrity: sha512-QHSvHBVDze3+dUwAhIGq6l1iOev4jdoqdBK7QpfeN1Q4h+6qpVEw3EEqBiH0AXUSh/iWwObBv4uMgfIx0aNZ5g==}
+  '@scalar/openapi-types@0.4.0':
+    resolution: {integrity: sha512-vdFLzz7vETw6kS3bxWUHCBeFtJOnr1bk/+FXKyxKkd6TbcyT6USXkoelI704IaBdoXyOgGX10FD1IVrs4FwUow==}
     engines: {node: '>=20'}
 
-  '@scalar/types@0.2.16':
-    resolution: {integrity: sha512-XWff9jWfYaj6q3ww94x66S6Q58u/3kA1sDOUhLAwb9va7r58bzk3NRwLOkEEdJmyEns1MEJAM53mY8KRWX6elA==}
+  '@scalar/types@0.3.0':
+    resolution: {integrity: sha512-RVL4waBX2jpshVBU8l1J8gsG+Ai9oRoTN1Zc1+yaO2WG/ZMXOBtq1noJWpUk2c2i16E1oxmRZC8/nPNFRbkxog==}
     engines: {node: '>=20'}
 
   '@selderee/plugin-htmlparser2@0.11.0':
@@ -5068,105 +4957,53 @@ packages:
     resolution: {integrity: sha512-/ubWjPwgLep84sUPzHfKL2Ns9mK9aQrEX4aBFztru7ygiJidKJTxYGtvjh4dL2M1aZ0WRQYp+7PF6+VKwdZXcQ==}
     engines: {node: '>= 14'}
 
-  '@sentry/cli-darwin@2.55.0':
-    resolution: {integrity: sha512-jGHE7SHHzqXUmnsmRLgorVH6nmMmTjQQXdPZbSL5tRtH8d3OIYrVNr5D72DSgD26XAPBDMV0ibqOQ9NKoiSpfA==}
-    engines: {node: '>=10'}
-    os: [darwin]
-
   '@sentry/cli-darwin@2.56.0':
     resolution: {integrity: sha512-CzXFWbv3GrjU0gFlUM9jt0fvJmyo5ktty4HGxRFfS/eMC6xW58Gg/sEeMVEkdvk5osKooX/YEgfLBdo4zvuWDA==}
     engines: {node: '>=10'}
     os: [darwin]
 
-  '@sentry/cli-linux-arm64@2.55.0':
-    resolution: {integrity: sha512-jNB/0/gFcOuDCaY/TqeuEpsy/k52dwyk1SOV3s1ku4DUsln6govTppeAGRewY3T1Rj9B2vgIWTrnB8KVh9+Rgg==}
-    engines: {node: '>=10'}
-    cpu: [arm64]
-    os: [linux, freebsd, android]
-
   '@sentry/cli-linux-arm64@2.56.0':
     resolution: {integrity: sha512-91d5ZlC989j/t+TXor/glPyx6SnLFS/SlJ9fIrHIQohdGKyWWSFb4VKUan8Ok3GYu9SUzKTMByryIOoYEmeGVw==}
     engines: {node: '>=10'}
     cpu: [arm64]
     os: [linux, freebsd, android]
 
-  '@sentry/cli-linux-arm@2.55.0':
-    resolution: {integrity: sha512-ATjU0PsiWADSPLF/kZroLZ7FPKd5W9TDWHVkKNwIUNTei702LFgTjNeRwOIzTgSvG3yTmVEqtwFQfFN/7hnVXQ==}
-    engines: {node: '>=10'}
-    cpu: [arm]
-    os: [linux, freebsd, android]
-
   '@sentry/cli-linux-arm@2.56.0':
     resolution: {integrity: sha512-vQCCMhZLugPmr25XBoP94dpQsFa110qK5SBUVJcRpJKyzMZd+6ueeHNslq2mB0OF4BwL1qd/ZDIa4nxa1+0rjQ==}
     engines: {node: '>=10'}
     cpu: [arm]
     os: [linux, freebsd, android]
 
-  '@sentry/cli-linux-i686@2.55.0':
-    resolution: {integrity: sha512-8LZjo6PncTM6bWdaggscNOi5r7F/fqRREsCwvd51dcjGj7Kp1plqo9feEzYQ+jq+KUzVCiWfHrUjddFmYyZJrg==}
-    engines: {node: '>=10'}
-    cpu: [x86, ia32]
-    os: [linux, freebsd, android]
-
   '@sentry/cli-linux-i686@2.56.0':
     resolution: {integrity: sha512-MZzXuq1Q/TktN81DUs6XSBU752pG3XWSJdZR+NCStIg3l8s3O/Pwh6OcDHTYqgwsYJaGBpA0fP2Afl5XeSAUNg==}
     engines: {node: '>=10'}
     cpu: [x86, ia32]
     os: [linux, freebsd, android]
 
-  '@sentry/cli-linux-x64@2.55.0':
-    resolution: {integrity: sha512-5LUVvq74Yj2cZZy5g5o/54dcWEaX4rf3myTHy73AKhRj1PABtOkfexOLbF9xSrZy95WXWaXyeH+k5n5z/vtHfA==}
-    engines: {node: '>=10'}
-    cpu: [x64]
-    os: [linux, freebsd, android]
-
   '@sentry/cli-linux-x64@2.56.0':
     resolution: {integrity: sha512-INOO2OQ90Y3UzYgHRdrHdKC/0es3YSHLv0iNNgQwllL0YZihSVNYSSrZqcPq8oSDllEy9Vt9oOm/7qEnUP2Kfw==}
     engines: {node: '>=10'}
     cpu: [x64]
     os: [linux, freebsd, android]
 
-  '@sentry/cli-win32-arm64@2.55.0':
-    resolution: {integrity: sha512-cWIQdzm1pfLwPARsV6dUb8TVd6Y3V1A2VWxjTons3Ift6GvtVmiAe0OWL8t2Yt95i8v61kTD/6Tq21OAaogqzA==}
-    engines: {node: '>=10'}
-    cpu: [arm64]
-    os: [win32]
-
   '@sentry/cli-win32-arm64@2.56.0':
     resolution: {integrity: sha512-eUvkVk9KK01q6/qyugQPh7dAxqFPbgOa62QAoSwo11WQFYc3NPgJLilFWLQo+nahHGYKh6PKuCJ5tcqnQq5Hkg==}
     engines: {node: '>=10'}
     cpu: [arm64]
     os: [win32]
 
-  '@sentry/cli-win32-i686@2.55.0':
-    resolution: {integrity: sha512-ldepCn2t9r4I0wvgk7NRaA7coJyy4rTQAzM66u9j5nTEsUldf66xym6esd5ZZRAaJUjffqvHqUIr/lrieTIrVg==}
-    engines: {node: '>=10'}
-    cpu: [x86, ia32]
-    os: [win32]
-
   '@sentry/cli-win32-i686@2.56.0':
     resolution: {integrity: sha512-mpCA8hKXuvT17bl1H/54KOa5i+02VBBHVlOiP3ltyBuQUqfvX/30Zl/86Spy+ikodovZWAHv5e5FpyXbY1/mPw==}
     engines: {node: '>=10'}
     cpu: [x86, ia32]
     os: [win32]
 
-  '@sentry/cli-win32-x64@2.55.0':
-    resolution: {integrity: sha512-4hPc/I/9tXx+HLTdTGwlagtAfDSIa2AoTUP30tl32NAYQhx9a6niUbPAemK2qfxesiufJ7D2djX83rCw6WnJVA==}
-    engines: {node: '>=10'}
-    cpu: [x64]
-    os: [win32]
-
   '@sentry/cli-win32-x64@2.56.0':
     resolution: {integrity: sha512-UV0pXNls+/ViAU/3XsHLLNEHCsRYaGEwJdY3HyGIufSlglxrX6BVApkV9ziGi4WAxcJWLjQdfcEs6V5B+wBy0A==}
     engines: {node: '>=10'}
     cpu: [x64]
     os: [win32]
 
-  '@sentry/cli@2.55.0':
-    resolution: {integrity: sha512-cynvcIM2xL8ddwELyFRSpZQw4UtFZzoM2rId2l9vg7+wDREPDocMJB9lEQpBIo3eqhp9JswqUT037yjO6iJ5Sw==}
-    engines: {node: '>= 10'}
-    hasBin: true
-
   '@sentry/cli@2.56.0':
     resolution: {integrity: sha512-br6+1nTPUV5EG1oaxLzxv31kREFKr49Y1+3jutfMUz9Nl8VyVP7o9YwakB/YWl+0Vi0NXg5vq7qsd/OOuV5j8w==}
     engines: {node: '>= 10'}
@@ -5264,220 +5101,220 @@ packages:
     resolution: {integrity: sha512-LtoMMhxAlorcGhmFYI+LhPgbPZCkgP6ra1YL604EeF6U98pLlQ3iWIGMdWSC+vWmPBWBNgmDBAhnAobLROJmwg==}
     engines: {node: '>=18'}
 
-  '@smithy/abort-controller@4.1.1':
-    resolution: {integrity: sha512-vkzula+IwRvPR6oKQhMYioM3A/oX/lFCZiwuxkQbRhqJS2S4YRY2k7k/SyR2jMf3607HLtbEwlRxi0ndXHMjRg==}
+  '@smithy/abort-controller@4.2.0':
+    resolution: {integrity: sha512-PLUYa+SUKOEZtXFURBu/CNxlsxfaFGxSBPcStL13KpVeVWIfdezWyDqkz7iDLmwnxojXD0s5KzuB5HGHvt4Aeg==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/chunked-blob-reader-native@4.1.0':
-    resolution: {integrity: sha512-Bnv0B3nSlfB2mPO0WgM49I/prl7+kamF042rrf3ezJ3Z4C7csPYvyYgZfXTGXwXfj1mAwDWjE/ybIf49PzFzvA==}
+  '@smithy/chunked-blob-reader-native@4.2.0':
+    resolution: {integrity: sha512-HNbGWdyTfSM1nfrZKQjYTvD8k086+M8s1EYkBUdGC++lhxegUp2HgNf5RIt6oOGVvsC26hBCW/11tv8KbwLn/Q==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/chunked-blob-reader@5.1.0':
-    resolution: {integrity: sha512-a36AtR7Q7XOhRPt6F/7HENmTWcB8kN7mDJcOFM/+FuKO6x88w8MQJfYCufMWh4fGyVkPjUh3Rrz/dnqFQdo6OQ==}
+  '@smithy/chunked-blob-reader@5.2.0':
+    resolution: {integrity: sha512-WmU0TnhEAJLWvfSeMxBNe5xtbselEO8+4wG0NtZeL8oR21WgH1xiO37El+/Y+H/Ie4SCwBy3MxYWmOYaGgZueA==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/config-resolver@4.2.2':
-    resolution: {integrity: sha512-IT6MatgBWagLybZl1xQcURXRICvqz1z3APSCAI9IqdvfCkrA7RaQIEfgC6G/KvfxnDfQUDqFV+ZlixcuFznGBQ==}
+  '@smithy/config-resolver@4.3.0':
+    resolution: {integrity: sha512-9oH+n8AVNiLPK/iK/agOsoWfrKZ3FGP3502tkksd6SRsKMYiu7AFX0YXo6YBADdsAj7C+G/aLKdsafIJHxuCkQ==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/core@3.12.0':
-    resolution: {integrity: sha512-zJeAgogZfbwlPGL93y4Z/XNeIN37YCreRUd6YMIRvaq+6RnBK8PPYYIQ85Is/GglPh3kNImD5riDCXbVSDpCiQ==}
+  '@smithy/core@3.14.0':
+    resolution: {integrity: sha512-XJ4z5FxvY/t0Dibms/+gLJrI5niRoY0BCmE02fwmPcRYFPI4KI876xaE79YGWIKnEslMbuQPsIEsoU/DXa0DoA==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/credential-provider-imds@4.1.2':
-    resolution: {integrity: sha512-JlYNq8TShnqCLg0h+afqe2wLAwZpuoSgOyzhYvTgbiKBWRov+uUve+vrZEQO6lkdLOWPh7gK5dtb9dS+KGendg==}
+  '@smithy/credential-provider-imds@4.2.0':
+    resolution: {integrity: sha512-SOhFVvFH4D5HJZytb0bLKxCrSnwcqPiNlrw+S4ZXjMnsC+o9JcUQzbZOEQcA8yv9wJFNhfsUiIUKiEnYL68Big==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/eventstream-codec@4.1.1':
-    resolution: {integrity: sha512-PwkQw1hZwHTQB6X5hSUWz2OSeuj5Z6enWuAqke7DgWoP3t6vg3ktPpqPz3Erkn6w+tmsl8Oss6nrgyezoea2Iw==}
+  '@smithy/eventstream-codec@4.2.0':
+    resolution: {integrity: sha512-XE7CtKfyxYiNZ5vz7OvyTf1osrdbJfmUy+rbh+NLQmZumMGvY0mT0Cq1qKSfhrvLtRYzMsOBuRpi10dyI0EBPg==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/eventstream-serde-browser@4.1.1':
-    resolution: {integrity: sha512-Q9QWdAzRaIuVkefupRPRFAasaG/droBqn1feiMnmLa+LLEUG45pqX1+FurHFmlqiCfobB3nUlgoJfeXZsr7MPA==}
+  '@smithy/eventstream-serde-browser@4.2.0':
+    resolution: {integrity: sha512-U53p7fcrk27k8irLhOwUu+UYnBqsXNLKl1XevOpsxK3y1Lndk8R7CSiZV6FN3fYFuTPuJy5pP6qa/bjDzEkRvA==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/eventstream-serde-config-resolver@4.2.1':
-    resolution: {integrity: sha512-oSUkF9zDN9zcOUBMtxp8RewJlh71E9NoHWU8jE3hU9JMYCsmW4assVTpgic/iS3/dM317j6hO5x18cc3XrfvEw==}
+  '@smithy/eventstream-serde-config-resolver@4.3.0':
+    resolution: {integrity: sha512-uwx54t8W2Yo9Jr3nVF5cNnkAAnMCJ8Wrm+wDlQY6rY/IrEgZS3OqagtCu/9ceIcZFQ1zVW/zbN9dxb5esuojfA==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/eventstream-serde-node@4.1.1':
-    resolution: {integrity: sha512-tn6vulwf/ScY0vjhzptSJuDJJqlhNtUjkxJ4wiv9E3SPoEqTEKbaq6bfqRO7nvhTG29ALICRcvfFheOUPl8KNA==}
+  '@smithy/eventstream-serde-node@4.2.0':
+    resolution: {integrity: sha512-yjM2L6QGmWgJjVu/IgYd6hMzwm/tf4VFX0lm8/SvGbGBwc+aFl3hOzvO/e9IJ2XI+22Tx1Zg3vRpFRs04SWFcg==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/eventstream-serde-universal@4.1.1':
-    resolution: {integrity: sha512-uLOAiM/Dmgh2CbEXQx+6/ssK7fbzFhd+LjdyFxXid5ZBCbLHTFHLdD/QbXw5aEDsLxQhgzDxLLsZhsftAYwHJA==}
+  '@smithy/eventstream-serde-universal@4.2.0':
+    resolution: {integrity: sha512-C3jxz6GeRzNyGKhU7oV656ZbuHY93mrfkT12rmjDdZch142ykjn8do+VOkeRNjSGKw01p4g+hdalPYPhmMwk1g==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/fetch-http-handler@5.2.1':
-    resolution: {integrity: sha512-5/3wxKNtV3wO/hk1is+CZUhL8a1yy/U+9u9LKQ9kZTkMsHaQjJhc3stFfiujtMnkITjzWfndGA2f7g9Uh9vKng==}
+  '@smithy/fetch-http-handler@5.3.0':
+    resolution: {integrity: sha512-BG3KSmsx9A//KyIfw+sqNmWFr1YBUr+TwpxFT7yPqAk0yyDh7oSNgzfNH7pS6OC099EGx2ltOULvumCFe8bcgw==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/hash-blob-browser@4.1.1':
-    resolution: {integrity: sha512-avAtk++s1e/1VODf+rg7c9R2pB5G9y8yaJaGY4lPZI2+UIqVyuSDMikWjeWfBVmFZ3O7NpDxBbUCyGhThVUKWQ==}
+  '@smithy/hash-blob-browser@4.2.0':
+    resolution: {integrity: sha512-MWmrRTPqVKpN8NmxmJPTeQuhewTt8Chf+waB38LXHZoA02+BeWYVQ9ViAwHjug8m7lQb1UWuGqp3JoGDOWvvuA==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/hash-node@4.1.1':
-    resolution: {integrity: sha512-H9DIU9WBLhYrvPs9v4sYvnZ1PiAI0oc8CgNQUJ1rpN3pP7QADbTOUjchI2FB764Ub0DstH5xbTqcMJu1pnVqxA==}
+  '@smithy/hash-node@4.2.0':
+    resolution: {integrity: sha512-ugv93gOhZGysTctZh9qdgng8B+xO0cj+zN0qAZ+Sgh7qTQGPOJbMdIuyP89KNfUyfAqFSNh5tMvC+h2uCpmTtA==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/hash-stream-node@4.1.1':
-    resolution: {integrity: sha512-3ztT4pV0Moazs3JAYFdfKk11kYFDo4b/3R3+xVjIm6wY9YpJf+xfz+ocEnNKcWAdcmSMqi168i2EMaKmJHbJMA==}
+  '@smithy/hash-stream-node@4.2.0':
+    resolution: {integrity: sha512-8dELAuGv+UEjtzrpMeNBZc1sJhO8GxFVV/Yh21wE35oX4lOE697+lsMHBoUIFAUuYkTMIeu0EuJSEsH7/8Y+UQ==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/invalid-dependency@4.1.1':
-    resolution: {integrity: sha512-1AqLyFlfrrDkyES8uhINRlJXmHA2FkG+3DY8X+rmLSqmFwk3DJnvhyGzyByPyewh2jbmV+TYQBEfngQax8IFGg==}
+  '@smithy/invalid-dependency@4.2.0':
+    resolution: {integrity: sha512-ZmK5X5fUPAbtvRcUPtk28aqIClVhbfcmfoS4M7UQBTnDdrNxhsrxYVv0ZEl5NaPSyExsPWqL4GsPlRvtlwg+2A==}
     engines: {node: '>=18.0.0'}
 
   '@smithy/is-array-buffer@2.2.0':
     resolution: {integrity: sha512-GGP3O9QFD24uGeAXYUjwSTXARoqpZykHadOmA8G5vfJPK0/DC67qa//0qvqrJzL1xc8WQWX7/yc7fwudjPHPhA==}
     engines: {node: '>=14.0.0'}
 
-  '@smithy/is-array-buffer@4.1.0':
-    resolution: {integrity: sha512-ePTYUOV54wMogio+he4pBybe8fwg4sDvEVDBU8ZlHOZXbXK3/C0XfJgUCu6qAZcawv05ZhZzODGUerFBPsPUDQ==}
+  '@smithy/is-array-buffer@4.2.0':
+    resolution: {integrity: sha512-DZZZBvC7sjcYh4MazJSGiWMI2L7E0oCiRHREDzIxi/M2LY79/21iXt6aPLHge82wi5LsuRF5A06Ds3+0mlh6CQ==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/md5-js@4.1.1':
-    resolution: {integrity: sha512-MvWXKK743BuHjr/hnWuT6uStdKEaoqxHAQUvbKJPPZM5ZojTNFI5D+47BoQfBE5RgGlRRty05EbWA+NXDv+hIA==}
+  '@smithy/md5-js@4.2.0':
+    resolution: {integrity: sha512-LFEPniXGKRQArFmDQ3MgArXlClFJMsXDteuQQY8WG1/zzv6gVSo96+qpkuu1oJp4MZsKrwchY0cuAoPKzEbaNA==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/middleware-content-length@4.1.1':
-    resolution: {integrity: sha512-9wlfBBgTsRvC2JxLJxv4xDGNBrZuio3AgSl0lSFX7fneW2cGskXTYpFxCdRYD2+5yzmsiTuaAJD1Wp7gWt9y9w==}
+  '@smithy/middleware-content-length@4.2.0':
+    resolution: {integrity: sha512-6ZAnwrXFecrA4kIDOcz6aLBhU5ih2is2NdcZtobBDSdSHtE9a+MThB5uqyK4XXesdOCvOcbCm2IGB95birTSOQ==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/middleware-endpoint@4.2.4':
-    resolution: {integrity: sha512-FZ4hzupOmthm8Q8ujYrd0I+/MHwVMuSTdkDtIQE0xVuvJt9pLT6Q+b0p4/t+slDyrpcf+Wj7SN+ZqT5OryaaZg==}
+  '@smithy/middleware-endpoint@4.3.0':
+    resolution: {integrity: sha512-jFVjuQeV8TkxaRlcCNg0GFVgg98tscsmIrIwRFeC74TIUyLE3jmY9xgc1WXrPQYRjQNK3aRoaIk6fhFRGOIoGw==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/middleware-retry@4.3.0':
-    resolution: {integrity: sha512-qhEX9745fAxZvtLM4bQJAVC98elWjiMO2OiHl1s6p7hUzS4QfZO1gXUYNwEK8m0J6NoCD5W52ggWxbIDHI0XSg==}
+  '@smithy/middleware-retry@4.4.0':
+    resolution: {integrity: sha512-yaVBR0vQnOnzex45zZ8ZrPzUnX73eUC8kVFaAAbn04+6V7lPtxn56vZEBBAhgS/eqD6Zm86o6sJs6FuQVoX5qg==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/middleware-serde@4.1.1':
-    resolution: {integrity: sha512-lh48uQdbCoj619kRouev5XbWhCwRKLmphAif16c4J6JgJ4uXjub1PI6RL38d3BLliUvSso6klyB/LTNpWSNIyg==}
+  '@smithy/middleware-serde@4.2.0':
+    resolution: {integrity: sha512-rpTQ7D65/EAbC6VydXlxjvbifTf4IH+sADKg6JmAvhkflJO2NvDeyU9qsWUNBelJiQFcXKejUHWRSdmpJmEmiw==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/middleware-stack@4.1.1':
-    resolution: {integrity: sha512-ygRnniqNcDhHzs6QAPIdia26M7e7z9gpkIMUe/pK0RsrQ7i5MblwxY8078/QCnGq6AmlUUWgljK2HlelsKIb/A==}
+  '@smithy/middleware-stack@4.2.0':
+    resolution: {integrity: sha512-G5CJ//eqRd9OARrQu9MK1H8fNm2sMtqFh6j8/rPozhEL+Dokpvi1Og+aCixTuwDAGZUkJPk6hJT5jchbk/WCyg==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/node-config-provider@4.2.2':
-    resolution: {integrity: sha512-SYGTKyPvyCfEzIN5rD8q/bYaOPZprYUPD2f5g9M7OjaYupWOoQFYJ5ho+0wvxIRf471i2SR4GoiZ2r94Jq9h6A==}
+  '@smithy/node-config-provider@4.3.0':
+    resolution: {integrity: sha512-5QgHNuWdT9j9GwMPPJCKxy2KDxZ3E5l4M3/5TatSZrqYVoEiqQrDfAq8I6KWZw7RZOHtVtCzEPdYz7rHZixwcA==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/node-http-handler@4.2.1':
-    resolution: {integrity: sha512-REyybygHlxo3TJICPF89N2pMQSf+p+tBJqpVe1+77Cfi9HBPReNjTgtZ1Vg73exq24vkqJskKDpfF74reXjxfw==}
+  '@smithy/node-http-handler@4.3.0':
+    resolution: {integrity: sha512-RHZ/uWCmSNZ8cneoWEVsVwMZBKy/8123hEpm57vgGXA3Irf/Ja4v9TVshHK2ML5/IqzAZn0WhINHOP9xl+Qy6Q==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/property-provider@4.1.1':
-    resolution: {integrity: sha512-gm3ZS7DHxUbzC2wr8MUCsAabyiXY0gaj3ROWnhSx/9sPMc6eYLMM4rX81w1zsMaObj2Lq3PZtNCC1J6lpEY7zg==}
+  '@smithy/property-provider@4.2.0':
+    resolution: {integrity: sha512-rV6wFre0BU6n/tx2Ztn5LdvEdNZ2FasQbPQmDOPfV9QQyDmsCkOAB0osQjotRCQg+nSKFmINhyda0D3AnjSBJw==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/protocol-http@5.2.1':
-    resolution: {integrity: sha512-T8SlkLYCwfT/6m33SIU/JOVGNwoelkrvGjFKDSDtVvAXj/9gOT78JVJEas5a+ETjOu4SVvpCstKgd0PxSu/aHw==}
+  '@smithy/protocol-http@5.3.0':
+    resolution: {integrity: sha512-6POSYlmDnsLKb7r1D3SVm7RaYW6H1vcNcTWGWrF7s9+2noNYvUsm7E4tz5ZQ9HXPmKn6Hb67pBDRIjrT4w/d7Q==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/querystring-builder@4.1.1':
-    resolution: {integrity: sha512-J9b55bfimP4z/Jg1gNo+AT84hr90p716/nvxDkPGCD4W70MPms0h8KF50RDRgBGZeL83/u59DWNqJv6tEP/DHA==}
+  '@smithy/querystring-builder@4.2.0':
+    resolution: {integrity: sha512-Q4oFD0ZmI8yJkiPPeGUITZj++4HHYCW3pYBYfIobUCkYpI6mbkzmG1MAQQ3lJYYWj3iNqfzOenUZu+jqdPQ16A==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/querystring-parser@4.1.1':
-    resolution: {integrity: sha512-63TEp92YFz0oQ7Pj9IuI3IgnprP92LrZtRAkE3c6wLWJxfy/yOPRt39IOKerVr0JS770olzl0kGafXlAXZ1vng==}
+  '@smithy/querystring-parser@4.2.0':
+    resolution: {integrity: sha512-BjATSNNyvVbQxOOlKse0b0pSezTWGMvA87SvoFoFlkRsKXVsN3bEtjCxvsNXJXfnAzlWFPaT9DmhWy1vn0sNEA==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/service-error-classification@4.1.2':
-    resolution: {integrity: sha512-Kqd8wyfmBWHZNppZSMfrQFpc3M9Y/kjyN8n8P4DqJJtuwgK1H914R471HTw7+RL+T7+kI1f1gOnL7Vb5z9+NgQ==}
+  '@smithy/service-error-classification@4.2.0':
+    resolution: {integrity: sha512-Ylv1ttUeKatpR0wEOMnHf1hXMktPUMObDClSWl2TpCVT4DwtJhCeighLzSLbgH3jr5pBNM0LDXT5yYxUvZ9WpA==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/shared-ini-file-loader@4.2.0':
-    resolution: {integrity: sha512-OQTfmIEp2LLuWdxa8nEEPhZmiOREO6bcB6pjs0AySf4yiZhl6kMOfqmcwcY8BaBPX+0Tb+tG7/Ia/6mwpoZ7Pw==}
+  '@smithy/shared-ini-file-loader@4.3.0':
+    resolution: {integrity: sha512-VCUPPtNs+rKWlqqntX0CbVvWyjhmX30JCtzO+s5dlzzxrvSfRh5SY0yxnkirvc1c80vdKQttahL71a9EsdolSQ==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/signature-v4@5.2.1':
-    resolution: {integrity: sha512-M9rZhWQLjlQVCCR37cSjHfhriGRN+FQ8UfgrYNufv66TJgk+acaggShl3KS5U/ssxivvZLlnj7QH2CUOKlxPyA==}
+  '@smithy/signature-v4@5.3.0':
+    resolution: {integrity: sha512-MKNyhXEs99xAZaFhm88h+3/V+tCRDQ+PrDzRqL0xdDpq4gjxcMmf5rBA3YXgqZqMZ/XwemZEurCBQMfxZOWq/g==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/smithy-client@4.6.4':
-    resolution: {integrity: sha512-qL7O3VDyfzCSN9r+sdbQXGhaHtrfSJL30En6Jboj0I3bobf2g1/T0eP2L4qxqrEW26gWhJ4THI4ElVVLjYyBHg==}
+  '@smithy/smithy-client@4.7.0':
+    resolution: {integrity: sha512-3BDx/aCCPf+kkinYf5QQhdQ9UAGihgOVqI3QO5xQfSaIWvUE4KYLtiGRWsNe1SR7ijXC0QEPqofVp5Sb0zC8xQ==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/types@4.5.0':
-    resolution: {integrity: sha512-RkUpIOsVlAwUIZXO1dsz8Zm+N72LClFfsNqf173catVlvRZiwPy0x2u0JLEA4byreOPKDZPGjmPDylMoP8ZJRg==}
+  '@smithy/types@4.6.0':
+    resolution: {integrity: sha512-4lI9C8NzRPOv66FaY1LL1O/0v0aLVrq/mXP/keUa9mJOApEeae43LsLd2kZRUJw91gxOQfLIrV3OvqPgWz1YsA==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/url-parser@4.1.1':
-    resolution: {integrity: sha512-bx32FUpkhcaKlEoOMbScvc93isaSiRM75pQ5IgIBaMkT7qMlIibpPRONyx/0CvrXHzJLpOn/u6YiDX2hcvs7Dg==}
+  '@smithy/url-parser@4.2.0':
+    resolution: {integrity: sha512-AlBmD6Idav2ugmoAL6UtR6ItS7jU5h5RNqLMZC7QrLCoITA9NzIN3nx9GWi8g4z1pfWh2r9r96SX/jHiNwPJ9A==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/util-base64@4.1.0':
-    resolution: {integrity: sha512-RUGd4wNb8GeW7xk+AY5ghGnIwM96V0l2uzvs/uVHf+tIuVX2WSvynk5CxNoBCsM2rQRSZElAo9rt3G5mJ/gktQ==}
+  '@smithy/util-base64@4.2.0':
+    resolution: {integrity: sha512-+erInz8WDv5KPe7xCsJCp+1WCjSbah9gWcmUXc9NqmhyPx59tf7jqFz+za1tRG1Y5KM1Cy1rWCcGypylFp4mvA==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/util-body-length-browser@4.1.0':
-    resolution: {integrity: sha512-V2E2Iez+bo6bUMOTENPr6eEmepdY8Hbs+Uc1vkDKgKNA/brTJqOW/ai3JO1BGj9GbCeLqw90pbbH7HFQyFotGQ==}
+  '@smithy/util-body-length-browser@4.2.0':
+    resolution: {integrity: sha512-Fkoh/I76szMKJnBXWPdFkQJl2r9SjPt3cMzLdOB6eJ4Pnpas8hVoWPYemX/peO0yrrvldgCUVJqOAjUrOLjbxg==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/util-body-length-node@4.1.0':
-    resolution: {integrity: sha512-BOI5dYjheZdgR9XiEM3HJcEMCXSoqbzu7CzIgYrx0UtmvtC3tC2iDGpJLsSRFffUpy8ymsg2ARMP5fR8mtuUQQ==}
+  '@smithy/util-body-length-node@4.2.0':
+    resolution: {integrity: sha512-U8q1WsSZFjXijlD7a4wsDQOvOwV+72iHSfq1q7VD+V75xP/pdtm0WIGuaFJ3gcADDOKj2MIBn4+zisi140HEnQ==}
     engines: {node: '>=18.0.0'}
 
   '@smithy/util-buffer-from@2.2.0':
     resolution: {integrity: sha512-IJdWBbTcMQ6DA0gdNhh/BwrLkDR+ADW5Kr1aZmd4k3DIF6ezMV4R2NIAmT08wQJ3yUK82thHWmC/TnK/wpMMIA==}
     engines: {node: '>=14.0.0'}
 
-  '@smithy/util-buffer-from@4.1.0':
-    resolution: {integrity: sha512-N6yXcjfe/E+xKEccWEKzK6M+crMrlwaCepKja0pNnlSkm6SjAeLKKA++er5Ba0I17gvKfN/ThV+ZOx/CntKTVw==}
+  '@smithy/util-buffer-from@4.2.0':
+    resolution: {integrity: sha512-kAY9hTKulTNevM2nlRtxAG2FQ3B2OR6QIrPY3zE5LqJy1oxzmgBGsHLWTcNhWXKchgA0WHW+mZkQrng/pgcCew==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/util-config-provider@4.1.0':
-    resolution: {integrity: sha512-swXz2vMjrP1ZusZWVTB/ai5gK+J8U0BWvP10v9fpcFvg+Xi/87LHvHfst2IgCs1i0v4qFZfGwCmeD/KNCdJZbQ==}
+  '@smithy/util-config-provider@4.2.0':
+    resolution: {integrity: sha512-YEjpl6XJ36FTKmD+kRJJWYvrHeUvm5ykaUS5xK+6oXffQPHeEM4/nXlZPe+Wu0lsgRUcNZiliYNh/y7q9c2y6Q==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/util-defaults-mode-browser@4.1.4':
-    resolution: {integrity: sha512-mLDJ1s4eA3vwOGaQOEPlg5LB4LdZUUMpB5UMOMofeGhWqiS7WR7dTpLiNi9zVn+YziKUd3Af5NLfxDs7NJqmIw==}
+  '@smithy/util-defaults-mode-browser@4.2.0':
+    resolution: {integrity: sha512-qzHp7ZDk1Ba4LDwQVCNp90xPGqSu7kmL7y5toBpccuhi3AH7dcVBIT/pUxYcInK4jOy6FikrcTGq5wxcka8UaQ==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/util-defaults-mode-node@4.1.4':
-    resolution: {integrity: sha512-pjX2iMTcOASaSanAd7bu6i3fcMMezr3NTr8Rh64etB0uHRZi+Aw86DoCxPESjY4UTIuA06hhqtTtw95o//imYA==}
+  '@smithy/util-defaults-mode-node@4.2.0':
+    resolution: {integrity: sha512-FxUHS3WXgx3bTWR6yQHNHHkQHZm/XKIi/CchTnKvBulN6obWpcbzJ6lDToXn+Wp0QlVKd7uYAz2/CTw1j7m+Kg==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/util-endpoints@3.1.2':
-    resolution: {integrity: sha512-+AJsaaEGb5ySvf1SKMRrPZdYHRYSzMkCoK16jWnIMpREAnflVspMIDeCVSZJuj+5muZfgGpNpijE3mUNtjv01Q==}
+  '@smithy/util-endpoints@3.2.0':
+    resolution: {integrity: sha512-TXeCn22D56vvWr/5xPqALc9oO+LN+QpFjrSM7peG/ckqEPoI3zaKZFp+bFwfmiHhn5MGWPaLCqDOJPPIixk9Wg==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/util-hex-encoding@4.1.0':
-    resolution: {integrity: sha512-1LcueNN5GYC4tr8mo14yVYbh/Ur8jHhWOxniZXii+1+ePiIbsLZ5fEI0QQGtbRRP5mOhmooos+rLmVASGGoq5w==}
+  '@smithy/util-hex-encoding@4.2.0':
+    resolution: {integrity: sha512-CCQBwJIvXMLKxVbO88IukazJD9a4kQ9ZN7/UMGBjBcJYvatpWk+9g870El4cB8/EJxfe+k+y0GmR9CAzkF+Nbw==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/util-middleware@4.1.1':
-    resolution: {integrity: sha512-CGmZ72mL29VMfESz7S6dekqzCh8ZISj3B+w0g1hZFXaOjGTVaSqfAEFAq8EGp8fUL+Q2l8aqNmt8U1tglTikeg==}
+  '@smithy/util-middleware@4.2.0':
+    resolution: {integrity: sha512-u9OOfDa43MjagtJZ8AapJcmimP+K2Z7szXn8xbty4aza+7P1wjFmy2ewjSbhEiYQoW1unTlOAIV165weYAaowA==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/util-retry@4.1.2':
-    resolution: {integrity: sha512-NCgr1d0/EdeP6U5PSZ9Uv5SMR5XRRYoVr1kRVtKZxWL3tixEL3UatrPIMFZSKwHlCcp2zPLDvMubVDULRqeunA==}
+  '@smithy/util-retry@4.2.0':
+    resolution: {integrity: sha512-BWSiuGbwRnEE2SFfaAZEX0TqaxtvtSYPM/J73PFVm+A29Fg1HTPiYFb8TmX1DXp4hgcdyJcNQmprfd5foeORsg==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/util-stream@4.3.2':
-    resolution: {integrity: sha512-Ka+FA2UCC/Q1dEqUanCdpqwxOFdf5Dg2VXtPtB1qxLcSGh5C1HdzklIt18xL504Wiy9nNUKwDMRTVCbKGoK69g==}
+  '@smithy/util-stream@4.4.0':
+    resolution: {integrity: sha512-vtO7ktbixEcrVzMRmpQDnw/Ehr9UWjBvSJ9fyAbadKkC4w5Cm/4lMO8cHz8Ysb8uflvQUNRcuux/oNHKPXkffg==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/util-uri-escape@4.1.0':
-    resolution: {integrity: sha512-b0EFQkq35K5NHUYxU72JuoheM6+pytEVUGlTwiFxWFpmddA+Bpz3LgsPRIpBk8lnPE47yT7AF2Egc3jVnKLuPg==}
+  '@smithy/util-uri-escape@4.2.0':
+    resolution: {integrity: sha512-igZpCKV9+E/Mzrpq6YacdTQ0qTiLm85gD6N/IrmyDvQFA4UnU3d5g3m8tMT/6zG/vVkWSU+VxeUyGonL62DuxA==}
     engines: {node: '>=18.0.0'}
 
   '@smithy/util-utf8@2.3.0':
     resolution: {integrity: sha512-R8Rdn8Hy72KKcebgLiv8jQcQkXoLMOGGv5uI1/k0l+snqkOzQ1R0ChUBCxWMlBsFMekWjq0wRudIweFs7sKT5A==}
     engines: {node: '>=14.0.0'}
 
-  '@smithy/util-utf8@4.1.0':
-    resolution: {integrity: sha512-mEu1/UIXAdNYuBcyEPbjScKi/+MQVXNIuY/7Cm5XLIWe319kDrT5SizBE95jqtmEXoDbGoZxKLCMttdZdqTZKQ==}
+  '@smithy/util-utf8@4.2.0':
+    resolution: {integrity: sha512-zBPfuzoI8xyBtR2P6WQj63Rz8i3AmfAaJLuNG8dWsfvPe8lO4aCPYLn879mEgHndZH1zQ2oXmG8O1GGzzaoZiw==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/util-waiter@4.1.1':
-    resolution: {integrity: sha512-PJBmyayrlfxM7nbqjomF4YcT1sApQwZio0NHSsT0EzhJqljRmvhzqZua43TyEs80nJk2Cn2FGPg/N8phH6KeCQ==}
+  '@smithy/util-waiter@4.2.0':
+    resolution: {integrity: sha512-0Z+nxUU4/4T+SL8BCNN4ztKdQjToNvUYmkF1kXO5T7Yz3Gafzh0HeIG6mrkN8Fz3gn9hSyxuAT+6h4vM+iQSBQ==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/uuid@1.0.0':
-    resolution: {integrity: sha512-OlA/yZHh0ekYFnbUkmYBDQPE6fGfdrvgz39ktp8Xf+FA6BfxLejPTMDOG0Nfk5/rDySAz1dRbFf24zaAFYVXlQ==}
+  '@smithy/uuid@1.1.0':
+    resolution: {integrity: sha512-4aUIteuyxtBUhVdiQqcDhKFitwfd9hqoSDYY2KRXiWtgoWJ9Bmise+KfEPDiVHWeJepvF8xJO9/9+WDIciMFFw==}
     engines: {node: '>=18.0.0'}
 
   '@standard-schema/spec@1.0.0':
@@ -5754,45 +5591,45 @@ packages:
     resolution: {integrity: sha512-UCHM2uS0t/uSszqPEo+SBSSoQVeQ+LlOWAVBl5SA7+AedeAbKafIPjFn8huZCXNLAYb0WKV2+wETr7lDK9uz7g==}
     engines: {node: '>=12'}
 
-  '@tanstack/query-core@5.87.4':
-    resolution: {integrity: sha512-uNsg6zMxraEPDVO2Bn+F3/ctHi+Zsk+MMpcN8h6P7ozqD088F6mFY5TfGM7zuyIrL7HKpDyu6QHfLWiDxh3cuw==}
+  '@tanstack/query-core@5.90.2':
+    resolution: {integrity: sha512-k/TcR3YalnzibscALLwxeiLUub6jN5EDLwKDiO7q5f4ICEoptJ+n9+7vcEFy5/x/i6Q+Lb/tXrsKCggf5uQJXQ==}
 
-  '@tanstack/query-devtools@5.87.3':
-    resolution: {integrity: sha512-LkzxzSr2HS1ALHTgDmJH5eGAVsSQiuwz//VhFW5OqNk0OQ+Fsqba0Tsf+NzWRtXYvpgUqwQr4b2zdFZwxHcGvg==}
+  '@tanstack/query-devtools@5.90.1':
+    resolution: {integrity: sha512-GtINOPjPUH0OegJExZ70UahT9ykmAhmtNVcmtdnOZbxLwT7R5OmRztR5Ahe3/Cu7LArEmR6/588tAycuaWb1xQ==}
 
-  '@tanstack/query-persist-client-core@5.87.4':
-    resolution: {integrity: sha512-71jHVxFvRBjPfiLQ4cJ71sRICCf989s+wCdynmwvAJqW6NgWx7GkdhQC1F7tXb56ZlcK19kQPPa5X2EPqP94wA==}
+  '@tanstack/query-persist-client-core@5.90.2':
+    resolution: {integrity: sha512-rgJRgqqziPc3KgK2mav2HNR4PoI5e7fkiIrkg85xZ5j29mHPzTp3A0QcceQXVaV9qcPp/SMDJA48A6BpGJGHZg==}
 
-  '@tanstack/query-sync-storage-persister@5.87.4':
-    resolution: {integrity: sha512-c09tsMaNugl/dSXvYZvWvW/rqRXluiSkDOD1+aXUmsNPmOHsM51grrFy5r8X80xJFuBwfd5ouir7Nm5eSxKxLA==}
+  '@tanstack/query-sync-storage-persister@5.90.2':
+    resolution: {integrity: sha512-vofHRbeLS6ufL/hOndbuBbMJGAJb2EdckJUT6C1jv1Px7b0y6s7ZHbb/lNiAA3yrIxQILw6feGFl/6/Fu58viQ==}
 
-  '@tanstack/react-query-devtools@5.87.4':
-    resolution: {integrity: sha512-JYcnVJBBW1DCPyNGM0S2CyrLpe6KFiL2gpYd/k9tAp62Du7+Y27zkzd+dKFyxpFadYaTxsx4kUA7YvnkMLVUoQ==}
+  '@tanstack/react-query-devtools@5.90.2':
+    resolution: {integrity: sha512-vAXJzZuBXtCQtrY3F/yUNJCV4obT/A/n81kb3+YqLbro5Z2+phdAbceO+deU3ywPw8B42oyJlp4FhO0SoivDFQ==}
     peerDependencies:
-      '@tanstack/react-query': ^5.87.4
+      '@tanstack/react-query': ^5.90.2
       react: ^18 || ^19
 
-  '@tanstack/react-query-persist-client@5.87.4':
-    resolution: {integrity: sha512-RFnkAfYJcQ8nEQUWx0rhcPVPdRmvHAYG+mJwcykiJKVHaFeCuiHaEoW3KseGTBZcliV//UjI07bplAaT2ElR8g==}
+  '@tanstack/react-query-persist-client@5.90.2':
+    resolution: {integrity: sha512-ii5VbUlxv/zSPWbMT5Sr7VAsmvjup+xu7XeHj/umRiZ3cR7Ulc+6qwFhfehw7sUi1L6/K0RN5hXZjtzPBrUgjA==}
     peerDependencies:
-      '@tanstack/react-query': ^5.87.4
+      '@tanstack/react-query': ^5.90.2
       react: ^18 || ^19
 
-  '@tanstack/react-query@5.87.4':
-    resolution: {integrity: sha512-T5GT/1ZaNsUXf5I3RhcYuT17I4CPlbZgyLxc/ZGv7ciS6esytlbjb3DgUFO6c8JWYMDpdjSWInyGZUErgzqhcA==}
+  '@tanstack/react-query@5.90.2':
+    resolution: {integrity: sha512-CLABiR+h5PYfOWr/z+vWFt5VsOA2ekQeRQBFSKlcoW6Ndx/f8rfyVmq4LbgOM4GG2qtxAxjLYLOpCNTYm4uKzw==}
     peerDependencies:
       react: ^18 || ^19
 
-  '@tanstack/react-router-devtools@1.132.31':
-    resolution: {integrity: sha512-EiO+t6s1K8igqqtxCO0GLG6KoJgaIsv9JAZMcJV+z/BspElGQwGDBzTtWYcHd9NOP2Yw7OCkAhM8ihwMbzWJNQ==}
+  '@tanstack/react-router-devtools@1.132.33':
+    resolution: {integrity: sha512-QXoSjFOK0dy/M7s14b7D+vUqXfPET8KuIxS1ebTPP8NWdlodHqxYUEj1/r66Ar+FFH7OyXbWr8wcCu1BRY0nBg==}
     engines: {node: '>=12'}
     peerDependencies:
-      '@tanstack/react-router': ^1.132.31
+      '@tanstack/react-router': ^1.132.33
       react: '>=18.0.0 || >=19.0.0'
       react-dom: '>=18.0.0 || >=19.0.0'
 
-  '@tanstack/react-router@1.132.31':
-    resolution: {integrity: sha512-bgYgffI9TQhi8Zc/I5DMQEO4WOcDNtSll66Eb3/+k3iuI59ovVB/CiVCGjqdT8+2YBBj2x0saRDjsF00vj5+Yg==}
+  '@tanstack/react-router@1.132.33':
+    resolution: {integrity: sha512-o/uOh/EfCRr5u2SyY6aHJCIREZKTyXsiztMnZGSWjT055J99IaQm7zUwq9ZeK841hsZ7fhgMjLh8my75SOdobA==}
     engines: {node: '>=12'}
     peerDependencies:
       react: '>=18.0.0 || >=19.0.0'
@@ -5804,15 +5641,15 @@ packages:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
 
-  '@tanstack/router-core@1.132.31':
-    resolution: {integrity: sha512-74W+J5N1NuPcuWDwsBAjCgK4ahtIRaB51KdegYrD1AeSNqiV4u8KzOzHKAAZD01UipQApUbpJbzFrHq0XQ9BHw==}
+  '@tanstack/router-core@1.132.33':
+    resolution: {integrity: sha512-7EwXqlcBsIbDfb8MjhpZp0yaZHE6Jl+TBHtQ3WErramBB5PLFtYVDB1fiJnZMCftHXJNWXMAz4640VTcCQsXow==}
     engines: {node: '>=12'}
 
-  '@tanstack/router-devtools-core@1.132.31':
-    resolution: {integrity: sha512-GwymJRm21hkluQMjOkXn+mBNPMyWlpzQut8mqEObh1cnF3zUsYT5YkCFV8ePA0jb/YVdjK/AfCAgSlhyIa09IA==}
+  '@tanstack/router-devtools-core@1.132.33':
+    resolution: {integrity: sha512-PFiINWuGltDrSzbOsGniZjEppvDPVGGDjeH4gX2Q0CMqwurapegEna0D0PO++OwVD0aVr6VvFRkmumBwr5vkTA==}
     engines: {node: '>=12'}
     peerDependencies:
-      '@tanstack/router-core': ^1.132.31
+      '@tanstack/router-core': ^1.132.33
       csstype: ^3.0.10
       solid-js: '>=1.9.5'
       tiny-invariant: ^1.3.3
@@ -5820,16 +5657,16 @@ packages:
       csstype:
         optional: true
 
-  '@tanstack/router-generator@1.132.31':
-    resolution: {integrity: sha512-6Ys47sBR3jxet3CaqnF/ykV44R8HLQoT5ZbDqi6f2At6TXYe/+VELRSApC+cq1yjVJwp6Ot5Hm6mYWewh69bdQ==}
+  '@tanstack/router-generator@1.132.33':
+    resolution: {integrity: sha512-KXLl7vOvXuvEuuIHqqirfalLEjbO+VtuvU9fhG9Xh9lYk84uEt8/Qvhe+UDu2+CP5IIQEmghlGVTRw/3BZo9FQ==}
     engines: {node: '>=12'}
 
-  '@tanstack/router-plugin@1.132.31':
-    resolution: {integrity: sha512-5/n6VxA6tFLFyewjl1+Av0Qsxmr/WpnAR2UlccS7ZaYli3bvNPJSZd3dy9EphEAXeSbqvFT29nQ/ox8EmGTonQ==}
+  '@tanstack/router-plugin@1.132.33':
+    resolution: {integrity: sha512-jt8HjETP8EtIaRG9+d90OtORcWPiwAdAf+Xv0mNzEaPIoJyrt+CHHYz6tPOoMU4JlqZurFQMTyHbjefoWIkhAA==}
     engines: {node: '>=12'}
     peerDependencies:
       '@rsbuild/core': '>=1.0.2'
-      '@tanstack/react-router': ^1.132.31
+      '@tanstack/react-router': ^1.132.33
       vite: '>=5.0.0 || >=6.0.0 || >=7.0.0'
       vite-plugin-solid: ^2.11.8
       webpack: '>=5.92.0'
@@ -6099,9 +5936,6 @@ packages:
   '@types/node@22.18.8':
     resolution: {integrity: sha512-pAZSHMiagDR7cARo/cch1f3rXy0AEXwsVsVH09FcyeJVAzCnGgmYis7P3JidtTUjyadhTeSo8TgRPswstghDaw==}
 
-  '@types/node@24.5.2':
-    resolution: {integrity: sha512-FYxk1I7wPv3K2XBaoyH2cTnocQEu8AOZ60hPbsyukMPLv5/5qr7V1i8PLHdl6Zf87I+xZXFvPCXYjiTFq+YSDQ==}
-
   '@types/node@24.6.2':
     resolution: {integrity: sha512-d2L25Y4j+W3ZlNAeMKcy7yDsK425ibcAOO2t7aPTz6gNMH0z2GThtwENCDc0d/Pw9wgyRqE5Px1wkV7naz8ang==}
 
@@ -6133,9 +5967,6 @@ packages:
     peerDependencies:
       '@types/react': '*'
 
-  '@types/react@19.1.13':
-    resolution: {integrity: sha512-hHkbU/eoO3EG5/MZkuFSKmYqPbSVk5byPFa3e7y/8TybHiLMACgI8seVYlicwk7H5K/rI2px9xrQp/C+AUDTiQ==}
-
   '@types/react@19.2.0':
     resolution: {integrity: sha512-1LOH8xovvsKsCBq1wnT4ntDUdCJKmnEakhsuoUSy6ExlHCkGP2hqnatagYTgFk6oeL0VU31u7SNjunPN+GchtA==}
 
@@ -6736,8 +6567,8 @@ packages:
   base64-js@1.5.1:
     resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==}
 
-  baseline-browser-mapping@2.8.10:
-    resolution: {integrity: sha512-uLfgBi+7IBNay8ECBO2mVMGZAc1VgZWEChxm4lv+TobGdG82LnXMjuNGo/BSSZZL4UmkWhxEHP2f5ziLNwGWMA==}
+  baseline-browser-mapping@2.8.11:
+    resolution: {integrity: sha512-i+sRXGhz4+QW8aACZ3+r1GAKMt0wlFpeA8M5rOQd0HEYw9zhDrlx9Wc8uQ0IdXakjJRthzglEwfB/yqIjO6iDg==}
     hasBin: true
 
   bcp-47-match@2.0.3:
@@ -6849,8 +6680,8 @@ packages:
     resolution: {integrity: sha512-QOSvevhslijgYwRx6Rv7zKdMF8lbRmx+uQGx2+vDc+KI/eBnsy9kit5aj23AgGu3pa4t9AgwbnXWqS+iOY+2aA==}
     engines: {node: '>= 6'}
 
-  caniuse-lite@1.0.30001746:
-    resolution: {integrity: sha512-eA7Ys/DGw+pnkWWSE/id29f2IcPHVoE8wxtvE5JdvD2V28VTDPy1yEeo11Guz0sJ4ZeGRcm3uaTcAqK1LXaphA==}
+  caniuse-lite@1.0.30001747:
+    resolution: {integrity: sha512-mzFa2DGIhuc5490Nd/G31xN1pnBnYMadtkyTjefPI7wzypqgCEpeWu9bJr0OnDsyKrW75zA9ZAt7pbQFmwLsQg==}
 
   canvas-confetti@1.9.3:
     resolution: {integrity: sha512-rFfTURMvmVEX1gyXFgn5QMn81bYk70qa0HLzcIOSVEyl57n6o9ItHeBtUSWdvKAPY0xlvBHno4/v3QPrT83q9g==}
@@ -7394,10 +7225,6 @@ packages:
     resolution: {integrity: sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==}
     engines: {node: '>=12'}
 
-  dotenv@17.2.2:
-    resolution: {integrity: sha512-Sf2LSQP+bOlhKWWyhFsn0UsfdK/kCWRv1iuA2gXAwt3dyNabr6QSj00I2V10pidqz69soatm9ZwZvpQMTIOd5Q==}
-    engines: {node: '>=12'}
-
   dotenv@17.2.3:
     resolution: {integrity: sha512-JVUnt+DUIzu87TABbhPmNfVdBDt18BLOWjMUFJMSi/Qqg7NTYtabbvSNJGOJ7afbRuv9D/lngizHtP7QyLQ+9w==}
     engines: {node: '>=12'}
@@ -7406,12 +7233,12 @@ packages:
     resolution: {integrity: sha512-kT8sgyC2hZrtOh5okhEBiwgx8jx+EjLUFoANFVVkBbxIjcb8XjaUorZ0rwCEUEd7THclI3ZARR64pmxloMW3Aw==}
     hasBin: true
 
-  drizzle-kit@0.31.4:
-    resolution: {integrity: sha512-tCPWVZWZqWVx2XUsVpJRnH9Mx0ClVOf5YUHerZ5so1OKSlqww4zy1R5ksEdGRcO3tM3zj0PYN6V48TbQCL1RfA==}
+  drizzle-kit@0.31.5:
+    resolution: {integrity: sha512-+CHgPFzuoTQTt7cOYCV6MOw2w8vqEn/ap1yv4bpZOWL03u7rlVRQhUY0WYT3rHsgVTXwYQDZaSUJSQrMBUKuWg==}
     hasBin: true
 
-  drizzle-orm@0.44.5:
-    resolution: {integrity: sha512-jBe37K7d8ZSKptdKfakQFdeljtu3P2Cbo7tJoJSVZADzIKOBo9IAJPOmMsH2bZl90bZgh8FQlD8BjxXA/zuBkQ==}
+  drizzle-orm@0.44.6:
+    resolution: {integrity: sha512-uy6uarrrEOc9K1u5/uhBFJbdF5VJ5xQ/Yzbecw3eAYOunv5FDeYkR2m8iitocdHBOHbvorviKOW5GVw0U1j4LQ==}
     peerDependencies:
       '@aws-sdk/client-rds-data': '>=3'
       '@cloudflare/workers-types': '>=4'
@@ -7531,8 +7358,8 @@ packages:
     engines: {node: '>=0.10.0'}
     hasBin: true
 
-  electron-to-chromium@1.5.228:
-    resolution: {integrity: sha512-nxkiyuqAn4MJ1QbobwqJILiDtu/jk14hEAWaMiJmNPh1Z+jqoFlBFZjdXwLWGeVSeu9hGLg6+2G9yJaW8rBIFA==}
+  electron-to-chromium@1.5.230:
+    resolution: {integrity: sha512-A6A6Fd3+gMdaed9wX83CvHYJb4UuapPD5X5SLq72VZJzxHSY0/LUweGXRWmQlh2ln7KV7iw7jnwXK7dlPoOnHQ==}
 
   embla-carousel-autoplay@8.6.0:
     resolution: {integrity: sha512-OBu5G3nwaSXkZCo1A6LTaFMZ8EpkYbwIaH+bPqdBnDGQ2fh4+NbzjXjs2SktoPNKCtflfVMc75njaDHOYXcrsA==}
@@ -7769,10 +7596,6 @@ packages:
   fast-png@6.4.0:
     resolution: {integrity: sha512-kAqZq1TlgBjZcLr5mcN6NP5Rv4V2f22z00c3g8vRrwkcqjerx7BEhPbOnWCPqaHUl2XWQBJQvOT/FQhdMT7X/Q==}
 
-  fast-redact@3.5.0:
-    resolution: {integrity: sha512-dwsoQlS7h9hMeYUq1W++23NDcBLV4KqONnITDV9DjfS3q1SgDGVrBdvvTLUotWtPSD7asWDV9/CmsZPy8Hf70A==}
-    engines: {node: '>=6'}
-
   fast-safe-stringify@2.1.1:
     resolution: {integrity: sha512-W+KJc2dmILlPplD/H4K9l9LcAHAfPtP6BY84uVLXQ6Evcz9Lcg33Y2z1IVblT6xdY54PXYVHEv+0Wpq8Io6zkA==}
 
@@ -8048,8 +7871,8 @@ packages:
   globrex@0.1.2:
     resolution: {integrity: sha512-uHJgbwAMwNFf5mLst7IWLNg14x1CkeqglJb/K3doi4dw6q2IvAAmM/Y81kevy83wP+Sst+nutFTYOGg3d1lsxg==}
 
-  goober@2.1.16:
-    resolution: {integrity: sha512-erjk19y1U33+XAMe1VTvIONHYoSqE4iS7BYUZfHaqeohLmnC0FdxEh7rQU+6MZ4OajItzjZFSRtVANrQwNq6/g==}
+  goober@2.1.18:
+    resolution: {integrity: sha512-2vFqsaDVIT9Gz7N6kAL++pLpp41l3PfDuusHcjnGLfR6+huZkl6ziX+zgVC3ZxpqWhzH6pyDdGrCeDhMIvwaxw==}
     peerDependencies:
       csstype: ^3.0.10
 
