tenneo-auth-gateway-plugin 1.0.7

package/dist/index.mjs

@@ -0,0 +1,3520 @@
+import axios from 'axios';
+import { createContext, useContext, useMemo, useRef, useLayoutEffect, useEffect, useState, useCallback } from 'react';
+import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
+
+// src/infrastructure/runtime/context.ts
+var currentRuntime = null;
+function setAuthRuntime(runtime) {
+  currentRuntime = runtime;
+}
+function getAuthRuntime() {
+  return currentRuntime;
+}
+
+// src/domain/tenant.ts
+function isLocalhost(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname.startsWith("192.168.") || hostname.startsWith("10.") || hostname.endsWith(".local");
+}
+function isCallbackUrlFromUrl(url) {
+  const params = new URLSearchParams(url.search);
+  return params.has("code") && params.has("state");
+}
+
+// src/infrastructure/storage/prefix.ts
+var DEFAULT_PREFIX = "tenneo_auth_";
+var currentPrefix = DEFAULT_PREFIX;
+function getStorageKeyPrefix() {
+  return currentPrefix;
+}
+function normalizeTenantCode(tenantCode) {
+  const trimmed = tenantCode.trim();
+  if (!trimmed) return "";
+  return trimmed.replace(/[^a-zA-Z0-9_]/g, "_").toLowerCase();
+}
+function setStorageKeyPrefix(tenantCode) {
+  const normalized = normalizeTenantCode(tenantCode);
+  currentPrefix = normalized ? `${normalized}_auth_` : DEFAULT_PREFIX;
+}
+function getStorageKey(suffix) {
+  return getStorageKeyPrefix() + suffix;
+}
+
+// src/infrastructure/storage/namespace.ts
+function buildStorageKey(ns, suffix) {
+  const { tenantId, appId } = ns;
+  if (!tenantId && !appId) {
+    return `${getStorageKeyPrefix()}${suffix}`;
+  }
+  const tid = tenantId || "";
+  const aid = appId || "";
+  return `auth_${tid}_${aid}_${suffix}`;
+}
+var TOKEN_KEY_SUFFIXES = {
+  accessToken: "access_token",
+  refreshToken: "refresh_token",
+  expiresAt: "expires_at"
+};
+var CONFIG_KEY_SUFFIXES = {
+  authServerUrl: "auth_server_url",
+  clientId: "client_id",
+  redirectUri: "redirect_uri",
+  tenantId: "tenant_id",
+  tenantKey: "tenant_key",
+  codeVerifier: "code_verifier",
+  state: "state",
+  callbackProcessed: "callback_processed",
+  callbackProcessing: "callback_processing",
+  callbackAttempted: "callback_attempted",
+  flowInProgress: "flow_in_progress",
+  flowTimestamp: "flow_timestamp",
+  logoutProcessing: "logout_processing",
+  propsConfig: "props_config",
+  propsChanged: "props_changed",
+  tenantSwitched: "tenant_switched",
+  newTenantKey: "new_tenant_key",
+  stateMismatch: "state_mismatch",
+  bootstrapInProgress: "bootstrap_in_progress",
+  bootstrapTimestamp: "bootstrap_timestamp",
+  callbackHandled: "callback_handled"
+};
+
+// src/infrastructure/storage/context.ts
+var currentAdapter = null;
+var currentNamespace = { tenantId: "", appId: "" };
+function setStorageContext(adapter, namespace = {}) {
+  currentAdapter = adapter;
+  currentNamespace = {
+    tenantId: namespace.tenantId ?? "",
+    appId: namespace.appId ?? ""
+  };
+}
+function getStorageAdapter() {
+  const runtime = getAuthRuntime();
+  if (runtime?.storageAdapter) return runtime.storageAdapter;
+  return currentAdapter;
+}
+function getStorageNamespace() {
+  const runtime = getAuthRuntime();
+  if (runtime?.storageNamespace) return { ...runtime.storageNamespace };
+  return { ...currentNamespace };
+}
+
+// src/infrastructure/storage/memory-adapter.ts
+function createMemoryStorageAdapter(namespace) {
+  const store = /* @__PURE__ */ new Map();
+  const getTokensSync = () => {
+    const accessToken = store.get(buildStorageKey(namespace, TOKEN_KEY_SUFFIXES.accessToken)) ?? null;
+    const refreshToken = store.get(buildStorageKey(namespace, TOKEN_KEY_SUFFIXES.refreshToken)) ?? null;
+    const expiresAtStr = store.get(buildStorageKey(namespace, TOKEN_KEY_SUFFIXES.expiresAt)) ?? null;
+    if (!accessToken || !refreshToken || !expiresAtStr) return null;
+    const expiresAt = parseInt(expiresAtStr, 10);
+    if (isNaN(expiresAt)) return null;
+    return { accessToken, refreshToken, expiresAt };
+  };
+  return {
+    async getTokens() {
+      return getTokensSync();
+    },
+    getTokensSync,
+    async setTokens(tokens) {
+      store.set(buildStorageKey(namespace, TOKEN_KEY_SUFFIXES.accessToken), tokens.accessToken);
+      store.set(buildStorageKey(namespace, TOKEN_KEY_SUFFIXES.refreshToken), tokens.refreshToken);
+      store.set(buildStorageKey(namespace, TOKEN_KEY_SUFFIXES.expiresAt), String(tokens.expiresAt));
+    },
+    setTokensSync(tokens) {
+      store.set(buildStorageKey(namespace, TOKEN_KEY_SUFFIXES.accessToken), tokens.accessToken);
+      store.set(buildStorageKey(namespace, TOKEN_KEY_SUFFIXES.refreshToken), tokens.refreshToken);
+      store.set(buildStorageKey(namespace, TOKEN_KEY_SUFFIXES.expiresAt), String(tokens.expiresAt));
+    },
+    async clearTokens() {
+      store.delete(buildStorageKey(namespace, TOKEN_KEY_SUFFIXES.accessToken));
+      store.delete(buildStorageKey(namespace, TOKEN_KEY_SUFFIXES.refreshToken));
+      store.delete(buildStorageKey(namespace, TOKEN_KEY_SUFFIXES.expiresAt));
+    },
+    clearTokensSync() {
+      store.delete(buildStorageKey(namespace, TOKEN_KEY_SUFFIXES.accessToken));
+      store.delete(buildStorageKey(namespace, TOKEN_KEY_SUFFIXES.refreshToken));
+      store.delete(buildStorageKey(namespace, TOKEN_KEY_SUFFIXES.expiresAt));
+    },
+    async getItem(key) {
+      return store.get(key) ?? null;
+    },
+    getItemSync(key) {
+      return store.get(key) ?? null;
+    },
+    async setItem(key, value) {
+      store.set(key, value);
+    },
+    setItemSync(key, value) {
+      store.set(key, value);
+    },
+    async removeItem(key) {
+      store.delete(key);
+    },
+    removeItemSync(key) {
+      store.delete(key);
+    },
+    async clear() {
+      store.clear();
+    },
+    clearSync() {
+      store.clear();
+    }
+  };
+}
+
+// src/infrastructure/storage/session-adapter.ts
+function getSessionStorage() {
+  if (typeof window === "undefined") return null;
+  try {
+    return window.sessionStorage;
+  } catch {
+    return null;
+  }
+}
+function createSecureSessionStorageAdapter(namespace) {
+  return {
+    async getTokens() {
+      return getTokensSyncImpl(namespace);
+    },
+    getTokensSync() {
+      return getTokensSyncImpl(namespace);
+    },
+    async setTokens(tokens) {
+      setTokensSyncImpl(namespace, tokens);
+    },
+    setTokensSync(tokens) {
+      setTokensSyncImpl(namespace, tokens);
+    },
+    async clearTokens() {
+      clearTokensSyncImpl(namespace);
+    },
+    clearTokensSync() {
+      clearTokensSyncImpl(namespace);
+    },
+    async getItem(key) {
+      return getItemSyncImpl(key);
+    },
+    getItemSync(key) {
+      return getItemSyncImpl(key);
+    },
+    async setItem(key, value) {
+      setItemSyncImpl(key, value);
+    },
+    setItemSync(key, value) {
+      setItemSyncImpl(key, value);
+    },
+    async removeItem(key) {
+      removeItemSyncImpl(key);
+    },
+    removeItemSync(key) {
+      removeItemSyncImpl(key);
+    },
+    async clear() {
+      clearSyncImpl(namespace);
+    },
+    clearSync() {
+      clearSyncImpl(namespace);
+    }
+  };
+}
+function getTokensSyncImpl(ns) {
+  const storage = getSessionStorage();
+  if (!storage) return null;
+  try {
+    const accessToken = storage.getItem(buildStorageKey(ns, TOKEN_KEY_SUFFIXES.accessToken));
+    const refreshToken = storage.getItem(buildStorageKey(ns, TOKEN_KEY_SUFFIXES.refreshToken));
+    const expiresAtStr = storage.getItem(buildStorageKey(ns, TOKEN_KEY_SUFFIXES.expiresAt));
+    if (!accessToken || !refreshToken || !expiresAtStr) return null;
+    const expiresAt = parseInt(expiresAtStr, 10);
+    if (isNaN(expiresAt)) return null;
+    return { accessToken, refreshToken, expiresAt };
+  } catch {
+    return null;
+  }
+}
+function setTokensSyncImpl(ns, tokens) {
+  const storage = getSessionStorage();
+  if (!storage) return;
+  try {
+    storage.setItem(buildStorageKey(ns, TOKEN_KEY_SUFFIXES.accessToken), tokens.accessToken);
+    storage.setItem(buildStorageKey(ns, TOKEN_KEY_SUFFIXES.refreshToken), tokens.refreshToken);
+    storage.setItem(buildStorageKey(ns, TOKEN_KEY_SUFFIXES.expiresAt), String(tokens.expiresAt));
+  } catch {
+  }
+}
+function clearTokensSyncImpl(ns) {
+  const storage = getSessionStorage();
+  if (!storage) return;
+  try {
+    storage.removeItem(buildStorageKey(ns, TOKEN_KEY_SUFFIXES.accessToken));
+    storage.removeItem(buildStorageKey(ns, TOKEN_KEY_SUFFIXES.refreshToken));
+    storage.removeItem(buildStorageKey(ns, TOKEN_KEY_SUFFIXES.expiresAt));
+  } catch {
+  }
+}
+function getItemSyncImpl(key) {
+  const storage = getSessionStorage();
+  if (!storage) return null;
+  try {
+    return storage.getItem(key);
+  } catch {
+    return null;
+  }
+}
+function setItemSyncImpl(key, value) {
+  const storage = getSessionStorage();
+  if (!storage) return;
+  try {
+    storage.setItem(key, value);
+  } catch {
+  }
+}
+function removeItemSyncImpl(key) {
+  const storage = getSessionStorage();
+  if (!storage) return;
+  try {
+    storage.removeItem(key);
+  } catch {
+  }
+}
+function clearSyncImpl(ns) {
+  const storage = getSessionStorage();
+  if (!storage) return;
+  try {
+    const prefix = ns.tenantId || ns.appId ? `auth_${ns.tenantId || ""}_${ns.appId || ""}_` : getStorageKeyPrefix();
+    const keys = [];
+    for (let i = 0; i < storage.length; i++) {
+      const key = storage.key(i);
+      if (key && key.startsWith(prefix)) keys.push(key);
+    }
+    keys.forEach((k) => storage.removeItem(k));
+  } catch {
+  }
+}
+
+// src/infrastructure/storage/cookie-adapter.ts
+var DEFAULT_COOKIE_OPTIONS = {
+  path: "/",
+  sameSite: "lax",
+  maxAge: 60 * 60 * 24 * 7
+  // 7 days for refresh token
+};
+function getDocument() {
+  if (typeof document === "undefined") return null;
+  return document;
+}
+function getCookie(name) {
+  const doc = getDocument();
+  if (!doc || !doc.cookie) return null;
+  const match = doc.cookie.match(new RegExp("(^| )" + name + "=([^;]+)"));
+  return match ? decodeURIComponent(match[2]) : null;
+}
+function setCookie(name, value, options = {}) {
+  const doc = getDocument();
+  if (!doc) return;
+  const { path = "/", sameSite = "lax", maxAge } = { ...DEFAULT_COOKIE_OPTIONS, ...options };
+  let cookie = `${encodeURIComponent(name)}=${encodeURIComponent(value)};path=${path};SameSite=${sameSite}`;
+  if (maxAge != null) cookie += `;max-age=${maxAge}`;
+  doc.cookie = cookie;
+}
+function deleteCookie(name) {
+  const doc = getDocument();
+  if (!doc) return;
+  doc.cookie = `${encodeURIComponent(name)}=;path=/;max-age=0`;
+}
+function createCookieStorageAdapter(namespace, options) {
+  const prefix = options?.cookiePrefix ?? "auth";
+  const keyPrefix = namespace.tenantId || namespace.appId ? `auth_${namespace.tenantId || ""}_${namespace.appId || ""}_` : getStorageKeyPrefix();
+  const cookieName = (suffix) => `${prefix}_${namespace.tenantId || "t"}_${namespace.appId || "a"}_${suffix}`.replace(/[^a-zA-Z0-9_]/g, "_");
+  return {
+    async getTokens() {
+      const accessToken = getCookie(cookieName(TOKEN_KEY_SUFFIXES.accessToken));
+      const refreshToken = getCookie(cookieName(TOKEN_KEY_SUFFIXES.refreshToken));
+      const expiresAtStr = getCookie(cookieName(TOKEN_KEY_SUFFIXES.expiresAt));
+      if (!accessToken || !refreshToken || !expiresAtStr) return null;
+      const expiresAt = parseInt(expiresAtStr, 10);
+      if (isNaN(expiresAt)) return null;
+      return { accessToken, refreshToken, expiresAt };
+    },
+    async setTokens(tokens) {
+      setCookie(cookieName(TOKEN_KEY_SUFFIXES.accessToken), tokens.accessToken, { maxAge: 60 * 60 });
+      setCookie(cookieName(TOKEN_KEY_SUFFIXES.refreshToken), tokens.refreshToken, { maxAge: 60 * 60 * 24 * 7 });
+      setCookie(cookieName(TOKEN_KEY_SUFFIXES.expiresAt), String(tokens.expiresAt), { maxAge: 60 * 60 * 24 });
+    },
+    async clearTokens() {
+      deleteCookie(cookieName(TOKEN_KEY_SUFFIXES.accessToken));
+      deleteCookie(cookieName(TOKEN_KEY_SUFFIXES.refreshToken));
+      deleteCookie(cookieName(TOKEN_KEY_SUFFIXES.expiresAt));
+    },
+    async getItem(key) {
+      const name = key.startsWith(keyPrefix) ? key.slice(keyPrefix.length) : key;
+      return getCookie(cookieName(name));
+    },
+    async setItem(key, value) {
+      const name = key.startsWith(keyPrefix) ? key.slice(keyPrefix.length) : key;
+      setCookie(cookieName(name), value);
+    },
+    async removeItem(key) {
+      const name = key.startsWith(keyPrefix) ? key.slice(keyPrefix.length) : key;
+      deleteCookie(cookieName(name));
+    },
+    async clear() {
+      const suffixes = Object.values(TOKEN_KEY_SUFFIXES);
+      suffixes.forEach((s) => deleteCookie(cookieName(s)));
+      Object.values(CONFIG_KEY_SUFFIXES).forEach((suffix) => deleteCookie(cookieName(suffix)));
+    }
+  };
+}
+
+// src/infrastructure/storage/kv.ts
+function keyToSuffix(key) {
+  const prefix = getStorageKeyPrefix();
+  return key.startsWith(prefix) ? key.slice(prefix.length) : key;
+}
+function setStorage(key, value) {
+  const adapter = getStorageAdapter();
+  if (!adapter?.setItemSync) return;
+  const ns = getStorageNamespace();
+  const suffix = keyToSuffix(key);
+  try {
+    adapter.setItemSync(buildStorageKey(ns, suffix), value);
+  } catch {
+  }
+}
+function getStorage(key) {
+  const adapter = getStorageAdapter();
+  if (!adapter?.getItemSync) return null;
+  const ns = getStorageNamespace();
+  const suffix = keyToSuffix(key);
+  try {
+    return adapter.getItemSync(buildStorageKey(ns, suffix));
+  } catch {
+    return null;
+  }
+}
+function removeStorage(key) {
+  const adapter = getStorageAdapter();
+  if (!adapter?.removeItemSync) return;
+  const ns = getStorageNamespace();
+  const suffix = keyToSuffix(key);
+  try {
+    adapter.removeItemSync(buildStorageKey(ns, suffix));
+  } catch {
+  }
+}
+
+// src/infrastructure/storage/api.ts
+var KEY_SUFFIXES = {
+  tenantKey: "tenant_key",
+  codeVerifier: "code_verifier",
+  state: "state",
+  accessToken: "access_token",
+  refreshToken: "refresh_token",
+  expiresAt: "expires_at"