@@ -8263,14 +8086,6 @@ packages:
   i18next-http-backend@3.0.2:
     resolution: {integrity: sha512-PdlvPnvIp4E1sYi46Ik4tBYh/v/NbYfFFgTjkwFl0is8A18s7/bx9aXqsrOax9WUbeNS6mD2oix7Z0yGGf6m5g==}
 
-  i18next@25.5.2:
-    resolution: {integrity: sha512-lW8Zeh37i/o0zVr+NoCHfNnfvVw+M6FQbRp36ZZ/NyHDJ3NJVpp2HhAUyU9WafL5AssymNoOjMRB48mmx2P6Hw==}
-    peerDependencies:
-      typescript: ^5
-    peerDependenciesMeta:
-      typescript:
-        optional: true
-
   i18next@25.5.3:
     resolution: {integrity: sha512-joFqorDeQ6YpIXni944upwnuHBf5IoPMuqAchGVeQLdWC2JOjxgM9V8UGLhNIIH/Q8QleRxIi0BSRQehSrDLcg==}
     peerDependencies:
@@ -9019,8 +8834,8 @@ packages:
   mdurl@2.0.0:
     resolution: {integrity: sha512-Lf+9+2r+Tdp5wXDXC4PcIBjTDtq4UKjCPMQhKIuzpJNW0b96kVqSwW0bT7FhRSfmAiFYgP+SCRvdrDozfh0U5w==}
 
-  media-chrome@4.13.1:
-    resolution: {integrity: sha512-jPPwYrFkM4ky27/xNYEeyRPOBC7qvru4Oydy7vQHMHplXLQJmjtcauhlLPvG0O5kkYFEaOBXv5zGYes/UxOoVw==}
+  media-chrome@4.14.0:
+    resolution: {integrity: sha512-IEdFb4blyF15vLvQzLIn6USJBv7Kf2ne+TfLQKBYI5Z0f9VEBVZz5MKy4Uhi0iA9lStl2S9ENIujJRuJIa5OiA==}
 
   merge-refs@1.3.0:
     resolution: {integrity: sha512-nqXPXbso+1dcKDpPCXvwZyJILz+vSLqGGOnDrYHQYE+B8n9JTCekVLC65AfCpR4ggVyA/45Y0iR9LDyS2iI+zA==}
@@ -9271,11 +9086,6 @@ packages:
   napi-build-utils@2.0.0:
     resolution: {integrity: sha512-GEbrYkbfF7MoNaoh2iGG84Mnf/WZfB0GdGEsM8wz7Expx/LlWf5U8t9nvJKXSp3qr5IsEbK04cBGhol/KwOsWA==}
 
-  napi-postinstall@0.3.3:
-    resolution: {integrity: sha512-uTp172LLXSxuSYHv/kou+f6KW3SMppU9ivthaVTXian9sOt3XM/zHYHpRZiLgQoxeWfYUnslNWQHF1+G71xcow==}
-    engines: {node: ^12.20.0 || ^14.18.0 || >=16.0.0}
-    hasBin: true
-
   natural-compare@1.4.0:
     resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==}
 
@@ -9405,8 +9215,8 @@ packages:
     resolution: {integrity: sha512-qFOyK5PjiWZd+QQIh+1jhdb9LpxTF0qs7Pm8o5QHYZ0M3vKqSqzsZaEB6oWlxZ+q2sJBMI/Ktgd2N5ZwQoRHfg==}
     engines: {node: '>= 0.4'}
 
-  oxc-resolver@11.8.4:
-    resolution: {integrity: sha512-qpimS3tHHEf+kgESMAme+q+rj7aCzMya00u9YdKOKyX2o7q4lozjPo6d7ZTTi979KHEcVOPWdNTueAKdeNq72w==}
+  oxc-resolver@11.9.0:
+    resolution: {integrity: sha512-u714L0DBBXpD0ERErCQlun2XwinuBfIGo2T8bA7xE8WLQ4uaJudO/VOEQCWslOmcDY2nEkS+UVir5PpyvSG23w==}
 
   p-defer@3.0.0:
     resolution: {integrity: sha512-ugZxsxmtTln604yeYd29EGrNhazN2lywetzpKhfmQjW/VJmhpDmWbiX+h0zL8V91R0UXkhb3KtPmyq9PZw3aYw==}
@@ -9598,8 +9408,8 @@ packages:
   pino-std-serializers@7.0.0:
     resolution: {integrity: sha512-e906FRY0+tV27iq4juKzSYPbUj2do2X2JX4EzSca1631EB2QJQUqGbDuERal7LCtOpxl6x3+nvo9NPZcmjkiFA==}
 
-  pino@9.11.0:
-    resolution: {integrity: sha512-+YIodBB9sxcWeR8PrXC2K3gEDyfkUuVEITOcbqrfcj+z5QW4ioIcqZfYFbrLTYLsmAwunbS7nfU/dpBB6PZc1g==}
+  pino@9.13.1:
+    resolution: {integrity: sha512-Szuj+ViDTjKPQYiKumGmEn3frdl+ZPSdosHyt9SnUevFosOkMY2b7ipxlEctNKPmMD/VibeBI+ZcZCJK+4DPuw==}
     hasBin: true
 
   pirates@4.0.7:
@@ -9609,8 +9419,8 @@ packages:
   pkg-types@1.3.1:
     resolution: {integrity: sha512-/Jm5M4RvtBFVkKWRu2BLUTNP8/M2a+UwuAX+ae4770q1qVGtfjG+WTCupoZixokjmHiry8uI+dlY8KXYV5HVVQ==}
 
-  player.style@0.2.0:
-    resolution: {integrity: sha512-Ngoaz49TClptMr8HDA2IFmjT3Iq6R27QEUH/C+On33L59RSF3dCLefBYB1Au2RDZQJ6oVFpc1sXaPVpp7fEzzA==}
+  player.style@0.3.0:
+    resolution: {integrity: sha512-ny1TbqA2ZsUd6jzN+F034+UMXVK7n5SrwepsrZ2gIqVz00Hn0ohCUbbUdst/2IOFCy0oiTbaOXkSFxRw1RmSlg==}
 
   playwright-core@1.55.1:
     resolution: {integrity: sha512-Z6Mh9mkwX+zxSlHqdr5AOcJnfp+xUWLCt9uKV18fhzA8eyxUd8NUWzAjxUh55RZKSYwDGX0cfaySdhZJGMoJ+w==}
@@ -9944,11 +9754,6 @@ packages:
     resolution: {integrity: sha512-kQKsqPLplY3Hx4jGnM3jpQcG3FQDt7ySz32uTHt3C9HAe45kNXG+3o16Eqn3Fw1GtMfHoN3b4J/z2e6cZJCmqQ==}
     engines: {node: ^20.9.0 || >=22}
 
-  react-dom@19.1.1:
-    resolution: {integrity: sha512-Dlq/5LAZgF0Gaz6yiqZCf6VCcZs1ghAJyrsu84Q/GT0gV+mCxbfmKNoGRKBYMJ8IEdGPqu49YWXD02GCknEDkw==}
-    peerDependencies:
-      react: ^19.1.1
-
   react-dom@19.2.0:
     resolution: {integrity: sha512-UlbRu4cAiGaIewkPyiRGJk0imDN2T3JjieT6spoL2UeSf5od4n5LB/mQ4ejmxhCFT1tYe8IvaFulzynWovsEFQ==}
     peerDependencies:
@@ -9965,22 +9770,6 @@ packages:
     peerDependencies:
       react: ^16.8.0 || ^17 || ^18 || ^19
 
-  react-i18next@15.7.3:
-    resolution: {integrity: sha512-AANws4tOE+QSq/IeMF/ncoHlMNZaVLxpa5uUGW1wjike68elVYr0018L9xYoqBr1OFO7G7boDPrbn0HpMCJxTw==}
-    peerDependencies:
-      i18next: '>= 25.4.1'
-      react: '>= 16.8.0'
-      react-dom: '*'
-      react-native: '*'
-      typescript: ^5
-    peerDependenciesMeta:
-      react-dom:
-        optional: true
-      react-native:
-        optional: true
-      typescript:
-        optional: true
-
   react-i18next@15.7.4:
     resolution: {integrity: sha512-nyU8iKNrI5uDJch0z9+Y5XEr34b0wkyYj3Rp+tfbahxtlswxSCjcUL9H0nqXo9IR3/t5Y5PKIA3fx3MfUyR9Xw==}
     peerDependencies:
@@ -10138,10 +9927,6 @@ packages:
     peerDependencies:
       react: ^17.0.2 || ^18.0.0 || ^19.0.0
 
-  react@19.1.1:
-    resolution: {integrity: sha512-w8nqGImo45dmMIfljjMwOGtbmC/mk4CMYhWIicdSflH91J9TyCyczcPFXJzrZ/ZXcgGRFeP6BU0BEJTw6tZdfQ==}
-    engines: {node: '>=0.10.0'}
-
   react@19.2.0:
     resolution: {integrity: sha512-tmbWg6W31tQLeB5cdIBOicJDJRR2KzXsV7uSK9iNfLWQ5bIZfxuPEHp7M8wiHyHnn0DD1i7w3Zmin0FtkrwoCQ==}
     engines: {node: '>=0.10.0'}
@@ -10401,13 +10186,8 @@ packages:
     engines: {node: '>=10.0.0'}
     hasBin: true
 
-  rollup@4.52.2:
-    resolution: {integrity: sha512-I25/2QgoROE1vYV+NQ1En9T9UFB9Cmfm2CJ83zZOlaDpvz29wGQSZXWKw7MiNXau7wYgB/T9fVIdIuEQ+KbiiA==}
-    engines: {node: '>=18.0.0', npm: '>=8.0.0'}
-    hasBin: true
-
-  rollup@4.52.3:
-    resolution: {integrity: sha512-RIDh866U8agLgiIcdpB+COKnlCreHJLfIhWC3LVflku5YHfpnsIKigRZeFfMfCc4dVcqNVfQQ5gO/afOck064A==}
+  rollup@4.52.4:
+    resolution: {integrity: sha512-CLEVl+MnPAiKh5pl4dEWSyMTpuflgNQiLGhMv8ezD5W/qP8AKvmYpCOKRRNOh7oRKnauBZ4SyeYkMS+1VSyKwQ==}
     engines: {node: '>=18.0.0', npm: '>=8.0.0'}
     hasBin: true
 
@@ -10462,9 +10242,6 @@ packages:
     resolution: {integrity: sha512-xAg7SOnEhrm5zI3puOOKyy1OMcMlIJZYNJY7xLBwSze0UjhPLnWfj2GF2EpT0jmzaJKIWKHLsaSSajf35bcYnA==}
     engines: {node: '>=v12.22.7'}
 
-  scheduler@0.26.0:
-    resolution: {integrity: sha512-NlHwttCI/l5gCPR3D1nNXtWABUmBwvZpEQiD4IXSbIDq8BzLIK/7Ir5gTFSGZDUu37K5cMNp0hFtzO38sC7gWA==}
-
   scheduler@0.27.0:
     resolution: {integrity: sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q==}
 
@@ -10579,6 +10356,9 @@ packages:
     resolution: {integrity: sha512-ZA6oR3T/pEyuqwMgAKT0/hAv8oAXckzbkmR0UkUosQ+Mc4RxGoJkRmwHgHufaenlyAgE1Mxgpdcrf75y6XcnDg==}
     engines: {node: '>=14.16'}
 
+  slow-redact@0.3.0:
+    resolution: {integrity: sha512-cf723wn9JeRIYP9tdtd86GuqoR5937u64Io+CYjlm2i7jvu7g0H+Cp0l0ShAf/4ZL+ISUTVT+8Qzz7RZmp9FjA==}
+
   slugify@1.6.6:
     resolution: {integrity: sha512-h+z7HKHYXj6wJU+AnS/+IH8Uh9fdcX1Lrhg1/VMdf9PwoBQXFcXiAdsy2tSK0P6gKwJLXp02r90ahUCqHk9rrw==}
     engines: {node: '>=8.0.0'}
@@ -10747,8 +10527,8 @@ packages:
   strnum@2.1.1:
     resolution: {integrity: sha512-7ZvoFTiCnGxBtDqJ//Cu6fWtZtc7Y3x+QOirG15wztbdngGSkht27o2pyGWrVy0b4WAy3jbKmnoK6g5VlVNUUw==}
 
-  style-to-object@1.0.9:
-    resolution: {integrity: sha512-G4qppLgKu/k6FwRpHiGiKPaPTFcG3g4wNVX/Qsfu+RqQM30E7Tyu/TEgxcL9PNLF5pdRLwQdE3YKKf+KF2Dzlw==}
+  style-to-object@1.0.11:
+    resolution: {integrity: sha512-5A560JmXr7wDyGLK12Nq/EYS38VkGlglVzkis1JEdbGWSnbQIEhZzTJhzURXN5/8WwwFCs/f/VVcmkTppbXLow==}
 
   sucrase@3.35.0:
     resolution: {integrity: sha512-8EbVDiu9iN/nESwxeSxDKe0dunta1GOlHufmSSXxMD2z2/tMZpDMpvXQGsc+ajGo8y2uYUmixaSRUc/QPoQ0GA==}
@@ -11003,11 +10783,6 @@ packages:
     engines: {node: '>=18.0.0'}
     hasBin: true
 
-  tsx@4.20.5:
-    resolution: {integrity: sha512-+wKjMNU9w/EaQayHXb7WA7ZaHY6hN8WgfvHNQ3t1PnU91/7O8TcTnIhCDYTZwnt8JsO9IBqZ30Ln1r7pPF52Aw==}
-    engines: {node: '>=18.0.0'}
-    hasBin: true
-
   tsx@4.20.6:
     resolution: {integrity: sha512-ytQKuwgmrrkDTFP4LjR0ToE2nqgy886GpvRSpU0JAnrdBYppuY5rLkRUYPU1yCryb24SsKBTL/hlDQAEFVwtZg==}
     engines: {node: '>=18.0.0'}
@@ -11046,6 +10821,10 @@ packages:
     resolution: {integrity: sha512-tLq3bSNx+xSpwvAJnzrK0Ep5CLNWjvFTOp71URMaAEWBfRb9nnJiBoUe0tF8bI4ZFO3omgBR6NvnbzVUT3Ly4g==}
     engines: {node: '>=14.16'}
 
+  type-fest@4.41.0:
+    resolution: {integrity: sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA==}
+    engines: {node: '>=16'}
+
   typed-array-buffer@1.0.3:
     resolution: {integrity: sha512-nAYYwfY3qnzX30IkA6AQZjVbtK6duGontcQm1WSG1MD94YLqK0515GNApXkoxKOWMusVssAHWLh9SeaoefYFGw==}
     engines: {node: '>= 0.4'}
@@ -11067,11 +10846,6 @@ packages:
     engines: {node: '>=14.17'}
     hasBin: true
 
-  typescript@5.9.2:
-    resolution: {integrity: sha512-CWBzXQrc/qOkhidw1OzBTQuYRbfyxDXJMVJ1XNwUHGROVmuaeiEm3OslpZ1RV96d7SKKjZKrSJu3+t/xlw3R9A==}
-    engines: {node: '>=14.17'}
-    hasBin: true
-
   typescript@5.9.3:
     resolution: {integrity: sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==}
     engines: {node: '>=14.17'}
@@ -11102,9 +10876,6 @@ packages:
   undici-types@6.21.0:
     resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==}
 
-  undici-types@7.12.0:
-    resolution: {integrity: sha512-goOacqME2GYyOZZfb5Lgtu+1IDmAlAEu5xnD3+xTzS10hT0vzpf0SPjkXwAw9Jm+4n/mQGDP3LO8CPbYROeBfQ==}
-
   undici-types@7.13.0:
     resolution: {integrity: sha512-Ov2Rr9Sx+fRgagJ5AX0qvItZG/JKKoBRAVITs1zk7IqZGTJUwgUr7qoYBpWwakpWilTZFM98rG/AFRocu10iIQ==}
 
@@ -11285,8 +11056,8 @@ packages:
   victory-vendor@37.3.6:
     resolution: {integrity: sha512-SbPDPdDBYp+5MJHhBCAyI7wKM3d5ivekigc2Dk2s7pgbZ9wIgIBYGVw4zGHBml/qTFbexrofXW6Gu4noGxrOwQ==}
 
-  virtua@0.43.6:
-    resolution: {integrity: sha512-FcIkIUibw5SSCywhTbg0R0nKmFhILWCVrAIWesckitsXX5IOrWYqtDpT/GLmIuZIrTB9A/+3DnmL5uvDgKWmFQ==}
+  virtua@0.44.0:
+    resolution: {integrity: sha512-bEx+lKwChA7OZ377vhSWNw6GfFoRGRJLOzFsyFLS5JmY6GWNw5P0lL/TtVlLvSecXks/t9N8K/1+Y9TbMmd2Vw==}
     peerDependencies:
       react: '>=16.14.0'
       react-dom: '>=16.14.0'
@@ -11372,8 +11143,8 @@ packages:
       terser:
         optional: true
 
-  vite@7.1.8:
-    resolution: {integrity: sha512-oBXvfSHEOL8jF+R9Am7h59Up07kVVGH1NrFGFoEG6bPDZP3tGpQhvkBpy5x7U6+E6wZCu9OihsWgJqDbQIm8LQ==}
+  vite@7.1.9:
+    resolution: {integrity: sha512-4nVGliEpxmhCL8DslSAUdxlB6+SMrhB0a1v5ijlh1xB1nEPuy1mxaHxysVucLHuWryAxLWg6a5ei+U4TLn/rFg==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
@@ -11715,9 +11486,6 @@ packages:
     resolution: {integrity: sha512-GQHQqAopRhwU8Kt1DDM8NjibDXHC8eoh1erhGAJPEyveY9qqVeXvVikNKrDz69sHowPMorbPUrH/mx8c50eiBQ==}
     engines: {node: '>=18'}
 
-  zod@3.24.1:
-    resolution: {integrity: sha512-muH7gBL9sI1nciMZV67X5fTKKBLtwpZ5VBp1vsOQzj1MhrBZ4wlVCm3gedKZWLp0Oyel8sIGfeiz54Su+OVT+A==}
-
   zod@3.25.76:
     resolution: {integrity: sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ==}
 
@@ -11809,20 +11577,20 @@ snapshots:
   '@aws-crypto/crc32@5.2.0':
     dependencies:
       '@aws-crypto/util': 5.2.0
-      '@aws-sdk/types': 3.893.0
+      '@aws-sdk/types': 3.901.0
       tslib: 2.8.1
 
   '@aws-crypto/crc32c@5.2.0':
     dependencies:
       '@aws-crypto/util': 5.2.0
-      '@aws-sdk/types': 3.893.0
+      '@aws-sdk/types': 3.901.0
       tslib: 2.8.1
 
   '@aws-crypto/sha1-browser@5.2.0':
     dependencies:
       '@aws-crypto/supports-web-crypto': 5.2.0
       '@aws-crypto/util': 5.2.0
-      '@aws-sdk/types': 3.893.0
+      '@aws-sdk/types': 3.901.0
       '@aws-sdk/util-locate-window': 3.893.0
       '@smithy/util-utf8': 2.3.0
       tslib: 2.8.1
@@ -11832,7 +11600,7 @@ snapshots:
       '@aws-crypto/sha256-js': 5.2.0
       '@aws-crypto/supports-web-crypto': 5.2.0
       '@aws-crypto/util': 5.2.0
-      '@aws-sdk/types': 3.893.0
+      '@aws-sdk/types': 3.901.0
       '@aws-sdk/util-locate-window': 3.893.0
       '@smithy/util-utf8': 2.3.0
       tslib: 2.8.1
@@ -11840,7 +11608,7 @@ snapshots:
   '@aws-crypto/sha256-js@5.2.0':
     dependencies:
       '@aws-crypto/util': 5.2.0
-      '@aws-sdk/types': 3.893.0
+      '@aws-sdk/types': 3.901.0
       tslib: 2.8.1
 
   '@aws-crypto/supports-web-crypto@5.2.0':
@@ -11849,460 +11617,460 @@ snapshots:
 
   '@aws-crypto/util@5.2.0':
     dependencies:
-      '@aws-sdk/types': 3.893.0
+      '@aws-sdk/types': 3.901.0
       '@smithy/util-utf8': 2.3.0
       tslib: 2.8.1
 
-  '@aws-sdk/client-s3@3.896.0':
+  '@aws-sdk/client-s3@3.901.0':
     dependencies:
       '@aws-crypto/sha1-browser': 5.2.0
       '@aws-crypto/sha256-browser': 5.2.0
       '@aws-crypto/sha256-js': 5.2.0
-      '@aws-sdk/core': 3.896.0
-      '@aws-sdk/credential-provider-node': 3.896.0
-      '@aws-sdk/middleware-bucket-endpoint': 3.893.0
-      '@aws-sdk/middleware-expect-continue': 3.893.0
-      '@aws-sdk/middleware-flexible-checksums': 3.896.0
-      '@aws-sdk/middleware-host-header': 3.893.0
-      '@aws-sdk/middleware-location-constraint': 3.893.0
-      '@aws-sdk/middleware-logger': 3.893.0
-      '@aws-sdk/middleware-recursion-detection': 3.893.0
-      '@aws-sdk/middleware-sdk-s3': 3.896.0
-      '@aws-sdk/middleware-ssec': 3.893.0
-      '@aws-sdk/middleware-user-agent': 3.896.0
-      '@aws-sdk/region-config-resolver': 3.893.0
-      '@aws-sdk/signature-v4-multi-region': 3.896.0
-      '@aws-sdk/types': 3.893.0
-      '@aws-sdk/util-endpoints': 3.895.0
-      '@aws-sdk/util-user-agent-browser': 3.893.0
-      '@aws-sdk/util-user-agent-node': 3.896.0
-      '@aws-sdk/xml-builder': 3.894.0
-      '@smithy/config-resolver': 4.2.2
-      '@smithy/core': 3.12.0
-      '@smithy/eventstream-serde-browser': 4.1.1
-      '@smithy/eventstream-serde-config-resolver': 4.2.1
-      '@smithy/eventstream-serde-node': 4.1.1
-      '@smithy/fetch-http-handler': 5.2.1
-      '@smithy/hash-blob-browser': 4.1.1
-      '@smithy/hash-node': 4.1.1
-      '@smithy/hash-stream-node': 4.1.1
-      '@smithy/invalid-dependency': 4.1.1
-      '@smithy/md5-js': 4.1.1
-      '@smithy/middleware-content-length': 4.1.1
-      '@smithy/middleware-endpoint': 4.2.4
-      '@smithy/middleware-retry': 4.3.0
-      '@smithy/middleware-serde': 4.1.1
-      '@smithy/middleware-stack': 4.1.1
-      '@smithy/node-config-provider': 4.2.2
-      '@smithy/node-http-handler': 4.2.1
-      '@smithy/protocol-http': 5.2.1
-      '@smithy/smithy-client': 4.6.4
-      '@smithy/types': 4.5.0
-      '@smithy/url-parser': 4.1.1
-      '@smithy/util-base64': 4.1.0
-      '@smithy/util-body-length-browser': 4.1.0
-      '@smithy/util-body-length-node': 4.1.0
-      '@smithy/util-defaults-mode-browser': 4.1.4
-      '@smithy/util-defaults-mode-node': 4.1.4
-      '@smithy/util-endpoints': 3.1.2
-      '@smithy/util-middleware': 4.1.1
-      '@smithy/util-retry': 4.1.2
-      '@smithy/util-stream': 4.3.2
-      '@smithy/util-utf8': 4.1.0
-      '@smithy/util-waiter': 4.1.1
-      '@smithy/uuid': 1.0.0
+      '@aws-sdk/core': 3.901.0
+      '@aws-sdk/credential-provider-node': 3.901.0
+      '@aws-sdk/middleware-bucket-endpoint': 3.901.0
+      '@aws-sdk/middleware-expect-continue': 3.901.0
+      '@aws-sdk/middleware-flexible-checksums': 3.901.0
+      '@aws-sdk/middleware-host-header': 3.901.0
+      '@aws-sdk/middleware-location-constraint': 3.901.0
+      '@aws-sdk/middleware-logger': 3.901.0
+      '@aws-sdk/middleware-recursion-detection': 3.901.0
+      '@aws-sdk/middleware-sdk-s3': 3.901.0
+      '@aws-sdk/middleware-ssec': 3.901.0
+      '@aws-sdk/middleware-user-agent': 3.901.0
+      '@aws-sdk/region-config-resolver': 3.901.0
+      '@aws-sdk/signature-v4-multi-region': 3.901.0
+      '@aws-sdk/types': 3.901.0
+      '@aws-sdk/util-endpoints': 3.901.0
+      '@aws-sdk/util-user-agent-browser': 3.901.0
+      '@aws-sdk/util-user-agent-node': 3.901.0
+      '@aws-sdk/xml-builder': 3.901.0
+      '@smithy/config-resolver': 4.3.0
+      '@smithy/core': 3.14.0
+      '@smithy/eventstream-serde-browser': 4.2.0
+      '@smithy/eventstream-serde-config-resolver': 4.3.0
+      '@smithy/eventstream-serde-node': 4.2.0
+      '@smithy/fetch-http-handler': 5.3.0
+      '@smithy/hash-blob-browser': 4.2.0
+      '@smithy/hash-node': 4.2.0
+      '@smithy/hash-stream-node': 4.2.0
+      '@smithy/invalid-dependency': 4.2.0
+      '@smithy/md5-js': 4.2.0
+      '@smithy/middleware-content-length': 4.2.0
+      '@smithy/middleware-endpoint': 4.3.0
+      '@smithy/middleware-retry': 4.4.0
+      '@smithy/middleware-serde': 4.2.0
+      '@smithy/middleware-stack': 4.2.0
+      '@smithy/node-config-provider': 4.3.0
+      '@smithy/node-http-handler': 4.3.0
+      '@smithy/protocol-http': 5.3.0
+      '@smithy/smithy-client': 4.7.0
+      '@smithy/types': 4.6.0
+      '@smithy/url-parser': 4.2.0
+      '@smithy/util-base64': 4.2.0
+      '@smithy/util-body-length-browser': 4.2.0
+      '@smithy/util-body-length-node': 4.2.0
+      '@smithy/util-defaults-mode-browser': 4.2.0
+      '@smithy/util-defaults-mode-node': 4.2.0
+      '@smithy/util-endpoints': 3.2.0
+      '@smithy/util-middleware': 4.2.0
+      '@smithy/util-retry': 4.2.0
+      '@smithy/util-stream': 4.4.0
+      '@smithy/util-utf8': 4.2.0
+      '@smithy/util-waiter': 4.2.0
+      '@smithy/uuid': 1.1.0
       tslib: 2.8.1
     transitivePeerDependencies:
       - aws-crt
 
-  '@aws-sdk/client-sso@3.896.0':
+  '@aws-sdk/client-sso@3.901.0':
     dependencies:
       '@aws-crypto/sha256-browser': 5.2.0
       '@aws-crypto/sha256-js': 5.2.0
-      '@aws-sdk/core': 3.896.0
-      '@aws-sdk/middleware-host-header': 3.893.0
-      '@aws-sdk/middleware-logger': 3.893.0
-      '@aws-sdk/middleware-recursion-detection': 3.893.0
-      '@aws-sdk/middleware-user-agent': 3.896.0
-      '@aws-sdk/region-config-resolver': 3.893.0
-      '@aws-sdk/types': 3.893.0
-      '@aws-sdk/util-endpoints': 3.895.0
-      '@aws-sdk/util-user-agent-browser': 3.893.0
-      '@aws-sdk/util-user-agent-node': 3.896.0
-      '@smithy/config-resolver': 4.2.2
-      '@smithy/core': 3.12.0
-      '@smithy/fetch-http-handler': 5.2.1
-      '@smithy/hash-node': 4.1.1
-      '@smithy/invalid-dependency': 4.1.1
-      '@smithy/middleware-content-length': 4.1.1
-      '@smithy/middleware-endpoint': 4.2.4
-      '@smithy/middleware-retry': 4.3.0
-      '@smithy/middleware-serde': 4.1.1
-      '@smithy/middleware-stack': 4.1.1
-      '@smithy/node-config-provider': 4.2.2
-      '@smithy/node-http-handler': 4.2.1
-      '@smithy/protocol-http': 5.2.1
-      '@smithy/smithy-client': 4.6.4
-      '@smithy/types': 4.5.0
-      '@smithy/url-parser': 4.1.1
-      '@smithy/util-base64': 4.1.0
-      '@smithy/util-body-length-browser': 4.1.0
-      '@smithy/util-body-length-node': 4.1.0
-      '@smithy/util-defaults-mode-browser': 4.1.4
-      '@smithy/util-defaults-mode-node': 4.1.4
-      '@smithy/util-endpoints': 3.1.2
-      '@smithy/util-middleware': 4.1.1
-      '@smithy/util-retry': 4.1.2
-      '@smithy/util-utf8': 4.1.0
+      '@aws-sdk/core': 3.901.0
+      '@aws-sdk/middleware-host-header': 3.901.0
+      '@aws-sdk/middleware-logger': 3.901.0
+      '@aws-sdk/middleware-recursion-detection': 3.901.0
+      '@aws-sdk/middleware-user-agent': 3.901.0
+      '@aws-sdk/region-config-resolver': 3.901.0
+      '@aws-sdk/types': 3.901.0
+      '@aws-sdk/util-endpoints': 3.901.0
+      '@aws-sdk/util-user-agent-browser': 3.901.0
+      '@aws-sdk/util-user-agent-node': 3.901.0
+      '@smithy/config-resolver': 4.3.0
+      '@smithy/core': 3.14.0
+      '@smithy/fetch-http-handler': 5.3.0
+      '@smithy/hash-node': 4.2.0
+      '@smithy/invalid-dependency': 4.2.0
+      '@smithy/middleware-content-length': 4.2.0
+      '@smithy/middleware-endpoint': 4.3.0
+      '@smithy/middleware-retry': 4.4.0
+      '@smithy/middleware-serde': 4.2.0
+      '@smithy/middleware-stack': 4.2.0
+      '@smithy/node-config-provider': 4.3.0
+      '@smithy/node-http-handler': 4.3.0
+      '@smithy/protocol-http': 5.3.0
+      '@smithy/smithy-client': 4.7.0
+      '@smithy/types': 4.6.0
+      '@smithy/url-parser': 4.2.0
+      '@smithy/util-base64': 4.2.0
+      '@smithy/util-body-length-browser': 4.2.0
+      '@smithy/util-body-length-node': 4.2.0
+      '@smithy/util-defaults-mode-browser': 4.2.0
+      '@smithy/util-defaults-mode-node': 4.2.0
+      '@smithy/util-endpoints': 3.2.0
+      '@smithy/util-middleware': 4.2.0
+      '@smithy/util-retry': 4.2.0
+      '@smithy/util-utf8': 4.2.0
       tslib: 2.8.1
     transitivePeerDependencies:
       - aws-crt
 
-  '@aws-sdk/cloudfront-signer@3.893.0':
+  '@aws-sdk/cloudfront-signer@3.901.0':
     dependencies:
-      '@smithy/url-parser': 4.1.1
+      '@smithy/url-parser': 4.2.0
       tslib: 2.8.1
 
-  '@aws-sdk/core@3.896.0':
-    dependencies:
-      '@aws-sdk/types': 3.893.0
-      '@aws-sdk/xml-builder': 3.894.0
-      '@smithy/core': 3.12.0
-      '@smithy/node-config-provider': 4.2.2
-      '@smithy/property-provider': 4.1.1
-      '@smithy/protocol-http': 5.2.1
-      '@smithy/signature-v4': 5.2.1
-      '@smithy/smithy-client': 4.6.4
-      '@smithy/types': 4.5.0
-      '@smithy/util-base64': 4.1.0
-      '@smithy/util-middleware': 4.1.1
-      '@smithy/util-utf8': 4.1.0
+  '@aws-sdk/core@3.901.0':
+    dependencies:
+      '@aws-sdk/types': 3.901.0
+      '@aws-sdk/xml-builder': 3.901.0
+      '@smithy/core': 3.14.0
+      '@smithy/node-config-provider': 4.3.0
+      '@smithy/property-provider': 4.2.0
+      '@smithy/protocol-http': 5.3.0
+      '@smithy/signature-v4': 5.3.0
+      '@smithy/smithy-client': 4.7.0
+      '@smithy/types': 4.6.0
+      '@smithy/util-base64': 4.2.0
+      '@smithy/util-middleware': 4.2.0
+      '@smithy/util-utf8': 4.2.0
       tslib: 2.8.1
 
-  '@aws-sdk/credential-provider-env@3.896.0':
+  '@aws-sdk/credential-provider-env@3.901.0':
     dependencies:
-      '@aws-sdk/core': 3.896.0
-      '@aws-sdk/types': 3.893.0
-      '@smithy/property-provider': 4.1.1
-      '@smithy/types': 4.5.0
+      '@aws-sdk/core': 3.901.0
+      '@aws-sdk/types': 3.901.0
+      '@smithy/property-provider': 4.2.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@aws-sdk/credential-provider-http@3.896.0':
-    dependencies:
-      '@aws-sdk/core': 3.896.0
-      '@aws-sdk/types': 3.893.0
-      '@smithy/fetch-http-handler': 5.2.1
-      '@smithy/node-http-handler': 4.2.1
-      '@smithy/property-provider': 4.1.1
-      '@smithy/protocol-http': 5.2.1
-      '@smithy/smithy-client': 4.6.4
-      '@smithy/types': 4.5.0
-      '@smithy/util-stream': 4.3.2
+  '@aws-sdk/credential-provider-http@3.901.0':
+    dependencies:
+      '@aws-sdk/core': 3.901.0
+      '@aws-sdk/types': 3.901.0
+      '@smithy/fetch-http-handler': 5.3.0
+      '@smithy/node-http-handler': 4.3.0
+      '@smithy/property-provider': 4.2.0
+      '@smithy/protocol-http': 5.3.0
+      '@smithy/smithy-client': 4.7.0
+      '@smithy/types': 4.6.0
+      '@smithy/util-stream': 4.4.0
       tslib: 2.8.1
 
-  '@aws-sdk/credential-provider-ini@3.896.0':
-    dependencies:
-      '@aws-sdk/core': 3.896.0
-      '@aws-sdk/credential-provider-env': 3.896.0
-      '@aws-sdk/credential-provider-http': 3.896.0
-      '@aws-sdk/credential-provider-process': 3.896.0
-      '@aws-sdk/credential-provider-sso': 3.896.0
-      '@aws-sdk/credential-provider-web-identity': 3.896.0
-      '@aws-sdk/nested-clients': 3.896.0
-      '@aws-sdk/types': 3.893.0
-      '@smithy/credential-provider-imds': 4.1.2
-      '@smithy/property-provider': 4.1.1
-      '@smithy/shared-ini-file-loader': 4.2.0
-      '@smithy/types': 4.5.0
+  '@aws-sdk/credential-provider-ini@3.901.0':
+    dependencies:
+      '@aws-sdk/core': 3.901.0
+      '@aws-sdk/credential-provider-env': 3.901.0
+      '@aws-sdk/credential-provider-http': 3.901.0
+      '@aws-sdk/credential-provider-process': 3.901.0
+      '@aws-sdk/credential-provider-sso': 3.901.0
+      '@aws-sdk/credential-provider-web-identity': 3.901.0
+      '@aws-sdk/nested-clients': 3.901.0
+      '@aws-sdk/types': 3.901.0
+      '@smithy/credential-provider-imds': 4.2.0
+      '@smithy/property-provider': 4.2.0
+      '@smithy/shared-ini-file-loader': 4.3.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
     transitivePeerDependencies:
       - aws-crt
 
-  '@aws-sdk/credential-provider-node@3.896.0':
-    dependencies:
-      '@aws-sdk/credential-provider-env': 3.896.0
-      '@aws-sdk/credential-provider-http': 3.896.0
-      '@aws-sdk/credential-provider-ini': 3.896.0
-      '@aws-sdk/credential-provider-process': 3.896.0
-      '@aws-sdk/credential-provider-sso': 3.896.0
-      '@aws-sdk/credential-provider-web-identity': 3.896.0
-      '@aws-sdk/types': 3.893.0
-      '@smithy/credential-provider-imds': 4.1.2
-      '@smithy/property-provider': 4.1.1
-      '@smithy/shared-ini-file-loader': 4.2.0
-      '@smithy/types': 4.5.0
+  '@aws-sdk/credential-provider-node@3.901.0':
+    dependencies:
+      '@aws-sdk/credential-provider-env': 3.901.0
+      '@aws-sdk/credential-provider-http': 3.901.0
+      '@aws-sdk/credential-provider-ini': 3.901.0
+      '@aws-sdk/credential-provider-process': 3.901.0
+      '@aws-sdk/credential-provider-sso': 3.901.0
+      '@aws-sdk/credential-provider-web-identity': 3.901.0
+      '@aws-sdk/types': 3.901.0
+      '@smithy/credential-provider-imds': 4.2.0
+      '@smithy/property-provider': 4.2.0
+      '@smithy/shared-ini-file-loader': 4.3.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
     transitivePeerDependencies:
       - aws-crt
 
-  '@aws-sdk/credential-provider-process@3.896.0':
+  '@aws-sdk/credential-provider-process@3.901.0':
     dependencies:
-      '@aws-sdk/core': 3.896.0
-      '@aws-sdk/types': 3.893.0
-      '@smithy/property-provider': 4.1.1
-      '@smithy/shared-ini-file-loader': 4.2.0
-      '@smithy/types': 4.5.0
+      '@aws-sdk/core': 3.901.0
+      '@aws-sdk/types': 3.901.0
+      '@smithy/property-provider': 4.2.0
+      '@smithy/shared-ini-file-loader': 4.3.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@aws-sdk/credential-provider-sso@3.896.0':
+  '@aws-sdk/credential-provider-sso@3.901.0':
     dependencies:
-      '@aws-sdk/client-sso': 3.896.0
-      '@aws-sdk/core': 3.896.0
-      '@aws-sdk/token-providers': 3.896.0
-      '@aws-sdk/types': 3.893.0
-      '@smithy/property-provider': 4.1.1
-      '@smithy/shared-ini-file-loader': 4.2.0
-      '@smithy/types': 4.5.0
+      '@aws-sdk/client-sso': 3.901.0
+      '@aws-sdk/core': 3.901.0
+      '@aws-sdk/token-providers': 3.901.0
+      '@aws-sdk/types': 3.901.0
+      '@smithy/property-provider': 4.2.0
+      '@smithy/shared-ini-file-loader': 4.3.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
     transitivePeerDependencies:
       - aws-crt
 
-  '@aws-sdk/credential-provider-web-identity@3.896.0':
+  '@aws-sdk/credential-provider-web-identity@3.901.0':
     dependencies:
-      '@aws-sdk/core': 3.896.0
-      '@aws-sdk/nested-clients': 3.896.0
-      '@aws-sdk/types': 3.893.0
-      '@smithy/property-provider': 4.1.1
-      '@smithy/shared-ini-file-loader': 4.2.0
-      '@smithy/types': 4.5.0
+      '@aws-sdk/core': 3.901.0
+      '@aws-sdk/nested-clients': 3.901.0
+      '@aws-sdk/types': 3.901.0
+      '@smithy/property-provider': 4.2.0
+      '@smithy/shared-ini-file-loader': 4.3.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
     transitivePeerDependencies:
       - aws-crt
 
-  '@aws-sdk/lib-storage@3.896.0(@aws-sdk/client-s3@3.896.0)':
+  '@aws-sdk/lib-storage@3.901.0(@aws-sdk/client-s3@3.901.0)':
     dependencies:
-      '@aws-sdk/client-s3': 3.896.0
-      '@smithy/abort-controller': 4.1.1
-      '@smithy/middleware-endpoint': 4.2.4
-      '@smithy/smithy-client': 4.6.4
+      '@aws-sdk/client-s3': 3.901.0
+      '@smithy/abort-controller': 4.2.0
+      '@smithy/middleware-endpoint': 4.3.0
+      '@smithy/smithy-client': 4.7.0
       buffer: 5.6.0
       events: 3.3.0
       stream-browserify: 3.0.0
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-bucket-endpoint@3.893.0':
+  '@aws-sdk/middleware-bucket-endpoint@3.901.0':
     dependencies:
-      '@aws-sdk/types': 3.893.0
+      '@aws-sdk/types': 3.901.0
       '@aws-sdk/util-arn-parser': 3.893.0
-      '@smithy/node-config-provider': 4.2.2
-      '@smithy/protocol-http': 5.2.1
-      '@smithy/types': 4.5.0
-      '@smithy/util-config-provider': 4.1.0
+      '@smithy/node-config-provider': 4.3.0
+      '@smithy/protocol-http': 5.3.0
+      '@smithy/types': 4.6.0
+      '@smithy/util-config-provider': 4.2.0
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-expect-continue@3.893.0':
+  '@aws-sdk/middleware-expect-continue@3.901.0':
     dependencies:
-      '@aws-sdk/types': 3.893.0
-      '@smithy/protocol-http': 5.2.1
-      '@smithy/types': 4.5.0
+      '@aws-sdk/types': 3.901.0
+      '@smithy/protocol-http': 5.3.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-flexible-checksums@3.896.0':
+  '@aws-sdk/middleware-flexible-checksums@3.901.0':
     dependencies:
       '@aws-crypto/crc32': 5.2.0
       '@aws-crypto/crc32c': 5.2.0
       '@aws-crypto/util': 5.2.0
-      '@aws-sdk/core': 3.896.0
-      '@aws-sdk/types': 3.893.0
-      '@smithy/is-array-buffer': 4.1.0
-      '@smithy/node-config-provider': 4.2.2
-      '@smithy/protocol-http': 5.2.1
-      '@smithy/types': 4.5.0
-      '@smithy/util-middleware': 4.1.1
-      '@smithy/util-stream': 4.3.2
-      '@smithy/util-utf8': 4.1.0
+      '@aws-sdk/core': 3.901.0
+      '@aws-sdk/types': 3.901.0
+      '@smithy/is-array-buffer': 4.2.0
+      '@smithy/node-config-provider': 4.3.0
+      '@smithy/protocol-http': 5.3.0
+      '@smithy/types': 4.6.0
+      '@smithy/util-middleware': 4.2.0
+      '@smithy/util-stream': 4.4.0
+      '@smithy/util-utf8': 4.2.0
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-host-header@3.893.0':
+  '@aws-sdk/middleware-host-header@3.901.0':
     dependencies:
-      '@aws-sdk/types': 3.893.0
-      '@smithy/protocol-http': 5.2.1
-      '@smithy/types': 4.5.0
+      '@aws-sdk/types': 3.901.0
+      '@smithy/protocol-http': 5.3.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-location-constraint@3.893.0':
+  '@aws-sdk/middleware-location-constraint@3.901.0':
     dependencies:
-      '@aws-sdk/types': 3.893.0
-      '@smithy/types': 4.5.0
+      '@aws-sdk/types': 3.901.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-logger@3.893.0':
+  '@aws-sdk/middleware-logger@3.901.0':
     dependencies:
-      '@aws-sdk/types': 3.893.0
-      '@smithy/types': 4.5.0
+      '@aws-sdk/types': 3.901.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-recursion-detection@3.893.0':
+  '@aws-sdk/middleware-recursion-detection@3.901.0':
     dependencies:
-      '@aws-sdk/types': 3.893.0
+      '@aws-sdk/types': 3.901.0
       '@aws/lambda-invoke-store': 0.0.1
-      '@smithy/protocol-http': 5.2.1
-      '@smithy/types': 4.5.0
+      '@smithy/protocol-http': 5.3.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-sdk-s3@3.896.0':
+  '@aws-sdk/middleware-sdk-s3@3.901.0':
     dependencies:
-      '@aws-sdk/core': 3.896.0
-      '@aws-sdk/types': 3.893.0
+      '@aws-sdk/core': 3.901.0
+      '@aws-sdk/types': 3.901.0
       '@aws-sdk/util-arn-parser': 3.893.0
-      '@smithy/core': 3.12.0
-      '@smithy/node-config-provider': 4.2.2
-      '@smithy/protocol-http': 5.2.1
-      '@smithy/signature-v4': 5.2.1
-      '@smithy/smithy-client': 4.6.4
-      '@smithy/types': 4.5.0
-      '@smithy/util-config-provider': 4.1.0
-      '@smithy/util-middleware': 4.1.1
-      '@smithy/util-stream': 4.3.2
-      '@smithy/util-utf8': 4.1.0
+      '@smithy/core': 3.14.0
+      '@smithy/node-config-provider': 4.3.0
+      '@smithy/protocol-http': 5.3.0
+      '@smithy/signature-v4': 5.3.0
+      '@smithy/smithy-client': 4.7.0
+      '@smithy/types': 4.6.0
+      '@smithy/util-config-provider': 4.2.0
+      '@smithy/util-middleware': 4.2.0
+      '@smithy/util-stream': 4.4.0
+      '@smithy/util-utf8': 4.2.0
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-ssec@3.893.0':
+  '@aws-sdk/middleware-ssec@3.901.0':
     dependencies:
-      '@aws-sdk/types': 3.893.0
-      '@smithy/types': 4.5.0
+      '@aws-sdk/types': 3.901.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-user-agent@3.896.0':
+  '@aws-sdk/middleware-user-agent@3.901.0':
     dependencies:
-      '@aws-sdk/core': 3.896.0
-      '@aws-sdk/types': 3.893.0
-      '@aws-sdk/util-endpoints': 3.895.0
-      '@smithy/core': 3.12.0
-      '@smithy/protocol-http': 5.2.1
-      '@smithy/types': 4.5.0
+      '@aws-sdk/core': 3.901.0
+      '@aws-sdk/types': 3.901.0
+      '@aws-sdk/util-endpoints': 3.901.0
+      '@smithy/core': 3.14.0
+      '@smithy/protocol-http': 5.3.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@aws-sdk/nested-clients@3.896.0':
+  '@aws-sdk/nested-clients@3.901.0':
     dependencies:
       '@aws-crypto/sha256-browser': 5.2.0
       '@aws-crypto/sha256-js': 5.2.0
-      '@aws-sdk/core': 3.896.0
-      '@aws-sdk/middleware-host-header': 3.893.0
-      '@aws-sdk/middleware-logger': 3.893.0
-      '@aws-sdk/middleware-recursion-detection': 3.893.0
-      '@aws-sdk/middleware-user-agent': 3.896.0
-      '@aws-sdk/region-config-resolver': 3.893.0
-      '@aws-sdk/types': 3.893.0
-      '@aws-sdk/util-endpoints': 3.895.0
-      '@aws-sdk/util-user-agent-browser': 3.893.0
-      '@aws-sdk/util-user-agent-node': 3.896.0
-      '@smithy/config-resolver': 4.2.2
-      '@smithy/core': 3.12.0
-      '@smithy/fetch-http-handler': 5.2.1
-      '@smithy/hash-node': 4.1.1
-      '@smithy/invalid-dependency': 4.1.1
-      '@smithy/middleware-content-length': 4.1.1
-      '@smithy/middleware-endpoint': 4.2.4
-      '@smithy/middleware-retry': 4.3.0
-      '@smithy/middleware-serde': 4.1.1
-      '@smithy/middleware-stack': 4.1.1
-      '@smithy/node-config-provider': 4.2.2
-      '@smithy/node-http-handler': 4.2.1
-      '@smithy/protocol-http': 5.2.1
-      '@smithy/smithy-client': 4.6.4
-      '@smithy/types': 4.5.0
-      '@smithy/url-parser': 4.1.1
-      '@smithy/util-base64': 4.1.0
-      '@smithy/util-body-length-browser': 4.1.0
-      '@smithy/util-body-length-node': 4.1.0
-      '@smithy/util-defaults-mode-browser': 4.1.4
-      '@smithy/util-defaults-mode-node': 4.1.4
-      '@smithy/util-endpoints': 3.1.2
-      '@smithy/util-middleware': 4.1.1
-      '@smithy/util-retry': 4.1.2
-      '@smithy/util-utf8': 4.1.0
+      '@aws-sdk/core': 3.901.0
+      '@aws-sdk/middleware-host-header': 3.901.0
+      '@aws-sdk/middleware-logger': 3.901.0
+      '@aws-sdk/middleware-recursion-detection': 3.901.0
+      '@aws-sdk/middleware-user-agent': 3.901.0
+      '@aws-sdk/region-config-resolver': 3.901.0
+      '@aws-sdk/types': 3.901.0
+      '@aws-sdk/util-endpoints': 3.901.0
+      '@aws-sdk/util-user-agent-browser': 3.901.0
+      '@aws-sdk/util-user-agent-node': 3.901.0
+      '@smithy/config-resolver': 4.3.0
+      '@smithy/core': 3.14.0
+      '@smithy/fetch-http-handler': 5.3.0
+      '@smithy/hash-node': 4.2.0
+      '@smithy/invalid-dependency': 4.2.0
+      '@smithy/middleware-content-length': 4.2.0
+      '@smithy/middleware-endpoint': 4.3.0
+      '@smithy/middleware-retry': 4.4.0
+      '@smithy/middleware-serde': 4.2.0
+      '@smithy/middleware-stack': 4.2.0
+      '@smithy/node-config-provider': 4.3.0
+      '@smithy/node-http-handler': 4.3.0
+      '@smithy/protocol-http': 5.3.0
+      '@smithy/smithy-client': 4.7.0
+      '@smithy/types': 4.6.0
+      '@smithy/url-parser': 4.2.0
+      '@smithy/util-base64': 4.2.0
+      '@smithy/util-body-length-browser': 4.2.0
+      '@smithy/util-body-length-node': 4.2.0
+      '@smithy/util-defaults-mode-browser': 4.2.0
+      '@smithy/util-defaults-mode-node': 4.2.0
+      '@smithy/util-endpoints': 3.2.0
+      '@smithy/util-middleware': 4.2.0
+      '@smithy/util-retry': 4.2.0
+      '@smithy/util-utf8': 4.2.0
       tslib: 2.8.1
     transitivePeerDependencies:
       - aws-crt
 
-  '@aws-sdk/region-config-resolver@3.893.0':
+  '@aws-sdk/region-config-resolver@3.901.0':
     dependencies:
-      '@aws-sdk/types': 3.893.0
-      '@smithy/node-config-provider': 4.2.2
-      '@smithy/types': 4.5.0
-      '@smithy/util-config-provider': 4.1.0
-      '@smithy/util-middleware': 4.1.1
+      '@aws-sdk/types': 3.901.0
+      '@smithy/node-config-provider': 4.3.0
+      '@smithy/types': 4.6.0
+      '@smithy/util-config-provider': 4.2.0
+      '@smithy/util-middleware': 4.2.0
       tslib: 2.8.1
 
-  '@aws-sdk/s3-request-presigner@3.896.0':
+  '@aws-sdk/s3-request-presigner@3.901.0':
     dependencies:
-      '@aws-sdk/signature-v4-multi-region': 3.896.0
-      '@aws-sdk/types': 3.893.0
-      '@aws-sdk/util-format-url': 3.893.0
-      '@smithy/middleware-endpoint': 4.2.4
-      '@smithy/protocol-http': 5.2.1
-      '@smithy/smithy-client': 4.6.4
-      '@smithy/types': 4.5.0
+      '@aws-sdk/signature-v4-multi-region': 3.901.0
+      '@aws-sdk/types': 3.901.0
+      '@aws-sdk/util-format-url': 3.901.0
+      '@smithy/middleware-endpoint': 4.3.0
+      '@smithy/protocol-http': 5.3.0
+      '@smithy/smithy-client': 4.7.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@aws-sdk/signature-v4-multi-region@3.896.0':
+  '@aws-sdk/signature-v4-multi-region@3.901.0':
     dependencies:
-      '@aws-sdk/middleware-sdk-s3': 3.896.0
-      '@aws-sdk/types': 3.893.0
-      '@smithy/protocol-http': 5.2.1
-      '@smithy/signature-v4': 5.2.1
-      '@smithy/types': 4.5.0
+      '@aws-sdk/middleware-sdk-s3': 3.901.0
+      '@aws-sdk/types': 3.901.0
+      '@smithy/protocol-http': 5.3.0
+      '@smithy/signature-v4': 5.3.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@aws-sdk/token-providers@3.896.0':
+  '@aws-sdk/token-providers@3.901.0':
     dependencies:
-      '@aws-sdk/core': 3.896.0
-      '@aws-sdk/nested-clients': 3.896.0
-      '@aws-sdk/types': 3.893.0
-      '@smithy/property-provider': 4.1.1
-      '@smithy/shared-ini-file-loader': 4.2.0
-      '@smithy/types': 4.5.0
+      '@aws-sdk/core': 3.901.0
+      '@aws-sdk/nested-clients': 3.901.0
+      '@aws-sdk/types': 3.901.0
+      '@smithy/property-provider': 4.2.0
+      '@smithy/shared-ini-file-loader': 4.3.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
     transitivePeerDependencies:
       - aws-crt
 
-  '@aws-sdk/types@3.893.0':
+  '@aws-sdk/types@3.901.0':
     dependencies:
-      '@smithy/types': 4.5.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
   '@aws-sdk/util-arn-parser@3.893.0':
     dependencies:
       tslib: 2.8.1
 
-  '@aws-sdk/util-endpoints@3.895.0':
+  '@aws-sdk/util-endpoints@3.901.0':
     dependencies:
-      '@aws-sdk/types': 3.893.0
-      '@smithy/types': 4.5.0
-      '@smithy/url-parser': 4.1.1
-      '@smithy/util-endpoints': 3.1.2
+      '@aws-sdk/types': 3.901.0
+      '@smithy/types': 4.6.0
+      '@smithy/url-parser': 4.2.0
+      '@smithy/util-endpoints': 3.2.0
       tslib: 2.8.1
 
-  '@aws-sdk/util-format-url@3.893.0':
+  '@aws-sdk/util-format-url@3.901.0':
     dependencies:
-      '@aws-sdk/types': 3.893.0
-      '@smithy/querystring-builder': 4.1.1
-      '@smithy/types': 4.5.0
+      '@aws-sdk/types': 3.901.0
+      '@smithy/querystring-builder': 4.2.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
   '@aws-sdk/util-locate-window@3.893.0':
     dependencies:
       tslib: 2.8.1
 
-  '@aws-sdk/util-user-agent-browser@3.893.0':
+  '@aws-sdk/util-user-agent-browser@3.901.0':
     dependencies:
-      '@aws-sdk/types': 3.893.0
-      '@smithy/types': 4.5.0
+      '@aws-sdk/types': 3.901.0
+      '@smithy/types': 4.6.0
       bowser: 2.12.1
       tslib: 2.8.1
 
-  '@aws-sdk/util-user-agent-node@3.896.0':
+  '@aws-sdk/util-user-agent-node@3.901.0':
     dependencies:
-      '@aws-sdk/middleware-user-agent': 3.896.0
-      '@aws-sdk/types': 3.893.0
-      '@smithy/node-config-provider': 4.2.2
-      '@smithy/types': 4.5.0
+      '@aws-sdk/middleware-user-agent': 3.901.0
+      '@aws-sdk/types': 3.901.0
+      '@smithy/node-config-provider': 4.3.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@aws-sdk/xml-builder@3.894.0':
+  '@aws-sdk/xml-builder@3.901.0':
     dependencies:
-      '@smithy/types': 4.5.0
+      '@smithy/types': 4.6.0
       fast-xml-parser: 5.2.5
       tslib: 2.8.1
 
@@ -13017,39 +12785,39 @@ snapshots:
 
   '@bcoe/v8-coverage@1.0.2': {}
 
-  '@biomejs/biome@2.2.4':
+  '@biomejs/biome@2.2.5':
     optionalDependencies:
-      '@biomejs/cli-darwin-arm64': 2.2.4
-      '@biomejs/cli-darwin-x64': 2.2.4
-      '@biomejs/cli-linux-arm64': 2.2.4
-      '@biomejs/cli-linux-arm64-musl': 2.2.4
-      '@biomejs/cli-linux-x64': 2.2.4
-      '@biomejs/cli-linux-x64-musl': 2.2.4
-      '@biomejs/cli-win32-arm64': 2.2.4
-      '@biomejs/cli-win32-x64': 2.2.4
+      '@biomejs/cli-darwin-arm64': 2.2.5
+      '@biomejs/cli-darwin-x64': 2.2.5
+      '@biomejs/cli-linux-arm64': 2.2.5
+      '@biomejs/cli-linux-arm64-musl': 2.2.5
+      '@biomejs/cli-linux-x64': 2.2.5
+      '@biomejs/cli-linux-x64-musl': 2.2.5
+      '@biomejs/cli-win32-arm64': 2.2.5
+      '@biomejs/cli-win32-x64': 2.2.5
 
-  '@biomejs/cli-darwin-arm64@2.2.4':
+  '@biomejs/cli-darwin-arm64@2.2.5':
     optional: true
 
-  '@biomejs/cli-darwin-x64@2.2.4':
+  '@biomejs/cli-darwin-x64@2.2.5':
     optional: true
 
-  '@biomejs/cli-linux-arm64-musl@2.2.4':
+  '@biomejs/cli-linux-arm64-musl@2.2.5':
     optional: true
 
-  '@biomejs/cli-linux-arm64@2.2.4':
+  '@biomejs/cli-linux-arm64@2.2.5':
     optional: true
 
-  '@biomejs/cli-linux-x64-musl@2.2.4':
+  '@biomejs/cli-linux-x64-musl@2.2.5':
     optional: true
 
-  '@biomejs/cli-linux-x64@2.2.4':
+  '@biomejs/cli-linux-x64@2.2.5':
     optional: true
 
-  '@biomejs/cli-win32-arm64@2.2.4':
+  '@biomejs/cli-win32-arm64@2.2.5':
     optional: true
 
-  '@biomejs/cli-win32-x64@2.2.4':
+  '@biomejs/cli-win32-x64@2.2.5':
     optional: true
 
   '@blocknote/code-block@0.33.0(@blocknote/core@0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0))':
@@ -13174,10 +12942,10 @@ snapshots:
       - tsx
       - yaml
 
-  '@cellajs/permission-manager@0.1.0(@swc/core@1.7.26)(jiti@2.6.1)(postcss@8.5.6)(tsx@4.20.5)(yaml@2.8.1)':
+  '@cellajs/permission-manager@0.1.0(@swc/core@1.7.26)(jiti@2.6.1)(postcss@8.5.6)(tsx@4.20.6)(yaml@2.8.1)':
     dependencies:
-      tsup: 8.5.0(@swc/core@1.7.26)(jiti@2.6.1)(postcss@8.5.6)(tsx@4.20.5)(typescript@5.9.2)(yaml@2.8.1)
-      typescript: 5.9.2
+      tsup: 8.5.0(@swc/core@1.7.26)(jiti@2.6.1)(postcss@8.5.6)(tsx@4.20.6)(typescript@5.9.3)(yaml@2.8.1)
+      typescript: 5.9.3
     transitivePeerDependencies:
       - '@microsoft/api-extractor'
       - '@swc/core'
@@ -13187,13 +12955,13 @@ snapshots:
       - tsx
       - yaml
 
-  '@chromatic-com/storybook@4.1.1(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
+  '@chromatic-com/storybook@4.1.1(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
     dependencies:
       '@neoconfetti/react': 1.0.0
       chromatic: 12.2.0
       filesize: 10.1.6
       jsonfile: 6.2.0
-      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       strip-ansi: 7.1.2
     transitivePeerDependencies:
       - '@chromatic-com/cypress'
@@ -13256,17 +13024,17 @@ snapshots:
 
   '@drizzle-team/brocli@0.10.2': {}
 
-  '@electric-sql/client@1.0.10':
+  '@electric-sql/client@1.0.13':
     dependencies:
       '@microsoft/fetch-event-source': 2.0.1
     optionalDependencies:
-      '@rollup/rollup-darwin-arm64': 4.52.3
+      '@rollup/rollup-darwin-arm64': 4.52.4
 
   '@electric-sql/pglite@0.3.10': {}
 
-  '@electric-sql/react@1.0.10(react@19.2.0)':
+  '@electric-sql/react@1.0.13(react@19.2.0)':
     dependencies:
-      '@electric-sql/client': 1.0.10
+      '@electric-sql/client': 1.0.13
       use-sync-external-store: 1.6.0(react@19.2.0)
     optionalDependencies:
       react: 19.2.0
@@ -13780,12 +13548,6 @@ snapshots:
       '@floating-ui/core': 1.7.3
       '@floating-ui/utils': 0.2.10
 
-  '@floating-ui/react-dom@2.1.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
-    dependencies:
-      '@floating-ui/dom': 1.7.4
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
-
   '@floating-ui/react-dom@2.1.6(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@floating-ui/dom': 1.7.4
@@ -13892,7 +13654,7 @@ snapshots:
       - utf-8-validate
     optional: true
 
-  '@hono/node-server@1.19.4(hono@4.9.8)':
+  '@hono/node-server@1.19.5(hono@4.9.8)':
     dependencies:
       hono: 4.9.8
 
@@ -14049,12 +13811,12 @@ snapshots:
 
   '@istanbuljs/schema@0.1.3': {}
 
-  '@joshwooding/vite-plugin-react-docgen-typescript@0.6.1(typescript@5.9.3)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
+  '@joshwooding/vite-plugin-react-docgen-typescript@0.6.1(typescript@5.9.3)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
       glob: 10.4.5
       magic-string: 0.30.19
       react-docgen-typescript: 2.4.0(typescript@5.9.3)
-      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     optionalDependencies:
       typescript: 5.9.3
 
@@ -14100,20 +13862,20 @@ snapshots:
       dot-prop: 8.0.2
       htmlparser2: 9.1.0
       micromatch: 4.0.8
-      style-to-object: 1.0.9
+      style-to-object: 1.0.11
 
   '@jsx-email/plugin-inline@1.0.1(jsx-email@2.7.3)':
     dependencies:
       '@adobe/css-tools': 4.4.4
       hast-util-select: 6.0.4
       hast-util-to-string: 3.0.1
-      jsx-email: 2.7.3(@emotion/is-prop-valid@1.3.1)(@jsx-email/plugin-inline@1.0.1)(@jsx-email/plugin-minify@1.0.1)(@jsx-email/plugin-pretty@1.0.0)(@types/node@24.5.2)(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(lightningcss@1.30.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(terser@5.44.0)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2))(typescript@5.9.2)
+      jsx-email: 2.7.3(@emotion/is-prop-valid@1.3.1)(@jsx-email/plugin-inline@1.0.1)(@jsx-email/plugin-minify@1.0.1)(@jsx-email/plugin-pretty@1.0.0)(@types/node@24.6.2)(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(lightningcss@1.30.1)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(terser@5.44.0)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.6.2)(typescript@5.9.3))(typescript@5.9.3)
       unist-util-remove: 4.0.0
       unist-util-visit: 5.0.0
 
   '@jsx-email/plugin-minify@1.0.1(jsx-email@2.7.3)':
     dependencies:
-      jsx-email: 2.7.3(@emotion/is-prop-valid@1.3.1)(@jsx-email/plugin-inline@1.0.1)(@jsx-email/plugin-minify@1.0.1)(@jsx-email/plugin-pretty@1.0.0)(@types/node@24.5.2)(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(lightningcss@1.30.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(terser@5.44.0)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2))(typescript@5.9.2)
+      jsx-email: 2.7.3(@emotion/is-prop-valid@1.3.1)(@jsx-email/plugin-inline@1.0.1)(@jsx-email/plugin-minify@1.0.1)(@jsx-email/plugin-pretty@1.0.0)(@types/node@24.6.2)(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(lightningcss@1.30.1)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(terser@5.44.0)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.6.2)(typescript@5.9.3))(typescript@5.9.3)
       rehype-minify-attribute-whitespace: 4.0.1
       rehype-minify-css-style: 4.0.1
       rehype-minify-enumerated-attribute: 5.0.2
@@ -14135,7 +13897,7 @@ snapshots:
 
   '@jsx-email/plugin-pretty@1.0.0(jsx-email@2.7.3)':
     dependencies:
-      jsx-email: 2.7.3(@emotion/is-prop-valid@1.3.1)(@jsx-email/plugin-inline@1.0.1)(@jsx-email/plugin-minify@1.0.1)(@jsx-email/plugin-pretty@1.0.0)(@types/node@24.5.2)(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(lightningcss@1.30.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(terser@5.44.0)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2))(typescript@5.9.2)
+      jsx-email: 2.7.3(@emotion/is-prop-valid@1.3.1)(@jsx-email/plugin-inline@1.0.1)(@jsx-email/plugin-minify@1.0.1)(@jsx-email/plugin-pretty@1.0.0)(@types/node@24.6.2)(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(lightningcss@1.30.1)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(terser@5.44.0)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.6.2)(typescript@5.9.3))(typescript@5.9.3)
       pretty: 2.0.0
 
   '@libsql/client-wasm@0.14.0':
@@ -14327,7 +14089,7 @@ snapshots:
       '@nodelib/fs.scandir': 2.1.5
       fastq: 1.19.1
 
-  '@novu/api@1.6.0':
+  '@novu/api@1.7.0':
     dependencies:
       zod: 3.25.76
 
@@ -14852,63 +14614,63 @@ snapshots:
       '@oslojs/crypto': 1.0.0
       '@oslojs/encoding': 1.0.0
 
-  '@oxc-resolver/binding-android-arm-eabi@11.8.4':
+  '@oxc-resolver/binding-android-arm-eabi@11.9.0':
     optional: true
 
-  '@oxc-resolver/binding-android-arm64@11.8.4':
+  '@oxc-resolver/binding-android-arm64@11.9.0':
     optional: true
 
-  '@oxc-resolver/binding-darwin-arm64@11.8.4':
+  '@oxc-resolver/binding-darwin-arm64@11.9.0':
     optional: true
 
-  '@oxc-resolver/binding-darwin-x64@11.8.4':
+  '@oxc-resolver/binding-darwin-x64@11.9.0':
     optional: true
 
-  '@oxc-resolver/binding-freebsd-x64@11.8.4':
+  '@oxc-resolver/binding-freebsd-x64@11.9.0':
     optional: true
 
-  '@oxc-resolver/binding-linux-arm-gnueabihf@11.8.4':
+  '@oxc-resolver/binding-linux-arm-gnueabihf@11.9.0':
     optional: true
 
-  '@oxc-resolver/binding-linux-arm-musleabihf@11.8.4':
+  '@oxc-resolver/binding-linux-arm-musleabihf@11.9.0':
     optional: true
 
-  '@oxc-resolver/binding-linux-arm64-gnu@11.8.4':
+  '@oxc-resolver/binding-linux-arm64-gnu@11.9.0':
     optional: true
 
-  '@oxc-resolver/binding-linux-arm64-musl@11.8.4':
+  '@oxc-resolver/binding-linux-arm64-musl@11.9.0':
     optional: true
 
-  '@oxc-resolver/binding-linux-ppc64-gnu@11.8.4':
+  '@oxc-resolver/binding-linux-ppc64-gnu@11.9.0':
     optional: true
 
-  '@oxc-resolver/binding-linux-riscv64-gnu@11.8.4':
+  '@oxc-resolver/binding-linux-riscv64-gnu@11.9.0':
     optional: true
 
-  '@oxc-resolver/binding-linux-riscv64-musl@11.8.4':
+  '@oxc-resolver/binding-linux-riscv64-musl@11.9.0':
     optional: true
 
-  '@oxc-resolver/binding-linux-s390x-gnu@11.8.4':
+  '@oxc-resolver/binding-linux-s390x-gnu@11.9.0':
     optional: true
 
-  '@oxc-resolver/binding-linux-x64-gnu@11.8.4':
+  '@oxc-resolver/binding-linux-x64-gnu@11.9.0':
     optional: true
 
-  '@oxc-resolver/binding-linux-x64-musl@11.8.4':
+  '@oxc-resolver/binding-linux-x64-musl@11.9.0':
     optional: true
 
-  '@oxc-resolver/binding-wasm32-wasi@11.8.4':
+  '@oxc-resolver/binding-wasm32-wasi@11.9.0':
     dependencies:
       '@napi-rs/wasm-runtime': 1.0.5
     optional: true
 
-  '@oxc-resolver/binding-win32-arm64-msvc@11.8.4':
+  '@oxc-resolver/binding-win32-arm64-msvc@11.9.0':
     optional: true
 
-  '@oxc-resolver/binding-win32-ia32-msvc@11.8.4':
+  '@oxc-resolver/binding-win32-ia32-msvc@11.9.0':
     optional: true
 
-  '@oxc-resolver/binding-win32-x64-msvc@11.8.4':
+  '@oxc-resolver/binding-win32-x64-msvc@11.9.0':
     optional: true
 
   '@paddle/paddle-js@1.4.2': {}
@@ -15066,23 +14828,14 @@ snapshots:
       '@types/react': 19.2.0
       '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-arrow@1.1.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
-    dependencies:
-      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
-    optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.2.0(@types/react@19.1.13)
-
-  '@radix-ui/react-arrow@1.1.7(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-arrow@1.1.0(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.2.0(@types/react@19.1.13)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
   '@radix-ui/react-arrow@1.1.7(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
@@ -15122,21 +14875,21 @@ snapshots:
       '@types/react': 19.2.0
       '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-collapsible@1.1.1(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-collapsible@1.1.1(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@radix-ui/primitive': 1.1.0
-      '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-id': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.1(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-context': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-id': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-presence': 1.1.1(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.2.0(@types/react@19.1.13)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
   '@radix-ui/react-collapsible@1.1.12(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
@@ -15154,29 +14907,17 @@ snapshots:
       '@types/react': 19.2.0
       '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-collection@1.1.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-collection@1.1.0(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-slot': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
-    optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.2.0(@types/react@19.1.13)
-
-  '@radix-ui/react-collection@1.1.7(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
-    dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.13)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-context': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-slot': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.2.0(@types/react@19.1.13)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
   '@radix-ui/react-collection@1.1.7(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
@@ -15190,17 +14931,11 @@ snapshots:
       '@types/react': 19.2.0
       '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-compose-refs@1.1.0(@types/react@19.1.13)(react@19.1.1)':
-    dependencies:
-      react: 19.1.1
-    optionalDependencies:
-      '@types/react': 19.1.13
-
-  '@radix-ui/react-compose-refs@1.1.2(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-compose-refs@1.1.0(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
-      react: 19.1.1
+      react: 19.2.0
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.2.0
 
   '@radix-ui/react-compose-refs@1.1.2(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
@@ -15222,23 +14957,17 @@ snapshots:
       '@types/react': 19.2.0
       '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-context@1.1.0(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-context@1.1.0(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
-      react: 19.1.1
-    optionalDependencies:
-      '@types/react': 19.1.13
-
-  '@radix-ui/react-context@1.1.1(@types/react@19.1.13)(react@19.1.1)':
-    dependencies:
-      react: 19.1.1
+      react: 19.2.0
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.2.0
 
-  '@radix-ui/react-context@1.1.2(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-context@1.1.1(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
-      react: 19.1.1
+      react: 19.2.0
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.2.0
 
   '@radix-ui/react-context@1.1.2(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
@@ -15268,17 +14997,11 @@ snapshots:
       '@types/react': 19.2.0
       '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-direction@1.1.0(@types/react@19.1.13)(react@19.1.1)':
-    dependencies:
-      react: 19.1.1
-    optionalDependencies:
-      '@types/react': 19.1.13
-
-  '@radix-ui/react-direction@1.1.1(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-direction@1.1.0(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
-      react: 19.1.1
+      react: 19.2.0
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.2.0
 
   '@radix-ui/react-direction@1.1.1(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
@@ -15286,31 +15009,18 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.2.0
 
-  '@radix-ui/react-dismissable-layer@1.1.1(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-dismissable-layer@1.1.1(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@radix-ui/primitive': 1.1.0
-      '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-escape-keydown': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
-    optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.2.0(@types/react@19.1.13)
-
-  '@radix-ui/react-dismissable-layer@1.1.11(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
-    dependencies:
-      '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-escape-keydown': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-escape-keydown': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.2.0(@types/react@19.1.13)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
   '@radix-ui/react-dismissable-layer@1.1.11(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
@@ -15340,17 +15050,11 @@ snapshots:
       '@types/react': 19.2.0
       '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-focus-guards@1.1.1(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-focus-guards@1.1.1(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
-      react: 19.1.1
-    optionalDependencies:
-      '@types/react': 19.1.13
-
-  '@radix-ui/react-focus-guards@1.1.3(@types/react@19.1.13)(react@19.1.1)':
-    dependencies:
-      react: 19.1.1
+      react: 19.2.0
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.2.0
 
   '@radix-ui/react-focus-guards@1.1.3(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
@@ -15358,27 +15062,16 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.2.0
 
-  '@radix-ui/react-focus-scope@1.1.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
-    dependencies:
-      '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
-    optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.2.0(@types/react@19.1.13)
-
-  '@radix-ui/react-focus-scope@1.1.7(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-focus-scope@1.1.0(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.2.0(@types/react@19.1.13)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
   '@radix-ui/react-focus-scope@1.1.7(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
@@ -15408,23 +15101,16 @@ snapshots:
       '@types/react': 19.2.0
       '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-icons@1.3.2(react@19.1.1)':
+  '@radix-ui/react-icons@1.3.2(react@19.2.0)':
     dependencies:
-      react: 19.1.1
-
-  '@radix-ui/react-id@1.1.0(@types/react@19.1.13)(react@19.1.1)':
-    dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      react: 19.1.1
-    optionalDependencies:
-      '@types/react': 19.1.13
+      react: 19.2.0
 
-  '@radix-ui/react-id@1.1.1(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-id@1.1.0(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      react: 19.1.1
+      '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.2.0
 
   '@radix-ui/react-id@1.1.1(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
@@ -15491,64 +15177,46 @@ snapshots:
       '@types/react': 19.2.0
       '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-popover@1.1.2(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-popover@1.1.2(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@radix-ui/primitive': 1.1.0
-      '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-dismissable-layer': 1.1.1(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-focus-guards': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-focus-scope': 1.1.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-id': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-popper': 1.2.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-portal': 1.1.2(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.1(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-slot': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-context': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-dismissable-layer': 1.1.1(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-focus-guards': 1.1.1(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-focus-scope': 1.1.0(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-id': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-popper': 1.2.0(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-portal': 1.1.2(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-presence': 1.1.1(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-slot': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.2.0)(react@19.2.0)
       aria-hidden: 1.2.6
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
-      react-remove-scroll: 2.6.0(@types/react@19.1.13)(react@19.1.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
+      react-remove-scroll: 2.6.0(@types/react@19.2.0)(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.2.0(@types/react@19.1.13)
-
-  '@radix-ui/react-popper@1.2.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
-    dependencies:
-      '@floating-ui/react-dom': 2.1.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-arrow': 1.1.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-rect': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-size': 1.1.0(@types/react@19.1.13)(react@19.1.1)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
+
+  '@radix-ui/react-popper@1.2.0(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
+    dependencies:
+      '@floating-ui/react-dom': 2.1.6(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-arrow': 1.1.0(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-context': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-rect': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-size': 1.1.0(@types/react@19.2.0)(react@19.2.0)
       '@radix-ui/rect': 1.1.0
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
-    optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.2.0(@types/react@19.1.13)
-
-  '@radix-ui/react-popper@1.2.8(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
-    dependencies:
-      '@floating-ui/react-dom': 2.1.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-arrow': 1.1.7(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-rect': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-size': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/rect': 1.1.1
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.2.0(@types/react@19.1.13)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
   '@radix-ui/react-popper@1.2.8(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
@@ -15568,25 +15236,15 @@ snapshots:
       '@types/react': 19.2.0
       '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-portal@1.1.2(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-portal@1.1.2(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
-      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
-    optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.2.0(@types/react@19.1.13)
-
-  '@radix-ui/react-portal@1.1.9(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
-    dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.2.0(@types/react@19.1.13)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
   '@radix-ui/react-portal@1.1.9(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
@@ -15598,15 +15256,15 @@ snapshots:
       '@types/react': 19.2.0
       '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-presence@1.1.1(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-presence@1.1.1(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.2.0(@types/react@19.1.13)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
   '@radix-ui/react-presence@1.1.5(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
@@ -15618,23 +15276,14 @@ snapshots:
       '@types/react': 19.2.0
       '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-primitive@2.0.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
-    dependencies:
-      '@radix-ui/react-slot': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
-    optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.2.0(@types/react@19.1.13)
-
-  '@radix-ui/react-primitive@2.1.3(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-primitive@2.0.0(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.13)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-slot': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.2.0(@types/react@19.1.13)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
   '@radix-ui/react-primitive@2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
@@ -15673,22 +15322,22 @@ snapshots:
       '@types/react': 19.2.0
       '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-roving-focus@1.1.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-roving-focus@1.1.0(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@radix-ui/primitive': 1.1.0
-      '@radix-ui/react-collection': 1.1.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-direction': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-id': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-collection': 1.1.0(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-context': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-direction': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-id': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.2.0(@types/react@19.1.13)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
   '@radix-ui/react-roving-focus@1.1.11(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
@@ -15724,35 +15373,6 @@ snapshots:
       '@types/react': 19.2.0
       '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-select@2.2.6(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
-    dependencies:
-      '@radix-ui/number': 1.1.1
-      '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      aria-hidden: 1.2.6
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
-      react-remove-scroll: 2.7.1(@types/react@19.1.13)(react@19.1.1)
-    optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.2.0(@types/react@19.1.13)
-
   '@radix-ui/react-select@2.2.6(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@radix-ui/number': 1.1.1
@@ -15810,19 +15430,12 @@ snapshots:
       '@types/react': 19.2.0
       '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-slot@1.1.0(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-slot@1.1.0(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      react: 19.1.1
-    optionalDependencies:
-      '@types/react': 19.1.13
-
-  '@radix-ui/react-slot@1.2.3(@types/react@19.1.13)(react@19.1.1)':
-    dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      react: 19.1.1
+      '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.2.0
 
   '@radix-ui/react-slot@1.2.3(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
@@ -15882,20 +15495,20 @@ snapshots:
       '@types/react': 19.2.0
       '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-toggle-group@1.1.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-toggle-group@1.1.0(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@radix-ui/primitive': 1.1.0
-      '@radix-ui/react-context': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-direction': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-roving-focus': 1.1.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-toggle': 1.1.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-context': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-direction': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-roving-focus': 1.1.0(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-toggle': 1.1.0(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.2.0(@types/react@19.1.13)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
   '@radix-ui/react-toggle-group@1.1.11(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
@@ -15912,16 +15525,16 @@ snapshots:
       '@types/react': 19.2.0
       '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-toggle@1.1.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-toggle@1.1.0(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@radix-ui/primitive': 1.1.0
-      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.2.0(@types/react@19.1.13)
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
   '@radix-ui/react-toggle@1.1.10(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
@@ -15954,17 +15567,11 @@ snapshots:
       '@types/react': 19.2.0
       '@types/react-dom': 19.2.0(@types/react@19.2.0)
 
-  '@radix-ui/react-use-callback-ref@1.1.0(@types/react@19.1.13)(react@19.1.1)':
-    dependencies:
-      react: 19.1.1
-    optionalDependencies:
-      '@types/react': 19.1.13
-
-  '@radix-ui/react-use-callback-ref@1.1.1(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-use-callback-ref@1.1.0(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
-      react: 19.1.1
+      react: 19.2.0
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.2.0
 
   '@radix-ui/react-use-callback-ref@1.1.1(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
@@ -15972,20 +15579,12 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.2.0
 
-  '@radix-ui/react-use-controllable-state@1.1.0(@types/react@19.1.13)(react@19.1.1)':
-    dependencies:
-      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      react: 19.1.1
-    optionalDependencies:
-      '@types/react': 19.1.13
-
-  '@radix-ui/react-use-controllable-state@1.2.2(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-use-controllable-state@1.1.0(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
-      '@radix-ui/react-use-effect-event': 0.0.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      react: 19.1.1
+      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.2.0
 
   '@radix-ui/react-use-controllable-state@1.2.2(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
@@ -15995,13 +15594,6 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.2.0
 
-  '@radix-ui/react-use-effect-event@0.0.2(@types/react@19.1.13)(react@19.1.1)':
-    dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      react: 19.1.1
-    optionalDependencies:
-      '@types/react': 19.1.13
-
   '@radix-ui/react-use-effect-event@0.0.2(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
       '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.0)(react@19.2.0)
@@ -16009,19 +15601,12 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.2.0
 
-  '@radix-ui/react-use-escape-keydown@1.1.0(@types/react@19.1.13)(react@19.1.1)':
-    dependencies:
-      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      react: 19.1.1
-    optionalDependencies:
-      '@types/react': 19.1.13
-
-  '@radix-ui/react-use-escape-keydown@1.1.1(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-use-escape-keydown@1.1.0(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      react: 19.1.1
+      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.2.0
 
   '@radix-ui/react-use-escape-keydown@1.1.1(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
@@ -16037,17 +15622,11 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.2.0
 
-  '@radix-ui/react-use-layout-effect@1.1.0(@types/react@19.1.13)(react@19.1.1)':
-    dependencies:
-      react: 19.1.1
-    optionalDependencies:
-      '@types/react': 19.1.13
-
-  '@radix-ui/react-use-layout-effect@1.1.1(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-use-layout-effect@1.1.0(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
-      react: 19.1.1
+      react: 19.2.0
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.2.0
 
   '@radix-ui/react-use-layout-effect@1.1.1(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
@@ -16055,31 +15634,18 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.2.0
 
-  '@radix-ui/react-use-previous@1.1.1(@types/react@19.1.13)(react@19.1.1)':
-    dependencies:
-      react: 19.1.1
-    optionalDependencies:
-      '@types/react': 19.1.13
-
   '@radix-ui/react-use-previous@1.1.1(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
       react: 19.2.0
     optionalDependencies:
       '@types/react': 19.2.0
 
-  '@radix-ui/react-use-rect@1.1.0(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-use-rect@1.1.0(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
       '@radix-ui/rect': 1.1.0
-      react: 19.1.1
-    optionalDependencies:
-      '@types/react': 19.1.13
-
-  '@radix-ui/react-use-rect@1.1.1(@types/react@19.1.13)(react@19.1.1)':
-    dependencies:
-      '@radix-ui/rect': 1.1.1
-      react: 19.1.1
+      react: 19.2.0
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.2.0
 
   '@radix-ui/react-use-rect@1.1.1(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
@@ -16088,19 +15654,12 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.2.0
 
-  '@radix-ui/react-use-size@1.1.0(@types/react@19.1.13)(react@19.1.1)':
-    dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      react: 19.1.1
-    optionalDependencies:
-      '@types/react': 19.1.13
-
-  '@radix-ui/react-use-size@1.1.1(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-use-size@1.1.0(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      react: 19.1.1
+      '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      react: 19.2.0
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.2.0
 
   '@radix-ui/react-use-size@1.1.1(@types/react@19.2.0)(react@19.2.0)':
     dependencies:
@@ -16109,15 +15668,6 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.2.0
 
-  '@radix-ui/react-visually-hidden@1.2.3(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
-    dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
-    optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.2.0(@types/react@19.1.13)
-
   '@radix-ui/react-visually-hidden@1.2.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
@@ -16131,7 +15681,7 @@ snapshots:
 
   '@radix-ui/rect@1.1.1': {}
 
-  '@react-scan/vite-plugin-react-scan@0.1.8(react-scan@0.4.3(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react-router-dom@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react-router@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react@19.2.0)(rollup@2.79.2))(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
+  '@react-scan/vite-plugin-react-scan@0.1.8(react-scan@0.4.3(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react-router-dom@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react-router@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react@19.2.0)(rollup@2.79.2))(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
       '@babel/core': 7.28.4
       '@babel/plugin-transform-react-jsx': 7.27.1(@babel/core@7.28.4)
@@ -16139,7 +15689,7 @@ snapshots:
       babel-plugin-add-react-displayname: 0.0.5
       cheerio: 1.1.2
       react-scan: 0.4.3(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react-router-dom@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react-router@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react@19.2.0)(rollup@2.79.2)
-      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - supports-color
 
@@ -16216,136 +15766,70 @@ snapshots:
     optionalDependencies:
       rollup: 2.79.2
 
-  '@rollup/rollup-android-arm-eabi@4.52.2':
-    optional: true
-
-  '@rollup/rollup-android-arm-eabi@4.52.3':
-    optional: true
-
-  '@rollup/rollup-android-arm64@4.52.2':
-    optional: true
-
-  '@rollup/rollup-android-arm64@4.52.3':
-    optional: true
-
-  '@rollup/rollup-darwin-arm64@4.52.2':
-    optional: true
-
-  '@rollup/rollup-darwin-arm64@4.52.3':
-    optional: true
-
-  '@rollup/rollup-darwin-x64@4.52.2':
-    optional: true
-
-  '@rollup/rollup-darwin-x64@4.52.3':
-    optional: true
-
-  '@rollup/rollup-freebsd-arm64@4.52.2':
-    optional: true
-
-  '@rollup/rollup-freebsd-arm64@4.52.3':
+  '@rollup/rollup-android-arm-eabi@4.52.4':
     optional: true
 
-  '@rollup/rollup-freebsd-x64@4.52.2':
+  '@rollup/rollup-android-arm64@4.52.4':
     optional: true
 
-  '@rollup/rollup-freebsd-x64@4.52.3':
+  '@rollup/rollup-darwin-arm64@4.52.4':
     optional: true
 
-  '@rollup/rollup-linux-arm-gnueabihf@4.52.2':
+  '@rollup/rollup-darwin-x64@4.52.4':
     optional: true
 
-  '@rollup/rollup-linux-arm-gnueabihf@4.52.3':
+  '@rollup/rollup-freebsd-arm64@4.52.4':
     optional: true
 
-  '@rollup/rollup-linux-arm-musleabihf@4.52.2':
+  '@rollup/rollup-freebsd-x64@4.52.4':
     optional: true
 
-  '@rollup/rollup-linux-arm-musleabihf@4.52.3':
+  '@rollup/rollup-linux-arm-gnueabihf@4.52.4':
     optional: true
 
-  '@rollup/rollup-linux-arm64-gnu@4.52.2':
+  '@rollup/rollup-linux-arm-musleabihf@4.52.4':
     optional: true
 
-  '@rollup/rollup-linux-arm64-gnu@4.52.3':
+  '@rollup/rollup-linux-arm64-gnu@4.52.4':
     optional: true
 
-  '@rollup/rollup-linux-arm64-musl@4.52.2':
+  '@rollup/rollup-linux-arm64-musl@4.52.4':
     optional: true
 
-  '@rollup/rollup-linux-arm64-musl@4.52.3':
+  '@rollup/rollup-linux-loong64-gnu@4.52.4':
     optional: true
 
-  '@rollup/rollup-linux-loong64-gnu@4.52.2':
+  '@rollup/rollup-linux-ppc64-gnu@4.52.4':
     optional: true
 
-  '@rollup/rollup-linux-loong64-gnu@4.52.3':
+  '@rollup/rollup-linux-riscv64-gnu@4.52.4':
     optional: true
 
-  '@rollup/rollup-linux-ppc64-gnu@4.52.2':
+  '@rollup/rollup-linux-riscv64-musl@4.52.4':
     optional: true
 
-  '@rollup/rollup-linux-ppc64-gnu@4.52.3':
+  '@rollup/rollup-linux-s390x-gnu@4.52.4':
     optional: true
 
-  '@rollup/rollup-linux-riscv64-gnu@4.52.2':
+  '@rollup/rollup-linux-x64-gnu@4.52.4':
     optional: true
 
-  '@rollup/rollup-linux-riscv64-gnu@4.52.3':
+  '@rollup/rollup-linux-x64-musl@4.52.4':
     optional: true
 
-  '@rollup/rollup-linux-riscv64-musl@4.52.2':
+  '@rollup/rollup-openharmony-arm64@4.52.4':
     optional: true
 
-  '@rollup/rollup-linux-riscv64-musl@4.52.3':
+  '@rollup/rollup-win32-arm64-msvc@4.52.4':
     optional: true
 
-  '@rollup/rollup-linux-s390x-gnu@4.52.2':
+  '@rollup/rollup-win32-ia32-msvc@4.52.4':
     optional: true
 
-  '@rollup/rollup-linux-s390x-gnu@4.52.3':
+  '@rollup/rollup-win32-x64-gnu@4.52.4':
     optional: true
 
-  '@rollup/rollup-linux-x64-gnu@4.52.2':
-    optional: true
-
-  '@rollup/rollup-linux-x64-gnu@4.52.3':
-    optional: true
-
-  '@rollup/rollup-linux-x64-musl@4.52.2':
-    optional: true
-
-  '@rollup/rollup-linux-x64-musl@4.52.3':
-    optional: true
-
-  '@rollup/rollup-openharmony-arm64@4.52.2':
-    optional: true
-
-  '@rollup/rollup-openharmony-arm64@4.52.3':
-    optional: true
-
-  '@rollup/rollup-win32-arm64-msvc@4.52.2':
-    optional: true
-
-  '@rollup/rollup-win32-arm64-msvc@4.52.3':
-    optional: true
-
-  '@rollup/rollup-win32-ia32-msvc@4.52.2':
-    optional: true
-
-  '@rollup/rollup-win32-ia32-msvc@4.52.3':
-    optional: true
-
-  '@rollup/rollup-win32-x64-gnu@4.52.2':
-    optional: true
-
-  '@rollup/rollup-win32-x64-gnu@4.52.3':
-    optional: true
-
-  '@rollup/rollup-win32-x64-msvc@4.52.2':
-    optional: true
-
-  '@rollup/rollup-win32-x64-msvc@4.52.3':
+  '@rollup/rollup-win32-x64-msvc@4.52.4':
     optional: true
 
   '@rrweb/record@2.0.0-alpha.18':
@@ -16357,24 +15841,25 @@ snapshots:
 
   '@rrweb/utils@2.0.0-alpha.18': {}
 
-  '@scalar/core@0.3.17':
+  '@scalar/core@0.3.18':
     dependencies:
-      '@scalar/types': 0.2.16
+      '@scalar/types': 0.3.0
 
-  '@scalar/hono-api-reference@0.9.19(hono@4.9.8)':
+  '@scalar/hono-api-reference@0.9.20(hono@4.9.8)':
     dependencies:
-      '@scalar/core': 0.3.17
+      '@scalar/core': 0.3.18
       hono: 4.9.8
 
-  '@scalar/openapi-types@0.3.7':
+  '@scalar/openapi-types@0.4.0':
     dependencies:
-      zod: 3.24.1
+      zod: 4.1.11
 
-  '@scalar/types@0.2.16':
+  '@scalar/types@0.3.0':
     dependencies:
-      '@scalar/openapi-types': 0.3.7
+      '@scalar/openapi-types': 0.4.0
       nanoid: 5.1.5
-      zod: 3.24.1
+      type-fest: 4.41.0
+      zod: 4.1.11
 
   '@selderee/plugin-htmlparser2@0.11.0':
     dependencies:
@@ -16446,74 +15931,30 @@ snapshots:
       - encoding
       - supports-color
 
-  '@sentry/cli-darwin@2.55.0':
-    optional: true
-
   '@sentry/cli-darwin@2.56.0':
     optional: true
 
-  '@sentry/cli-linux-arm64@2.55.0':
-    optional: true
-
   '@sentry/cli-linux-arm64@2.56.0':
     optional: true
 
-  '@sentry/cli-linux-arm@2.55.0':
-    optional: true
-
   '@sentry/cli-linux-arm@2.56.0':
     optional: true
 
-  '@sentry/cli-linux-i686@2.55.0':
-    optional: true
-
   '@sentry/cli-linux-i686@2.56.0':
     optional: true
 
-  '@sentry/cli-linux-x64@2.55.0':
-    optional: true
-
   '@sentry/cli-linux-x64@2.56.0':
     optional: true
 
-  '@sentry/cli-win32-arm64@2.55.0':
-    optional: true
-
   '@sentry/cli-win32-arm64@2.56.0':
     optional: true
 
-  '@sentry/cli-win32-i686@2.55.0':
-    optional: true
-
   '@sentry/cli-win32-i686@2.56.0':
     optional: true
 
-  '@sentry/cli-win32-x64@2.55.0':
-    optional: true
-
   '@sentry/cli-win32-x64@2.56.0':
     optional: true
 
-  '@sentry/cli@2.55.0':
-    dependencies:
-      https-proxy-agent: 5.0.1
-      node-fetch: 2.7.0
-      progress: 2.0.3
-      proxy-from-env: 1.1.0
-      which: 2.0.2
-    optionalDependencies:
-      '@sentry/cli-darwin': 2.55.0
-      '@sentry/cli-linux-arm': 2.55.0
-      '@sentry/cli-linux-arm64': 2.55.0
-      '@sentry/cli-linux-i686': 2.55.0
-      '@sentry/cli-linux-x64': 2.55.0
-      '@sentry/cli-win32-arm64': 2.55.0
-      '@sentry/cli-win32-i686': 2.55.0
-      '@sentry/cli-win32-x64': 2.55.0
-    transitivePeerDependencies:
-      - encoding
-      - supports-color
-
   '@sentry/cli@2.56.0':
     dependencies:
       https-proxy-agent: 5.0.1
@@ -16694,253 +16135,253 @@ snapshots:
 
   '@sindresorhus/merge-streams@2.3.0': {}
 
-  '@smithy/abort-controller@4.1.1':
+  '@smithy/abort-controller@4.2.0':
     dependencies:
-      '@smithy/types': 4.5.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@smithy/chunked-blob-reader-native@4.1.0':
+  '@smithy/chunked-blob-reader-native@4.2.0':
     dependencies:
-      '@smithy/util-base64': 4.1.0
+      '@smithy/util-base64': 4.2.0
       tslib: 2.8.1
 
-  '@smithy/chunked-blob-reader@5.1.0':
+  '@smithy/chunked-blob-reader@5.2.0':
     dependencies:
       tslib: 2.8.1
 
-  '@smithy/config-resolver@4.2.2':
+  '@smithy/config-resolver@4.3.0':
     dependencies:
-      '@smithy/node-config-provider': 4.2.2
-      '@smithy/types': 4.5.0
-      '@smithy/util-config-provider': 4.1.0
-      '@smithy/util-middleware': 4.1.1
+      '@smithy/node-config-provider': 4.3.0
+      '@smithy/types': 4.6.0
+      '@smithy/util-config-provider': 4.2.0
+      '@smithy/util-middleware': 4.2.0
       tslib: 2.8.1
 
-  '@smithy/core@3.12.0':
-    dependencies:
-      '@smithy/middleware-serde': 4.1.1
-      '@smithy/protocol-http': 5.2.1
-      '@smithy/types': 4.5.0
-      '@smithy/util-base64': 4.1.0
-      '@smithy/util-body-length-browser': 4.1.0
-      '@smithy/util-middleware': 4.1.1
-      '@smithy/util-stream': 4.3.2
-      '@smithy/util-utf8': 4.1.0
-      '@smithy/uuid': 1.0.0
+  '@smithy/core@3.14.0':
+    dependencies:
+      '@smithy/middleware-serde': 4.2.0
+      '@smithy/protocol-http': 5.3.0
+      '@smithy/types': 4.6.0
+      '@smithy/util-base64': 4.2.0
+      '@smithy/util-body-length-browser': 4.2.0
+      '@smithy/util-middleware': 4.2.0
+      '@smithy/util-stream': 4.4.0
+      '@smithy/util-utf8': 4.2.0
+      '@smithy/uuid': 1.1.0
       tslib: 2.8.1
 
-  '@smithy/credential-provider-imds@4.1.2':
+  '@smithy/credential-provider-imds@4.2.0':
     dependencies:
-      '@smithy/node-config-provider': 4.2.2
-      '@smithy/property-provider': 4.1.1
-      '@smithy/types': 4.5.0
-      '@smithy/url-parser': 4.1.1
+      '@smithy/node-config-provider': 4.3.0
+      '@smithy/property-provider': 4.2.0
+      '@smithy/types': 4.6.0
+      '@smithy/url-parser': 4.2.0
       tslib: 2.8.1
 
-  '@smithy/eventstream-codec@4.1.1':
+  '@smithy/eventstream-codec@4.2.0':
     dependencies:
       '@aws-crypto/crc32': 5.2.0
-      '@smithy/types': 4.5.0
-      '@smithy/util-hex-encoding': 4.1.0
+      '@smithy/types': 4.6.0
+      '@smithy/util-hex-encoding': 4.2.0
       tslib: 2.8.1
 
-  '@smithy/eventstream-serde-browser@4.1.1':
+  '@smithy/eventstream-serde-browser@4.2.0':
     dependencies:
-      '@smithy/eventstream-serde-universal': 4.1.1
-      '@smithy/types': 4.5.0
+      '@smithy/eventstream-serde-universal': 4.2.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@smithy/eventstream-serde-config-resolver@4.2.1':
+  '@smithy/eventstream-serde-config-resolver@4.3.0':
     dependencies:
-      '@smithy/types': 4.5.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@smithy/eventstream-serde-node@4.1.1':
+  '@smithy/eventstream-serde-node@4.2.0':
     dependencies:
-      '@smithy/eventstream-serde-universal': 4.1.1
-      '@smithy/types': 4.5.0
+      '@smithy/eventstream-serde-universal': 4.2.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@smithy/eventstream-serde-universal@4.1.1':
+  '@smithy/eventstream-serde-universal@4.2.0':
     dependencies:
-      '@smithy/eventstream-codec': 4.1.1
-      '@smithy/types': 4.5.0
+      '@smithy/eventstream-codec': 4.2.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@smithy/fetch-http-handler@5.2.1':
+  '@smithy/fetch-http-handler@5.3.0':
     dependencies:
-      '@smithy/protocol-http': 5.2.1
-      '@smithy/querystring-builder': 4.1.1
-      '@smithy/types': 4.5.0
-      '@smithy/util-base64': 4.1.0
+      '@smithy/protocol-http': 5.3.0
+      '@smithy/querystring-builder': 4.2.0
+      '@smithy/types': 4.6.0
+      '@smithy/util-base64': 4.2.0
       tslib: 2.8.1
 
-  '@smithy/hash-blob-browser@4.1.1':
+  '@smithy/hash-blob-browser@4.2.0':
     dependencies:
-      '@smithy/chunked-blob-reader': 5.1.0
-      '@smithy/chunked-blob-reader-native': 4.1.0
-      '@smithy/types': 4.5.0
+      '@smithy/chunked-blob-reader': 5.2.0
+      '@smithy/chunked-blob-reader-native': 4.2.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@smithy/hash-node@4.1.1':
+  '@smithy/hash-node@4.2.0':
     dependencies:
-      '@smithy/types': 4.5.0
-      '@smithy/util-buffer-from': 4.1.0
-      '@smithy/util-utf8': 4.1.0
+      '@smithy/types': 4.6.0
+      '@smithy/util-buffer-from': 4.2.0
+      '@smithy/util-utf8': 4.2.0
       tslib: 2.8.1
 
-  '@smithy/hash-stream-node@4.1.1':
+  '@smithy/hash-stream-node@4.2.0':
     dependencies:
-      '@smithy/types': 4.5.0
-      '@smithy/util-utf8': 4.1.0
+      '@smithy/types': 4.6.0
+      '@smithy/util-utf8': 4.2.0
       tslib: 2.8.1
 
-  '@smithy/invalid-dependency@4.1.1':
+  '@smithy/invalid-dependency@4.2.0':
     dependencies:
-      '@smithy/types': 4.5.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
   '@smithy/is-array-buffer@2.2.0':
     dependencies:
       tslib: 2.8.1
 
-  '@smithy/is-array-buffer@4.1.0':
+  '@smithy/is-array-buffer@4.2.0':
     dependencies:
       tslib: 2.8.1
 
-  '@smithy/md5-js@4.1.1':
+  '@smithy/md5-js@4.2.0':
     dependencies:
-      '@smithy/types': 4.5.0
-      '@smithy/util-utf8': 4.1.0
+      '@smithy/types': 4.6.0
+      '@smithy/util-utf8': 4.2.0
       tslib: 2.8.1
 
-  '@smithy/middleware-content-length@4.1.1':
+  '@smithy/middleware-content-length@4.2.0':
     dependencies:
-      '@smithy/protocol-http': 5.2.1
-      '@smithy/types': 4.5.0
+      '@smithy/protocol-http': 5.3.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@smithy/middleware-endpoint@4.2.4':
+  '@smithy/middleware-endpoint@4.3.0':
     dependencies:
-      '@smithy/core': 3.12.0
-      '@smithy/middleware-serde': 4.1.1
-      '@smithy/node-config-provider': 4.2.2
-      '@smithy/shared-ini-file-loader': 4.2.0
-      '@smithy/types': 4.5.0
-      '@smithy/url-parser': 4.1.1
-      '@smithy/util-middleware': 4.1.1
+      '@smithy/core': 3.14.0
+      '@smithy/middleware-serde': 4.2.0
+      '@smithy/node-config-provider': 4.3.0
+      '@smithy/shared-ini-file-loader': 4.3.0
+      '@smithy/types': 4.6.0
+      '@smithy/url-parser': 4.2.0
+      '@smithy/util-middleware': 4.2.0
       tslib: 2.8.1
 
-  '@smithy/middleware-retry@4.3.0':
+  '@smithy/middleware-retry@4.4.0':
     dependencies:
-      '@smithy/node-config-provider': 4.2.2
-      '@smithy/protocol-http': 5.2.1
-      '@smithy/service-error-classification': 4.1.2
-      '@smithy/smithy-client': 4.6.4
-      '@smithy/types': 4.5.0
-      '@smithy/util-middleware': 4.1.1
-      '@smithy/util-retry': 4.1.2
-      '@smithy/uuid': 1.0.0
+      '@smithy/node-config-provider': 4.3.0
+      '@smithy/protocol-http': 5.3.0
+      '@smithy/service-error-classification': 4.2.0
+      '@smithy/smithy-client': 4.7.0
+      '@smithy/types': 4.6.0
+      '@smithy/util-middleware': 4.2.0
+      '@smithy/util-retry': 4.2.0
+      '@smithy/uuid': 1.1.0
       tslib: 2.8.1
 
-  '@smithy/middleware-serde@4.1.1':
+  '@smithy/middleware-serde@4.2.0':
     dependencies:
-      '@smithy/protocol-http': 5.2.1
-      '@smithy/types': 4.5.0
+      '@smithy/protocol-http': 5.3.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@smithy/middleware-stack@4.1.1':
+  '@smithy/middleware-stack@4.2.0':
     dependencies:
-      '@smithy/types': 4.5.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@smithy/node-config-provider@4.2.2':
+  '@smithy/node-config-provider@4.3.0':
     dependencies:
-      '@smithy/property-provider': 4.1.1
-      '@smithy/shared-ini-file-loader': 4.2.0
-      '@smithy/types': 4.5.0
+      '@smithy/property-provider': 4.2.0
+      '@smithy/shared-ini-file-loader': 4.3.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@smithy/node-http-handler@4.2.1':
+  '@smithy/node-http-handler@4.3.0':
     dependencies:
-      '@smithy/abort-controller': 4.1.1
-      '@smithy/protocol-http': 5.2.1
-      '@smithy/querystring-builder': 4.1.1
-      '@smithy/types': 4.5.0
+      '@smithy/abort-controller': 4.2.0
+      '@smithy/protocol-http': 5.3.0
+      '@smithy/querystring-builder': 4.2.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@smithy/property-provider@4.1.1':
+  '@smithy/property-provider@4.2.0':
     dependencies:
-      '@smithy/types': 4.5.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@smithy/protocol-http@5.2.1':
+  '@smithy/protocol-http@5.3.0':
     dependencies:
-      '@smithy/types': 4.5.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@smithy/querystring-builder@4.1.1':
+  '@smithy/querystring-builder@4.2.0':
     dependencies:
-      '@smithy/types': 4.5.0
-      '@smithy/util-uri-escape': 4.1.0
+      '@smithy/types': 4.6.0
+      '@smithy/util-uri-escape': 4.2.0
       tslib: 2.8.1
 
-  '@smithy/querystring-parser@4.1.1':
+  '@smithy/querystring-parser@4.2.0':
     dependencies:
-      '@smithy/types': 4.5.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@smithy/service-error-classification@4.1.2':
+  '@smithy/service-error-classification@4.2.0':
     dependencies:
-      '@smithy/types': 4.5.0
+      '@smithy/types': 4.6.0
 
-  '@smithy/shared-ini-file-loader@4.2.0':
+  '@smithy/shared-ini-file-loader@4.3.0':
     dependencies:
-      '@smithy/types': 4.5.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@smithy/signature-v4@5.2.1':
+  '@smithy/signature-v4@5.3.0':
     dependencies:
-      '@smithy/is-array-buffer': 4.1.0
-      '@smithy/protocol-http': 5.2.1
-      '@smithy/types': 4.5.0
-      '@smithy/util-hex-encoding': 4.1.0
-      '@smithy/util-middleware': 4.1.1
-      '@smithy/util-uri-escape': 4.1.0
-      '@smithy/util-utf8': 4.1.0
+      '@smithy/is-array-buffer': 4.2.0
+      '@smithy/protocol-http': 5.3.0
+      '@smithy/types': 4.6.0
+      '@smithy/util-hex-encoding': 4.2.0
+      '@smithy/util-middleware': 4.2.0
+      '@smithy/util-uri-escape': 4.2.0
+      '@smithy/util-utf8': 4.2.0
       tslib: 2.8.1
 
-  '@smithy/smithy-client@4.6.4':
+  '@smithy/smithy-client@4.7.0':
     dependencies:
-      '@smithy/core': 3.12.0
-      '@smithy/middleware-endpoint': 4.2.4
-      '@smithy/middleware-stack': 4.1.1
-      '@smithy/protocol-http': 5.2.1
-      '@smithy/types': 4.5.0
-      '@smithy/util-stream': 4.3.2
+      '@smithy/core': 3.14.0
+      '@smithy/middleware-endpoint': 4.3.0
+      '@smithy/middleware-stack': 4.2.0
+      '@smithy/protocol-http': 5.3.0
+      '@smithy/types': 4.6.0
+      '@smithy/util-stream': 4.4.0
       tslib: 2.8.1
 
-  '@smithy/types@4.5.0':
+  '@smithy/types@4.6.0':
     dependencies:
       tslib: 2.8.1
 
-  '@smithy/url-parser@4.1.1':
+  '@smithy/url-parser@4.2.0':
     dependencies:
-      '@smithy/querystring-parser': 4.1.1
-      '@smithy/types': 4.5.0
+      '@smithy/querystring-parser': 4.2.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@smithy/util-base64@4.1.0':
+  '@smithy/util-base64@4.2.0':
     dependencies:
-      '@smithy/util-buffer-from': 4.1.0
-      '@smithy/util-utf8': 4.1.0
+      '@smithy/util-buffer-from': 4.2.0
+      '@smithy/util-utf8': 4.2.0
       tslib: 2.8.1
 
-  '@smithy/util-body-length-browser@4.1.0':
+  '@smithy/util-body-length-browser@4.2.0':
     dependencies:
       tslib: 2.8.1
 
-  '@smithy/util-body-length-node@4.1.0':
+  '@smithy/util-body-length-node@4.2.0':
     dependencies:
       tslib: 2.8.1
 
@@ -16949,66 +16390,66 @@ snapshots:
       '@smithy/is-array-buffer': 2.2.0
       tslib: 2.8.1
 
-  '@smithy/util-buffer-from@4.1.0':
+  '@smithy/util-buffer-from@4.2.0':
     dependencies:
-      '@smithy/is-array-buffer': 4.1.0
+      '@smithy/is-array-buffer': 4.2.0
       tslib: 2.8.1
 
-  '@smithy/util-config-provider@4.1.0':
+  '@smithy/util-config-provider@4.2.0':
     dependencies:
       tslib: 2.8.1
 
-  '@smithy/util-defaults-mode-browser@4.1.4':
+  '@smithy/util-defaults-mode-browser@4.2.0':
     dependencies:
-      '@smithy/property-provider': 4.1.1
-      '@smithy/smithy-client': 4.6.4
-      '@smithy/types': 4.5.0
+      '@smithy/property-provider': 4.2.0
+      '@smithy/smithy-client': 4.7.0
+      '@smithy/types': 4.6.0
       bowser: 2.12.1
       tslib: 2.8.1
 
-  '@smithy/util-defaults-mode-node@4.1.4':
+  '@smithy/util-defaults-mode-node@4.2.0':
     dependencies:
-      '@smithy/config-resolver': 4.2.2
-      '@smithy/credential-provider-imds': 4.1.2
-      '@smithy/node-config-provider': 4.2.2
-      '@smithy/property-provider': 4.1.1
-      '@smithy/smithy-client': 4.6.4
-      '@smithy/types': 4.5.0
+      '@smithy/config-resolver': 4.3.0
+      '@smithy/credential-provider-imds': 4.2.0
+      '@smithy/node-config-provider': 4.3.0
+      '@smithy/property-provider': 4.2.0
+      '@smithy/smithy-client': 4.7.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@smithy/util-endpoints@3.1.2':
+  '@smithy/util-endpoints@3.2.0':
     dependencies:
-      '@smithy/node-config-provider': 4.2.2
-      '@smithy/types': 4.5.0
+      '@smithy/node-config-provider': 4.3.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@smithy/util-hex-encoding@4.1.0':
+  '@smithy/util-hex-encoding@4.2.0':
     dependencies:
       tslib: 2.8.1
 
-  '@smithy/util-middleware@4.1.1':
+  '@smithy/util-middleware@4.2.0':
     dependencies:
-      '@smithy/types': 4.5.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@smithy/util-retry@4.1.2':
+  '@smithy/util-retry@4.2.0':
     dependencies:
-      '@smithy/service-error-classification': 4.1.2
-      '@smithy/types': 4.5.0
+      '@smithy/service-error-classification': 4.2.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@smithy/util-stream@4.3.2':
+  '@smithy/util-stream@4.4.0':
     dependencies:
-      '@smithy/fetch-http-handler': 5.2.1
-      '@smithy/node-http-handler': 4.2.1
-      '@smithy/types': 4.5.0
-      '@smithy/util-base64': 4.1.0
-      '@smithy/util-buffer-from': 4.1.0
-      '@smithy/util-hex-encoding': 4.1.0
-      '@smithy/util-utf8': 4.1.0
+      '@smithy/fetch-http-handler': 5.3.0
+      '@smithy/node-http-handler': 4.3.0
+      '@smithy/types': 4.6.0
+      '@smithy/util-base64': 4.2.0
+      '@smithy/util-buffer-from': 4.2.0
+      '@smithy/util-hex-encoding': 4.2.0
+      '@smithy/util-utf8': 4.2.0
       tslib: 2.8.1
 
-  '@smithy/util-uri-escape@4.1.0':
+  '@smithy/util-uri-escape@4.2.0':
     dependencies:
       tslib: 2.8.1
 
@@ -17017,18 +16458,18 @@ snapshots:
       '@smithy/util-buffer-from': 2.2.0
       tslib: 2.8.1
 
-  '@smithy/util-utf8@4.1.0':
+  '@smithy/util-utf8@4.2.0':
     dependencies:
-      '@smithy/util-buffer-from': 4.1.0
+      '@smithy/util-buffer-from': 4.2.0
       tslib: 2.8.1
 
-  '@smithy/util-waiter@4.1.1':
+  '@smithy/util-waiter@4.2.0':
     dependencies:
-      '@smithy/abort-controller': 4.1.1
-      '@smithy/types': 4.5.0
+      '@smithy/abort-controller': 4.2.0
+      '@smithy/types': 4.6.0
       tslib: 2.8.1
 
-  '@smithy/uuid@1.0.0':
+  '@smithy/uuid@1.1.0':
     dependencies:
       tslib: 2.8.1
 
@@ -17036,50 +16477,50 @@ snapshots:
 
   '@standard-schema/utils@0.3.0': {}
 
-  '@storybook/addon-a11y@9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
+  '@storybook/addon-a11y@9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
     dependencies:
       '@storybook/global': 5.0.0
       axe-core: 4.10.3
-      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
 
-  '@storybook/addon-docs@9.1.10(@types/react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
+  '@storybook/addon-docs@9.1.10(@types/react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
     dependencies:
       '@mdx-js/react': 3.1.1(@types/react@19.2.0)(react@19.2.0)
-      '@storybook/csf-plugin': 9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
+      '@storybook/csf-plugin': 9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
       '@storybook/icons': 1.6.0(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
-      '@storybook/react-dom-shim': 9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
+      '@storybook/react-dom-shim': 9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
       react: 19.2.0
       react-dom: 19.2.0(react@19.2.0)
-      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       ts-dedent: 2.2.0
     transitivePeerDependencies:
       - '@types/react'
 
-  '@storybook/addon-vitest@9.1.10(@vitest/browser@3.2.4)(@vitest/runner@3.2.4)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(vitest@3.2.4)':
+  '@storybook/addon-vitest@9.1.10(@vitest/browser@3.2.4)(@vitest/runner@3.2.4)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(vitest@3.2.4)':
     dependencies:
       '@storybook/global': 5.0.0
       '@storybook/icons': 1.6.0(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       prompts: 2.4.2
-      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       ts-dedent: 2.2.0
     optionalDependencies:
-      '@vitest/browser': 3.2.4(playwright@1.55.1)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)
+      '@vitest/browser': 3.2.4(playwright@1.55.1)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)
       '@vitest/runner': 3.2.4
       vitest: 3.2.4(@types/debug@4.1.12)(@types/node@24.6.2)(@vitest/browser@3.2.4)(jiti@1.21.7)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - react
       - react-dom
 
-  '@storybook/builder-vite@9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
+  '@storybook/builder-vite@9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
-      '@storybook/csf-plugin': 9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
-      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      '@storybook/csf-plugin': 9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       ts-dedent: 2.2.0
-      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
 
-  '@storybook/csf-plugin@9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
+  '@storybook/csf-plugin@9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
     dependencies:
-      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       unplugin: 1.16.1
 
   '@storybook/global@5.0.0': {}
@@ -17089,39 +16530,39 @@ snapshots:
       react: 19.2.0
       react-dom: 19.2.0(react@19.2.0)
 
-  '@storybook/react-dom-shim@9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
+  '@storybook/react-dom-shim@9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
     dependencies:
       react: 19.2.0
       react-dom: 19.2.0(react@19.2.0)
-      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
 
-  '@storybook/react-vite@9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(rollup@2.79.2)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(typescript@5.9.3)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
+  '@storybook/react-vite@9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(rollup@2.79.2)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(typescript@5.9.3)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
-      '@joshwooding/vite-plugin-react-docgen-typescript': 0.6.1(typescript@5.9.3)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      '@joshwooding/vite-plugin-react-docgen-typescript': 0.6.1(typescript@5.9.3)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@rollup/pluginutils': 5.3.0(rollup@2.79.2)
-      '@storybook/builder-vite': 9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
-      '@storybook/react': 9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(typescript@5.9.3)
+      '@storybook/builder-vite': 9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      '@storybook/react': 9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(typescript@5.9.3)
       find-up: 7.0.0
       magic-string: 0.30.19
       react: 19.2.0
       react-docgen: 8.0.1
       react-dom: 19.2.0(react@19.2.0)
       resolve: 1.22.10
-      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       tsconfig-paths: 4.2.0
-      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - rollup
       - supports-color
       - typescript
 