+};
+var STORAGE_KEYS = {
+  get tenantKey() {
+    return getStorageKey(KEY_SUFFIXES.tenantKey);
+  },
+  get codeVerifier() {
+    return getStorageKey(KEY_SUFFIXES.codeVerifier);
+  },
+  get state() {
+    return getStorageKey(KEY_SUFFIXES.state);
+  },
+  get accessToken() {
+    return getStorageKey(KEY_SUFFIXES.accessToken);
+  },
+  get refreshToken() {
+    return getStorageKey(KEY_SUFFIXES.refreshToken);
+  },
+  get expiresAt() {
+    return getStorageKey(KEY_SUFFIXES.expiresAt);
+  }
+};
+function clearAuthStorage() {
+  const keysToClear = [
+    STORAGE_KEYS.accessToken,
+    STORAGE_KEYS.refreshToken,
+    STORAGE_KEYS.expiresAt,
+    STORAGE_KEYS.codeVerifier,
+    STORAGE_KEYS.state,
+    getStorageKey("callback_processed"),
+    getStorageKey("props_config"),
+    getStorageKey("tenant_switched"),
+    getStorageKey("new_tenant_key"),
+    getStorageKey("preserved_tenant_key")
+  ];
+  for (const key of keysToClear) removeStorage(key);
+}
+function clearAuthSessionStorage() {
+  clearAuthStorage();
+}
+function clearAllCookies() {
+  const runtime = getAuthRuntime();
+  try {
+    runtime?.clearCookies?.clearCookies();
+  } catch {
+  }
+}
+function clearAllStorage() {
+  clearAuthStorage();
+  clearAllCookies();
+}
+function getAccessToken() {
+  const adapter = getStorageAdapter();
+  if (adapter?.getTokensSync) {
+    const t = adapter.getTokensSync();
+    return t?.accessToken ?? null;
+  }
+  return getStorage(STORAGE_KEYS.accessToken);
+}
+function getRefreshToken() {
+  const adapter = getStorageAdapter();
+  if (adapter?.getTokensSync) {
+    const t = adapter.getTokensSync();
+    return t?.refreshToken ?? null;
+  }
+  return getStorage(STORAGE_KEYS.refreshToken);
+}
+function getExpiresAt() {
+  const adapter = getStorageAdapter();
+  if (adapter?.getTokensSync) {
+    const t = adapter.getTokensSync();
+    return t?.expiresAt ?? null;
+  }
+  const expiresAt = getStorage(STORAGE_KEYS.expiresAt);
+  if (!expiresAt) return null;
+  const timestamp = parseInt(expiresAt, 10);
+  return isNaN(timestamp) ? null : timestamp;
+}
+function isAccessTokenExpired() {
+  const expiresAt = getExpiresAt();
+  if (!expiresAt) return true;
+  const buffer = 60 * 1e3;
+  return Date.now() >= expiresAt - buffer;
+}
+function getCodeVerifier() {
+  return getStorage(STORAGE_KEYS.codeVerifier);
+}
+function getState() {
+  return getStorage(STORAGE_KEYS.state);
+}
+function getTenantKey() {
+  return getStorage(STORAGE_KEYS.tenantKey);
+}
+function setTenantKey(tenantKey) {
+  setStorage(STORAGE_KEYS.tenantKey, tenantKey);
+}
+
+// src/utils/logger.ts
+function isDev() {
+  if (typeof window === "undefined") {
+    return false;
+  }
+  const hostname = window.location.hostname;
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname.startsWith("192.168.") || hostname.startsWith("10.") || hostname.endsWith(".local");
+}
+var Logger = class {
+  constructor() {
+    this.prefix = "[tenneo-auth-gateway-plugin]";
+  }
+  log(level, message, data) {
+    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+    const logMessage = `${this.prefix} [${timestamp}] [${level.toUpperCase()}] ${message}`;
+    switch (level) {
+      case "info":
+        console.log(logMessage, data || "");
+        break;
+      case "warn":
+        console.warn(logMessage, data || "");
+        break;
+      case "error":
+        console.error(logMessage, data || "");
+        break;
+      case "debug":
+        if (isDev()) {
+          console.debug(logMessage, data || "");
+        }
+        break;
+    }
+  }
+  info(message, data) {
+    this.log("info", message, data);
+  }
+  warn(message, data) {
+    this.log("warn", message, data);
+  }
+  error(message, data) {
+    this.log("error", message, data);
+  }
+  debug(message, data) {
+    this.log("debug", message, data);
+  }
+};
+var logger = new Logger();
+
+// src/config/resolver-core.ts
+var inMemoryConfig = {};
+var hostConfigProvider = null;
+var CACHE_MARKER = "__tenneo_host_config_cache";
+var CACHE_AT = "__tenneo_host_config_cache_at";
+function setConfig(overrides) {
+  inMemoryConfig = { ...inMemoryConfig, ...overrides };
+}
+function clearConfigOverrides() {
+  inMemoryConfig = {};
+}
+function setHostConfigProvider(fn) {
+  hostConfigProvider = fn;
+}
+function readHostBridge() {
+  const out = {};
+  try {
+    if (typeof window !== "undefined" && window.__TENNEO_AUTH_HOST__) {
+      Object.assign(out, window.__TENNEO_AUTH_HOST__);
+    }
+  } catch {
+  }
+  try {
+    const fromProvider = hostConfigProvider?.();
+    if (fromProvider && typeof fromProvider === "object") {
+      Object.assign(out, fromProvider);
+    }
+  } catch (e) {
+    logger.warn("[config] hostConfigProvider threw", {
+      error: e instanceof Error ? e.message : String(e)
+    });
+  }
+  return out;
+}
+function readStorageConfigCache() {
+  try {
+    const raw = getStorage(getStorageKey("host_config"));
+    if (!raw) return {};
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object") return {};
+    const { [CACHE_MARKER]: _m, [CACHE_AT]: _t, ...rest } = parsed;
+    if (!rest.clientId && typeof rest.client_id === "string" && rest.client_id.trim()) {
+      rest.clientId = rest.client_id.trim();
+    }
+    return rest;
+  } catch {
+    return {};
+  }
+}
+function resolveSDKConfig(overrides) {
+  const stored = readStorageConfigCache();
+  const bridge = readHostBridge();
+  return {
+    ...stored,
+    ...bridge,
+    ...inMemoryConfig,
+    ...overrides ?? {}
+  };
+}
+function nonEmptyString(v) {
+  if (v == null) return void 0;
+  const s = String(v).trim();
+  return s || void 0;
+}
+function getConfigFieldSources(overrides) {
+  const stored = readStorageConfigCache();
+  const bridge = readHostBridge();
+  const layers = [
+    { src: "storage_cache", cfg: stored },
+    { src: "host_bridge", cfg: bridge },
+    { src: "memory", cfg: inMemoryConfig }
+  ];
+  if (overrides && Object.keys(overrides).length) {
+    layers.push({ src: "override", cfg: overrides });
+  }
+  const pick = (key) => {
+    for (let i = layers.length - 1; i >= 0; i--) {
+      const v = nonEmptyString(layers[i].cfg[key]);
+      if (v !== void 0) return layers[i].src;
+    }
+    return void 0;
+  };
+  return {
+    tenantCode: pick("tenantCode") ?? pick("tenantKey"),
+    tenantKey: pick("tenantKey") ?? pick("tenantCode"),
+    apiBaseUrl: pick("apiBaseUrl"),
+    authServerUrl: pick("authServerUrl"),
+    callbackUrl: pick("callbackUrl"),
+    clientCode: pick("clientCode"),
+    clientId: pick("clientId"),
+    tenantId: pick("tenantId"),
+    appId: pick("appId")
+  };
+}
+function getEffectiveTenantCode(overrides) {
+  const cfg = resolveSDKConfig(overrides);
+  const t = nonEmptyString(cfg.tenantCode) ?? nonEmptyString(cfg.tenantKey) ?? nonEmptyString(cfg.clientCode) ?? "";
+  return t;
+}
+var getEffectiveTenantKey = getEffectiveTenantCode;
+function trim(v) {
+  return v == null ? "" : String(v).trim();
+}
+function toResolvedConfig(cfg) {
+  const merged = { ...cfg };
+  if (!merged.tenantCode && merged.tenantKey) {
+    merged.tenantCode = merged.tenantKey;
+  }
+  const clientId = trim(merged.clientId) || trim(merged.clientCode);
+  return {
+    apiBaseUrl: trim(merged.apiBaseUrl),
+    authServerUrl: trim(merged.authServerUrl),
+    callbackUrl: trim(merged.callbackUrl) || trim(merged.redirectUri),
+    clientCode: trim(merged.clientCode),
+    tenantCode: trim(merged.tenantCode),
+    appId: trim(merged.appId),
+    clientId,
+    tenantId: trim(merged.tenantId)
+  };
+}
+var AuthConfigError = class extends Error {
+  constructor(missing, message) {
+    super(
+      message ?? `[tenneo-auth] Missing required auth configuration: ${missing.join(", ")}. Provide authServerUrl, callbackUrl (redirectUri), and tenant_key/tenant_code via AuthProvider/initPlugin or window.__TENNEO_AUTH_HOST__.`
+    );
+    this.code = "AUTH_CONFIG_MISSING";
+    this.name = "AuthConfigError";
+    this.missing = missing;
+  }
+};
+function resolveConfig(overrides) {
+  return toResolvedConfig(resolveSDKConfig(overrides));
+}
+function getAuthConfig(options) {
+  const resolved = toResolvedConfig(resolveSDKConfig(options?.overrides));
+  if (options?.strict) {
+    const missing = [];
+    if (!resolved.authServerUrl) missing.push("authServerUrl");
+    if (!resolved.callbackUrl) missing.push("callbackUrl");
+    if (!resolved.tenantCode) missing.push("tenantCode|tenantKey");
+    if (missing.length) throw new AuthConfigError(missing);
+  }
+  return resolved;
+}
+function syncHostConfigCacheFromMemory() {
+  const c = resolveSDKConfig();
+  const patch = {};
+  const keys = [
+    "apiBaseUrl",
+    "authServerUrl",
+    "callbackUrl",
+    "redirectUri",
+    "tenantCode",
+    "tenantKey",
+    "clientCode",
+    "clientId",
+    "tenantId",
+    "appId",
+    "basePath"
+  ];
+  for (const k of keys) {
+    const v = c[k];
+    if (v != null && String(v).trim()) {
+      patch[k] = String(v).trim();
+    }
+  }
+  if (Object.keys(patch).length) writeHostConfigCache(patch);
+}
+function writeHostConfigCache(partial) {
+  try {
+    const key = getStorageKey("host_config");
+    const raw = getStorage(key);
+    let existing = {};
+    try {
+      if (raw) existing = JSON.parse(raw);
+    } catch {
+      existing = {};
+    }
+    const next = {
+      ...existing,
+      ...partial,
+      [CACHE_MARKER]: true,
+      [CACHE_AT]: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    setStorage(key, JSON.stringify(next));
+    logger.debug("[config] host_config cache updated (non-authoritative)", {
+      keys: Object.keys(partial)
+    });
+  } catch (e) {
+    logger.warn("[config] Failed to write host_config cache", {
+      error: e instanceof Error ? e.message : String(e)
+    });
+  }
+}
+function initPlugin(config, opts) {
+  setConfig(config);
+  logger.info("[config] initPlugin \u2014 runtime config updated", {
+    syncStorageCache: opts?.syncStorageCache !== false,
+    tenantCode: config.tenantCode ?? config.tenantKey ?? "(none)"
+  });
+  if (opts?.syncStorageCache !== false) {
+    writeHostConfigCache(config);
+  }
+}
+function logConfigResolutionDebug(context, overrides) {
+  const sources = getConfigFieldSources(overrides);
+  logger.debug(`[config] ${context}`, {
+    fieldSources: sources,
+    effectiveTenantCode: getEffectiveTenantCode(overrides) || "(empty)",
+    hasAuthServerUrl: !!resolveSDKConfig(overrides).authServerUrl,
+    hasCallbackUrl: !!resolveSDKConfig(overrides).callbackUrl
+  });
+}
+
+// src/config/host-fields.ts
+function trim2(v) {
+  if (v == null) return null;
+  const s = String(v).trim();
+  return s || null;
+}
+function oauthClientIdForTokenRequest(raw) {
+  if (!raw) return null;
+  let s = raw.trim();
+  if (!s) return null;
+  if (s.toLowerCase().startsWith("public-")) {
+    s = s.slice("public-".length).trim();
+  }
+  return s || null;
+}
+function getClientId() {
+  const c = resolveSDKConfig();
+  const fromId = oauthClientIdForTokenRequest(trim2(c.clientId));
+  if (fromId) return fromId;
+  return oauthClientIdForTokenRequest(trim2(c.clientCode));
+}
+function normalizeClientIdForOAuthTokenBody(raw) {
+  return oauthClientIdForTokenRequest(trim2(raw));
+}
+function getRedirectUri() {
+  const c = resolveSDKConfig();
+  return trim2(c.callbackUrl) ?? trim2(c.redirectUri);
+}
+function getTenantId() {
+  return trim2(resolveSDKConfig().tenantId);
+}
+
+// src/domain/errors.ts
+function isLocalhostHostname(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname.startsWith("192.168.") || hostname.startsWith("10.") || hostname.startsWith("172.16.");
+}
+function isDev2() {
+  if (typeof window === "undefined") return false;
+  return isLocalhostHostname(window.location.hostname);
+}
+function enforceHttps(allowLocalhost = true) {
+  if (typeof window === "undefined") return;
+  const isLocalhostWindow = window.location.hostname === "localhost" || window.location.hostname === "127.0.0.1" || window.location.hostname.startsWith("192.168.") || window.location.hostname.startsWith("10.") || window.location.hostname.startsWith("172.16.");
+  const isHttp = window.location.protocol === "http:";
+  if (allowLocalhost && isLocalhostWindow && isHttp) {
+    logger.debug("HTTP allowed on localhost for development");
+    return;
+  }
+  if (isHttp && !isLocalhostWindow) {
+    const error = new Error("HTTPS is required for authentication. Please use HTTPS to access this application.");
+    logger.error("HTTPS enforcement failed", {
+      protocol: window.location.protocol,
+      hostname: window.location.hostname
+    });
+    throw error;
+  }
+  logger.debug("HTTPS check passed", { protocol: window.location.protocol });
+}
+function sanitizeErrorMessage(error, genericMessage) {
+  if (isDev2()) {
+    if (error instanceof Error) return error.message;
+    return String(error);
+  }
+  return genericMessage;
+}
+var SanitizedError = class extends Error {
+  constructor(code, genericMessage, originalError) {
+    super(genericMessage);
+    this.name = "SanitizedError";
+    this.code = code;
+    if (isDev2() && originalError instanceof Error) {
+      this.originalMessage = originalError.message;
+    }
+  }
+};
+
+// src/domain/auth-lifecycle.ts
+function resolveAuthLifecycleState(input) {
+  const {
+    url,
+    getStorage: getStorage3,
+    isCallbackUrl: isCallbackUrl2,
+    hasValidToken,
+    hasToken,
+    hasRefreshToken,
+    isTokenExpired
+  } = input;
+  const callbackProcessed = getStorage3("callback_processed") === "true";
+  const tenantSwitched = getStorage3("tenant_switched") === "true";
+  if (isCallbackUrl2(url)) return "PROCESSING_CALLBACK" /* PROCESSING_CALLBACK */;
+  if (hasValidToken) return "AUTHENTICATED" /* AUTHENTICATED */;
+  if (callbackProcessed && !hasToken) return "LOGIN_REQUIRED" /* LOGIN_REQUIRED */;
+  if (hasToken && isTokenExpired && hasRefreshToken) return "TOKEN_EXPIRED" /* TOKEN_EXPIRED */;
+  if (hasToken && isTokenExpired && !hasRefreshToken) return "LOGIN_REQUIRED" /* LOGIN_REQUIRED */;
+  if (tenantSwitched) return "TENANT_SWITCH" /* TENANT_SWITCH */;
+  return "LOGIN_REQUIRED" /* LOGIN_REQUIRED */;
+}
+
+// src/application/lifecycle-state.ts
+var BOOTSTRAP_STALE_MS = 5e3;
+var bootstrapInProgress = false;
+var bootstrapTimestamp = 0;
+var callbackProcessing = false;
+var flowInProgress = false;
+var flowTimestamp = 0;
+function isBootstrapInProgress() {
+  if (!bootstrapInProgress) return false;
+  if (!bootstrapTimestamp) return true;
+  return Date.now() - bootstrapTimestamp < BOOTSTRAP_STALE_MS;
+}
+function setBootstrapInProgress() {
+  bootstrapInProgress = true;
+  bootstrapTimestamp = Date.now();
+}
+function clearBootstrapInProgress() {
+  bootstrapInProgress = false;
+  bootstrapTimestamp = 0;
+}
+function isCallbackProcessing() {
+  return callbackProcessing;
+}
+function setCallbackProcessing() {
+  callbackProcessing = true;
+}
+function clearCallbackProcessing() {
+  callbackProcessing = false;
+}
+function isFlowInProgress() {
+  return flowInProgress;
+}
+function setFlowInProgress() {
+  flowInProgress = true;
+  flowTimestamp = Date.now();
+}
+function clearFlowInProgress() {
+  flowInProgress = false;
+  flowTimestamp = 0;
+}
+function isFlowFlagStale(thresholdMs = 3e3) {
+  if (!flowTimestamp) return true;
+  return Date.now() - flowTimestamp > thresholdMs;
+}
+function clearFlowFlags() {
+  clearFlowInProgress();
+}
+function setFlowFlags() {
+  setFlowInProgress();
+}
+
+// src/application/events/AuthEvents.ts
+var AuthEventNames = {
+  LOGIN_STARTED: "LOGIN_STARTED",
+  LOGIN_SUCCESS: "LOGIN_SUCCESS",
+  LOGIN_FAILED: "LOGIN_FAILED",
+  CALLBACK_SUCCESS: "CALLBACK_SUCCESS",
+  CALLBACK_FAILED: "CALLBACK_FAILED",
+  TOKEN_REFRESH_SUCCESS: "TOKEN_REFRESH_SUCCESS",
+  TOKEN_REFRESH_FAILED: "TOKEN_REFRESH_FAILED",
+  TENANT_SWITCHED: "TENANT_SWITCHED",
+  LOGOUT_COMPLETED: "LOGOUT_COMPLETED",
+  BOOTSTRAP_STATE_DETECTED: "BOOTSTRAP_STATE_DETECTED",
+  REDIRECT_LOOP_RISK: "REDIRECT_LOOP_RISK"
+};
+var listeners = /* @__PURE__ */ new Map();
+function getHandlers(event) {
+  let set = listeners.get(event);
+  if (!set) {
+    set = /* @__PURE__ */ new Set();
+    listeners.set(event, set);
+  }
+  return set;
+}
+function getWildcardHandlers() {
+  let set = listeners.get("*");
+  if (!set) {
+    set = /* @__PURE__ */ new Set();
+    listeners.set("*", set);
+  }
+  return set;
+}
+function emitAuthEvent(event, payload) {
+  const handlers = getHandlers(event);
+  const wildcard = getWildcardHandlers();
+  const p = payload ?? {};
+  handlers.forEach((fn) => {
+    try {
+      fn(p);
+    } catch {
+    }
+  });
+  wildcard.forEach((fn) => {
+    try {
+      fn({ ...p, event });
+    } catch {
+    }
+  });
+}
+function subscribeAuthEvent(event, handler) {
+  const set = event === "*" ? getWildcardHandlers() : getHandlers(event);
+  set.add(handler);
+  return () => set.delete(handler);
+}
+
+// src/config/constants.ts
+var OAUTH_CONSTANTS = {
+  SCOPES: "openid profile email",
+  RESPONSE_TYPE: "code",
+  CODE_CHALLENGE_METHOD: "S256",
+  TOKEN_GRANT_TYPE: "authorization_code",
+  REFRESH_GRANT_TYPE: "refresh_token"
+};
+var STORAGE_KEY_PREFIX = "tenneo_auth_";
+var STORAGE_KEYS2 = {
+  authServerUrl: `${STORAGE_KEY_PREFIX}auth_server_url`,
+  clientId: `${STORAGE_KEY_PREFIX}client_id`,
+  redirectUri: `${STORAGE_KEY_PREFIX}redirect_uri`,
+  tenantId: `${STORAGE_KEY_PREFIX}tenant_id`,
+  codeVerifier: `${STORAGE_KEY_PREFIX}code_verifier`,
+  state: `${STORAGE_KEY_PREFIX}state`,
+  accessToken: `${STORAGE_KEY_PREFIX}access_token`,
+  refreshToken: `${STORAGE_KEY_PREFIX}refresh_token`,
+  expiresAt: `${STORAGE_KEY_PREFIX}expires_at`
+};
+OAUTH_CONSTANTS.SCOPES;
+var DEFAULT_RESPONSE_TYPE = OAUTH_CONSTANTS.RESPONSE_TYPE;
+var DEFAULT_CODE_CHALLENGE_METHOD = OAUTH_CONSTANTS.CODE_CHALLENGE_METHOD;
+var DEFAULT_TOKEN_GRANT_TYPE = OAUTH_CONSTANTS.TOKEN_GRANT_TYPE;
+var DEFAULT_REFRESH_GRANT_TYPE = OAUTH_CONSTANTS.REFRESH_GRANT_TYPE;
+
+// src/config/index.ts
+function getAuthConfig2(options) {
+  return getAuthConfig(options);
+}
+function requireAuthConfig(overrides) {
+  return getAuthConfig({ strict: true, overrides });
+}
+function getConfig() {
+  return resolveConfig();
+}
+function getRedirectUri2() {
+  const cfg = resolveConfig();
+  if (cfg.callbackUrl) return cfg.callbackUrl;
+  if (typeof window !== "undefined") return `${window.location.origin}/callback`;
+  return "";
+}
+var Config = {
+  getApiBaseUrl() {
+    return resolveConfig().apiBaseUrl;
+  },
+  getAuthServerUrl() {
+    return resolveConfig().authServerUrl;
+  },
+  getClientCode() {
+    return resolveConfig().clientCode;
+  },
+  getRedirectUri() {
+    return getRedirectUri2();
+  },
+  getAll() {
+    return resolveConfig();
+  }
+};
+function applyRuntimeTenantSwitch(tenantKey, opts) {
+  const t = tenantKey.trim();
+  if (!t) return;
+  setConfig({ tenantCode: t, tenantKey: t });
+  logConfigResolutionDebug("applyRuntimeTenantSwitch", { tenantCode: t, tenantKey: t });
+  if (opts?.syncStorageCache !== false) {
+    writeHostConfigCache({ tenantCode: t, tenantKey: t });
+  }
+}
+
+// src/infrastructure/tenant/TenantConfigCache.ts
+var DEFAULT_TTL_MS = 5 * 60 * 1e3;
+var TenantConfigCache = class {
+  constructor(ttlMs = DEFAULT_TTL_MS) {
+    this.cache = /* @__PURE__ */ new Map();
+    this.inFlight = /* @__PURE__ */ new Map();
+    this.ttlMs = ttlMs;
+  }
+  get(tenantKey) {
+    const entry = this.cache.get(tenantKey);
+    if (!entry) return null;
+    if (Date.now() >= entry.expiresAt) {
+      this.cache.delete(tenantKey);
+      return null;
+    }
+    return entry.config;
+  }
+  set(tenantKey, config) {
+    this.cache.set(tenantKey, {
+      config,
+      expiresAt: Date.now() + this.ttlMs
+    });
+  }
+  invalidate(tenantKey) {
+    if (tenantKey) {
+      this.cache.delete(tenantKey);
+      this.inFlight.delete(tenantKey);
+    } else {
+      this.cache.clear();
+      this.inFlight.clear();
+    }
+  }
+  async getOrResolve(tenantKey, resolver) {
+    if (!tenantKey || !tenantKey.trim()) return null;
+    const key = tenantKey.trim();
+    const cached = this.get(key);
+    if (cached) {
+      logger.debug("Tenant config from cache", { tenantKey: key });
+      return cached;
+    }
+    const existing = this.inFlight.get(key);
+    if (existing) {
+      logger.debug("Tenant resolution reused (in-flight)", { tenantKey: key });
+      return existing;
+    }
+    const promise = (async () => {
+      try {
+        const config = await resolver(key);
+        if (config) this.set(key, config);
+        return config;
+      } finally {
+        this.inFlight.delete(key);
+      }
+    })();
+    this.inFlight.set(key, promise);
+    return promise;
+  }
+};
+
+// src/infrastructure/tenant/tenantResolution.ts
+var defaultTenantConfigCache = new TenantConfigCache();
+function consumePropsConfig() {
+  const propsConfigKey = getStorageKey("props_config");
+  try {
+    const propsConfigStr = getStorage(propsConfigKey);
+    if (!propsConfigStr) return null;
+    const parsed = JSON.parse(propsConfigStr);
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  } finally {
+    removeStorage(propsConfigKey);
+  }
+}
+function validateTenantKey(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed ? trimmed : null;
+}
+function resolveTenantKey() {
+  const propsConfig = consumePropsConfig();
+  const tenantFromProps = validateTenantKey(propsConfig?.tenantKey);
+  if (tenantFromProps) {
+    logger.debug("[tenant] Resolved tenant from props_config", { tenantKey: tenantFromProps });
+    return tenantFromProps;
+  }
+  const fromHost = validateTenantKey(getEffectiveTenantCode());
+  if (fromHost) {
+    logger.debug("[tenant] Resolved tenant from host/runtime config", { tenantKey: fromHost });
+    return fromHost;
+  }
+  logger.warn("[tenant] Unable to resolve tenant key (props + host/runtime empty)");
+  return null;
+}
+async function resolveTenantConfig(tenantKey, tenantResolver) {
+  const resolved = await tenantResolver.resolve(tenantKey);
+  if (!resolved) return null;
+  return { ...resolved, tenantKey };
+}
+async function resolveTenantConfigCached(tenantKey, tenantResolver) {
+  return defaultTenantConfigCache.getOrResolve(
+    tenantKey,
+    (key) => resolveTenantConfig(key, tenantResolver)
+  );
+}
+
+// src/application/domain-facade.ts
+function isLocalhost2() {
+  const runtime = getAuthRuntime();
+  const hostname = runtime ? runtime.urlProvider.getCurrentUrl().hostname : typeof window !== "undefined" ? window.location.hostname : "";
+  return isLocalhost(hostname);
+}
+function extractTenantKey() {
+  return resolveTenantKey();
+}
+function isCallbackUrl() {
+  const runtime = getAuthRuntime();
+  if (runtime) return isCallbackUrlFromUrl(runtime.urlProvider.getCurrentUrl());
+  if (typeof window === "undefined") return false;
+  const params = new URLSearchParams(window.location.search);
+  return params.has("code") && params.has("state");
+}
+
+// src/strategies/oauth2-pkce/token-exchange.ts
+function storeTokens(tokenData) {
+  const expiresIn = tokenData.expires_in || 3600;
+  const expiresAt = Date.now() + expiresIn * 1e3;
+  const adapter = getStorageAdapter();
+  if (adapter?.setTokensSync) {
+    adapter.setTokensSync({
+      accessToken: tokenData.access_token,
+      refreshToken: tokenData.refresh_token,
+      expiresAt
+    });
+  }
+  setStorage(STORAGE_KEYS.accessToken, tokenData.access_token);
+  setStorage(STORAGE_KEYS.refreshToken, tokenData.refresh_token);
+  setStorage(STORAGE_KEYS.expiresAt, expiresAt.toString());
+  if (isLocalhost2()) {
+    logger.debug("Tokens stored successfully", {
+      expiresAt: new Date(expiresAt).toISOString(),
+      expiresIn
+    });
+  } else {
+    logger.info("Tokens stored successfully");
+  }
+}
+async function exchangeCodeForTokens(params) {
+  try {
+    const { code, codeVerifier, clientId, redirectUri, tenantId } = params;
+    const apiAuthBaseUrl = Config.getAuthServerUrl();
+    const tokenUrl = `${apiAuthBaseUrl}/oauth/token`;
+    const body = new URLSearchParams({
+      grant_type: DEFAULT_TOKEN_GRANT_TYPE,
+      code,
+      client_id: `public-${clientId}`,
+      redirect_uri: redirectUri,
+      code_verifier: codeVerifier
+    });
+    const response = await fetch(tokenUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        "X-Tenant-Id": tenantId
+      },
+      body: body.toString()
+    });
+    if (!response.ok) {
+      const responseData = await response.json().catch(() => ({}));
+      logger.error("Token exchange failed", {
+        status: response.status,
+        statusText: response.statusText,
+        responseData,
+        requestUrl: tokenUrl
+      });
+      throw new Error(
+        `Token exchange failed: ${response.status} ${response.statusText}${Object.keys(responseData).length ? ` - ${JSON.stringify(responseData)}` : ""}`
+      );
+    }
+    const tokenData = await response.json();
+    if (!tokenData.access_token || !tokenData.refresh_token || !tokenData.expires_in) {
+      logger.error("Invalid token response received");
+      throw new Error("Invalid token response");
+    }
+    storeTokens(tokenData);
+    return tokenData;
+  } catch (error) {
+    const isAborted = error instanceof Error && error.name === "AbortError";
+    if (isAborted) {
+      logger.warn("Token exchange request canceled (likely due to navigation or component unmount)");
+      const existingToken = getAccessToken();
+      if (existingToken && !isAccessTokenExpired()) {
+        return {
+          access_token: existingToken,
+          refresh_token: getRefreshToken() || "",
+          expires_in: 3600
+        };
+      }
+      throw new Error("Token exchange request was canceled");
+    }
+    logger.error("Token exchange failed", {
+      message: error instanceof Error ? error.message : String(error)
+    });
+    throw error;
+  }
+}
+var refreshPromise = null;
+async function refreshAccessToken() {
+  if (refreshPromise) return refreshPromise;
+  refreshPromise = (async () => {
+    try {
+      const refreshToken = getRefreshToken();
+      const clientId = getClientId();
+      const tenantId = getTenantId();
+      logger.debug("Token refresh - collected data", {
+        hasRefreshToken: !!refreshToken,
+        clientId,
+        tenantId
+      });
+      if (!refreshToken || !clientId || !tenantId) {
+        logger.error("Token refresh failed: missing required data", {
+          hasRefreshToken: !!refreshToken,
+          hasClientId: !!clientId,
+          hasTenantId: !!tenantId
+        });
+        throw new Error("Cannot refresh token: missing required data");
+      }
+      const refreshTokenApiAuthBaseUrl = Config.getAuthServerUrl();
+      const refreshtokenUrl = `${refreshTokenApiAuthBaseUrl}/oauth/refresh`;
+      const body = new URLSearchParams({
+        grant_type: DEFAULT_REFRESH_GRANT_TYPE,
+        refresh_token: refreshToken,
+        client_id: clientId.startsWith("public-") ? clientId : `public-${clientId}`,
+        tenant_id: tenantId
+      });
+      const response = await fetch(refreshtokenUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          "Accept": "application/json",
+          "X-Tenant-Id": tenantId
+        },
+        body: body.toString()
+      });
+      if (!response.ok) {
+        const responseData = await response.json().catch(() => ({}));
+        const isExpiredOrInvalidGrant = response.status === 401 || responseData?.error === "invalid_grant" || typeof responseData?.error_description === "string" && (responseData.error_description.includes("expired") || responseData.error_description.includes("invalid"));
+        if (isExpiredOrInvalidGrant) {
+          removeStorage(STORAGE_KEYS.refreshToken);
+          removeStorage(STORAGE_KEYS.accessToken);
+          removeStorage(STORAGE_KEYS.expiresAt);
+          emitAuthEvent(AuthEventNames.TOKEN_REFRESH_FAILED, {
+            error: "Refresh token expired or invalid",
+            message: String(responseData?.error_description ?? responseData?.error ?? "Token refresh failed")
+          });
+        }
+        logger.error("Token refresh failed", {
+          status: response.status,
+          statusText: response.statusText,