-  '@storybook/react@9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(typescript@5.9.3)':
+  '@storybook/react@9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(typescript@5.9.3)':
     dependencies:
       '@storybook/global': 5.0.0
-      '@storybook/react-dom-shim': 9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
+      '@storybook/react-dom-shim': 9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
       react: 19.2.0
       react-dom: 19.2.0(react@19.2.0)
-      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
     optionalDependencies:
       typescript: 5.9.3
 
@@ -17187,11 +16628,11 @@ snapshots:
       '@swc/counter': 0.1.3
     optional: true
 
-  '@t3-oss/env-core@0.13.8(arktype@2.1.20)(typescript@5.9.2)(zod@4.1.8)':
+  '@t3-oss/env-core@0.13.8(arktype@2.1.20)(typescript@5.9.3)(zod@4.1.11)':
     optionalDependencies:
       arktype: 2.1.20
-      typescript: 5.9.2
-      zod: 4.1.8
+      typescript: 5.9.3
+      zod: 4.1.11
 
   '@t3-oss/env-core@0.13.8(arktype@2.1.20)(typescript@5.9.3)(zod@4.1.8)':
     optionalDependencies:
@@ -17268,52 +16709,52 @@ snapshots:
       postcss-selector-parser: 6.0.10
       tailwindcss: 4.1.14
 
-  '@tailwindcss/vite@4.1.14(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
+  '@tailwindcss/vite@4.1.14(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
       '@tailwindcss/node': 4.1.14
       '@tailwindcss/oxide': 4.1.14
       tailwindcss: 4.1.14
-      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
 
   '@tanstack/history@1.132.31': {}
 
-  '@tanstack/query-core@5.87.4': {}
+  '@tanstack/query-core@5.90.2': {}
 
-  '@tanstack/query-devtools@5.87.3': {}
+  '@tanstack/query-devtools@5.90.1': {}
 
-  '@tanstack/query-persist-client-core@5.87.4':
+  '@tanstack/query-persist-client-core@5.90.2':
     dependencies:
-      '@tanstack/query-core': 5.87.4
+      '@tanstack/query-core': 5.90.2
 
-  '@tanstack/query-sync-storage-persister@5.87.4':
+  '@tanstack/query-sync-storage-persister@5.90.2':
     dependencies:
-      '@tanstack/query-core': 5.87.4
-      '@tanstack/query-persist-client-core': 5.87.4
+      '@tanstack/query-core': 5.90.2
+      '@tanstack/query-persist-client-core': 5.90.2
 
-  '@tanstack/react-query-devtools@5.87.4(@tanstack/react-query@5.87.4(react@19.2.0))(react@19.2.0)':
+  '@tanstack/react-query-devtools@5.90.2(@tanstack/react-query@5.90.2(react@19.2.0))(react@19.2.0)':
     dependencies:
-      '@tanstack/query-devtools': 5.87.3
-      '@tanstack/react-query': 5.87.4(react@19.2.0)
+      '@tanstack/query-devtools': 5.90.1
+      '@tanstack/react-query': 5.90.2(react@19.2.0)
       react: 19.2.0
 
-  '@tanstack/react-query-persist-client@5.87.4(@tanstack/react-query@5.87.4(react@19.2.0))(react@19.2.0)':
+  '@tanstack/react-query-persist-client@5.90.2(@tanstack/react-query@5.90.2(react@19.2.0))(react@19.2.0)':
     dependencies:
-      '@tanstack/query-persist-client-core': 5.87.4
-      '@tanstack/react-query': 5.87.4(react@19.2.0)
+      '@tanstack/query-persist-client-core': 5.90.2
+      '@tanstack/react-query': 5.90.2(react@19.2.0)
       react: 19.2.0
 
-  '@tanstack/react-query@5.87.4(react@19.2.0)':
+  '@tanstack/react-query@5.90.2(react@19.2.0)':
     dependencies:
-      '@tanstack/query-core': 5.87.4
+      '@tanstack/query-core': 5.90.2
       react: 19.2.0
 
-  '@tanstack/react-router-devtools@1.132.31(@tanstack/react-router@1.132.31(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(@tanstack/router-core@1.132.31)(@types/node@24.6.2)(csstype@3.1.3)(jiti@1.21.7)(lightningcss@1.30.1)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.6)(yaml@2.8.1)':
+  '@tanstack/react-router-devtools@1.132.33(@tanstack/react-router@1.132.33(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(@tanstack/router-core@1.132.33)(@types/node@24.6.2)(csstype@3.1.3)(jiti@1.21.7)(lightningcss@1.30.1)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.6)(yaml@2.8.1)':
     dependencies:
-      '@tanstack/react-router': 1.132.31(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
-      '@tanstack/router-devtools-core': 1.132.31(@tanstack/router-core@1.132.31)(@types/node@24.6.2)(csstype@3.1.3)(jiti@1.21.7)(lightningcss@1.30.1)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.6)(yaml@2.8.1)
+      '@tanstack/react-router': 1.132.33(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@tanstack/router-devtools-core': 1.132.33(@tanstack/router-core@1.132.33)(@types/node@24.6.2)(csstype@3.1.3)(jiti@1.21.7)(lightningcss@1.30.1)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.6)(yaml@2.8.1)
       react: 19.2.0
       react-dom: 19.2.0(react@19.2.0)
-      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - '@tanstack/router-core'
       - '@types/node'
@@ -17331,11 +16772,11 @@ snapshots:
       - tsx
       - yaml
 
-  '@tanstack/react-router@1.132.31(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
+  '@tanstack/react-router@1.132.33(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@tanstack/history': 1.132.31
       '@tanstack/react-store': 0.7.7(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
-      '@tanstack/router-core': 1.132.31
+      '@tanstack/router-core': 1.132.33
       isbot: 5.1.31
       react: 19.2.0
       react-dom: 19.2.0(react@19.2.0)
@@ -17349,7 +16790,7 @@ snapshots:
       react-dom: 19.2.0(react@19.2.0)
       use-sync-external-store: 1.6.0(react@19.2.0)
 
-  '@tanstack/router-core@1.132.31':
+  '@tanstack/router-core@1.132.33':
     dependencies:
       '@tanstack/history': 1.132.31
       '@tanstack/store': 0.7.7
@@ -17359,14 +16800,14 @@ snapshots:
       tiny-invariant: 1.3.3
       tiny-warning: 1.0.3
 
-  '@tanstack/router-devtools-core@1.132.31(@tanstack/router-core@1.132.31)(@types/node@24.6.2)(csstype@3.1.3)(jiti@1.21.7)(lightningcss@1.30.1)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.6)(yaml@2.8.1)':
+  '@tanstack/router-devtools-core@1.132.33(@tanstack/router-core@1.132.33)(@types/node@24.6.2)(csstype@3.1.3)(jiti@1.21.7)(lightningcss@1.30.1)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.6)(yaml@2.8.1)':
     dependencies:
-      '@tanstack/router-core': 1.132.31
+      '@tanstack/router-core': 1.132.33
       clsx: 2.1.1
-      goober: 2.1.16(csstype@3.1.3)
+      goober: 2.1.18(csstype@3.1.3)
       solid-js: 1.9.9
       tiny-invariant: 1.3.3
-      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     optionalDependencies:
       csstype: 3.1.3
     transitivePeerDependencies:
@@ -17382,9 +16823,9 @@ snapshots:
       - tsx
       - yaml
 
-  '@tanstack/router-generator@1.132.31':
+  '@tanstack/router-generator@1.132.33':
     dependencies:
-      '@tanstack/router-core': 1.132.31
+      '@tanstack/router-core': 1.132.33
       '@tanstack/router-utils': 1.132.31
       '@tanstack/virtual-file-routes': 1.132.31
       prettier: 3.6.2
@@ -17395,7 +16836,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@tanstack/router-plugin@1.132.31(@tanstack/react-router@1.132.31(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
+  '@tanstack/router-plugin@1.132.33(@tanstack/react-router@1.132.33(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
       '@babel/core': 7.28.4
       '@babel/plugin-syntax-jsx': 7.27.1(@babel/core@7.28.4)
@@ -17403,8 +16844,8 @@ snapshots:
       '@babel/template': 7.27.2
       '@babel/traverse': 7.28.4
       '@babel/types': 7.28.4
-      '@tanstack/router-core': 1.132.31
-      '@tanstack/router-generator': 1.132.31
+      '@tanstack/router-core': 1.132.33
+      '@tanstack/router-generator': 1.132.33
       '@tanstack/router-utils': 1.132.31
       '@tanstack/virtual-file-routes': 1.132.31
       babel-dead-code-elimination: 1.0.10
@@ -17412,8 +16853,8 @@ snapshots:
       unplugin: 2.3.10
       zod: 3.25.76
     optionalDependencies:
-      '@tanstack/react-router': 1.132.31(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
-      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      '@tanstack/react-router': 1.132.33(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - supports-color
 
@@ -17614,7 +17055,7 @@ snapshots:
 
   '@types/connect@3.4.38':
     dependencies:
-      '@types/node': 24.5.2
+      '@types/node': 24.6.2
 
   '@types/css-font-loading-module@0.0.7': {}
 
@@ -17662,7 +17103,7 @@ snapshots:
 
   '@types/jsdom@21.1.7':
     dependencies:
-      '@types/node': 24.5.2
+      '@types/node': 24.6.2
       '@types/tough-cookie': 4.0.5
       parse5: 7.3.0
 
@@ -17671,7 +17112,7 @@ snapshots:
   '@types/jsonwebtoken@9.0.10':
     dependencies:
       '@types/ms': 2.1.0
-      '@types/node': 24.5.2
+      '@types/node': 24.6.2
 
   '@types/linkify-it@5.0.0': {}
 
@@ -17696,7 +17137,7 @@ snapshots:
 
   '@types/mysql@2.15.26':
     dependencies:
-      '@types/node': 24.5.2
+      '@types/node': 24.6.2
 
   '@types/node@20.19.19':
     dependencies:
@@ -17706,10 +17147,6 @@ snapshots:
     dependencies:
       undici-types: 6.21.0
 
-  '@types/node@24.5.2':
-    dependencies:
-      undici-types: 7.12.0
-
   '@types/node@24.6.2':
     dependencies:
       undici-types: 7.13.0
@@ -17718,7 +17155,7 @@ snapshots:
 
   '@types/papaparse@5.3.16':
     dependencies:
-      '@types/node': 24.5.2
+      '@types/node': 24.6.2
 
   '@types/pg-pool@2.0.6':
     dependencies:
@@ -17726,24 +17163,19 @@ snapshots:
 
   '@types/pg@8.15.5':
     dependencies:
-      '@types/node': 24.5.2
+      '@types/node': 24.6.2
       pg-protocol: 1.10.3
       pg-types: 2.2.0
 
   '@types/pg@8.6.1':
     dependencies:
-      '@types/node': 24.5.2
+      '@types/node': 24.6.2
       pg-protocol: 1.10.3
       pg-types: 2.2.0
 
   '@types/raf@3.4.3':
     optional: true
 
-  '@types/react-dom@19.2.0(@types/react@19.1.13)':
-    dependencies:
-      '@types/react': 19.1.13
-    optional: true
-
   '@types/react-dom@19.2.0(@types/react@19.2.0)':
     dependencies:
       '@types/react': 19.2.0
@@ -17752,10 +17184,6 @@ snapshots:
     dependencies:
       '@types/react': 19.2.0
 
-  '@types/react@19.1.13':
-    dependencies:
-      csstype: 3.1.3
-
   '@types/react@19.2.0':
     dependencies:
       csstype: 3.1.3
@@ -17772,7 +17200,7 @@ snapshots:
 
   '@types/tedious@4.0.14':
     dependencies:
-      '@types/node': 24.5.2
+      '@types/node': 24.6.2
 
   '@types/tough-cookie@4.0.5': {}
 
@@ -18115,11 +17543,11 @@ snapshots:
       react: 19.2.0
       react-dom: 19.2.0(react@19.2.0)
 
-  '@vitejs/plugin-basic-ssl@2.1.0(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
+  '@vitejs/plugin-basic-ssl@2.1.0(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
-      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
 
-  '@vitejs/plugin-react@4.7.0(vite@5.4.20(@types/node@24.5.2)(lightningcss@1.30.1)(terser@5.44.0))':
+  '@vitejs/plugin-react@4.7.0(vite@5.4.20(@types/node@24.6.2)(lightningcss@1.30.1)(terser@5.44.0))':
     dependencies:
       '@babel/core': 7.28.4
       '@babel/plugin-transform-react-jsx-self': 7.27.1(@babel/core@7.28.4)
@@ -18127,11 +17555,11 @@ snapshots:
       '@rolldown/pluginutils': 1.0.0-beta.27
       '@types/babel__core': 7.20.5
       react-refresh: 0.17.0
-      vite: 5.4.20(@types/node@24.5.2)(lightningcss@1.30.1)(terser@5.44.0)
+      vite: 5.4.20(@types/node@24.6.2)(lightningcss@1.30.1)(terser@5.44.0)
     transitivePeerDependencies:
       - supports-color
 
-  '@vitejs/plugin-react@5.0.4(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
+  '@vitejs/plugin-react@5.0.4(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
       '@babel/core': 7.28.4
       '@babel/plugin-transform-react-jsx-self': 7.27.1(@babel/core@7.28.4)
@@ -18139,15 +17567,15 @@ snapshots:
       '@rolldown/pluginutils': 1.0.0-beta.38
       '@types/babel__core': 7.20.5
       react-refresh: 0.17.0
-      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - supports-color
 
-  '@vitest/browser@3.2.4(playwright@1.55.1)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)':
+  '@vitest/browser@3.2.4(playwright@1.55.1)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)':
     dependencies:
       '@testing-library/dom': 10.4.1
       '@testing-library/user-event': 14.6.1(@testing-library/dom@10.4.1)
-      '@vitest/mocker': 3.2.4(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      '@vitest/mocker': 3.2.4(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@vitest/utils': 3.2.4
       magic-string: 0.30.19
       sirv: 3.0.2
@@ -18162,11 +17590,11 @@ snapshots:
       - utf-8-validate
       - vite
 
-  '@vitest/browser@3.2.4(playwright@1.55.1)(vite@7.1.8(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)':
+  '@vitest/browser@3.2.4(playwright@1.55.1)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)':
     dependencies:
       '@testing-library/dom': 10.4.1
       '@testing-library/user-event': 14.6.1(@testing-library/dom@10.4.1)
-      '@vitest/mocker': 3.2.4(vite@7.1.8(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      '@vitest/mocker': 3.2.4(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@vitest/utils': 3.2.4
       magic-string: 0.30.19
       sirv: 3.0.2
@@ -18199,7 +17627,7 @@ snapshots:
       tinyrainbow: 2.0.0
       vitest: 3.2.4(@types/debug@4.1.12)(@types/node@24.6.2)(@vitest/browser@3.2.4)(jiti@1.21.7)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     optionalDependencies:
-      '@vitest/browser': 3.2.4(playwright@1.55.1)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)
+      '@vitest/browser': 3.2.4(playwright@1.55.1)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)
     transitivePeerDependencies:
       - supports-color
 
@@ -18211,21 +17639,21 @@ snapshots:
       chai: 5.3.3
       tinyrainbow: 2.0.0
 
-  '@vitest/mocker@3.2.4(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
+  '@vitest/mocker@3.2.4(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
       '@vitest/spy': 3.2.4
       estree-walker: 3.0.3
       magic-string: 0.30.19
     optionalDependencies:
-      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
 
-  '@vitest/mocker@3.2.4(vite@7.1.8(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
+  '@vitest/mocker@3.2.4(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
       '@vitest/spy': 3.2.4
       estree-walker: 3.0.3
       magic-string: 0.30.19
     optionalDependencies:
-      vite: 7.1.8(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
 
   '@vitest/pretty-format@3.2.4':
     dependencies:
@@ -18459,7 +17887,7 @@ snapshots:
   autoprefixer@10.4.21(postcss@8.5.6):
     dependencies:
       browserslist: 4.26.3
-      caniuse-lite: 1.0.30001746
+      caniuse-lite: 1.0.30001747
       fraction.js: 4.3.7
       normalize-range: 0.1.2
       picocolors: 1.1.1
@@ -18541,7 +17969,7 @@ snapshots:
 
   base64-js@1.5.1: {}
 
-  baseline-browser-mapping@2.8.10: {}
+  baseline-browser-mapping@2.8.11: {}
 
   bcp-47-match@2.0.3: {}
 
@@ -18594,9 +18022,9 @@ snapshots:
 
   browserslist@4.26.3:
     dependencies:
-      baseline-browser-mapping: 2.8.10
-      caniuse-lite: 1.0.30001746
-      electron-to-chromium: 1.5.228
+      baseline-browser-mapping: 2.8.11
+      caniuse-lite: 1.0.30001747
+      electron-to-chromium: 1.5.230
       node-releases: 2.0.21
       update-browserslist-db: 1.1.3(browserslist@4.26.3)
 
@@ -18669,7 +18097,7 @@ snapshots:
 
   camelcase-css@2.0.1: {}
 
-  caniuse-lite@1.0.30001746: {}
+  caniuse-lite@1.0.30001747: {}
 
   canvas-confetti@1.9.3: {}
 
@@ -19182,8 +18610,6 @@ snapshots:
 
   dotenv@16.6.1: {}
 
-  dotenv@17.2.2: {}
-
   dotenv@17.2.3: {}
 
   drizzle-kit@0.30.3:
@@ -19195,7 +18621,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  drizzle-kit@0.31.4:
+  drizzle-kit@0.31.5:
     dependencies:
       '@drizzle-team/brocli': 0.10.2
       '@esbuild-kit/esm-loader': 2.6.5
@@ -19204,7 +18630,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  drizzle-orm@0.44.5(@electric-sql/pglite@0.3.10)(@libsql/client-wasm@0.14.0)(@opentelemetry/api@1.9.0)(@types/pg@8.15.5)(gel@2.0.2)(pg@8.16.3)(postgres@3.4.7):
+  drizzle-orm@0.44.6(@electric-sql/pglite@0.3.10)(@libsql/client-wasm@0.14.0)(@opentelemetry/api@1.9.0)(@types/pg@8.15.5)(gel@2.0.2)(pg@8.16.3)(postgres@3.4.7):
     optionalDependencies:
       '@electric-sql/pglite': 0.3.10
       '@libsql/client-wasm': 0.14.0
@@ -19214,9 +18640,9 @@ snapshots:
       pg: 8.16.3
       postgres: 3.4.7
 
-  drizzle-zod@0.8.3(drizzle-orm@0.44.5(@electric-sql/pglite@0.3.10)(@libsql/client-wasm@0.14.0)(@opentelemetry/api@1.9.0)(@types/pg@8.15.5)(gel@2.0.2)(pg@8.16.3)(postgres@3.4.7))(zod@4.1.8):
+  drizzle-zod@0.8.3(drizzle-orm@0.44.6(@electric-sql/pglite@0.3.10)(@libsql/client-wasm@0.14.0)(@opentelemetry/api@1.9.0)(@types/pg@8.15.5)(gel@2.0.2)(pg@8.16.3)(postgres@3.4.7))(zod@4.1.8):
     dependencies:
-      drizzle-orm: 0.44.5(@electric-sql/pglite@0.3.10)(@libsql/client-wasm@0.14.0)(@opentelemetry/api@1.9.0)(@types/pg@8.15.5)(gel@2.0.2)(pg@8.16.3)(postgres@3.4.7)
+      drizzle-orm: 0.44.6(@electric-sql/pglite@0.3.10)(@libsql/client-wasm@0.14.0)(@opentelemetry/api@1.9.0)(@types/pg@8.15.5)(gel@2.0.2)(pg@8.16.3)(postgres@3.4.7)
       zod: 4.1.8
 
   dunder-proto@1.0.1:
@@ -19247,7 +18673,7 @@ snapshots:
     dependencies:
       jake: 10.9.4
 
-  electron-to-chromium@1.5.228: {}
+  electron-to-chromium@1.5.230: {}
 
   embla-carousel-autoplay@8.6.0(embla-carousel@8.6.0):
     dependencies:
@@ -19688,8 +19114,6 @@ snapshots:
       iobuffer: 5.4.0
       pako: 2.1.0
 
-  fast-redact@3.5.0: {}
-
   fast-safe-stringify@2.1.1: {}
 
   fast-uri@3.1.0: {}
@@ -19741,7 +19165,7 @@ snapshots:
     dependencies:
       magic-string: 0.30.19
       mlly: 1.8.0
-      rollup: 4.52.2
+      rollup: 4.52.4
 
   flat-cache@3.2.0:
     dependencies:
@@ -19796,13 +19220,13 @@ snapshots:
 
   fraction.js@4.3.7: {}
 
-  framer-motion@11.12.0(@emotion/is-prop-valid@1.3.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
+  framer-motion@11.12.0(@emotion/is-prop-valid@1.3.1)(react-dom@19.2.0(react@19.2.0))(react@19.2.0):
     dependencies:
       tslib: 2.8.1
     optionalDependencies:
       '@emotion/is-prop-valid': 1.3.1
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
 
   framer-motion@12.23.22(@emotion/is-prop-valid@1.3.1)(react-dom@19.2.0(react@19.2.0))(react@19.2.0):
     dependencies:
@@ -19996,7 +19420,7 @@ snapshots:
 
   globrex@0.1.2: {}
 
-  goober@2.1.16(csstype@3.1.3):
+  goober@2.1.18(csstype@3.1.3):
     dependencies:
       csstype: 3.1.3
 
@@ -20329,12 +19753,6 @@ snapshots:
     transitivePeerDependencies:
       - encoding
 
-  i18next@25.5.2(typescript@5.9.2):
-    dependencies:
-      '@babel/runtime': 7.28.4
-    optionalDependencies:
-      typescript: 5.9.2
-
   i18next@25.5.3(typescript@5.9.3):
     dependencies:
       '@babel/runtime': 7.28.4
@@ -20741,7 +20159,7 @@ snapshots:
       json-schema: 0.4.0
       verror: 1.10.0
 
-  jsx-email@2.7.3(@emotion/is-prop-valid@1.3.1)(@jsx-email/plugin-inline@1.0.1)(@jsx-email/plugin-minify@1.0.1)(@jsx-email/plugin-pretty@1.0.0)(@types/node@24.5.2)(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(lightningcss@1.30.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(terser@5.44.0)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2))(typescript@5.9.2):
+  jsx-email@2.7.3(@emotion/is-prop-valid@1.3.1)(@jsx-email/plugin-inline@1.0.1)(@jsx-email/plugin-minify@1.0.1)(@jsx-email/plugin-pretty@1.0.0)(@types/node@24.6.2)(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(lightningcss@1.30.1)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(terser@5.44.0)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.6.2)(typescript@5.9.3))(typescript@5.9.3):
     dependencies:
       '@dot/log': 0.1.5
       '@jsx-email/doiuse-email': 1.0.4
@@ -20750,12 +20168,12 @@ snapshots:
       '@jsx-email/plugin-pretty': 1.0.0(jsx-email@2.7.3)
       '@parcel/watcher': 2.5.1
       '@radix-ui/colors': 3.0.0
-      '@radix-ui/react-collapsible': 1.1.1(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-icons': 1.3.2(react@19.1.1)
-      '@radix-ui/react-popover': 1.1.2(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-select': 2.2.6(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-slot': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-toggle-group': 1.1.0(@types/react-dom@19.2.0(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-collapsible': 1.1.1(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-icons': 1.3.2(react@19.2.0)
+      '@radix-ui/react-popover': 1.1.2(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-select': 2.2.6(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@radix-ui/react-slot': 1.1.0(@types/react@19.2.0)(react@19.2.0)
+      '@radix-ui/react-toggle-group': 1.1.0(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@unocss/core': 0.65.4
       '@unocss/preset-rem-to-px': 0.65.4
       '@unocss/preset-typography': 0.65.4
@@ -20763,39 +20181,39 @@ snapshots:
       '@unocss/preset-wind': 0.65.4
       '@unocss/transformer-compile-class': 0.65.4
       '@unocss/transformer-variant-group': 0.65.4
-      '@vitejs/plugin-react': 4.7.0(vite@5.4.20(@types/node@24.5.2)(lightningcss@1.30.1)(terser@5.44.0))
+      '@vitejs/plugin-react': 4.7.0(vite@5.4.20(@types/node@24.6.2)(lightningcss@1.30.1)(terser@5.44.0))
       autoprefixer: 10.4.21(postcss@8.5.6)
       chalk: 4.1.2
       classnames: 2.5.1
       debug: 4.4.3
       esbuild: 0.24.2
       find-up: 7.0.0
-      framer-motion: 11.12.0(@emotion/is-prop-valid@1.3.1)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      framer-motion: 11.12.0(@emotion/is-prop-valid@1.3.1)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       globby: 14.0.2
       hash-it: 6.0.0
       html-to-text: 9.0.5
       lilconfig: 3.1.3
       magic-string: 0.30.19
-      md-to-react-email: 5.0.4(react@19.1.1)
+      md-to-react-email: 5.0.4(react@19.2.0)
       micromatch: 4.0.8
       mime-types: 2.1.35
       mustache: 4.2.0
       postcss: 8.5.6
       postcss-var-replace: 1.0.0(postcss@8.5.6)
       pretty-bytes: 6.1.1
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
-      react-router-dom: 7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      react: 19.2.0
+      react-dom: 19.2.0(react@19.2.0)
+      react-router-dom: 7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       rehype: 13.0.2
       rehype-stringify: 10.0.1
       shiki: 1.29.2
       source-map-support: 0.5.21
       std-env: 3.9.0
-      tailwindcss: 3.4.15(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2))
+      tailwindcss: 3.4.15(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.6.2)(typescript@5.9.3))
       titleize: 4.0.0
       unist-util-visit: 5.0.0
-      valibot: 0.42.1(typescript@5.9.2)
-      vite: 5.4.20(@types/node@24.5.2)(lightningcss@1.30.1)(terser@5.44.0)
+      valibot: 0.42.1(typescript@5.9.3)
+      vite: 5.4.20(@types/node@24.6.2)(lightningcss@1.30.1)(terser@5.44.0)
       yargs-parser: 21.1.1
     transitivePeerDependencies:
       - '@emotion/is-prop-valid'
@@ -20845,7 +20263,7 @@ snapshots:
       jiti: 2.6.1
       js-yaml: 4.1.0
       minimist: 1.2.8
-      oxc-resolver: 11.8.4
+      oxc-resolver: 11.9.0
       picocolors: 1.1.1
       picomatch: 4.0.3
       smol-toml: 1.4.2
@@ -21064,10 +20482,10 @@ snapshots:
 
   math-intrinsics@1.1.0: {}
 
-  md-to-react-email@5.0.4(react@19.1.1):
+  md-to-react-email@5.0.4(react@19.2.0):
     dependencies:
       marked: 7.0.4
-      react: 19.1.1
+      react: 19.2.0
 
   mdast-util-find-and-replace@3.0.2:
     dependencies:
@@ -21185,7 +20603,7 @@ snapshots:
 
   mdurl@2.0.0: {}
 
-  media-chrome@4.13.1(react@19.2.0):
+  media-chrome@4.14.0(react@19.2.0):
     dependencies:
       ce-la-react: 0.3.1(react@19.2.0)
     transitivePeerDependencies:
@@ -21511,8 +20929,6 @@ snapshots:
   napi-build-utils@2.0.0:
     optional: true
 
-  napi-postinstall@0.3.3: {}
-
   natural-compare@1.4.0: {}
 
   neo-async@2.6.2: {}
@@ -21646,29 +21062,27 @@ snapshots:
       object-keys: 1.1.1
       safe-push-apply: 1.0.0
 
-  oxc-resolver@11.8.4:
-    dependencies:
-      napi-postinstall: 0.3.3
+  oxc-resolver@11.9.0:
     optionalDependencies:
-      '@oxc-resolver/binding-android-arm-eabi': 11.8.4
-      '@oxc-resolver/binding-android-arm64': 11.8.4
-      '@oxc-resolver/binding-darwin-arm64': 11.8.4
-      '@oxc-resolver/binding-darwin-x64': 11.8.4
-      '@oxc-resolver/binding-freebsd-x64': 11.8.4
-      '@oxc-resolver/binding-linux-arm-gnueabihf': 11.8.4
-      '@oxc-resolver/binding-linux-arm-musleabihf': 11.8.4
-      '@oxc-resolver/binding-linux-arm64-gnu': 11.8.4
-      '@oxc-resolver/binding-linux-arm64-musl': 11.8.4
-      '@oxc-resolver/binding-linux-ppc64-gnu': 11.8.4
-      '@oxc-resolver/binding-linux-riscv64-gnu': 11.8.4
-      '@oxc-resolver/binding-linux-riscv64-musl': 11.8.4
-      '@oxc-resolver/binding-linux-s390x-gnu': 11.8.4
-      '@oxc-resolver/binding-linux-x64-gnu': 11.8.4
-      '@oxc-resolver/binding-linux-x64-musl': 11.8.4
-      '@oxc-resolver/binding-wasm32-wasi': 11.8.4
-      '@oxc-resolver/binding-win32-arm64-msvc': 11.8.4
-      '@oxc-resolver/binding-win32-ia32-msvc': 11.8.4
-      '@oxc-resolver/binding-win32-x64-msvc': 11.8.4
+      '@oxc-resolver/binding-android-arm-eabi': 11.9.0
+      '@oxc-resolver/binding-android-arm64': 11.9.0
+      '@oxc-resolver/binding-darwin-arm64': 11.9.0
+      '@oxc-resolver/binding-darwin-x64': 11.9.0
+      '@oxc-resolver/binding-freebsd-x64': 11.9.0
+      '@oxc-resolver/binding-linux-arm-gnueabihf': 11.9.0
+      '@oxc-resolver/binding-linux-arm-musleabihf': 11.9.0
+      '@oxc-resolver/binding-linux-arm64-gnu': 11.9.0
+      '@oxc-resolver/binding-linux-arm64-musl': 11.9.0
+      '@oxc-resolver/binding-linux-ppc64-gnu': 11.9.0
+      '@oxc-resolver/binding-linux-riscv64-gnu': 11.9.0
+      '@oxc-resolver/binding-linux-riscv64-musl': 11.9.0
+      '@oxc-resolver/binding-linux-s390x-gnu': 11.9.0
+      '@oxc-resolver/binding-linux-x64-gnu': 11.9.0
+      '@oxc-resolver/binding-linux-x64-musl': 11.9.0
+      '@oxc-resolver/binding-wasm32-wasi': 11.9.0
+      '@oxc-resolver/binding-win32-arm64-msvc': 11.9.0
+      '@oxc-resolver/binding-win32-ia32-msvc': 11.9.0
+      '@oxc-resolver/binding-win32-x64-msvc': 11.9.0
 
   p-defer@3.0.0: {}
 
@@ -21835,7 +21249,7 @@ snapshots:
   pino-http@10.5.0:
     dependencies:
       get-caller-file: 2.0.5
-      pino: 9.11.0
+      pino: 9.13.1
       pino-std-serializers: 7.0.0
       process-warning: 5.0.0
 
@@ -21857,10 +21271,9 @@ snapshots:
 
   pino-std-serializers@7.0.0: {}
 
-  pino@9.11.0:
+  pino@9.13.1:
     dependencies:
       atomic-sleep: 1.0.0
-      fast-redact: 3.5.0
       on-exit-leak-free: 2.1.2
       pino-abstract-transport: 2.0.0
       pino-std-serializers: 7.0.0
@@ -21868,6 +21281,7 @@ snapshots:
       quick-format-unescaped: 4.0.4
       real-require: 0.2.0
       safe-stable-stringify: 2.5.0
+      slow-redact: 0.3.0
       sonic-boom: 4.2.0
       thread-stream: 3.1.0
 
@@ -21879,9 +21293,9 @@ snapshots:
       mlly: 1.8.0
       pathe: 2.0.3
 
-  player.style@0.2.0(react@19.2.0):
+  player.style@0.3.0(react@19.2.0):
     dependencies:
-      media-chrome: 4.13.1(react@19.2.0)
+      media-chrome: 4.14.0(react@19.2.0)
     transitivePeerDependencies:
       - react
 
@@ -21907,13 +21321,13 @@ snapshots:
       camelcase-css: 2.0.1
       postcss: 8.5.6
 
-  postcss-load-config@4.0.2(postcss@8.5.6)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2)):
+  postcss-load-config@4.0.2(postcss@8.5.6)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.6.2)(typescript@5.9.3)):
     dependencies:
       lilconfig: 3.1.3
       yaml: 2.8.1
     optionalDependencies:
       postcss: 8.5.6
-      ts-node: 10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2)
+      ts-node: 10.9.2(@swc/core@1.7.26)(@types/node@24.6.2)(typescript@5.9.3)
 
   postcss-load-config@6.0.1(jiti@1.21.7)(postcss@8.5.6)(tsx@4.20.6)(yaml@2.8.1):
     dependencies:
@@ -21933,13 +21347,13 @@ snapshots:
       tsx: 4.20.3
       yaml: 2.8.1
 
-  postcss-load-config@6.0.1(jiti@2.6.1)(postcss@8.5.6)(tsx@4.20.5)(yaml@2.8.1):
+  postcss-load-config@6.0.1(jiti@2.6.1)(postcss@8.5.6)(tsx@4.20.6)(yaml@2.8.1):
     dependencies:
       lilconfig: 3.1.3
     optionalDependencies:
       jiti: 2.6.1
       postcss: 8.5.6
-      tsx: 4.20.5
+      tsx: 4.20.6
       yaml: 2.8.1
 
   postcss-nested@6.2.0(postcss@8.5.6):
@@ -22171,7 +21585,7 @@ snapshots:
       '@protobufjs/path': 1.1.2
       '@protobufjs/pool': 1.1.0
       '@protobufjs/utf8': 1.1.0
-      '@types/node': 24.5.2
+      '@types/node': 24.6.2
       long: 5.3.2
 
   proxy-from-env@1.1.0: {}
@@ -22259,11 +21673,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  react-dom@19.1.1(react@19.1.1):
-    dependencies:
-      react: 19.1.1
-      scheduler: 0.26.0
-
   react-dom@19.2.0(react@19.2.0):
     dependencies:
       react: 19.2.0
@@ -22278,16 +21687,6 @@ snapshots:
     dependencies:
       react: 19.2.0
 
-  react-i18next@15.7.3(i18next@25.5.2(typescript@5.9.2))(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(typescript@5.9.2):
-    dependencies:
-      '@babel/runtime': 7.28.4
-      html-parse-stringify: 3.0.1
-      i18next: 25.5.2(typescript@5.9.2)
-      react: 19.1.1
-    optionalDependencies:
-      react-dom: 19.1.1(react@19.1.1)
-      typescript: 5.9.2
-
   react-i18next@15.7.4(i18next@25.5.3(typescript@5.9.3))(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(typescript@5.9.3):
     dependencies:
       '@babel/runtime': 7.28.4
@@ -22342,14 +21741,6 @@ snapshots:
 
   react-refresh@0.17.0: {}
 
-  react-remove-scroll-bar@2.3.8(@types/react@19.1.13)(react@19.1.1):
-    dependencies:
-      react: 19.1.1
-      react-style-singleton: 2.2.3(@types/react@19.1.13)(react@19.1.1)
-      tslib: 2.8.1
-    optionalDependencies:
-      '@types/react': 19.1.13
-
   react-remove-scroll-bar@2.3.8(@types/react@19.2.0)(react@19.2.0):
     dependencies:
       react: 19.2.0
@@ -22358,27 +21749,16 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.2.0
 
-  react-remove-scroll@2.6.0(@types/react@19.1.13)(react@19.1.1):
-    dependencies:
-      react: 19.1.1
-      react-remove-scroll-bar: 2.3.8(@types/react@19.1.13)(react@19.1.1)
-      react-style-singleton: 2.2.3(@types/react@19.1.13)(react@19.1.1)
-      tslib: 2.8.1
-      use-callback-ref: 1.3.3(@types/react@19.1.13)(react@19.1.1)
-      use-sidecar: 1.1.3(@types/react@19.1.13)(react@19.1.1)
-    optionalDependencies:
-      '@types/react': 19.1.13
-
-  react-remove-scroll@2.7.1(@types/react@19.1.13)(react@19.1.1):
+  react-remove-scroll@2.6.0(@types/react@19.2.0)(react@19.2.0):
     dependencies:
-      react: 19.1.1
-      react-remove-scroll-bar: 2.3.8(@types/react@19.1.13)(react@19.1.1)
-      react-style-singleton: 2.2.3(@types/react@19.1.13)(react@19.1.1)
+      react: 19.2.0
+      react-remove-scroll-bar: 2.3.8(@types/react@19.2.0)(react@19.2.0)
+      react-style-singleton: 2.2.3(@types/react@19.2.0)(react@19.2.0)
       tslib: 2.8.1
-      use-callback-ref: 1.3.3(@types/react@19.1.13)(react@19.1.1)
-      use-sidecar: 1.1.3(@types/react@19.1.13)(react@19.1.1)
+      use-callback-ref: 1.3.3(@types/react@19.2.0)(react@19.2.0)
+      use-sidecar: 1.1.3(@types/react@19.2.0)(react@19.2.0)
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.2.0
 
   react-remove-scroll@2.7.1(@types/react@19.2.0)(react@19.2.0):
     dependencies:
@@ -22396,27 +21776,11 @@ snapshots:
       react: 19.2.0
       react-dom: 19.2.0(react@19.2.0)
 
-  react-router-dom@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
-    dependencies:
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
-      react-router: 7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-
   react-router-dom@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0):
     dependencies:
       react: 19.2.0
       react-dom: 19.2.0(react@19.2.0)
       react-router: 7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
-    optional: true
-
-  react-router@7.5.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
-    dependencies:
-      cookie: 1.0.2
-      react: 19.1.1
-      set-cookie-parser: 2.7.1
-      turbo-stream: 2.4.0
-    optionalDependencies:
-      react-dom: 19.1.1(react@19.1.1)
 
   react-router@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0):
     dependencies:
@@ -22426,7 +21790,6 @@ snapshots:
       turbo-stream: 2.4.0
     optionalDependencies:
       react-dom: 19.2.0(react@19.2.0)
-    optional: true
 
   react-scan@0.4.3(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react-router-dom@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react-router@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react@19.2.0)(rollup@2.79.2):
     dependencies:
@@ -22458,14 +21821,6 @@ snapshots:
       - rollup
       - supports-color
 
-  react-style-singleton@2.2.3(@types/react@19.1.13)(react@19.1.1):
-    dependencies:
-      get-nonce: 1.0.1
-      react: 19.1.1
-      tslib: 2.8.1
-    optionalDependencies:
-      '@types/react': 19.1.13
-
   react-style-singleton@2.2.3(@types/react@19.2.0)(react@19.2.0):
     dependencies:
       get-nonce: 1.0.1
@@ -22478,8 +21833,6 @@ snapshots:
     dependencies:
       react: 19.2.0
 
-  react@19.1.1: {}
-
   react@19.2.0: {}
 
   read-cache@1.0.0:
@@ -22868,60 +22221,32 @@ snapshots:
     optionalDependencies:
       fsevents: 2.3.3
 
-  rollup@4.52.2:
+  rollup@4.52.4:
     dependencies:
       '@types/estree': 1.0.8
     optionalDependencies:
-      '@rollup/rollup-android-arm-eabi': 4.52.2
-      '@rollup/rollup-android-arm64': 4.52.2
-      '@rollup/rollup-darwin-arm64': 4.52.2
-      '@rollup/rollup-darwin-x64': 4.52.2
-      '@rollup/rollup-freebsd-arm64': 4.52.2
-      '@rollup/rollup-freebsd-x64': 4.52.2
-      '@rollup/rollup-linux-arm-gnueabihf': 4.52.2
-      '@rollup/rollup-linux-arm-musleabihf': 4.52.2
-      '@rollup/rollup-linux-arm64-gnu': 4.52.2
-      '@rollup/rollup-linux-arm64-musl': 4.52.2
-      '@rollup/rollup-linux-loong64-gnu': 4.52.2
-      '@rollup/rollup-linux-ppc64-gnu': 4.52.2
-      '@rollup/rollup-linux-riscv64-gnu': 4.52.2
-      '@rollup/rollup-linux-riscv64-musl': 4.52.2
-      '@rollup/rollup-linux-s390x-gnu': 4.52.2
-      '@rollup/rollup-linux-x64-gnu': 4.52.2
-      '@rollup/rollup-linux-x64-musl': 4.52.2
-      '@rollup/rollup-openharmony-arm64': 4.52.2
-      '@rollup/rollup-win32-arm64-msvc': 4.52.2
-      '@rollup/rollup-win32-ia32-msvc': 4.52.2
-      '@rollup/rollup-win32-x64-gnu': 4.52.2
-      '@rollup/rollup-win32-x64-msvc': 4.52.2
-      fsevents: 2.3.3
-
-  rollup@4.52.3:
-    dependencies:
-      '@types/estree': 1.0.8
-    optionalDependencies:
-      '@rollup/rollup-android-arm-eabi': 4.52.3
-      '@rollup/rollup-android-arm64': 4.52.3
-      '@rollup/rollup-darwin-arm64': 4.52.3
-      '@rollup/rollup-darwin-x64': 4.52.3
-      '@rollup/rollup-freebsd-arm64': 4.52.3
-      '@rollup/rollup-freebsd-x64': 4.52.3
-      '@rollup/rollup-linux-arm-gnueabihf': 4.52.3
-      '@rollup/rollup-linux-arm-musleabihf': 4.52.3
-      '@rollup/rollup-linux-arm64-gnu': 4.52.3
-      '@rollup/rollup-linux-arm64-musl': 4.52.3
-      '@rollup/rollup-linux-loong64-gnu': 4.52.3
-      '@rollup/rollup-linux-ppc64-gnu': 4.52.3
-      '@rollup/rollup-linux-riscv64-gnu': 4.52.3
-      '@rollup/rollup-linux-riscv64-musl': 4.52.3
-      '@rollup/rollup-linux-s390x-gnu': 4.52.3
-      '@rollup/rollup-linux-x64-gnu': 4.52.3
-      '@rollup/rollup-linux-x64-musl': 4.52.3
-      '@rollup/rollup-openharmony-arm64': 4.52.3
-      '@rollup/rollup-win32-arm64-msvc': 4.52.3
-      '@rollup/rollup-win32-ia32-msvc': 4.52.3
-      '@rollup/rollup-win32-x64-gnu': 4.52.3
-      '@rollup/rollup-win32-x64-msvc': 4.52.3
+      '@rollup/rollup-android-arm-eabi': 4.52.4
+      '@rollup/rollup-android-arm64': 4.52.4
+      '@rollup/rollup-darwin-arm64': 4.52.4
+      '@rollup/rollup-darwin-x64': 4.52.4
+      '@rollup/rollup-freebsd-arm64': 4.52.4
+      '@rollup/rollup-freebsd-x64': 4.52.4
+      '@rollup/rollup-linux-arm-gnueabihf': 4.52.4
+      '@rollup/rollup-linux-arm-musleabihf': 4.52.4
+      '@rollup/rollup-linux-arm64-gnu': 4.52.4
+      '@rollup/rollup-linux-arm64-musl': 4.52.4
+      '@rollup/rollup-linux-loong64-gnu': 4.52.4
+      '@rollup/rollup-linux-ppc64-gnu': 4.52.4
+      '@rollup/rollup-linux-riscv64-gnu': 4.52.4
+      '@rollup/rollup-linux-riscv64-musl': 4.52.4
+      '@rollup/rollup-linux-s390x-gnu': 4.52.4
+      '@rollup/rollup-linux-x64-gnu': 4.52.4
+      '@rollup/rollup-linux-x64-musl': 4.52.4
+      '@rollup/rollup-openharmony-arm64': 4.52.4
+      '@rollup/rollup-win32-arm64-msvc': 4.52.4
+      '@rollup/rollup-win32-ia32-msvc': 4.52.4
+      '@rollup/rollup-win32-x64-gnu': 4.52.4
+      '@rollup/rollup-win32-x64-msvc': 4.52.4
       fsevents: 2.3.3
 
   rope-sequence@1.3.4: {}
@@ -22986,8 +22311,6 @@ snapshots:
     dependencies:
       xmlchars: 2.2.0
 
-  scheduler@0.26.0: {}
-
   scheduler@0.27.0: {}
 
   secure-json-parse@4.0.0: {}
@@ -23115,6 +22438,8 @@ snapshots:
 
   slash@5.1.0: {}
 
+  slow-redact@0.3.0: {}
+
   slugify@1.6.6: {}
 
   smob@1.5.0: {}
@@ -23183,13 +22508,13 @@ snapshots:
       es-errors: 1.3.0
       internal-slot: 1.1.0
 
-  storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)):
+  storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)):
     dependencies:
       '@storybook/global': 5.0.0
       '@testing-library/jest-dom': 6.9.1
       '@testing-library/user-event': 14.6.1(@testing-library/dom@10.4.1)
       '@vitest/expect': 3.2.4
-      '@vitest/mocker': 3.2.4(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      '@vitest/mocker': 3.2.4(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@vitest/spy': 3.2.4
       better-opn: 3.0.2
       esbuild: 0.25.10
@@ -23311,7 +22636,7 @@ snapshots:
 
   strnum@2.1.1: {}
 
-  style-to-object@1.0.9:
+  style-to-object@1.0.11:
     dependencies:
       inline-style-parser: 0.2.4
 
@@ -23354,7 +22679,7 @@ snapshots:
     dependencies:
       tailwindcss: 4.1.14
 
-  tailwindcss@3.4.15(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2)):
+  tailwindcss@3.4.15(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.6.2)(typescript@5.9.3)):
     dependencies:
       '@alloc/quick-lru': 5.2.0
       arg: 5.0.2
@@ -23373,7 +22698,7 @@ snapshots:
       postcss: 8.5.6
       postcss-import: 15.1.0(postcss@8.5.6)
       postcss-js: 4.1.0(postcss@8.5.6)
-      postcss-load-config: 4.0.2(postcss@8.5.6)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2))
+      postcss-load-config: 4.0.2(postcss@8.5.6)(ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.6.2)(typescript@5.9.3))
       postcss-nested: 6.2.0(postcss@8.5.6)
       postcss-selector-parser: 6.1.2
       resolve: 1.22.10
@@ -23564,21 +22889,21 @@ snapshots:
 
   ts-interface-checker@0.1.13: {}
 
-  ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.5.2)(typescript@5.9.2):
+  ts-node@10.9.2(@swc/core@1.7.26)(@types/node@24.6.2)(typescript@5.9.3):
     dependencies:
       '@cspotcode/source-map-support': 0.8.1
       '@tsconfig/node10': 1.0.11
       '@tsconfig/node12': 1.0.11
       '@tsconfig/node14': 1.0.3
       '@tsconfig/node16': 1.0.4
-      '@types/node': 24.5.2
+      '@types/node': 24.6.2
       acorn: 8.15.0
       acorn-walk: 8.3.4
       arg: 4.1.3
       create-require: 1.1.1
       diff: 4.0.2
       make-error: 1.3.6
-      typescript: 5.9.2
+      typescript: 5.9.3
       v8-compile-cache-lib: 3.0.1
       yn: 3.1.1
     optionalDependencies:
@@ -23610,7 +22935,7 @@ snapshots:
       picocolors: 1.1.1
       postcss-load-config: 6.0.1(jiti@2.6.1)(postcss@8.5.6)(tsx@4.20.3)(yaml@2.8.1)
       resolve-from: 5.0.0
-      rollup: 4.52.2
+      rollup: 4.52.4
       source-map: 0.8.0-beta.0
       sucrase: 3.35.0
       tinyexec: 0.3.2
@@ -23626,7 +22951,7 @@ snapshots:
       - tsx
       - yaml
 
-  tsup@8.5.0(@swc/core@1.7.26)(jiti@2.6.1)(postcss@8.5.6)(tsx@4.20.5)(typescript@5.9.2)(yaml@2.8.1):
+  tsup@8.5.0(@swc/core@1.7.26)(jiti@2.6.1)(postcss@8.5.6)(tsx@4.20.6)(typescript@5.9.3)(yaml@2.8.1):
     dependencies:
       bundle-require: 5.1.0(esbuild@0.25.10)
       cac: 6.7.14
@@ -23637,9 +22962,9 @@ snapshots:
       fix-dts-default-cjs-exports: 1.0.1
       joycon: 3.1.1
       picocolors: 1.1.1
-      postcss-load-config: 6.0.1(jiti@2.6.1)(postcss@8.5.6)(tsx@4.20.5)(yaml@2.8.1)
+      postcss-load-config: 6.0.1(jiti@2.6.1)(postcss@8.5.6)(tsx@4.20.6)(yaml@2.8.1)
       resolve-from: 5.0.0
-      rollup: 4.52.2
+      rollup: 4.52.4
       source-map: 0.8.0-beta.0
       sucrase: 3.35.0
       tinyexec: 0.3.2
@@ -23648,7 +22973,7 @@ snapshots:
     optionalDependencies:
       '@swc/core': 1.7.26
       postcss: 8.5.6
-      typescript: 5.9.2
+      typescript: 5.9.3
     transitivePeerDependencies:
       - jiti
       - supports-color
@@ -23662,13 +22987,6 @@ snapshots:
     optionalDependencies:
       fsevents: 2.3.3
 
-  tsx@4.20.5:
-    dependencies:
-      esbuild: 0.25.10
-      get-tsconfig: 4.10.1
-    optionalDependencies:
-      fsevents: 2.3.3
-
   tsx@4.20.6:
     dependencies:
       esbuild: 0.25.10
@@ -23706,6 +23024,8 @@ snapshots:
 
   type-fest@3.13.1: {}
 
+  type-fest@4.41.0: {}
+
   typed-array-buffer@1.0.3:
     dependencies:
       call-bound: 1.0.4
@@ -23741,8 +23061,6 @@ snapshots:
 
   typescript@5.8.3: {}
 
-  typescript@5.9.2: {}
-
   typescript@5.9.3: {}
 
   ua-is-frozen@0.1.2: {}
@@ -23770,8 +23088,6 @@ snapshots:
 
   undici-types@6.21.0: {}
 
-  undici-types@7.12.0: {}
-
   undici-types@7.13.0: {}
 
   undici@7.16.0: {}
@@ -23883,13 +23199,6 @@ snapshots:
       querystringify: 2.2.0
       requires-port: 1.0.0
 
-  use-callback-ref@1.3.3(@types/react@19.1.13)(react@19.1.1):
-    dependencies:
-      react: 19.1.1
-      tslib: 2.8.1
-    optionalDependencies:
-      '@types/react': 19.1.13
-
   use-callback-ref@1.3.3(@types/react@19.2.0)(react@19.2.0):
     dependencies:
       react: 19.2.0
@@ -23906,14 +23215,6 @@ snapshots:
     dependencies:
       react: 19.2.0
 
-  use-sidecar@1.1.3(@types/react@19.1.13)(react@19.1.1):
-    dependencies:
-      detect-node-es: 1.1.0
-      react: 19.1.1
-      tslib: 2.8.1
-    optionalDependencies:
-      '@types/react': 19.1.13
-
   use-sidecar@1.1.3(@types/react@19.2.0)(react@19.2.0):
     dependencies:
       detect-node-es: 1.1.0
@@ -23940,9 +23241,9 @@ snapshots:
   v8-compile-cache-lib@3.0.1:
     optional: true
 
-  valibot@0.42.1(typescript@5.9.2):
+  valibot@0.42.1(typescript@5.9.3):
     optionalDependencies:
-      typescript: 5.9.2
+      typescript: 5.9.3
 
   validate-npm-package-name@5.0.1: {}
 
@@ -23993,7 +23294,7 @@ snapshots:
       d3-time: 3.1.0
       d3-timer: 3.0.1
 
-  virtua@0.43.6(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(solid-js@1.9.9)(vue@3.5.13(typescript@5.9.3)):
+  virtua@0.44.0(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(solid-js@1.9.9)(vue@3.5.13(typescript@5.9.3)):
     optionalDependencies:
       react: 19.2.0
       react-dom: 19.2.0(react@19.2.0)
@@ -24006,7 +23307,7 @@ snapshots:
       debug: 4.4.3
       es-module-lexer: 1.7.0
       pathe: 2.0.3
-      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - '@types/node'
       - jiti
@@ -24027,7 +23328,7 @@ snapshots:
       debug: 4.4.3
       es-module-lexer: 1.7.0
       pathe: 2.0.3
-      vite: 7.1.8(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - '@types/node'
       - jiti
@@ -24042,7 +23343,7 @@ snapshots:
       - tsx
       - yaml
 
-  vite-plugin-html@3.2.2(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)):
+  vite-plugin-html@3.2.2(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)):
     dependencies:
       '@rollup/pluginutils': 4.2.1
       colorette: 2.0.20
@@ -24056,57 +23357,57 @@ snapshots:
       html-minifier-terser: 6.1.0
       node-html-parser: 5.4.2
       pathe: 0.2.0
-      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
 
-  vite-plugin-pwa@1.0.3(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(workbox-build@7.3.0(@types/babel__core@7.20.5))(workbox-window@7.3.0):
+  vite-plugin-pwa@1.0.3(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(workbox-build@7.3.0(@types/babel__core@7.20.5))(workbox-window@7.3.0):
     dependencies:
       debug: 4.4.3
       pretty-bytes: 6.1.1
       tinyglobby: 0.2.15
-      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
       workbox-build: 7.3.0(@types/babel__core@7.20.5)
       workbox-window: 7.3.0
     transitivePeerDependencies:
       - supports-color
 
-  vite-plugin-static-copy@3.1.3(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)):
+  vite-plugin-static-copy@3.1.3(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)):
     dependencies:
       chokidar: 3.6.0
       fs-extra: 11.3.2
       p-map: 7.0.3
       picocolors: 1.1.1
       tinyglobby: 0.2.15
-      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
 
-  vite-tsconfig-paths@5.1.4(typescript@5.9.3)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)):
+  vite-tsconfig-paths@5.1.4(typescript@5.9.3)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)):
     dependencies:
       debug: 4.4.3
       globrex: 0.1.2
       tsconfck: 3.1.6(typescript@5.9.3)
     optionalDependencies:
-      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - supports-color
       - typescript
 
-  vite@5.4.20(@types/node@24.5.2)(lightningcss@1.30.1)(terser@5.44.0):
+  vite@5.4.20(@types/node@24.6.2)(lightningcss@1.30.1)(terser@5.44.0):
     dependencies:
       esbuild: 0.21.5
       postcss: 8.5.6
-      rollup: 4.52.3
+      rollup: 4.52.4
     optionalDependencies:
-      '@types/node': 24.5.2
+      '@types/node': 24.6.2
       fsevents: 2.3.3
       lightningcss: 1.30.1
       terser: 5.44.0
 
-  vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1):
+  vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1):
     dependencies:
       esbuild: 0.25.10
       fdir: 6.5.0(picomatch@4.0.3)
       picomatch: 4.0.3
       postcss: 8.5.6
-      rollup: 4.52.3
+      rollup: 4.52.4
       tinyglobby: 0.2.15
     optionalDependencies:
       '@types/node': 24.6.2
@@ -24117,13 +23418,13 @@ snapshots:
       tsx: 4.20.6
       yaml: 2.8.1
 
-  vite@7.1.8(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1):
+  vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1):
     dependencies:
       esbuild: 0.25.10
       fdir: 6.5.0(picomatch@4.0.3)
       picomatch: 4.0.3
       postcss: 8.5.6
-      rollup: 4.52.3
+      rollup: 4.52.4
       tinyglobby: 0.2.15
     optionalDependencies:
       '@types/node': 24.6.2
@@ -24138,7 +23439,7 @@ snapshots:
     dependencies:
       '@types/chai': 5.2.2
       '@vitest/expect': 3.2.4
-      '@vitest/mocker': 3.2.4(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      '@vitest/mocker': 3.2.4(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@vitest/pretty-format': 3.2.4
       '@vitest/runner': 3.2.4
       '@vitest/snapshot': 3.2.4
@@ -24156,13 +23457,13 @@ snapshots:
       tinyglobby: 0.2.15
       tinypool: 1.1.1
       tinyrainbow: 2.0.0
-      vite: 7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
       vite-node: 3.2.4(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
       why-is-node-running: 2.3.0
     optionalDependencies:
       '@types/debug': 4.1.12
       '@types/node': 24.6.2
-      '@vitest/browser': 3.2.4(playwright@1.55.1)(vite@7.1.8(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)
+      '@vitest/browser': 3.2.4(playwright@1.55.1)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)
       jsdom: 26.1.0(canvas@3.2.0)
     transitivePeerDependencies:
       - jiti
@@ -24182,7 +23483,7 @@ snapshots:
     dependencies:
       '@types/chai': 5.2.2
       '@vitest/expect': 3.2.4
-      '@vitest/mocker': 3.2.4(vite@7.1.8(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      '@vitest/mocker': 3.2.4(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@vitest/pretty-format': 3.2.4
       '@vitest/runner': 3.2.4
       '@vitest/snapshot': 3.2.4
@@ -24200,13 +23501,13 @@ snapshots:
       tinyglobby: 0.2.15
       tinypool: 1.1.1
       tinyrainbow: 2.0.0
-      vite: 7.1.8(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
       vite-node: 3.2.4(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
       why-is-node-running: 2.3.0
     optionalDependencies:
       '@types/debug': 4.1.12
       '@types/node': 24.6.2
-      '@vitest/browser': 3.2.4(playwright@1.55.1)(vite@7.1.8(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)
+      '@vitest/browser': 3.2.4(playwright@1.55.1)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)
       jsdom: 26.1.0(canvas@3.2.0)
     transitivePeerDependencies:
       - jiti
@@ -24554,8 +23855,6 @@ snapshots:
 
   yoctocolors@2.1.1: {}
 
-  zod@3.24.1: {}
-
   zod@3.25.76: {}
 
   zod@4.1.11: {}

From 4d0f45402b2966e09e33a91101adf5461ffd8dcf Mon Sep 17 00:00:00 2001
From: David Hordiienko <90209095+LemonardoD@users.noreply.github.com>
Date: Sat, 4 Oct 2025 14:02:09 +0300
Subject: [PATCH 40/48] Refactor/sse (#630)