+          responseData,
+          requestUrl: refreshtokenUrl
+        });
+        throw new Error(
+          `Token refresh failed: ${response.status} ${response.statusText}${Object.keys(responseData).length ? ` - ${JSON.stringify(responseData)}` : ""}`
+        );
+      }
+      const tokenData = await response.json();
+      if (!tokenData.access_token || !tokenData.refresh_token) {
+        logger.error("Invalid refresh token response received");
+        throw new Error("Invalid refresh token response");
+      }
+      storeTokens(tokenData);
+      emitAuthEvent(AuthEventNames.TOKEN_REFRESH_SUCCESS);
+      return tokenData.access_token;
+    } catch (error) {
+      if (error instanceof Error) {
+        logger.error("Token refresh failed", { message: error.message });
+        emitAuthEvent(AuthEventNames.TOKEN_REFRESH_FAILED, { error: error.message });
+      }
+      throw error;
+    } finally {
+      refreshPromise = null;
+    }
+  })();
+  return refreshPromise;
+}
+
+// src/strategies/oauth2-pkce/pkce.ts
+function generateCodeVerifier(length = 128) {
+  const array = new Uint8Array(length);
+  crypto.getRandomValues(array);
+  const base64 = btoa(String.fromCharCode(...array));
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+async function generateCodeChallenge(verifier) {
+  try {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(verifier);
+    const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    const base64 = btoa(String.fromCharCode(...hashArray));
+    return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+  } catch {
+    throw new Error("Failed to generate code challenge");
+  }
+}
+function generateState() {
+  const array = new Uint8Array(32);
+  crypto.getRandomValues(array);
+  const base64 = btoa(String.fromCharCode(...array));
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+
+// src/utils/validation.ts
+function isValidGuid(guid) {
+  if (!guid || typeof guid !== "string") {
+    return false;
+  }
+  const guidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  return guidRegex.test(guid.trim());
+}
+function validateTenantId(tenantId) {
+  if (!tenantId || tenantId.trim() === "") {
+    return {
+      isValid: false,
+      error: "Tenant ID is required"
+    };
+  }
+  if (!isValidGuid(tenantId)) {
+    return {
+      isValid: false,
+      error: "Tenant ID must be a valid GUID format (00000000-0000-0000-0000-000000000001)"
+    };
+  }
+  return { isValid: true };
+}
+
+// src/application/security/redirectLoopGuard.ts
+var DEFAULT_MAX_REDIRECTS = 5;
+var WINDOW_MS = 60 * 1e3;
+var redirectCount = 0;
+var firstRedirectAt = 0;
+function resetRedirectLoopGuard() {
+  redirectCount = 0;
+  firstRedirectAt = 0;
+}
+function checkAndIncrementRedirect(maxAttempts = DEFAULT_MAX_REDIRECTS) {
+  const now = Date.now();
+  if (now - firstRedirectAt > WINDOW_MS) {
+    redirectCount = 0;
+    firstRedirectAt = now;
+  }
+  if (redirectCount >= maxAttempts) {
+    emitAuthEvent(AuthEventNames.REDIRECT_LOOP_RISK, {
+      message: `Redirect attempt limit (${maxAttempts}) exceeded`
+    });
+    return false;
+  }
+  redirectCount++;
+  return true;
+}
+
+// src/strategies/oauth2-pkce/oauth.ts
+function storeTenantConfig(config) {
+  const validation = validateTenantId(config.tenantId);
+  if (!validation.isValid) {
+    logger.warn("Tenant ID validation failed", { tenantId: config.tenantId });
+  }
+  const authServerToStore = Config.getAuthServerUrl() || config.authServer;
+  const redirectUriToStore = Config.getRedirectUri();
+  writeHostConfigCache({
+    authServerUrl: authServerToStore,
+    clientId: config.client.clientId,
+    clientCode: config.client.clientCode ?? config.client.clientId,
+    redirectUri: redirectUriToStore,
+    callbackUrl: redirectUriToStore,
+    tenantId: config.tenantId,
+    tenantKey: config.tenantKey ?? "",
+    tenantCode: config.tenantKey ?? ""
+  });
+  if (config.tenantKey) {
+    setStorage(STORAGE_KEYS.tenantKey, config.tenantKey);
+  }
+}
+async function initiateAuthFlow(config) {
+  try {
+    logger.info("Initiating OAuth authorization flow");
+    const authServerFromProps = Config.getAuthServerUrl();
+    const authServerEffective = (authServerFromProps || config?.authServer || "").replace(/\/+$/, "");
+    const redirectUriEffective = Config.getRedirectUri();
+    const tenantIdEffective = config?.tenantId || "";
+    const clientIdEffective = config?.client?.clientId || "";
+    logger.debug("[initiateAuthFlow] Resolved inputs", {
+      authServerFromProps: authServerFromProps ? "(provided)" : "(empty)",
+      authServerEffective,
+      redirectUriEffective,
+      tenantIdEffective,
+      clientIdEffective,
+      scopes: config?.client?.scopes,
+      hasRuntime: !!getAuthRuntime()
+    });
+    logger.info("[initiateAuthFlow] authServerUrl for OAuth", {
+      authServerFromProps: authServerFromProps || null,
+      authServerEffective,
+      redirectUriEffective,
+      tenantId: tenantIdEffective,
+      tenantKey: config.tenantKey ?? null,
+      clientIdEffective
+    });
+    const token = getAccessToken();
+    if (token && !isAccessTokenExpired()) {
+      logger.debug("Valid token already exists, skipping auth flow");
+      clearFlowFlags();
+      return;
+    }
+    if (isCallbackUrl()) {
+      logger.debug("Callback URL detected - clearing flow flag to allow callback processing");
+      clearFlowFlags();
+      return;
+    }
+    if (isFlowInProgress()) {
+      if (isFlowFlagStale(3e3)) {
+        logger.info("Stale auth flow flag detected, clearing and proceeding");
+        clearFlowFlags();
+      } else {
+        logger.debug("Auth flow already in progress (recent), skipping duplicate redirect");
+        return;
+      }
+    }
+    setFlowFlags();
+    if (!(Config.getAuthServerUrl() || config?.authServer) || !config.client?.clientId || !config.client?.redirectUri) {
+      logger.error("[initiateAuthFlow] Missing required tenant config", {
+        authServerEffective,
+        clientId: config?.client?.clientId,
+        redirectUriFromTenantApi: config?.client?.redirectUri,
+        redirectUriEffective
+      });
+      throw new Error("Invalid tenant configuration for auth flow");
+    }
+    storeTenantConfig(config);
+    logger.debug("[initiateAuthFlow] Stored tenant config, generating PKCE");
+    removeStorage(getStorageKey("callback_processed"));
+    removeStorage(getStorageKey("state_mismatch"));
+    clearCallbackProcessing();
+    const codeVerifier = generateCodeVerifier();
+    const codeChallenge = await generateCodeChallenge(codeVerifier);
+    const state = generateState();
+    removeStorage(STORAGE_KEYS.codeVerifier);
+    removeStorage(STORAGE_KEYS.state);
+    setStorage(STORAGE_KEYS.codeVerifier, codeVerifier);
+    setStorage(STORAGE_KEYS.state, state);
+    const authUrl = buildAuthorizationUrl(config, codeChallenge, state);
+    logger.debug("[initiateAuthFlow] Built authorization URL", {
+      authServerEffective,
+      urlPrefix: authUrl?.slice(0, 80)
+    });
+    if (!authUrl || !(authUrl.startsWith("http://") || authUrl.startsWith("https://"))) {
+      throw new Error("Invalid authorization URL generated");
+    }
+    if (!checkAndIncrementRedirect()) {
+      logger.warn("Redirect loop protection: max redirect attempts exceeded");
+      clearFlowFlags();
+      return;
+    }
+    logger.info("Redirecting to authorization server");
+    emitAuthEvent(AuthEventNames.LOGIN_STARTED, { tenantKey: config.tenantKey });
+    const runtime = getAuthRuntime();
+    if (runtime) {
+      logger.debug("[initiateAuthFlow] Redirect via runtime.urlProvider.redirect");
+      runtime.urlProvider.redirect(authUrl);
+    } else if (typeof window !== "undefined") {
+      logger.debug("[initiateAuthFlow] Redirect via window.location.replace");
+      window.location.replace(authUrl);
+    } else {
+      logger.error("[initiateAuthFlow] No runtime and no window; cannot redirect", { authUrl });
+    }
+  } catch (error) {
+    clearFlowFlags();
+    logger.error("Failed to initiate auth flow", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+    throw error;
+  }
+}
+function buildAuthorizationUrl(config, codeChallenge, state) {
+  const authServerBase = (Config.getAuthServerUrl() || config.authServer || "").replace(/\/+$/, "");
+  if (isLocalhost2()) {
+    logger.debug("Building authorization URL", {
+      authServer: authServerBase,
+      clientId: config.client.clientId,
+      redirectUri: config.client.redirectUri,
+      scopes: config.client.scopes
+    });
+  }
+  const tenantIdToUse = config.tenantId;
+  const clientIdToUse = config.client.clientId;
+  const redirectUriToUse = Config.getRedirectUri();
+  const params = new URLSearchParams({
+    client_id: `public-${clientIdToUse}`,
+    tenant_id: tenantIdToUse,
+    redirect_uri: redirectUriToUse,
+    response_type: DEFAULT_RESPONSE_TYPE,
+    scope: config.client.scopes,
+    state,
+    code_challenge: codeChallenge,
+    code_challenge_method: DEFAULT_CODE_CHALLENGE_METHOD
+  });
+  return `${authServerBase}/connect/authorize?${params.toString()}`;
+}
+function isProcessed() {
+  return getStorage(getStorageKey("callback_processed")) === "true";
+}
+function isProcessing() {
+  return isCallbackProcessing();
+}
+function markProcessing() {
+  setCallbackProcessing();
+}
+function markProcessed() {
+  setStorage(getStorageKey("callback_processed"), "true");
+  clearCallbackProcessing();
+}
+function clearProcessing() {
+  clearCallbackProcessing();
+  removeStorage(getStorageKey("callback_processed"));
+}
+var urlCleaned = false;
+function cleanUrlSoft() {
+  if (urlCleaned) return;
+  if (isProcessing()) return;
+  const runtime = getAuthRuntime();
+  const clean = runtime ? `${runtime.urlProvider.getCurrentUrl().origin}${runtime.urlProvider.getCurrentUrl().pathname}` : typeof window !== "undefined" ? `${window.location.origin}${window.location.pathname}` : "/";
+  if (runtime) runtime.urlProvider.replaceState(clean);
+  else if (typeof window !== "undefined") window.history.replaceState({}, typeof document !== "undefined" ? document.title : "", clean);
+  urlCleaned = true;
+}
+function clearAllAuthFlags() {
+  clearFlowFlags();
+}
+async function tryRecoverOAuthConfigFromTenant() {
+  const runtime = getAuthRuntime();
+  const tenantKey = (resolveTenantKey() ?? getTenantKey() ?? "").trim();
+  if (!runtime?.tenantResolver || !tenantKey) {
+    logger.debug("[Callback] OAuth config recovery skipped \u2014 no tenantResolver or tenantKey", {
+      hasResolver: !!runtime?.tenantResolver,
+      tenantKey: tenantKey || "(empty)"
+    });
+    return null;
+  }
+  try {
+    const tc = await runtime.tenantResolver.resolve(tenantKey);
+    if (!tc?.client?.clientId || !tc.tenantId) {
+      logger.warn("[Callback] OAuth config recovery: tenant resolve missing client or tenantId", {
+        tenantKey
+      });
+      return null;
+    }
+    storeTenantConfig(tc);
+    return {
+      clientId: tc.client.clientId.trim() || null,
+      redirectUri: tc.client.redirectUri?.trim() || getRedirectUri(),
+      tenantId: tc.tenantId.trim() || null
+    };
+  } catch (e) {
+    logger.warn("[Callback] OAuth config recovery: tenant re-resolve failed", {
+      tenantKey,
+      error: e instanceof Error ? e.message : String(e)
+    });
+    return null;
+  }
+}
+async function handleCallback() {
+  const runtimeSearch = getAuthRuntime()?.urlProvider.getCurrentUrl().search;
+  const windowSearch = typeof window !== "undefined" ? window.location.search : "";
+  logger.debug("[Callback] handleCallback invoked", {
+    isProcessed: isProcessed(),
+    isProcessing: isProcessing(),
+    isCallbackUrl: isCallbackUrl(),
+    runtimeSearch: runtimeSearch ?? "(none)",
+    windowSearch: windowSearch || "(none)"
+  });
+  if (isProcessed()) {
+    logger.warn("[Callback] Early exit: callback already processed");
+    if (isCallbackUrl()) {
+      if (!isProcessing()) cleanUrlSoft();
+    }
+    clearFlowFlags();
+    return true;
+  }
+  if (isProcessing()) {
+    logger.warn("[Callback] Early exit: callback processing already in progress");
+    return true;
+  }
+  const storedTenantKey = getTenantKey();
+  const currentTenantKey = resolveTenantKey() ?? storedTenantKey;
+  if (currentTenantKey && storedTenantKey && currentTenantKey !== storedTenantKey) {
+    logger.warn("[Callback] Early exit: tenant key changed before exchange", {
+      currentTenantKey,
+      storedTenantKey
+    });
+    clearAllStorage();
+    clearAllAuthFlags();
+    clearProcessing();
+    setStorage(getStorageKey("tenant_switched"), "true");
+    setStorage(getStorageKey("new_tenant_key"), currentTenantKey);
+    setTenantKey(currentTenantKey);
+    if (isCallbackUrl()) cleanUrlSoft();
+    return false;
+  }
+  if (!isCallbackUrl()) {
+    logger.warn("[Callback] Early exit: URL is not callback URL");
+    return false;
+  }
+  markProcessing();
+  clearFlowFlags();
+  urlCleaned = false;
+  try {
+    const search = getAuthRuntime()?.urlProvider.getCurrentUrl().search ?? (typeof window !== "undefined" ? window.location.search : "");
+    const params = new URLSearchParams(search);
+    const code = params.get("code");
+    const state = params.get("state");
+    const error = params.get("error");
+    if (error || !code || !state) {
+      logger.error("[Callback] Early exit: invalid OAuth callback params", { error, code, state });
+      clearAllAuthFlags();
+      clearProcessing();
+      cleanUrlSoft();
+      return false;
+    }
+    const storedState = getState();
+    if (!storedState || storedState !== state) {
+      const currentTenantKeyFromUrl = extractTenantKey();
+      const resolvedTenantKey = resolveTenantKey();
+      const tenantKeyChanged = currentTenantKeyFromUrl && resolvedTenantKey && currentTenantKeyFromUrl !== resolvedTenantKey;
+      if (tenantKeyChanged) {
+        logger.warn("[Callback] Early exit: state mismatch due to tenant key change");
+      } else {
+        logger.error("[Callback] Early exit: OAuth state mismatch - redirecting to login");
+      }
+      clearAllAuthFlags();