* refactor(SSE events): make naming more generalised, for scalabilitty

* refactor(addMenuItem):  remove section name

* refactor(FE SSE): add useTypedSSE

* chore: add todo

* refactor (useTypedSSE): simplify it

---------

Co-authored-by: flipvanhaaren <flip@shareworks.nl>
---
 backend/src/modules/memberships/handlers.ts   |  9 ++-
 backend/src/modules/organizations/handlers.ts |  4 +-
 frontend/src/modules/common/sse/index.tsx     | 60 ++++++++-----------
 .../menu-sheet/helpers/menu-operations.ts     | 38 +++++++-----
 frontend/src/modules/organizations/query.ts   |  2 +-
 5 files changed, 55 insertions(+), 58 deletions(-)

diff --git a/backend/src/modules/memberships/handlers.ts b/backend/src/modules/memberships/handlers.ts
index 1fc7a56d1..899a122df 100644
--- a/backend/src/modules/memberships/handlers.ts
+++ b/backend/src/modules/memberships/handlers.ts
@@ -171,13 +171,12 @@ const membershipRouteHandlers = app
 
         eventManager.emit('instantMembershipCreation', createdMembership);
 
-        sendSSEToUsers([userId], 'add_entity', {
+        sendSSEToUsers([userId], 'membership_created', {
           newItem: {
             ...entity,
             membership: createdMembership,
           },
-          sectionName: associatedEntity?.type || entity.entityType,
-          ...(associatedEntity && { parentIdOrSlug: associatedEntity.id }),
+          ...(associatedEntity && { attachToIdOrSlug: associatedEntity.id }),
         });
       }),
     );
@@ -290,7 +289,7 @@ const membershipRouteHandlers = app
 
     // Send the event to the user if they are a member of the organization
     const memberIds = targets.map((el) => el.userId);
-    sendSSEToUsers(memberIds, 'remove_entity', { id: entity.id, entityType: entity.entityType });
+    sendSSEToUsers(memberIds, 'membership_deleted', { id: entity.id, entityType: entity.entityType });
 
     logEvent('info', 'Deleted members', memberIds);
 
@@ -360,7 +359,7 @@ const membershipRouteHandlers = app
 
     // Trigger SSE notification only if the update is for a different user
     if (updatedMembership.userId !== user.id) {
-      sendSSEToUsers([updatedMembership.userId], 'update_entity', {
+      sendSSEToUsers([updatedMembership.userId], 'membership_updated', {
         ...membershipContext,
         membership: updatedMembership,
       });
diff --git a/backend/src/modules/organizations/handlers.ts b/backend/src/modules/organizations/handlers.ts
index f461569cd..cb946a5c0 100644
--- a/backend/src/modules/organizations/handlers.ts
+++ b/backend/src/modules/organizations/handlers.ts
@@ -197,7 +197,7 @@ const organizationRouteHandlers = app
           isNotNull(membershipsTable.activatedAt),
         ),
       );
-    for (const member of organizationMemberships) sendSSEToUsers([member.userId], 'update_entity', { ...updatedOrganization, member });
+    for (const member of organizationMemberships) sendSSEToUsers([member.userId], 'entity_updated', { ...updatedOrganization, member });
 
     logEvent('info', 'Organization updated', { organizationId: updatedOrganization.id });
 
@@ -243,7 +243,7 @@ const organizationRouteHandlers = app
       if (!memberIds.length) continue;
 
       const userIds = memberIds.map((m) => m.id);
-      sendSSEToUsers(userIds, 'remove_entity', { id, entityType: 'organization' });
+      sendSSEToUsers(userIds, 'entity_deleted', { id, entityType: 'organization' });
     }
 
     logEvent('info', 'Organizations deleted', allowedIds);
diff --git a/frontend/src/modules/common/sse/index.tsx b/frontend/src/modules/common/sse/index.tsx
index 4f2a5cad1..c8e69dce8 100644
--- a/frontend/src/modules/common/sse/index.tsx
+++ b/frontend/src/modules/common/sse/index.tsx
@@ -3,50 +3,38 @@ import { useSSE } from '~/modules/common/sse/use-sse';
 import type { UserMenuItem } from '~/modules/me/types';
 import { addMenuItem, deleteMenuItem, updateMenuItem } from '~/modules/navigation/menu-sheet/helpers/menu-operations';
 
-const SSE = () => {
-  // Handle incoming event to add a new entity to the menu
-  const addEntity = (e: MessageEvent<string>) => {
-    try {
-      const data = JSON.parse(e.data);
-      const { newItem, sectionName, parentSlug } = data;
-
-      // Add new menu item under correct section and parent(if exist)
-      addMenuItem(newItem as UserMenuItem, sectionName, parentSlug);
-    } catch (error) {
-      Sentry.captureException(error);
-      console.error('Error parsing add menu item event', error);
-    }
-  };
+// TODO in future add is to shared?
+type SSEEventsMap = {
+  membership_created: { newItem: UserMenuItem; attachToIdOrSlug?: string };
+  membership_updated: UserMenuItem;
+  entity_updated: UserMenuItem;
+  membership_removed: { id: string };
+  entity_deleted: { id: string };
+};
 
-  // Handle updates to an existing menu item
-  const updateEntity = (e: MessageEvent<string>) => {
+const useTypedSSE = <T extends keyof SSEEventsMap>(type: T, callback: (data: SSEEventsMap[T]) => void) => {
+  useSSE(type, (e: MessageEvent<string>) => {
     try {
-      const updatedItem = JSON.parse(e.data);
-
-      updateMenuItem(updatedItem as UserMenuItem);
+      const data = JSON.parse(e.data) as SSEEventsMap[T];
+      callback(data);
     } catch (error) {
       Sentry.captureException(error);
-      console.error('Error parsing update event', error);
+      console.error(`Failed to parse SSE event - ${type}`, error);
     }
-  };
+  });
+};
 
-  // Handle removal of an entity from the menu
-  const removeEntity = (e: MessageEvent<string>) => {
-    try {
-      const deleteResponse = JSON.parse(e.data);
+const SSE = () => {
+  // Add menu item
+  useTypedSSE('membership_created', ({ newItem, attachToIdOrSlug }) => addMenuItem(newItem, attachToIdOrSlug));
 
-      // Remove item by ID
-      deleteMenuItem(deleteResponse.id);
-    } catch (error) {
-      Sentry.captureException(error);
-      console.error('Error parsing remove event', error);
-    }
-  };
+  // Update menu item
+  useTypedSSE('entity_updated', (data) => updateMenuItem(data));
+  useTypedSSE('membership_updated', (data) => updateMenuItem(data));
 
-  // Register SSE listeners
-  useSSE('add_entity', (e) => addEntity(e));
-  useSSE('update_entity', (e) => updateEntity(e));
-  useSSE('remove_entity', (e) => removeEntity(e));
+  // Delete menu item
+  useTypedSSE('entity_deleted', ({ id }) => deleteMenuItem(id));
+  useTypedSSE('membership_removed', ({ id }) => deleteMenuItem(id));
 
   return null; // This component does not render any UI
 };
diff --git a/frontend/src/modules/navigation/menu-sheet/helpers/menu-operations.ts b/frontend/src/modules/navigation/menu-sheet/helpers/menu-operations.ts
index 12d8f25dd..83e4c9640 100644
--- a/frontend/src/modules/navigation/menu-sheet/helpers/menu-operations.ts
+++ b/frontend/src/modules/navigation/menu-sheet/helpers/menu-operations.ts
@@ -18,33 +18,43 @@ const useTransformOnMenuItems = (transform: (items: UserMenuItem[]) => UserMenuI
 
 /**
  * Adds a new menu item to the user's navigation menu.
- * If `parentIdOrSlug` is provided, new item will be added under parent menu item.
+ * If `attachToIdOrSlug` is provided, the new item will be added
+ * under the matching item by id/slug.
  *
- * @param newEntity - New menu item to be added.
- * @param sectionName - Name of section in  menu where  item will be added.
- * @param parentIdOrSlug -  ID or Slug of  parent item, if new item should be a submenu (optional).
+ * @param newItem - The new menu item to add.
+ * @param attachToIdOrSlug - ID or slug of the item to attach the new one under (optional).
  */
-export const addMenuItem = (newEntity: UserMenuItem, sectionName: keyof UserMenu, parentIdOrSlug?: string) => {
-  const menu = useNavigationStore.getState().menu;
+export const addMenuItem = (newItem: UserMenuItem, attachToIdOrSlug?: string) => {
+  const { menu } = useNavigationStore.getState();
 
-  const add = (items: UserMenuItem[]): UserMenuItem[] => {
-    return items.map((item) => {
-      if (!parentIdOrSlug || (item.slug !== parentIdOrSlug && item.id !== parentIdOrSlug)) return item;
+  // Recursive helper to insert newItem under the correct item
+  const insertUnder = (items: UserMenuItem[]): UserMenuItem[] =>
+    items.map((item) => {
+      if (attachToIdOrSlug && (item.id === attachToIdOrSlug || item.slug === attachToIdOrSlug)) {
+        return {
+          ...item,
+          submenu: [...(item.submenu ?? []), newItem],
+        };
+      }
 
-      // If parent is found, add new entity to its submenu
       return {
         ...item,
-        submenu: item.submenu ? [...item.submenu, newEntity] : [newEntity],
+        submenu: item.submenu ? insertUnder(item.submenu) : item.submenu,
       };
     });
-  };
 
-  const updatedMenuSection = parentIdOrSlug ? add(menu[sectionName]) : [...menu[sectionName], { ...newEntity, submenu: [] }];
+  // Find the menu section based on entity type
+  const section = appConfig.menuStructure.find((el) => el.entityType === newItem.entityType || el.subentityType === newItem.entityType);
+  if (!section) return;
+
+  const { entityType: sectionName } = section;
+
+  const updatedSection = attachToIdOrSlug ? insertUnder(menu[sectionName]) : [...menu[sectionName], { ...newItem, submenu: [] }];
 
   useNavigationStore.setState({
     menu: {
       ...menu,
-      [sectionName]: updatedMenuSection,
+      [sectionName]: updatedSection,
     },
   });
 };
diff --git a/frontend/src/modules/organizations/query.ts b/frontend/src/modules/organizations/query.ts
index 98f272d10..60a0fec07 100644
--- a/frontend/src/modules/organizations/query.ts
+++ b/frontend/src/modules/organizations/query.ts
@@ -105,7 +105,7 @@ export const useOrganizationCreateMutation = () => {
       const mutateCache = useMutateQueryData(organizationsKeys.table.base);
 
       mutateCache.create([createdOrganization]);
-      addMenuItem(createdOrganization, 'organization');
+      addMenuItem(createdOrganization);
     },
   });
 };

From 05ee7643469078c79875938a81d89bde2a7aabf4 Mon Sep 17 00:00:00 2001
From: David Hordiienko <90209095+LemonardoD@users.noreply.github.com>
Date: Mon, 6 Oct 2025 11:33:38 +0300
Subject: [PATCH 41/48] Improve/open api (#633)

* chore: add status code 201 on creation

* chore: add body required

* chore: improve usage of security in routes

* chore: change signOut method from GET to POST
---
 backend/src/lib/custom-routes.ts              |  10 +-
 backend/src/lib/docs.ts                       |   1 -
 backend/src/lib/openapi-describer.ts          |   8 +
 backend/src/modules/attachments/handlers.ts   |   2 +-
 backend/src/modules/attachments/routes.ts     |  44 +---
 backend/src/modules/auth/general/routes.ts    |  26 +--
 backend/src/modules/auth/oauth/routes.ts      |   6 -
 backend/src/modules/auth/passkeys/handlers.ts |   2 +-
 backend/src/modules/auth/passkeys/routes.ts   |  21 +-
 .../src/modules/auth/passwords/handlers.ts    |  10 +-
 backend/src/modules/auth/passwords/routes.ts  |  31 ++-
 backend/src/modules/auth/totps/handlers.ts    |   2 +-
 backend/src/modules/auth/totps/routes.ts      |  15 +-
 backend/src/modules/entities/routes.ts        |   5 +-
 backend/src/modules/me/routes.ts              |  19 +-
 backend/src/modules/memberships/routes.ts     |  18 +-
 backend/src/modules/organizations/handlers.ts |   2 +-
 backend/src/modules/organizations/routes.ts   |  29 +--
 backend/src/modules/requests/handlers.ts      |   2 +-
 backend/src/modules/requests/routes.ts        |  14 +-
 backend/src/modules/system/routes.ts          |  21 +-
 backend/src/modules/users/routes.ts           |  17 +-
 frontend/src/api.gen/sdk.gen.ts               | 210 ++++++++---------
 frontend/src/api.gen/types.gen.ts             |  58 +++--
 frontend/src/api.gen/zod.gen.ts               | 212 +++++++-----------
 .../src/modules/auth/steps/check-email.tsx    |   2 +-
 frontend/src/modules/auth/steps/sign-up.tsx   |   4 +-
 .../common/contact-form/contact-form.tsx      |   2 +-
 frontend/src/modules/me/query.ts              |   2 +-
 frontend/src/modules/me/totp/setup.tsx        |   4 +-
 .../src/modules/requests/waitlist-form.tsx    |   2 +-
 frontend/src/modules/users/invite-users.tsx   |   2 +-
 32 files changed, 327 insertions(+), 476 deletions(-)

diff --git a/backend/src/lib/custom-routes.ts b/backend/src/lib/custom-routes.ts
index 98a6a152e..c0b4e0a23 100644
--- a/backend/src/lib/custom-routes.ts
+++ b/backend/src/lib/custom-routes.ts
@@ -1,7 +1,7 @@
 import { createRoute } from '@hono/zod-openapi';
 import type { MiddlewareHandler } from 'hono';
 import type { Env } from '#/lib/context';
-import { enhanceOpenAPIDescription } from '#/lib/openapi-describer';
+import { enhanceOpenAPIDescription, getMiddlewareDescriptor } from '#/lib/openapi-describer';
 
 type NonEmptyArray<T> = readonly [T, ...T[]];
 
@@ -34,8 +34,14 @@ export const createCustomRoute = <P extends string, R extends Omit<RouteOptions,
     middleware, // optionally check all middleware too
   );
 
+  // Determine OpenAPI security automatically based on middleware guards
+  const security = initGuard.some((guard) => getMiddlewareDescriptor(guard)?.level === 'authenticated')
+    ? [{ cookieAuth: [] }] // protected route
+    : []; // public route
+
   return createRoute({
-    ...routeConfig,
+    security,
+    ...routeConfig, // allow routeConfig to override security
     middleware,
     description: enhancedDescription,
   });
diff --git a/backend/src/lib/docs.ts b/backend/src/lib/docs.ts
index ed94d86ba..350368b4b 100644
--- a/backend/src/lib/docs.ts
+++ b/backend/src/lib/docs.ts
@@ -23,7 +23,6 @@ const openApiConfig = {
   },
   openapi: '3.1.0',
   tags: apiModulesList,
-  security: [{ cookieAuth: [] }],
 };
 
 /**
diff --git a/backend/src/lib/openapi-describer.ts b/backend/src/lib/openapi-describer.ts
index 1fb80a6a9..06dc6f2b7 100644
--- a/backend/src/lib/openapi-describer.ts
+++ b/backend/src/lib/openapi-describer.ts
@@ -45,6 +45,14 @@ export function registerMiddlewareDescription(descriptor: MiddlewareDescriptor)
   middlewareRegistry.set(descriptor.middleware, descriptor);
 }
 
+/**
+ * Retrieve the registered descriptor for a middleware.
+ * Returns undefined if the middleware has not been registered.
+ */
+export function getMiddlewareDescriptor(middleware: MiddlewareHandler): MiddlewareDescriptor | undefined {
+  return middlewareRegistry.get(middleware);
+}
+
 /**
  * Enhance an OpenAPI route description by prefixing it with security or metadata context
  * derived from known middleware in the route.
diff --git a/backend/src/modules/attachments/handlers.ts b/backend/src/modules/attachments/handlers.ts
index 0a17b18f6..16328e365 100644
--- a/backend/src/modules/attachments/handlers.ts
+++ b/backend/src/modules/attachments/handlers.ts
@@ -120,7 +120,7 @@ const attachmentsRouteHandlers = app
 
     logEvent('info', `${createdAttachments.length} attachments have been created`);
 
-    return ctx.json(data, 200);
+    return ctx.json(data, 201);
   })
   /**
    * Get attachments
diff --git a/backend/src/modules/attachments/routes.ts b/backend/src/modules/attachments/routes.ts
index 2d7416970..bb15513d0 100644
--- a/backend/src/modules/attachments/routes.ts
+++ b/backend/src/modules/attachments/routes.ts
@@ -19,15 +19,11 @@ const attachmentRoutes = {
       params: inOrgParamSchema,
       body: {
         required: true,
-        content: {
-          'application/json': {
-            schema: attachmentCreateManySchema,
-          },
-        },
+        content: { 'application/json': { schema: attachmentCreateManySchema } },
       },
     },
     responses: {
-      200: {
+      201: {
         description: 'Attachment',
         content: {
           'application/json': {
@@ -54,11 +50,7 @@ const attachmentRoutes = {
     responses: {
       200: {
         description: 'Attachments',
-        content: {
-          'application/json': {
-            schema: paginationSchema(attachmentSchema),
-          },
-        },
+        content: { 'application/json': { schema: paginationSchema(attachmentSchema) } },
       },
       ...errorResponses,
     },
@@ -72,9 +64,7 @@ const attachmentRoutes = {
     tags: ['attachments'],
     summary: 'Get attachment',
     description: 'Fetches metadata and access details for a single *attachment* by ID.',
-    request: {
-      params: idInOrgParamSchema,
-    },
+    request: { params: idInOrgParamSchema },
     responses: {
       200: {
         description: 'Attachment',
@@ -99,11 +89,8 @@ const attachmentRoutes = {
     request: {
       params: idInOrgParamSchema,
       body: {
-        content: {
-          'application/json': {
-            schema: attachmentUpdateBodySchema,
-          },
-        },
+        required: true,
+        content: { 'application/json': { schema: attachmentUpdateBodySchema } },
       },
     },
     responses: {
@@ -130,11 +117,8 @@ const attachmentRoutes = {
     request: {
       params: inOrgParamSchema,
       body: {
-        content: {
-          'application/json': {
-            schema: idsBodySchema(),
-          },
-        },
+        required: true,
+        content: { 'application/json': { schema: idsBodySchema() } },
       },
     },
     responses: {
@@ -162,9 +146,7 @@ const attachmentRoutes = {
       This endpoint ensures required query parameters are forwarded and response headers are adjusted for browser compatibility.`,
     request: { query: baseElectrycSyncQuery, params: inOrgParamSchema },
     responses: {
-      200: {
-        description: 'Success',
-      },
+      200: { description: 'Success' },
       ...errorResponses,
     },
   }),
@@ -178,13 +160,9 @@ const attachmentRoutes = {
     tags: ['attachments'],
     summary: 'Redirect to attachment',
     description: "Redirects to the file's public or presigned URL, depending on storage visibility.",
-    request: {
-      params: z.object({ id: idSchema }),
-    },
+    request: { params: z.object({ id: idSchema }) },
     responses: {
-      200: {
-        description: 'Success',
-      },
+      200: { description: 'Success' },
       ...errorResponses,
     },
   }),
diff --git a/backend/src/modules/auth/general/routes.ts b/backend/src/modules/auth/general/routes.ts
index ce4091674..84bca6513 100644
--- a/backend/src/modules/auth/general/routes.ts
+++ b/backend/src/modules/auth/general/routes.ts
@@ -21,9 +21,7 @@ const authGeneralRoutes = {
     responses: {
       204: {
         description: 'Impersonating',
-        headers: z.object({
-          'Set-Cookie': cookieSchema,
-        }),
+        headers: z.object({ 'Set-Cookie': cookieSchema }),
       },
       ...errorResponses,
     },
@@ -38,9 +36,7 @@ const authGeneralRoutes = {
     summary: 'Stop impersonating',
     description: 'Ends impersonation by clearing the current impersonation session and restoring the admin context.',
     responses: {
-      204: {
-        description: 'Stopped impersonating',
-      },
+      204: { description: 'Stopped impersonating' },
       ...errorResponses,
     },
   }),
@@ -54,20 +50,14 @@ const authGeneralRoutes = {
     tags: ['auth'],
     summary: 'Check if email exists',
     description: 'Checks if a user with the specified email address exists in the system.',
-    security: [],
     request: {
       body: {
-        content: {
-          'application/json': {
-            schema: emailBodySchema,
-          },
-        },
+        required: true,
+        content: { 'application/json': { schema: emailBodySchema } },
       },
     },
     responses: {
-      204: {
-        description: 'Email exists',
-      },
+      204: { description: 'Email exists' },
       ...errorResponses,
     },
   }),
@@ -120,16 +110,14 @@ const authGeneralRoutes = {
 
   signOut: createCustomRoute({
     operationId: 'signOut',
-    method: 'get',
+    method: 'post',
     path: '/sign-out',
     guard: isPublicAccess,
     tags: ['auth'],
     summary: 'Sign out',
     description: 'Signs out the *current user* and clears the active session.',
     responses: {
-      204: {
-        description: 'User signed out',
-      },
+      204: { description: 'User signed out' },
       ...errorResponses,
     },
   }),
diff --git a/backend/src/modules/auth/oauth/routes.ts b/backend/src/modules/auth/oauth/routes.ts
index ecc2f52ac..8e6ff3417 100644
--- a/backend/src/modules/auth/oauth/routes.ts
+++ b/backend/src/modules/auth/oauth/routes.ts
@@ -16,7 +16,6 @@ const authOAuthRoutes = {
     summary: 'Authenticate with GitHub',
     description:
       'Starts OAuth authentication with GitHub. Can be used for account connection, email verification, invitation process, defaults to authentication.',
-    security: [],
     request: { query: oauthQuerySchema },
     responses: {
       302: {
@@ -36,7 +35,6 @@ const authOAuthRoutes = {
     tags: ['auth'],
     summary: 'Callback for GitHub',
     description: 'Handles GitHub OAuth callback, retrieves user identity, and establishes a session or links account.',
-    security: [],
     request: {
       query: oauthCallbackQuerySchema.extend({
         error: z.string().optional(),
@@ -62,7 +60,6 @@ const authOAuthRoutes = {
     summary: 'Authenticate with Google',
     description:
       'Starts OAuth authentication with Google. Can be used for account connection, email verification, invitation process, defaults to authentication.',
-    security: [],
     request: { query: oauthQuerySchema },
     responses: {
       302: {
@@ -82,7 +79,6 @@ const authOAuthRoutes = {
     tags: ['auth'],
     summary: 'Callback for Google',
     description: 'Handles Google OAuth callback, retrieves user identity, and establishes a session or links account.',
-    security: [],
     request: { query: oauthCallbackQuerySchema },
     responses: {
       302: {
@@ -102,7 +98,6 @@ const authOAuthRoutes = {
     summary: 'Authenticate with Microsoft',
     description:
       'Starts OAuth authentication with Microsoft. Can be used for account connection, email verification, invitation process, defaults to authentication.',
-    security: [],
     request: { query: oauthQuerySchema },
     responses: {
       302: {
@@ -122,7 +117,6 @@ const authOAuthRoutes = {
     tags: ['auth'],
     summary: 'Callback for Microsoft',
     description: 'Handles Microsoft OAuth callback, retrieves user identity, and establishes a session or links account.',
-    security: [],
     request: { query: oauthCallbackQuerySchema },
     responses: {
       302: {
diff --git a/backend/src/modules/auth/passkeys/handlers.ts b/backend/src/modules/auth/passkeys/handlers.ts
index 065f1844f..ca7f1ff66 100644
--- a/backend/src/modules/auth/passkeys/handlers.ts
+++ b/backend/src/modules/auth/passkeys/handlers.ts
@@ -56,7 +56,7 @@ const authPasskeysRouteHandlers = app
     // Save public key in database
     const [newPasskey] = await db.insert(passkeysTable).values(passkeyValue).returning(passkeySelect);
 
-    return ctx.json(newPasskey, 200);
+    return ctx.json(newPasskey, 201);
   })
   /**
    * Delete passkey
diff --git a/backend/src/modules/auth/passkeys/routes.ts b/backend/src/modules/auth/passkeys/routes.ts
index 7e295a542..eac14a66d 100644
--- a/backend/src/modules/auth/passkeys/routes.ts
+++ b/backend/src/modules/auth/passkeys/routes.ts
@@ -23,8 +23,12 @@ const authPasskeysRoutes = {
     tags: ['auth'],
     summary: 'Generate passkey challenge',
     description: 'Initiates the passkey registration or authentication flow by generating a device bound challenge.',
-    security: [],
-    request: { body: { content: { 'application/json': { schema: passkeyChallengeBodySchema } } } },
+    request: {
+      body: {
+        required: true,
+        content: { 'application/json': { schema: passkeyChallengeBodySchema } },
+      },
+    },
     responses: {
       200: {
         description: 'Challenge generated',
@@ -43,7 +47,6 @@ const authPasskeysRoutes = {
     summary: 'Create passkey',
     description:
       'Register a passkey for passwordless authentication by verifying a signed challenge and linking it to the *current user*. Multiple passkeys can be created for different devices/browsers.',
-    security: [],
     request: {
       body: {
         required: true,
@@ -51,7 +54,7 @@ const authPasskeysRoutes = {
       },
     },
     responses: {
-      200: {
+      201: {
         description: 'Passkey created',
         content: { 'application/json': { schema: passkeySchema } },
       },
@@ -67,10 +70,7 @@ const authPasskeysRoutes = {
     tags: ['auth'],
     summary: 'Delete passkey',
     description: 'Delete a passkey by id from the *current user*.',
-    security: [],
-    request: {
-      params: z.object({ id: idSchema }),
-    },
+    request: { params: z.object({ id: idSchema }) },
     responses: {
       204: {
         description: 'Passkey deleted',
@@ -89,7 +89,10 @@ const authPasskeysRoutes = {
     summary: 'Verify passkey',
     description: 'Validates the signed challenge and completes passkey based authentication.',
     request: {
-      body: { content: { 'application/json': { schema: passkeyVerificationBodySchema } } },
+      body: {
+        required: true,
+        content: { 'application/json': { schema: passkeyVerificationBodySchema } },
+      },
     },
     responses: {
       204: {
diff --git a/backend/src/modules/auth/passwords/handlers.ts b/backend/src/modules/auth/passwords/handlers.ts
index 3d084dedb..8eb403f45 100644
--- a/backend/src/modules/auth/passwords/handlers.ts
+++ b/backend/src/modules/auth/passwords/handlers.ts
@@ -61,7 +61,7 @@ const authPasswordsRouteHandlers = app
 
     sendVerificationEmail({ userId: user.id });
 
-    return ctx.body(null, 204);
+    return ctx.body(null, 201);
   })
   /**
    * Sign up with email & password to accept (system or membership) invitations.
@@ -99,7 +99,7 @@ const authPasswordsRouteHandlers = app
     await setUserSession(ctx, user, strategy);
 
     // If no membership invitation, we are done
-    if (!isMembershipInvite) return ctx.json({ shouldRedirect: true, redirectPath: appConfig.defaultRedirectPath }, 200);
+    if (!isMembershipInvite) return ctx.json({ shouldRedirect: true, redirectPath: appConfig.defaultRedirectPath }, 201);
 
     // If membership invitation, get membership to forward
     const [invitationMembership] = await db
@@ -112,7 +112,7 @@ const authPasswordsRouteHandlers = app
     // Redirect to accept invitation if membership invite
     const redirectPath = `/home?invitationMembershipId=${invitationMembership.id}&skipWelcome=true`;
 
-    return ctx.json({ shouldRedirect: true, redirectPath }, 200);
+    return ctx.json({ shouldRedirect: true, redirectPath }, 201);
   })
   /**
    * Request reset password email
@@ -198,11 +198,11 @@ const authPasswordsRouteHandlers = app
     if (mfaRedirectPath) {
       // Append fromRoot to avoid redirecting to FE homepage
       const redirectPath = `${mfaRedirectPath}?fromRoot=true`;
-      return ctx.json({ shouldRedirect: true, redirectPath }, 200);
+      return ctx.json({ shouldRedirect: true, redirectPath }, 201);
     }
 
     await setUserSession(ctx, user, strategy);
-    return ctx.json({ shouldRedirect: false }, 200);
+    return ctx.json({ shouldRedirect: false }, 201);
   })
   /**
    * Sign in with email and password
diff --git a/backend/src/modules/auth/passwords/routes.ts b/backend/src/modules/auth/passwords/routes.ts
index 2a595b079..97b1e4538 100644
--- a/backend/src/modules/auth/passwords/routes.ts
+++ b/backend/src/modules/auth/passwords/routes.ts
@@ -19,14 +19,13 @@ const authPasswordsRoutes = {
     tags: ['auth'],
     summary: 'Sign up with password',
     description: 'Registers a new user using an email and password. Sends a verification email upon successful sign up.',
-    security: [],
     request: {
       body: {
         content: { 'application/json': { schema: emailPasswordBodySchema } },
       },
     },
     responses: {
-      204: {
+      201: {
         description: 'User signed up',
         headers: z.object({ 'Set-Cookie': cookieSchema }),
       },
@@ -47,13 +46,15 @@ const authPasswordsRoutes = {
     tags: ['auth'],
     summary: 'Sign up to accept invite',
     description: 'Registers a user using an email and password in response to a system or organization invitation.',
-    security: [],
     request: {
       params: z.object({ tokenId: z.string() }),
-      body: { content: { 'application/json': { schema: emailPasswordBodySchema } } },
+      body: {
+        required: true,
+        content: { 'application/json': { schema: emailPasswordBodySchema } },
+      },
     },
     responses: {
-      200: {
+      201: {
         description: 'User signed up',
         headers: z.object({ 'Set-Cookie': cookieSchema }),
         content: { 'application/json': { schema: redirectResponseSchema } },
@@ -71,9 +72,11 @@ const authPasswordsRoutes = {
     tags: ['auth'],
     summary: 'Request new password',
     description: "Sends an email with a link to reset the user's password.",
-    security: [],
     request: {
-      body: { content: { 'application/json': { schema: emailBodySchema } } },
+      body: {
+        required: true,
+        content: { 'application/json': { schema: emailBodySchema } },
+      },
     },
     responses: {
       204: {
@@ -92,13 +95,15 @@ const authPasswordsRoutes = {
     tags: ['auth'],
     summary: 'Create password',
     description: 'Sets a new password using a single-use session token in cookie and grants a session immediately upon success.',
-    security: [],
     request: {
       params: z.object({ tokenId: z.string() }),
-      body: { content: { 'application/json': { schema: z.object({ password: passwordSchema }) } } },
+      body: {
+        required: true,
+        content: { 'application/json': { schema: z.object({ password: passwordSchema }) } },
+      },
     },
     responses: {
-      200: {
+      201: {
         description: 'Password created',
         content: { 'application/json': { schema: redirectResponseSchema } },
       },
@@ -115,9 +120,11 @@ const authPasswordsRoutes = {
     tags: ['auth'],
     summary: 'Sign in with password',
     description: 'Authenticates an existing user using their email and password.',
-    security: [],
     request: {
-      body: { content: { 'application/json': { schema: emailPasswordBodySchema } } },
+      body: {
+        required: true,
+        content: { 'application/json': { schema: emailPasswordBodySchema } },
+      },
     },
     responses: {
       200: {
diff --git a/backend/src/modules/auth/totps/handlers.ts b/backend/src/modules/auth/totps/handlers.ts
index 0588a6f2c..9965db547 100644
--- a/backend/src/modules/auth/totps/handlers.ts
+++ b/backend/src/modules/auth/totps/handlers.ts
@@ -71,7 +71,7 @@ const authTotpsRouteHandlers = app
     // Save encoded secret key in database
     await db.insert(totpsTable).values({ userId: user.id, secret: encodedSecret });
 
-    return ctx.body(null, 204);
+    return ctx.body(null, 201);
   })
   /**
    * Unlink TOTP
diff --git a/backend/src/modules/auth/totps/routes.ts b/backend/src/modules/auth/totps/routes.ts
index 53e2b4977..2d9e8137a 100644
--- a/backend/src/modules/auth/totps/routes.ts
+++ b/backend/src/modules/auth/totps/routes.ts
@@ -15,7 +15,6 @@ const authTotpsRoutes = {
     tags: ['auth'],
     summary: 'Generate TOTP key',
     description: 'Generates a new TOTP key for current user and returns a provisioning URI and Base32 manual key.',
-    security: [],
     responses: {
       200: {
         description: 'Challenge created',
@@ -34,7 +33,6 @@ const authTotpsRoutes = {
     summary: 'Set TOTP',
     description:
       'Confirms TOTP setup by verifying a code from the authenticator app for the first time. On success, TOTP is registered for current user.',
-    security: [],
     request: {
       body: {
         required: true,
@@ -43,7 +41,7 @@ const authTotpsRoutes = {
     },
 
     responses: {
-      204: {
+      201: {
         description: 'TOTP created',
       },
       ...errorResponses,
@@ -58,11 +56,8 @@ const authTotpsRoutes = {
     tags: ['auth'],
     summary: 'Delete TOTP',
     description: 'Delete TOTP credential for current user.',
-    security: [],
     responses: {
-      204: {
-        description: 'TOTP deleted',
-      },
+      204: { description: 'TOTP deleted' },
       ...errorResponses,
     },
   }),
@@ -77,9 +72,11 @@ const authTotpsRoutes = {
     tags: ['auth'],
     summary: 'Verify TOTP',
     description: 'Validates the TOTP code and completes TOTP based authentication.',
-    security: [],
     request: {
-      body: { content: { 'application/json': { schema: totpCreateBodySchema } } },
+      body: {
+        required: true,
+        content: { 'application/json': { schema: totpCreateBodySchema } },
+      },
     },
     responses: {
       204: {
diff --git a/backend/src/modules/entities/routes.ts b/backend/src/modules/entities/routes.ts
index 71dbf95f0..5320589fa 100644
--- a/backend/src/modules/entities/routes.ts
+++ b/backend/src/modules/entities/routes.ts
@@ -16,7 +16,10 @@ const entityRoutes = {
     description: `Checks whether a given slug is available across all entity types (e.g. *organizations*, *users*).
       Primarily used to prevent slug collisions before creating or updating an entity.`,
     request: {
-      body: { content: { 'application/json': { schema: z.object({ slug: slugSchema, entityType: entityTypeSchema }) } } },
+      body: {
+        required: true,
+        content: { 'application/json': { schema: z.object({ slug: slugSchema, entityType: entityTypeSchema }) } },
+      },
     },
     responses: {
       204: {
diff --git a/backend/src/modules/me/routes.ts b/backend/src/modules/me/routes.ts
index 8a29e809d..5047a8235 100644
--- a/backend/src/modules/me/routes.ts
+++ b/backend/src/modules/me/routes.ts
@@ -11,7 +11,7 @@ import {
   uploadTokenSchema,
 } from '#/modules/me/schema';
 import { userFlagsSchema, userSchema, userUpdateBodySchema } from '#/modules/users/schema';
-import { entityWithTypeQuerySchema, locationSchema } from '#/utils/schema/common';
+import { entityWithTypeQuerySchema, idsBodySchema, locationSchema } from '#/utils/schema/common';
 import { errorResponses, successWithRejectedItemsSchema } from '#/utils/schema/responses';
 
 const meRoutes = {
@@ -77,6 +77,7 @@ const meRoutes = {
     description: 'Updates the *current user*.',
     request: {
       body: {
+        required: true,
         content: {
           'application/json': { schema: userUpdateBodySchema.extend({ userFlags: userFlagsSchema.partial().optional() }) },
         },
@@ -101,9 +102,7 @@ const meRoutes = {
     description:
       "Deletes the *current user*. This also removes the user's memberships (cascade) and sets references to the user to `null` where applicable.",
     responses: {
-      204: {
-        description: 'User deleted',
-      },
+      204: { description: 'User deleted' },
       ...errorResponses,
     },
   }),
@@ -134,8 +133,9 @@ const meRoutes = {
     summary: 'Terminate sessions',
     description: 'Ends one or more sessions for the *current user* based on provided session IDs.',
     request: {
+      required: true,
       body: {
-        content: { 'application/json': { schema: z.object({ ids: z.array(z.string()).min(1, 'Add at least one item') }) } },
+        content: { 'application/json': { schema: idsBodySchema() } },
       },
     },
 
@@ -156,10 +156,7 @@ const meRoutes = {
     tags: ['me'],
     summary: 'Leave entity',
     description: 'Removes the *current user* from an entity they are a member of.',
-    security: [],
-    request: {
-      query: entityWithTypeQuerySchema,
-    },
+    request: { query: entityWithTypeQuerySchema },
     responses: {
       204: {
         description: 'Membership removed',
@@ -178,9 +175,7 @@ const meRoutes = {
     summary: 'Unsubscribe',
     description:
       'Unsubscribes the user from email notifications using a personal unsubscribe token. No authentication is required, as the token implicitly identifies the *current user*.',
-    request: {
-      query: z.object({ token: z.string() }),
-    },
+    request: { query: z.object({ token: z.string() }) },
     responses: {
       302: {
         description: 'Redirect to FE',
diff --git a/backend/src/modules/memberships/routes.ts b/backend/src/modules/memberships/routes.ts
index 12a87d9e8..a9024ef68 100644
--- a/backend/src/modules/memberships/routes.ts
+++ b/backend/src/modules/memberships/routes.ts
@@ -17,6 +17,7 @@ import {
   entityWithTypeQuerySchema,
   idInOrgParamSchema,
   idOrSlugSchema,
+  idSchema,
   idsBodySchema,
   inOrgParamSchema,
 } from '#/utils/schema/common';
@@ -35,11 +36,8 @@ const membershipRoutes = {
       params: inOrgParamSchema,
       query: entityWithTypeQuerySchema,
       body: {
-        content: {
-          'application/json': {
-            schema: membershipCreateBodySchema,
-          },
-        },
+        required: true,
+        content: { 'application/json': { schema: membershipCreateBodySchema } },
       },
     },
     responses: {
@@ -63,6 +61,7 @@ const membershipRoutes = {
       params: inOrgParamSchema,
       query: entityWithTypeQuerySchema,
       body: {
+        required: true,
         content: { 'application/json': { schema: idsBodySchema() } },
       },
     },
@@ -90,11 +89,7 @@ const membershipRoutes = {
     request: {
       params: idInOrgParamSchema,
       body: {
-        content: {
-          'application/json': {
-            schema: membershipUpdateBodySchema,
-          },
-        },
+        content: { 'application/json': { schema: membershipUpdateBodySchema } },
       },
     },
     responses: {
@@ -114,7 +109,7 @@ const membershipRoutes = {
     tags: ['membership'],
     summary: 'Respond to membership invitation',
     description: 'Accepting activates the associated membership. Rejecting adds a rejectedAt timestamp.',
-    request: { params: z.object({ id: z.string(), acceptOrReject: z.enum(['accept', 'reject']) }) },
+    request: { params: z.object({ id: idSchema, acceptOrReject: z.enum(['accept', 'reject']) }) },
     responses: {
       200: {
         description: 'Invitation was accepted',
@@ -182,7 +177,6 @@ const membershipRoutes = {
     tags: ['memberships'],
     summary: 'Resend invitation',
     description: 'Resends an invitation email to a new or existing user using the provided email address and token ID.',
-    security: [],
     request: {
       body: { required: true, content: { 'application/json': { schema: emailOrTokenIdQuerySchema } } },
     },
diff --git a/backend/src/modules/organizations/handlers.ts b/backend/src/modules/organizations/handlers.ts
index cb946a5c0..b32a3dbb0 100644
--- a/backend/src/modules/organizations/handlers.ts
+++ b/backend/src/modules/organizations/handlers.ts
@@ -77,7 +77,7 @@ const organizationRouteHandlers = app
       counts: { membership: memberCounts, entities: entitiesCounts },
     };
 
-    return ctx.json(data, 200);
+    return ctx.json(data, 201);
   })
   /**
    * Get list of organizations
diff --git a/backend/src/modules/organizations/routes.ts b/backend/src/modules/organizations/routes.ts
index a1e264a65..d11588852 100644
--- a/backend/src/modules/organizations/routes.ts
+++ b/backend/src/modules/organizations/routes.ts
@@ -22,15 +22,11 @@ const organizationRoutes = {
     request: {
       body: {
         required: true,
-        content: {
-          'application/json': {
-            schema: organizationCreateBodySchema,
-          },
-        },
+        content: { 'application/json': { schema: organizationCreateBodySchema } },
       },
     },
     responses: {
-      200: {
+      201: {
         description: 'Organization was created',
         content: { 'application/json': { schema: organizationWithMembershipSchema } },
       },
@@ -45,17 +41,11 @@ const organizationRoutes = {
     tags: ['organizations'],
     summary: 'Get list of organizations',
     description: 'Returns a list of *organizations* at the system level.',
-    request: {
-      query: organizationListQuerySchema,
-    },
+    request: { query: organizationListQuerySchema },
     responses: {
       200: {
         description: 'Organizations',
-        content: {
-          'application/json': {
-            schema: paginationSchema(organizationSchema),
-          },
-        },
+        content: { 'application/json': { schema: paginationSchema(organizationSchema) } },
       },
       ...errorResponses,
     },
@@ -71,11 +61,7 @@ const organizationRoutes = {
     request: {
       params: entityParamSchema,
       body: {
-        content: {
-          'application/json': {
-            schema: organizationUpdateBodySchema,
-          },
-        },
+        content: { 'application/json': { schema: organizationUpdateBodySchema } },
       },
     },
     responses: {
@@ -94,9 +80,7 @@ const organizationRoutes = {
     tags: ['organizations'],
     summary: 'Get organization',
     description: 'Retrieves an *organization* by ID or slug.',
-    request: {
-      params: entityParamSchema,
-    },
+    request: { params: entityParamSchema },
     responses: {
       200: {
         description: 'Organization',
@@ -115,6 +99,7 @@ const organizationRoutes = {
     description: 'Deletes one or more *organizations* by ID.',
     request: {
       body: {
+        required: true,
         content: { 'application/json': { schema: idsBodySchema() } },
       },
     },
diff --git a/backend/src/modules/requests/handlers.ts b/backend/src/modules/requests/handlers.ts
index 12496c783..4cb233533 100644
--- a/backend/src/modules/requests/handlers.ts
+++ b/backend/src/modules/requests/handlers.ts
@@ -75,7 +75,7 @@ const requestRouteHandlers = app
       wasInvited: false,
     };
 
-    return ctx.json(data, 200);
+    return ctx.json(data, 201);
   })
   /**
    *  Get list of requests for system admins
diff --git a/backend/src/modules/requests/routes.ts b/backend/src/modules/requests/routes.ts
index 19ee3a2c1..41a840de2 100644
--- a/backend/src/modules/requests/routes.ts
+++ b/backend/src/modules/requests/routes.ts
@@ -18,15 +18,12 @@ const requestRoutes = {
     description: 'Submits a new *request* to the system. Supported types include contact form, newsletter signup, and waitlist entry.',
     request: {
       body: {
-        content: {
-          'application/json': {
-            schema: requestCreateBodySchema,
-          },
-        },
+        required: true,
+        content: { 'application/json': { schema: requestCreateBodySchema } },
       },
     },
     responses: {
-      200: {
+      201: {
         description: 'Requests',
         content: { 'application/json': { schema: requestSchema } },
       },
@@ -41,9 +38,7 @@ const requestRoutes = {
     tags: ['requests'],
     summary: 'Get list of requests',
     description: 'Returns a list of submitted *requests* across all types: contact form, newsletter, and waitlist.',
-    request: {
-      query: requestListQuerySchema,
-    },
+    request: { query: requestListQuerySchema },
     responses: {
       200: {
         description: 'Requests',
@@ -66,6 +61,7 @@ const requestRoutes = {
     description: 'Deletes one or more *requests* from the system by their IDs.',
     request: {
       body: {
+        required: true,
         content: { 'application/json': { schema: idsBodySchema() } },
       },
     },
diff --git a/backend/src/modules/system/routes.ts b/backend/src/modules/system/routes.ts
index 51bb06d33..9659ac213 100644
--- a/backend/src/modules/system/routes.ts
+++ b/backend/src/modules/system/routes.ts
@@ -17,11 +17,8 @@ const systemRoutes = {
     description: 'Invites one or more users to the system via email. Can be used to onboard system level users or admins.',
     request: {
       body: {
-        content: {
-          'application/json': {
-            schema: inviteBodySchema,
-          },
-        },
+        required: true,
+        content: { 'application/json': { schema: inviteBodySchema } },
       },
     },
     responses: {
@@ -45,11 +42,7 @@ const systemRoutes = {
       query: z.object({ toSelf: booleanTransformSchema }),
       body: {
         required: true,
-        content: {
-          'application/json': {
-            schema: sendNewsletterBodySchema,
-          },
-        },
+        content: { 'application/json': { schema: sendNewsletterBodySchema } },
       },
     },
     responses: {
@@ -89,13 +82,7 @@ const systemRoutes = {
     summary: 'Paddle webhook (WIP)',
     description: 'Receives and handles Paddle subscription events such as purchases, renewals, and cancellations.',
     request: {
-      body: {
-        content: {
-          'application/json': {
-            schema: z.unknown(),
-          },
-        },
-      },
+      body: { content: { 'application/json': { schema: z.unknown() } } },
     },
     responses: {
       204: {
diff --git a/backend/src/modules/users/routes.ts b/backend/src/modules/users/routes.ts
index 1d9886912..787c51020 100644
--- a/backend/src/modules/users/routes.ts
+++ b/backend/src/modules/users/routes.ts
@@ -45,17 +45,14 @@ const userRoutes = {
       "Deletes one or more *users* from the system based on a list of IDs. This also removes the user's memberships (cascade) and sets references to the user to `null` where applicable.",
     request: {
       body: {
+        required: true,
         content: { 'application/json': { schema: idsBodySchema() } },
       },
     },
     responses: {
       200: {
         description: 'Success',
-        content: {
-          'application/json': {
-            schema: successWithRejectedItemsSchema,
-          },
-        },
+        content: { 'application/json': { schema: successWithRejectedItemsSchema } },
       },
       ...errorResponses,
     },
@@ -68,9 +65,7 @@ const userRoutes = {
     tags: ['users'],
     summary: 'Get user',
     description: 'Retrieves a *user* by ID or slug.',
-    request: {
-      params: entityParamSchema,
-    },
+    request: { params: entityParamSchema },
     responses: {
       200: {
         description: 'User',
@@ -90,11 +85,7 @@ const userRoutes = {
     request: {
       params: entityParamSchema,
       body: {
-        content: {
-          'application/json': {
-            schema: userUpdateBodySchema,
-          },
-        },
+        content: { 'application/json': { schema: userUpdateBodySchema } },
       },
     },
     responses: {
diff --git a/frontend/src/api.gen/sdk.gen.ts b/frontend/src/api.gen/sdk.gen.ts
index e48e0e564..acb2a766e 100644
--- a/frontend/src/api.gen/sdk.gen.ts
+++ b/frontend/src/api.gen/sdk.gen.ts
@@ -237,14 +237,14 @@ export type Options<TData extends TDataShape = TDataShape, ThrowOnError extends
  * @param {string=} options.body.email - `string` (optional)
  * @returns Possible status codes: 204, 400, 401, 403, 404, 429
  */
-export const checkEmail = <ThrowOnError extends boolean = true>(options?: Options<CheckEmailData, ThrowOnError>) => {
-  return (options?.client ?? client).post<CheckEmailResponses, CheckEmailErrors, ThrowOnError, 'data'>({
+export const checkEmail = <ThrowOnError extends boolean = true>(options: Options<CheckEmailData, ThrowOnError>) => {
+  return (options.client ?? client).post<CheckEmailResponses, CheckEmailErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
     url: '/auth/check-email',
     ...options,
     headers: {
       'Content-Type': 'application/json',
-      ...options?.headers,
+      ...options.headers,
     },
   });
 };
@@ -266,13 +266,6 @@ export const checkEmail = <ThrowOnError extends boolean = true>(options?: Option
 export const invokeToken = <ThrowOnError extends boolean = true>(options: Options<InvokeTokenData, ThrowOnError>) => {
   return (options.client ?? client).get<unknown, InvokeTokenErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
-    security: [
-      {
-        in: 'cookie',
-        name: 'cella-development-session-v1',
-        type: 'apiKey',
-      },
-    ],
     url: '/auth/invoke-token/{type}/{token}',
     ...options,
   });
@@ -294,13 +287,6 @@ export const invokeToken = <ThrowOnError extends boolean = true>(options: Option
 export const getTokenData = <ThrowOnError extends boolean = true>(options: Options<GetTokenDataData, ThrowOnError>) => {
   return (options.client ?? client).get<GetTokenDataResponses, GetTokenDataErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
-    security: [
-      {
-        in: 'cookie',
-        name: 'cella-development-session-v1',
-        type: 'apiKey',
-      },
-    ],
     url: '/auth/token/{tokenId}',
     ...options,
   });
@@ -365,21 +351,14 @@ export const stopImpersonation = <ThrowOnError extends boolean = true>(options?:
  *
  * Signs out the *current user* and clears the active session.
  *
- * **GET /auth/sign-out** ·· [signOut](http://localhost:4000/docs#tag/auth/get/auth/sign-out) ·· _auth_
+ * **POST /auth/sign-out** ·· [signOut](http://localhost:4000/docs#tag/auth/post/auth/sign-out) ·· _auth_
  *
  * @param {signOutData} options
  * @returns Possible status codes: 204, 400, 401, 403, 404, 429
  */
 export const signOut = <ThrowOnError extends boolean = true>(options?: Options<SignOutData, ThrowOnError>) => {
-  return (options?.client ?? client).get<SignOutResponses, SignOutErrors, ThrowOnError, 'data'>({
+  return (options?.client ?? client).post<SignOutResponses, SignOutErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
-    security: [
-      {
-        in: 'cookie',
-        name: 'cella-development-session-v1',
-        type: 'apiKey',
-      },
-    ],
     url: '/auth/sign-out',
     ...options,
   });
@@ -399,6 +378,13 @@ export const signOut = <ThrowOnError extends boolean = true>(options?: Options<S
 export const generateTotpKey = <ThrowOnError extends boolean = true>(options?: Options<GenerateTotpKeyData, ThrowOnError>) => {
   return (options?.client ?? client).post<GenerateTotpKeyResponses, GenerateTotpKeyErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
+    security: [
+      {
+        in: 'cookie',
+        name: 'cella-development-session-v1',
+        type: 'apiKey',
+      },
+    ],
     url: '/auth/totp/generate-key',
     ...options,
   });
@@ -418,6 +404,13 @@ export const generateTotpKey = <ThrowOnError extends boolean = true>(options?: O
 export const deleteTotp = <ThrowOnError extends boolean = true>(options?: Options<DeleteTotpData, ThrowOnError>) => {
   return (options?.client ?? client).delete<DeleteTotpResponses, DeleteTotpErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
+    security: [
+      {
+        in: 'cookie',
+        name: 'cella-development-session-v1',
+        type: 'apiKey',
+      },
+    ],
     url: '/auth/totp',
     ...options,
   });
@@ -433,11 +426,18 @@ export const deleteTotp = <ThrowOnError extends boolean = true>(options?: Option
  *
  * @param {createTotpData} options
  * @param {string=} options.body.code - `string` (optional)
- * @returns Possible status codes: 204, 400, 401, 403, 404, 429
+ * @returns Possible status codes: 201, 400, 401, 403, 404, 429
  */
 export const createTotp = <ThrowOnError extends boolean = true>(options: Options<CreateTotpData, ThrowOnError>) => {
   return (options.client ?? client).post<CreateTotpResponses, CreateTotpErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
+    security: [
+      {
+        in: 'cookie',
+        name: 'cella-development-session-v1',
+        type: 'apiKey',
+      },
+    ],
     url: '/auth/totp',
     ...options,
     headers: {
@@ -460,14 +460,14 @@ export const createTotp = <ThrowOnError extends boolean = true>(options: Options
  * @param {string=} options.body.code - `string` (optional)
  * @returns Possible status codes: 204, 400, 401, 403, 404, 429
  */
-export const signInWithTotp = <ThrowOnError extends boolean = true>(options?: Options<SignInWithTotpData, ThrowOnError>) => {
-  return (options?.client ?? client).post<SignInWithTotpResponses, SignInWithTotpErrors, ThrowOnError, 'data'>({
+export const signInWithTotp = <ThrowOnError extends boolean = true>(options: Options<SignInWithTotpData, ThrowOnError>) => {
+  return (options.client ?? client).post<SignInWithTotpResponses, SignInWithTotpErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
     url: '/auth/totp-verification',
     ...options,
     headers: {
       'Content-Type': 'application/json',
-      ...options?.headers,
+      ...options.headers,
     },
   });
 };
@@ -484,7 +484,7 @@ export const signInWithTotp = <ThrowOnError extends boolean = true>(options?: Op
  * @param {signUpData} options
  * @param {string=} options.body.email - `string` (optional)
  * @param {string=} options.body.password - `string` (optional)
- * @returns Possible status codes: 204, 302, 400, 401, 403, 404, 429
+ * @returns Possible status codes: 201, 302, 400, 401, 403, 404, 429
  */
 export const signUp = <ThrowOnError extends boolean = true>(options?: Options<SignUpData, ThrowOnError>) => {
   return (options?.client ?? client).post<SignUpResponses, SignUpErrors, ThrowOnError, 'data'>({
@@ -511,7 +511,7 @@ export const signUp = <ThrowOnError extends boolean = true>(options?: Options<Si
  * @param {string} options.path.tokenid - `string`
  * @param {string=} options.body.email - `string` (optional)
  * @param {string=} options.body.password - `string` (optional)
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ * @returns Possible status codes: 201, 400, 401, 403, 404, 429
  */
 export const signUpWithToken = <ThrowOnError extends boolean = true>(options: Options<SignUpWithTokenData, ThrowOnError>) => {
   return (options.client ?? client).post<SignUpWithTokenResponses, SignUpWithTokenErrors, ThrowOnError, 'data'>({
@@ -538,14 +538,14 @@ export const signUpWithToken = <ThrowOnError extends boolean = true>(options: Op
  * @param {string=} options.body.email - `string` (optional)
  * @returns Possible status codes: 204, 400, 401, 403, 404, 429
  */
-export const requestPassword = <ThrowOnError extends boolean = true>(options?: Options<RequestPasswordData, ThrowOnError>) => {
-  return (options?.client ?? client).post<RequestPasswordResponses, RequestPasswordErrors, ThrowOnError, 'data'>({
+export const requestPassword = <ThrowOnError extends boolean = true>(options: Options<RequestPasswordData, ThrowOnError>) => {
+  return (options.client ?? client).post<RequestPasswordResponses, RequestPasswordErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
     url: '/auth/request-password',
     ...options,
     headers: {
       'Content-Type': 'application/json',
-      ...options?.headers,
+      ...options.headers,
     },
   });
 };
@@ -562,7 +562,7 @@ export const requestPassword = <ThrowOnError extends boolean = true>(options?: O
  * @param {createPasswordData} options
  * @param {string} options.path.tokenid - `string`
  * @param {string=} options.body.password - `string` (optional)
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ * @returns Possible status codes: 201, 400, 401, 403, 404, 429
  */
 export const createPassword = <ThrowOnError extends boolean = true>(options: Options<CreatePasswordData, ThrowOnError>) => {
   return (options.client ?? client).post<CreatePasswordResponses, CreatePasswordErrors, ThrowOnError, 'data'>({
@@ -590,14 +590,14 @@ export const createPassword = <ThrowOnError extends boolean = true>(options: Opt
  * @param {string=} options.body.password - `string` (optional)
  * @returns Possible status codes: 200, 400, 401, 403, 404, 429
  */
-export const signIn = <ThrowOnError extends boolean = true>(options?: Options<SignInData, ThrowOnError>) => {
-  return (options?.client ?? client).post<SignInResponses, SignInErrors, ThrowOnError, 'data'>({
+export const signIn = <ThrowOnError extends boolean = true>(options: Options<SignInData, ThrowOnError>) => {
+  return (options.client ?? client).post<SignInResponses, SignInErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
     url: '/auth/sign-in',
     ...options,
     headers: {
       'Content-Type': 'application/json',
-      ...options?.headers,
+      ...options.headers,
     },
   });
 };
@@ -614,11 +614,18 @@ export const signIn = <ThrowOnError extends boolean = true>(options?: Options<Si
  * @param {string=} options.body.attestationObject - `string` (optional)
  * @param {string=} options.body.clientDataJSON - `string` (optional)
  * @param {string=} options.body.nameOnDevice - `string` (optional)
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ * @returns Possible status codes: 201, 400, 401, 403, 404, 429
  */
 export const createPasskey = <ThrowOnError extends boolean = true>(options: Options<CreatePasskeyData, ThrowOnError>) => {
   return (options.client ?? client).post<CreatePasskeyResponses, CreatePasskeyErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
+    security: [
+      {
+        in: 'cookie',
+        name: 'cella-development-session-v1',
+        type: 'apiKey',
+      },
+    ],
     url: '/auth/passkey',
     ...options,
     headers: {
@@ -643,6 +650,13 @@ export const createPasskey = <ThrowOnError extends boolean = true>(options: Opti
 export const deletePasskey = <ThrowOnError extends boolean = true>(options: Options<DeletePasskeyData, ThrowOnError>) => {
   return (options.client ?? client).delete<DeletePasskeyResponses, DeletePasskeyErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
+    security: [
+      {
+        in: 'cookie',
+        name: 'cella-development-session-v1',
+        type: 'apiKey',
+      },
+    ],
     url: '/auth/passkey/{id}',
     ...options,
   });
@@ -662,14 +676,14 @@ export const deletePasskey = <ThrowOnError extends boolean = true>(options: Opti
  * @param {string=} options.body.email - `string` (optional)
  * @returns Possible status codes: 200, 400, 401, 403, 404, 429
  */
-export const generatePasskeyChallenge = <ThrowOnError extends boolean = true>(options?: Options<GeneratePasskeyChallengeData, ThrowOnError>) => {
-  return (options?.client ?? client).post<GeneratePasskeyChallengeResponses, GeneratePasskeyChallengeErrors, ThrowOnError, 'data'>({
+export const generatePasskeyChallenge = <ThrowOnError extends boolean = true>(options: Options<GeneratePasskeyChallengeData, ThrowOnError>) => {
+  return (options.client ?? client).post<GeneratePasskeyChallengeResponses, GeneratePasskeyChallengeErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
     url: '/auth/passkey/generate-challenge',
     ...options,
     headers: {
       'Content-Type': 'application/json',
-      ...options?.headers,
+      ...options.headers,
     },
   });
 };
@@ -692,21 +706,14 @@ export const generatePasskeyChallenge = <ThrowOnError extends boolean = true>(op
  * @param {string=} options.body.email - `string` (optional)
  * @returns Possible status codes: 204, 400, 401, 403, 404, 429
  */
-export const signInWithPasskey = <ThrowOnError extends boolean = true>(options?: Options<SignInWithPasskeyData, ThrowOnError>) => {
-  return (options?.client ?? client).post<SignInWithPasskeyResponses, SignInWithPasskeyErrors, ThrowOnError, 'data'>({
+export const signInWithPasskey = <ThrowOnError extends boolean = true>(options: Options<SignInWithPasskeyData, ThrowOnError>) => {
+  return (options.client ?? client).post<SignInWithPasskeyResponses, SignInWithPasskeyErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
-    security: [
-      {
-        in: 'cookie',
-        name: 'cella-development-session-v1',
-        type: 'apiKey',
-      },
-    ],
     url: '/auth/passkey-verification',
     ...options,
     headers: {
       'Content-Type': 'application/json',
-      ...options?.headers,
+      ...options.headers,
     },
   });
 };
@@ -914,8 +921,8 @@ export const getMe = <ThrowOnError extends boolean = true>(options?: Options<Get
  * @param {object=} options.body.userFlags - `object` (optional)
  * @returns Possible status codes: 200, 400, 401, 403, 404, 429
  */
-export const updateMe = <ThrowOnError extends boolean = true>(options?: Options<UpdateMeData, ThrowOnError>) => {
-  return (options?.client ?? client).put<UpdateMeResponses, UpdateMeErrors, ThrowOnError, 'data'>({
+export const updateMe = <ThrowOnError extends boolean = true>(options: Options<UpdateMeData, ThrowOnError>) => {
+  return (options.client ?? client).put<UpdateMeResponses, UpdateMeErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
     security: [
       {
@@ -928,7 +935,7 @@ export const updateMe = <ThrowOnError extends boolean = true>(options?: Options<
     ...options,
     headers: {
       'Content-Type': 'application/json',
-      ...options?.headers,
+      ...options.headers,
     },
   });
 };
@@ -1091,6 +1098,13 @@ export const deleteMySessions = <ThrowOnError extends boolean = true>(options?:
 export const deleteMyMembership = <ThrowOnError extends boolean = true>(options: Options<DeleteMyMembershipData, ThrowOnError>) => {
   return (options.client ?? client).delete<DeleteMyMembershipResponses, DeleteMyMembershipErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
+    security: [
+      {
+        in: 'cookie',
+        name: 'cella-development-session-v1',
+        type: 'apiKey',
+      },
+    ],
     url: '/me/leave',
     ...options,
   });
@@ -1141,13 +1155,6 @@ export const getUploadToken = <ThrowOnError extends boolean = true>(options: Opt
 export const unsubscribeMe = <ThrowOnError extends boolean = true>(options: Options<UnsubscribeMeData, ThrowOnError>) => {
   return (options.client ?? client).get<unknown, UnsubscribeMeErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
-    security: [
-      {
-        in: 'cookie',
-        name: 'cella-development-session-v1',
-        type: 'apiKey',
-      },
-    ],
     url: '/me/unsubscribe',
     ...options,
   });
@@ -1165,8 +1172,8 @@ export const unsubscribeMe = <ThrowOnError extends boolean = true>(options: Opti
  * @param {any[]=} options.body.ids - `any[]` (optional)
  * @returns Possible status codes: 200, 400, 401, 403, 404, 429
  */
-export const deleteUsers = <ThrowOnError extends boolean = true>(options?: Options<DeleteUsersData, ThrowOnError>) => {
-  return (options?.client ?? client).delete<DeleteUsersResponses, DeleteUsersErrors, ThrowOnError, 'data'>({
+export const deleteUsers = <ThrowOnError extends boolean = true>(options: Options<DeleteUsersData, ThrowOnError>) => {
+  return (options.client ?? client).delete<DeleteUsersResponses, DeleteUsersErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
     security: [
       {
@@ -1179,7 +1186,7 @@ export const deleteUsers = <ThrowOnError extends boolean = true>(options?: Optio
     ...options,
     headers: {
       'Content-Type': 'application/json',
-      ...options?.headers,
+      ...options.headers,
     },
   });
 };
@@ -1296,8 +1303,8 @@ export const updateUser = <ThrowOnError extends boolean = true>(options: Options
  * @param {any[]=} options.body.ids - `any[]` (optional)
  * @returns Possible status codes: 200, 400, 401, 403, 404, 429
  */
-export const deleteOrganizations = <ThrowOnError extends boolean = true>(options?: Options<DeleteOrganizationsData, ThrowOnError>) => {
-  return (options?.client ?? client).delete<DeleteOrganizationsResponses, DeleteOrganizationsErrors, ThrowOnError, 'data'>({
+export const deleteOrganizations = <ThrowOnError extends boolean = true>(options: Options<DeleteOrganizationsData, ThrowOnError>) => {
+  return (options.client ?? client).delete<DeleteOrganizationsResponses, DeleteOrganizationsErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
     security: [
       {
@@ -1310,7 +1317,7 @@ export const deleteOrganizations = <ThrowOnError extends boolean = true>(options
     ...options,
     headers: {
       'Content-Type': 'application/json',
-      ...options?.headers,
+      ...options.headers,
     },
   });
 };
@@ -1357,7 +1364,7 @@ export const getOrganizations = <ThrowOnError extends boolean = true>(options?:
  * @param {createOrganizationData} options
  * @param {string=} options.body.name - `string` (optional)
  * @param {string=} options.body.slug - `string` (optional)
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ * @returns Possible status codes: 201, 400, 401, 403, 404, 429
  */
 export const createOrganization = <ThrowOnError extends boolean = true>(options: Options<CreateOrganizationData, ThrowOnError>) => {
   return (options.client ?? client).post<CreateOrganizationResponses, CreateOrganizationErrors, ThrowOnError, 'data'>({
@@ -1536,8 +1543,8 @@ export const getContextEntity = <ThrowOnError extends boolean = true>(options: O
  * @param {enum=} options.body.entityType - `enum` (optional)
  * @returns Possible status codes: 204, 400, 401, 403, 404, 429
  */
-export const checkSlug = <ThrowOnError extends boolean = true>(options?: Options<CheckSlugData, ThrowOnError>) => {
-  return (options?.client ?? client).post<CheckSlugResponses, CheckSlugErrors, ThrowOnError, 'data'>({
+export const checkSlug = <ThrowOnError extends boolean = true>(options: Options<CheckSlugData, ThrowOnError>) => {
+  return (options.client ?? client).post<CheckSlugResponses, CheckSlugErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
     security: [
       {
@@ -1550,7 +1557,7 @@ export const checkSlug = <ThrowOnError extends boolean = true>(options?: Options
     ...options,
     headers: {
       'Content-Type': 'application/json',
-      ...options?.headers,
+      ...options.headers,
     },
   });
 };
@@ -1567,8 +1574,8 @@ export const checkSlug = <ThrowOnError extends boolean = true>(options?: Options
  * @param {any[]=} options.body.emails - `any[]` (optional)
  * @returns Possible status codes: 200, 400, 401, 403, 404, 429
  */
-export const systemInvite = <ThrowOnError extends boolean = true>(options?: Options<SystemInviteData, ThrowOnError>) => {
-  return (options?.client ?? client).post<SystemInviteResponses, SystemInviteErrors, ThrowOnError, 'data'>({
+export const systemInvite = <ThrowOnError extends boolean = true>(options: Options<SystemInviteData, ThrowOnError>) => {
+  return (options.client ?? client).post<SystemInviteResponses, SystemInviteErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
     security: [
       {
@@ -1581,7 +1588,7 @@ export const systemInvite = <ThrowOnError extends boolean = true>(options?: Opti
     ...options,
     headers: {
       'Content-Type': 'application/json',
-      ...options?.headers,
+      ...options.headers,
     },
   });
 };
@@ -1602,13 +1609,6 @@ export const systemInvite = <ThrowOnError extends boolean = true>(options?: Opti
 export const getPresignedUrl = <ThrowOnError extends boolean = true>(options: Options<GetPresignedUrlData, ThrowOnError>) => {
   return (options.client ?? client).get<GetPresignedUrlResponses, GetPresignedUrlErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
-    security: [
-      {
-        in: 'cookie',
-        name: 'cella-development-session-v1',
-        type: 'apiKey',
-      },
-    ],
     url: '/system/presigned-url',
     ...options,
   });
@@ -1629,13 +1629,6 @@ export const getPresignedUrl = <ThrowOnError extends boolean = true>(options: Op
 export const paddleWebhook = <ThrowOnError extends boolean = true>(options?: Options<PaddleWebhookData, ThrowOnError>) => {
   return (options?.client ?? client).post<PaddleWebhookResponses, PaddleWebhookErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
-    security: [
-      {
-        in: 'cookie',
-        name: 'cella-development-session-v1',
-        type: 'apiKey',
-      },
-    ],
     url: '/system/paddle-webhook',
     ...options,
     headers: {
@@ -1692,8 +1685,8 @@ export const sendNewsletter = <ThrowOnError extends boolean = true>(options: Opt
  * @param {any[]=} options.body.ids - `any[]` (optional)
  * @returns Possible status codes: 204, 400, 401, 403, 404, 429
  */
-export const deleteRequests = <ThrowOnError extends boolean = true>(options?: Options<DeleteRequestsData, ThrowOnError>) => {
-  return (options?.client ?? client).delete<DeleteRequestsResponses, DeleteRequestsErrors, ThrowOnError, 'data'>({
+export const deleteRequests = <ThrowOnError extends boolean = true>(options: Options<DeleteRequestsData, ThrowOnError>) => {
+  return (options.client ?? client).delete<DeleteRequestsResponses, DeleteRequestsErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
     security: [
       {
@@ -1706,7 +1699,7 @@ export const deleteRequests = <ThrowOnError extends boolean = true>(options?: Op
     ...options,
     headers: {
       'Content-Type': 'application/json',
-      ...options?.headers,
+      ...options.headers,
     },
   });
 };
@@ -1755,23 +1748,16 @@ export const getRequests = <ThrowOnError extends boolean = true>(options?: Optio
  * @param {string=} options.body.email - `string` (optional)
  * @param {enum=} options.body.type - `enum` (optional)
  * @param {string | null=} options.body.message - `string | null` (optional)
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ * @returns Possible status codes: 201, 400, 401, 403, 404, 429
  */
-export const createRequest = <ThrowOnError extends boolean = true>(options?: Options<CreateRequestData, ThrowOnError>) => {
-  return (options?.client ?? client).post<CreateRequestResponses, CreateRequestErrors, ThrowOnError, 'data'>({
+export const createRequest = <ThrowOnError extends boolean = true>(options: Options<CreateRequestData, ThrowOnError>) => {
+  return (options.client ?? client).post<CreateRequestResponses, CreateRequestErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
-    security: [
-      {
-        in: 'cookie',
-        name: 'cella-development-session-v1',
-        type: 'apiKey',
-      },
-    ],
     url: '/requests',
     ...options,
     headers: {
       'Content-Type': 'application/json',
-      ...options?.headers,
+      ...options.headers,
     },
   });
 };
@@ -1818,13 +1804,6 @@ export const getMetrics = <ThrowOnError extends boolean = true>(options?: Option
 export const getPublicCounts = <ThrowOnError extends boolean = true>(options?: Options<GetPublicCountsData, ThrowOnError>) => {
   return (options?.client ?? client).get<GetPublicCountsResponses, GetPublicCountsErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
-    security: [
-      {
-        in: 'cookie',
-        name: 'cella-development-session-v1',
-        type: 'apiKey',
-      },
-    ],
     url: '/metrics/public',
     ...options,
   });
@@ -1940,7 +1919,7 @@ export const getAttachments = <ThrowOnError extends boolean = true>(options: Opt
  *
  * @param {createAttachmentData} options
  * @param {string | string} options.path.orgidorslug - `string | string`
- * @returns Possible status codes: 200, 400, 401, 403, 404, 429
+ * @returns Possible status codes: 201, 400, 401, 403, 404, 429
  */
 export const createAttachment = <ThrowOnError extends boolean = true>(options: Options<CreateAttachmentData, ThrowOnError>) => {
   return (options.client ?? client).post<CreateAttachmentResponses, CreateAttachmentErrors, ThrowOnError, 'data'>({
@@ -2039,13 +2018,6 @@ export const updateAttachment = <ThrowOnError extends boolean = true>(options: O
 export const redirectToAttachment = <ThrowOnError extends boolean = true>(options: Options<RedirectToAttachmentData, ThrowOnError>) => {
   return (options.client ?? client).get<RedirectToAttachmentResponses, RedirectToAttachmentErrors, ThrowOnError, 'data'>({
     responseStyle: 'data',
-    security: [
-      {
-        in: 'cookie',
-        name: 'cella-development-session-v1',
-        type: 'apiKey',
-      },
-    ],
     url: '/{orgIdOrSlug}/attachments/{id}/link',
     ...options,
   });
diff --git a/frontend/src/api.gen/types.gen.ts b/frontend/src/api.gen/types.gen.ts
index 6d71b527a..d5028b9c7 100644
--- a/frontend/src/api.gen/types.gen.ts
+++ b/frontend/src/api.gen/types.gen.ts
@@ -208,7 +208,7 @@ export type ApiError = {
 };
 
 export type CheckEmailData = {
-  body?: {
+  body: {
     email: string;
   };
   path?: never;
@@ -677,13 +677,11 @@ export type CreateTotpResponses = {
   /**
    * TOTP created
    */
-  204: void;
+  201: unknown;
 };
 
-export type CreateTotpResponse = CreateTotpResponses[keyof CreateTotpResponses];
-
 export type SignInWithTotpData = {
-  body?: {
+  body: {
     code: string;
   };
   path?: never;
@@ -784,13 +782,11 @@ export type SignUpResponses = {
   /**
    * User signed up
    */
-  204: void;
+  201: unknown;
 };
 
-export type SignUpResponse = SignUpResponses[keyof SignUpResponses];
-
 export type SignUpWithTokenData = {
-  body?: {
+  body: {
     email: string;
     password: string;
   };
@@ -840,7 +836,7 @@ export type SignUpWithTokenResponses = {
   /**
    * User signed up
    */
-  200: {
+  201: {
     shouldRedirect: boolean;
     redirectPath?: string;
   };
@@ -849,7 +845,7 @@ export type SignUpWithTokenResponses = {
 export type SignUpWithTokenResponse = SignUpWithTokenResponses[keyof SignUpWithTokenResponses];
 
 export type RequestPasswordData = {
-  body?: {
+  body: {
     email: string;
   };
   path?: never;
@@ -902,7 +898,7 @@ export type RequestPasswordResponses = {
 export type RequestPasswordResponse = RequestPasswordResponses[keyof RequestPasswordResponses];
 
 export type CreatePasswordData = {
-  body?: {
+  body: {
     password: string;
   };
   path: {
@@ -951,7 +947,7 @@ export type CreatePasswordResponses = {
   /**
    * Password created
    */
-  200: {
+  201: {
     shouldRedirect: boolean;
     redirectPath?: string;
   };
@@ -960,7 +956,7 @@ export type CreatePasswordResponses = {
 export type CreatePasswordResponse = CreatePasswordResponses[keyof CreatePasswordResponses];
 
 export type SignInData = {
-  body?: {
+  body: {
     email: string;
     password: string;
   };
@@ -1066,7 +1062,7 @@ export type CreatePasskeyResponses = {
   /**
    * Passkey created
    */
-  200: {
+  201: {
     id: string;
     userId: string;
     deviceName: string | null;
@@ -1134,7 +1130,7 @@ export type DeletePasskeyResponses = {
 export type DeletePasskeyResponse = DeletePasskeyResponses[keyof DeletePasskeyResponses];
 
 export type GeneratePasskeyChallengeData = {
-  body?: {
+  body: {
     type: 'authentication' | 'mfa' | 'registration';
     email?: string;
   };
@@ -1191,7 +1187,7 @@ export type GeneratePasskeyChallengeResponses = {
 export type GeneratePasskeyChallengeResponse = GeneratePasskeyChallengeResponses[keyof GeneratePasskeyChallengeResponses];
 
 export type SignInWithPasskeyData = {
-  body?: {
+  body: {
     credentialId: string;
     clientDataJSON: string;
     authenticatorObject: string;
@@ -1624,7 +1620,7 @@ export type GetMeResponses = {
 export type GetMeResponse = GetMeResponses[keyof GetMeResponses];
 
 export type UpdateMeData = {
-  body?: {
+  body: {
     bannerUrl?: string | null;
     firstName?: string | null;
     lastName?: string | null;
@@ -2167,7 +2163,7 @@ export type UnsubscribeMeErrors = {
 export type UnsubscribeMeError = UnsubscribeMeErrors[keyof UnsubscribeMeErrors];
 
 export type DeleteUsersData = {
-  body?: {
+  body: {
     ids: Array<string>;
   };
   path?: never;
@@ -2405,7 +2401,7 @@ export type UpdateUserResponses = {
 export type UpdateUserResponse = UpdateUserResponses[keyof UpdateUserResponses];
 
 export type DeleteOrganizationsData = {
-  body?: {
+  body: {
     ids: Array<string>;
   };
   path?: never;
@@ -2569,7 +2565,7 @@ export type CreateOrganizationResponses = {
   /**
    * Organization was created
    */
-  200: Organization & {
+  201: Organization & {
     membership?: {
       id: string;
       contextType: 'organization';
@@ -2851,7 +2847,7 @@ export type GetContextEntityResponses = {
 export type GetContextEntityResponse = GetContextEntityResponses[keyof GetContextEntityResponses];
 
 export type CheckSlugData = {
-  body?: {
+  body: {
     slug: string;
     entityType: 'user' | 'organization' | 'attachment';
   };
@@ -2905,7 +2901,7 @@ export type CheckSlugResponses = {
 export type CheckSlugResponse = CheckSlugResponses[keyof CheckSlugResponses];
 
 export type SystemInviteData = {
-  body?: {
+  body: {
     emails: Array<string>;
   };
   path?: never;
@@ -3125,7 +3121,7 @@ export type SendNewsletterResponses = {
 export type SendNewsletterResponse = SendNewsletterResponses[keyof SendNewsletterResponses];
 
 export type DeleteRequestsData = {
-  body?: {
+  body: {
     ids: Array<string>;
   };
   path?: never;
@@ -3245,7 +3241,7 @@ export type GetRequestsResponses = {
 export type GetRequestsResponse = GetRequestsResponses[keyof GetRequestsResponses];
 
 export type CreateRequestData = {
-  body?: {
+  body: {
     email: string;
     type: 'waitlist' | 'newsletter' | 'contact';
     message: string | null;
@@ -3294,7 +3290,7 @@ export type CreateRequestResponses = {
   /**
    * Requests
    */
-  200: {
+  201: {
     createdAt: string;
     id: string;
     message: string | null;
@@ -3474,7 +3470,7 @@ export type ShapeProxyResponses = {
 };
 
 export type DeleteAttachmentsData = {
-  body?: {
+  body: {
     ids: Array<string>;
   };
   path: {
@@ -3655,7 +3651,7 @@ export type CreateAttachmentResponses = {
   /**
    * Attachment
    */
-  200: Array<Attachment>;
+  201: Array<Attachment>;
 };
 
 export type CreateAttachmentResponse = CreateAttachmentResponses[keyof CreateAttachmentResponses];
@@ -3715,7 +3711,7 @@ export type GetAttachmentResponses = {
 export type GetAttachmentResponse = GetAttachmentResponses[keyof GetAttachmentResponses];
 
 export type UpdateAttachmentData = {
-  body?: {
+  body: {
     name?: string;
     originalKey?: string;
   };
@@ -3823,7 +3819,7 @@ export type RedirectToAttachmentResponses = {
 };
 
 export type DeleteMembershipsData = {
-  body?: {
+  body: {
     ids: Array<string>;
   };
   path: {
@@ -3884,7 +3880,7 @@ export type DeleteMembershipsResponses = {
 export type DeleteMembershipsResponse = DeleteMembershipsResponses[keyof DeleteMembershipsResponses];
 
 export type MembershipInviteData = {
-  body?: {
+  body: {
     emails: Array<string>;
     role: 'member' | 'admin';
   };
diff --git a/frontend/src/api.gen/zod.gen.ts b/frontend/src/api.gen/zod.gen.ts
index b79498dff..1a8dc5497 100644
--- a/frontend/src/api.gen/zod.gen.ts
+++ b/frontend/src/api.gen/zod.gen.ts
@@ -217,11 +217,9 @@ export const zApiError = z.object({
 });
 
 export const zCheckEmailData = z.object({
-  body: z.optional(
-    z.object({
-      email: z.email(),
-    }),
-  ),
+  body: z.object({
+    email: z.email(),
+  }),
   path: z.optional(z.never()),
   query: z.optional(z.never()),
 });
@@ -332,17 +330,10 @@ export const zCreateTotpData = z.object({
   query: z.optional(z.never()),
 });
 
-/**
- * TOTP created
- */
-export const zCreateTotpResponse = z.void();
-
 export const zSignInWithTotpData = z.object({
-  body: z.optional(
-    z.object({
-      code: z.string().regex(/^\d{6}$/),
-    }),
-  ),
+  body: z.object({
+    code: z.string().regex(/^\d{6}$/),
+  }),
   path: z.optional(z.never()),
   query: z.optional(z.never()),
 });
@@ -363,18 +354,11 @@ export const zSignUpData = z.object({
   query: z.optional(z.never()),
 });
 
-/**
- * User signed up
- */
-export const zSignUpResponse = z.void();
-
 export const zSignUpWithTokenData = z.object({
-  body: z.optional(
-    z.object({
-      email: z.email(),
-      password: z.string().min(8).max(100),
-    }),
-  ),
+  body: z.object({
+    email: z.email(),
+    password: z.string().min(8).max(100),
+  }),
   path: z.object({
     tokenId: z.string(),
   }),
@@ -390,11 +374,9 @@ export const zSignUpWithTokenResponse = z.object({
 });
 
 export const zRequestPasswordData = z.object({
-  body: z.optional(
-    z.object({
-      email: z.email(),
-    }),
-  ),
+  body: z.object({
+    email: z.email(),
+  }),
   path: z.optional(z.never()),
   query: z.optional(z.never()),
 });
@@ -405,11 +387,9 @@ export const zRequestPasswordData = z.object({
 export const zRequestPasswordResponse = z.void();
 
 export const zCreatePasswordData = z.object({
-  body: z.optional(
-    z.object({
-      password: z.string().min(8).max(100),
-    }),
-  ),
+  body: z.object({
+    password: z.string().min(8).max(100),
+  }),
   path: z.object({
     tokenId: z.string(),
   }),
@@ -425,12 +405,10 @@ export const zCreatePasswordResponse = z.object({
 });
 
 export const zSignInData = z.object({
-  body: z.optional(
-    z.object({
-      email: z.email(),
-      password: z.string().min(8).max(100),
-    }),
-  ),
+  body: z.object({
+    email: z.email(),
+    password: z.string().min(8).max(100),
+  }),
   path: z.optional(z.never()),
   query: z.optional(z.never()),
 });
@@ -481,12 +459,10 @@ export const zDeletePasskeyData = z.object({
 export const zDeletePasskeyResponse = z.void();
 
 export const zGeneratePasskeyChallengeData = z.object({
-  body: z.optional(
-    z.object({
-      type: z.union([z.enum(['authentication']), z.enum(['mfa']), z.enum(['registration'])]),
-      email: z.optional(z.string()),
-    }),
-  ),
+  body: z.object({
+    type: z.union([z.enum(['authentication']), z.enum(['mfa']), z.enum(['registration'])]),
+    email: z.optional(z.string()),
+  }),
   path: z.optional(z.never()),
   query: z.optional(z.never()),
 });
@@ -500,16 +476,14 @@ export const zGeneratePasskeyChallengeResponse = z.object({
 });
 
 export const zSignInWithPasskeyData = z.object({
-  body: z.optional(
-    z.object({
-      credentialId: z.string(),
-      clientDataJSON: z.string(),
-      authenticatorObject: z.string(),
-      signature: z.string(),
-      type: z.union([z.enum(['authentication']), z.enum(['mfa'])]),
-      email: z.optional(z.string()),
-    }),
-  ),
+  body: z.object({
+    credentialId: z.string(),
+    clientDataJSON: z.string(),
+    authenticatorObject: z.string(),
+    signature: z.string(),
+    type: z.union([z.enum(['authentication']), z.enum(['mfa'])]),
+    email: z.optional(z.string()),
+  }),
   path: z.optional(z.never()),
   query: z.optional(z.never()),
 });
@@ -605,22 +579,20 @@ export const zGetMeData = z.object({
 export const zGetMeResponse = zUser;
 
 export const zUpdateMeData = z.object({
-  body: z.optional(
-    z.object({
-      bannerUrl: z.optional(z.union([z.string(), z.null()])),
-      firstName: z.optional(z.union([z.string().min(2).max(100), z.null()])),
-      lastName: z.optional(z.union([z.string().min(2).max(100), z.null()])),
-      language: z.optional(z.enum(['en', 'nl'])),
-      newsletter: z.optional(z.boolean()),
-      thumbnailUrl: z.optional(z.union([z.string(), z.null()])),
-      slug: z.optional(z.string().min(2).max(100)),
-      userFlags: z.optional(
-        z.object({
-          finishedOnboarding: z.optional(z.boolean()),
-        }),
-      ),
-    }),
-  ),
+  body: z.object({
+    bannerUrl: z.optional(z.union([z.string(), z.null()])),
+    firstName: z.optional(z.union([z.string().min(2).max(100), z.null()])),
+    lastName: z.optional(z.union([z.string().min(2).max(100), z.null()])),
+    language: z.optional(z.enum(['en', 'nl'])),
+    newsletter: z.optional(z.boolean()),
+    thumbnailUrl: z.optional(z.union([z.string(), z.null()])),
+    slug: z.optional(z.string().min(2).max(100)),
+    userFlags: z.optional(
+      z.object({
+        finishedOnboarding: z.optional(z.boolean()),
+      }),
+    ),
+  }),
   path: z.optional(z.never()),
   query: z.optional(z.never()),
 });
@@ -743,7 +715,7 @@ export const zGetMyInvitationsResponse = z.array(
 export const zDeleteMySessionsData = z.object({
   body: z.optional(
     z.object({
-      ids: z.array(z.string()).min(1),
+      ids: z.array(z.string()).min(1).max(50),
     }),
   ),
   path: z.optional(z.never()),
@@ -807,11 +779,9 @@ export const zUnsubscribeMeData = z.object({
 });
 
 export const zDeleteUsersData = z.object({
-  body: z.optional(
-    z.object({
-      ids: z.array(z.string()).min(1).max(50),
-    }),
-  ),
+  body: z.object({
+    ids: z.array(z.string()).min(1).max(50),
+  }),
   path: z.optional(z.never()),
   query: z.optional(z.never()),
 });
@@ -894,11 +864,9 @@ export const zUpdateUserData = z.object({
 export const zUpdateUserResponse = zUser;
 
 export const zDeleteOrganizationsData = z.object({
-  body: z.optional(
-    z.object({
-      ids: z.array(z.string()).min(1).max(50),
-    }),
-  ),
+  body: z.object({
+    ids: z.array(z.string()).min(1).max(50),
+  }),
   path: z.optional(z.never()),
   query: z.optional(z.never()),
 });
@@ -1078,12 +1046,10 @@ export const zGetContextEntityData = z.object({
 export const zGetContextEntityResponse = zContextEntityBaseSchema;
 
 export const zCheckSlugData = z.object({
-  body: z.optional(
-    z.object({
-      slug: z.string(),
-      entityType: z.enum(['user', 'organization', 'attachment']),
-    }),
-  ),
+  body: z.object({
+    slug: z.string(),
+    entityType: z.enum(['user', 'organization', 'attachment']),
+  }),
   path: z.optional(z.never()),
   query: z.optional(z.never()),
 });
@@ -1094,11 +1060,9 @@ export const zCheckSlugData = z.object({
 export const zCheckSlugResponse = z.void();
 
 export const zSystemInviteData = z.object({
-  body: z.optional(
-    z.object({
-      emails: z.array(z.email()).min(1).max(50),
-    }),
-  ),
+  body: z.object({
+    emails: z.array(z.email()).min(1).max(50),
+  }),
   path: z.optional(z.never()),
   query: z.optional(z.never()),
 });
@@ -1158,11 +1122,9 @@ export const zSendNewsletterData = z.object({
 export const zSendNewsletterResponse = z.void();
 
 export const zDeleteRequestsData = z.object({
-  body: z.optional(
-    z.object({
-      ids: z.array(z.string()).min(1).max(50),
-    }),
-  ),
+  body: z.object({
+    ids: z.array(z.string()).min(1).max(50),
+  }),
   path: z.optional(z.never()),
   query: z.optional(z.never()),
 });
@@ -1204,13 +1166,11 @@ export const zGetRequestsResponse = z.object({
 });
 
 export const zCreateRequestData = z.object({
-  body: z.optional(
-    z.object({
-      email: z.email(),
-      type: z.enum(['waitlist', 'newsletter', 'contact']),
-      message: z.union([z.string(), z.null()]),
-    }),
-  ),
+  body: z.object({
+    email: z.email(),
+    type: z.enum(['waitlist', 'newsletter', 'contact']),
+    message: z.union([z.string(), z.null()]),
+  }),
   path: z.optional(z.never()),
   query: z.optional(z.never()),
 });
@@ -1274,11 +1234,9 @@ export const zShapeProxyData = z.object({
 });
 
 export const zDeleteAttachmentsData = z.object({
-  body: z.optional(
-    z.object({
-      ids: z.array(z.string()).min(1).max(50),
-    }),
-  ),
+  body: z.object({
+    ids: z.array(z.string()).min(1).max(50),
+  }),
   path: z.object({
     orgIdOrSlug: z.string(),
   }),
@@ -1364,12 +1322,10 @@ export const zGetAttachmentData = z.object({
 export const zGetAttachmentResponse = zAttachment;
 
 export const zUpdateAttachmentData = z.object({
-  body: z.optional(
-    z.object({
-      name: z.optional(z.string()),
-      originalKey: z.optional(z.string()),
-    }),
-  ),
+  body: z.object({
+    name: z.optional(z.string()),
+    originalKey: z.optional(z.string()),
+  }),
   path: z.object({
     id: z.string(),
     orgIdOrSlug: z.string(),
@@ -1391,11 +1347,9 @@ export const zRedirectToAttachmentData = z.object({
 });
 
 export const zDeleteMembershipsData = z.object({
-  body: z.optional(
-    z.object({
-      ids: z.array(z.string()).min(1).max(50),
-    }),
-  ),
+  body: z.object({
+    ids: z.array(z.string()).min(1).max(50),
+  }),
   path: z.object({
     orgIdOrSlug: z.string(),
   }),
@@ -1414,12 +1368,10 @@ export const zDeleteMembershipsResponse = z.object({
 });
 
 export const zMembershipInviteData = z.object({
-  body: z.optional(
-    z.object({
-      emails: z.array(z.email().min(4).max(100)).min(1).max(50),
-      role: z.enum(['member', 'admin']),
-    }),
-  ),
+  body: z.object({
+    emails: z.array(z.email().min(4).max(100)).min(1).max(50),
+    role: z.enum(['member', 'admin']),
+  }),
   path: z.object({
     orgIdOrSlug: z.string(),
   }),
diff --git a/frontend/src/modules/auth/steps/check-email.tsx b/frontend/src/modules/auth/steps/check-email.tsx
index 36ffd4336..26c319a4d 100644
--- a/frontend/src/modules/auth/steps/check-email.tsx
+++ b/frontend/src/modules/auth/steps/check-email.tsx
@@ -19,7 +19,7 @@ import { defaultOnInvalid } from '~/utils/form-on-invalid';
 const enabledStrategies: readonly string[] = appConfig.enabledAuthStrategies;
 const emailEnabled = enabledStrategies.includes('password') || enabledStrategies.includes('passkey');
 
-const formSchema = zCheckEmailData.shape.body.unwrap();
+const formSchema = zCheckEmailData.shape.body;
 type FormValues = z.infer<typeof formSchema>;
 
 /**
diff --git a/frontend/src/modules/auth/steps/sign-up.tsx b/frontend/src/modules/auth/steps/sign-up.tsx
index 3e7744e43..26e9eb9ce 100644
--- a/frontend/src/modules/auth/steps/sign-up.tsx
+++ b/frontend/src/modules/auth/steps/sign-up.tsx
@@ -7,7 +7,7 @@ import { lazy, Suspense } from 'react';
 import { useForm } from 'react-hook-form';
 import { useTranslation } from 'react-i18next';
 import type { z } from 'zod';
-import { type SignUpData, type SignUpResponse, type SignUpWithTokenData, type SignUpWithTokenResponse, signUp, signUpWithToken } from '~/api.gen';
+import { type SignUpData, type SignUpResponses, type SignUpWithTokenData, type SignUpWithTokenResponse, signUp, signUpWithToken } from '~/api.gen';
 import { zSignUpData } from '~/api.gen/zod.gen';
 import type { ApiError } from '~/lib/api';
 import { LegalNotice } from '~/modules/auth/legal-notice';
@@ -40,7 +40,7 @@ export const SignUpStep = ({ tokenData }: { tokenData?: TokenData }) => {
   const isMobile = window.innerWidth < 640;
 
   // Handle basic sign up
-  const { mutate: _signUp, isPending } = useMutation<SignUpResponse, ApiError, NonNullable<SignUpData['body']>>({
+  const { mutate: _signUp, isPending } = useMutation<SignUpResponses[201], ApiError, NonNullable<SignUpData['body']>>({
     mutationFn: (body) => signUp({ body }),
     onSuccess: () => navigate({ to: '/auth/email-verification/$reason', params: { reason: 'signup' }, replace: true }),
   });
diff --git a/frontend/src/modules/common/contact-form/contact-form.tsx b/frontend/src/modules/common/contact-form/contact-form.tsx
index 3d40e7563..9d0e69129 100644
--- a/frontend/src/modules/common/contact-form/contact-form.tsx
+++ b/frontend/src/modules/common/contact-form/contact-form.tsx
@@ -23,7 +23,7 @@ const ContactForm = ({ dialog: isDialog }: { dialog?: boolean }) => {
   const { user } = useUserStore();
   const isMediumScreen = useBreakpoints('min', 'md');
 
-  const formSchema = zCreateRequestData.shape.body.unwrap().extend({ name: z.string().min(2, t('error:name_required')) });
+  const formSchema = zCreateRequestData.shape.body.extend({ name: z.string().min(2, t('error:name_required')) });
 
   type FormValues = z.infer<typeof formSchema>;
 
diff --git a/frontend/src/modules/me/query.ts b/frontend/src/modules/me/query.ts
index 27b904f07..99f49c13d 100644
--- a/frontend/src/modules/me/query.ts
+++ b/frontend/src/modules/me/query.ts
@@ -99,7 +99,7 @@ export const useToggleMfaMutation = () => {
  * @returns The mutation hook for updating the user flags.
  */
 export const useUpdateSelfFlagsMutation = () => {
-  return useMutation<User, ApiError, Pick<NonNullable<UpdateMeData['body']>, 'userFlags'>>({
+  return useMutation<User, ApiError, Pick<UpdateMeData['body'], 'userFlags'>>({
     mutationKey: meKeys.update.flags,
     mutationFn: (body) => updateMe({ body }),
     onSuccess: (updatedUser) => updateOnSuccesses(updatedUser),
diff --git a/frontend/src/modules/me/totp/setup.tsx b/frontend/src/modules/me/totp/setup.tsx
index 85ea8e859..1322364bd 100644
--- a/frontend/src/modules/me/totp/setup.tsx
+++ b/frontend/src/modules/me/totp/setup.tsx
@@ -3,7 +3,7 @@ import { CircleAlert, CopyCheckIcon, CopyIcon } from 'lucide-react';
 import { QRCodeSVG } from 'qrcode.react';
 import { useRef, useState } from 'react';
 import { useTranslation } from 'react-i18next';
-import { type ApiError, type CreateTotpData, type CreateTotpResponse, createTotp, generateTotpKey } from '~/api.gen';
+import { type ApiError, type CreateTotpData, type CreateTotpResponses, createTotp, generateTotpKey } from '~/api.gen';
 import { useCopyToClipboard } from '~/hooks/use-copy-to-clipboard';
 import { TotpConfirmationForm } from '~/modules/auth/totp-verify-code-form';
 import { useDialoger } from '~/modules/common/dialoger/use-dialoger';
@@ -19,7 +19,7 @@ export const SetupTotp = () => {
   const [formVersion, setFormVersion] = useState(0);
 
   // Mutation to validate and activate TOTP with provided code
-  const { mutate, isPending } = useMutation<CreateTotpResponse, ApiError | Error, NonNullable<CreateTotpData['body']>>({
+  const { mutate, isPending } = useMutation<CreateTotpResponses[201], ApiError | Error, NonNullable<CreateTotpData['body']>>({
     mutationFn: async (body) => await createTotp({ body }),
     onSuccess: () => {
       useDialoger.getState().remove('setup-totp');
diff --git a/frontend/src/modules/requests/waitlist-form.tsx b/frontend/src/modules/requests/waitlist-form.tsx
index d2454743a..f37ae2e6b 100644
--- a/frontend/src/modules/requests/waitlist-form.tsx
+++ b/frontend/src/modules/requests/waitlist-form.tsx
@@ -16,7 +16,7 @@ import { Input } from '~/modules/ui/input';
 import { cn } from '~/utils/cn';
 import { defaultOnInvalid } from '~/utils/form-on-invalid';
 
-const formSchema = zCreateRequestData.shape.body.unwrap();
+const formSchema = zCreateRequestData.shape.body;
 
 type FormValues = z.infer<typeof formSchema>;
 
diff --git a/frontend/src/modules/users/invite-users.tsx b/frontend/src/modules/users/invite-users.tsx
index 42d912efd..e2e7103ae 100644
--- a/frontend/src/modules/users/invite-users.tsx
+++ b/frontend/src/modules/users/invite-users.tsx
@@ -15,7 +15,7 @@ import { ToggleGroup, ToggleGroupItem } from '~/modules/ui/toggle-group';
 import InviteEmailForm from '~/modules/users/invite-email-form';
 import InviteSearchForm from '~/modules/users/invite-search-form';
 
-const InviteFormSchema = zMembershipInviteData.shape.body.unwrap();
+const InviteFormSchema = zMembershipInviteData.shape.body;
 export type InviteFormValues = z.infer<typeof InviteFormSchema>;
 
 export const useInviteFormDraft = (entityId?: string) => {

From f312f63838a633663240581d115bc574f2daa813 Mon Sep 17 00:00:00 2001
From: David Hordiienko <shiraz0david@gmail.com>
Date: Mon, 6 Oct 2025 11:35:51 +0300
Subject: [PATCH 42/48] chore: add account-security template for multiple
 scenarios

---
 backend/emails/account-security.tsx | 51 +++++++++++++++++++++++++++++
 locales/en/backend.json             |  9 ++++-
 2 files changed, 59 insertions(+), 1 deletion(-)
 create mode 100644 backend/emails/account-security.tsx

diff --git a/backend/emails/account-security.tsx b/backend/emails/account-security.tsx
new file mode 100644
index 000000000..1dab77e11
--- /dev/null
+++ b/backend/emails/account-security.tsx
@@ -0,0 +1,51 @@
+import { appConfig } from 'config';
+import i18n from 'i18next';
+import { Text } from 'jsx-email';
+import type { BasicTemplateType } from '../src/lib/mailer';
+import { AppLogo } from './components/app-logo';
+import { EmailContainer } from './components/container';
+import { EmailBody } from './components/email-body';
+import { EmailHeader } from './components/email-header';
+import { Footer } from './components/footer';
+
+export type AccountSecurityType =
+  | 'mfa-enabled'
+  | 'mfa-disabled'
+  | 'wrong-password-lockout';
+
+export interface AccountSecurityProps extends BasicTemplateType {
+  name: string;
+  type: AccountSecurityType;
+  details?: Record<string, string | number>; // Optional extra details for dynamic messages
+}
+
+export const AccountSecurity = ({
+  lng,
+  name,
+  type,
+  details,
+}: AccountSecurityProps) => {
+  // Base properties for all i18n calls
+  const baseProps = { lng, appName: appConfig.name };
+
+  const previewText = i18n.t(`backend:emails.account_security.preview`, { ...baseProps, name });
+
+  const headerText = i18n.t(`backend:emails.account_security.${type}.title`, baseProps);
+  const bodyText = i18n.t(`backend:emails.account_security.${type}.text`, { ...baseProps, ...details });
+
+  return (
+    <EmailContainer previewText={previewText}>
+      <EmailHeader headerText={headerText} />
+      <EmailBody>
+        <Text>
+          <span dangerouslySetInnerHTML={{ __html: bodyText }} />
+        </Text>
+      </EmailBody>
+      <AppLogo />
+      <Footer />
+    </EmailContainer>
+  );
+};
+
+// Template export
+export const Template = AccountSecurity;
diff --git a/locales/en/backend.json b/locales/en/backend.json
index 986591ddf..b6b732c0e 100644
--- a/locales/en/backend.json
+++ b/locales/en/backend.json
@@ -32,5 +32,12 @@
   "email.newsletter_request.title": "You're subscribed to our newsletter",
   "email.newsletter_request.text": "Thanks for subscribing to {{appName}} updates. We'll keep you in the loop with news, tips, and product updates.",
   "email.contact_request.title": "Our team has your request",
-  "email.contact_request.text": "Thanks for reaching out to {{appName}}. Our team will get back to you as soon as possible."
+  "email.contact_request.text": "Thanks for reaching out to {{appName}}. Our team will get back to you as soon as possible.",
+  "email.account_security.preview": "Hello {{name}}, security update for your {{appName}} account",
+  "email.account_security.mfa-enabled.title": "Multi-factor authentication enabled",
+  "email.account_security.mfa-disabled.title": "Multi-factor authentication disabled",
+  "email.account_security.wrong-password-lockout.title": "Account temporarily locked",
+  "email.account_security.mfa-enabled.text": "Your account on {{appName}} now has MFA enabled for extra security.",
+  "email.account_security.mfa-disabled.text": "MFA has been disabled on your {{appName}} account.",
+  "email.account_security.wrong-password-lockout.text": "There have been {{attempts}} unsuccessful login attempts on {{appName}}. Your account is locked for {{duration}} minutes."
 }

From f72e758e202bf782f6526219b4db9483fa11a122 Mon Sep 17 00:00:00 2001
From: gino1991 <ginopresilli@gmail.com>
Date: Mon, 6 Oct 2025 18:05:16 +0200
Subject: [PATCH 43/48] fix: Tests (remove res.jons on empty responses)

---
 backend/tests/sign-up/basic.test.ts | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/backend/tests/sign-up/basic.test.ts b/backend/tests/sign-up/basic.test.ts
index 6e039eb03..de121af17 100644
--- a/backend/tests/sign-up/basic.test.ts
+++ b/backend/tests/sign-up/basic.test.ts
@@ -37,11 +37,7 @@ describe('sign-up', async () => {
     );
 
     // Check the response status
-    expect(res.status).toBe(200);
-
-    // Check the response
-    const data = await res.json();
-    expect(data).toBe(true);
+    expect(res.status).toBe(201);
 
     // Check if the user was created in the database
     const [user] = await getUserByEmail(signUpUser.email);
@@ -66,9 +62,7 @@ describe('sign-up', async () => {
       { headers: defaultHeaders },
     );
 
-    expect(res.status).toBe(200);
-    const data = await res.json();
-    expect(data).toBe(true);
+    expect(res.status).toBe(204);
   });
 
   it('should not allow duplicate emails', async () => {

From 5afa171fad464d1ced0cb05327467c69280742e2 Mon Sep 17 00:00:00 2001
From: gino <ginopresilli@gmail.com>
Date: Tue, 7 Oct 2025 09:20:04 +0200
Subject: [PATCH 44/48] Potential fix for code scanning alert no. 27: Workflow
 does not contain permissions (#634)

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 .github/workflows/ci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f57e570f4..c2d688f1a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -151,6 +151,8 @@ jobs:
 
   # Generates draft release notes (for testing only)
   draft-release-notes:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo

From 240601d7727ad2c7f8f163f834f3fee7cd71dee9 Mon Sep 17 00:00:00 2001
From: David Hordiienko <90209095+LemonardoD@users.noreply.github.com>
Date: Tue, 7 Oct 2025 17:03:05 +0300
Subject: [PATCH 45/48] Chore/update blocknote (#636)

* chore: update blocknote

* chore: naming

* chore: add todo

* chore: fix side menu

* fix: header select

* fix: formattingToolBarConfig

* fix: readme
---
 frontend/package.json                         |   8 +-
 .../src/modules/common/blocknote/README.md    | 168 +++--
 .../common/blocknote/blocknote-config.ts      | 159 +----
 .../custom-elements/notify/index.tsx          |   2 +-
 .../custom-align-change.tsx                   |   8 +-
 .../custom-block-type-change.tsx              |  20 +-
 .../custom-text-type-change.tsx               |  23 +-
 .../open-preview-button.tsx                   |   3 +-
 .../custom-side-menu/drag-handle-button.tsx   |  65 --
 .../blocknote/custom-side-menu/index.tsx      |  53 +-
 .../custom-side-menu/reset-block-type.tsx     |  25 +-
 .../blocknote/helpers/header-item-select.ts   |  17 +
 .../modules/common/blocknote/helpers/index.ts |   4 +-
 .../common/blocknote/helpers/shad-cn.tsx      |   1 +
 .../src/modules/common/blocknote/index.tsx    |  46 +-
 .../modules/common/blocknote/type-to-keys.ts  |   4 +-
 .../src/modules/common/blocknote/types.ts     |  14 +-
 .../modules/system/create-newsletter-form.tsx |   2 +-
 pnpm-lock.yaml                                | 668 +++++++-----------
 19 files changed, 507 insertions(+), 783 deletions(-)
 delete mode 100644 frontend/src/modules/common/blocknote/custom-side-menu/drag-handle-button.tsx
 create mode 100644 frontend/src/modules/common/blocknote/helpers/header-item-select.ts

diff --git a/frontend/package.json b/frontend/package.json
index ae949ae3c..48f456a82 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -30,10 +30,10 @@
     "@atlaskit/pragmatic-drag-and-drop": "^1.7.7",
     "@atlaskit/pragmatic-drag-and-drop-auto-scroll": "^2.1.2",
     "@atlaskit/pragmatic-drag-and-drop-hitbox": "^1.1.0",
-    "@blocknote/code-block": "0.33.0",
-    "@blocknote/core": "0.33.0",
-    "@blocknote/react": "0.33.0",
-    "@blocknote/shadcn": "0.33.0",
+    "@blocknote/code-block": "0.40.0",
+    "@blocknote/core": "0.40.0",
+    "@blocknote/react": "0.40.0",
+    "@blocknote/shadcn": "0.40.0",
     "@electric-sql/client": "1.0.13",
     "@electric-sql/react": "1.0.13",
     "@floating-ui/dom": "^1.7.4",
diff --git a/frontend/src/modules/common/blocknote/README.md b/frontend/src/modules/common/blocknote/README.md
index 7beace7ad..47f8de7f7 100644
--- a/frontend/src/modules/common/blocknote/README.md
+++ b/frontend/src/modules/common/blocknote/README.md
@@ -2,59 +2,78 @@
 
 ## Overview
 
-**BlockNote** serves as the core text editor and has been customized to be an easy-to-configure tool tailored to your specific
-needs. The key benefits include modularity and flexibility.
+**BlockNote** serves as the core text editor and has been customized to be an easy-to-configure tool tailored to your
+specific needs. The key benefits include modularity and flexibility.
 
 ## BlockNote Block Customization Guide
 
 The default BlockNote schema can be extended to include custom block types, such as **Notify** and **Mention**. For example,
 you can find this custom components under `blocknote/custom-element`. For app-specific customizations, use `blocknote/
 app-specific-custom`.
-functions `getSideMenuItems` and `getSlashMenuItems` are required for integrating custom items into the side and slash menus,
-respectively. For default Cella usage, they should look like this:
+functions `getSideMenuItems` and `getSlashMenuItems` are required for integrating custom items into the side and slash
+menus, respectively. For default Cella usage, they should look like this:
 
 ```typescript
 export const getSideMenuItems = (dict: Dictionary) => [...blockTypeSelectItems(dict)];
 
-export const getSlashMenuItems = (editor: CustomBlockNoteEditor, allowedTypes: readonly CustomBlockTypes[]): DefaultReactSuggestionItem[] => {
-  // Get all available slash items
-  const baseItems = [...getDefaultReactSlashMenuItems(editor), getSlashSummaryItem(editor)];
-
-  // Filter allowed indexed and non-indexed types once
-  const allowedIndexed = customSlashIndexedItems.filter((type) => allowedTypes.includes(type));
-  const allowedNotIndexed = customSlashNotIndexedItems.filter((type) => allowedTypes.includes(type));
-
-  // Combine allowed types in order
-  const orderedTypes = [...allowedIndexed, ...allowedNotIndexed];
-
-  // Create a sort order map where keys map to their index in orderedTypes
-  const sortOrder = new Map(orderedTypes.flatMap((type, index) => typeToBlocknoteKeys[type].map((key) => [key, index])));
-
-  // Filter items that have keys present in sortOrder, then sort by that index
-  const filteredSortedItems = baseItems
-    .filter((item): item is DefaultSuggestionItem & { key: SlashItemKeys } => "key" in item && sortOrder.has(item.key as SlashItemKeys))
+// Generate the complete Slash menu items list
+export const getSlashMenuItems = (
+  editor: CustomBlockNoteEditor,
+  allowedTypes: CustomBlockTypes[],
+  headingLevels: NonNullable<CommonBlockNoteProps["headingLevels"]>
+): DefaultReactSuggestionItem[] => {
+  const baseItems = [...getDefaultReactSlashMenuItems(editor), getSlashNotifySlashItem(editor)];
+
+  // Filter heading keys based on allowed headingLevels
+  const { heading, ...restTypeToKeys } = { ...baseBlocknoteTypeToKeys };
+  const filteredHeading = heading.filter((key) => {
+    const match = key.match(/(?:_)?(\d)$/);
+    const level = match ? Number.parseInt(match[1], 10) : 1;
+    return headingLevels.includes(level as (typeof headingLevels)[number]);
+  });
+
+  // Build a map of allowed types to keys
+  const allowedTypeToKeys = {
+    ...restTypeToKeys,
+    heading: filteredHeading
+  };
+
+  // Only keep types that are allowed
+  const filteredTypeToKeys = Object.fromEntries(
+    Object.entries(allowedTypeToKeys).filter(([type]) => allowedTypes.includes(type as CustomBlockTypes))
+  );
+
+  // Flatten the keys to filter baseItems
+  const allowedKeys = Object.values(filteredTypeToKeys).flat();
+
+  // Optional: sort by `customSlashIndexedItems`
+  const sortOrder = new Map(
+    customSlashIndexedItems
+      .filter((type) => allowedTypes.includes(type))
+      .flatMap((type, index) => filteredTypeToKeys[type].map((key) => [key, index]))
+  );
+
+  return baseItems
+    .filter((item): item is DefaultSuggestionItem => "key" in item && allowedKeys.includes(item.key as DefaultSuggestionItem["key"]))
     .sort(({ key: first }, { key: second }) => {
       const aIndex = sortOrder.get(first) ?? Number.POSITIVE_INFINITY;
       const bIndex = sortOrder.get(second) ?? Number.POSITIVE_INFINITY;
       return aIndex - bIndex;
     });
-
-  return filteredSortedItems;
 };
 ```
 
 These functions are used to populate the menus with the default items and any custom items added to your configuration.
-However, the lists of items in the side and slash menus are also filtered by `customBlockTypeSelectItems`,
-`customSlashNotIndexedItems`, and `customSlashIndexedItems`.
+However, the lists of items in the side and slash menu can be filtered.
 
-- `customBlockTypeSelectItems` filters the block types available in the side menu.
-- `customSlashIndexedItems` & `customSlashNotIndexedItems` defines blocks that available for selection in the slash menu
+- `customBlockTypeSwitchItems` filters the block types available in the side menu.
+- props `excludeBlockTypes` and `excludeFileBlockTypes` on `BlockNote` defines blocks that available for selection in the slash menu
 
 By filtering these lists, you can control which block types and items are available to users in the side and slash menus,
 ensuring that only relevant blocks and actions are displayed.
 
-To add a new component, import it, add it to the schema, assign its type and key, and integrate it with `getSideMenuItems`
-and `getSlashMenuItems`.
+To add a new component, import it, add it to the schema, assign its type and key, and integrate it with
+`getSideMenuItems` and `getSlashMenuItems`.
 