+      clearProcessing();
+      cleanUrlSoft();
+      setStorage(getStorageKey("state_mismatch"), "true");
+      return false;
+    }
+    const codeVerifier = getCodeVerifier();
+    if (!codeVerifier) {
+      logger.error("[Callback] Early exit: missing PKCE verifier");
+      clearAllAuthFlags();
+      clearProcessing();
+      cleanUrlSoft();
+      return false;
+    }
+    let clientId = getClientId();
+    let redirectUri = getRedirectUri();
+    let tenantId = getTenantId();
+    if (!clientId || !redirectUri || !tenantId) {
+      logger.warn("[Callback] OAuth config incomplete \u2014 attempting tenant re-resolve", {
+        hasClientId: !!clientId,
+        hasRedirectUri: !!redirectUri,
+        hasTenantId: !!tenantId
+      });
+      const recovered = await tryRecoverOAuthConfigFromTenant();
+      if (recovered) {
+        if (!redirectUri) redirectUri = recovered.redirectUri;
+        if (!tenantId) tenantId = recovered.tenantId;
+        clientId = getClientId() ?? normalizeClientIdForOAuthTokenBody(recovered.clientId) ?? null;
+      }
+    }
+    if (!clientId || !redirectUri || !tenantId) {
+      logger.error("[Callback] Early exit: missing OAuth config during callback", {
+        hasClientId: !!clientId,
+        hasRedirectUri: !!redirectUri,
+        hasTenantId: !!tenantId
+      });
+      clearAllAuthFlags();
+      clearProcessing();
+      cleanUrlSoft();
+      return false;
+    }
+    const existingToken = getAccessToken();
+    if (existingToken && !isAccessTokenExpired()) {
+      logger.warn("[Callback] Early exit: valid token already exists - skipping code exchange");
+      removeStorage(STORAGE_KEYS.codeVerifier);
+      removeStorage(STORAGE_KEYS.state);
+      clearAllAuthFlags();
+      markProcessed();
+      cleanUrlSoft();
+      resetRedirectLoopGuard();
+      emitAuthEvent(AuthEventNames.CALLBACK_SUCCESS);
+      return true;
+    }
+    logger.info("[Callback] Entering token exchange");
+    const tokenData = await exchangeCodeForTokens({
+      code,
+      codeVerifier,
+      clientId,
+      redirectUri,
+      tenantId
+    });
+    if (!tokenData?.access_token) {
+      logger.error("Token exchange returned no access token");
+      clearProcessing();
+      clearAllAuthFlags();
+      cleanUrlSoft();
+      emitAuthEvent(AuthEventNames.CALLBACK_FAILED, { message: "No access token returned" });
+      return false;
+    }
+    removeStorage(STORAGE_KEYS.codeVerifier);
+    removeStorage(STORAGE_KEYS.state);
+    clearAllAuthFlags();
+    markProcessed();
+    cleanUrlSoft();
+    logger.info("OAuth callback processed successfully");
+    resetRedirectLoopGuard();
+    emitAuthEvent(AuthEventNames.CALLBACK_SUCCESS);
+    return true;
+  } catch (err) {
+    if (axios.isAxiosError(err)) {
+      const status = err.response?.status;
+      const responseData = err.response?.data;
+      const errorCode = responseData?.error;
+      const errorDescription = responseData?.error_description || responseData?.details || "";
+      if (status === 400 && errorCode === "invalid_grant" && (String(errorDescription).includes("already used") || String(errorDescription).includes("Code not found") || String(errorDescription).includes("expired, already used"))) {
+        const existingToken2 = getAccessToken();
+        const tokenValid2 = existingToken2 && !isAccessTokenExpired();
+        if (tokenValid2) {
+          removeStorage(STORAGE_KEYS.codeVerifier);
+          removeStorage(STORAGE_KEYS.state);
+          clearAllAuthFlags();
+          markProcessed();
+          cleanUrlSoft();
+          logger.info("OAuth callback processed successfully (code already used, but token exists)");
+          resetRedirectLoopGuard();
+          emitAuthEvent(AuthEventNames.CALLBACK_SUCCESS);
+          return true;
+        }
+      }
+      emitAuthEvent(AuthEventNames.CALLBACK_FAILED, {
+        error: err.message,
+        message: responseData?.error_description ?? err.message
+      });
+      logger.error("OAuth callback failed (Axios error)", {
+        status,
+        statusText: err.response?.statusText,
+        responseData: err.response?.data,
+        message: err.message,
+        url: err.config?.url
+      });
+    } else {
+      logger.error("OAuth callback failed", {
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+    clearAllAuthFlags();
+    const existingToken = getAccessToken();
+    const tokenValid = existingToken && !isAccessTokenExpired();
+    if (tokenValid) {
+      markProcessed();
+      cleanUrlSoft();
+      resetRedirectLoopGuard();
+      emitAuthEvent(AuthEventNames.CALLBACK_SUCCESS);
+      return true;
+    }
+    emitAuthEvent(AuthEventNames.CALLBACK_FAILED, {
+      error: err instanceof Error ? err.message : String(err)
+    });
+    clearProcessing();
+    if (isCallbackUrl()) cleanUrlSoft();
+    return false;
+  }
+}
+
+// src/application/flows/CallbackFlow.ts
+var CallbackFlow = class {
+  async execute(context) {
+    const { runtime } = context;
+    const { urlProvider, logger: log } = runtime;
+    const getUrl = () => urlProvider.getCurrentUrl();
+    clearFlowFlags();
+    const handled = await handleCallback();
+    if (handled) {
+      if (isCallbackUrlFromUrl(getUrl())) {
+        if (isCallbackProcessing()) return { completed: true };
+        const u = getUrl();
+        urlProvider.redirect(`${u.origin}${u.pathname}`);
+        return { completed: true };
+      }
+      return { completed: true };
+    }
+    if (isCallbackUrlFromUrl(getUrl())) {
+      const u = getUrl();
+      urlProvider.redirect(`${u.origin}${u.pathname}`);
+    }
+    return { completed: true };
+  }
+};
+
+// src/application/flows/AuthenticatedFlow.ts
+var AuthenticatedFlow = class {
+  async execute(_context) {
+    return { completed: true };
+  }
+};
+
+// src/application/engine/defaultEngine.ts
+var defaultEngine = null;
+function getDefaultAuthEngine() {
+  return defaultEngine;
+}
+function setDefaultAuthEngine(engine) {
+  defaultEngine = engine;
+}
+
+// src/application/token.ts
+var lastNoRefreshLog = 0;
+var NO_REFRESH_LOG_INTERVAL_MS = 5e3;
+async function ensureValidAccessToken() {
+  const engine = getDefaultAuthEngine();
+  if (engine) {
+    try {
+      return await engine.getAccessToken();
+    } catch {
+    }
+  }
+  const token = getAccessToken();
+  if (token && !isAccessTokenExpired()) return token;
+  const refreshToken = getRefreshToken();
+  if (!refreshToken) {
+    const now = Date.now();
+    if (now - lastNoRefreshLog >= NO_REFRESH_LOG_INTERVAL_MS) {
+      lastNoRefreshLog = now;
+      logger.debug("No refresh token - cannot refresh; login required");
+    }
+    throw new Error("No refresh token; login required");
+  }
+  return await refreshAccessToken();
+}
+function getAccessToken2() {
+  return getAccessToken();
+}
+
+// src/application/flows/RefreshFlow.ts
+var RefreshFlow = class {
+  async execute(context) {
+    const { runtime } = context;
+    const { logger: log } = runtime;
+    const getUrl = () => runtime.urlProvider.getCurrentUrl();
+    log.debug("Token expired, attempting to refresh...");
+    try {
+      const refreshedToken = await ensureValidAccessToken();
+      if (refreshedToken) {
+        logger.debug("Token refreshed successfully, bootstrap complete");
+        return { completed: true };
+      }
+    } catch (error) {
+      logger.warn("Token refresh failed, will trigger new auth flow", {
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+    const tenantKey = resolveTenantKey();
+    log.debug("[RefreshFlow] Tenant key resolved", {
+      tenantKey: tenantKey ?? "(null)",
+      source: tenantKey ? "resolved" : "none"
+    });
+    if (!tenantKey) {
+      throw new SanitizedError(
+        "TENANT_KEY_RESOLUTION_FAILED",
+        "Unable to resolve tenant",
+        new Error(`Tenant key missing for refresh flow at url=${getUrl().href}`)
+      );
+    }
+    const tenantConfig = await resolveTenantConfigCached(tenantKey, runtime.tenantResolver);
+    if (!tenantConfig) {
+      throw new SanitizedError(
+        "TENANT_CONFIG_RESOLUTION_FAILED",
+        "Unable to resolve tenant configuration",
+        new Error(`Tenant config resolution failed for tenantKey: ${tenantKey}`)
+      );
+    }
+    setTenantKey(tenantKey);
+    storeTenantConfig(tenantConfig);
+    await initiateAuthFlow(tenantConfig);
+    return { completed: true };
+  }
+};
+
+// src/application/flows/TenantSwitchFlow.ts
+var TenantSwitchFlow = class {
+  async execute(context) {
+    const { runtime } = context;
+    const { urlProvider, logger: log } = runtime;
+    const getUrl = () => urlProvider.getCurrentUrl();
+    const newTenantKey = getStorage(getStorageKey("new_tenant_key"));
+    log.info("Tenant switch detected - starting fresh login", { newTenantKey });
+    emitAuthEvent(AuthEventNames.TENANT_SWITCHED, { tenantKey: newTenantKey ?? void 0 });
+    removeStorage(getStorageKey("tenant_switched"));
+    removeStorage(getStorageKey("new_tenant_key"));
+    const tenantKey = (newTenantKey || resolveTenantKey())?.trim() || null;
+    log.debug("[TenantSwitchFlow] Tenant key resolved", {
+      tenantKey: tenantKey ?? "(null)",
+      fromNewTenantKey: newTenantKey ?? "(null)",
+      source: newTenantKey ? "new_tenant_key" : tenantKey ? "resolved" : "none"
+    });
+    if (!tenantKey) {
+      throw new SanitizedError(
+        "TENANT_KEY_RESOLUTION_FAILED",
+        "Unable to resolve tenant after switch",
+        new Error(`Tenant key missing after switch at url=${getUrl().href}`)
+      );
+    }
+    const tenantConfig = await resolveTenantConfigCached(tenantKey, runtime.tenantResolver);
+    if (!tenantConfig) {
+      throw new SanitizedError(
+        "TENANT_CONFIG_RESOLUTION_FAILED",
+        "Unable to resolve tenant configuration after switch",
+        new Error(`Tenant config resolution failed for tenantKey: ${tenantKey}`)
+      );
+    }
+    try {
+      const cfg = getAuthConfig2();
+      writeHostConfigCache({
+        apiBaseUrl: cfg.apiBaseUrl,
+        authServerUrl: cfg.authServerUrl,
+        callbackUrl: cfg.callbackUrl,
+        appId: cfg.appId,
+        clientCode: tenantConfig.client?.clientCode ?? cfg.clientCode ?? "",
+        clientId: cfg.clientId || tenantConfig.client?.clientId,
+        tenantId: tenantConfig.tenantId ?? cfg.tenantId,
+        tenantKey,
+        tenantCode: tenantKey
+      });
+    } catch {
+    }
+    setTenantKey(tenantKey);
+    storeTenantConfig(tenantConfig);
+    await initiateAuthFlow(tenantConfig);
+    return { completed: true };
+  }
+};
+
+// src/application/flows/LoginFlow.ts
+var LoginFlow = class {
+  async execute(context) {
+    const { runtime } = context;
+    const { logger: log } = runtime;
+    const getUrl = () => runtime.urlProvider.getCurrentUrl();
+    const url = getUrl();
+    log.debug("[LoginFlow] Start", { url: url.href, pathname: url.pathname, search: url.search });
+    const callbackProcessed = getStorage(getStorageKey("callback_processed")) === "true";
+    const token = getAccessToken();
+    if (callbackProcessed && !token) {
+      log.warn("Callback processed but token still not available - clearing flag and allowing fresh login");
+      removeStorage(getStorageKey("callback_processed"));
+      clearCallbackProcessing();
+    }
+    const wasStateMismatch = getStorage(getStorageKey("state_mismatch")) === "true";
+    if (wasStateMismatch) removeStorage(getStorageKey("state_mismatch"));
+    const tenantKey = resolveTenantKey();
+    log.debug("[LoginFlow] Tenant key resolved", {
+      tenantKey: tenantKey ?? "(null)",
+      source: tenantKey ? "resolved" : "none"
+    });
+    if (!tenantKey) {
+      throw new SanitizedError(
+        "TENANT_KEY_RESOLUTION_FAILED",
+        "Unable to resolve tenant",
+        new Error(`Tenant key missing for login flow at url=${url.href}`)
+      );
+    }
+    log.debug("[LoginFlow] Resolving tenant config", { tenantKey });
+    const tenantConfig = await resolveTenantConfigCached(tenantKey, runtime.tenantResolver);
+    log.debug("[LoginFlow] Tenant config resolved", {
+      ok: !!tenantConfig,
+      tenantId: tenantConfig?.tenantId,
+      authServer: tenantConfig?.authServer ? "(set)" : "(empty)",
+      clientId: tenantConfig?.client?.clientId,
+      redirectUri: tenantConfig?.client?.redirectUri
+    });
+    if (!tenantConfig) {
+      throw new SanitizedError(
+        "TENANT_CONFIG_RESOLUTION_FAILED",
+        "Unable to resolve tenant configuration",
+        new Error(`Tenant config resolution failed for tenantKey: ${tenantKey}`)
+      );
+    }
+    setTenantKey(tenantKey);
+    storeTenantConfig(tenantConfig);
+    log.debug("[LoginFlow] Stored tenant config, initiating auth flow");
+    await initiateAuthFlow(tenantConfig);
+    log.debug("[LoginFlow] Auth flow initiated (redirect should happen)");
+    return { completed: true };
+  }
+};
+
+// src/application/flows/getFlowForState.ts
+var callbackFlow = new CallbackFlow();
+var authenticatedFlow = new AuthenticatedFlow();
+var refreshFlow = new RefreshFlow();
+var tenantSwitchFlow = new TenantSwitchFlow();
+var loginFlow = new LoginFlow();
+function getFlowForState(state) {
+  switch (state) {
+    case "PROCESSING_CALLBACK" /* PROCESSING_CALLBACK */:
+      return callbackFlow;
+    case "AUTHENTICATED" /* AUTHENTICATED */:
+      return authenticatedFlow;
+    case "TOKEN_EXPIRED" /* TOKEN_EXPIRED */:
+      return refreshFlow;
+    case "TENANT_SWITCH" /* TENANT_SWITCH */:
+      return tenantSwitchFlow;
+    case "LOGIN_REQUIRED" /* LOGIN_REQUIRED */:
+    case "INITIALIZING" /* INITIALIZING */:
+    case "LOGGED_OUT" /* LOGGED_OUT */:
+    case "ERROR" /* ERROR */:
+    default:
+      return loginFlow;
+  }
+}
+
+// src/application/run-bootstrap.ts
+function createStorageReader() {
+  return (suffix) => getStorage(getStorageKey(suffix));
+}
+async function runBootstrap() {
+  const runtime = getAuthRuntime();
+  if (!runtime) {
+    logger.warn(
+      "Auth runtime not set; skipping bootstrap. Set runtime via AuthProvider or setAuthRuntime()."
+    );
+    return;
+  }
+  if (isBootstrapInProgress()) {
+    logger.debug("Bootstrap already in progress - skipping duplicate run");
+    return;
+  }
+  setBootstrapInProgress();
+  try {
+    enforceHttps(true);
+    const url = runtime.urlProvider.getCurrentUrl();
+    const token = getAccessToken();
+    const expired = isAccessTokenExpired();
+    const hasValidToken = !!(token && !expired);
+    const hasToken = !!token;
+    const hasRefreshToken = !!getRefreshToken();
+    const state = resolveAuthLifecycleState({
+      url,
+      getStorage: createStorageReader(),
+      isCallbackUrl: isCallbackUrlFromUrl,
+      hasValidToken,
+      hasToken,
+      hasRefreshToken,
+      isTokenExpired: expired
+    });
+    emitAuthEvent(AuthEventNames.BOOTSTRAP_STATE_DETECTED, { state });
+    const flow = getFlowForState(state);
+    const context = { runtime, url, state };
+    await flow.execute(context);
+  } catch (error) {
+    if (error instanceof SanitizedError) throw error;
+    const r = getAuthRuntime();
+    (r?.logger ?? logger).error("Bootstrap failed", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+    throw new Error(
+      sanitizeErrorMessage(error, "Authentication initialization failed")
+    );
+  } finally {
+    clearBootstrapInProgress();
+  }
+}
+
+// src/infrastructure/watchers/callbacks.ts
+var sessionClearedCallback = null;
+function setSessionClearedCallback(cb) {
+  sessionClearedCallback = cb;
+}
+function getSessionClearedCallback() {
+  return sessionClearedCallback;
+}
+
+// src/application/bootstrap.ts
+async function bootstrapImpl() {
+  const engine = getDefaultAuthEngine();
+  if (engine) {
+    await engine.init();
+    return;
+  }
+  await runBootstrap();
+}
+setSessionClearedCallback(() => bootstrapImpl());
+async function bootstrap() {
+  return bootstrapImpl();
+}
+
+// src/infrastructure/watchers/watcher-guard.ts
+var suspended = false;
+var generation = 0;
+function suspendWatchers() {
+  suspended = true;
+  generation += 1;
+  return generation;
+}
+function resumeWatchers(expectedGen) {
+  if (expectedGen !== void 0 && expectedGen !== generation) return;
+  suspended = false;
+}
+function areWatchersSuspended() {
+  return suspended;
+}
+
+// src/strategies/cookie/cookie-auth.ts
+var COOKIE_NAMES = {
+  accessToken: "tenneo_auth_access_token",
+  refreshToken: "tenneo_auth_refresh_token"
+};
+
+// src/infrastructure/watchers/cookie-watcher.ts
+var isWatching = false;
+var lastCookieSnapshot = "";
+var lastCookieMap = /* @__PURE__ */ new Map();
+var watchInterval = null;
+function getCookieSnapshot() {
+  try {
+    return document.cookie || "";
+  } catch {
+    return "";
+  }
+}
+function getCookieNames() {
+  try {
+    const cookies = document.cookie.split(";");
+    return cookies.map((cookie) => {
+      const eqPos = cookie.indexOf("=");
+      return eqPos > -1 ? cookie.substring(0, eqPos).trim() : cookie.trim();
+    }).filter((name) => name.length > 0);
+  } catch {
+    return [];
+  }
+}
+function getCookieMap() {
+  const cookieMap = /* @__PURE__ */ new Map();
+  try {
+    const cookies = document.cookie.split(";");
+    for (const cookie of cookies) {
+      const eqPos = cookie.indexOf("=");
+      if (eqPos > -1) {
+        const name = cookie.substring(0, eqPos).trim();
+        const value = cookie.substring(eqPos + 1).trim();
+        if (name.length > 0) cookieMap.set(name, value);
+      }
+    }
+  } catch {
+  }
+  return cookieMap;
+}
+function checkCookiesDeleted() {
+  try {
+    const currentSnapshot = getCookieSnapshot();
+    const currentCookieMap = getCookieMap();
+    const currentCookies = getCookieNames();
+    if (lastCookieSnapshot && !currentSnapshot) {
+      logger.info("All cookies deleted detected");
+      return true;
+    }
+    if (lastCookieMap.size > 0) {
+      const authCookieNames = [
+        COOKIE_NAMES.accessToken,
+        COOKIE_NAMES.refreshToken,
+        "tenneo_auth",
+        "tenneo_auth_access_token",
+        "tenneo_auth_refresh_token",
+        "auth",
+        "session",
+        "token"
+      ];
+      const deletedAuthCookies = [];
+      for (const [cookieName] of lastCookieMap) {
+        const isAuthCookie = authCookieNames.some(
+          (authName) => cookieName.toLowerCase().includes(authName.toLowerCase())
+        );
+        if (isAuthCookie && !currentCookieMap.has(cookieName)) {
+          deletedAuthCookies.push(cookieName);
+        }
+      }
+      if (deletedAuthCookies.length > 0) {
+        logger.info("Auth cookies deleted detected", {
+          deletedCookies: deletedAuthCookies,
+          previousCookieCount: lastCookieMap.size,
+          currentCookieCount: currentCookieMap.size
+        });
+        return true;
+      }
+      const hadTenneoAuthAccess = lastCookieMap.has(COOKIE_NAMES.accessToken) || lastCookieMap.has("tenneo_auth_access_token");
+      const hasTenneoAuthAccess = currentCookieMap.has(COOKIE_NAMES.accessToken) || currentCookieMap.has("tenneo_auth_access_token");
+      if (hadTenneoAuthAccess && !hasTenneoAuthAccess) {
+        logger.info("tenneo auth access token cookie deleted detected");
+        return true;
+      }
+      const hadTenneoAuthRefresh = lastCookieMap.has(COOKIE_NAMES.refreshToken) || lastCookieMap.has("tenneo_auth_refresh_token");
+      const hasTenneoAuthRefresh = currentCookieMap.has(COOKIE_NAMES.refreshToken) || currentCookieMap.has("tenneo_auth_refresh_token");
+      if (hadTenneoAuthRefresh && !hasTenneoAuthRefresh) {
+        logger.info("tenneo auth refresh token cookie deleted detected");
+        return true;
+      }
+      if (lastCookieMap.size > currentCookieMap.size && lastCookieMap.size - currentCookieMap.size >= 1) {
+        const deletedCookies = [];
+        for (const [cookieName] of lastCookieMap) {
+          if (!currentCookieMap.has(cookieName)) deletedCookies.push(cookieName);
+        }
+        const deletedAuthCookiesCount = deletedCookies.filter(
+          (name) => authCookieNames.some(
+            (authName) => name.toLowerCase().includes(authName.toLowerCase())
+          )
+        ).length;
+        if (deletedAuthCookiesCount > 0) {
+          logger.info("Auth cookies deleted detected (count-based)", {
+            deletedCookies,
+            deletedAuthCount: deletedAuthCookiesCount,
+            previousCount: lastCookieMap.size,
+            currentCount: currentCookieMap.size
+          });
+          return true;
+        }
+      }
+    }
+    lastCookieSnapshot = currentSnapshot;
+    lastCookieMap = new Map(currentCookieMap);
+    return false;
+  } catch (error) {
+    logger.warn("Error checking cookies", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+    return false;
+  }
+}
+function handleCookieDeletion() {
+  if (areWatchersSuspended()) {
+    logger.debug("Cookie deletion handler skipped \u2014 watchers suspended (logout/teardown)");
+    return;
+  }
+  try {
+    logger.info("Cookies deleted detected - clearing session and redirecting to login");
+    clearAuthStorage();
+    clearAuthSessionStorage();
+    const cb = getSessionClearedCallback();
+    if (cb) {
+      Promise.resolve(cb()).catch((error) => {
+        logger.error("Failed to redirect to login after cookie deletion", {
+          error: error instanceof Error ? error.message : String(error)
+        });
+      });
+    }
+  } catch (error) {
+    logger.error("Error handling cookie deletion", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
+}
+function startCookieWatcher() {
+  if (isWatching) {
+    logger.debug("Cookie watcher already running");
+    return;
+  }
+  isWatching = true;
+  lastCookieSnapshot = getCookieSnapshot();
+  lastCookieMap = getCookieMap();
+  const initialCookies = getCookieNames();
+  const authCookies = initialCookies.filter(
+    (name) => name.toLowerCase().includes("tenneo_auth") || name.toLowerCase().includes("auth") || name.toLowerCase().includes("token")
+  );
+  logger.debug("Cookie watcher started", {
+    initialCookieCount: initialCookies.length,
+    authCookieCount: authCookies.length,
+    authCookies,
+    allCookies: initialCookies
+  });
+  watchInterval = setInterval(async () => {
+    if (areWatchersSuspended()) return;
+    const cookiesDeleted = checkCookiesDeleted();
+    if (cookiesDeleted) {
+      logger.info("Cookies deleted detected by cookie watcher");
+      if (watchInterval) {
+        clearInterval(watchInterval);
+        watchInterval = null;
+      }
+      isWatching = false;
+      try {
+        await handleCookieDeletion();
+      } catch (error) {
+        logger.error("Error handling cookie deletion, will restart watcher", {
+          error: error instanceof Error ? error.message : String(error)
+        });
+      } finally {
+        queueMicrotask(() => {
+          if (!isWatching) startCookieWatcher();
+        });
+      }
+    }
+  }, 1e3);
+  logger.info("Cookie watcher started - monitoring for cookie deletion");
+}
+function stopCookieWatcher() {
+  isWatching = false;
+  if (watchInterval) {
+    clearInterval(watchInterval);
+    watchInterval = null;
+  }
+  lastCookieSnapshot = "";
+  logger.debug("Cookie watcher stopped");
+}
+function resetCookieWatcher() {
+  lastCookieSnapshot = getCookieSnapshot();
+  lastCookieMap = getCookieMap();
+  const currentCookies = getCookieNames();
+  const authCookies = currentCookies.filter(
+    (name) => name.toLowerCase().includes("tenneo_auth") || name.toLowerCase().includes("auth") || name.toLowerCase().includes("token")
+  );
+  logger.debug("Cookie watcher reset", {
+    currentCookieCount: currentCookies.length,
+    authCookieCount: authCookies.length,
+    authCookies
+  });
+}
+
+// src/infrastructure/watchers/storage-watcher.ts
+var isWatching2 = false;
+var lastStorageCheck = null;
+var storageEventListener = null;
+function checkStorageCleared() {
+  try {
+    const hasAnyAuthData = Object.values(STORAGE_KEYS).some(
+      (key) => getStorage(key) !== null
+    );
+    if (lastStorageCheck === "had_data" && !hasAnyAuthData) return true;
+    lastStorageCheck = hasAnyAuthData ? "had_data" : "no_data";
+    return false;
+  } catch {
+    return false;
+  }
+}
+function handleStorageEvent(event) {
+  if (areWatchersSuspended()) return;
+  if (typeof window !== "undefined" && event.storageArea === window.sessionStorage) {
+    const wasCleared = checkStorageCleared();
+    if (wasCleared) {
+      if (areWatchersSuspended()) return;
+      logger.info("Detected manual sessionStorage clear! Redirecting to login...");
+      const cb = getSessionClearedCallback();
+      if (cb) {
+        Promise.resolve(cb()).catch((error) => {
+          logger.error("Failed to redirect to login after manual clear", {
+            error: error instanceof Error ? error.message : String(error)
+          });
+        });
+      }
+    }
+  }
+}
+function startStorageWatcher() {
+  if (isWatching2) return;
+  isWatching2 = true;
+  checkStorageCleared();
+  storageEventListener = handleStorageEvent;
+  window.addEventListener("storage", storageEventListener);
+  const pollInterval = setInterval(() => {
+    if (areWatchersSuspended()) return;
+    const wasCleared = checkStorageCleared();
+    if (wasCleared) {
+      if (areWatchersSuspended()) return;
+      logger.info("Detected manual sessionStorage clear (polling)! Redirecting to login...");
+      clearInterval(pollInterval);
+      const cb = getSessionClearedCallback();
+      if (cb) {
+        Promise.resolve(cb()).catch((error) => {
+          logger.error("Failed to redirect to login after manual clear", {
+            error: error instanceof Error ? error.message : String(error)
+          });
+          if (!isWatching2) startStorageWatcher();
+        });
+      }
+    }
+  }, 1e3);
+  window.__tenneo_auth_storage_watcher_interval = pollInterval;
+}
+function stopStorageWatcher() {
+  isWatching2 = false;
+  if (storageEventListener) {
+    window.removeEventListener("storage", storageEventListener);
+    storageEventListener = null;
+  }
+  const win = window;
+  const intervalId = win.__tenneo_auth_storage_watcher_interval;
+  if (intervalId) {
+    clearInterval(intervalId);
+    delete win.__tenneo_auth_storage_watcher_interval;
+  }
+}
+
+// src/utils/cookies.ts
+function clearClientCookies() {
+  try {
+    if (typeof document === "undefined" || typeof window === "undefined") return;
+    const cookies = document.cookie.split(";");
+    const hostname = window.location.hostname;
+    const hostParts = hostname.split(".").filter(Boolean);
+    const domainsToTry = [hostname];
+    if (hostParts.length > 1) {
+      for (let i = hostParts.length - 2; i >= 0; i--) {
+        const parent = "." + hostParts.slice(i).join(".");
+        if (!domainsToTry.includes(parent)) domainsToTry.push(parent);
+      }
+    }
+    const pathsToTry = ["/", window.location.pathname || "/"].filter(Boolean);
+    for (const cookie of cookies) {
+      const eqPos = cookie.indexOf("=");
+      const name = eqPos > -1 ? cookie.slice(0, eqPos).trim() : cookie.trim();
+      if (!name) continue;
+      for (const path of pathsToTry) {
+        document.cookie = `${name}=;expires=Thu, 01 Jan 1970 00:00:00 GMT;path=${path}`;
+        for (const domain of domainsToTry) {
+          document.cookie = `${name}=;expires=Thu, 01 Jan 1970 00:00:00 GMT;path=${path};domain=${domain}`;
+        }
+      }
+    }
+    logger.debug("Client-side cookies cleared (best-effort)");
+  } catch (error) {
+    logger.warn("Failed to clear client cookies", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
+}
+
+// src/application/logout.ts
+function buildUrl(baseUrl, path) {
+  const url = new URL(baseUrl);
+  const normalizedPath = path.startsWith("/") ? path : `/${path}`;
+  url.pathname = url.pathname.endsWith("/") ? `${url.pathname}${normalizedPath.slice(1)}` : `${url.pathname}${normalizedPath}`;
+  return url.toString();
+}
+function getCsrfToken() {
+  try {
+    if (typeof document === "undefined") return null;
+    const meta = document.querySelector('meta[name="csrf-token"]');
+    if (meta?.content) return meta.content;
+    const match = document.cookie.match(/(?:^|;\s*)XSRF-TOKEN=([^;]+)/i);
+    if (match) return decodeURIComponent(match[1]);
+    return null;
+  } catch {
+    return null;
+  }
+}
+async function callServerLogout(logoutUrl) {
+  const csrfToken = getCsrfToken();
+  const headers = {
+    "X-Requested-With": "XMLHttpRequest",
+    Accept: "application/json, */*",
+    "Content-Type": "application/x-www-form-urlencoded"
+  };
+  if (csrfToken) {
+    headers["X-CSRF-Token"] = csrfToken;
+  }
+  try {
+    const response = await fetch(logoutUrl, {
+      method: "POST",
+      mode: "cors",
+      headers,
+      credentials: "include",
+      body: ""
+    });
+    if (!response.ok) {
+      logger.warn("[logout] Server logout HTTP error", {
+        status: response.status,
+        statusText: response.statusText
+      });
+      return { success: false };
+    }
+    const contentType = response.headers.get("content-type") || "";
+    if (!contentType.includes("application/json")) {
+      logger.info("[logout] Server logout: OK without JSON body", {
+        status: response.status
+      });
+      return { success: true, response: { success: true } };
+    }
+    const text = await response.text();
+    let data = {};
+    if (text?.trim()) {
+      try {
+        data = JSON.parse(text);
+      } catch {
+        logger.warn("[logout] Server returned non-JSON body with JSON content-type");
+        return { success: false };
+      }
+    }
+    logger.info("[logout] Server logout response", { response: data });
+    if (data && (data.success === true || data.logout === true)) {
+      return { success: true, response: data };
+    }
+    if (!text || text.trim() === "") {
+      return { success: true, response: { success: true } };
+    }
+    logger.warn("[logout] Server logout: unexpected JSON payload", { response: data });
+    return { success: false, response: data };
+  } catch (error) {
+    logger.warn("[logout] Server logout request failed", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+    return { success: false };
+  }
+}
+function performLocalLogoutCleanup() {
+  logger.debug("[logout] Local cleanup: cookies + auth storage");
+  try {
+    getAuthRuntime()?.clearCookies?.clearCookies();
+  } catch (error) {
+    logger.debug("[logout] Runtime cookie clearer failed (ignored)", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
+  clearClientCookies();
+  try {
+    clearAuthStorage();
+  } catch (error) {
+    logger.warn("[logout] clearAuthStorage failed", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
+  logger.info("[logout] Local cleanup completed");
+}
+function acquireLogoutLock() {
+  const LOCK_KEY = getStorageKey("logout_lock");
+  const now = Date.now();
+  const existingLock = getStorage(LOCK_KEY);
+  if (existingLock) {
+    const lockTime = Number(existingLock);
+    if (!Number.isNaN(lockTime) && now - lockTime < 5e3) {
+      logger.debug("[logout] Lock active \u2014 duplicate tab logout skipped", {
+        now,
+        lockTime
+      });
+      return false;
+    }
+  }
+  setStorage(LOCK_KEY, String(now));
+  return true;
+}
+function releaseLogoutLock() {
+  try {
+    removeStorage(getStorageKey("logout_lock"));
+  } catch {
+  }
+}
+var logoutInFlight = null;
+async function runLogoutPipeline(tenantKey) {
+  const gen = suspendWatchers();
+  logger.info("[logout] Lifecycle: suspend watchers", { generation: gen });
+  stopStorageWatcher();
+  stopCookieWatcher();
+  if (!acquireLogoutLock()) {
+    resumeWatchers(gen);
+    logger.debug("[logout] Lifecycle: resume (skipped \u2014 lock)");
+    return { success: true, message: "Logout already in progress in another tab." };
+  }
+  let serverLogoutSuccess = false;
+  let serverResponse;
+  try {
+    if (tenantKey?.trim()) {
+      applyRuntimeTenantSwitch(tenantKey.trim(), { syncStorageCache: true });
+      logger.info("[logout] Runtime tenant applied for logout context", {
+        tenantKey: tenantKey.trim()
+      });
+    }
+    const authConfig = getAuthConfig2();
+    const apiAuthBaseUrl = authConfig.authServerUrl;
+    if (apiAuthBaseUrl) {
+      const logoutUrl = buildUrl(apiAuthBaseUrl, "account/logout");
+      logger.info("[logout] Calling auth server logout (POST)", { logoutUrl });
+      const logoutResult = await callServerLogout(logoutUrl);
+      serverLogoutSuccess = logoutResult.success;
+      serverResponse = logoutResult.response;
+      if (!serverLogoutSuccess) {
+        logger.warn("[logout] Server logout did not confirm success \u2014 clearing local session anyway", {
+          logoutUrl,
+          serverResponse
+        });
+      }
+    } else {
+      logger.warn("[logout] authServerUrl missing \u2014 local logout only");
+    }
+  } catch (error) {
+    logger.error("[logout] Unexpected error before local cleanup", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
+  try {
+    performLocalLogoutCleanup();
+  } catch (error) {
+    logger.error("[logout] Local cleanup threw", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
+  try {
+    syncHostConfigCacheFromMemory();
+    logger.debug("[logout] host_config cache refreshed from runtime (not restored from snapshot)");
+  } catch (error) {
+    logger.warn("[logout] Failed to sync host config cache", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
+  try {
+    resetCookieWatcher();
+    startStorageWatcher();
+    logger.info("[logout] Watchers restarted");
+  } catch (error) {
+    logger.warn("[logout] Watcher restart failed", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
+  releaseLogoutLock();
+  resumeWatchers(gen);
+  logger.info("[logout] Lifecycle: complete", { serverLogoutSuccess });
+  emitAuthEvent(AuthEventNames.LOGOUT_COMPLETED, {
+    serverLogoutSuccess,
+    tenantKey: tenantKey?.trim() || getAuthConfig2().tenantCode || void 0,
+    message: serverLogoutSuccess ? "Server logout success" : "Local logout (server may be pending)"
+  });
+  return {
+    success: true,
+    message: serverLogoutSuccess ? serverResponse?.message || "Logout successful. Fresh login required." : "Logged out locally. Fresh login required (server logout may have failed).",
+    serverResponse
+  };
+}
+async function logout(tenantKey) {
+  if (logoutInFlight) {
+    logger.debug("[logout] Coalescing with in-flight logout");
+    return logoutInFlight;
+  }
+  logoutInFlight = runLogoutPipeline(tenantKey).finally(() => {
+    logoutInFlight = null;
+  });
+  return logoutInFlight;
+}
+var AuthContext = createContext(void 0);
+function useAuthContext() {
+  const context = useContext(AuthContext);
+  if (!context) {
+    throw new Error("useAuthContext must be used within AuthProvider");
+  }
+  return context;
+}
+
+// src/infrastructure/tenant/tenant.api.ts
+var ongoingRequests = /* @__PURE__ */ new Map();
+var DEFAULT_SCOPES2 = OAUTH_CONSTANTS.SCOPES;
+function getResolvedTenantBaseUrl() {
+  let base = Config.getApiBaseUrl();
+  if (typeof window !== "undefined" && (!base || base.startsWith("/"))) {
+    base = window.location.origin + (base || "");
+  }
+  return base;
+}
+var PUBLIC_CODE_PREFIX = "public-";
+function getTenantByCodeUrl(tenantCode) {
+  const apiTenantResolutionBaseUrl = getResolvedTenantBaseUrl();
+  const base = (apiTenantResolutionBaseUrl || "").replace(/\/api(?:\/v1)?\/?$/, "") || apiTenantResolutionBaseUrl;
+  return `${base}/api/v1/tenant/public/tenants/by-code/${encodeURIComponent(tenantCode)}`;
+}
+async function resolveTenant(tenantKey) {
+  if (!tenantKey || tenantKey.trim() === "") {
+    logger.debug("tenantKey is empty or invalid, skipping API call");
+    return null;
+  }
+  const tenantCode = tenantKey.trim();
+  const requestKey = `resolveTenant:${tenantCode}`;
+  if (ongoingRequests.has(requestKey)) {
+    logger.debug("Tenant resolution reused (in-flight)", { tenantCode });
+    return ongoingRequests.get(requestKey);
+  }
+  logger.info("Tenant resolution API call", { tenantCode });
+  const requestPromise = (async () => {
+    try {
+      const url = getTenantByCodeUrl(tenantCode);
+      logger.debug("GET tenant by-code", { url });
+      let data;
+      try {
+        const response = await fetch(url, { method: "GET" });
+        if (!response.ok) throw new Error(`HTTP ${response.status}`);
+        data = await response.json();
+        logger.debug("API response received", { tenantCode });
+      } catch (error) {
+        logger.warn("API call failed", { tenantCode, error });
+        return null;
+      }
+      if (!data || typeof data !== "object") return null;
+      const res = data;
+      if (!res.success || !res.data) return null;
+      const tenant = res.data;
+      if (!tenant.id || !tenant.clientCode) return null;
+      const authServer = Config.getAuthServerUrl();
+      const redirectUri = Config.getRedirectUri();
+      if (!authServer || !redirectUri) {
+        return null;
+      }
+      const clientCodeWithPrefix = tenant.clientCode.startsWith(PUBLIC_CODE_PREFIX) ? tenant.clientCode : `${PUBLIC_CODE_PREFIX}${tenant.clientCode}`;
+      const config = {
+        tenantId: tenant.id,
+        authServer,
+        tenantKey: tenantCode,
+        client: {
+          clientId: tenant.clientCode,
+          clientCode: clientCodeWithPrefix,
+          redirectUri,
+          scopes: DEFAULT_SCOPES2
+        }
+      };
+      logger.debug("Resolved tenant config", { tenantCode });
+      return config;
+    } catch (error) {
+      logger.warn("Unexpected error resolving tenant", { tenantCode, error });
+      return null;
+    } finally {
+      ongoingRequests.delete(requestKey);
+    }
+  })();
+  ongoingRequests.set(requestKey, requestPromise);
+  return requestPromise;
+}
+
+// src/browser/adapters.ts
+function createConsoleLogger() {
+  return {
+    info(message, meta) {
+      if (typeof console !== "undefined") console.info(message, meta ?? "");
+    },
+    warn(message, meta) {
+      if (typeof console !== "undefined") console.warn(message, meta ?? "");
+    },
+    error(message, meta) {
+      if (typeof console !== "undefined") console.error(message, meta ?? "");
+    },
+    debug(message, meta) {
+      if (typeof console !== "undefined") console.debug(message, meta ?? "");
+    }
+  };
+}
+function createBrowserUrlProvider() {
+  return {
+    getCurrentUrl() {
+      if (typeof window === "undefined") {
+        return { href: "", origin: "", pathname: "/", search: "", hostname: "" };
+      }
+      const w = window;
+      const loc = w.location;
+      return {
+        href: loc.href,
+        origin: loc.origin,
+        pathname: loc.pathname,
+        search: loc.search,
+        hostname: loc.hostname
+      };
+    },
+    redirect(url) {
+      if (typeof window !== "undefined") window.location.replace(url);
+    },
+    replaceState(url) {
+      if (typeof window === "undefined") return;
+      try {
+        const title = typeof document !== "undefined" ? document.title : "";
+        window.history.replaceState({}, title, url);
+      } catch {
+      }
+    }
+  };
+}
+function createConfigProvider() {
+  return {
+    getApiBaseUrl: () => Config.getApiBaseUrl(),
+    getAuthServerUrl: () => Config.getAuthServerUrl(),
+    getRedirectUri: () => Config.getRedirectUri(),
+    getClientCode: () => Config.getClientCode()
+  };
+}
+function createTenantResolver() {
+  return { resolve: (tenantKey) => resolveTenant(tenantKey) };
+}
+function createBrowserCookieClearer() {
+  return {
+    clearCookies() {
+      if (typeof document === "undefined" || typeof window === "undefined") return;
+      try {
+        const cookies = document.cookie.split(";");
+        cookies.forEach((cookie) => {
+          const eqPos = cookie.indexOf("=");
+          const name = eqPos > -1 ? cookie.substring(0, eqPos).trim() : cookie.trim();
+          document.cookie = `${name}=;expires=Thu, 01 Jan 1970 00:00:00 GMT;path=/`;
+          const domain = window.location.hostname;
+          const parts = domain.split(".");
+          if (parts.length > 1) {
+            const parentDomain = "." + parts.slice(-2).join(".");
+            document.cookie = `${name}=;expires=Thu, 01 Jan 1970 00:00:00 GMT;path=/;domain=${parentDomain}`;
+          }
+        });
+      } catch {
+      }
+    }
+  };
+}
+
+// src/strategies/oauth2-pkce/OAuth2PkceStrategy.ts
+function createOAuth2PkceStrategy() {
+  return {
+    async initiate(tenantConfig) {
+      storeTenantConfig(tenantConfig);
+      await initiateAuthFlow(tenantConfig);
+    },
+    async handleCallback() {
+      return handleCallback();
+    },
+    async refresh() {
+      return refreshAccessToken();
+    },
+    async logout(options) {
+      await logout(options?.tenantKey);
+    }
+  };
+}
+
+// src/application/engine/eventBus.ts
+function createEventBus() {
+  const listeners2 = /* @__PURE__ */ new Set();
+  return {
+    subscribe(listener) {
+      listeners2.add(listener);
+      return () => listeners2.delete(listener);
+    },
+    emit(state) {
+      listeners2.forEach((fn) => {
+        try {
+          fn(state);
+        } catch {
+        }
+      });
+    }
+  };
+}
+
+// src/application/engine/createEngine.ts
+function stateEquals(a, b) {
+  return a.status === b.status && a.accessToken === b.accessToken && a.expiresAt === b.expiresAt && a.error === b.error;
+}
+function deriveState(config) {
+  setAuthRuntime(config);
+  const accessToken = getAccessToken();
+  const expiresAt = getExpiresAt();
+  const expired = isAccessTokenExpired();
+  if (accessToken && !expired) {
+    return {
+      status: "authenticated",
+      accessToken,
+      expiresAt,
+      error: null
+    };
+  }
+  if (accessToken && expired) {
+    return {
+      status: "error",
+      accessToken,
+      expiresAt,
+      error: "Token expired"
+    };
+  }
+  return {
+    status: "unauthenticated",
+    accessToken: null,
+    expiresAt: null,
+    error: null
+  };
+}
+function createAuthEngine(config) {
+  const frozenConfig = Object.freeze({ ...config });
+  const bus = createEventBus();
+  let lastEmittedState = null;
+  const strategy = frozenConfig.strategy ?? createOAuth2PkceStrategy();
+  const emitState = () => {
+    const next = deriveState(frozenConfig);
+    if (lastEmittedState !== null && stateEquals(lastEmittedState, next)) return;
+    lastEmittedState = next;
+    bus.emit(next);
+  };
+  return {
+    async init() {
+      setAuthRuntime(frozenConfig);
+      frozenConfig.logger.debug("Engine init: running bootstrap");
+      await runBootstrap();
+      emitState();
+    },
+    async login() {
+      setAuthRuntime(frozenConfig);
+      frozenConfig.logger.debug("Engine login: running bootstrap (may redirect)");
+      await runBootstrap();
+      emitState();
+    },
+    async logout(options) {
+      setAuthRuntime(frozenConfig);
+      frozenConfig.logger.debug("Engine logout");
+      await strategy.logout(options);
+      emitState();
+    },
+    async refresh() {
+      setAuthRuntime(frozenConfig);
+      frozenConfig.logger.debug("Engine refresh");
+      try {
+        const token = await strategy.refresh();
+        emitState();
+        return token;
+      } catch (e) {
+        emitState();
+        throw e;
+      }
+    },
+    async getAccessToken() {
+      setAuthRuntime(frozenConfig);
+      return ensureValidAccessToken();
+    },
+    async handleCallback() {
+      setAuthRuntime(frozenConfig);
+      frozenConfig.logger.debug("Engine handleCallback");
+      const handled = await strategy.handleCallback();
+      emitState();
+      return handled;
+    },
+    subscribe(listener) {
+      return bus.subscribe(listener);
+    },
+    getState() {
+      return deriveState(frozenConfig);
+    }
+  };
+}
+function AuthProvider({
+  children,
+  autoInit = true,
+  config,
+  tenantCode,
+  apiBaseUrl,
+  authServerUrl,
+  callbackUrl,
+  appId = "",
+  storageAdapter
+}) {
+  const mergedTenantCode = tenantCode ?? config?.tenantCode;
+  const mergedApiBaseUrl = apiBaseUrl ?? config?.apiBaseUrl;
+  const mergedAuthServerUrl = authServerUrl ?? config?.authServerUrl;
+  const mergedCallbackUrl = callbackUrl ?? config?.callbackUrl;
+  const resolvedTenantKey = mergedTenantCode ?? Config.getClientCode();
+  const namespace = useMemo(
+    () => ({ tenantId: resolvedTenantKey ?? "", appId: appId ?? "" }),
+    [resolvedTenantKey, appId]
+  );
+  const initRanRef = useRef(false);
+  const engineRef = useRef(null);
+  useLayoutEffect(() => {
+    logger.debug("[AuthProvider] Host config props", {
+      tenantCode: mergedTenantCode ?? "(not provided)",
+      apiBaseUrl: mergedApiBaseUrl ? mergedApiBaseUrl : "(empty)",
+      authServerUrl: mergedAuthServerUrl ? mergedAuthServerUrl : "(empty)",
+      callbackUrl: mergedCallbackUrl ? mergedCallbackUrl : "(empty)"
+    });
+    if (!mergedAuthServerUrl || !mergedAuthServerUrl.trim()) {
+      logger.warn("[AuthProvider] authServerUrl missing from host props");
+    }
+    if (!mergedCallbackUrl || !mergedCallbackUrl.trim()) {
+      logger.warn("[AuthProvider] callbackUrl missing from host props");
+    }
+    setConfig({
+      ...mergedTenantCode ? { tenantCode: mergedTenantCode, tenantKey: mergedTenantCode } : {},
+      ...mergedApiBaseUrl ? { apiBaseUrl: mergedApiBaseUrl } : {},
+      ...mergedAuthServerUrl ? { authServerUrl: mergedAuthServerUrl } : {},
+      ...mergedCallbackUrl ? { callbackUrl: mergedCallbackUrl } : {}
+    });
+    logConfigResolutionDebug("AuthProvider host props applied");
+    return () => {
+      clearConfigOverrides();
+    };
+  }, [mergedTenantCode, mergedApiBaseUrl, mergedAuthServerUrl, mergedCallbackUrl]);
+  useEffect(() => {
+    try {
+      writeHostConfigCache({
+        tenantCode: mergedTenantCode ?? "",
+        tenantKey: mergedTenantCode ?? "",
+        appId: appId ?? "",
+        apiBaseUrl: mergedApiBaseUrl ?? "",
+        authServerUrl: mergedAuthServerUrl ?? "",
+        callbackUrl: mergedCallbackUrl ?? ""
+      });
+    } catch {
+    }
+  }, [mergedTenantCode, mergedApiBaseUrl, mergedAuthServerUrl, mergedCallbackUrl, appId]);
+  useLayoutEffect(() => {
+    setStorageKeyPrefix(resolvedTenantKey ?? "");
+    const adapter = storageAdapter !== void 0 && storageAdapter !== null ? storageAdapter : createSecureSessionStorageAdapter(namespace);
+    setStorageContext(adapter, namespace);
+    const runtime = {
+      storageAdapter: adapter,
+      storageNamespace: namespace,
+      logger: createConsoleLogger(),
+      urlProvider: createBrowserUrlProvider(),
+      configProvider: createConfigProvider(),
+      tenantResolver: createTenantResolver(),
+      clearCookies: createBrowserCookieClearer()
+    };
+    setAuthRuntime(runtime);
+    engineRef.current = createAuthEngine(runtime);
+    setDefaultAuthEngine(engineRef.current);
+    return () => {
+      setDefaultAuthEngine(null);
+      engineRef.current = null;
+      setAuthRuntime(null);
+      setStorageContext(null, { tenantId: "", appId: "" });
+      setStorageKeyPrefix("");
+    };
+  }, [resolvedTenantKey, appId, storageAdapter]);
+  useEffect(() => {
+    const resolvedTenantKey2 = mergedTenantCode ?? Config.getClientCode();
+    logger.debug("[AuthProvider] Props from host app", {
+      tenantCode: mergedTenantCode ?? "(not provided)",
+      appId: appId ?? "",
+      resolvedTenantKey: resolvedTenantKey2
+    });
+    if (resolvedTenantKey2) {
+      const previousTenantKey = getStorage(getStorageKey("tenant_key"));
+      const tenantKeyChanged = previousTenantKey && previousTenantKey !== resolvedTenantKey2;
+      if (tenantKeyChanged) {
+        logger.debug("[AuthProvider] Tenant switch detected", { previous: previousTenantKey, next: resolvedTenantKey2 });
+        if (typeof window !== "undefined") {
+          const currentUrl = window.location.href;
+          const isCallback = currentUrl.includes("code=") || currentUrl.includes("state=");
+          if (isCallback) {
+            const cleanUrl = window.location.origin + window.location.pathname;
+            window.history.replaceState({}, document.title, cleanUrl);
+          }
+        }
+        removeStorage(getStorageKey("access_token"));
+        removeStorage(getStorageKey("refresh_token"));
+        removeStorage(getStorageKey("expires_at"));
+        removeStorage(getStorageKey("state"));
+        removeStorage(getStorageKey("code_verifier"));
+        removeStorage(getStorageKey("callback_processed"));
+        clearCallbackProcessing();
+        clearFlowFlags();
+        setStorage(getStorageKey("props_changed"), "true");
+        setStorage(getStorageKey("tenant_switched"), "true");
+        setStorage(getStorageKey("new_tenant_key"), resolvedTenantKey2);
+        setState({
+          isAuthenticated: false,
+          accessToken: null,
+          isLoading: true,
+          error: null
+        });
+      } else if (previousTenantKey) {
+        logger.debug("[AuthProvider] TenantKey unchanged", { tenantKey: resolvedTenantKey2 });
+      }
+      try {
+        writeHostConfigCache({
+          tenantKey: resolvedTenantKey2,
+          tenantCode: resolvedTenantKey2
+        });
+        logConfigResolutionDebug("AuthProvider tenant key synced to cache", {
+          tenantCode: resolvedTenantKey2,
+          tenantKey: resolvedTenantKey2
+        });
+      } catch {
+      }
+      setStorage(getStorageKey("tenant_key"), resolvedTenantKey2);
+    } else {
+      logger.debug("[AuthProvider] No tenant code determined");
+    }
+  }, [mergedTenantCode, appId]);
+  const [state, setState] = useState({
+    isAuthenticated: false,
+    accessToken: null,
+    isLoading: autoInit,
+    error: null
+  });
+  const syncAuthState = useCallback(() => {
+    try {
+      const engine = engineRef.current;
+      let authenticated;
+      let accessToken;
+      let error = null;
+      if (engine) {
+        const s = engine.getState();
+        authenticated = s.status === "authenticated" && !!s.accessToken;
+        accessToken = s.accessToken;
+        error = s.error;
+      } else {
+        accessToken = getAccessToken();
+        authenticated = !!accessToken && !isAccessTokenExpired();
+      }
+      setState({
+        isAuthenticated: authenticated,
+        accessToken,
+        isLoading: false,
+        error
+      });
+      if (authenticated) {
+      } else {
+        stopStorageWatcher();
+        stopCookieWatcher();
+      }
+    } catch (error) {
+      stopStorageWatcher();
+      stopCookieWatcher();
+      setState({
+        isAuthenticated: false,
+        accessToken: null,
+        isLoading: false,
+        error: error instanceof Error ? error.message : "Unknown error"
+      });
+    }
+  }, []);
+  useEffect(() => {
+    if (!autoInit) return;
+    const tenantSwitched = getStorage(getStorageKey("tenant_switched")) === "true";
+    const propsChanged = getStorage(getStorageKey("props_changed")) === "true";
+    if (!tenantSwitched && !propsChanged) return;
+    let cancelled = false;
+    const reinit = async () => {
+      try {
+        await engineRef.current?.init();
+        if (!cancelled) {
+          syncAuthState();
+        }
+      } finally {
+        removeStorage(getStorageKey("props_changed"));
+      }
+    };
+    reinit();
+    return () => {
+      cancelled = true;
+    };
+  }, [autoInit, mergedTenantCode, syncAuthState]);
+  useEffect(() => {
+    if (!autoInit) {
+      setState((prev) => ({ ...prev, isLoading: false }));
+      return;
+    }
+    if (initRanRef.current) return;
+    initRanRef.current = true;
+    let cancelled = false;
+    const init = async () => {
+      try {
+        await engineRef.current?.init();
+        if (!cancelled) syncAuthState();
+      } catch (error) {
+        stopStorageWatcher();
+        stopCookieWatcher();
+        if (!cancelled) {
+          setState({
+            isAuthenticated: false,
+            accessToken: null,
+            isLoading: false,
+            error: error instanceof Error ? error.message : "Authentication initialization failed"
+          });
+        }
+      }
+    };
+    init();
+    return () => {
+      cancelled = true;
+      initRanRef.current = false;
+      stopStorageWatcher();
+      stopCookieWatcher();
+    };
+  }, [autoInit, syncAuthState]);
+  const login = useCallback(async () => {
+    setState((prev) => ({ ...prev, isLoading: true }));
+    await engineRef.current?.login();
+    syncAuthState();
+  }, [syncAuthState]);
+  const logout2 = useCallback(async () => {
+    stopStorageWatcher();
+    stopCookieWatcher();
+    setState((prev) => ({ ...prev, isLoading: true }));
+    try {
+      await engineRef.current?.logout({ tenantKey: mergedTenantCode });
+      resetCookieWatcher();
+    } finally {
+      stopStorageWatcher();
+      stopCookieWatcher();
+      setState({
+        isAuthenticated: false,
+        accessToken: null,
+        isLoading: false,
+        error: null
+      });
+    }
+  }, [mergedTenantCode]);
+  const refreshToken = useCallback(async () => {
+    try {
+      const newToken = await engineRef.current?.refresh() ?? "";
+      syncAuthState();
+      return newToken;
+    } catch (error) {
+      await logout2();
+      throw error;
+    }
+  }, [syncAuthState, logout2]);
+  const getValidAccessToken = useCallback(async () => {
+    try {
+      const token = await engineRef.current?.getAccessToken();
+      if (!token) throw new Error("Not authenticated");
+      syncAuthState();
+      return token;
+    } catch (error) {
+      await logout2();
+      throw error;
+    }
+  }, [syncAuthState, logout2]);
+  const setTokens = useCallback((accessToken) => {
+    setState({
+      isAuthenticated: true,
+      accessToken,
+      isLoading: false,
+      error: null
+    });
+  }, []);
+  const contextValue = useMemo(
+    () => ({
+      ...state,
+      login,
+      logout: logout2,
+      refreshToken,
+      getAccessToken: getValidAccessToken,
+      setTokens
+    }),
+    [state, login, logout2, refreshToken, getValidAccessToken, setTokens]
+  );
+  return /* @__PURE__ */ jsx(AuthContext.Provider, { value: contextValue, children });
+}
+var PLUGIN_DISPLAY_NAME = "Tenneo Auth";
+function AuthCallback({
+  loginPath = "/login",
+  successPath = "/dashboard",
+  homePath = "/"
+}) {
+  const { setTokens } = useAuthContext();
+  const handledRef = useRef(false);
+  const [status, setStatus] = useState("idle");
+  const [message, setMessage] = useState("");
+  useEffect(() => {
+    if (handledRef.current) return;
+    handledRef.current = true;
+    const urlParams = new URLSearchParams(window.location.search);
+    const hasCallbackParams = urlParams.has("code") || urlParams.has("error");
+    if (!hasCallbackParams) {
+      window.location.replace(loginPath || homePath);
+      return;
+    }
+    const error = urlParams.get("error");
+    const errorDescription = urlParams.get("error_description");
+    if (error) {
+      setStatus("error");
+      setMessage(`${error}: ${errorDescription || "Authorization failed"}`);
+      window.history.replaceState({}, document.title, window.location.origin + window.location.pathname);
+      return;
+    }
+    const runCallback = async () => {
+      setStatus("loading");
+      setMessage("Completing sign-in...");
+      const handled = await handleCallback();
+      if (!handled) {
+        setStatus("error");
+        setMessage("Authentication failed. Please try again.");
+        window.history.replaceState({}, document.title, window.location.origin + window.location.pathname);
+        return;
+      }
+      const startedAt = Date.now();
+      const MAX_WAIT_MS = 5e3;
+      while (true) {
+        const token = getAccessToken();
+        if (token) {
+          setTokens(token);
+          setStatus("success");
+          setMessage("Authentication successful. Redirecting...");
+          window.location.replace(successPath);
+          return;
+        }
+        if (Date.now() - startedAt > MAX_WAIT_MS) break;
+        await new Promise((r) => setTimeout(r, 200));
+      }
+      setStatus("error");
+      setMessage("Authentication did not complete. Please try again.");
+      window.history.replaceState({}, document.title, window.location.origin + window.location.pathname);
+    };
+    runCallback();
+  }, [homePath, loginPath, successPath, setTokens]);
+  const containerStyle = {
+    minHeight: "200px",
+    display: "flex",
+    flexDirection: "column",
+    alignItems: "center",
+    justifyContent: "center",
+    padding: 32,
+    fontFamily: "system-ui, -apple-system, Segoe UI, Roboto, sans-serif",
+    textAlign: "center"
+  };
+  const titleStyle = {
+    margin: 0,
+    fontSize: "1.25rem",
+    fontWeight: 600,
+    color: "#1a1a1a",
+    marginBottom: 8
+  };
+  const messageStyle = {
+    margin: 0,
+    fontSize: "0.9375rem",
+    color: "#555",
+    lineHeight: 1.5,
+    maxWidth: 360
+  };
+  const errorBoxStyle = {
+    marginTop: 16,
+    padding: "12px 16px",
+    backgroundColor: "#fef2f2",
+    border: "1px solid #fecaca",
+    borderRadius: 8,
+    color: "#991b1b",
+    fontSize: "0.875rem",
+    maxWidth: 360
+  };
+  const retryLinkStyle = {
+    marginTop: 16,
+    fontSize: "0.875rem",
+    color: "#2563eb",
+    textDecoration: "none",
+    cursor: "pointer"
+  };
+  const spinnerStyle = {
+    width: 28,
+    height: 28,
+    border: "3px solid #e5e7eb",
+    borderTopColor: "#2563eb",
+    borderRadius: "50%",
+    animation: "auth-callback-spin 0.8s linear infinite",
+    marginBottom: 16
+  };
+  const pluginNameStyle = {
+    position: "absolute",
+    top: 24,
+    left: "50%",
+    transform: "translateX(-50%)",
+    margin: 0,
+    fontSize: "0.875rem",
+    fontWeight: 600,
+    color: "#6b7280",
+    letterSpacing: "0.02em"
+  };
+  return /* @__PURE__ */ jsxs("div", { style: { ...containerStyle, position: "relative" }, children: [
+    /* @__PURE__ */ jsx("style", { children: `@keyframes auth-callback-spin { to { transform: rotate(360deg); } }` }),
+    /* @__PURE__ */ jsx("p", { style: pluginNameStyle, children: PLUGIN_DISPLAY_NAME }),
+    status === "loading" && /* @__PURE__ */ jsxs(Fragment, { children: [
+      /* @__PURE__ */ jsx("div", { style: spinnerStyle, "aria-hidden": true }),
+      /* @__PURE__ */ jsx("h2", { style: titleStyle, children: "Signing you in..." }),
+      /* @__PURE__ */ jsx("p", { style: messageStyle, children: "Please wait while we complete authentication." })
+    ] }),
+    status === "success" && /* @__PURE__ */ jsxs(Fragment, { children: [
+      /* @__PURE__ */ jsx("h2", { style: titleStyle, children: "Signed in successfully" }),
+      /* @__PURE__ */ jsx("p", { style: messageStyle, children: "Redirecting you now." })
+    ] }),
+    status === "error" && /* @__PURE__ */ jsxs(Fragment, { children: [
+      /* @__PURE__ */ jsx("h2", { style: { ...titleStyle, color: "#991b1b" }, children: "Authentication failed" }),
+      /* @__PURE__ */ jsx("div", { style: errorBoxStyle, children: message }),
+      /* @__PURE__ */ jsx(
+        "a",
+        {
+          href: loginPath,
+          style: retryLinkStyle,
+          onClick: (e) => {
+            e.preventDefault();
+            window.location.href = loginPath;
+          },
+          children: "Try again"
+        }
+      )
+    ] }),
+    status === "idle" && /* @__PURE__ */ jsxs(Fragment, { children: [
+      /* @__PURE__ */ jsx("div", { style: spinnerStyle, "aria-hidden": true }),
+      /* @__PURE__ */ jsx("h2", { style: titleStyle, children: "Preparing callback..." }),
+      /* @__PURE__ */ jsx("p", { style: messageStyle, children: "Setting up authentication." })
+    ] })
+  ] });
+}
+
+// src/hooks/useAuth.ts
+function useAuth() {
+  return useAuthContext();
+}
+function ProtectedRoute({
+  children,
+  fallback = null,
+  autoLogin = true
+}) {
+  const { isAuthenticated, getAccessToken: getAccessToken3, login } = useAuth();
+  const [ready, setReady] = useState(false);
+  const loginTriggeredRef = useRef(false);
+  useEffect(() => {
+    let cancelled = false;
+    const run = async () => {
+      if (isAuthenticated) {
+        if (!cancelled) setReady(true);
+        return;
+      }
+      try {
+        await getAccessToken3();
+        if (!cancelled) setReady(true);
+      } catch {
+        if (autoLogin && !loginTriggeredRef.current) {
+          loginTriggeredRef.current = true;
+          await login();
+        }
+        if (!cancelled) setReady(false);
+      }
+    };
+    run();
+    return () => {
+      cancelled = true;
+    };
+  }, [autoLogin, getAccessToken3, isAuthenticated, login]);
+  if (!ready || !isAuthenticated) {
+    return /* @__PURE__ */ jsx(Fragment, { children: fallback });
+  }
+  return /* @__PURE__ */ jsx(Fragment, { children });
+}
+function useAuthInit() {
+  const [isLoading, setIsLoading] = useState(false);
+  const [error, setError] = useState(null);
+  const inProgressRef = useRef(false);
+  const mountedRef = useRef(true);
+  useEffect(() => {
+    return () => {
+      mountedRef.current = false;
+    };
+  }, []);
+  const init = useCallback(async () => {
+    if (inProgressRef.current) {
+      return;
+    }
+    inProgressRef.current = true;
+    if (mountedRef.current) {
+      setIsLoading(true);
+      setError(null);
+    }
+    try {
+      await bootstrap();
+    } catch (err) {
+      if (mountedRef.current) {
+        setError(
+          err instanceof Error ? err.message : "Authentication initialization failed"
+        );
+      }
+    } finally {
+      inProgressRef.current = false;
+      if (mountedRef.current) {
+        setIsLoading(false);
+      }
+    }
+  }, []);
+  return useMemo(
+    () => ({ isLoading, error, init }),
+    [isLoading, error, init]
+  );
+}
+
+export { AuthCallback, AuthConfigError, AuthEventNames, AuthProvider, Config, OAUTH_CONSTANTS, ProtectedRoute, STORAGE_KEYS2 as STORAGE_KEYS, STORAGE_KEY_PREFIX, SanitizedError, applyRuntimeTenantSwitch, areWatchersSuspended, bootstrap, buildStorageKey, createAuthEngine, createCookieStorageAdapter, createMemoryStorageAdapter, createOAuth2PkceStrategy, createSecureSessionStorageAdapter, emitAuthEvent, enforceHttps, ensureValidAccessToken, extractTenantKey, getAccessToken2 as getAccessToken, getAuthConfig2 as getAuthConfig, getAuthRuntime, getConfig, getConfigFieldSources, getEffectiveTenantCode, getEffectiveTenantKey, getStorageAdapter, getStorageNamespace, getAccessToken as getStoredAccessToken, initPlugin, isAccessTokenExpired, isCallbackUrl, logConfigResolutionDebug, logout, refreshAccessToken, requireAuthConfig, resetCookieWatcher, resolveConfig, resolveTenant, resumeWatchers, sanitizeErrorMessage, setAuthRuntime, setConfig, setHostConfigProvider, setStorageContext, startCookieWatcher, startStorageWatcher, stopCookieWatcher, stopStorageWatcher, subscribeAuthEvent, suspendWatchers, syncHostConfigCacheFromMemory, useAuth, useAuthContext, useAuthInit, writeHostConfigCache };
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map