 ### Example: Adding a Custom Summary Block
 
@@ -69,16 +88,10 @@ and `getSlashMenuItems`.
 
 ```typescript
 import { Summary, getSlashSummaryItem, insertSummarySideMenu } from "~/modules/common/blocknote/app-specific-custom/summary-block";
-
-export const baseBlockSpecs = { ...defaultBlockSpecs, notify: Notify }; // Adds Notify block
-export const baseInlineContentSpecs = { ...defaultInlineContentSpecs, mention: MentionSchema }; // Adds Mention tag
-export const baseStyleSpecs = { ...defaultStyleSpecs };
-
 // Base custom schema
-export const customSchema = BlockNoteSchema.create({
-  blockSpecs: baseBlockSpecs,
-  inlineContentSpecs: baseInlineContentSpecs,
-  styleSpecs: baseStyleSpecs
+export const customSchema = BlockNoteSchema.create().extend({
+  blockSpecs: { notify: notifyBlock() }, // Adds Notify block
+  inlineContentSpecs: { mention: MentionSchema } // Adds Mention tag
 });
 
 const typeToBlocknoteKeys: Record<CustomBlockTypes, SlashItemKeys[]> = {
@@ -86,7 +99,7 @@ const typeToBlocknoteKeys: Record<CustomBlockTypes, SlashItemKeys[]> = {
   summary: ["summary"]
 };
 
-export const customBlockTypeSelectItems: CustomBlockTypes[] = [...existingCustomBlockTypeSelectItems, "summary"];
+export const customBlockTypeSwitchItems: CustomBlockTypes[] = [...existingCustomBlockTypeSwitchItems, "summary"];
 export const getSideMenuItems = (dict: Dictionary) => [...blockTypeSelectItems(dict), insertSummarySideMenu()];
 
 declare module "~/modules/common/blocknote/types" {
@@ -95,36 +108,55 @@ declare module "~/modules/common/blocknote/types" {
   }
 }
 // Generate the complete Slash menu items list
-export const getSlashMenuItems = (editor: CustomBlockNoteEditor, allowedTypes: readonly CustomBlockTypes[]): DefaultReactSuggestionItem[] => {
-  // Get all available slash items
+export const getSlashMenuItems = (
+  editor: CustomBlockNoteEditor,
+  allowedTypes: CustomBlockTypes[],
+  headingLevels: NonNullable<CommonBlockNoteProps["headingLevels"]>
+): DefaultReactSuggestionItem[] => {
   const baseItems = [...getDefaultReactSlashMenuItems(editor), getSlashNotifySlashItem(editor), getSlashSummaryItem(editor)];
 
-  // Filter allowed indexed and non-indexed types once
-  const allowedIndexed = customSlashIndexedItems.filter((type) => allowedTypes.includes(type));
-  const allowedNotIndexed = customSlashNotIndexedItems.filter((type) => allowedTypes.includes(type));
-
-  // Combine allowed types in order
-  const orderedTypes = [...allowedIndexed, ...allowedNotIndexed];
-
-  // Create a sort order map where keys map to their index in orderedTypes
-  const sortOrder = new Map(orderedTypes.flatMap((type, index) => typeToBlocknoteKeys[type].map((key) => [key, index])));
-
-  // Filter items that have keys present in sortOrder, then sort by that index
-  const filteredSortedItems = baseItems
-    .filter((item): item is DefaultSuggestionItem & { key: SlashItemKeys } => "key" in item && sortOrder.has(item.key as SlashItemKeys))
+  // Filter heading keys based on allowed headingLevels
+  const { heading, ...restTypeToKeys } = { ...baseBlocknoteTypeToKeys };
+  const filteredHeading = heading.filter((key) => {
+    const match = key.match(/(?:_)?(\d)$/);
+    const level = match ? Number.parseInt(match[1], 10) : 1;
+    return headingLevels.includes(level as (typeof headingLevels)[number]);
+  });
+
+  // Build a map of allowed types to keys
+  const allowedTypeToKeys = {
+    ...restTypeToKeys,
+    heading: filteredHeading
+  };
+
+  // Only keep types that are allowed
+  const filteredTypeToKeys = Object.fromEntries(
+    Object.entries(allowedTypeToKeys).filter(([type]) => allowedTypes.includes(type as CustomBlockTypes))
+  );
+
+  // Flatten the keys to filter baseItems
+  const allowedKeys = Object.values(filteredTypeToKeys).flat();
+
+  // Optional: sort by `customSlashIndexedItems`
+  const sortOrder = new Map(
+    customSlashIndexedItems
+      .filter((type) => allowedTypes.includes(type))
+      .flatMap((type, index) => filteredTypeToKeys[type].map((key) => [key, index]))
+  );
+
+  return baseItems
+    .filter((item): item is DefaultSuggestionItem => "key" in item && allowedKeys.includes(item.key as DefaultSuggestionItem["key"]))
     .sort(({ key: first }, { key: second }) => {
       const aIndex = sortOrder.get(first) ?? Number.POSITIVE_INFINITY;
       const bIndex = sortOrder.get(second) ?? Number.POSITIVE_INFINITY;
       return aIndex - bIndex;
     });
-
-  return filteredSortedItems;
 };
 ```
 
 ## Allowed Types
 
-The `allowedTypes` property in `blocknote-appConfig.ts` defines the basic block types that Blocknote will handle. Types assigned to `allowedTypes` will be used by default. You can exclude some of the types by specifying them in the <BlockNote /> component configuration. This allows you to tailor the editor to specific needs.
+Keys of `customSchema.blockSpecs` will be used by default. You can exclude some of the types by specifying them in the <BlockNote /> component configuration. This allows you to tailor the editor to specific needs.
 
 Example Usage:
 
@@ -144,24 +176,24 @@ Example Usage:
 
 ## Side menu
 
-Our BlockNote component uses a custom side menu button. The block types specified in `sideMenuOpenOnTypes` will trigger the
-side menu to open when their side button is clicked. For other block types, this button only executes the drag functionality,
-and clicking on it has no additional effect.
+Our BlockNote component uses a custom side menu button. The block types specified in `customBlockTypeSwitchItems` will
+trigger the side menu to open when their side button is clicked. For other block types, this button only executes the
+drag functionality, and clicking on it has no additional effect.
 
-The menu will include blocks that are assigned in `getSideMenuItems` and filter them using `customBlockTypeSelectItems`.
-Essentially, `customBlockTypeSelectItems` allows you to filter out basic blocks from the side menu. However, when adding a
-custom block, it must be explicitly added to both `getSideMenuItems` and `customBlockTypeSelectItems` for it to appear in the
-side menu.
+The menu will include blocks that are assigned in `getSideMenuItems` and filter them using `customBlockTypeSwitchItems`.
+Essentially, `customBlockTypeSwitchItems` allows you to filter out basic blocks from the side menu. However, when adding
+a custom block, it must be explicitly added to both `getSideMenuItems` and `customBlockTypeSwitchItems` for it to appear
+in the side menu.
 
 ## Slash menu
 
 The slash menu is divided into two parts: indexed and not-indexed. This setup allows users to quickly select blocks by their
 number when interacting with the slash menu.
 
-The indexed items are defined in `customSlashIndexedItems`, while the not-indexed items are listed in
-`customSlashNotIndexedItems`. Items are added by their key rather than their type. It’s
-important to note that the number of indexed items should not exceed 9; otherwise, the functionality may not work as expected.
-Custom items are added to the slash menu using the `getSlashMenuItems` function.
+The indexed items are defined in `customSlashIndexedItems`, while all others become the not-indexed. Items are added by
+their key rather than their type. It’s important to note that the number of indexed items should not exceed 9;
+otherwise, the functionality may not work as expected. Custom items are added to the slash menu using the
+`getSlashMenuItems` function.
 
 ## File Upload
 
diff --git a/frontend/src/modules/common/blocknote/blocknote-config.ts b/frontend/src/modules/common/blocknote/blocknote-config.ts
index 442606806..a515d3c4b 100644
--- a/frontend/src/modules/common/blocknote/blocknote-config.ts
+++ b/frontend/src/modules/common/blocknote/blocknote-config.ts
@@ -1,26 +1,14 @@
-import {
-  BlockNoteSchema,
-  type CodeBlockOptions,
-  type DefaultSuggestionItem,
-  type Dictionary,
-  defaultBlockSpecs,
-  defaultInlineContentSpecs,
-  defaultStyleSpecs,
-} from '@blocknote/core';
+import { BlockNoteSchema, type DefaultSuggestionItem, type Dictionary } from '@blocknote/core';
 import { blockTypeSelectItems, type DefaultReactSuggestionItem, getDefaultReactSlashMenuItems } from '@blocknote/react';
-
 import { MentionSchema } from '~/modules/common/blocknote/custom-elements/mention/mention';
-import { getSlashNotifySlashItem, Notify } from '~/modules/common/blocknote/custom-elements/notify';
+import { getSlashNotifySlashItem, notifyBlock } from '~/modules/common/blocknote/custom-elements/notify';
 import { baseBlocknoteTypeToKeys } from '~/modules/common/blocknote/type-to-keys';
 import type {
-  BlockAlignTypes,
-  BlockStyleTypes,
   CommonBlockNoteProps,
   CustomBlockNoteEditor,
   CustomBlockTypes,
   CustomFormatToolBarConfig,
   SlashIndexedItems,
-  SlashItemKeys,
 } from '~/modules/common/blocknote/types';
 
 /**
@@ -28,44 +16,11 @@ import type {
  */
 
 // Base custom schema
-export const customSchema = BlockNoteSchema.create({
-  blockSpecs: { ...defaultBlockSpecs, notify: Notify }, // Adds Notify block
-  inlineContentSpecs: { ...defaultInlineContentSpecs, mention: MentionSchema }, // Adds Mention tag
-  styleSpecs: { ...defaultStyleSpecs },
+export const customSchema = BlockNoteSchema.create().extend({
+  blockSpecs: { notify: notifyBlock() }, // Adds Notify block
+  inlineContentSpecs: { mention: MentionSchema }, // Adds Mention tag
 });
 
-// Config for supported languages for BlockNote code blocks
-export const supportedLanguages = {
-  text: {
-    name: 'Plain Text',
-    aliases: ['text', 'txt', 'plain'],
-  },
-  html: {
-    name: 'HTML',
-    aliases: ['htm'],
-  },
-  javascript: {
-    name: 'JavaScript',
-    aliases: ['javascript', 'js'],
-  },
-  json: {
-    name: 'JSON',
-    aliases: ['json'],
-  },
-  jsonc: {
-    name: 'JSON with Comments',
-    aliases: ['jsonc'],
-  },
-  markdown: {
-    name: 'Markdown',
-    aliases: ['markdown', 'md'],
-  },
-  typescript: {
-    name: 'TypeScript',
-    aliases: ['typescript', 'ts'],
-  },
-} satisfies CodeBlockOptions['supportedLanguages'];
-
 // Extend Blocknote types to include custom block keys for slash menu
 declare module '~/modules/common/blocknote/types' {
   export interface ExtendableBlocknoteTypes {
@@ -73,36 +28,12 @@ declare module '~/modules/common/blocknote/types' {
   }
 }
 
-// Default allowed block types
-export const allowedTypes: CustomBlockTypes[] = [
-  'notify',
-  'table',
-  'emoji',
-  'paragraph',
-  'heading',
-  'codeBlock',
-  'bulletListItem',
-  'numberedListItem',
-  'checkListItem',
-  'toggleListItem',
-  'image',
-  'video',
-  'audio',
-  'file',
-];
-
-// Blocks to witch can be switched
-export const customBlockTypeSelectItems: CustomBlockTypes[] = ['heading', 'paragraph', 'bulletListItem', 'numberedListItem', 'checkListItem'];
-
-export const typeToBlocknoteKeys: Record<CustomBlockTypes, SlashItemKeys[]> = { ...baseBlocknoteTypeToKeys };
+// Blocks to witch can be switched by sidemenu btn or in formatting toolbar
+export const customBlockTypeSwitchItems: CustomBlockTypes[] = ['heading', 'paragraph', 'bulletListItem', 'numberedListItem', 'checkListItem'];
 
 /**
  *  Side Menu Configuration
  */
-// Block types that trigger the side menu when selected
-export const sideMenuOpenOnTypes: CustomBlockTypes[] = ['paragraph', 'heading', 'bulletListItem', 'numberedListItem', 'checkListItem'];
-
-// Generate side menu items based on dictionary input
 export const getSideMenuItems = (dict: Dictionary) => [...blockTypeSelectItems(dict)];
 
 /**
@@ -112,66 +43,55 @@ export const getSideMenuItems = (dict: Dictionary) => [...blockTypeSelectItems(d
 // Indexed items (max 9 for quick number-based selection)
 export const customSlashIndexedItems: SlashIndexedItems = ['image', 'video', 'file', 'bulletListItem', 'numberedListItem', 'checkListItem', 'notify'];
 
-// Non-indexed items (accessed via browsing)
-export const customSlashNotIndexedItems: CustomBlockTypes[] = [
-  'table',
-  'audio',
-  'heading',
-  'paragraph',
-  'codeBlock',
-  'quote',
-  'emoji',
-  'toggleListItem',
-  'checkListItem',
-];
-
 // Generate the complete Slash menu items list
 export const getSlashMenuItems = (
   editor: CustomBlockNoteEditor,
   allowedTypes: CustomBlockTypes[],
   headingLevels: NonNullable<CommonBlockNoteProps['headingLevels']>,
 ): DefaultReactSuggestionItem[] => {
-  // Get all available slash items
   const baseItems = [...getDefaultReactSlashMenuItems(editor), getSlashNotifySlashItem(editor)];
 
-  // Filter allowed indexed and non-indexed types once
-  const allowedIndexed = customSlashIndexedItems.filter((type) => allowedTypes.includes(type));
-  const allowedNotIndexed = customSlashNotIndexedItems.filter((type) => allowedTypes.includes(type));
-
-  // Combine allowed types in order
-  const orderedTypes = [...allowedIndexed, ...allowedNotIndexed];
-
-  const { heading, ...restTypeToKeys } = typeToBlocknoteKeys;
-
-  // Filter heading keys like "heading", "heading_2", "toggle_heading_3", etc.
-  const filteredHeading = heading.filter((el) => {
-    const match = el.match(/(?:_)?(\d)$/); // match ending digit with optional underscore (handles "heading_2" or "toggle_heading_3")
-    const level = match ? Number.parseInt(match[1], 10) : 1; // "heading" (no number) defaults to level 1
+  // Filter heading keys based on allowed headingLevels
+  const { heading, ...restTypeToKeys } = { ...baseBlocknoteTypeToKeys };
+  const filteredHeading = heading.filter((key) => {
+    const match = key.match(/(?:_)?(\d)$/);
+    const level = match ? Number.parseInt(match[1], 10) : 1;
     return headingLevels.includes(level as (typeof headingLevels)[number]);
   });
 
-  const validTypeToBlocknoteKeys = { ...restTypeToKeys, heading: filteredHeading };
-
-  // Create a sort order map where keys map to their index in orderedTypes
-  const sortOrder = new Map(orderedTypes.flatMap((type, index) => validTypeToBlocknoteKeys[type].map((key) => [key, index])));
-
-  // Filter items that have keys present in sortOrder, then sort by that index
-  const filteredSortedItems = baseItems
-    .filter((item): item is DefaultSuggestionItem & { key: SlashItemKeys } => 'key' in item && sortOrder.has(item.key as SlashItemKeys))
+  // Build a map of allowed types to keys
+  const allowedTypeToKeys = {
+    ...restTypeToKeys,
+    heading: filteredHeading,
+  };
+
+  // Only keep types that are allowed
+  const filteredTypeToKeys = Object.fromEntries(
+    Object.entries(allowedTypeToKeys).filter(([type]) => allowedTypes.includes(type as CustomBlockTypes)),
+  );
+
+  // Flatten the keys to filter baseItems
+  const allowedKeys = Object.values(filteredTypeToKeys).flat();
+
+  // Optional: sort by `customSlashIndexedItems`
+  const sortOrder = new Map(
+    customSlashIndexedItems
+      .filter((type) => allowedTypes.includes(type))
+      .flatMap((type, index) => filteredTypeToKeys[type].map((key) => [key, index])),
+  );
+
+  return baseItems
+    .filter((item): item is DefaultSuggestionItem => 'key' in item && allowedKeys.includes(item.key as DefaultSuggestionItem['key']))
     .sort(({ key: first }, { key: second }) => {
       const aIndex = sortOrder.get(first) ?? Number.POSITIVE_INFINITY;
       const bIndex = sortOrder.get(second) ?? Number.POSITIVE_INFINITY;
       return aIndex - bIndex;
     });
-
-  return filteredSortedItems;
 };
 
 /**
  *  Formatting toolbar Configuration
  */
-
-// Toolbar configuration settings
 export const customFormattingToolBarConfig: CustomFormatToolBarConfig = {
   blockTypeSelect: false,
   blockStyleSelect: true,
@@ -182,12 +102,3 @@ export const customFormattingToolBarConfig: CustomFormatToolBarConfig = {
   openPreview: true,
   createLink: true,
 };
-
-// Text alignment options available in the Formatting Toolbar
-export const formattingToolBarTextAlignItems: BlockAlignTypes[] = ['left', 'center', 'right'];
-
-// Text styles available in the Formatting Toolbar
-export const formattingToolBarTextStyleSelect: BlockStyleTypes[] = ['bold', 'italic', 'underline', 'strike', 'code'];
-
-// Blocks that can have formatting styles applied
-export const formattingToolBarStyleForBlocks: CustomBlockTypes[] = ['heading', 'paragraph', 'bulletListItem', 'numberedListItem', 'checkListItem'];
diff --git a/frontend/src/modules/common/blocknote/custom-elements/notify/index.tsx b/frontend/src/modules/common/blocknote/custom-elements/notify/index.tsx
index b9578abb0..a88ed06d9 100644
--- a/frontend/src/modules/common/blocknote/custom-elements/notify/index.tsx
+++ b/frontend/src/modules/common/blocknote/custom-elements/notify/index.tsx
@@ -14,7 +14,7 @@ import {
   DropdownMenuTrigger,
 } from '~/modules/ui/dropdown-menu';
 
-export const Notify = createReactBlockSpec(
+export const notifyBlock = createReactBlockSpec(
   {
     type: 'notify',
     propSchema: {
diff --git a/frontend/src/modules/common/blocknote/custom-formatting-toolbar/custom-align-change.tsx b/frontend/src/modules/common/blocknote/custom-formatting-toolbar/custom-align-change.tsx
index 28f769717..ee385d620 100644
--- a/frontend/src/modules/common/blocknote/custom-formatting-toolbar/custom-align-change.tsx
+++ b/frontend/src/modules/common/blocknote/custom-formatting-toolbar/custom-align-change.tsx
@@ -1,11 +1,15 @@
 import { TextAlignButton, useComponentsContext } from '@blocknote/react';
 import { ChevronDown, MoveHorizontal } from 'lucide-react';
-import { formattingToolBarTextAlignItems } from '~/modules/common/blocknote/blocknote-config';
+
+// Infer BasicTextAlign type directly from component prop
+type BasicTextAlign = React.ComponentProps<typeof TextAlignButton>['textAlignment'];
 
 export const CustomTextAlignSelect = () => {
   // biome-ignore lint/style/noNonNullAssertion: required by author
   const Components = useComponentsContext()!;
 
+  const variants = ['left', 'center', 'right', 'justify'] satisfies BasicTextAlign[];
+
   return (
     <Components.Generic.Menu.Root>
       <Components.Generic.Menu.Trigger>
@@ -16,7 +20,7 @@ export const CustomTextAlignSelect = () => {
       </Components.Generic.Menu.Trigger>
       <Components.Generic.Menu.Dropdown>
         <Components.Generic.Menu.Item className="no-hover-bg">
-          {formattingToolBarTextAlignItems.map((el) => (
+          {variants.map((el) => (
             <TextAlignButton textAlignment={el} key={`textAlign${el.charAt(0).toUpperCase() + el.slice(1)}Button`} />
           ))}
         </Components.Generic.Menu.Item>
diff --git a/frontend/src/modules/common/blocknote/custom-formatting-toolbar/custom-block-type-change.tsx b/frontend/src/modules/common/blocknote/custom-formatting-toolbar/custom-block-type-change.tsx
index c33724193..a646a88b8 100644
--- a/frontend/src/modules/common/blocknote/custom-formatting-toolbar/custom-block-type-change.tsx
+++ b/frontend/src/modules/common/blocknote/custom-formatting-toolbar/custom-block-type-change.tsx
@@ -10,8 +10,9 @@ import {
 } from '@blocknote/react';
 import { ChevronDown } from 'lucide-react';
 import { useMemo, useState } from 'react';
-import { customBlockTypeSelectItems } from '~/modules/common/blocknote/blocknote-config';
-import type { CustomBlockNoteMenuProps } from '~/modules/common/blocknote/types';
+import { customBlockTypeSwitchItems } from '~/modules/common/blocknote/blocknote-config';
+import { isHeadingMenuItemActive } from '~/modules/common/blocknote/helpers/header-item-select';
+import type { CustomBlock, CustomBlockNoteMenuProps } from '~/modules/common/blocknote/types';
 
 export const CellaCustomBlockTypeSelect = ({ headingLevels }: { headingLevels: CustomBlockNoteMenuProps['headingLevels'] }) => {
   // biome-ignore lint/style/noNonNullAssertion: required by author
@@ -21,7 +22,7 @@ export const CellaCustomBlockTypeSelect = ({ headingLevels }: { headingLevels: C
 
   const selectedBlocks = useSelectedBlocks(editor);
   const currentBlock = selectedBlocks[0];
-  const itemsType: readonly string[] = customBlockTypeSelectItems;
+  const itemsType: readonly string[] = customBlockTypeSwitchItems;
 
   const [block, setBlock] = useState(editor.getTextCursorPosition().block);
 
@@ -40,11 +41,10 @@ export const CellaCustomBlockTypeSelect = ({ headingLevels }: { headingLevels: C
   const shouldShow = useMemo(() => filteredItems.some((item) => item.type === block.type), [block.type, filteredItems]);
 
   const selectedItem = useMemo(() => {
-    // Return the first matching item with both type and level
-    if (currentBlock?.props?.level) {
-      return filteredItems.find((el) => el.type === currentBlock.type && el.name.includes(currentBlock.props.level));
-    }
-    return filteredItems.find((el) => el.type === currentBlock.type);
+    return filteredItems.find(
+      (el) =>
+        el.type === currentBlock.type && el.props?.level === currentBlock.props.level && !!el.props?.isToggleable === currentBlock.props.isToggleable,
+    );
   }, [filteredItems, currentBlock]);
 
   // Handle item click for updating the block type
@@ -62,12 +62,12 @@ export const CellaCustomBlockTypeSelect = ({ headingLevels }: { headingLevels: C
   const fullItems = useMemo(
     () =>
       filteredItems.map((item) => {
-        const { icon: Icon, isSelected, name } = item;
+        const { icon: Icon, name, type } = item;
         return {
           title: name,
           icon: <Icon size={16} />,
           onClick: () => handleItemClick(item),
-          isSelected: isSelected(block),
+          isSelected: block.type === 'heading' ? isHeadingMenuItemActive(block as unknown as CustomBlock, name) : block.type === type,
         };
       }),
     [block, filteredItems, editor, selectedBlocks],
diff --git a/frontend/src/modules/common/blocknote/custom-formatting-toolbar/custom-text-type-change.tsx b/frontend/src/modules/common/blocknote/custom-formatting-toolbar/custom-text-type-change.tsx
index 5cfe581fb..525a5c661 100644
--- a/frontend/src/modules/common/blocknote/custom-formatting-toolbar/custom-text-type-change.tsx
+++ b/frontend/src/modules/common/blocknote/custom-formatting-toolbar/custom-text-type-change.tsx
@@ -1,26 +1,21 @@
-import { BasicTextStyleButton, blockTypeSelectItems, useBlockNoteEditor, useDictionary, useEditorContentOrSelectionChange } from '@blocknote/react';
-import { useMemo, useState } from 'react';
-import { customSchema, formattingToolBarStyleForBlocks, formattingToolBarTextStyleSelect } from '~/modules/common/blocknote/blocknote-config';
+import { BasicTextStyleButton, useBlockNoteEditor, useEditorContentOrSelectionChange } from '@blocknote/react';
+import { useState } from 'react';
+import { customSchema } from '~/modules/common/blocknote/blocknote-config';
+
+// Infer BasicTextStyle type directly from component prop
+type BasicTextStyle = React.ComponentProps<typeof BasicTextStyleButton>['basicTextStyle'];
 
 export const CustomTextStyleSelect = () => {
-  const dict = useDictionary();
   const editor = useBlockNoteEditor(customSchema);
-  const [block, setBlock] = useState(editor.getTextCursorPosition().block);
-  const itemsType: readonly string[] = formattingToolBarStyleForBlocks;
-
-  const filteredItems = useMemo(() => blockTypeSelectItems(dict).filter((item) => itemsType.includes(item.type)), [editor, dict]);
-
-  const shouldShow = useMemo(() => filteredItems.some((item) => item.type === block.type), [block.type, filteredItems]);
-
+  const [_, setBlock] = useState(editor.getTextCursorPosition().block);
   // Update the block on content or selection change
   useEditorContentOrSelectionChange(() => setBlock(editor.getTextCursorPosition().block), editor);
 
-  // Early return if the block type should not show text styles
-  if (!shouldShow) return null;
+  const styles = ['bold', 'strike', 'italic', 'underline', 'code'] satisfies BasicTextStyle[];
 
   return (
     <>
-      {formattingToolBarTextStyleSelect.map((el) => (
+      {styles.map((el) => (
         <BasicTextStyleButton key={`${el}StyleButton`} basicTextStyle={el} />
       ))}
     </>
diff --git a/frontend/src/modules/common/blocknote/custom-formatting-toolbar/open-preview-button.tsx b/frontend/src/modules/common/blocknote/custom-formatting-toolbar/open-preview-button.tsx
index 3413bcc95..78b0cd80f 100644
--- a/frontend/src/modules/common/blocknote/custom-formatting-toolbar/open-preview-button.tsx
+++ b/frontend/src/modules/common/blocknote/custom-formatting-toolbar/open-preview-button.tsx
@@ -1,4 +1,3 @@
-import { checkBlockIsFileBlock } from '@blocknote/core';
 import { useBlockNoteEditor, useComponentsContext, useSelectedBlocks } from '@blocknote/react';
 import { Scaling } from 'lucide-react';
 import { useMemo, useRef } from 'react';
@@ -18,7 +17,7 @@ export const FileOpenPreviewButton = () => {
 
     const block = selectedBlocks[0];
 
-    return checkBlockIsFileBlock(block, editor);
+    return block.type === 'file';
   }, [editor, selectedBlocks]);
 
   if (!showButton) return null;
diff --git a/frontend/src/modules/common/blocknote/custom-side-menu/drag-handle-button.tsx b/frontend/src/modules/common/blocknote/custom-side-menu/drag-handle-button.tsx
deleted file mode 100644
index 751635791..000000000
--- a/frontend/src/modules/common/blocknote/custom-side-menu/drag-handle-button.tsx
+++ /dev/null
@@ -1,65 +0,0 @@
-import type {
-  BlockSchema,
-  DefaultBlockSchema,
-  DefaultInlineContentSchema,
-  DefaultStyleSchema,
-  InlineContentSchema,
-  StyleSchema,
-} from '@blocknote/core';
-import { DragHandleMenu, type SideMenuProps, useComponentsContext } from '@blocknote/react';
-import { GripVertical } from 'lucide-react';
-
-type CustomDragHandleButtonProps<
-  BSchema extends BlockSchema = DefaultBlockSchema,
-  I extends InlineContentSchema = DefaultInlineContentSchema,
-  S extends StyleSchema = DefaultStyleSchema,
-> = Omit<SideMenuProps<BSchema, I, S>, 'addBlock'> & {
-  hasDropdown?: boolean;
-  position?: 'left' | 'right' | 'top' | 'bottom';
-};
-
-export const CustomDragHandleButton = <
-  BSchema extends BlockSchema = DefaultBlockSchema,
-  I extends InlineContentSchema = DefaultInlineContentSchema,
-  S extends StyleSchema = DefaultStyleSchema,
->({
-  hasDropdown = false,
-  position = 'top',
-  dragHandleMenu: DragHandleContent = DragHandleMenu,
-  blockDragStart,
-  blockDragEnd,
-  freezeMenu,
-  unfreezeMenu,
-  block,
-}: CustomDragHandleButtonProps<BSchema, I, S>) => {
-  // biome-ignore lint/style/noNonNullAssertion: req by author
-  const Components = useComponentsContext()!;
-
-  // Wrapper to match the signature of onDragStart
-  const handleDragStart = ({ dataTransfer, clientY }: React.DragEvent) => {
-    blockDragStart?.({ dataTransfer, clientY }, block);
-  };
-
-  // Prevent form submission when clicking the drag handle button
-  const handleButtonClick = (e: React.MouseEvent) => e.preventDefault();
-
-  // Common button properties
-  const baseButtonProps = {
-    onDragStart: handleDragStart,
-    onDragEnd: blockDragEnd,
-    className: 'bn-button',
-    icon: <GripVertical size={22} data-test="dragHandle" />,
-  };
-
-  if (!hasDropdown) return <Components.SideMenu.Button {...baseButtonProps} onClick={handleButtonClick} label="Drag button" draggable />;
-
-  return (
-    <Components.Generic.Menu.Root onOpenChange={(open) => (open ? freezeMenu() : unfreezeMenu())} position={position}>
-      <Components.Generic.Menu.Trigger>
-        <Components.SideMenu.Button {...baseButtonProps} label="Open side menu" draggable />
-      </Components.Generic.Menu.Trigger>
-
-      <DragHandleContent block={block} />
-    </Components.Generic.Menu.Root>
-  );
-};
diff --git a/frontend/src/modules/common/blocknote/custom-side-menu/index.tsx b/frontend/src/modules/common/blocknote/custom-side-menu/index.tsx
index 9c9608a5b..94ba2977b 100644
--- a/frontend/src/modules/common/blocknote/custom-side-menu/index.tsx
+++ b/frontend/src/modules/common/blocknote/custom-side-menu/index.tsx
@@ -1,28 +1,35 @@
-import { DragHandleMenu, SideMenu, SideMenuController } from '@blocknote/react';
-import { sideMenuOpenOnTypes } from '~/modules/common/blocknote/blocknote-config';
-import { CustomDragHandleButton } from '~/modules/common/blocknote/custom-side-menu/drag-handle-button';
+import { DragHandleButton, SideMenu, SideMenuController, useComponentsContext } from '@blocknote/react';
+import { GripVertical } from 'lucide-react';
+import { customBlockTypeSwitchItems } from '~/modules/common/blocknote/blocknote-config';
 import { ResetBlockTypeItem } from '~/modules/common/blocknote/custom-side-menu/reset-block-type';
 import type { CustomBlockNoteMenuProps } from '~/modules/common/blocknote/types';
 
 // in this menu we have only drag button
-export const CustomSideMenu = ({ editor, allowedTypes, headingLevels }: CustomBlockNoteMenuProps) => (
-  <SideMenuController
-    sideMenu={(props) => (
-      <SideMenu {...props}>
-        <CustomDragHandleButton
-          hasDropdown={sideMenuOpenOnTypes.includes(props.block.type)}
-          dragHandleMenu={(props) => (
-            <>
-              {sideMenuOpenOnTypes.includes(props.block.type) ? (
-                <DragHandleMenu {...props}>
-                  <ResetBlockTypeItem editor={editor} props={props} allowedTypes={allowedTypes} headingLevels={headingLevels} />
-                </DragHandleMenu>
-              ) : null}
-            </>
+export const CustomSideMenu = ({ editor, allowedTypes, headingLevels }: CustomBlockNoteMenuProps) => {
+  // biome-ignore lint/style/noNonNullAssertion: req by author
+  const Components = useComponentsContext()!;
+
+  return (
+    <SideMenuController
+      sideMenu={(props) => (
+        <SideMenu {...props}>
+          {customBlockTypeSwitchItems.includes(props.block.type) ? (
+            <DragHandleButton {...props}>
+              <ResetBlockTypeItem editor={editor} props={props} allowedTypes={allowedTypes} headingLevels={headingLevels} />
+            </DragHandleButton>
+          ) : (
+            <Components.SideMenu.Button
+              onDragStart={(e) => props.blockDragStart(e, props.block)}
+              onDragEnd={props.blockDragEnd}
+              className="bn-button"
+              icon={<GripVertical size={22} data-test="dragHandle" />}
+              label="Open side menu"
+              draggable
+              onClick={(e) => e.preventDefault()}
+            />
           )}
-          {...props}
-        />
-      </SideMenu>
-    )}
-  />
-);
+        </SideMenu>
+      )}
+    />
+  );
+};
diff --git a/frontend/src/modules/common/blocknote/custom-side-menu/reset-block-type.tsx b/frontend/src/modules/common/blocknote/custom-side-menu/reset-block-type.tsx
index 8788c73ce..81343c461 100644
--- a/frontend/src/modules/common/blocknote/custom-side-menu/reset-block-type.tsx
+++ b/frontend/src/modules/common/blocknote/custom-side-menu/reset-block-type.tsx
@@ -1,23 +1,24 @@
 import type { Block, BlockConfig, InlineContentSchema, StyleSchema } from '@blocknote/core';
-import { type BlockTypeSelectItem, type DragHandleMenuProps, useComponentsContext, useDictionary } from '@blocknote/react';
+import { type BlockTypeSelectItem, SideMenuProps, useComponentsContext, useDictionary } from '@blocknote/react';
 import { useMemo } from 'react';
-import { customBlockTypeSelectItems, getSideMenuItems } from '~/modules/common/blocknote/blocknote-config';
+import { customBlockTypeSwitchItems, getSideMenuItems } from '~/modules/common/blocknote/blocknote-config';
 import { focusEditor } from '~/modules/common/blocknote/helpers/focus';
+import { isHeadingMenuItemActive } from '~/modules/common/blocknote/helpers/header-item-select';
 import type { CommonBlockNoteProps, CustomBlockNoteEditor, CustomBlockTypes } from '~/modules/common/blocknote/types';
 
 interface ResetBlockTypeItemProp {
   editor: CustomBlockNoteEditor;
-  props: DragHandleMenuProps;
+  props: Omit<SideMenuProps, 'addBlock'>;
   allowedTypes: CustomBlockTypes[];
   headingLevels: NonNullable<CommonBlockNoteProps['headingLevels']>;
 }
 
-export function ResetBlockTypeItem({ editor, props: { block }, allowedTypes, headingLevels }: ResetBlockTypeItemProp) {
+export function ResetBlockTypeItem({ editor, props: { block, unfreezeMenu }, allowedTypes, headingLevels }: ResetBlockTypeItemProp) {
   // biome-ignore lint/style/noNonNullAssertion: required by author
   const Components = useComponentsContext()!;
   const dict = useDictionary();
 
-  const filteredSelectItems = customBlockTypeSelectItems.filter((i) => allowedTypes.includes(i));
+  const filteredSelectItems = customBlockTypeSwitchItems.filter((i) => allowedTypes.includes(i));
   const selectItemsType: readonly string[] = filteredSelectItems;
 
   const filteredItems = useMemo(() => {
@@ -70,9 +71,19 @@ export function ResetBlockTypeItem({ editor, props: { block }, allowedTypes, hea
   return (
     <>
       {fullItems.map(({ title, type, icon, onClick }) => {
-        const isSelected = block.type === 'heading' ? title.includes(block.props.level.toString()) : block.type === type;
+        const isSelected = block.type === 'heading' ? isHeadingMenuItemActive(block, title) : block.type === type;
+
         return (
-          <Components.Generic.Menu.Item className="bn-menu-item" key={title} onClick={onClick} icon={icon} checked={isSelected}>
+          <Components.Generic.Menu.Item
+            className="bn-menu-item"
+            key={title}
+            onClick={() => {
+              onClick();
+              unfreezeMenu();
+            }}
+            icon={icon}
+            checked={isSelected}
+          >
             {title}
           </Components.Generic.Menu.Item>
         );
diff --git a/frontend/src/modules/common/blocknote/helpers/header-item-select.ts b/frontend/src/modules/common/blocknote/helpers/header-item-select.ts
new file mode 100644
index 000000000..10c2c3762
--- /dev/null
+++ b/frontend/src/modules/common/blocknote/helpers/header-item-select.ts
@@ -0,0 +1,17 @@
+import type { CustomBlock } from '~/modules/common/blocknote/types';
+
+/**
+ * Determines if a heading menu item should be selected.
+ * @param block - The block being rendered.
+ * @param title - The menu item title.
+ * @returns True if the menu item should be selected.
+ */
+export const isHeadingMenuItemActive = (block: CustomBlock, title: string): boolean => {
+  if (block.type !== 'heading') return false;
+
+  const levelMatch = title.includes(block.props.level.toString());
+  const isToggleable = !!block.props.isToggleable;
+  const toggleKeyword = 'Toggle';
+
+  return levelMatch && (isToggleable ? title.includes(toggleKeyword) : !title.includes(toggleKeyword));
+};
diff --git a/frontend/src/modules/common/blocknote/helpers/index.ts b/frontend/src/modules/common/blocknote/helpers/index.ts
index 1fc5620bb..a78415b18 100644
--- a/frontend/src/modules/common/blocknote/helpers/index.ts
+++ b/frontend/src/modules/common/blocknote/helpers/index.ts
@@ -14,9 +14,9 @@ export const getParsedContent = (initialStringifiedBlocks: string | undefined) =
   }
 };
 
-export const blocksToHTML = async (srtBlocks: string) => {
+export const blocksToHTML = (srtBlocks: string) => {
   const editor = BlockNoteEditor.create({ schema: customSchema, _headless: true });
   const blocks = JSON.parse(srtBlocks) as CustomBlock[];
 
-  return await editor.blocksToHTMLLossy(blocks);
+  return editor.blocksToHTMLLossy(blocks);
 };
diff --git a/frontend/src/modules/common/blocknote/helpers/shad-cn.tsx b/frontend/src/modules/common/blocknote/helpers/shad-cn.tsx
index 15804f3b3..e9db0eaa6 100644
--- a/frontend/src/modules/common/blocknote/helpers/shad-cn.tsx
+++ b/frontend/src/modules/common/blocknote/helpers/shad-cn.tsx
@@ -9,4 +9,5 @@ import * as Tabs from '~/modules/ui/tabs';
 import * as Toggle from '~/modules/ui/toggle';
 import * as Tooltip from '~/modules/ui/tooltip';
 
+// Ensure compatibility, your ShadCN components should not use Portals (comment these out from your DropdownMenu, Popover and Select components).
 export const shadCNComponents = { Button, DropdownMenu, Tooltip, Select, Label, Input, Card, Badge, Toggle, Tabs };
diff --git a/frontend/src/modules/common/blocknote/index.tsx b/frontend/src/modules/common/blocknote/index.tsx
index 0dc6a8de8..2770caec9 100644
--- a/frontend/src/modules/common/blocknote/index.tsx
+++ b/frontend/src/modules/common/blocknote/index.tsx
@@ -1,17 +1,14 @@
-import { codeBlock } from '@blocknote/code-block';
+import '@blocknote/shadcn/style.css';
+import '~/modules/common/blocknote/app-specific-custom/styles.css';
+import '~/modules/common/blocknote/styles.css';
+
 import { GridSuggestionMenuController, useCreateBlockNote } from '@blocknote/react';
 import { BlockNoteView } from '@blocknote/shadcn';
 import { type FocusEventHandler, type KeyboardEventHandler, type MouseEventHandler, useCallback, useEffect, useMemo, useRef } from 'react';
-
+import { getPresignedUrl } from '~/api.gen';
 import { useBreakpoints } from '~/hooks/use-breakpoints';
 import router from '~/lib/router';
-import {
-  allowedTypes,
-  customSchema,
-  customSlashIndexedItems,
-  customSlashNotIndexedItems,
-  supportedLanguages,
-} from '~/modules/common/blocknote/blocknote-config';
+import { customSchema, customSlashIndexedItems } from '~/modules/common/blocknote/blocknote-config';
 import { Mention } from '~/modules/common/blocknote/custom-elements/mention';
 import { CustomFilePanel } from '~/modules/common/blocknote/custom-file-panel';
 import { CustomFormattingToolbar } from '~/modules/common/blocknote/custom-formatting-toolbar';
@@ -21,15 +18,15 @@ import { compareIsContentSame, getParsedContent } from '~/modules/common/blockno
 import { getDictionary } from '~/modules/common/blocknote/helpers/dictionary';
 import { focusEditor } from '~/modules/common/blocknote/helpers/focus';
 import { openAttachment } from '~/modules/common/blocknote/helpers/open-attachment';
-import { shadCNComponents } from '~/modules/common/blocknote/helpers/shad-cn';
-import type { CommonBlockNoteProps, CustomBlockFileTypes, CustomBlockNoteEditor, CustomBlockRegularTypes } from '~/modules/common/blocknote/types';
+import type {
+  CommonBlockNoteProps,
+  CustomBlockFileTypes,
+  CustomBlockNoteEditor,
+  CustomBlockRegularTypes,
+  CustomBlockTypes,
+} from '~/modules/common/blocknote/types';
 import { useUIStore } from '~/store/ui';
 
-import '@blocknote/shadcn/style.css';
-import { getPresignedUrl } from '~/api.gen';
-import '~/modules/common/blocknote/app-specific-custom/styles.css';
-import '~/modules/common/blocknote/styles.css';
-
 type BlockNoteProps =
   | (CommonBlockNoteProps & {
       type: 'edit' | 'create';
@@ -46,6 +43,7 @@ type BlockNoteProps =
       baseFilePanelProps?: never;
     });
 
+// TODO ensure code block highliht works and shadCn components
 const BlockNote = ({
   id,
   type,
@@ -55,7 +53,6 @@ const BlockNote = ({
   clickOpensPreview = false, // click on FileBlock opens preview (in case, type is 'preview' or not editable)
   // Editor functional
   headingLevels = [1, 2, 3],
-  codeBlockDefaultLanguage = 'text',
   editable = type !== 'preview',
   sideMenu = true,
   slashMenu = true,
@@ -78,22 +75,15 @@ const BlockNote = ({
 
   const blockNoteRef = useRef<HTMLDivElement | null>(null);
 
-  const allowedBlockTypes = allowedTypes.filter(
+  const defaultAllowedBlockTypes = Object.keys(customSchema.blockSpecs) as CustomBlockTypes[];
+  const allowedBlockTypes = defaultAllowedBlockTypes.filter(
     (type) => !excludeBlockTypes.includes(type as CustomBlockRegularTypes) && !excludeFileBlockTypes.includes(type as CustomBlockFileTypes),
   );
 
-  const emojiPicker = slashMenu
-    ? [...customSlashIndexedItems, ...customSlashNotIndexedItems].includes('emoji') && allowedBlockTypes.includes('emoji')
-    : emojis;
+  const emojiPicker = slashMenu ? customSlashIndexedItems.includes('emoji') && allowedBlockTypes.includes('emoji') : emojis;
 
   const editor = useCreateBlockNote({
     schema: customSchema,
-    codeBlock: {
-      indentLineWithTab: true,
-      defaultLanguage: codeBlockDefaultLanguage,
-      supportedLanguages,
-      createHighlighter: codeBlock.createHighlighter,
-    },
     heading: { levels: headingLevels },
     trailingBlock,
     dictionary: getDictionary(),
@@ -213,7 +203,7 @@ const BlockNote = ({
       ref={blockNoteRef}
       className={className}
       data-color-scheme={mode}
-      shadCNComponents={shadCNComponents}
+      // shadCNComponents={shadCNComponents}
       sideMenu={false}
       slashMenu={!slashMenu}
       formattingToolbar={!formattingToolbar}
diff --git a/frontend/src/modules/common/blocknote/type-to-keys.ts b/frontend/src/modules/common/blocknote/type-to-keys.ts
index 34519b7a1..4db0a9849 100644
--- a/frontend/src/modules/common/blocknote/type-to-keys.ts
+++ b/frontend/src/modules/common/blocknote/type-to-keys.ts
@@ -1,6 +1,6 @@
 import type { CustomBlockTypes, SlashItemKeys } from '~/modules/common/blocknote/types';
 
-export const baseBlocknoteTypeToKeys: Record<CustomBlockTypes, SlashItemKeys[]> = {
+export const baseBlocknoteTypeToKeys = {
   table: ['table'],
   notify: ['notify'],
   paragraph: ['paragraph'],
@@ -16,4 +16,4 @@ export const baseBlocknoteTypeToKeys: Record<CustomBlockTypes, SlashItemKeys[]>
   audio: ['audio'],
   emoji: ['emoji'],
   toggleListItem: ['toggle_list'],
-};
+} satisfies Record<CustomBlockTypes, SlashItemKeys[]>;
diff --git a/frontend/src/modules/common/blocknote/types.ts b/frontend/src/modules/common/blocknote/types.ts
index b1f52721a..7a312038e 100644
--- a/frontend/src/modules/common/blocknote/types.ts
+++ b/frontend/src/modules/common/blocknote/types.ts
@@ -1,11 +1,10 @@
-import type { BlockNoteEditorOptions } from '@blocknote/core';
+import type { HeadingOptions } from '@blocknote/core';
 import type { FilePanelProps } from '@blocknote/react';
 import type React from 'react';
-import type { customSchema, supportedLanguages } from '~/modules/common/blocknote/blocknote-config';
+import type { customSchema } from '~/modules/common/blocknote/blocknote-config';
 import type { UploadedUppyFile } from '~/modules/common/uploader/types';
 import type { Member } from '~/modules/memberships/types';
 
-type CustomSchema = typeof customSchema;
 export type CustomBlockNoteEditor = typeof customSchema.BlockNoteEditor;
 export type CustomBlock = typeof customSchema.Block;
 
@@ -26,10 +25,6 @@ export interface CustomFormatToolBarConfig {
   createLink?: boolean;
 }
 
-// Define types for block alignment and styles
-export type BlockAlignTypes = 'right' | 'center' | 'left';
-export type BlockStyleTypes = 'bold' | 'italic' | 'underline' | 'strike' | 'code';
-
 type MaxNineItems<T extends string> =
   | [T]
   | [T, T]
@@ -64,10 +59,7 @@ export type CommonBlockNoteProps = {
   defaultValue?: string; // stringified block
   editable?: boolean;
   className?: string;
-  codeBlockDefaultLanguage?: keyof typeof supportedLanguages;
-  headingLevels?: NonNullable<
-    BlockNoteEditorOptions<CustomSchema['blockSchema'], CustomSchema['inlineContentSchema'], CustomSchema['styleSchema']>['heading']
-  >['levels'];
+  headingLevels?: NonNullable<HeadingOptions['defaultLevel']>[];
   sideMenu?: boolean;
   slashMenu?: boolean;
   formattingToolbar?: boolean;
diff --git a/frontend/src/modules/system/create-newsletter-form.tsx b/frontend/src/modules/system/create-newsletter-form.tsx
index 008588b3f..914a22a18 100644
--- a/frontend/src/modules/system/create-newsletter-form.tsx
+++ b/frontend/src/modules/system/create-newsletter-form.tsx
@@ -70,7 +70,7 @@ const CreateNewsletterForm = ({ organizationIds, callback }: CreateNewsletterFor
     const body = {
       ...data,
       organizationIds,
-      content: await blocksToHTML(data.content),
+      content: blocksToHTML(data.content),
     };
     _sendNewsletter({ body, toSelf: !!testOnly });
   };
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 8760e8632..cd3df45ab 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -351,17 +351,17 @@ importers:
         specifier: ^1.1.0
         version: 1.1.0
       '@blocknote/code-block':
-        specifier: 0.33.0
-        version: 0.33.0(@blocknote/core@0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0))
+        specifier: 0.40.0
+        version: 0.40.0(@blocknote/core@0.40.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@tiptap/extensions@3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))(@tiptap/pm@3.6.5))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0))
       '@blocknote/core':
-        specifier: 0.33.0
-        version: 0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)
+        specifier: 0.40.0
+        version: 0.40.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@tiptap/extensions@3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))(@tiptap/pm@3.6.5))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)
       '@blocknote/react':
-        specifier: 0.33.0
-        version: 0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+        specifier: 0.40.0
+        version: 0.40.0(@floating-ui/dom@1.7.4)(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@tiptap/extensions@3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))(@tiptap/pm@3.6.5))(@types/hast@3.0.4)(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(highlight.js@11.11.1)(lowlight@3.3.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@blocknote/shadcn':
-        specifier: 0.33.0
-        version: 0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(highlight.js@11.11.1)(lowlight@3.3.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(tsx@4.20.6)(yaml@2.8.1)
+        specifier: 0.40.0
+        version: 0.40.0(@floating-ui/dom@1.7.4)(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@tiptap/extensions@3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))(@tiptap/pm@3.6.5))(@types/hast@3.0.4)(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(highlight.js@11.11.1)(lowlight@3.3.0)(postcss@8.5.6)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(tailwindcss@4.1.14)
       '@electric-sql/client':
         specifier: 1.0.13
         version: 1.0.13
@@ -487,7 +487,7 @@ importers:
         version: 1.132.33(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@tanstack/react-router-devtools':
         specifier: ^1.132.33
-        version: 1.132.33(@tanstack/react-router@1.132.33(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(@tanstack/router-core@1.132.33)(@types/node@24.6.2)(csstype@3.1.3)(jiti@1.21.7)(lightningcss@1.30.1)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.6)(yaml@2.8.1)
+        version: 1.132.33(@tanstack/react-router@1.132.33(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(@tanstack/router-core@1.132.33)(@types/node@24.6.2)(csstype@3.1.3)(jiti@2.6.1)(lightningcss@1.30.1)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.6)(yaml@2.8.1)
       '@uppy/audio':
         specifier: ^3.0.1
         version: 3.0.1(@uppy/core@5.0.2)
@@ -682,7 +682,7 @@ importers:
         version: 0.44.0(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(solid-js@1.9.9)(vue@3.5.13(typescript@5.9.3))
       vitest:
         specifier: ^3.2.4
-        version: 3.2.4(@types/debug@4.1.12)(@types/node@24.6.2)(@vitest/browser@3.2.4)(jiti@1.21.7)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+        version: 3.2.4(@types/debug@4.1.12)(@types/node@24.6.2)(@vitest/browser@3.2.4)(jiti@2.6.1)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
       workbox-window:
         specifier: ^7.3.0
         version: 7.3.0
@@ -698,13 +698,13 @@ importers:
     devDependencies:
       '@chromatic-com/storybook':
         specifier: ^4.1.1
-        version: 4.1.1(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
+        version: 4.1.1(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
       '@hey-api/openapi-ts':
         specifier: ^0.84.4
         version: 0.84.4(magicast@0.3.5)(typescript@5.9.3)
       '@react-scan/vite-plugin-react-scan':
         specifier: ^0.1.8
-        version: 0.1.8(react-scan@0.4.3(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react-router-dom@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react-router@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react@19.2.0)(rollup@2.79.2))(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+        version: 0.1.8(react-scan@0.4.3(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react-router-dom@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react-router@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react@19.2.0)(rollup@2.79.2))(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@rollup/plugin-terser':
         specifier: ^0.4.4
         version: 0.4.4(rollup@2.79.2)
@@ -713,25 +713,25 @@ importers:
         version: 3.6.1
       '@storybook/addon-a11y':
         specifier: ^9.1.10
-        version: 9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
+        version: 9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
       '@storybook/addon-docs':
         specifier: ^9.1.10
-        version: 9.1.10(@types/react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
+        version: 9.1.10(@types/react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
       '@storybook/addon-vitest':
         specifier: ^9.1.10
-        version: 9.1.10(@vitest/browser@3.2.4)(@vitest/runner@3.2.4)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(vitest@3.2.4)
+        version: 9.1.10(@vitest/browser@3.2.4)(@vitest/runner@3.2.4)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(vitest@3.2.4)
       '@storybook/react-vite':
         specifier: ^9.1.10
-        version: 9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(rollup@2.79.2)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(typescript@5.9.3)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+        version: 9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(rollup@2.79.2)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(typescript@5.9.3)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@tailwindcss/vite':
         specifier: ^4.1.14
-        version: 4.1.14(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+        version: 4.1.14(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@tanstack/router-core':
         specifier: ^1.132.33
         version: 1.132.33
       '@tanstack/router-plugin':
         specifier: ^1.132.33
-        version: 1.132.33(@tanstack/react-router@1.132.33(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+        version: 1.132.33(@tanstack/react-router@1.132.33(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@types/canvas-confetti':
         specifier: ^1.9.0
         version: 1.9.0
@@ -752,13 +752,13 @@ importers:
         version: 7.0.0-dev.20250910.1
       '@vitejs/plugin-basic-ssl':
         specifier: ^2.1.0
-        version: 2.1.0(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+        version: 2.1.0(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@vitejs/plugin-react':
         specifier: ^5.0.4
-        version: 5.0.4(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+        version: 5.0.4(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@vitest/browser':
         specifier: ^3.2.4
-        version: 3.2.4(playwright@1.55.1)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)
+        version: 3.2.4(playwright@1.55.1)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)
       '@vitest/coverage-v8':
         specifier: ^3.2.4
         version: 3.2.4(@vitest/browser@3.2.4)(vitest@3.2.4)
@@ -785,7 +785,7 @@ importers:
         version: 6.0.4(rollup@2.79.2)
       storybook:
         specifier: ^9.1.10
-        version: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+        version: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       tsx:
         specifier: ^4.20.6
         version: 4.20.6
@@ -794,19 +794,19 @@ importers:
         version: 5.9.3
       vite:
         specifier: ^7.1.9
-        version: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+        version: 7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
       vite-plugin-html:
         specifier: ^3.2.2
-        version: 3.2.2(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+        version: 3.2.2(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       vite-plugin-pwa:
         specifier: ^1.0.3
-        version: 1.0.3(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(workbox-build@7.3.0(@types/babel__core@7.20.5))(workbox-window@7.3.0)
+        version: 1.0.3(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(workbox-build@7.3.0(@types/babel__core@7.20.5))(workbox-window@7.3.0)
       vite-plugin-static-copy:
         specifier: ^3.1.3
-        version: 3.1.3(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+        version: 3.1.3(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       vite-tsconfig-paths:
         specifier: ^5.1.4
-        version: 5.1.4(typescript@5.9.3)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+        version: 5.1.4(typescript@5.9.3)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       wait-on:
         specifier: ^8.0.5
         version: 8.0.5
@@ -1643,30 +1643,31 @@ packages:
     cpu: [x64]
     os: [win32]
 
-  '@blocknote/code-block@0.33.0':
-    resolution: {integrity: sha512-PITKLHUITKp3orc9+PMcoS/Hw4NIWEFxdxUQ92pnE6/cnmTCvqZFcBC5AH6uzRAFRfd7Jc/in9OiEosm0miWsg==}
+  '@blocknote/code-block@0.40.0':
+    resolution: {integrity: sha512-RD5eecQbv2t0RkT0ijbU0zYV/S67yXNjt708ks12ulTPn4IQantuD1vGOsHQk8TTErPzHVl8Ad4tY75ZhqxqAQ==}
     peerDependencies:
-      '@blocknote/core': ^0.33.0
+      '@blocknote/core': ^0.40.0
 
-  '@blocknote/core@0.33.0':
-    resolution: {integrity: sha512-BngrC1zx6aQjjOtRII2XpgtWwDfAP9D/dsKEsWGzCYXcfbE3smssy8MzkQQqFBHf4klTxOgOYZosmb0GW10SZg==}
+  '@blocknote/core@0.40.0':
+    resolution: {integrity: sha512-ORx03MZVLW2yH3CZXpNOE3moeP6TcjegOIG0pM/vwiyvjqoOP9hNZ1uGPXN+gTGE1L2uAzDNPeFbq047F5J9dA==}
     peerDependencies:
       '@hocuspocus/provider': ^2.15.2
     peerDependenciesMeta:
       '@hocuspocus/provider':
         optional: true
 
-  '@blocknote/react@0.33.0':
-    resolution: {integrity: sha512-1MHtJ1D0Rorrb25anWYReraSqTZ1ZVc9jK4xlR1G5A0AimR+P9lCSw1tH9TncrNfsihOQAy4/nY4QWRn6tHzRg==}
+  '@blocknote/react@0.40.0':
+    resolution: {integrity: sha512-Ha4RIgtoUnUSX6x5aZnnNq9KfeGRz21x7HHzXU//g0KmO5vN68umqf4n+PRl3ds4UkgL/+S8OEGRKsJMeWZyXQ==}
     peerDependencies:
       react: ^18.0 || ^19.0 || >= 19.0.0-rc
       react-dom: ^18.0 || ^19.0 || >= 19.0.0-rc
 
-  '@blocknote/shadcn@0.33.0':
-    resolution: {integrity: sha512-gu6JaNtDV5CY6vHAYV0JsqueoNembsqHmxUVk1kRI7KMzsQiu8YvRYruT7kLMT5UNNcgePSVBA8xHgG/FXXT9g==}
+  '@blocknote/shadcn@0.40.0':
+    resolution: {integrity: sha512-l1QzsF61yJWwTDq6ZFCdyTd4ZI2OUtY42tBPjFkThWnHUVdOXLHxoLyJjlYi7iWl4a6WK3m1C5TPQZqAIhToxA==}
     peerDependencies:
       react: ^18.0 || ^19.0 || >= 19.0.0-rc
       react-dom: ^18.0 || ^19.0 || >= 19.0.0-rc
+      tailwindcss: ^4.1.12
 
   '@cellajs/permission-manager@0.1.0':
     resolution: {integrity: sha512-+vGHLdGrR5Jez+dp6yHsgij8hIuZbdU88IU4JAV8nO4FzH1RDNkkj++O9RhMf3CKKDslYn7QiwI8D16u379+0A==}
@@ -2687,12 +2688,6 @@ packages:
       react: '>=16.8.0'
       react-dom: '>=16.8.0'
 
-  '@floating-ui/react@0.26.28':
-    resolution: {integrity: sha512-yORQuuAtVpiRjpMhdc0wJj06b9JFjrYF4qp96j++v2NBpbi6SEGF7donUJ3TMieerQ6qVkAv1tgr7L4r5roTqw==}
-    peerDependencies:
-      react: '>=16.8.0'
-      react-dom: '>=16.8.0'
-
   '@floating-ui/react@0.27.16':
     resolution: {integrity: sha512-9O8N4SeG2z++TSM8QA/KTeKFBVCNEz/AGS7gWPJf6KFRzmRWixFRnCnkPHRDwSVZW6QPDO6uT0P2SpWNKCc9/g==}
     peerDependencies:
@@ -3762,9 +3757,6 @@ packages:
   '@polka/url@1.0.0-next.29':
     resolution: {integrity: sha512-wwQAWhWSuHaag8c4q/KN/vCoeOJYshAIvMQwD4GpSb3OiZklFfvAgmj0VCBBImRpuF/aFgIRzllXlVX93Jevww==}
 
-  '@popperjs/core@2.11.8':
-    resolution: {integrity: sha512-P1st0aksCrn9sGZhp8GMYwBnQsbvAWsZAX44oXNNvLHGqAOcoVxmjZiohstwQ7SqKnbR47akdNi+uleWD8+g6A==}
-
   '@preact/signals-core@1.12.1':
     resolution: {integrity: sha512-BwbTXpj+9QutoZLQvbttRg5x3l5468qaV2kufh+51yha1c53ep5dY4kTuZR35+3pAZxpfQerGJiQqg34ZNZ6uA==}
 
@@ -5707,100 +5699,97 @@ packages:
     peerDependencies:
       '@testing-library/dom': '>=7.21.4'
 
-  '@tiptap/core@2.26.2':
-    resolution: {integrity: sha512-cr30QWJECl5j7qUUG4Z4BDitHgJIBWipbC3JbjoDtumgZLedGa5SV+JiGa4GUhNt9E34Pw1BH0gBDL4adGHiLg==}
+  '@tiptap/core@3.6.5':
+    resolution: {integrity: sha512-CgXuhevQbBcPfxaXzGZgIY9+aVMSAd68Q21g3EONz1iZBw026QgiaLhGK6jgGTErZL4GoNL/P+gC5nFCvN7+cA==}
     peerDependencies:
-      '@tiptap/pm': ^2.7.0
+      '@tiptap/pm': ^3.6.5
 
-  '@tiptap/extension-bold@2.26.2':
-    resolution: {integrity: sha512-kNjbHZhLyDu2ZBZmJINzXg3MAW7+05KqGkcwxudC1X/DQM5V5FpW7u6TOlC+nf1I9wABgayxURyU8FsIaXDxqA==}
+  '@tiptap/extension-bold@3.6.5':
+    resolution: {integrity: sha512-8JXC+K4DXtPDbClHxgRAZnXYO2an2I86PbpqUw+S7m17XCr4t39Sw9CeNBohOHS6Cl8uxOKAjSyCZzqdnYkn3g==}
     peerDependencies:
-      '@tiptap/core': ^2.7.0
+      '@tiptap/core': ^3.6.5
 
-  '@tiptap/extension-bubble-menu@2.26.2':
-    resolution: {integrity: sha512-kB7/bGTUnC7ZCBH/fkigpfId925nwGOn+Nq1hf199NYMu2ffWbKk75ckLwyqlETprQYzzHfViIqcwyxJzo04Sg==}
+  '@tiptap/extension-bubble-menu@3.6.5':
+    resolution: {integrity: sha512-RyCJghtkYZAljZQUfjk3B5tvVVCILsIYMR9XnC152uBiIuWsnz25qfdyBP+cOl6ONrQUvdscs0WmKvzN+nXZYw==}
     peerDependencies:
-      '@tiptap/core': ^2.7.0
-      '@tiptap/pm': ^2.7.0
+      '@tiptap/core': ^3.6.5
+      '@tiptap/pm': ^3.6.5
 
-  '@tiptap/extension-code@2.26.2':
-    resolution: {integrity: sha512-xnKJvzlAp75dheyaK5tLKAksHf9PtSr8a7OuPjf2IXS5K+QMtnwxx7KAHHijmecfWjLR0wyu9AvT/FWFfKi5LQ==}
+  '@tiptap/extension-code@3.6.5':
+    resolution: {integrity: sha512-U/cJFjE0hqBTbMb5J74e7ni5YReuJgS9NyJgTy94+Xt6vxR1vU4+qOl+3E0fOZtwDrxbLrsCQy3P3LvNb3HXdw==}
     peerDependencies:
-      '@tiptap/core': ^2.7.0
+      '@tiptap/core': ^3.6.5
 
-  '@tiptap/extension-floating-menu@2.26.2':
-    resolution: {integrity: sha512-AILrhwKAGU4Z6GcjNXJAsN0LHlL26bE7VRrYIqUwDv44ImiQf5vu9jEnncBOeHWzMe8SgjrrJWGNNu+dceACpw==}
+  '@tiptap/extension-floating-menu@3.6.5':
+    resolution: {integrity: sha512-ASKb5vHkYyB9g3vOAr2E2U+b6MbHk4Ff4PqngafGlWRAmOAmFxTcw9fLa3HKnj4pokSsYAEvYGOso99/W3GzhA==}
     peerDependencies:
-      '@tiptap/core': ^2.7.0
-      '@tiptap/pm': ^2.7.0
+      '@floating-ui/dom': ^1.0.0
+      '@tiptap/core': ^3.6.5
+      '@tiptap/pm': ^3.6.5
 
-  '@tiptap/extension-gapcursor@2.26.2':
-    resolution: {integrity: sha512-a68mi8V0mh058UrBIk23f50K5JGVeRZnF6ViptIleAD/Ny1K6VLjGCz6k190de+Tb9tnQLPEwwwDcy+ZnvCmYQ==}
+  '@tiptap/extension-gapcursor@3.6.5':
+    resolution: {integrity: sha512-SHtp71zhV2bAQS8kaJ/otb2podGusDREZ9/SQ1rZi6yPcDFLS2KvIvsLssDwbjTuH6KefnsN6Vx01tzmXRAQig==}
     peerDependencies:
-      '@tiptap/core': ^2.7.0
-      '@tiptap/pm': ^2.7.0
+      '@tiptap/extensions': ^3.6.5
 
-  '@tiptap/extension-history@2.26.2':
-    resolution: {integrity: sha512-X/cu79AV5D2Z1QtuvKo/4/Rgl/Uti/n5V3QgCxFLQRCKTxHOCis+RlBCjBfOPztJX4T9QUE6lq20KqB47rsNwQ==}
+  '@tiptap/extension-history@3.6.5':
+    resolution: {integrity: sha512-i9J2IS5duuIimSG8cBwXHjfYezWazY2LvfeOajDu28qNSpMx6UHcB2WVXOwTkC+RZeg6EFQPJMC66+9Y0sYS3A==}
     peerDependencies:
-      '@tiptap/core': ^2.7.0
-      '@tiptap/pm': ^2.7.0
+      '@tiptap/extensions': ^3.6.5
 
-  '@tiptap/extension-horizontal-rule@2.26.2':
-    resolution: {integrity: sha512-whlUskFUwmi7nXn4OT55xHXSAqwEAEQfZWswmae1Y5wTMDxavZ0FF4xvCVgsQ7gYG782tIgLCzriTN4AjBphIQ==}
+  '@tiptap/extension-horizontal-rule@3.6.5':
+    resolution: {integrity: sha512-yNxcejI25j6NQMQuKQMTVmNYLnrHFCpzGAz1Ndzyar+gItYZXI9BLmMlwpLkIaJMpIKChj+2qHz25fPS5FlNFw==}
     peerDependencies:
-      '@tiptap/core': ^2.7.0
-      '@tiptap/pm': ^2.7.0
+      '@tiptap/core': ^3.6.5
+      '@tiptap/pm': ^3.6.5
 
-  '@tiptap/extension-italic@2.26.2':
-    resolution: {integrity: sha512-/4AiE2JWtjY9yW+MifMP8EOOwOSDKDUxCyqtGT6e4xqqFUNLZJA0o4P/MYjcKVwsa1/IsDRsOaFRlAiMmAXVXw==}
+  '@tiptap/extension-italic@3.6.5':
+    resolution: {integrity: sha512-2EtO2uffw5YnTQ1cieLPv9t7OKCfJFbgHRJPXf7Nnfh8XFh5AEyzw0qBNXZyLtlB28+HHSWLc/OHS6xMfwUy0A==}
     peerDependencies:
-      '@tiptap/core': ^2.7.0
+      '@tiptap/core': ^3.6.5
 
-  '@tiptap/extension-link@2.26.2':
-    resolution: {integrity: sha512-rzYxx5wI1551ubPfW2pJ3V957cX/WAmbUI3q8Un+LlOsSmbddl+5BjlF5t/vl/pwaOv7FJAz9e29n877zkGOVQ==}
+  '@tiptap/extension-link@3.6.5':
+    resolution: {integrity: sha512-VLCDNwxLC1IPnWT3HLLJUg1Hflf8A2jfs7aNF4vyMTWmKnrk1zmN+VyXQTAkrqr27qE5FnmLhHOYF3SNolNucw==}
     peerDependencies:
-      '@tiptap/core': ^2.7.0
-      '@tiptap/pm': ^2.7.0
+      '@tiptap/core': ^3.6.5
+      '@tiptap/pm': ^3.6.5
 
-  '@tiptap/extension-paragraph@2.26.2':
-    resolution: {integrity: sha512-dccyffm95nNT9arjxGOyv4/cOPF4XS5Osylccp9KYLrmiSTXEuzVIYtMXhXbc0UUdABGvbFQWi88tRxgeDTkgA==}
+  '@tiptap/extension-paragraph@3.6.5':
+    resolution: {integrity: sha512-AfuaBu+DKrRPspaLsXgo17dhuneISS6QsZTIzPeX21jFJcq3TjtD8wSzS4yRgzAQCEbupkI7t4JbtgxAIBNQHA==}
     peerDependencies:
-      '@tiptap/core': ^2.7.0
+      '@tiptap/core': ^3.6.5
 
-  '@tiptap/extension-strike@2.26.2':
-    resolution: {integrity: sha512-gY8/P8ycvICiZsa9OeTpOnSL0o+PAYH1QpBomaBhdZZ2tcsziMYN9BZto6uQARi9tdxeOYRePyZ+Junk4xsyFg==}
+  '@tiptap/extension-strike@3.6.5':
+    resolution: {integrity: sha512-QR7CUmRJ7fJkHtxqKajKIaX/B4xpKFOsAOJHbnqZ8wzOtnEL5IlsmoUnbKBoVn0+2R2YKKvMK3lepGtAcVCfIQ==}
     peerDependencies:
-      '@tiptap/core': ^2.7.0
+      '@tiptap/core': ^3.6.5
 
-  '@tiptap/extension-table-cell@2.26.2':
-    resolution: {integrity: sha512-A2XThaJBVQvR/nKyUfHwyoSuz/NtwWYDjnGjYtN/+fFCEWx++33HjvtxmCCpGrw5xuE783L4I9cr5Pcrepgy3A==}
+  '@tiptap/extension-text@3.6.5':
+    resolution: {integrity: sha512-PVZDWUa25xPzmEN6WWA103yvYJn+NBvWb7WrQwWu9LkKUgd98ZgV3yFaEem/Ybugl/NDPV7q8GGaH+2wEg/VeA==}
     peerDependencies:
-      '@tiptap/core': ^2.7.0
+      '@tiptap/core': ^3.6.5
 
-  '@tiptap/extension-table-header@2.26.2':
-    resolution: {integrity: sha512-ppiL8aOQuBqy8GjMuVmIWu187rvNwxANCoAE+iGRDTK0y6c27HA+f6Y9n55T9PYqzDs5Z03gIBGhNIyw1lfc5A==}
+  '@tiptap/extension-underline@3.6.5':
+    resolution: {integrity: sha512-Ul1mO0H1e2vfvN5g48X/YQ8w1xFTpLqce+GUhi0OmXaZnVOTIMtLuN/zAAPjD+uw+79JVGjYa53lbo1dyhOfAw==}
     peerDependencies:
-      '@tiptap/core': ^2.7.0
+      '@tiptap/core': ^3.6.5
 
-  '@tiptap/extension-text@2.26.2':
-    resolution: {integrity: sha512-Rb8Le/Li+EixQNc/pGkEJpLjozTjWYP9glaYfnjPtRVw4tHcd7khVm5mer0TQjonbBUjVC1zSuXv9gifXOv6DQ==}
+  '@tiptap/extensions@3.6.5':
+    resolution: {integrity: sha512-7aadEaRjSbFAIp3WGYR1LXrvtVprmBNxw3FakEUMJ+XKmGNErDJgDMZh+siAYw5MWwCCGa5kKu8Qi/i+DU+ILg==}
     peerDependencies:
-      '@tiptap/core': ^2.7.0
+      '@tiptap/core': ^3.6.5
+      '@tiptap/pm': ^3.6.5
 
-  '@tiptap/extension-underline@2.26.2':
-    resolution: {integrity: sha512-kpKJSfsn1+b8l96YPg2GRn3aaN78pLqSeyzfA5FYVbN0lyptbqRVOrNM8p3n6l0LbAkiEjc/TgOMwNNEL93kyA==}
-    peerDependencies:
-      '@tiptap/core': ^2.7.0
+  '@tiptap/pm@3.6.5':
+    resolution: {integrity: sha512-S+j6MPgUXRIQd5/mdaLjaJnOt4ptFwjqGjGMUfBbf9a3uKpXUXaCCzfuC6ZikwaUtoVh4KN9BU3HCYDtgtENPA==}
 
-  '@tiptap/pm@2.26.2':
-    resolution: {integrity: sha512-H2kJHckC9idlYPu/PNdu5XR3Rdu7gbNb+Qrdt2gBnaDyHgAcs+14wak6x19vy27GV9FFzg9722Eb7LErooo28w==}
-
-  '@tiptap/react@2.26.2':
-    resolution: {integrity: sha512-p7jv0sltCC2L4iHIVNthtjv/CIxajOalb7ytjLx6ijx5q2J564VIny0U7O33Ymbo2cV0dJoB+Bo5aeaJ5SfHGg==}
+  '@tiptap/react@3.6.5':
+    resolution: {integrity: sha512-kum9fYzY6qmHuabcXDUTX2sVLdtJtZS0kN91mwD29Ue8HUkjVvEX92PwV2HtgNw3WFMaVxgm/dtm3XPTAlUEwg==}
     peerDependencies:
-      '@tiptap/core': ^2.7.0
-      '@tiptap/pm': ^2.7.0
+      '@tiptap/core': ^3.6.5
+      '@tiptap/pm': ^3.6.5
+      '@types/react': ^17.0.0 || ^18.0.0 || ^19.0.0
+      '@types/react-dom': ^17.0.0 || ^18.0.0 || ^19.0.0
       react: ^17.0.0 || ^18.0.0 || ^19.0.0
       react-dom: ^17.0.0 || ^18.0.0 || ^19.0.0
 
@@ -8739,6 +8728,11 @@ packages:
   lru-cache@5.1.1:
     resolution: {integrity: sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==}
 
+  lucide-react@0.525.0:
+    resolution: {integrity: sha512-Tm1txJ2OkymCGkvwoHt33Y2JpN5xucVq1slHcgE6Lk0WjDfjgKWor5CdVER8U6DvcfMwh4M8XxmpTiyzfmfDYQ==}
+    peerDependencies:
+      react: ^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0
+
   lucide-react@0.542.0:
     resolution: {integrity: sha512-w3hD8/SQB7+lzU2r4VdFyzzOzKnUjTZIF/MQJGSSvni7Llewni4vuViRppfRAa2guOsY5k4jZyxw/i9DQHv+dw==}
     peerDependencies:
@@ -10573,11 +10567,6 @@ packages:
     engines: {node: '>=14.0.0'}
     hasBin: true
 
-  tailwindcss@3.4.18:
-    resolution: {integrity: sha512-6A2rnmW5xZMdw11LYjhcI5846rt9pbLSabY5XPxo+XWdxwZaFEn47Go4NzFiHu9sNNmr/kXivP1vStfvMaK1GQ==}
-    engines: {node: '>=14.0.0'}
-    hasBin: true
-
   tailwindcss@4.1.14:
     resolution: {integrity: sha512-b7pCxjGO98LnxVkKjaZSDeNuljC4ueKUddjENJOADtubtdo8llTaJy7HwBMeLNSSo2N5QIAgklslK1+Ir8r6CA==}
 
@@ -10664,9 +10653,6 @@ packages:
     resolution: {integrity: sha512-azl+t0z7pw/z958Gy9svOTuzqIk6xq+NSheJzn5MMWtWTFywIacg2wUlzKFGtt3cthx0r2SxMK0yzJOR0IES7Q==}
     engines: {node: '>=14.0.0'}
 
-  tippy.js@6.3.7:
-    resolution: {integrity: sha512-E1d3oP2emgJ9dRQZdf3Kkn0qJgI6ZLpyS5z6ZkY1DF3kaQaBsGZsndEpHwx+eC+tYM41HaSNvNtLx8tU57FzTQ==}
-
   titleize@4.0.0:
     resolution: {integrity: sha512-ZgUJ1K83rhdu7uh7EHAC2BgY5DzoX8V5rTvoWI4vFysggi6YjLe5gUXABPWAU7VkvGP7P/0YiWq+dcPeYDsf1g==}
     engines: {node: '>=18'}
@@ -12820,9 +12806,9 @@ snapshots:
   '@biomejs/cli-win32-x64@2.2.5':
     optional: true
 
-  '@blocknote/code-block@0.33.0(@blocknote/core@0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0))':
+  '@blocknote/code-block@0.40.0(@blocknote/core@0.40.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@tiptap/extensions@3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))(@tiptap/pm@3.6.5))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0))':
     dependencies:
-      '@blocknote/core': 0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)
+      '@blocknote/core': 0.40.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@tiptap/extensions@3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))(@tiptap/pm@3.6.5))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)
       '@shikijs/core': 3.13.0
       '@shikijs/engine-javascript': 3.13.0
       '@shikijs/langs': 3.13.0
@@ -12830,26 +12816,25 @@ snapshots:
       '@shikijs/themes': 3.13.0
       '@shikijs/types': 3.13.0
 
-  '@blocknote/core@0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)':
+  '@blocknote/core@0.40.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@tiptap/extensions@3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))(@tiptap/pm@3.6.5))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)':
     dependencies:
       '@emoji-mart/data': 1.2.1
       '@shikijs/types': 3.2.1
-      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
-      '@tiptap/extension-bold': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))
-      '@tiptap/extension-code': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))
-      '@tiptap/extension-gapcursor': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)
-      '@tiptap/extension-history': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)
-      '@tiptap/extension-horizontal-rule': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)
-      '@tiptap/extension-italic': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))
-      '@tiptap/extension-link': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)
-      '@tiptap/extension-paragraph': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))
-      '@tiptap/extension-strike': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))
-      '@tiptap/extension-table-cell': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))
-      '@tiptap/extension-table-header': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))
-      '@tiptap/extension-text': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))
-      '@tiptap/extension-underline': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))
-      '@tiptap/pm': 2.26.2
+      '@tiptap/core': 3.6.5(@tiptap/pm@3.6.5)
+      '@tiptap/extension-bold': 3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))
+      '@tiptap/extension-code': 3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))
+      '@tiptap/extension-gapcursor': 3.6.5(@tiptap/extensions@3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))(@tiptap/pm@3.6.5))
+      '@tiptap/extension-history': 3.6.5(@tiptap/extensions@3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))(@tiptap/pm@3.6.5))
+      '@tiptap/extension-horizontal-rule': 3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))(@tiptap/pm@3.6.5)
+      '@tiptap/extension-italic': 3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))
+      '@tiptap/extension-link': 3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))(@tiptap/pm@3.6.5)
+      '@tiptap/extension-paragraph': 3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))
+      '@tiptap/extension-strike': 3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))
+      '@tiptap/extension-text': 3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))
+      '@tiptap/extension-underline': 3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))
+      '@tiptap/pm': 3.6.5
       emoji-mart: 5.6.0
+      fast-deep-equal: 3.1.3
       hast-util-from-dom: 5.0.1
       prosemirror-dropcursor: 1.8.2
       prosemirror-highlight: 0.13.0(@shikijs/types@3.2.1)(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)(prosemirror-model@1.25.3)(prosemirror-state@1.4.3)(prosemirror-transform@1.10.4)(prosemirror-view@1.41.2)
@@ -12874,6 +12859,7 @@ snapshots:
     optionalDependencies:
       '@hocuspocus/provider': 2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27)
     transitivePeerDependencies:
+      - '@tiptap/extensions'
       - '@types/hast'
       - highlight.js
       - lowlight
@@ -12881,32 +12867,36 @@ snapshots:
       - sugar-high
       - supports-color
 
-  '@blocknote/react@0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
+  '@blocknote/react@0.40.0(@floating-ui/dom@1.7.4)(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@tiptap/extensions@3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))(@tiptap/pm@3.6.5))(@types/hast@3.0.4)(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(highlight.js@11.11.1)(lowlight@3.3.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
-      '@blocknote/core': 0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)
+      '@blocknote/core': 0.40.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@tiptap/extensions@3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))(@tiptap/pm@3.6.5))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)
       '@emoji-mart/data': 1.2.1
-      '@floating-ui/react': 0.26.28(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
-      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
-      '@tiptap/pm': 2.26.2
-      '@tiptap/react': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@floating-ui/react': 0.27.16(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@tiptap/core': 3.6.5(@tiptap/pm@3.6.5)
+      '@tiptap/pm': 3.6.5
+      '@tiptap/react': 3.6.5(@floating-ui/dom@1.7.4)(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))(@tiptap/pm@3.6.5)(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       emoji-mart: 5.6.0
       lodash.merge: 4.6.2
       react: 19.2.0
       react-dom: 19.2.0(react@19.2.0)
       react-icons: 5.5.0(react@19.2.0)
     transitivePeerDependencies:
+      - '@floating-ui/dom'
       - '@hocuspocus/provider'
+      - '@tiptap/extensions'
       - '@types/hast'
+      - '@types/react'
+      - '@types/react-dom'
       - highlight.js
       - lowlight
       - refractor
       - sugar-high
       - supports-color
 
-  '@blocknote/shadcn@0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(highlight.js@11.11.1)(lowlight@3.3.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(tsx@4.20.6)(yaml@2.8.1)':
+  '@blocknote/shadcn@0.40.0(@floating-ui/dom@1.7.4)(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@tiptap/extensions@3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))(@tiptap/pm@3.6.5))(@types/hast@3.0.4)(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(highlight.js@11.11.1)(lowlight@3.3.0)(postcss@8.5.6)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(tailwindcss@4.1.14)':
     dependencies:
-      '@blocknote/core': 0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)
-      '@blocknote/react': 0.33.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
+      '@blocknote/core': 0.40.0(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@tiptap/extensions@3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))(@tiptap/pm@3.6.5))(@types/hast@3.0.4)(highlight.js@11.11.1)(lowlight@3.3.0)
+      '@blocknote/react': 0.40.0(@floating-ui/dom@1.7.4)(@hocuspocus/provider@2.15.2(y-protocols@1.0.6(yjs@13.6.27))(yjs@13.6.27))(@tiptap/extensions@3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))(@tiptap/pm@3.6.5))(@types/hast@3.0.4)(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(highlight.js@11.11.1)(lowlight@3.3.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@hookform/resolvers': 3.10.0(react-hook-form@7.63.0(react@19.2.0))
       '@radix-ui/react-avatar': 1.1.10(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       '@radix-ui/react-dropdown-menu': 2.1.16(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
@@ -12920,27 +12910,26 @@ snapshots:
       autoprefixer: 10.4.21(postcss@8.5.6)
       class-variance-authority: 0.7.1
       clsx: 2.1.1
-      lucide-react: 0.542.0(react@19.2.0)
-      postcss: 8.5.6
+      lucide-react: 0.525.0(react@19.2.0)
       react: 19.2.0
       react-dom: 19.2.0(react@19.2.0)
       react-hook-form: 7.63.0(react@19.2.0)
       tailwind-merge: 2.6.0
-      tailwindcss: 3.4.18(tsx@4.20.6)(yaml@2.8.1)
-      tailwindcss-animate: 1.0.7(tailwindcss@3.4.18(tsx@4.20.6)(yaml@2.8.1))
+      tailwindcss: 4.1.14
       zod: 3.25.76
     transitivePeerDependencies:
+      - '@floating-ui/dom'
       - '@hocuspocus/provider'
+      - '@tiptap/extensions'
       - '@types/hast'
       - '@types/react'
       - '@types/react-dom'
       - highlight.js
       - lowlight
+      - postcss
       - refractor
       - sugar-high
       - supports-color
-      - tsx
-      - yaml
 
   '@cellajs/permission-manager@0.1.0(@swc/core@1.7.26)(jiti@2.6.1)(postcss@8.5.6)(tsx@4.20.6)(yaml@2.8.1)':
     dependencies:
@@ -12955,13 +12944,13 @@ snapshots:
       - tsx
       - yaml
 
-  '@chromatic-com/storybook@4.1.1(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
+  '@chromatic-com/storybook@4.1.1(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
     dependencies:
       '@neoconfetti/react': 1.0.0
       chromatic: 12.2.0
       filesize: 10.1.6
       jsonfile: 6.2.0
-      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       strip-ansi: 7.1.2
     transitivePeerDependencies:
       - '@chromatic-com/cypress'
@@ -13554,14 +13543,6 @@ snapshots:
       react: 19.2.0
       react-dom: 19.2.0(react@19.2.0)
 
-  '@floating-ui/react@0.26.28(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
-    dependencies:
-      '@floating-ui/react-dom': 2.1.6(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
-      '@floating-ui/utils': 0.2.10
-      react: 19.2.0
-      react-dom: 19.2.0(react@19.2.0)
-      tabbable: 6.2.0
-
   '@floating-ui/react@0.27.16(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
       '@floating-ui/react-dom': 2.1.6(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
@@ -13811,12 +13792,12 @@ snapshots:
 
   '@istanbuljs/schema@0.1.3': {}
 
-  '@joshwooding/vite-plugin-react-docgen-typescript@0.6.1(typescript@5.9.3)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
+  '@joshwooding/vite-plugin-react-docgen-typescript@0.6.1(typescript@5.9.3)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
       glob: 10.4.5
       magic-string: 0.30.19
       react-docgen-typescript: 2.4.0(typescript@5.9.3)
-      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     optionalDependencies:
       typescript: 5.9.3
 
@@ -14750,8 +14731,6 @@ snapshots:
 
   '@polka/url@1.0.0-next.29': {}
 
-  '@popperjs/core@2.11.8': {}
-
   '@preact/signals-core@1.12.1': {}
 
   '@preact/signals@1.3.2(preact@10.27.2)':
@@ -15681,7 +15660,7 @@ snapshots:
 
   '@radix-ui/rect@1.1.1': {}
 
-  '@react-scan/vite-plugin-react-scan@0.1.8(react-scan@0.4.3(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react-router-dom@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react-router@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react@19.2.0)(rollup@2.79.2))(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
+  '@react-scan/vite-plugin-react-scan@0.1.8(react-scan@0.4.3(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react-router-dom@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react-router@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react@19.2.0)(rollup@2.79.2))(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
       '@babel/core': 7.28.4
       '@babel/plugin-transform-react-jsx': 7.27.1(@babel/core@7.28.4)
@@ -15689,7 +15668,7 @@ snapshots:
       babel-plugin-add-react-displayname: 0.0.5
       cheerio: 1.1.2
       react-scan: 0.4.3(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react-router-dom@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react-router@7.5.2(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(react@19.2.0)(rollup@2.79.2)
-      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - supports-color
 
@@ -16477,50 +16456,50 @@ snapshots:
 
   '@standard-schema/utils@0.3.0': {}
 
-  '@storybook/addon-a11y@9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
+  '@storybook/addon-a11y@9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
     dependencies:
       '@storybook/global': 5.0.0
       axe-core: 4.10.3
-      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
 
-  '@storybook/addon-docs@9.1.10(@types/react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
+  '@storybook/addon-docs@9.1.10(@types/react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
     dependencies:
       '@mdx-js/react': 3.1.1(@types/react@19.2.0)(react@19.2.0)
-      '@storybook/csf-plugin': 9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
+      '@storybook/csf-plugin': 9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
       '@storybook/icons': 1.6.0(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
-      '@storybook/react-dom-shim': 9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
+      '@storybook/react-dom-shim': 9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
       react: 19.2.0
       react-dom: 19.2.0(react@19.2.0)
-      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       ts-dedent: 2.2.0
     transitivePeerDependencies:
       - '@types/react'
 
-  '@storybook/addon-vitest@9.1.10(@vitest/browser@3.2.4)(@vitest/runner@3.2.4)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(vitest@3.2.4)':
+  '@storybook/addon-vitest@9.1.10(@vitest/browser@3.2.4)(@vitest/runner@3.2.4)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(vitest@3.2.4)':
     dependencies:
       '@storybook/global': 5.0.0
       '@storybook/icons': 1.6.0(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
       prompts: 2.4.2
-      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       ts-dedent: 2.2.0
     optionalDependencies:
-      '@vitest/browser': 3.2.4(playwright@1.55.1)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)
+      '@vitest/browser': 3.2.4(playwright@1.55.1)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)
       '@vitest/runner': 3.2.4
-      vitest: 3.2.4(@types/debug@4.1.12)(@types/node@24.6.2)(@vitest/browser@3.2.4)(jiti@1.21.7)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vitest: 3.2.4(@types/debug@4.1.12)(@types/node@24.6.2)(@vitest/browser@3.2.4)(jiti@2.6.1)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - react
       - react-dom
 
-  '@storybook/builder-vite@9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
+  '@storybook/builder-vite@9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
-      '@storybook/csf-plugin': 9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
-      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      '@storybook/csf-plugin': 9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       ts-dedent: 2.2.0
-      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
 
-  '@storybook/csf-plugin@9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
+  '@storybook/csf-plugin@9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
     dependencies:
-      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       unplugin: 1.16.1
 
   '@storybook/global@5.0.0': {}
@@ -16530,39 +16509,39 @@ snapshots:
       react: 19.2.0
       react-dom: 19.2.0(react@19.2.0)
 
-  '@storybook/react-dom-shim@9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
+  '@storybook/react-dom-shim@9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))':
     dependencies:
       react: 19.2.0
       react-dom: 19.2.0(react@19.2.0)
-      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
 
-  '@storybook/react-vite@9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(rollup@2.79.2)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(typescript@5.9.3)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
+  '@storybook/react-vite@9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(rollup@2.79.2)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(typescript@5.9.3)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
-      '@joshwooding/vite-plugin-react-docgen-typescript': 0.6.1(typescript@5.9.3)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      '@joshwooding/vite-plugin-react-docgen-typescript': 0.6.1(typescript@5.9.3)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@rollup/pluginutils': 5.3.0(rollup@2.79.2)
-      '@storybook/builder-vite': 9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
-      '@storybook/react': 9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(typescript@5.9.3)
+      '@storybook/builder-vite': 9.1.10(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      '@storybook/react': 9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(typescript@5.9.3)
       find-up: 7.0.0
       magic-string: 0.30.19
       react: 19.2.0
       react-docgen: 8.0.1
       react-dom: 19.2.0(react@19.2.0)
       resolve: 1.22.10
-      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       tsconfig-paths: 4.2.0
-      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - rollup
       - supports-color
       - typescript
 
-  '@storybook/react@9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(typescript@5.9.3)':
+  '@storybook/react@9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))(typescript@5.9.3)':
     dependencies:
       '@storybook/global': 5.0.0
-      '@storybook/react-dom-shim': 9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
+      '@storybook/react-dom-shim': 9.1.10(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)))
       react: 19.2.0
       react-dom: 19.2.0(react@19.2.0)
-      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      storybook: 9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
     optionalDependencies:
       typescript: 5.9.3
 
@@ -16709,12 +16688,12 @@ snapshots:
       postcss-selector-parser: 6.0.10
       tailwindcss: 4.1.14
 
-  '@tailwindcss/vite@4.1.14(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
+  '@tailwindcss/vite@4.1.14(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
       '@tailwindcss/node': 4.1.14
       '@tailwindcss/oxide': 4.1.14
       tailwindcss: 4.1.14
-      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
 
   '@tanstack/history@1.132.31': {}
 
@@ -16748,13 +16727,13 @@ snapshots:
       '@tanstack/query-core': 5.90.2
       react: 19.2.0
 
-  '@tanstack/react-router-devtools@1.132.33(@tanstack/react-router@1.132.33(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(@tanstack/router-core@1.132.33)(@types/node@24.6.2)(csstype@3.1.3)(jiti@1.21.7)(lightningcss@1.30.1)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.6)(yaml@2.8.1)':
+  '@tanstack/react-router-devtools@1.132.33(@tanstack/react-router@1.132.33(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(@tanstack/router-core@1.132.33)(@types/node@24.6.2)(csstype@3.1.3)(jiti@2.6.1)(lightningcss@1.30.1)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.6)(yaml@2.8.1)':
     dependencies:
       '@tanstack/react-router': 1.132.33(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
-      '@tanstack/router-devtools-core': 1.132.33(@tanstack/router-core@1.132.33)(@types/node@24.6.2)(csstype@3.1.3)(jiti@1.21.7)(lightningcss@1.30.1)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.6)(yaml@2.8.1)
+      '@tanstack/router-devtools-core': 1.132.33(@tanstack/router-core@1.132.33)(@types/node@24.6.2)(csstype@3.1.3)(jiti@2.6.1)(lightningcss@1.30.1)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.6)(yaml@2.8.1)
       react: 19.2.0
       react-dom: 19.2.0(react@19.2.0)
-      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - '@tanstack/router-core'
       - '@types/node'
@@ -16800,14 +16779,14 @@ snapshots:
       tiny-invariant: 1.3.3
       tiny-warning: 1.0.3
 
-  '@tanstack/router-devtools-core@1.132.33(@tanstack/router-core@1.132.33)(@types/node@24.6.2)(csstype@3.1.3)(jiti@1.21.7)(lightningcss@1.30.1)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.6)(yaml@2.8.1)':
+  '@tanstack/router-devtools-core@1.132.33(@tanstack/router-core@1.132.33)(@types/node@24.6.2)(csstype@3.1.3)(jiti@2.6.1)(lightningcss@1.30.1)(solid-js@1.9.9)(terser@5.44.0)(tiny-invariant@1.3.3)(tsx@4.20.6)(yaml@2.8.1)':
     dependencies:
       '@tanstack/router-core': 1.132.33
       clsx: 2.1.1
       goober: 2.1.18(csstype@3.1.3)
       solid-js: 1.9.9
       tiny-invariant: 1.3.3
-      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     optionalDependencies:
       csstype: 3.1.3
     transitivePeerDependencies:
@@ -16836,7 +16815,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@tanstack/router-plugin@1.132.33(@tanstack/react-router@1.132.33(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
+  '@tanstack/router-plugin@1.132.33(@tanstack/react-router@1.132.33(react-dom@19.2.0(react@19.2.0))(react@19.2.0))(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
       '@babel/core': 7.28.4
       '@babel/plugin-syntax-jsx': 7.27.1(@babel/core@7.28.4)
@@ -16854,7 +16833,7 @@ snapshots:
       zod: 3.25.76
     optionalDependencies:
       '@tanstack/react-router': 1.132.33(react-dom@19.2.0(react@19.2.0))(react@19.2.0)
-      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - supports-color
 
@@ -16899,80 +16878,77 @@ snapshots:
     dependencies:
       '@testing-library/dom': 10.4.1
 
-  '@tiptap/core@2.26.2(@tiptap/pm@2.26.2)':
+  '@tiptap/core@3.6.5(@tiptap/pm@3.6.5)':
     dependencies:
-      '@tiptap/pm': 2.26.2
+      '@tiptap/pm': 3.6.5
 
-  '@tiptap/extension-bold@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))':
+  '@tiptap/extension-bold@3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))':
     dependencies:
-      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
+      '@tiptap/core': 3.6.5(@tiptap/pm@3.6.5)
 
-  '@tiptap/extension-bubble-menu@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)':
+  '@tiptap/extension-bubble-menu@3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))(@tiptap/pm@3.6.5)':
     dependencies:
-      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
-      '@tiptap/pm': 2.26.2
-      tippy.js: 6.3.7
+      '@floating-ui/dom': 1.7.4
+      '@tiptap/core': 3.6.5(@tiptap/pm@3.6.5)
+      '@tiptap/pm': 3.6.5
+    optional: true
 
-  '@tiptap/extension-code@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))':
+  '@tiptap/extension-code@3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))':
     dependencies:
-      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
+      '@tiptap/core': 3.6.5(@tiptap/pm@3.6.5)
 
-  '@tiptap/extension-floating-menu@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)':
+  '@tiptap/extension-floating-menu@3.6.5(@floating-ui/dom@1.7.4)(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))(@tiptap/pm@3.6.5)':
     dependencies:
-      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
-      '@tiptap/pm': 2.26.2
-      tippy.js: 6.3.7
+      '@floating-ui/dom': 1.7.4
+      '@tiptap/core': 3.6.5(@tiptap/pm@3.6.5)
+      '@tiptap/pm': 3.6.5
+    optional: true
 
-  '@tiptap/extension-gapcursor@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)':
+  '@tiptap/extension-gapcursor@3.6.5(@tiptap/extensions@3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))(@tiptap/pm@3.6.5))':
     dependencies:
-      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
-      '@tiptap/pm': 2.26.2
+      '@tiptap/extensions': 3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))(@tiptap/pm@3.6.5)
 
-  '@tiptap/extension-history@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)':
+  '@tiptap/extension-history@3.6.5(@tiptap/extensions@3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))(@tiptap/pm@3.6.5))':
     dependencies:
-      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
-      '@tiptap/pm': 2.26.2
+      '@tiptap/extensions': 3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))(@tiptap/pm@3.6.5)
 
-  '@tiptap/extension-horizontal-rule@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)':
+  '@tiptap/extension-horizontal-rule@3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))(@tiptap/pm@3.6.5)':
     dependencies:
-      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
-      '@tiptap/pm': 2.26.2
+      '@tiptap/core': 3.6.5(@tiptap/pm@3.6.5)
+      '@tiptap/pm': 3.6.5
 
-  '@tiptap/extension-italic@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))':
+  '@tiptap/extension-italic@3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))':
     dependencies:
-      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
+      '@tiptap/core': 3.6.5(@tiptap/pm@3.6.5)
 
-  '@tiptap/extension-link@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)':
+  '@tiptap/extension-link@3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))(@tiptap/pm@3.6.5)':
     dependencies:
-      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
-      '@tiptap/pm': 2.26.2
+      '@tiptap/core': 3.6.5(@tiptap/pm@3.6.5)
+      '@tiptap/pm': 3.6.5
       linkifyjs: 4.3.2
 
-  '@tiptap/extension-paragraph@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))':
-    dependencies:
-      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
-
-  '@tiptap/extension-strike@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))':
+  '@tiptap/extension-paragraph@3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))':
     dependencies:
-      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
+      '@tiptap/core': 3.6.5(@tiptap/pm@3.6.5)
 
-  '@tiptap/extension-table-cell@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))':
+  '@tiptap/extension-strike@3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))':
     dependencies:
-      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
+      '@tiptap/core': 3.6.5(@tiptap/pm@3.6.5)
 
-  '@tiptap/extension-table-header@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))':
+  '@tiptap/extension-text@3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))':
     dependencies:
-      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
+      '@tiptap/core': 3.6.5(@tiptap/pm@3.6.5)
 
-  '@tiptap/extension-text@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))':
+  '@tiptap/extension-underline@3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))':
     dependencies:
-      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
+      '@tiptap/core': 3.6.5(@tiptap/pm@3.6.5)
 
-  '@tiptap/extension-underline@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))':
+  '@tiptap/extensions@3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))(@tiptap/pm@3.6.5)':
     dependencies:
-      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
+      '@tiptap/core': 3.6.5(@tiptap/pm@3.6.5)
+      '@tiptap/pm': 3.6.5
 
-  '@tiptap/pm@2.26.2':
+  '@tiptap/pm@3.6.5':
     dependencies:
       prosemirror-changeset: 2.3.1
       prosemirror-collab: 1.3.1
@@ -16993,17 +16969,22 @@ snapshots:
       prosemirror-transform: 1.10.4
       prosemirror-view: 1.41.2
 
-  '@tiptap/react@2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
+  '@tiptap/react@3.6.5(@floating-ui/dom@1.7.4)(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))(@tiptap/pm@3.6.5)(@types/react-dom@19.2.0(@types/react@19.2.0))(@types/react@19.2.0)(react-dom@19.2.0(react@19.2.0))(react@19.2.0)':
     dependencies:
-      '@tiptap/core': 2.26.2(@tiptap/pm@2.26.2)
-      '@tiptap/extension-bubble-menu': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)
-      '@tiptap/extension-floating-menu': 2.26.2(@tiptap/core@2.26.2(@tiptap/pm@2.26.2))(@tiptap/pm@2.26.2)
-      '@tiptap/pm': 2.26.2
+      '@tiptap/core': 3.6.5(@tiptap/pm@3.6.5)
+      '@tiptap/pm': 3.6.5
+      '@types/react': 19.2.0
+      '@types/react-dom': 19.2.0(@types/react@19.2.0)
       '@types/use-sync-external-store': 0.0.6
       fast-deep-equal: 3.1.3
       react: 19.2.0
       react-dom: 19.2.0(react@19.2.0)
       use-sync-external-store: 1.6.0(react@19.2.0)
+    optionalDependencies:
+      '@tiptap/extension-bubble-menu': 3.6.5(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))(@tiptap/pm@3.6.5)
+      '@tiptap/extension-floating-menu': 3.6.5(@floating-ui/dom@1.7.4)(@tiptap/core@3.6.5(@tiptap/pm@3.6.5))(@tiptap/pm@3.6.5)
+    transitivePeerDependencies:
+      - '@floating-ui/dom'
 
   '@transloadit/prettier-bytes@0.3.5': {}
 
@@ -17543,9 +17524,9 @@ snapshots:
       react: 19.2.0
       react-dom: 19.2.0(react@19.2.0)
 
-  '@vitejs/plugin-basic-ssl@2.1.0(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
+  '@vitejs/plugin-basic-ssl@2.1.0(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
-      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
 
   '@vitejs/plugin-react@4.7.0(vite@5.4.20(@types/node@24.6.2)(lightningcss@1.30.1)(terser@5.44.0))':
     dependencies:
@@ -17559,7 +17540,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@vitejs/plugin-react@5.0.4(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
+  '@vitejs/plugin-react@5.0.4(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
       '@babel/core': 7.28.4
       '@babel/plugin-transform-react-jsx-self': 7.27.1(@babel/core@7.28.4)
@@ -17567,29 +17548,10 @@ snapshots:
       '@rolldown/pluginutils': 1.0.0-beta.38
       '@types/babel__core': 7.20.5
       react-refresh: 0.17.0
-      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - supports-color
 
-  '@vitest/browser@3.2.4(playwright@1.55.1)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)':
-    dependencies:
-      '@testing-library/dom': 10.4.1
-      '@testing-library/user-event': 14.6.1(@testing-library/dom@10.4.1)
-      '@vitest/mocker': 3.2.4(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
-      '@vitest/utils': 3.2.4
-      magic-string: 0.30.19
-      sirv: 3.0.2
-      tinyrainbow: 2.0.0
-      vitest: 3.2.4(@types/debug@4.1.12)(@types/node@24.6.2)(@vitest/browser@3.2.4)(jiti@1.21.7)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
-      ws: 8.18.3
-    optionalDependencies:
-      playwright: 1.55.1
-    transitivePeerDependencies:
-      - bufferutil
-      - msw
-      - utf-8-validate
-      - vite
-
   '@vitest/browser@3.2.4(playwright@1.55.1)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)':
     dependencies:
       '@testing-library/dom': 10.4.1
@@ -17608,7 +17570,6 @@ snapshots:
       - msw
       - utf-8-validate
       - vite
-    optional: true
 
   '@vitest/coverage-v8@3.2.4(@vitest/browser@3.2.4)(vitest@3.2.4)':
     dependencies:
@@ -17625,9 +17586,9 @@ snapshots:
       std-env: 3.9.0
       test-exclude: 7.0.1
       tinyrainbow: 2.0.0
-      vitest: 3.2.4(@types/debug@4.1.12)(@types/node@24.6.2)(@vitest/browser@3.2.4)(jiti@1.21.7)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vitest: 3.2.4(@types/debug@4.1.12)(@types/node@24.6.2)(@vitest/browser@3.2.4)(jiti@2.6.1)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     optionalDependencies:
-      '@vitest/browser': 3.2.4(playwright@1.55.1)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)
+      '@vitest/browser': 3.2.4(playwright@1.55.1)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)
     transitivePeerDependencies:
       - supports-color
 
@@ -17639,14 +17600,6 @@ snapshots:
       chai: 5.3.3
       tinyrainbow: 2.0.0
 
-  '@vitest/mocker@3.2.4(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
-    dependencies:
-      '@vitest/spy': 3.2.4
-      estree-walker: 3.0.3
-      magic-string: 0.30.19
-    optionalDependencies:
-      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
-
   '@vitest/mocker@3.2.4(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))':
     dependencies:
       '@vitest/spy': 3.2.4
@@ -20432,6 +20385,10 @@ snapshots:
     dependencies:
       yallist: 3.1.1
 
+  lucide-react@0.525.0(react@19.2.0):
+    dependencies:
+      react: 19.2.0
+
   lucide-react@0.542.0(react@19.2.0):
     dependencies:
       react: 19.2.0
@@ -21329,15 +21286,6 @@ snapshots:
       postcss: 8.5.6
       ts-node: 10.9.2(@swc/core@1.7.26)(@types/node@24.6.2)(typescript@5.9.3)
 
-  postcss-load-config@6.0.1(jiti@1.21.7)(postcss@8.5.6)(tsx@4.20.6)(yaml@2.8.1):
-    dependencies:
-      lilconfig: 3.1.3
-    optionalDependencies:
-      jiti: 1.21.7
-      postcss: 8.5.6
-      tsx: 4.20.6
-      yaml: 2.8.1
-
   postcss-load-config@6.0.1(jiti@2.6.1)(postcss@8.5.6)(tsx@4.20.3)(yaml@2.8.1):
     dependencies:
       lilconfig: 3.1.3
@@ -22508,13 +22456,13 @@ snapshots:
       es-errors: 1.3.0
       internal-slot: 1.1.0
 
-  storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)):
+  storybook@9.1.10(@testing-library/dom@10.4.1)(prettier@3.6.2)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)):
     dependencies:
       '@storybook/global': 5.0.0
       '@testing-library/jest-dom': 6.9.1
       '@testing-library/user-event': 14.6.1(@testing-library/dom@10.4.1)
       '@vitest/expect': 3.2.4
-      '@vitest/mocker': 3.2.4(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
+      '@vitest/mocker': 3.2.4(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
       '@vitest/spy': 3.2.4
       better-opn: 3.0.2
       esbuild: 0.25.10
@@ -22671,10 +22619,6 @@ snapshots:
 
   tailwind-merge@3.3.1: {}
 
-  tailwindcss-animate@1.0.7(tailwindcss@3.4.18(tsx@4.20.6)(yaml@2.8.1)):
-    dependencies:
-      tailwindcss: 3.4.18(tsx@4.20.6)(yaml@2.8.1)
-
   tailwindcss-animate@1.0.7(tailwindcss@4.1.14):
     dependencies:
       tailwindcss: 4.1.14
@@ -22706,34 +22650,6 @@ snapshots:
     transitivePeerDependencies:
       - ts-node
 
-  tailwindcss@3.4.18(tsx@4.20.6)(yaml@2.8.1):
-    dependencies:
-      '@alloc/quick-lru': 5.2.0
-      arg: 5.0.2
-      chokidar: 3.6.0
-      didyoumean: 1.2.2
-      dlv: 1.1.3
-      fast-glob: 3.3.3
-      glob-parent: 6.0.2
-      is-glob: 4.0.3
-      jiti: 1.21.7
-      lilconfig: 3.1.3
-      micromatch: 4.0.8
-      normalize-path: 3.0.0
-      object-hash: 3.0.0
-      picocolors: 1.1.1
-      postcss: 8.5.6
-      postcss-import: 15.1.0(postcss@8.5.6)
-      postcss-js: 4.1.0(postcss@8.5.6)
-      postcss-load-config: 6.0.1(jiti@1.21.7)(postcss@8.5.6)(tsx@4.20.6)(yaml@2.8.1)
-      postcss-nested: 6.2.0(postcss@8.5.6)
-      postcss-selector-parser: 6.1.2
-      resolve: 1.22.10
-      sucrase: 3.35.0
-    transitivePeerDependencies:
-      - tsx
-      - yaml
-
   tailwindcss@4.1.14: {}
 
   tapable@2.3.0: {}
@@ -22836,10 +22752,6 @@ snapshots:
 
   tinyspy@4.0.4: {}
 
-  tippy.js@6.3.7:
-    dependencies:
-      '@popperjs/core': 2.11.8
-
   titleize@4.0.0: {}
 
   tldts-core@6.1.86: {}
@@ -23301,27 +23213,6 @@ snapshots:
       solid-js: 1.9.9
       vue: 3.5.13(typescript@5.9.3)
 
-  vite-node@3.2.4(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1):
-    dependencies:
-      cac: 6.7.14
-      debug: 4.4.3
-      es-module-lexer: 1.7.0
-      pathe: 2.0.3
-      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
-    transitivePeerDependencies:
-      - '@types/node'
-      - jiti
-      - less
-      - lightningcss
-      - sass
-      - sass-embedded
-      - stylus
-      - sugarss
-      - supports-color
-      - terser
-      - tsx
-      - yaml
-
   vite-node@3.2.4(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1):
     dependencies:
       cac: 6.7.14
@@ -23343,7 +23234,7 @@ snapshots:
       - tsx
       - yaml
 
-  vite-plugin-html@3.2.2(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)):
+  vite-plugin-html@3.2.2(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)):
     dependencies:
       '@rollup/pluginutils': 4.2.1
       colorette: 2.0.20
@@ -23357,35 +23248,35 @@ snapshots:
       html-minifier-terser: 6.1.0
       node-html-parser: 5.4.2
       pathe: 0.2.0
-      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
 
-  vite-plugin-pwa@1.0.3(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(workbox-build@7.3.0(@types/babel__core@7.20.5))(workbox-window@7.3.0):
+  vite-plugin-pwa@1.0.3(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(workbox-build@7.3.0(@types/babel__core@7.20.5))(workbox-window@7.3.0):
     dependencies:
       debug: 4.4.3
       pretty-bytes: 6.1.1
       tinyglobby: 0.2.15
-      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
       workbox-build: 7.3.0(@types/babel__core@7.20.5)
       workbox-window: 7.3.0
     transitivePeerDependencies:
       - supports-color
 
-  vite-plugin-static-copy@3.1.3(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)):
+  vite-plugin-static-copy@3.1.3(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)):
     dependencies:
       chokidar: 3.6.0
       fs-extra: 11.3.2
       p-map: 7.0.3
       picocolors: 1.1.1
       tinyglobby: 0.2.15
-      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
 
-  vite-tsconfig-paths@5.1.4(typescript@5.9.3)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)):
+  vite-tsconfig-paths@5.1.4(typescript@5.9.3)(vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)):
     dependencies:
       debug: 4.4.3
       globrex: 0.1.2
       tsconfck: 3.1.6(typescript@5.9.3)
     optionalDependencies:
-      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
+      vite: 7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
     transitivePeerDependencies:
       - supports-color
       - typescript
@@ -23401,23 +23292,6 @@ snapshots:
       lightningcss: 1.30.1
       terser: 5.44.0
 
-  vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1):
-    dependencies:
-      esbuild: 0.25.10
-      fdir: 6.5.0(picomatch@4.0.3)
-      picomatch: 4.0.3
-      postcss: 8.5.6
-      rollup: 4.52.4
-      tinyglobby: 0.2.15
-    optionalDependencies:
-      '@types/node': 24.6.2
-      fsevents: 2.3.3
-      jiti: 1.21.7
-      lightningcss: 1.30.1
-      terser: 5.44.0
-      tsx: 4.20.6
-      yaml: 2.8.1
-
   vite@7.1.9(@types/node@24.6.2)(jiti@2.6.1)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1):
     dependencies:
       esbuild: 0.25.10
@@ -23435,50 +23309,6 @@ snapshots:
       tsx: 4.20.6
       yaml: 2.8.1
 
-  vitest@3.2.4(@types/debug@4.1.12)(@types/node@24.6.2)(@vitest/browser@3.2.4)(jiti@1.21.7)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1):
-    dependencies:
-      '@types/chai': 5.2.2
-      '@vitest/expect': 3.2.4
-      '@vitest/mocker': 3.2.4(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))
-      '@vitest/pretty-format': 3.2.4
-      '@vitest/runner': 3.2.4
-      '@vitest/snapshot': 3.2.4
-      '@vitest/spy': 3.2.4
-      '@vitest/utils': 3.2.4
-      chai: 5.3.3
-      debug: 4.4.3
-      expect-type: 1.2.2
-      magic-string: 0.30.19
-      pathe: 2.0.3
-      picomatch: 4.0.3
-      std-env: 3.9.0
-      tinybench: 2.9.0
-      tinyexec: 0.3.2
-      tinyglobby: 0.2.15
-      tinypool: 1.1.1
-      tinyrainbow: 2.0.0
-      vite: 7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
-      vite-node: 3.2.4(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1)
-      why-is-node-running: 2.3.0
-    optionalDependencies:
-      '@types/debug': 4.1.12
-      '@types/node': 24.6.2
-      '@vitest/browser': 3.2.4(playwright@1.55.1)(vite@7.1.9(@types/node@24.6.2)(jiti@1.21.7)(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1))(vitest@3.2.4)
-      jsdom: 26.1.0(canvas@3.2.0)
-    transitivePeerDependencies:
-      - jiti
-      - less
-      - lightningcss
-      - msw
-      - sass
-      - sass-embedded
-      - stylus
-      - sugarss
-      - supports-color
-      - terser
-      - tsx
-      - yaml
-
   vitest@3.2.4(@types/debug@4.1.12)(@types/node@24.6.2)(@vitest/browser@3.2.4)(jiti@2.6.1)(jsdom@26.1.0(canvas@3.2.0))(lightningcss@1.30.1)(terser@5.44.0)(tsx@4.20.6)(yaml@2.8.1):
     dependencies:
       '@types/chai': 5.2.2

From 1641ed6caabe87266d9c87e6dc91ebbc24f0734a Mon Sep 17 00:00:00 2001
From: gino <ginopresilli@gmail.com>
Date: Tue, 7 Oct 2025 16:18:48 +0200
Subject: [PATCH 46/48] =?UTF-8?q?fix:=20When=20not=20at=20least=202=20prev?=
 =?UTF-8?q?=20tags=20=E2=86=92=20Use=20all=20commits,=20Else=20use=20secon?=
 =?UTF-8?q?d=20tag=20as=20pointer=20(#637)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix: When not at least 2 prev tags → Use all commits, Else use second tag as pointer

* fix: Add extra check for if tags exists

* chore: Just echo vitest for now (no tests yet)
---
 .github/workflows/ci.yml      | 17 ++++++++++++++++-
 .github/workflows/release.yml | 17 ++++++++++++++++-
 frontend/package.json         |  2 +-
 3 files changed, 33 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c2d688f1a..03f1c3e04 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -172,7 +172,22 @@ jobs:
         run: pnpm add -Dw conventional-changelog-cli conventional-changelog-conventionalcommits
 
       - name: Generate draft release notes
-        run: npx conventional-changelog -p conventionalcommits -r 0 -o RELEASE_NOTES.md
+        run: |
+          # Check latest and previous tags
+          LATEST_TAG=$(if [ "$(git tag | wc -l)" -ge 1 ]; then git describe --tags --abbrev=0; fi)
+          PREV_TAG=$(if [ "$(git tag | wc -l)" -ge 2 ]; then git tag --sort=creatordate | tail -2 | head -1; fi)
+
+          echo "Latest tag: $LATEST_TAG"
+          echo "Previous tag: $PREV_TAG"
+
+          if [ -z "$PREV_TAG" ]; then
+            echo "First release — include all commits"
+            npx conventional-changelog -p conventionalcommits -r 0 -o RELEASE_NOTES.md
+          else
+            echo "Generating changelog since previous tag $PREV_TAG"
+            # Use -r 2 and output commits since PREV_TAG
+            npx conventional-changelog -p conventionalcommits -r 2 -o RELEASE_NOTES.md
+          fi
 
       - name: Upload draft release notes
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 16b7d5b36..fa3fb036f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -26,7 +26,22 @@ jobs:
         run: pnpm add -Dw conventional-changelog-cli conventional-changelog-conventionalcommits
 
       - name: Generate release notes
-        run: npx conventional-changelog -p conventionalcommits -r 1 -o RELEASE_NOTES.md
+        run: |
+            # Check latest and previous tags
+            LATEST_TAG=$(if [ "$(git tag | wc -l)" -ge 1 ]; then git describe --tags --abbrev=0; fi)
+            PREV_TAG=$(if [ "$(git tag | wc -l)" -ge 2 ]; then git tag --sort=creatordate | tail -2 | head -1; fi)
+
+            echo "Latest tag: $LATEST_TAG"
+            echo "Previous tag: $PREV_TAG"
+
+            if [ -z "$PREV_TAG" ]; then
+              echo "First release — include all commits"
+              npx conventional-changelog -p conventionalcommits -r 0 -o RELEASE_NOTES.md
+            else
+              echo "Generating changelog since previous tag $PREV_TAG"
+              # Use -r 2 and output commits since PREV_TAG
+              npx conventional-changelog -p conventionalcommits -r 2 -o RELEASE_NOTES.md
+            fi
 
       - name: Publish GitHub Release
         uses: softprops/action-gh-release@v2
diff --git a/frontend/package.json b/frontend/package.json
index 48f456a82..bb0f332c7 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -11,7 +11,7 @@
     "dev:run": "cross-env NODE_ENV=development vite --mode development",
     "tunnel": "wait-on http://localhost:4000/ping && cross-env NODE_ENV=tunnel vite --mode tunnel",
     "start": "cross-env NODE_ENV=production pnpm preview",
-    "test": "vitest",
+    "test": "echo 'No tests → skipping Vitest'",
     "ts": "tsc --pretty",
     "ts:beta": "tsgo --pretty",
     "tsperf": "rm -rf tsconfig.tsbuildinfo && cross-env NODE_ENV=development tsc --noEmit --extendedDiagnostics",

From 22e0c338e00088698422e2f457274b63bd55b7ee Mon Sep 17 00:00:00 2001
From: gino <ginopresilli@gmail.com>
Date: Tue, 7 Oct 2025 16:27:16 +0200
Subject: [PATCH 47/48] Potential fix for code scanning alert no. 23: Workflow
 does not contain permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 .github/workflows/ci.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 03f1c3e04..6e6d07131 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,5 +1,8 @@
 name: CI
 
+permissions:
+  contents: read
+
 # Controls which events and branches will trigger the workflow
 on:
   push:

From b24561be1cfcad7a777e106c5603e74b305d492e Mon Sep 17 00:00:00 2001
From: gino <ginopresilli@gmail.com>
Date: Tue, 7 Oct 2025 16:37:54 +0200
Subject: [PATCH 48/48] Potential fix for code scanning alert no. 22: Workflow
 does not contain permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 .github/workflows/release.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fa3fb036f..cf8411a30 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,4 +1,6 @@
 name: Release
+permissions:
+  contents: write
 
 on:
   push: