tenneo-auth-plugin 0.1.0

package/dist/index.mjs

@@ -0,0 +1,3385 @@
+import { z } from 'zod';
+import axios from 'axios';
+import { createContext, useContext, useMemo, useRef, useLayoutEffect, useEffect, useState, useCallback } from 'react';
+import { jsx, jsxs, Fragment } from 'react/jsx-runtime';
+
+// src/infrastructure/runtime/context.ts
+var currentRuntime = null;
+function setAuthRuntime(runtime) {
+  currentRuntime = runtime;
+}
+function getAuthRuntime() {
+  return currentRuntime;
+}
+
+// src/domain/tenant.ts
+function isLocalhost(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname.startsWith("192.168.") || hostname.startsWith("10.") || hostname.endsWith(".local");
+}
+function extractTenantKeyFromDomain(urlOrHostname, config) {
+  try {
+    let hostname;
+    if (urlOrHostname.startsWith("http://") || urlOrHostname.startsWith("https://")) {
+      try {
+        const url = new URL(urlOrHostname);
+        hostname = url.hostname;
+      } catch {
+        hostname = urlOrHostname.replace(/^https?:\/\//, "").split("/")[0];
+      }
+    } else {
+      hostname = urlOrHostname;
+    }
+    const parts = hostname.split(".");
+    if (parts.length < 2) return config.getClientCode();
+    const tenantKey = parts[0];
+    if (!tenantKey || tenantKey.trim() === "") return config.getClientCode();
+    if (tenantKey.trim().toLowerCase() === "productlms") return config.getClientCode();
+    return tenantKey.trim();
+  } catch {
+    return config.getClientCode();
+  }
+}
+function extractTenantKeyFromUrl(url, config, getStorage3, getKey) {
+  try {
+    const propsConfigKey = getKey ? getKey("props_config") : "tenneo_auth_props_config";
+    const propsConfigStr = getStorage3(propsConfigKey);
+    if (propsConfigStr) {
+      try {
+        const propsConfig = JSON.parse(propsConfigStr);
+        if (propsConfig.tenantKey?.trim()) return propsConfig.tenantKey.trim();
+      } catch {
+      }
+    }
+    const tenantKeyStorageKey = getKey ? getKey("tenant_key") : "tenneo_auth_tenant_key";
+    const storedTenantKey = getStorage3(tenantKeyStorageKey);
+    if (storedTenantKey?.trim()) return storedTenantKey.trim();
+    const urlParams = new URLSearchParams(url.search);
+    const tenantKeyFromQuery = urlParams.get("t");
+    if (tenantKeyFromQuery?.trim()) {
+      const hostnameParts = url.hostname.split(".");
+      const baseDomain = hostnameParts.length >= 2 ? hostnameParts.slice(-2).join(".") : url.hostname;
+      const simulatedHostname = `${tenantKeyFromQuery.trim()}.${baseDomain}`;
+      const key = extractTenantKeyFromDomain(simulatedHostname, config);
+      if (key) return key;
+      return tenantKeyFromQuery.trim();
+    }
+    const keyFromHost = extractTenantKeyFromDomain(url.hostname, config);
+    if (keyFromHost) return keyFromHost;
+    const clientCode = config.getClientCode();
+    if (clientCode?.trim()) return clientCode.trim();
+    const tenantId = config.getTenantId();
+    if (tenantId?.trim()) return tenantId.trim();
+    return config.getClientCode();
+  } catch {
+    const clientCode = config.getClientCode();
+    if (clientCode?.trim()) return clientCode.trim();
+    return config.getTenantId() || config.getClientCode();
+  }
+}
+function isCallbackUrlFromUrl(url) {
+  const params = new URLSearchParams(url.search);
+  return params.has("code") && params.has("state");
+}
+
+// src/infrastructure/storage/prefix.ts
+var DEFAULT_PREFIX = "tenneo_auth_";
+var currentPrefix = DEFAULT_PREFIX;
+function getStorageKeyPrefix() {
+  return currentPrefix;
+}
+function normalizeTenantCode(tenantCode) {
+  const trimmed = tenantCode.trim();
+  if (!trimmed) return "";
+  return trimmed.replace(/[^a-zA-Z0-9_]/g, "_").toLowerCase();
+}
+function setStorageKeyPrefix(tenantCode) {
+  const normalized = normalizeTenantCode(tenantCode);
+  currentPrefix = normalized ? `${normalized}_auth_` : DEFAULT_PREFIX;
+}
+function getStorageKey(suffix) {
+  return getStorageKeyPrefix() + suffix;
+}
+
+// src/infrastructure/storage/namespace.ts
+function buildStorageKey(ns, suffix) {
+  const { tenantId, appId } = ns;
+  if (!tenantId && !appId) {
+    return `${getStorageKeyPrefix()}${suffix}`;
+  }
+  const tid = tenantId || "";
+  const aid = appId || "";
+  return `auth_${tid}_${aid}_${suffix}`;
+}
+var TOKEN_KEY_SUFFIXES = {
+  accessToken: "access_token",
+  refreshToken: "refresh_token",
+  expiresAt: "expires_at"
+};
+var CONFIG_KEY_SUFFIXES = {
+  authServerUrl: "auth_server_url",
+  clientId: "client_id",
+  redirectUri: "redirect_uri",
+  tenantId: "tenant_id",
+  tenantKey: "tenant_key",
+  codeVerifier: "code_verifier",
+  state: "state",
+  callbackProcessed: "callback_processed",
+  callbackProcessing: "callback_processing",
+  callbackAttempted: "callback_attempted",
+  flowInProgress: "flow_in_progress",
+  flowTimestamp: "flow_timestamp",
+  logoutProcessing: "logout_processing",
+  propsConfig: "props_config",
+  propsChanged: "props_changed",
+  tenantSwitched: "tenant_switched",
+  newTenantKey: "new_tenant_key",
+  stateMismatch: "state_mismatch",
+  bootstrapInProgress: "bootstrap_in_progress",
+  bootstrapTimestamp: "bootstrap_timestamp",
+  callbackHandled: "callback_handled",
+  idToken: "id_token"
+};
+
+// src/infrastructure/storage/context.ts
+var currentAdapter = null;
+var currentNamespace = { tenantId: "", appId: "" };
+function setStorageContext(adapter, namespace = {}) {
+  currentAdapter = adapter;
+  currentNamespace = {
+    tenantId: namespace.tenantId ?? "",
+    appId: namespace.appId ?? ""
+  };
+}
+function getStorageAdapter() {
+  const runtime = getAuthRuntime();
+  if (runtime?.storageAdapter) return runtime.storageAdapter;
+  return currentAdapter;
+}
+function getStorageNamespace() {
+  const runtime = getAuthRuntime();
+  if (runtime?.storageNamespace) return { ...runtime.storageNamespace };
+  return { ...currentNamespace };
+}
+
+// src/infrastructure/storage/memory-adapter.ts
+function createMemoryStorageAdapter(namespace) {
+  const store = /* @__PURE__ */ new Map();
+  const getTokensSync = () => {
+    const accessToken = store.get(buildStorageKey(namespace, TOKEN_KEY_SUFFIXES.accessToken)) ?? null;
+    const refreshToken = store.get(buildStorageKey(namespace, TOKEN_KEY_SUFFIXES.refreshToken)) ?? null;
+    const expiresAtStr = store.get(buildStorageKey(namespace, TOKEN_KEY_SUFFIXES.expiresAt)) ?? null;
+    if (!accessToken || !refreshToken || !expiresAtStr) return null;
+    const expiresAt = parseInt(expiresAtStr, 10);
+    if (isNaN(expiresAt)) return null;
+    return { accessToken, refreshToken, expiresAt };
+  };
+  return {
+    async getTokens() {
+      return getTokensSync();
+    },
+    getTokensSync,
+    async setTokens(tokens) {
+      store.set(buildStorageKey(namespace, TOKEN_KEY_SUFFIXES.accessToken), tokens.accessToken);
+      store.set(buildStorageKey(namespace, TOKEN_KEY_SUFFIXES.refreshToken), tokens.refreshToken);
+      store.set(buildStorageKey(namespace, TOKEN_KEY_SUFFIXES.expiresAt), String(tokens.expiresAt));
+    },
+    setTokensSync(tokens) {
+      store.set(buildStorageKey(namespace, TOKEN_KEY_SUFFIXES.accessToken), tokens.accessToken);
+      store.set(buildStorageKey(namespace, TOKEN_KEY_SUFFIXES.refreshToken), tokens.refreshToken);
+      store.set(buildStorageKey(namespace, TOKEN_KEY_SUFFIXES.expiresAt), String(tokens.expiresAt));
+    },
+    async clearTokens() {
+      store.delete(buildStorageKey(namespace, TOKEN_KEY_SUFFIXES.accessToken));
+      store.delete(buildStorageKey(namespace, TOKEN_KEY_SUFFIXES.refreshToken));
+      store.delete(buildStorageKey(namespace, TOKEN_KEY_SUFFIXES.expiresAt));
+    },
+    clearTokensSync() {
+      store.delete(buildStorageKey(namespace, TOKEN_KEY_SUFFIXES.accessToken));
+      store.delete(buildStorageKey(namespace, TOKEN_KEY_SUFFIXES.refreshToken));
+      store.delete(buildStorageKey(namespace, TOKEN_KEY_SUFFIXES.expiresAt));
+    },
+    async getItem(key) {
+      return store.get(key) ?? null;
+    },
+    getItemSync(key) {
+      return store.get(key) ?? null;
+    },
+    async setItem(key, value) {
+      store.set(key, value);
+    },
+    setItemSync(key, value) {
+      store.set(key, value);
+    },
+    async removeItem(key) {
+      store.delete(key);
+    },
+    removeItemSync(key) {
+      store.delete(key);
+    },
+    async clear() {
+      store.clear();
+    },
+    clearSync() {
+      store.clear();
+    }
+  };
+}
+
+// src/infrastructure/storage/session-adapter.ts
+function getSessionStorage() {
+  if (typeof window === "undefined") return null;
+  try {
+    return window.sessionStorage;
+  } catch {
+    return null;
+  }
+}
+function createSecureSessionStorageAdapter(namespace) {
+  return {
+    async getTokens() {
+      return getTokensSyncImpl(namespace);
+    },
+    getTokensSync() {
+      return getTokensSyncImpl(namespace);
+    },
+    async setTokens(tokens) {
+      setTokensSyncImpl(namespace, tokens);
+    },
+    setTokensSync(tokens) {
+      setTokensSyncImpl(namespace, tokens);
+    },
+    async clearTokens() {
+      clearTokensSyncImpl(namespace);
+    },
+    clearTokensSync() {
+      clearTokensSyncImpl(namespace);
+    },
+    async getItem(key) {
+      return getItemSyncImpl(key);
+    },
+    getItemSync(key) {
+      return getItemSyncImpl(key);
+    },
+    async setItem(key, value) {
+      setItemSyncImpl(key, value);
+    },
+    setItemSync(key, value) {
+      setItemSyncImpl(key, value);
+    },
+    async removeItem(key) {
+      removeItemSyncImpl(key);
+    },
+    removeItemSync(key) {
+      removeItemSyncImpl(key);
+    },
+    async clear() {
+      clearSyncImpl(namespace);
+    },
+    clearSync() {
+      clearSyncImpl(namespace);
+    }
+  };
+}
+function getTokensSyncImpl(ns) {
+  const storage = getSessionStorage();
+  if (!storage) return null;
+  try {
+    const accessToken = storage.getItem(buildStorageKey(ns, TOKEN_KEY_SUFFIXES.accessToken));
+    const refreshToken = storage.getItem(buildStorageKey(ns, TOKEN_KEY_SUFFIXES.refreshToken));
+    const expiresAtStr = storage.getItem(buildStorageKey(ns, TOKEN_KEY_SUFFIXES.expiresAt));
+    if (!accessToken || !refreshToken || !expiresAtStr) return null;
+    const expiresAt = parseInt(expiresAtStr, 10);
+    if (isNaN(expiresAt)) return null;
+    return { accessToken, refreshToken, expiresAt };
+  } catch {
+    return null;
+  }
+}
+function setTokensSyncImpl(ns, tokens) {
+  const storage = getSessionStorage();
+  if (!storage) return;
+  try {
+    storage.setItem(buildStorageKey(ns, TOKEN_KEY_SUFFIXES.accessToken), tokens.accessToken);
+    storage.setItem(buildStorageKey(ns, TOKEN_KEY_SUFFIXES.refreshToken), tokens.refreshToken);
+    storage.setItem(buildStorageKey(ns, TOKEN_KEY_SUFFIXES.expiresAt), String(tokens.expiresAt));
+  } catch {
+  }
+}
+function clearTokensSyncImpl(ns) {
+  const storage = getSessionStorage();
+  if (!storage) return;
+  try {
+    storage.removeItem(buildStorageKey(ns, TOKEN_KEY_SUFFIXES.accessToken));
+    storage.removeItem(buildStorageKey(ns, TOKEN_KEY_SUFFIXES.refreshToken));
+    storage.removeItem(buildStorageKey(ns, TOKEN_KEY_SUFFIXES.expiresAt));
+  } catch {
+  }
+}
+function getItemSyncImpl(key) {
+  const storage = getSessionStorage();
+  if (!storage) return null;
+  try {
+    return storage.getItem(key);
+  } catch {
+    return null;
+  }
+}
+function setItemSyncImpl(key, value) {
+  const storage = getSessionStorage();
+  if (!storage) return;
+  try {
+    storage.setItem(key, value);
+  } catch {
+  }
+}
+function removeItemSyncImpl(key) {
+  const storage = getSessionStorage();
+  if (!storage) return;
+  try {
+    storage.removeItem(key);
+  } catch {
+  }
+}
+function clearSyncImpl(ns) {
+  const storage = getSessionStorage();
+  if (!storage) return;
+  try {
+    const prefix = ns.tenantId || ns.appId ? `auth_${ns.tenantId || ""}_${ns.appId || ""}_` : getStorageKeyPrefix();
+    const keys = [];
+    for (let i = 0; i < storage.length; i++) {
+      const key = storage.key(i);
+      if (key && key.startsWith(prefix)) keys.push(key);
+    }
+    keys.forEach((k) => storage.removeItem(k));
+  } catch {
+  }
+}
+
+// src/infrastructure/storage/cookie-adapter.ts
+var DEFAULT_COOKIE_OPTIONS = {
+  path: "/",
+  sameSite: "lax",
+  maxAge: 60 * 60 * 24 * 7
+  // 7 days for refresh token
+};
+function getDocument() {
+  if (typeof document === "undefined") return null;
+  return document;
+}
+function getCookie(name) {
+  const doc = getDocument();
+  if (!doc || !doc.cookie) return null;
+  const match = doc.cookie.match(new RegExp("(^| )" + name + "=([^;]+)"));
+  return match ? decodeURIComponent(match[2]) : null;
+}
+function setCookie(name, value, options = {}) {
+  const doc = getDocument();
+  if (!doc) return;
+  const { path = "/", sameSite = "lax", maxAge } = { ...DEFAULT_COOKIE_OPTIONS, ...options };
+  let cookie = `${encodeURIComponent(name)}=${encodeURIComponent(value)};path=${path};SameSite=${sameSite}`;
+  if (maxAge != null) cookie += `;max-age=${maxAge}`;
+  doc.cookie = cookie;
+}
+function deleteCookie(name) {
+  const doc = getDocument();
+  if (!doc) return;
+  doc.cookie = `${encodeURIComponent(name)}=;path=/;max-age=0`;
+}
+function createCookieStorageAdapter(namespace, options) {
+  const prefix = options?.cookiePrefix ?? "auth";
+  const keyPrefix = namespace.tenantId || namespace.appId ? `auth_${namespace.tenantId || ""}_${namespace.appId || ""}_` : getStorageKeyPrefix();
+  const cookieName = (suffix) => `${prefix}_${namespace.tenantId || "t"}_${namespace.appId || "a"}_${suffix}`.replace(/[^a-zA-Z0-9_]/g, "_");
+  return {
+    async getTokens() {
+      const accessToken = getCookie(cookieName(TOKEN_KEY_SUFFIXES.accessToken));
+      const refreshToken = getCookie(cookieName(TOKEN_KEY_SUFFIXES.refreshToken));
+      const expiresAtStr = getCookie(cookieName(TOKEN_KEY_SUFFIXES.expiresAt));
+      if (!accessToken || !refreshToken || !expiresAtStr) return null;
+      const expiresAt = parseInt(expiresAtStr, 10);
+      if (isNaN(expiresAt)) return null;
+      return { accessToken, refreshToken, expiresAt };
+    },
+    async setTokens(tokens) {
+      setCookie(cookieName(TOKEN_KEY_SUFFIXES.accessToken), tokens.accessToken, { maxAge: 60 * 60 });
+      setCookie(cookieName(TOKEN_KEY_SUFFIXES.refreshToken), tokens.refreshToken, { maxAge: 60 * 60 * 24 * 7 });
+      setCookie(cookieName(TOKEN_KEY_SUFFIXES.expiresAt), String(tokens.expiresAt), { maxAge: 60 * 60 * 24 });
+    },
+    async clearTokens() {
+      deleteCookie(cookieName(TOKEN_KEY_SUFFIXES.accessToken));
+      deleteCookie(cookieName(TOKEN_KEY_SUFFIXES.refreshToken));
+      deleteCookie(cookieName(TOKEN_KEY_SUFFIXES.expiresAt));
+    },
+    async getItem(key) {
+      const name = key.startsWith(keyPrefix) ? key.slice(keyPrefix.length) : key;
+      return getCookie(cookieName(name));
+    },
+    async setItem(key, value) {
+      const name = key.startsWith(keyPrefix) ? key.slice(keyPrefix.length) : key;
+      setCookie(cookieName(name), value);
+    },
+    async removeItem(key) {
+      const name = key.startsWith(keyPrefix) ? key.slice(keyPrefix.length) : key;
+      deleteCookie(cookieName(name));
+    },
+    async clear() {
+      const suffixes = Object.values(TOKEN_KEY_SUFFIXES);
+      suffixes.forEach((s) => deleteCookie(cookieName(s)));
+      Object.values(CONFIG_KEY_SUFFIXES).forEach((suffix) => deleteCookie(cookieName(suffix)));
+    }
+  };
+}
+
+// src/infrastructure/storage/api.ts
+var KEY_SUFFIXES = {
+  authServerUrl: "auth_server_url",
+  clientId: "client_id",
+  redirectUri: "redirect_uri",
+  tenantId: "tenant_id",
+  tenantKey: "tenant_key",
+  codeVerifier: "code_verifier",
+  state: "state",
+  accessToken: "access_token",
+  refreshToken: "refresh_token",
+  expiresAt: "expires_at"
+};
+var STORAGE_KEYS = {
+  get authServerUrl() {
+    return getStorageKey(KEY_SUFFIXES.authServerUrl);
+  },
+  get clientId() {
+    return getStorageKey(KEY_SUFFIXES.clientId);
+  },
+  get redirectUri() {
+    return getStorageKey(KEY_SUFFIXES.redirectUri);
+  },
+  get tenantId() {
+    return getStorageKey(KEY_SUFFIXES.tenantId);
+  },
+  get tenantKey() {
+    return getStorageKey(KEY_SUFFIXES.tenantKey);
+  },
+  get codeVerifier() {
+    return getStorageKey(KEY_SUFFIXES.codeVerifier);
+  },
+  get state() {
+    return getStorageKey(KEY_SUFFIXES.state);
+  },
+  get accessToken() {
+    return getStorageKey(KEY_SUFFIXES.accessToken);
+  },
+  get refreshToken() {
+    return getStorageKey(KEY_SUFFIXES.refreshToken);
+  },
+  get expiresAt() {
+    return getStorageKey(KEY_SUFFIXES.expiresAt);
+  }
+};
+function keyToSuffix(key) {
+  const prefix = getStorageKeyPrefix();
+  return key.startsWith(prefix) ? key.slice(prefix.length) : key;
+}
+function setStorage(key, value) {
+  const adapter = getStorageAdapter();
+  if (!adapter?.setItemSync) return;
+  const ns = getStorageNamespace();
+  const suffix = keyToSuffix(key);
+  try {
+    adapter.setItemSync(buildStorageKey(ns, suffix), value);
+  } catch {
+  }
+}
+function getStorage(key) {
+  const adapter = getStorageAdapter();
+  if (!adapter?.getItemSync) return null;
+  const ns = getStorageNamespace();
+  const suffix = keyToSuffix(key);
+  try {
+    return adapter.getItemSync(buildStorageKey(ns, suffix));
+  } catch {
+    return null;
+  }
+}
+function removeStorage(key) {
+  const adapter = getStorageAdapter();
+  if (!adapter?.removeItemSync) return;
+  const ns = getStorageNamespace();
+  const suffix = keyToSuffix(key);
+  try {
+    adapter.removeItemSync(buildStorageKey(ns, suffix));
+  } catch {
+  }
+}
+function clearAuthStorage() {
+  const adapter = getStorageAdapter();
+  if (!adapter?.clearSync) return;
+  try {
+    adapter.clearTokensSync?.();
+    adapter.clearSync();
+  } catch {
+  }
+}
+function clearAuthSessionStorage() {
+  const adapter = getStorageAdapter();
+  if (!adapter?.clearSync) return;
+  try {
+    adapter.clearTokensSync?.();
+    adapter.clearSync();
+  } catch {
+  }
+}
+function clearAllCookies() {
+  const runtime = getAuthRuntime();
+  try {
+    runtime?.clearCookies?.clearCookies();
+  } catch {
+  }
+}
+function clearAllStorage() {
+  const forceLogin = getStorage(getStorageKey("force_login"));
+  const logoutInProgress = getStorage(getStorageKey("logout_in_progress"));
+  const preservedTenantKey = getStorage(getStorageKey("preserved_tenant_key"));
+  clearAuthSessionStorage();
+  clearAuthStorage();
+  if (forceLogin === "true") setStorage(getStorageKey("force_login"), "true");
+  if (logoutInProgress === "true") setStorage(getStorageKey("logout_in_progress"), "true");
+  if (preservedTenantKey) setStorage(getStorageKey("preserved_tenant_key"), preservedTenantKey);
+  clearAllCookies();
+}
+function getAccessToken() {
+  const adapter = getStorageAdapter();
+  if (adapter?.getTokensSync) {
+    const t = adapter.getTokensSync();
+    return t?.accessToken ?? null;
+  }
+  return getStorage(STORAGE_KEYS.accessToken);
+}
+function getRefreshToken() {
+  const adapter = getStorageAdapter();
+  if (adapter?.getTokensSync) {
+    const t = adapter.getTokensSync();
+    return t?.refreshToken ?? null;
+  }
+  return getStorage(STORAGE_KEYS.refreshToken);
+}
+function getExpiresAt() {
+  const adapter = getStorageAdapter();
+  if (adapter?.getTokensSync) {
+    const t = adapter.getTokensSync();
+    return t?.expiresAt ?? null;
+  }
+  const expiresAt = getStorage(STORAGE_KEYS.expiresAt);
+  if (!expiresAt) return null;
+  const timestamp = parseInt(expiresAt, 10);
+  return isNaN(timestamp) ? null : timestamp;
+}
+function isAccessTokenExpired() {
+  const expiresAt = getExpiresAt();
+  if (!expiresAt) return true;
+  const buffer = 60 * 1e3;
+  return Date.now() >= expiresAt - buffer;
+}
+function getClientId() {
+  return getStorage(STORAGE_KEYS.clientId);
+}
+function getRedirectUri() {
+  return getStorage(STORAGE_KEYS.redirectUri);
+}
+function getTenantId() {
+  return getStorage(STORAGE_KEYS.tenantId);
+}
+function getCodeVerifier() {
+  return getStorage(STORAGE_KEYS.codeVerifier);
+}
+function getState() {
+  return getStorage(STORAGE_KEYS.state);
+}
+function getTenantKey() {
+  return getStorage(STORAGE_KEYS.tenantKey);
+}
+function setTenantKey(tenantKey) {
+  setStorage(STORAGE_KEYS.tenantKey, tenantKey);
+}
+
+// src/utils/logger.ts
+function isDev() {
+  if (typeof window === "undefined") {
+    return false;
+  }
+  const hostname = window.location.hostname;
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname.startsWith("192.168.") || hostname.startsWith("10.") || hostname.endsWith(".local");
+}
+var Logger = class {
+  constructor() {
+    this.prefix = "[tenneo-auth-gateway-plugin]";
+  }
+  log(level, message, data) {
+    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+    const logMessage = `${this.prefix} [${timestamp}] [${level.toUpperCase()}] ${message}`;
+    switch (level) {
+      case "info":
+        console.log(logMessage, data || "");
+        break;
+      case "warn":
+        console.warn(logMessage, data || "");
+        break;
+      case "error":
+        console.error(logMessage, data || "");
+        break;
+      case "debug":
+        if (isDev()) {
+          console.debug(logMessage, data || "");
+        }
+        break;
+    }
+  }
+  info(message, data) {
+    this.log("info", message, data);
+  }
+  warn(message, data) {
+    this.log("warn", message, data);
+  }
+  error(message, data) {
+    this.log("error", message, data);
+  }
+  debug(message, data) {
+    this.log("debug", message, data);
+  }
+};
+var logger = new Logger();
+
+// src/domain/errors.ts
+function isLocalhostHostname(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname.startsWith("192.168.") || hostname.startsWith("10.") || hostname.startsWith("172.16.");
+}
+function isDev2() {
+  if (typeof window === "undefined") return false;
+  return isLocalhostHostname(window.location.hostname);
+}
+function enforceHttps(allowLocalhost = true) {
+  if (typeof window === "undefined") return;
+  const isLocalhostWindow = window.location.hostname === "localhost" || window.location.hostname === "127.0.0.1" || window.location.hostname.startsWith("192.168.") || window.location.hostname.startsWith("10.") || window.location.hostname.startsWith("172.16.");
+  const isHttp = window.location.protocol === "http:";
+  if (allowLocalhost && isLocalhostWindow && isHttp) {
+    logger.debug("HTTP allowed on localhost for development");
+    return;
+  }
+  if (isHttp && !isLocalhostWindow) {
+    const error = new Error("HTTPS is required for authentication. Please use HTTPS to access this application.");
+    logger.error("HTTPS enforcement failed", {
+      protocol: window.location.protocol,
+      hostname: window.location.hostname
+    });
+    throw error;
+  }
+  logger.debug("HTTPS check passed", { protocol: window.location.protocol });
+}
+function sanitizeErrorMessage(error, genericMessage) {
+  if (isDev2()) {
+    if (error instanceof Error) return error.message;
+    return String(error);
+  }
+  return genericMessage;
+}
+var SanitizedError = class extends Error {
+  constructor(code, genericMessage, originalError) {
+    super(genericMessage);
+    this.name = "SanitizedError";
+    this.code = code;
+    if (isDev2() && originalError instanceof Error) {
+      this.originalMessage = originalError.message;
+    }
+  }
+};
+
+// src/domain/auth-lifecycle.ts
+function resolveAuthLifecycleState(input) {
+  const {
+    url,
+    getStorage: getStorage3,
+    isCallbackUrl: isCallbackUrl2,
+    hasValidToken,
+    hasToken,
+    hasRefreshToken,
+    isTokenExpired
+  } = input;
+  const forceLogin = getStorage3("force_login") === "true";
+  const callbackProcessed = getStorage3("callback_processed") === "true";
+  const tenantSwitched = getStorage3("tenant_switched") === "true";
+  if (forceLogin) return "FORCE_LOGIN" /* FORCE_LOGIN */;
+  if (isCallbackUrl2(url)) return "PROCESSING_CALLBACK" /* PROCESSING_CALLBACK */;
+  if (hasValidToken) return "AUTHENTICATED" /* AUTHENTICATED */;
+  if (callbackProcessed && !hasToken) return "LOGIN_REQUIRED" /* LOGIN_REQUIRED */;
+  if (hasToken && isTokenExpired && hasRefreshToken) return "TOKEN_EXPIRED" /* TOKEN_EXPIRED */;
+  if (hasToken && isTokenExpired && !hasRefreshToken) return "LOGIN_REQUIRED" /* LOGIN_REQUIRED */;
+  if (tenantSwitched) return "TENANT_SWITCH" /* TENANT_SWITCH */;
+  return "LOGIN_REQUIRED" /* LOGIN_REQUIRED */;
+}
+
+// src/application/lifecycle-state.ts
+var BOOTSTRAP_STALE_MS = 5e3;
+var bootstrapInProgress = false;
+var bootstrapTimestamp = 0;
+var callbackProcessing = false;
+var flowInProgress = false;
+var flowTimestamp = 0;
+function isBootstrapInProgress() {
+  if (!bootstrapInProgress) return false;
+  if (!bootstrapTimestamp) return true;
+  return Date.now() - bootstrapTimestamp < BOOTSTRAP_STALE_MS;
+}
+function setBootstrapInProgress() {
+  bootstrapInProgress = true;
+  bootstrapTimestamp = Date.now();
+}
+function clearBootstrapInProgress() {
+  bootstrapInProgress = false;
+  bootstrapTimestamp = 0;
+}
+function isCallbackProcessing() {
+  return callbackProcessing;
+}
+function setCallbackProcessing() {
+  callbackProcessing = true;
+}
+function clearCallbackProcessing() {
+  callbackProcessing = false;
+}
+function isFlowInProgress() {
+  return flowInProgress;
+}
+function setFlowInProgress() {
+  flowInProgress = true;
+  flowTimestamp = Date.now();
+}
+function clearFlowInProgress() {
+  flowInProgress = false;
+  flowTimestamp = 0;
+}
+function isFlowFlagStale(thresholdMs = 3e3) {
+  if (!flowTimestamp) return true;
+  return Date.now() - flowTimestamp > thresholdMs;
+}
+function clearFlowFlags() {
+  clearFlowInProgress();
+}
+function setFlowFlags() {
+  setFlowInProgress();
+}
+
+// src/strategies/oauth2-pkce/pkce.ts
+function generateCodeVerifier(length = 128) {
+  const array = new Uint8Array(length);
+  crypto.getRandomValues(array);
+  const base64 = btoa(String.fromCharCode(...array));
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+async function generateCodeChallenge(verifier) {
+  try {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(verifier);
+    const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    const base64 = btoa(String.fromCharCode(...hashArray));
+    return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+  } catch {
+    throw new Error("Failed to generate code challenge");
+  }
+}
+function generateState() {
+  const array = new Uint8Array(32);
+  crypto.getRandomValues(array);
+  const base64 = btoa(String.fromCharCode(...array));
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+
+// src/config/env.ts
+var ENV_KEYS = {
+  CLIENT_ID: ["VITE_CLIENT_ID", "CLIENT_ID"],
+  TENANT_ID: ["VITE_TENANT_ID", "TENANT_ID"],
+  CLIENTCODE: ["VITE_CLIENTCODE", "CLIENTCODE"]
+};
+function getEnvValue(keys) {
+  try {
+    const g = typeof globalThis !== "undefined" ? globalThis : null;
+    const env = g?.process && typeof g.process.env === "object" ? g.process.env : null;
+    if (env) {
+      for (const key of keys) {
+        const v = env[key];
+        if (v != null && String(v).trim()) return String(v).trim();
+      }
+    }
+  } catch {
+  }
+  try {
+    const meta = typeof import.meta !== "undefined" ? import.meta.env : void 0;
+    if (meta) {
+      for (const key of keys) {
+        const v = meta[key];
+        if (v != null && String(v).trim()) return String(v).trim();
+      }
+    }
+  } catch {
+  }
+  return "";
+}
+var FORBIDDEN_WINDOW_KEYS = ["apiBaseUrl", "apiTenantResolutionBaseUrl", "apiAuthBaseUrl", "authServerUrl", "defaultDomain", "API_BASE_URL", "AUTH_SERVER_URL", "DEFAULT_DOMAIN"];
+function getWindowConfigRaw() {
+  if (typeof window === "undefined") return null;
+  const w = window;
+  const raw = w.__AUTH_CONFIG__ ?? w.__APP_CONFIG__;
+  if (!raw || typeof raw !== "object") return null;
+  for (const forbidden of FORBIDDEN_WINDOW_KEYS) {
+    if (forbidden in raw) {
+      throw new Error("Attempted to override protected internal configuration");
+    }
+  }
+  const out = {};
+  const map = {
+    clientId: "CLIENT_ID",
+    tenantId: "TENANT_ID",
+    clientcode: "CLIENTCODE"
+  };
+  for (const [winKey, sdkKey] of Object.entries(map)) {
+    const v = raw[winKey];
+    if (v != null && typeof v === "string" && v.trim()) out[sdkKey] = v.trim();
+  }
+  return Object.keys(out).length ? out : null;
+}
+function loadEnvConfig() {
+  const partial = {};
+  for (const [key, envKeys] of Object.entries(ENV_KEYS)) {
+    const v = getEnvValue(envKeys);
+    if (v) partial[key] = v;
+  }
+  return partial;
+}
+function loadWindowConfig() {
+  const raw = getWindowConfigRaw();
+  if (!raw) return null;
+  return raw;
+}
+var schema = z.object({
+  CLIENT_ID: z.string().min(1, "CLIENT_ID is required"),
+  TENANT_ID: z.string().min(1, "TENANT_ID is required"),
+  CLIENTCODE: z.string().min(1, "CLIENTCODE is required")
+});
+function validateConfig(data) {
+  return schema.parse(data);
+}
+
+// src/config/types.ts
+var INTERNAL_CONFIG_KEYS = ["API_TENANT_RESOLUTION_BASE_URL", "API_AUTH_BASE_URL", "AUTH_SERVER_URL", "DEFAULT_DOMAIN"];
+var RUNTIME_CONFIG_KEYS = ["CLIENT_ID", "TENANT_ID", "CLIENTCODE"];
+
+// src/config/constants.ts
+var OAUTH_CONSTANTS = {
+  SCOPES: "openid profile email",
+  RESPONSE_TYPE: "code",
+  CODE_CHALLENGE_METHOD: "S256",
+  TOKEN_GRANT_TYPE: "authorization_code",
+  REFRESH_GRANT_TYPE: "refresh_token"
+};
+var STORAGE_KEY_PREFIX = "tenneo_auth_";
+var STORAGE_KEYS2 = {
+  authServerUrl: `${STORAGE_KEY_PREFIX}auth_server_url`,
+  clientId: `${STORAGE_KEY_PREFIX}client_id`,
+  redirectUri: `${STORAGE_KEY_PREFIX}redirect_uri`,
+  tenantId: `${STORAGE_KEY_PREFIX}tenant_id`,
+  codeVerifier: `${STORAGE_KEY_PREFIX}code_verifier`,
+  state: `${STORAGE_KEY_PREFIX}state`,
+  accessToken: `${STORAGE_KEY_PREFIX}access_token`,
+  refreshToken: `${STORAGE_KEY_PREFIX}refresh_token`,
+  expiresAt: `${STORAGE_KEY_PREFIX}expires_at`
+};
+OAUTH_CONSTANTS.SCOPES;
+var DEFAULT_RESPONSE_TYPE = OAUTH_CONSTANTS.RESPONSE_TYPE;
+var DEFAULT_CODE_CHALLENGE_METHOD = OAUTH_CONSTANTS.CODE_CHALLENGE_METHOD;
+var DEFAULT_TOKEN_GRANT_TYPE = OAUTH_CONSTANTS.TOKEN_GRANT_TYPE;
+var DEFAULT_REFRESH_GRANT_TYPE = OAUTH_CONSTANTS.REFRESH_GRANT_TYPE;
+
+// src/config/index.ts
+var INTERNAL_DEFAULTS = {
+  API_TENANT_RESOLUTION_BASE_URL: "https://localhost:5020/api/v1",
+  API_AUTH_BASE_URL: "https://localhost:5001",
+  AUTH_SERVER_URL: "https://localhost:5001",
+  DEFAULT_DOMAIN: "https://localhost:5001"
+};
+function envOr(key) {
+  const v = getEnvValue([`VITE_${key}`, key]);
+  return v && v.trim() ? v.trim() : INTERNAL_DEFAULTS[key];
+}
+var INTERNAL_CONFIG = Object.freeze({
+  API_TENANT_RESOLUTION_BASE_URL: envOr("API_TENANT_RESOLUTION_BASE_URL"),
+  API_AUTH_BASE_URL: envOr("API_AUTH_BASE_URL"),
+  AUTH_SERVER_URL: envOr("AUTH_SERVER_URL"),
+  DEFAULT_DOMAIN: envOr("DEFAULT_DOMAIN")
+});
+var RUNTIME_CONFIG_DEFAULTS = Object.freeze({
+  CLIENT_ID: "tenneo",
+  TENANT_ID: "00000000-0000-0000-0000-000000000001",
+  CLIENTCODE: "productlms"
+});
+function pickRuntimeConfig(source) {
+  if (!source) return {};
+  const picked = {};
+  for (const key of RUNTIME_CONFIG_KEYS) {
+    const value = source[key];
+    if (value != null && typeof value === "string") {
+      const trimmed = value.trim();
+      if (trimmed) picked[key] = trimmed;
+    }
+  }
+  return picked;
+}
+({
+  ...INTERNAL_CONFIG,
+  ...RUNTIME_CONFIG_DEFAULTS
+});
+var runtimeOverrides = {};
+var runtimeConfigOverrides = {};
+function mergeRuntime(base, ...sources) {
+  let out = { ...base };
+  for (const src of sources) {
+    if (!src) continue;
+    for (const key of Object.keys(src)) {
+      const value = src[key];
+      if (value != null && String(value).trim() !== "") out[key] = String(value).trim();
+    }
+  }
+  return out;
+}
+function assertNoInternalOverrides(source) {
+  if (!source) return;
+  for (const key of INTERNAL_CONFIG_KEYS) {
+    if (source[key] !== void 0) throw new Error("Attempted to override protected internal configuration");
+  }
+}
+var INTERNAL_KEY_SET = new Set(INTERNAL_CONFIG_KEYS);
+var HOST_TO_RUNTIME_KEYS = {
+  clientId: "CLIENT_ID",
+  tenantId: "TENANT_ID",
+  clientcode: "CLIENTCODE"
+};
+function sanitizeRuntimeOverrides(source) {
+  if (!source) return void 0;
+  const filtered = {};
+  for (const [key, raw] of Object.entries(source)) {
+    if (raw == null) continue;
+    if (INTERNAL_KEY_SET.has(key)) continue;
+    const trimmed = String(raw).trim();
+    if (!trimmed) continue;
+    const sdkKey = HOST_TO_RUNTIME_KEYS[key] ?? key;
+    filtered[sdkKey] = trimmed;
+  }
+  const picked = pickRuntimeConfig(filtered);
+  return Object.keys(picked).length ? picked : void 0;
+}
+function resolveConfig(overrides) {
+  assertNoInternalOverrides(runtimeOverrides);
+  assertNoInternalOverrides(overrides);
+  const windowCfg = loadWindowConfig();
+  const envCfg = loadEnvConfig();
+  const mergedRuntime = mergeRuntime(
+    RUNTIME_CONFIG_DEFAULTS,
+    envCfg,
+    windowCfg ?? void 0,
+    runtimeOverrides,
+    sanitizeRuntimeOverrides(overrides)
+  );
+  const validatedRuntime = validateConfig(mergedRuntime);
+  return { ...INTERNAL_CONFIG, ...validatedRuntime };
+}
+function getConfig() {
+  return resolveConfig();
+}
+function setConfig(overrides) {
+  assertNoInternalOverrides(overrides);
+  const sanitized = sanitizeRuntimeOverrides(overrides);
+  if (sanitized) runtimeOverrides = { ...runtimeOverrides, ...sanitized };
+  const { basePath, redirectUri } = overrides;
+  if (basePath != null && basePath.trim() !== "") runtimeConfigOverrides = { ...runtimeConfigOverrides, basePath: basePath.trim() };
+  if (redirectUri != null && redirectUri.trim() !== "") runtimeConfigOverrides = { ...runtimeConfigOverrides, redirectUri: redirectUri.trim() };
+}
+function clearConfigOverrides() {
+  runtimeOverrides = {};
+  runtimeConfigOverrides = {};
+}
+function getWindowBasePath() {
+  if (typeof window === "undefined") return "";
+  const w = window;
+  const raw = w.__AUTH_CONFIG__ ?? w.__APP_CONFIG__;
+  const bp = raw?.basePath;
+  if (bp != null && typeof bp === "string" && bp.trim()) return bp.trim();
+  const pathname = window.location.pathname;
+  const segments = pathname.split("/").filter(Boolean);
+  const commonRoutes = ["dashboards", "callback", "confirmation", "client-confirmed", "client-provisioned", "approval-completed"];
+  if (segments.length > 0 && !commonRoutes.includes(segments[0])) {
+    let base = "/" + segments[0];
+    if (base.endsWith("/")) base = base.slice(0, -1);
+    return base;
+  }
+  return "";
+}
+function getBasePath() {
+  if (runtimeConfigOverrides.basePath != null && runtimeConfigOverrides.basePath !== "") return runtimeConfigOverrides.basePath;
+  return getWindowBasePath();
+}
+function getRedirectUri2() {
+  if (typeof window !== "undefined") {
+    return `${window.location.origin}/callback`;
+  }
+  return getEnvValue(["VITE_REDIRECT_URI", "REDIRECT_URI"]) || "http://localhost:5173/callback";
+}
+function hasRuntimeConfig() {
+  return loadWindowConfig() !== null || Object.keys(runtimeOverrides).length > 0;
+}
+var Config = {
+  getApiTenantResolutionBaseUrl() {
+    return getConfig().API_TENANT_RESOLUTION_BASE_URL;
+  },
+  getApiAuthBaseUrl() {
+    return getConfig().API_AUTH_BASE_URL;
+  },
+  getAuthServerUrl() {
+    return getConfig().AUTH_SERVER_URL;
+  },
+  getDefaultDomain() {
+    return getConfig().DEFAULT_DOMAIN;
+  },
+  getClientId() {
+    return getConfig().CLIENT_ID;
+  },
+  getTenantId() {
+    return getConfig().TENANT_ID;
+  },
+  getClientCode() {
+    return getConfig().CLIENTCODE;
+  },
+  getRedirectUri() {
+    return getRedirectUri2();
+  },
+  getBasePath() {
+    return getBasePath();
+  },
+  hasRuntimeConfig() {
+    return hasRuntimeConfig();
+  },
+  getAll() {
+    const c = getConfig();
+    return {
+      apiTenantResolutionBaseUrl: c.API_TENANT_RESOLUTION_BASE_URL,
+      apiAuthBaseUrl: c.API_AUTH_BASE_URL,
+      authServerUrl: c.AUTH_SERVER_URL,
+      defaultDomain: c.DEFAULT_DOMAIN,
+      clientId: c.CLIENT_ID,
+      tenantId: c.TENANT_ID,
+      clientCode: c.CLIENTCODE,
+      redirectUri: getRedirectUri2(),
+      basePath: getBasePath()
+    };
+  }
+};
+({
+  AUTH_SERVER_URL: Config.getAuthServerUrl(),
+  CLIENT_ID: Config.getClientId(),
+  TENANT_ID: Config.getTenantId(),
+  CLIENTCODE: Config.getClientCode()
+});
+function getEnvConfig() {
+  const authServerUrl = Config.getAuthServerUrl();
+  const clientId = Config.getClientId();
+  const tenantId = Config.getTenantId();
+  const redirectUri = Config.getRedirectUri();
+  try {
+    new URL(authServerUrl);
+    new URL(redirectUri);
+  } catch {
+    return Promise.resolve(null);
+  }
+  return Promise.resolve({
+    authServerUrl: authServerUrl.trim(),
+    clientId: clientId.trim(),
+    redirectUri: redirectUri.trim(),
+    tenantId: tenantId.trim()
+  });
+}
+function getEnvConfigSync() {
+  const authServerUrl = Config.getAuthServerUrl();
+  const clientId = Config.getClientId();
+  const tenantId = Config.getTenantId();
+  const redirectUri = Config.getRedirectUri();
+  try {
+    new URL(authServerUrl);
+    new URL(redirectUri);
+  } catch {
+    return null;
+  }
+  return {
+    authServerUrl: authServerUrl.trim(),
+    clientId: clientId.trim(),
+    redirectUri: redirectUri.trim(),
+    tenantId: tenantId.trim()
+  };
+}
+function hasEnvFallback() {
+  return getEnvConfigSync() !== null;
+}
+
+// src/utils/validation.ts
+function isValidGuid(guid) {
+  if (!guid || typeof guid !== "string") {
+    return false;
+  }
+  const guidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  return guidRegex.test(guid.trim());
+}
+function validateTenantId(tenantId) {
+  if (!tenantId || tenantId.trim() === "") {
+    return {
+      isValid: false,
+      error: "Tenant ID is required"
+    };
+  }
+  if (!isValidGuid(tenantId)) {
+    return {
+      isValid: false,
+      error: "Tenant ID must be a valid GUID format (00000000-0000-0000-0000-000000000001)"
+    };
+  }
+  return { isValid: true };
+}
+
+// src/application/domain-facade.ts
+function isLocalhost2() {
+  const runtime = getAuthRuntime();
+  const hostname = runtime ? runtime.urlProvider.getCurrentUrl().hostname : typeof window !== "undefined" ? window.location.hostname : "";
+  return isLocalhost(hostname);
+}
+function extractTenantKey() {
+  const runtime = getAuthRuntime();
+  if (runtime) {
+    const url = runtime.urlProvider.getCurrentUrl();
+    return extractTenantKeyFromUrl(url, runtime.configProvider, getStorage, getStorageKey);
+  }
+  return extractTenantKeyLegacy();
+}
+function extractTenantKeyLegacy() {
+  if (typeof window === "undefined") return Config.getClientCode();
+  try {
+    const propsConfigStr = getStorage(getStorageKey("props_config"));
+    if (propsConfigStr) {
+      const propsConfig = JSON.parse(propsConfigStr);
+      if (propsConfig.tenantKey?.trim()) return propsConfig.tenantKey.trim();
+    }
+    const stored = getStorage(getStorageKey("tenant_key"));
+    if (stored?.trim()) return stored.trim();
+    const urlParams = new URLSearchParams(window.location.search);
+    const t = urlParams.get("t");
+    if (t?.trim()) return t.trim();
+    const hostname = window.location.hostname;
+    const parts = hostname.split(".");
+    if (parts.length >= 2 && parts[0] && parts[0].toLowerCase() !== "productlms") return parts[0].trim();
+    return Config.getClientCode();
+  } catch {
+    return Config.getClientCode();
+  }
+}
+function isCallbackUrl() {
+  const runtime = getAuthRuntime();
+  if (runtime) return isCallbackUrlFromUrl(runtime.urlProvider.getCurrentUrl());
+  if (typeof window === "undefined") return false;
+  const params = new URLSearchParams(window.location.search);
+  return params.has("code") && params.has("state");
+}
+
+// src/application/events/AuthEvents.ts
+var AuthEventNames = {
+  LOGIN_STARTED: "LOGIN_STARTED",
+  LOGIN_SUCCESS: "LOGIN_SUCCESS",
+  LOGIN_FAILED: "LOGIN_FAILED",
+  CALLBACK_SUCCESS: "CALLBACK_SUCCESS",
+  CALLBACK_FAILED: "CALLBACK_FAILED",
+  TOKEN_REFRESH_SUCCESS: "TOKEN_REFRESH_SUCCESS",
+  TOKEN_REFRESH_FAILED: "TOKEN_REFRESH_FAILED",
+  TENANT_SWITCHED: "TENANT_SWITCHED",
+  LOGOUT_COMPLETED: "LOGOUT_COMPLETED",
+  BOOTSTRAP_STATE_DETECTED: "BOOTSTRAP_STATE_DETECTED",
+  REDIRECT_LOOP_RISK: "REDIRECT_LOOP_RISK"
+};
+var listeners = /* @__PURE__ */ new Map();
+function getHandlers(event) {
+  let set = listeners.get(event);
+  if (!set) {
+    set = /* @__PURE__ */ new Set();
+    listeners.set(event, set);
+  }
+  return set;
+}
+function getWildcardHandlers() {
+  let set = listeners.get("*");
+  if (!set) {
+    set = /* @__PURE__ */ new Set();
+    listeners.set("*", set);
+  }
+  return set;
+}
+function emitAuthEvent(event, payload) {
+  const handlers = getHandlers(event);
+  const wildcard = getWildcardHandlers();
+  const p = payload ?? {};
+  handlers.forEach((fn) => {
+    try {
+      fn(p);
+    } catch {
+    }
+  });
+  wildcard.forEach((fn) => {
+    try {
+      fn({ ...p, event });
+    } catch {
+    }
+  });
+}
+function subscribeAuthEvent(event, handler) {
+  const set = event === "*" ? getWildcardHandlers() : getHandlers(event);
+  set.add(handler);
+  return () => set.delete(handler);
+}
+
+// src/application/security/redirectLoopGuard.ts
+var DEFAULT_MAX_REDIRECTS = 5;
+var WINDOW_MS = 60 * 1e3;
+var redirectCount = 0;
+var firstRedirectAt = 0;
+function resetRedirectLoopGuard() {
+  redirectCount = 0;
+  firstRedirectAt = 0;
+}
+function checkAndIncrementRedirect(maxAttempts = DEFAULT_MAX_REDIRECTS) {
+  const now = Date.now();
+  if (now - firstRedirectAt > WINDOW_MS) {
+    redirectCount = 0;
+    firstRedirectAt = now;
+  }
+  if (redirectCount >= maxAttempts) {
+    emitAuthEvent(AuthEventNames.REDIRECT_LOOP_RISK, {
+      message: `Redirect attempt limit (${maxAttempts}) exceeded`
+    });
+    return false;
+  }
+  redirectCount++;
+  return true;
+}
+
+// src/strategies/oauth2-pkce/oauth.ts
+function storeTenantConfig(config) {
+  const validation = validateTenantId(config.tenantId);
+  if (!validation.isValid) {
+    logger.warn("Tenant ID validation failed", { tenantId: config.tenantId });
+  }
+  setStorage(STORAGE_KEYS.authServerUrl, config.authServer);
+  setStorage(STORAGE_KEYS.clientId, config.client.clientId);
+  setStorage(STORAGE_KEYS.redirectUri, Config.getRedirectUri());
+  setStorage(STORAGE_KEYS.tenantId, config.tenantId);
+  if (config.tenantKey) {
+    setStorage(STORAGE_KEYS.tenantKey, config.tenantKey);
+  }
+}
+async function initiateAuthFlow(config) {
+  try {
+    logger.info("Initiating OAuth authorization flow");
+    const token = getAccessToken();
+    if (token && !isAccessTokenExpired()) {
+      logger.debug("Valid token already exists, skipping auth flow");
+      clearFlowFlags();
+      return;
+    }
+    if (isCallbackUrl()) {
+      logger.debug("Callback URL detected - clearing flow flag to allow callback processing");
+      clearFlowFlags();
+      return;
+    }
+    if (isFlowInProgress()) {
+      if (isFlowFlagStale(3e3)) {
+        logger.info("Stale auth flow flag detected, clearing and proceeding");
+        clearFlowFlags();
+      } else {
+        logger.debug("Auth flow already in progress (recent), skipping duplicate redirect");
+        return;
+      }
+    }
+    setFlowFlags();
+    if (!config?.authServer || !config.client?.clientId || !config.client?.redirectUri) {
+      throw new Error("Invalid tenant configuration for auth flow");
+    }
+    storeTenantConfig(config);
+    const codeVerifier = generateCodeVerifier();
+    const codeChallenge = await generateCodeChallenge(codeVerifier);
+    const state = generateState();
+    removeStorage(STORAGE_KEYS.codeVerifier);
+    removeStorage(STORAGE_KEYS.state);
+    setStorage(STORAGE_KEYS.codeVerifier, codeVerifier);
+    setStorage(STORAGE_KEYS.state, state);
+    const authUrl = buildAuthorizationUrl(config, codeChallenge, state);
+    if (!authUrl || !(authUrl.startsWith("http://") || authUrl.startsWith("https://"))) {
+      throw new Error("Invalid authorization URL generated");
+    }
+    if (!checkAndIncrementRedirect()) {
+      logger.warn("Redirect loop protection: max redirect attempts exceeded");
+      clearFlowFlags();
+      return;
+    }
+    logger.info("Redirecting to authorization server");
+    emitAuthEvent(AuthEventNames.LOGIN_STARTED, { tenantKey: config.tenantKey });
+    const runtime = getAuthRuntime();
+    if (runtime) runtime.urlProvider.redirect(authUrl);
+    else if (typeof window !== "undefined") window.location.replace(authUrl);
+  } catch (error) {
+    clearFlowFlags();
+    logger.error("Failed to initiate auth flow", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+    throw error;
+  }
+}
+function buildAuthorizationUrl(config, codeChallenge, state) {
+  if (isLocalhost2()) {
+    logger.debug("Building authorization URL", {
+      authServer: config.authServer,
+      clientId: config.client.clientId,
+      redirectUri: config.client.redirectUri,
+      scopes: config.client.scopes
+    });
+  }
+  const storedTenantId = getStorage(STORAGE_KEYS.tenantId);
+  const storedClientId = getStorage(STORAGE_KEYS.clientId);
+  const tenantIdToUse = storedTenantId || config.tenantId;
+  const clientIdToUse = storedClientId || config.client.clientId;
+  const redirectUriToUse = Config.getRedirectUri();
+  const params = new URLSearchParams({
+    client_id: `public-${clientIdToUse}`,
+    tenant_id: tenantIdToUse,
+    redirect_uri: redirectUriToUse,
+    response_type: DEFAULT_RESPONSE_TYPE,
+    scope: config.client.scopes,
+    state,
+    code_challenge: codeChallenge,
+    code_challenge_method: DEFAULT_CODE_CHALLENGE_METHOD
+  });
+  return `${config.authServer}/connect/authorize?${params.toString()}`;
+}
+
+// src/strategies/oauth2-pkce/token-exchange.ts
+function storeTokens(tokenData) {
+  const expiresIn = tokenData.expires_in || 3600;
+  const expiresAt = Date.now() + expiresIn * 1e3;
+  const adapter = getStorageAdapter();
+  if (adapter?.setTokensSync) {
+    adapter.setTokensSync({
+      accessToken: tokenData.access_token,
+      refreshToken: tokenData.refresh_token,
+      expiresAt
+    });
+  }
+  setStorage(STORAGE_KEYS.accessToken, tokenData.access_token);
+  setStorage(STORAGE_KEYS.refreshToken, tokenData.refresh_token);
+  setStorage(STORAGE_KEYS.expiresAt, expiresAt.toString());
+  if (isLocalhost2()) {
+    logger.debug("Tokens stored successfully", {
+      expiresAt: new Date(expiresAt).toISOString(),
+      expiresIn
+    });
+  } else {
+    logger.info("Tokens stored successfully");
+  }
+}
+async function exchangeCodeForTokens(params) {
+  try {
+    const { code, codeVerifier, clientId, redirectUri } = params;
+    const apiAuthBaseUrl = Config.getApiAuthBaseUrl();
+    const tokenUrl = `${apiAuthBaseUrl}/oauth/token`;
+    const body = new URLSearchParams({
+      grant_type: DEFAULT_TOKEN_GRANT_TYPE,
+      code,
+      client_id: `public-${clientId}`,
+      redirect_uri: redirectUri,
+      code_verifier: codeVerifier
+    });
+    const response = await fetch(tokenUrl, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body: body.toString()
+    });
+    if (!response.ok) {
+      const responseData = await response.json().catch(() => ({}));
+      logger.error("Token exchange failed", {
+        status: response.status,
+        statusText: response.statusText,
+        responseData,
+        requestUrl: tokenUrl
+      });
+      throw new Error(
+        `Token exchange failed: ${response.status} ${response.statusText}${Object.keys(responseData).length ? ` - ${JSON.stringify(responseData)}` : ""}`
+      );
+    }
+    const tokenData = await response.json();
+    if (!tokenData.access_token || !tokenData.refresh_token || !tokenData.expires_in) {
+      logger.error("Invalid token response received");
+      throw new Error("Invalid token response");
+    }
+    storeTokens(tokenData);
+    return tokenData;
+  } catch (error) {
+    const isAborted = error instanceof Error && error.name === "AbortError";
+    if (isAborted) {
+      logger.warn("Token exchange request canceled (likely due to navigation or component unmount)");
+      const existingToken = getAccessToken();
+      if (existingToken && !isAccessTokenExpired()) {
+        return {
+          access_token: existingToken,
+          refresh_token: getRefreshToken() || "",
+          expires_in: 3600
+        };
+      }
+      throw new Error("Token exchange request was canceled");
+    }
+    logger.error("Token exchange failed", {
+      message: error instanceof Error ? error.message : String(error)
+    });
+    throw error;
+  }
+}
+var refreshPromise = null;
+async function refreshAccessToken() {
+  if (refreshPromise) return refreshPromise;
+  refreshPromise = (async () => {
+    try {
+      const refreshToken = getRefreshToken();
+      const clientId = getClientId();
+      const tenantId = getTenantId();
+      if (!refreshToken || !clientId || !tenantId) {
+        logger.error("Token refresh failed: missing required data");
+        throw new Error("Cannot refresh token: missing required data");
+      }
+      const apiAuthBaseUrl = Config.getApiAuthBaseUrl();
+      const tokenUrl = `${apiAuthBaseUrl}/oauth/refresh`;
+      const body = new URLSearchParams({
+        grant_type: DEFAULT_REFRESH_GRANT_TYPE,
+        refresh_token: refreshToken,
+        client_id: clientId.startsWith("public-") ? clientId : `public-${clientId}`
+      });
+      const response = await fetch(tokenUrl, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/x-www-form-urlencoded",
+          "__tenant": tenantId,
+          "Accept": "*/*"
+        },
+        body: body.toString()
+      });
+      if (!response.ok) {
+        const responseData = await response.json().catch(() => ({}));
+        const isExpiredOrInvalidGrant = response.status === 401 || responseData?.error === "invalid_grant" || typeof responseData?.error_description === "string" && (responseData.error_description.includes("expired") || responseData.error_description.includes("invalid"));
+        if (isExpiredOrInvalidGrant) {
+          removeStorage(STORAGE_KEYS.refreshToken);
+          removeStorage(STORAGE_KEYS.accessToken);
+          removeStorage(STORAGE_KEYS.expiresAt);
+          emitAuthEvent(AuthEventNames.TOKEN_REFRESH_FAILED, {
+            error: "Refresh token expired or invalid",
+            message: String(responseData?.error_description ?? responseData?.error ?? "Token refresh failed")
+          });
+        }
+        logger.error("Token refresh failed", {
+          status: response.status,
+          statusText: response.statusText,
+          responseData,
+          requestUrl: tokenUrl
+        });
+        throw new Error(
+          `Token refresh failed: ${response.status} ${response.statusText}${Object.keys(responseData).length ? ` - ${JSON.stringify(responseData)}` : ""}`
+        );
+      }
+      const tokenData = await response.json();
+      if (!tokenData.access_token || !tokenData.refresh_token) {
+        logger.error("Invalid refresh token response received");
+        throw new Error("Invalid refresh token response");
+      }
+      storeTokens(tokenData);
+      emitAuthEvent(AuthEventNames.TOKEN_REFRESH_SUCCESS);
+      return tokenData.access_token;
+    } catch (error) {
+      if (error instanceof Error) {
+        logger.error("Token refresh failed", { message: error.message });
+        emitAuthEvent(AuthEventNames.TOKEN_REFRESH_FAILED, { error: error.message });
+      }
+      throw error;
+    } finally {
+      refreshPromise = null;
+    }
+  })();
+  return refreshPromise;
+}
+function isProcessed() {
+  return getStorage(getStorageKey("callback_processed")) === "true";
+}
+function isProcessing() {
+  return isCallbackProcessing();
+}
+function markProcessing() {
+  setCallbackProcessing();
+}
+function markProcessed() {
+  setStorage(getStorageKey("callback_processed"), "true");
+  clearCallbackProcessing();
+}
+function clearProcessing() {
+  clearCallbackProcessing();
+  removeStorage(getStorageKey("callback_processed"));
+}
+var urlCleaned = false;
+function cleanUrl() {
+  if (urlCleaned) return;
+  if (isProcessing()) return;
+  const runtime = getAuthRuntime();
+  const clean = runtime ? `${runtime.urlProvider.getCurrentUrl().origin}${runtime.urlProvider.getCurrentUrl().pathname}` : typeof window !== "undefined" ? `${window.location.origin}${window.location.pathname}` : "/";
+  if (runtime) runtime.urlProvider.redirect(clean);
+  else if (typeof window !== "undefined") window.location.replace(clean);
+  urlCleaned = true;
+}
+function cleanUrlSoft() {
+  if (urlCleaned) return;
+  if (isProcessing()) return;
+  const runtime = getAuthRuntime();
+  const clean = runtime ? `${runtime.urlProvider.getCurrentUrl().origin}${runtime.urlProvider.getCurrentUrl().pathname}` : typeof window !== "undefined" ? `${window.location.origin}${window.location.pathname}` : "/";
+  if (runtime) runtime.urlProvider.replaceState(clean);
+  else if (typeof window !== "undefined") window.history.replaceState({}, typeof document !== "undefined" ? document.title : "", clean);
+  urlCleaned = true;
+}
+function clearAllAuthFlags() {
+  removeStorage(getStorageKey("force_login"));
+  removeStorage(getStorageKey("logout_in_progress"));
+  clearFlowFlags();
+}
+async function handleCallback() {
+  if (isProcessed()) {
+    logger.debug("Callback already processed in this session - preventing duplicate processing");
+    if (isCallbackUrl()) {
+      if (!isProcessing()) cleanUrlSoft();
+    }
+    clearFlowFlags();
+    return true;
+  }
+  if (isProcessing()) {
+    logger.debug("Callback processing already in progress - waiting for completion");
+    return true;
+  }
+  if (getStorage(getStorageKey("force_login")) === "true") {
+    logger.info("Force-login flag present \u2192 callback skipped (logout occurred)");
+    const runtime = getAuthRuntime();
+    if (runtime && runtime.urlProvider.getCurrentUrl().search) cleanUrlSoft();
+    else if (typeof window !== "undefined" && window.location.search) cleanUrlSoft();
+    clearAllAuthFlags();
+    clearProcessing();
+    return false;
+  }
+  const storedTenantKey = getTenantKey();
+  let currentTenantKey = null;
+  try {
+    const propsConfigStr = getStorage(getStorageKey("props_config"));
+    if (propsConfigStr) {
+      const propsConfig = JSON.parse(propsConfigStr);
+      currentTenantKey = propsConfig.tenantKey || null;
+    }
+  } catch {
+  }
+  if (!currentTenantKey) currentTenantKey = storedTenantKey;
+  if (currentTenantKey && storedTenantKey && currentTenantKey !== storedTenantKey) {
+    logger.info("TenantKey changed - bypassing callback, starting fresh login");
+    clearAllStorage();
+    clearAllAuthFlags();
+    clearProcessing();
+    setStorage(getStorageKey("tenant_switched"), "true");
+    setStorage(getStorageKey("new_tenant_key"), currentTenantKey);
+    setTenantKey(currentTenantKey);
+    if (isCallbackUrl()) cleanUrlSoft();
+    return false;
+  }
+  if (!isCallbackUrl()) return false;
+  markProcessing();
+  clearFlowFlags();
+  urlCleaned = false;
+  try {
+    const search = getAuthRuntime()?.urlProvider.getCurrentUrl().search ?? (typeof window !== "undefined" ? window.location.search : "");
+    const params = new URLSearchParams(search);
+    const code = params.get("code");
+    const state = params.get("state");
+    const error = params.get("error");
+    if (error || !code || !state) {
+      logger.error("Invalid OAuth callback params", { error, code, state });
+      clearAllAuthFlags();
+      clearProcessing();
+      markProcessed();
+      cleanUrlSoft();
+      return false;
+    }
+    const storedState = getState();
+    if (!storedState || storedState !== state) {
+      const currentTenantKeyFromUrl = extractTenantKey();
+      let storedTenantKeyFromProps = null;
+      try {
+        const propsConfigStr = getStorage(getStorageKey("props_config"));
+        if (propsConfigStr) {
+          const propsConfig = JSON.parse(propsConfigStr);
+          storedTenantKeyFromProps = propsConfig.tenantKey || null;
+        }
+      } catch {
+      }
+      const tenantKeyChanged = currentTenantKeyFromUrl && storedTenantKeyFromProps && currentTenantKeyFromUrl !== storedTenantKeyFromProps;
+      if (tenantKeyChanged) {
+        logger.info("OAuth state mismatch due to tenantKey change - expected behavior, starting fresh login");
+      } else {
+        logger.error("OAuth state mismatch - redirecting to login");
+      }
+      clearAllAuthFlags();
+      clearProcessing();
+      markProcessed();
+      cleanUrlSoft();
+      setStorage(getStorageKey("state_mismatch"), "true");
+      return false;
+    }
+    const codeVerifier = getCodeVerifier();
+    if (!codeVerifier) {
+      logger.error("Missing PKCE verifier");
+      clearAllAuthFlags();
+      clearProcessing();
+      markProcessed();
+      cleanUrlSoft();
+      return false;
+    }
+    const clientId = getClientId();
+    const redirectUri = getRedirectUri();
+    const tenantId = getTenantId();
+    if (!clientId || !redirectUri || !tenantId) {
+      logger.error("Missing OAuth config during callback");
+      clearAllAuthFlags();
+      clearProcessing();
+      markProcessed();
+      cleanUrlSoft();
+      return false;
+    }
+    const existingToken = getAccessToken();
+    if (existingToken && !isAccessTokenExpired()) {
+      logger.debug("Valid token already exists - skipping code exchange");
+      removeStorage(STORAGE_KEYS.codeVerifier);
+      removeStorage(STORAGE_KEYS.state);
+      clearAllAuthFlags();
+      markProcessed();
+      cleanUrl();
+      resetRedirectLoopGuard();
+      emitAuthEvent(AuthEventNames.CALLBACK_SUCCESS);
+      return true;
+    }
+    const tokenData = await exchangeCodeForTokens({
+      code,
+      codeVerifier,
+      clientId,
+      redirectUri,
+      tenantId
+    });
+    if (!tokenData?.access_token) {
+      logger.error("Token exchange returned no access token");
+      clearProcessing();
+      clearAllAuthFlags();
+      cleanUrlSoft();
+      emitAuthEvent(AuthEventNames.CALLBACK_FAILED, { message: "No access token returned" });
+      return false;
+    }
+    removeStorage(STORAGE_KEYS.codeVerifier);
+    removeStorage(STORAGE_KEYS.state);
+    clearAllAuthFlags();
+    markProcessed();
+    cleanUrl();
+    logger.info("OAuth callback processed successfully");
+    resetRedirectLoopGuard();
+    emitAuthEvent(AuthEventNames.CALLBACK_SUCCESS);
+    return true;
+  } catch (err) {
+    if (axios.isAxiosError(err)) {
+      const status = err.response?.status;
+      const responseData = err.response?.data;
+      const errorCode = responseData?.error;
+      const errorDescription = responseData?.error_description || responseData?.details || "";
+      if (status === 400 && errorCode === "invalid_grant" && (String(errorDescription).includes("already used") || String(errorDescription).includes("Code not found") || String(errorDescription).includes("expired, already used"))) {
+        const existingToken2 = getAccessToken();
+        const tokenValid2 = existingToken2 && !isAccessTokenExpired();
+        if (tokenValid2) {
+          removeStorage(STORAGE_KEYS.codeVerifier);
+          removeStorage(STORAGE_KEYS.state);
+          clearAllAuthFlags();
+          markProcessed();
+          cleanUrlSoft();
+          logger.info("OAuth callback processed successfully (code already used, but token exists)");
+          resetRedirectLoopGuard();
+          emitAuthEvent(AuthEventNames.CALLBACK_SUCCESS);
+          return true;
+        }
+      }
+      emitAuthEvent(AuthEventNames.CALLBACK_FAILED, {
+        error: err.message,
+        message: responseData?.error_description ?? err.message
+      });
+      logger.error("OAuth callback failed (Axios error)", {
+        status,
+        statusText: err.response?.statusText,
+        responseData: err.response?.data,
+        message: err.message,
+        url: err.config?.url
+      });
+    } else {
+      logger.error("OAuth callback failed", {
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+    clearAllAuthFlags();
+    const existingToken = getAccessToken();
+    const tokenValid = existingToken && !isAccessTokenExpired();
+    if (tokenValid) {
+      markProcessed();
+      cleanUrlSoft();
+      resetRedirectLoopGuard();
+      emitAuthEvent(AuthEventNames.CALLBACK_SUCCESS);
+      return true;
+    }
+    emitAuthEvent(AuthEventNames.CALLBACK_FAILED, {
+      error: err instanceof Error ? err.message : String(err)
+    });
+    clearProcessing();
+    if (isCallbackUrl()) cleanUrlSoft();
+    return false;
+  }
+}
+
+// src/infrastructure/tenant/TenantConfigCache.ts
+var DEFAULT_TTL_MS = 5 * 60 * 1e3;
+var TenantConfigCache = class {
+  constructor(ttlMs = DEFAULT_TTL_MS) {
+    this.cache = /* @__PURE__ */ new Map();
+    this.inFlight = /* @__PURE__ */ new Map();
+    this.ttlMs = ttlMs;
+  }
+  get(tenantKey) {
+    const entry = this.cache.get(tenantKey);
+    if (!entry) return null;
+    if (Date.now() >= entry.expiresAt) {
+      this.cache.delete(tenantKey);
+      return null;
+    }
+    return entry.config;
+  }
+  set(tenantKey, config) {
+    this.cache.set(tenantKey, {
+      config,
+      expiresAt: Date.now() + this.ttlMs
+    });
+  }
+  invalidate(tenantKey) {
+    if (tenantKey) {
+      this.cache.delete(tenantKey);
+      this.inFlight.delete(tenantKey);
+    } else {
+      this.cache.clear();
+      this.inFlight.clear();
+    }
+  }
+  async getOrResolve(tenantKey, resolver) {
+    if (!tenantKey || !tenantKey.trim()) return null;
+    const key = tenantKey.trim();
+    const cached = this.get(key);
+    if (cached) {
+      logger.debug("Tenant config from cache", { tenantKey: key });
+      return cached;
+    }
+    const existing = this.inFlight.get(key);
+    if (existing) {
+      logger.debug("Tenant resolution reused (in-flight)", { tenantKey: key });
+      return existing;
+    }
+    const promise = (async () => {
+      try {
+        const config = await resolver(key);
+        if (config) this.set(key, config);
+        return config;
+      } finally {
+        this.inFlight.delete(key);
+      }
+    })();
+    this.inFlight.set(key, promise);
+    return promise;
+  }
+};
+
+// src/infrastructure/tenant/tenantResolution.ts
+var defaultTenantConfigCache = new TenantConfigCache();
+function getTenantKeyFromRuntime(url, config) {
+  try {
+    const propsConfigStr = getStorage(getStorageKey("props_config"));
+    if (propsConfigStr) {
+      const propsConfig = JSON.parse(propsConfigStr);
+      if (propsConfig.tenantKey?.trim()) return propsConfig.tenantKey.trim();
+      return null;
+    }
+  } catch {
+  }
+  return extractTenantKeyFromUrl(url, config, getStorage, getStorageKey);
+}
+function getPropsConfig() {
+  try {
+    const propsConfigStr = getStorage(getStorageKey("props_config"));
+    if (!propsConfigStr) return null;
+    const parsed = JSON.parse(propsConfigStr);
+    if (parsed && typeof parsed === "object" && "authServerUrl" in parsed) {
+      delete parsed.authServerUrl;
+    }
+    return parsed;
+  } catch {
+    removeStorage(getStorageKey("props_config"));
+    return null;
+  }
+}
+function mergeConfigWithProps(apiEnvConfig, propsConfig, tenantKey) {
+  return {
+    tenantId: propsConfig.tenantId || apiEnvConfig.tenantId,
+    authServer: apiEnvConfig.authServer,
+    tenantKey: tenantKey || apiEnvConfig.tenantKey,
+    client: {
+      clientId: propsConfig.clientId || apiEnvConfig.client.clientId,
+      redirectUri: apiEnvConfig.client.redirectUri,
+      scopes: apiEnvConfig.client.scopes
+    }
+  };
+}
+async function buildTenantConfigFromEnv() {
+  const envConfig = await getEnvConfig();
+  if (!envConfig) return null;
+  return {
+    tenantId: envConfig.tenantId,
+    authServer: envConfig.authServerUrl,
+    client: {
+      clientId: envConfig.clientId,
+      redirectUri: envConfig.redirectUri,
+      scopes: "openid profile email"
+    }
+  };
+}
+async function resolveTenantConfig(tenantKey, tenantResolver) {
+  if (!tenantKey) return null;
+  const propsConfig = getPropsConfig();
+  let apiEnvConfig = null;
+  let apiResolved = false;
+  apiEnvConfig = await tenantResolver.resolve(tenantKey);
+  apiResolved = !!apiEnvConfig;
+  if (!apiEnvConfig) {
+    apiEnvConfig = await buildTenantConfigFromEnv();
+  }
+  if (!apiEnvConfig) return null;
+  if (!apiResolved && propsConfig) {
+    const mergedConfig = mergeConfigWithProps(apiEnvConfig, propsConfig, tenantKey);
+    removeStorage(getStorageKey("props_config"));
+    logger.info("Merged props config with ENV fallback config");
+    return mergedConfig;
+  }
+  removeStorage(getStorageKey("props_config"));
+  return {
+    ...apiEnvConfig,
+    tenantKey: tenantKey || apiEnvConfig.tenantKey
+  };
+}
+async function resolveTenantConfigCached(tenantKey, tenantResolver) {
+  if (!tenantKey) return null;
+  return defaultTenantConfigCache.getOrResolve(
+    tenantKey,
+    (key) => resolveTenantConfig(key, tenantResolver)
+  );
+}
+
+// src/application/flows/ForceLoginFlow.ts
+var ForceLoginFlow = class {
+  async execute(context) {
+    const { runtime } = context;
+    const { urlProvider, logger: log } = runtime;
+    const getUrl = () => urlProvider.getCurrentUrl();
+    if (isCallbackUrlFromUrl(getUrl())) {
+      await handleCallback();
+      if (isCallbackUrlFromUrl(getUrl())) {
+        log.warn("Callback URL still present after cleanup, forcing URL clean");
+        const u = getUrl();
+        urlProvider.redirect(`${u.origin}${u.pathname}`);
+        return { completed: true };
+      }
+    }
+    clearFlowFlags();
+    const tenantKey = getTenantKeyFromRuntime(getUrl(), runtime.configProvider);
+    if (!tenantKey) return { completed: true };
+    const tenantConfig = await resolveTenantConfigCached(tenantKey, runtime.tenantResolver);
+    if (!tenantConfig) {
+      log.error("Tenant config resolution failed for force login", { tenantKey });
+      throw new SanitizedError(
+        "TENANT_CONFIG_RESOLUTION_FAILED",
+        "Unable to resolve tenant configuration",
+        new Error(`Tenant config resolution failed for tenantKey: ${tenantKey}`)
+      );
+    }
+    storeTenantConfig(tenantConfig);
+    await initiateAuthFlow(tenantConfig);
+    return { completed: true };
+  }
+};
+
+// src/application/flows/CallbackFlow.ts
+var CallbackFlow = class {
+  async execute(context) {
+    const { runtime } = context;
+    const { urlProvider, logger: log } = runtime;
+    const getUrl = () => urlProvider.getCurrentUrl();
+    clearFlowFlags();
+    const handled = await handleCallback();
+    if (handled) {
+      if (isCallbackUrlFromUrl(getUrl())) {
+        if (isCallbackProcessing()) return { completed: true };
+        const u = getUrl();
+        urlProvider.redirect(`${u.origin}${u.pathname}`);
+        return { completed: true };
+      }
+      return { completed: true };
+    }
+    if (isCallbackUrlFromUrl(getUrl())) {
+      const u = getUrl();
+      urlProvider.redirect(`${u.origin}${u.pathname}`);
+    }
+    return { completed: true };
+  }
+};
+
+// src/application/flows/AuthenticatedFlow.ts
+var AuthenticatedFlow = class {
+  async execute(_context) {
+    return { completed: true };
+  }
+};
+
+// src/application/engine/defaultEngine.ts
+var defaultEngine = null;
+function getDefaultAuthEngine() {
+  return defaultEngine;
+}
+function setDefaultAuthEngine(engine) {
+  defaultEngine = engine;
+}
+
+// src/application/token.ts
+async function ensureValidAccessToken() {
+  const engine = getDefaultAuthEngine();
+  if (engine) {
+    try {
+      return await engine.getAccessToken();
+    } catch {
+    }
+  }
+  const token = getAccessToken();
+  if (token && !isAccessTokenExpired()) return token;
+  const refreshToken = getRefreshToken();
+  if (!refreshToken) {
+    logger.debug("No refresh token - cannot refresh; login required");
+    throw new Error("No refresh token; login required");
+  }
+  return await refreshAccessToken();
+}
+function getAccessToken2() {
+  return getAccessToken();
+}
+
+// src/application/flows/RefreshFlow.ts
+var RefreshFlow = class {
+  async execute(context) {
+    const { runtime } = context;
+    const { logger: log } = runtime;
+    const getUrl = () => runtime.urlProvider.getCurrentUrl();
+    log.debug("Token expired, attempting to refresh...");
+    try {
+      const refreshedToken = await ensureValidAccessToken();
+      if (refreshedToken) {
+        logger.debug("Token refreshed successfully, bootstrap complete");
+        return { completed: true };
+      }
+    } catch (error) {
+      logger.warn("Token refresh failed, will trigger new auth flow", {
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+    const tenantKey = getTenantKeyFromRuntime(getUrl(), runtime.configProvider);
+    if (!tenantKey) {
+      throw new SanitizedError(
+        "TENANT_KEY_RESOLUTION_FAILED",
+        "Unable to resolve tenant",
+        new Error("Tenant key missing")
+      );
+    }
+    const tenantConfig = await resolveTenantConfigCached(tenantKey, runtime.tenantResolver);
+    if (!tenantConfig) {
+      throw new SanitizedError(
+        "TENANT_CONFIG_RESOLUTION_FAILED",
+        "Unable to resolve tenant configuration",
+        new Error(`Tenant config resolution failed for tenantKey: ${tenantKey}`)
+      );
+    }
+    setTenantKey(tenantKey);
+    storeTenantConfig(tenantConfig);
+    await initiateAuthFlow(tenantConfig);
+    return { completed: true };
+  }
+};
+
+// src/application/flows/TenantSwitchFlow.ts
+var TenantSwitchFlow = class {
+  async execute(context) {
+    const { runtime } = context;
+    const { urlProvider, logger: log } = runtime;
+    const getUrl = () => urlProvider.getCurrentUrl();
+    const newTenantKey = getStorage(getStorageKey("new_tenant_key"));
+    log.info("Tenant switch detected - starting fresh login", { newTenantKey });
+    emitAuthEvent(AuthEventNames.TENANT_SWITCHED, { tenantKey: newTenantKey ?? void 0 });
+    removeStorage(getStorageKey("tenant_switched"));
+    removeStorage(getStorageKey("new_tenant_key"));
+    const tenantKey = newTenantKey || getTenantKeyFromRuntime(getUrl(), runtime.configProvider);
+    if (!tenantKey) {
+      throw new SanitizedError(
+        "TENANT_KEY_RESOLUTION_FAILED",
+        "Unable to resolve tenant after switch",
+        new Error("Tenant key missing after switch")
+      );
+    }
+    const tenantConfig = await resolveTenantConfigCached(tenantKey, runtime.tenantResolver);
+    if (!tenantConfig) {
+      throw new SanitizedError(
+        "TENANT_CONFIG_RESOLUTION_FAILED",
+        "Unable to resolve tenant configuration after switch",
+        new Error(`Tenant config resolution failed for tenantKey: ${tenantKey}`)
+      );
+    }
+    setTenantKey(tenantKey);
+    storeTenantConfig(tenantConfig);
+    await initiateAuthFlow(tenantConfig);
+    return { completed: true };
+  }
+};
+
+// src/application/flows/LoginFlow.ts
+var LoginFlow = class {
+  async execute(context) {
+    const { runtime } = context;
+    const { logger: log } = runtime;
+    const getUrl = () => runtime.urlProvider.getCurrentUrl();
+    const callbackProcessed = getStorage(getStorageKey("callback_processed")) === "true";
+    const token = getAccessToken();
+    if (callbackProcessed && !token) {
+      log.warn("Callback processed but token still not available - clearing flag and allowing fresh login");
+      removeStorage(getStorageKey("callback_processed"));
+      clearCallbackProcessing();
+    }
+    const wasStateMismatch = getStorage(getStorageKey("state_mismatch")) === "true";
+    if (wasStateMismatch) removeStorage(getStorageKey("state_mismatch"));
+    const tenantKey = getTenantKeyFromRuntime(getUrl(), runtime.configProvider);
+    if (!tenantKey) {
+      throw new SanitizedError(
+        "TENANT_KEY_RESOLUTION_FAILED",
+        "Unable to resolve tenant",
+        new Error("Tenant key missing")
+      );
+    }
+    const tenantConfig = await resolveTenantConfigCached(tenantKey, runtime.tenantResolver);
+    if (!tenantConfig) {
+      throw new SanitizedError(
+        "TENANT_CONFIG_RESOLUTION_FAILED",
+        "Unable to resolve tenant configuration",
+        new Error(`Tenant config resolution failed for tenantKey: ${tenantKey}`)
+      );
+    }
+    setTenantKey(tenantKey);
+    storeTenantConfig(tenantConfig);
+    await initiateAuthFlow(tenantConfig);
+    return { completed: true };
+  }
+};
+
+// src/application/flows/getFlowForState.ts
+var forceLoginFlow = new ForceLoginFlow();
+var callbackFlow = new CallbackFlow();
+var authenticatedFlow = new AuthenticatedFlow();
+var refreshFlow = new RefreshFlow();
+var tenantSwitchFlow = new TenantSwitchFlow();
+var loginFlow = new LoginFlow();
+function getFlowForState(state) {
+  switch (state) {
+    case "FORCE_LOGIN" /* FORCE_LOGIN */:
+      return forceLoginFlow;
+    case "PROCESSING_CALLBACK" /* PROCESSING_CALLBACK */:
+      return callbackFlow;
+    case "AUTHENTICATED" /* AUTHENTICATED */:
+      return authenticatedFlow;
+    case "TOKEN_EXPIRED" /* TOKEN_EXPIRED */:
+      return refreshFlow;
+    case "TENANT_SWITCH" /* TENANT_SWITCH */:
+      return tenantSwitchFlow;
+    case "LOGIN_REQUIRED" /* LOGIN_REQUIRED */:
+    case "INITIALIZING" /* INITIALIZING */:
+    case "LOGGED_OUT" /* LOGGED_OUT */:
+    case "ERROR" /* ERROR */:
+    default:
+      return loginFlow;
+  }
+}
+
+// src/application/run-bootstrap.ts
+function createStorageReader() {
+  return (suffix) => getStorage(getStorageKey(suffix));
+}
+async function runBootstrap() {
+  const runtime = getAuthRuntime();
+  if (!runtime) {
+    logger.warn(
+      "Auth runtime not set; skipping bootstrap. Set runtime via AuthProvider or setAuthRuntime()."
+    );
+    return;
+  }
+  if (isBootstrapInProgress()) {
+    logger.debug("Bootstrap already in progress - skipping duplicate run");
+    return;
+  }
+  setBootstrapInProgress();
+  try {
+    enforceHttps(true);
+    const url = runtime.urlProvider.getCurrentUrl();
+    const token = getAccessToken();
+    const expired = isAccessTokenExpired();
+    const hasValidToken = !!(token && !expired);
+    const hasToken = !!token;
+    const hasRefreshToken = !!getRefreshToken();
+    const state = resolveAuthLifecycleState({
+      url,
+      getStorage: createStorageReader(),
+      isCallbackUrl: isCallbackUrlFromUrl,
+      hasValidToken,
+      hasToken,
+      hasRefreshToken,
+      isTokenExpired: expired
+    });
+    emitAuthEvent(AuthEventNames.BOOTSTRAP_STATE_DETECTED, { state });
+    const flow = getFlowForState(state);
+    const context = { runtime, url, state };
+    await flow.execute(context);
+  } catch (error) {
+    if (error instanceof SanitizedError) throw error;
+    const r = getAuthRuntime();
+    (r?.logger ?? logger).error("Bootstrap failed", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+    throw new Error(
+      sanitizeErrorMessage(error, "Authentication initialization failed")
+    );
+  } finally {
+    clearBootstrapInProgress();
+  }
+}
+
+// src/infrastructure/watchers/callbacks.ts
+var sessionClearedCallback = null;
+function setSessionClearedCallback(cb) {
+  sessionClearedCallback = cb;
+}
+function getSessionClearedCallback() {
+  return sessionClearedCallback;
+}
+
+// src/application/bootstrap.ts
+async function bootstrapImpl() {
+  const engine = getDefaultAuthEngine();
+  if (engine) {
+    await engine.init();
+    return;
+  }
+  await runBootstrap();
+}
+setSessionClearedCallback(() => bootstrapImpl());
+async function bootstrap() {
+  return bootstrapImpl();
+}
+
+// src/strategies/cookie/cookie-auth.ts
+var COOKIE_NAMES = {
+  accessToken: "tenneo_auth_access_token",
+  refreshToken: "tenneo_auth_refresh_token"
+};
+
+// src/infrastructure/watchers/cookie-watcher.ts
+var isWatching = false;
+var lastCookieSnapshot = "";
+var lastCookieMap = /* @__PURE__ */ new Map();
+var watchInterval = null;
+function getCookieSnapshot() {
+  try {
+    return document.cookie || "";
+  } catch {
+    return "";
+  }
+}
+function getCookieNames() {
+  try {
+    const cookies = document.cookie.split(";");
+    return cookies.map((cookie) => {
+      const eqPos = cookie.indexOf("=");
+      return eqPos > -1 ? cookie.substring(0, eqPos).trim() : cookie.trim();
+    }).filter((name) => name.length > 0);
+  } catch {
+    return [];
+  }
+}
+function getCookieMap() {
+  const cookieMap = /* @__PURE__ */ new Map();
+  try {
+    const cookies = document.cookie.split(";");
+    for (const cookie of cookies) {
+      const eqPos = cookie.indexOf("=");
+      if (eqPos > -1) {
+        const name = cookie.substring(0, eqPos).trim();
+        const value = cookie.substring(eqPos + 1).trim();
+        if (name.length > 0) cookieMap.set(name, value);
+      }
+    }
+  } catch {
+  }
+  return cookieMap;
+}
+function checkCookiesDeleted() {
+  try {
+    const currentSnapshot = getCookieSnapshot();
+    const currentCookieMap = getCookieMap();
+    const currentCookies = getCookieNames();
+    if (lastCookieSnapshot && !currentSnapshot) {
+      logger.info("All cookies deleted detected");
+      return true;
+    }
+    if (lastCookieMap.size > 0) {
+      const authCookieNames = [
+        COOKIE_NAMES.accessToken,
+        COOKIE_NAMES.refreshToken,
+        "tenneo_auth",
+        "tenneo_auth_access_token",
+        "tenneo_auth_refresh_token",
+        "auth",
+        "session",
+        "token"
+      ];
+      const deletedAuthCookies = [];
+      for (const [cookieName] of lastCookieMap) {
+        const isAuthCookie = authCookieNames.some(
+          (authName) => cookieName.toLowerCase().includes(authName.toLowerCase())
+        );
+        if (isAuthCookie && !currentCookieMap.has(cookieName)) {
+          deletedAuthCookies.push(cookieName);
+        }
+      }
+      if (deletedAuthCookies.length > 0) {
+        logger.info("Auth cookies deleted detected", {
+          deletedCookies: deletedAuthCookies,
+          previousCookieCount: lastCookieMap.size,
+          currentCookieCount: currentCookieMap.size
+        });
+        return true;
+      }
+      const hadTenneoAuthAccess = lastCookieMap.has(COOKIE_NAMES.accessToken) || lastCookieMap.has("tenneo_auth_access_token");
+      const hasTenneoAuthAccess = currentCookieMap.has(COOKIE_NAMES.accessToken) || currentCookieMap.has("tenneo_auth_access_token");
+      if (hadTenneoAuthAccess && !hasTenneoAuthAccess) {
+        logger.info("tenneo auth access token cookie deleted detected");
+        return true;
+      }
+      const hadTenneoAuthRefresh = lastCookieMap.has(COOKIE_NAMES.refreshToken) || lastCookieMap.has("tenneo_auth_refresh_token");
+      const hasTenneoAuthRefresh = currentCookieMap.has(COOKIE_NAMES.refreshToken) || currentCookieMap.has("tenneo_auth_refresh_token");
+      if (hadTenneoAuthRefresh && !hasTenneoAuthRefresh) {
+        logger.info("tenneo auth refresh token cookie deleted detected");
+        return true;
+      }
+      if (lastCookieMap.size > currentCookieMap.size && lastCookieMap.size - currentCookieMap.size >= 1) {
+        const deletedCookies = [];
+        for (const [cookieName] of lastCookieMap) {
+          if (!currentCookieMap.has(cookieName)) deletedCookies.push(cookieName);
+        }
+        const deletedAuthCookiesCount = deletedCookies.filter(
+          (name) => authCookieNames.some(
+            (authName) => name.toLowerCase().includes(authName.toLowerCase())
+          )
+        ).length;
+        if (deletedAuthCookiesCount > 0) {
+          logger.info("Auth cookies deleted detected (count-based)", {
+            deletedCookies,
+            deletedAuthCount: deletedAuthCookiesCount,
+            previousCount: lastCookieMap.size,
+            currentCount: currentCookieMap.size
+          });
+          return true;
+        }
+      }
+    }
+    lastCookieSnapshot = currentSnapshot;
+    lastCookieMap = new Map(currentCookieMap);
+    return false;
+  } catch (error) {
+    logger.warn("Error checking cookies", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+    return false;
+  }
+}
+function handleCookieDeletion() {
+  try {
+    logger.info("Cookies deleted detected - clearing session and redirecting to login");
+    const forceLoginSet = getStorage(getStorageKey("force_login")) === "true";
+    const logoutInProgress = getStorage(getStorageKey("logout_in_progress")) === "true";
+    if (forceLoginSet || logoutInProgress) {
+      logger.debug(
+        "Force login or logout in progress - skipping bootstrap from cookie watcher (avoids duplicate by-code API call)"
+      );
+      return;
+    }
+    clearAuthStorage();
+    try {
+      if (typeof window !== "undefined") {
+        const forceLogin = window.localStorage.getItem(getStorageKey("force_login"));
+        const logoutInProgressPreserve = window.localStorage.getItem(
+          getStorageKey("logout_in_progress")
+        );
+        clearAuthSessionStorage();
+        if (forceLogin === "true")
+          window.localStorage.setItem(getStorageKey("force_login"), "true");
+        if (logoutInProgressPreserve === "true")
+          window.localStorage.setItem(getStorageKey("logout_in_progress"), "true");
+      } else {
+        clearAuthSessionStorage();
+      }
+    } catch (error) {
+      logger.warn("Failed to clear sessionStorage", {
+        error: error instanceof Error ? error.message : String(error)
+      });
+    }
+    const cb = getSessionClearedCallback();
+    if (cb) {
+      Promise.resolve(cb()).catch((error) => {
+        logger.error("Failed to redirect to login after cookie deletion", {
+          error: error instanceof Error ? error.message : String(error)
+        });
+      });
+    }
+  } catch (error) {
+    logger.error("Error handling cookie deletion", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
+}
+function startCookieWatcher() {
+  if (isWatching) {
+    logger.debug("Cookie watcher already running");
+    return;
+  }
+  isWatching = true;
+  lastCookieSnapshot = getCookieSnapshot();
+  lastCookieMap = getCookieMap();
+  const initialCookies = getCookieNames();
+  const authCookies = initialCookies.filter(
+    (name) => name.toLowerCase().includes("tenneo_auth") || name.toLowerCase().includes("auth") || name.toLowerCase().includes("token")
+  );
+  logger.debug("Cookie watcher started", {
+    initialCookieCount: initialCookies.length,
+    authCookieCount: authCookies.length,
+    authCookies,
+    allCookies: initialCookies
+  });
+  watchInterval = setInterval(async () => {
+    const logoutInProgress = typeof window !== "undefined" && window.localStorage.getItem(getStorageKey("logout_in_progress")) === "true";
+    if (logoutInProgress) {
+      logger.debug("Logout detected. Cookie watcher will not trigger bootstrap.");
+      lastCookieSnapshot = getCookieSnapshot();
+      lastCookieMap = getCookieMap();
+      return;
+    }
+    const cookiesDeleted = checkCookiesDeleted();
+    if (cookiesDeleted) {
+      logger.info("Cookies deleted detected by cookie watcher");
+      if (watchInterval) {
+        clearInterval(watchInterval);
+        watchInterval = null;
+      }
+      isWatching = false;
+      try {
+        await handleCookieDeletion();
+      } catch (error) {
+        logger.error("Error handling cookie deletion, will restart watcher", {
+          error: error instanceof Error ? error.message : String(error)
+        });
+      } finally {
+        queueMicrotask(() => {
+          if (!isWatching) startCookieWatcher();
+        });
+      }
+    }
+  }, 1e3);
+  logger.info("Cookie watcher started - monitoring for cookie deletion");
+}
+function stopCookieWatcher() {
+  isWatching = false;
+  if (watchInterval) {
+    clearInterval(watchInterval);
+    watchInterval = null;
+  }
+  lastCookieSnapshot = "";
+  logger.debug("Cookie watcher stopped");
+}
+function resetCookieWatcher() {
+  lastCookieSnapshot = getCookieSnapshot();
+  lastCookieMap = getCookieMap();
+  const currentCookies = getCookieNames();
+  const authCookies = currentCookies.filter(
+    (name) => name.toLowerCase().includes("tenneo_auth") || name.toLowerCase().includes("auth") || name.toLowerCase().includes("token")
+  );
+  logger.debug("Cookie watcher reset", {
+    currentCookieCount: currentCookies.length,
+    authCookieCount: authCookies.length,
+    authCookies
+  });
+}
+function stopStorageWatcher() {
+  const win = window;
+  const intervalId = win.__tenneo_auth_storage_watcher_interval;
+  if (intervalId) {
+    clearInterval(intervalId);
+    delete win.__tenneo_auth_storage_watcher_interval;
+  }
+}
+
+// src/utils/cookies.ts
+function clearClientCookies() {
+  try {
+    const cookies = document.cookie.split(";");
+    for (const cookie of cookies) {
+      const eqPos = cookie.indexOf("=");
+      const name = eqPos > -1 ? cookie.slice(0, eqPos).trim() : cookie.trim();
+      if (!name) continue;
+      document.cookie = `${name}=;expires=Thu, 01 Jan 1970 00:00:00 GMT;path=/`;
+      document.cookie = `${name}=;expires=Thu, 01 Jan 1970 00:00:00 GMT;path=/;domain=${window.location.hostname}`;
+    }
+    logger.debug("Client-side cookies cleared (best-effort)");
+  } catch (error) {
+    logger.warn("Failed to clear client cookies", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
+}
+
+// src/application/logout.ts
+function buildUrl(baseUrl, path) {
+  const url = new URL(baseUrl);
+  const normalizedPath = path.startsWith("/") ? path : `/${path}`;
+  url.pathname = url.pathname.endsWith("/") ? `${url.pathname}${normalizedPath.slice(1)}` : `${url.pathname}${normalizedPath}`;
+  return url.toString();
+}
+async function callServerLogout(logoutUrl) {
+  try {
+    const response = await fetch(logoutUrl, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        "X-Requested-With": "XMLHttpRequest",
+        Accept: "application/json"
+      },
+      credentials: "include"
+    });
+    const data = await response.json().catch(() => ({}));
+    logger.info("Server logout response (POST)", { response: data });
+    if (data && (data.success === true || data.logout === true)) {
+      return { success: true, response: data };
+    }
+    logger.warn("Server logout response invalid (POST)", { response: data });
+    return { success: false, response: data };
+  } catch (error) {
+    logger.debug("POST logout failed, trying GET", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+    try {
+      const response = await fetch(logoutUrl, {
+        method: "GET",
+        headers: {
+          "X-Requested-With": "XMLHttpRequest",
+          Accept: "application/json"
+        },
+        credentials: "include"
+      });
+      const data = await response.json().catch(() => ({}));
+      logger.info("Server logout response (GET)", { response: data });
+      if (data && (data.success === true || data.logout === true)) {
+        return { success: true, response: data };
+      }
+      logger.warn("Server logout response invalid (GET)", { response: data });
+      return { success: false, response: data };
+    } catch (getError) {
+      logger.warn("Server logout failed (both POST and GET)", {
+        postError: error instanceof Error ? error.message : String(error),
+        getError: getError instanceof Error ? getError.message : String(getError)
+      });
+      return { success: false };
+    }
+  }
+}
+function performLocalLogoutCleanup() {
+  logger.debug("Performing local logout cleanup");
+  clearClientCookies();
+  clearAllStorage();
+  logger.info("Local logout cleanup completed");
+}
+async function logout(tenantKey) {
+  setStorage(getStorageKey("logout_in_progress"), "true");
+  setStorage(getStorageKey("force_login"), "true");
+  if (tenantKey?.trim()) setStorage(getStorageKey("preserved_tenant_key"), tenantKey.trim());
+  if (getStorage(getStorageKey("logout_processing")) === "true") {
+    logger.debug("Logout already in progress \u2013 skipping duplicate call");
+    return { success: true, message: "Logout already in progress." };
+  }
+  setStorage(getStorageKey("logout_processing"), "true");
+  try {
+    stopStorageWatcher();
+    stopCookieWatcher();
+    const apiAuthBaseUrl = Config.getApiAuthBaseUrl();
+    let serverLogoutSuccess = false;
+    let serverResponse;
+    if (apiAuthBaseUrl) {
+      const logoutUrl = buildUrl(apiAuthBaseUrl, "account/logout");
+      logger.info("Calling auth server logout", { logoutUrl });
+      const logoutResult = await callServerLogout(logoutUrl);
+      serverLogoutSuccess = logoutResult.success;
+      serverResponse = logoutResult.response;
+    }
+    performLocalLogoutCleanup();
+    const preservedTenantKey = getStorage(getStorageKey("preserved_tenant_key"));
+    if (preservedTenantKey) {
+      setStorage(getStorageKey("props_config"), JSON.stringify({ tenantKey: preservedTenantKey }));
+      removeStorage(getStorageKey("preserved_tenant_key"));
+    }
+    resetCookieWatcher();
+    removeStorage(getStorageKey("logout_processing"));
+    logger.info("Logout completed \u2013 flags set, storage cleared, fresh login required", {
+      serverLogoutSuccess,
+      serverResponse
+    });
+    emitAuthEvent(AuthEventNames.LOGOUT_COMPLETED, {
+      message: serverLogoutSuccess ? "Server logout success" : "Local logout only"
+    });
+    return {
+      success: true,
+      message: serverLogoutSuccess ? serverResponse?.message || "Logout successful. Session cookies cleared. Fresh login required." : "Logged out locally. Fresh login required (server logout may have failed).",
+      serverResponse
+    };
+  } catch (error) {
+    logger.error("Logout failed unexpectedly", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+    performLocalLogoutCleanup();
+    const preservedTenantKey = getStorage(getStorageKey("preserved_tenant_key"));
+    if (preservedTenantKey) {
+      setStorage(getStorageKey("props_config"), JSON.stringify({ tenantKey: preservedTenantKey }));
+      removeStorage(getStorageKey("preserved_tenant_key"));
+    }
+    removeStorage(getStorageKey("logout_processing"));
+    return {
+      success: true,
+      message: "Logged out locally due to an error. Fresh login required."
+    };
+  }
+}
+var AuthContext = createContext(void 0);
+function useAuthContext() {
+  const context = useContext(AuthContext);
+  if (!context) {
+    throw new Error("useAuthContext must be used within AuthProvider");
+  }
+  return context;
+}
+
+// src/infrastructure/tenant/tenant.api.ts
+var ongoingRequests = /* @__PURE__ */ new Map();
+var DEFAULT_SCOPES2 = OAUTH_CONSTANTS.SCOPES;
+function getResolvedTenantBaseUrl() {
+  let base = Config.getApiTenantResolutionBaseUrl();
+  if (typeof window !== "undefined" && (!base || base.startsWith("/"))) {
+    base = window.location.origin + (base || "/api");
+  }
+  return base;
+}
+var PUBLIC_CODE_PREFIX = "public-";
+function getTenantByCodeUrl(tenantCode) {
+  const apiTenantResolutionBaseUrl = getResolvedTenantBaseUrl();
+  const base = apiTenantResolutionBaseUrl.replace(/\/api\/v1\/?$/, "") || apiTenantResolutionBaseUrl;
+  return `${base}/api/tenant/v1/public/tenants/by-code/${encodeURIComponent(tenantCode)}`;
+}
+async function resolveTenant(tenantKey) {
+  if (!tenantKey || tenantKey.trim() === "") {
+    logger.debug("tenantKey is empty or invalid, skipping API call");
+    return null;
+  }
+  const tenantCode = tenantKey.trim();
+  const requestKey = `resolveTenant:${tenantCode}`;
+  if (ongoingRequests.has(requestKey)) {
+    logger.debug("Tenant resolution reused (in-flight)", { tenantCode });
+    return ongoingRequests.get(requestKey);
+  }
+  logger.info("Tenant resolution API call", { tenantCode });
+  const requestPromise = (async () => {
+    try {
+      const url = getTenantByCodeUrl(tenantCode);
+      logger.debug("GET tenant by-code", { url });
+      let data;
+      try {
+        const response = await fetch(url, { method: "GET" });
+        if (!response.ok) throw new Error(`HTTP ${response.status}`);
+        data = await response.json();
+        logger.debug("API response received", { tenantCode });
+      } catch (error) {
+        logger.warn("API call failed", { tenantCode, error });
+        return null;
+      }
+      if (!data || typeof data !== "object") return null;
+      const res = data;
+      if (!res.id || !res.clientCode) return null;
+      const authServer = Config.getAuthServerUrl();
+      const redirectUri = Config.getRedirectUri();
+      if (!authServer || !redirectUri) return null;
+      const clientCodeWithPrefix = res.clientCode.startsWith(PUBLIC_CODE_PREFIX) ? res.clientCode : `${PUBLIC_CODE_PREFIX}${res.clientCode}`;
+      const config = {
+        tenantId: res.id,
+        authServer,
+        tenantKey: tenantCode,
+        client: {
+          clientId: res.clientCode,
+          clientCode: clientCodeWithPrefix,
+          redirectUri,
+          scopes: DEFAULT_SCOPES2
+        }
+      };
+      logger.debug("Resolved tenant config", { tenantCode });
+      return config;
+    } catch (error) {
+      logger.warn("Unexpected error resolving tenant", { tenantCode, error });
+      return null;
+    } finally {
+      ongoingRequests.delete(requestKey);
+    }
+  })();
+  ongoingRequests.set(requestKey, requestPromise);
+  return requestPromise;
+}
+
+// src/browser/adapters.ts
+function createConsoleLogger() {
+  return {
+    info(message, meta) {
+      if (typeof console !== "undefined") console.info(message, meta ?? "");
+    },
+    warn(message, meta) {
+      if (typeof console !== "undefined") console.warn(message, meta ?? "");
+    },
+    error(message, meta) {
+      if (typeof console !== "undefined") console.error(message, meta ?? "");
+    },
+    debug(message, meta) {
+      if (typeof console !== "undefined") console.debug(message, meta ?? "");
+    }
+  };
+}
+function createBrowserUrlProvider() {
+  return {
+    getCurrentUrl() {
+      if (typeof window === "undefined") {
+        return { href: "", origin: "", pathname: "/", search: "", hostname: "" };
+      }
+      const w = window;
+      const loc = w.location;
+      return {
+        href: loc.href,
+        origin: loc.origin,
+        pathname: loc.pathname,
+        search: loc.search,
+        hostname: loc.hostname
+      };
+    },
+    redirect(url) {
+      if (typeof window !== "undefined") window.location.replace(url);
+    },
+    replaceState(url) {
+      if (typeof window === "undefined") return;
+      try {
+        const title = typeof document !== "undefined" ? document.title : "";
+        window.history.replaceState({}, title, url);
+      } catch {
+      }
+    }
+  };
+}
+function createConfigProvider() {
+  return {
+    getApiBaseUrl: () => Config.getApiAuthBaseUrl(),
+    getAuthServerUrl: () => Config.getAuthServerUrl(),
+    getRedirectUri: () => Config.getRedirectUri(),
+    getClientId: () => Config.getClientId(),
+    getTenantId: () => Config.getTenantId(),
+    getClientCode: () => Config.getClientCode(),
+    getBasePath: () => Config.getBasePath()
+  };
+}
+function createTenantResolver() {
+  return { resolve: (tenantKey) => resolveTenant(tenantKey) };
+}
+function createBrowserCookieClearer() {
+  return {
+    clearCookies() {
+      if (typeof document === "undefined" || typeof window === "undefined") return;
+      try {
+        const cookies = document.cookie.split(";");
+        cookies.forEach((cookie) => {
+          const eqPos = cookie.indexOf("=");
+          const name = eqPos > -1 ? cookie.substring(0, eqPos).trim() : cookie.trim();
+          document.cookie = `${name}=;expires=Thu, 01 Jan 1970 00:00:00 GMT;path=/`;
+          const domain = window.location.hostname;
+          const parts = domain.split(".");
+          if (parts.length > 1) {
+            const parentDomain = "." + parts.slice(-2).join(".");
+            document.cookie = `${name}=;expires=Thu, 01 Jan 1970 00:00:00 GMT;path=/;domain=${parentDomain}`;
+          }
+        });
+      } catch {
+      }
+    }
+  };
+}
+
+// src/strategies/oauth2-pkce/OAuth2PkceStrategy.ts
+function createOAuth2PkceStrategy() {
+  return {
+    async initiate(tenantConfig) {
+      storeTenantConfig(tenantConfig);
+      await initiateAuthFlow(tenantConfig);
+    },
+    async handleCallback() {
+      return handleCallback();
+    },
+    async refresh() {
+      return refreshAccessToken();
+    },
+    async logout(options) {
+      await logout(options?.tenantKey);
+    }
+  };
+}
+
+// src/application/engine/eventBus.ts
+function createEventBus() {
+  const listeners2 = /* @__PURE__ */ new Set();
+  return {
+    subscribe(listener) {
+      listeners2.add(listener);
+      return () => listeners2.delete(listener);
+    },
+    emit(state) {
+      listeners2.forEach((fn) => {
+        try {
+          fn(state);
+        } catch {
+        }
+      });
+    }
+  };
+}
+
+// src/application/engine/createEngine.ts
+function stateEquals(a, b) {
+  return a.status === b.status && a.accessToken === b.accessToken && a.expiresAt === b.expiresAt && a.error === b.error;
+}
+function deriveState(config) {
+  setAuthRuntime(config);
+  const accessToken = getAccessToken();
+  const expiresAt = getExpiresAt();
+  const expired = isAccessTokenExpired();
+  if (accessToken && !expired) {
+    return {
+      status: "authenticated",
+      accessToken,
+      expiresAt,
+      error: null
+    };
+  }
+  if (accessToken && expired) {
+    return {
+      status: "error",
+      accessToken,
+      expiresAt,
+      error: "Token expired"
+    };
+  }
+  return {
+    status: "unauthenticated",
+    accessToken: null,
+    expiresAt: null,
+    error: null
+  };
+}
+function createAuthEngine(config) {
+  const frozenConfig = Object.freeze({ ...config });
+  const bus = createEventBus();
+  let lastEmittedState = null;
+  const strategy = frozenConfig.strategy ?? createOAuth2PkceStrategy();
+  const emitState = () => {
+    const next = deriveState(frozenConfig);
+    if (lastEmittedState !== null && stateEquals(lastEmittedState, next)) return;
+    lastEmittedState = next;
+    bus.emit(next);
+  };
+  return {
+    async init() {
+      setAuthRuntime(frozenConfig);
+      frozenConfig.logger.debug("Engine init: running bootstrap");
+      await runBootstrap();
+      emitState();
+    },
+    async login() {
+      setAuthRuntime(frozenConfig);
+      frozenConfig.logger.debug("Engine login: running bootstrap (may redirect)");
+      await runBootstrap();
+      emitState();
+    },
+    async logout(options) {
+      setAuthRuntime(frozenConfig);
+      frozenConfig.logger.debug("Engine logout");
+      await strategy.logout(options);
+      emitState();
+    },
+    async refresh() {
+      setAuthRuntime(frozenConfig);
+      frozenConfig.logger.debug("Engine refresh");
+      try {
+        const token = await strategy.refresh();
+        emitState();
+        return token;
+      } catch (e) {
+        emitState();
+        throw e;
+      }
+    },
+    async getAccessToken() {
+      setAuthRuntime(frozenConfig);
+      return ensureValidAccessToken();
+    },
+    async handleCallback() {
+      setAuthRuntime(frozenConfig);
+      frozenConfig.logger.debug("Engine handleCallback");
+      const handled = await strategy.handleCallback();
+      emitState();
+      return handled;
+    },
+    subscribe(listener) {
+      return bus.subscribe(listener);
+    },
+    getState() {
+      return deriveState(frozenConfig);
+    }
+  };
+}
+function AuthProvider({
+  children,
+  autoInit = true,
+  tenantCode,
+  appId = "",
+  storageAdapter
+}) {
+  const resolvedTenantKey = tenantCode ?? Config.getClientCode();
+  const namespace = useMemo(
+    () => ({ tenantId: resolvedTenantKey ?? "", appId: appId ?? "" }),
+    [resolvedTenantKey, appId]
+  );
+  const initRanRef = useRef(false);
+  const engineRef = useRef(null);
+  useLayoutEffect(() => {
+    if (tenantCode) {
+      setConfig({ CLIENTCODE: tenantCode });
+    }
+    return () => {
+      clearConfigOverrides();
+    };
+  }, [tenantCode]);
+  useLayoutEffect(() => {
+    setStorageKeyPrefix(resolvedTenantKey ?? "");
+    const adapter = storageAdapter !== void 0 && storageAdapter !== null ? storageAdapter : createSecureSessionStorageAdapter(namespace);
+    setStorageContext(adapter, namespace);
+    const runtime = {
+      storageAdapter: adapter,
+      storageNamespace: namespace,
+      logger: createConsoleLogger(),
+      urlProvider: createBrowserUrlProvider(),
+      configProvider: createConfigProvider(),
+      tenantResolver: createTenantResolver(),
+      clearCookies: createBrowserCookieClearer()
+    };
+    setAuthRuntime(runtime);
+    engineRef.current = createAuthEngine(runtime);
+    setDefaultAuthEngine(engineRef.current);
+    return () => {
+      setDefaultAuthEngine(null);
+      engineRef.current = null;
+      setAuthRuntime(null);
+      setStorageContext(null, { tenantId: "", appId: "" });
+      setStorageKeyPrefix("");
+    };
+  }, [resolvedTenantKey, appId, storageAdapter]);
+  useEffect(() => {
+    const resolvedTenantKey2 = tenantCode ?? Config.getClientCode();
+    logger.debug("[AuthProvider] Props from host app", {
+      tenantCode: tenantCode ?? "(not provided)",
+      appId: appId ?? "",
+      resolvedTenantKey: resolvedTenantKey2
+    });
+    if (resolvedTenantKey2) {
+      const previousTenantKey = getStorage(getStorageKey("tenant_key"));
+      const tenantKeyChanged = previousTenantKey && previousTenantKey !== resolvedTenantKey2;
+      if (tenantKeyChanged) {
+        logger.debug("[AuthProvider] Tenant switch detected", { previous: previousTenantKey, next: resolvedTenantKey2 });
+        if (typeof window !== "undefined") {
+          const currentUrl = window.location.href;
+          const isCallback = currentUrl.includes("code=") || currentUrl.includes("state=");
+          if (isCallback) {
+            const cleanUrl2 = window.location.origin + window.location.pathname;
+            window.history.replaceState({}, document.title, cleanUrl2);
+          }
+        }
+        removeStorage(getStorageKey("access_token"));
+        removeStorage(getStorageKey("refresh_token"));
+        removeStorage(getStorageKey("expires_at"));
+        removeStorage(getStorageKey("id_token"));
+        removeStorage(getStorageKey("state"));
+        removeStorage(getStorageKey("code_verifier"));
+        removeStorage(getStorageKey("callback_processed"));
+        clearCallbackProcessing();
+        clearFlowFlags();
+        removeStorage(getStorageKey("tenant_id"));
+        if (typeof window !== "undefined") {
+          window.localStorage.removeItem(getStorageKey("force_login"));
+          window.localStorage.removeItem(getStorageKey("logout_in_progress"));
+        }
+        setStorage(getStorageKey("props_changed"), "true");
+        setStorage(getStorageKey("tenant_switched"), "true");
+        setStorage(getStorageKey("new_tenant_key"), resolvedTenantKey2);
+        setState({
+          isAuthenticated: false,
+          accessToken: null,
+          isLoading: true,
+          error: null
+        });
+      } else if (previousTenantKey) {
+        logger.debug("[AuthProvider] TenantKey unchanged", { tenantKey: resolvedTenantKey2 });
+      }
+      setStorage(getStorageKey("props_config"), JSON.stringify({ tenantKey: resolvedTenantKey2 }));
+      setStorage(getStorageKey("tenant_key"), resolvedTenantKey2);
+    } else {
+      logger.debug("[AuthProvider] No tenant code determined");
+    }
+  }, [tenantCode, appId]);
+  const [state, setState] = useState({
+    isAuthenticated: false,
+    accessToken: null,
+    isLoading: autoInit,
+    error: null
+  });
+  const syncAuthState = useCallback(() => {
+    try {
+      const engine = engineRef.current;
+      let authenticated;
+      let accessToken;
+      let error = null;
+      if (engine) {
+        const s = engine.getState();
+        authenticated = s.status === "authenticated" && !!s.accessToken;
+        accessToken = s.accessToken;
+        error = s.error;
+      } else {
+        accessToken = getAccessToken();
+        authenticated = !!accessToken && !isAccessTokenExpired();
+      }
+      setState({
+        isAuthenticated: authenticated,
+        accessToken,
+        isLoading: false,
+        error
+      });
+      if (authenticated) {
+      } else {
+        stopStorageWatcher();
+        stopCookieWatcher();
+      }
+    } catch (error) {
+      stopStorageWatcher();
+      stopCookieWatcher();
+      setState({
+        isAuthenticated: false,
+        accessToken: null,
+        isLoading: false,
+        error: error instanceof Error ? error.message : "Unknown error"
+      });
+    }
+  }, []);
+  useEffect(() => {
+    if (!autoInit) return;
+    const tenantSwitched = getStorage(getStorageKey("tenant_switched")) === "true";
+    const propsChanged = getStorage(getStorageKey("props_changed")) === "true";
+    if (!tenantSwitched && !propsChanged) return;
+    let cancelled = false;
+    const reinit = async () => {
+      try {
+        await engineRef.current?.init();
+        if (!cancelled) {
+          syncAuthState();
+        }
+      } finally {
+        removeStorage(getStorageKey("props_changed"));
+      }
+    };
+    reinit();
+    return () => {
+      cancelled = true;
+    };
+  }, [autoInit, tenantCode, syncAuthState]);
+  useEffect(() => {
+    if (!autoInit) {
+      setState((prev) => ({ ...prev, isLoading: false }));
+      return;
+    }
+    if (initRanRef.current) return;
+    initRanRef.current = true;
+    let cancelled = false;
+    const init = async () => {
+      try {
+        await engineRef.current?.init();
+        if (!cancelled) syncAuthState();
+      } catch (error) {
+        stopStorageWatcher();
+        stopCookieWatcher();
+        if (!cancelled) {
+          setState({
+            isAuthenticated: false,
+            accessToken: null,
+            isLoading: false,
+            error: error instanceof Error ? error.message : "Authentication initialization failed"
+          });
+        }
+      }
+    };
+    init();
+    return () => {
+      cancelled = true;
+      initRanRef.current = false;
+      stopStorageWatcher();
+      stopCookieWatcher();
+    };
+  }, [autoInit, syncAuthState]);
+  const login = useCallback(async () => {
+    setState((prev) => ({ ...prev, isLoading: true }));
+    await engineRef.current?.login();
+    syncAuthState();
+  }, [syncAuthState]);
+  const logout2 = useCallback(async () => {
+    stopStorageWatcher();
+    stopCookieWatcher();
+    setState((prev) => ({ ...prev, isLoading: true }));
+    try {
+      await engineRef.current?.logout({ tenantKey: tenantCode });
+      resetCookieWatcher();
+    } finally {
+      stopStorageWatcher();
+      stopCookieWatcher();
+      setState({
+        isAuthenticated: false,
+        accessToken: null,
+        isLoading: false,
+        error: null
+      });
+    }
+  }, [tenantCode]);
+  const refreshToken = useCallback(async () => {
+    try {
+      const newToken = await engineRef.current?.refresh() ?? "";
+      syncAuthState();
+      return newToken;
+    } catch (error) {
+      await logout2();
+      throw error;
+    }
+  }, [syncAuthState, logout2]);
+  const getValidAccessToken = useCallback(async () => {
+    try {
+      const token = await engineRef.current?.getAccessToken();
+      if (!token) throw new Error("Not authenticated");
+      syncAuthState();
+      return token;
+    } catch (error) {
+      await logout2();
+      throw error;
+    }
+  }, [syncAuthState, logout2]);
+  const setTokens = useCallback((accessToken) => {
+    setState({
+      isAuthenticated: true,
+      accessToken,
+      isLoading: false,
+      error: null
+    });
+  }, []);
+  const contextValue = useMemo(
+    () => ({
+      ...state,
+      login,
+      logout: logout2,
+      refreshToken,
+      getAccessToken: getValidAccessToken,
+      setTokens
+    }),
+    [state, login, logout2, refreshToken, getValidAccessToken, setTokens]
+  );
+  return /* @__PURE__ */ jsx(AuthContext.Provider, { value: contextValue, children });
+}
+var PLUGIN_DISPLAY_NAME = "Tenneo Auth";
+function AuthCallback({
+  loginPath = "/login",
+  successPath = "/dashboard",
+  homePath = "/"
+}) {
+  const { setTokens } = useAuthContext();
+  const handledRef = useRef(false);
+  const [status, setStatus] = useState("idle");
+  const [message, setMessage] = useState("");
+  useEffect(() => {
+    if (handledRef.current) return;
+    handledRef.current = true;
+    const urlParams = new URLSearchParams(window.location.search);
+    const hasCallbackParams = urlParams.has("code") || urlParams.has("error");
+    if (!hasCallbackParams) {
+      window.location.replace(loginPath || homePath);
+      return;
+    }
+    const error = urlParams.get("error");
+    const errorDescription = urlParams.get("error_description");
+    if (error) {
+      setStatus("error");
+      setMessage(`${error}: ${errorDescription || "Authorization failed"}`);
+      window.history.replaceState({}, document.title, window.location.origin + window.location.pathname);
+      return;
+    }
+    const runCallback = async () => {
+      setStatus("loading");
+      setMessage("Completing sign-in...");
+      const handled = await handleCallback();
+      if (handled) {
+        const token = getAccessToken();
+        if (token) setTokens(token);
+        setStatus("success");
+        setMessage("Authentication successful. Redirecting...");
+        window.location.replace(successPath);
+      } else {
+        setStatus("error");
+        setMessage("Authentication failed. Please try again.");
+        window.history.replaceState({}, document.title, window.location.origin + window.location.pathname);
+      }
+    };
+    runCallback();
+  }, [homePath, loginPath, successPath, setTokens]);
+  const containerStyle = {
+    minHeight: "200px",
+    display: "flex",
+    flexDirection: "column",
+    alignItems: "center",
+    justifyContent: "center",
+    padding: 32,
+    fontFamily: "system-ui, -apple-system, Segoe UI, Roboto, sans-serif",
+    textAlign: "center"
+  };
+  const titleStyle = {
+    margin: 0,
+    fontSize: "1.25rem",
+    fontWeight: 600,
+    color: "#1a1a1a",
+    marginBottom: 8
+  };
+  const messageStyle = {
+    margin: 0,
+    fontSize: "0.9375rem",
+    color: "#555",
+    lineHeight: 1.5,
+    maxWidth: 360
+  };
+  const errorBoxStyle = {
+    marginTop: 16,
+    padding: "12px 16px",
+    backgroundColor: "#fef2f2",
+    border: "1px solid #fecaca",
+    borderRadius: 8,
+    color: "#991b1b",
+    fontSize: "0.875rem",
+    maxWidth: 360
+  };
+  const retryLinkStyle = {
+    marginTop: 16,
+    fontSize: "0.875rem",
+    color: "#2563eb",
+    textDecoration: "none",
+    cursor: "pointer"
+  };
+  const spinnerStyle = {
+    width: 28,
+    height: 28,
+    border: "3px solid #e5e7eb",
+    borderTopColor: "#2563eb",
+    borderRadius: "50%",
+    animation: "auth-callback-spin 0.8s linear infinite",
+    marginBottom: 16
+  };
+  const pluginNameStyle = {
+    position: "absolute",
+    top: 24,
+    left: "50%",
+    transform: "translateX(-50%)",
+    margin: 0,
+    fontSize: "0.875rem",
+    fontWeight: 600,
+    color: "#6b7280",
+    letterSpacing: "0.02em"
+  };
+  return /* @__PURE__ */ jsxs("div", { style: { ...containerStyle, position: "relative" }, children: [
+    /* @__PURE__ */ jsx("style", { children: `@keyframes auth-callback-spin { to { transform: rotate(360deg); } }` }),
+    /* @__PURE__ */ jsx("p", { style: pluginNameStyle, children: PLUGIN_DISPLAY_NAME }),
+    status === "loading" && /* @__PURE__ */ jsxs(Fragment, { children: [
+      /* @__PURE__ */ jsx("div", { style: spinnerStyle, "aria-hidden": true }),
+      /* @__PURE__ */ jsx("h2", { style: titleStyle, children: "Signing you in..." }),
+      /* @__PURE__ */ jsx("p", { style: messageStyle, children: "Please wait while we complete authentication." })
+    ] }),
+    status === "success" && /* @__PURE__ */ jsxs(Fragment, { children: [
+      /* @__PURE__ */ jsx("h2", { style: titleStyle, children: "Signed in successfully" }),
+      /* @__PURE__ */ jsx("p", { style: messageStyle, children: "Redirecting you now." })
+    ] }),
+    status === "error" && /* @__PURE__ */ jsxs(Fragment, { children: [
+      /* @__PURE__ */ jsx("h2", { style: { ...titleStyle, color: "#991b1b" }, children: "Authentication failed" }),
+      /* @__PURE__ */ jsx("div", { style: errorBoxStyle, children: message }),
+      /* @__PURE__ */ jsx(
+        "a",
+        {
+          href: loginPath,
+          style: retryLinkStyle,
+          onClick: (e) => {
+            e.preventDefault();
+            window.location.href = loginPath;
+          },
+          children: "Try again"
+        }
+      )
+    ] }),
+    status === "idle" && /* @__PURE__ */ jsxs(Fragment, { children: [
+      /* @__PURE__ */ jsx("div", { style: spinnerStyle, "aria-hidden": true }),
+      /* @__PURE__ */ jsx("h2", { style: titleStyle, children: "Preparing callback..." }),
+      /* @__PURE__ */ jsx("p", { style: messageStyle, children: "Setting up authentication." })
+    ] })
+  ] });
+}
+
+// src/hooks/useAuth.ts
+function useAuth() {
+  return useAuthContext();
+}
+function ProtectedRoute({
+  children,
+  fallback = null,
+  autoLogin = true
+}) {
+  const { isAuthenticated, getAccessToken: getAccessToken3, login } = useAuth();
+  const [ready, setReady] = useState(false);
+  const loginTriggeredRef = useRef(false);
+  useEffect(() => {
+    let cancelled = false;
+    const run = async () => {
+      if (isAuthenticated) {
+        if (!cancelled) setReady(true);
+        return;
+      }
+      try {
+        await getAccessToken3();
+        if (!cancelled) setReady(true);
+      } catch {
+        if (autoLogin && !loginTriggeredRef.current) {
+          loginTriggeredRef.current = true;
+          await login();
+        }
+        if (!cancelled) setReady(false);
+      }
+    };
+    run();
+    return () => {
+      cancelled = true;
+    };
+  }, [autoLogin, getAccessToken3, isAuthenticated, login]);
+  if (!ready || !isAuthenticated) {
+    return /* @__PURE__ */ jsx(Fragment, { children: fallback });
+  }
+  return /* @__PURE__ */ jsx(Fragment, { children });
+}
+function useAuthInit() {
+  const [isLoading, setIsLoading] = useState(false);
+  const [error, setError] = useState(null);
+  const inProgressRef = useRef(false);
+  const mountedRef = useRef(true);
+  useEffect(() => {
+    return () => {
+      mountedRef.current = false;
+    };
+  }, []);
+  const init = useCallback(async () => {
+    if (inProgressRef.current) {
+      return;
+    }
+    inProgressRef.current = true;
+    if (mountedRef.current) {
+      setIsLoading(true);
+      setError(null);
+    }
+    try {
+      await bootstrap();
+    } catch (err) {
+      if (mountedRef.current) {
+        setError(
+          err instanceof Error ? err.message : "Authentication initialization failed"
+        );
+      }
+    } finally {
+      inProgressRef.current = false;
+      if (mountedRef.current) {
+        setIsLoading(false);
+      }
+    }
+  }, []);
+  return useMemo(
+    () => ({ isLoading, error, init }),
+    [isLoading, error, init]
+  );
+}
+
+export { AuthCallback, AuthEventNames, AuthProvider, Config, OAUTH_CONSTANTS, ProtectedRoute, STORAGE_KEYS2 as STORAGE_KEYS, STORAGE_KEY_PREFIX, SanitizedError, bootstrap, buildStorageKey, createAuthEngine, createCookieStorageAdapter, createMemoryStorageAdapter, createOAuth2PkceStrategy, createSecureSessionStorageAdapter, emitAuthEvent, enforceHttps, ensureValidAccessToken, extractTenantKey, getAccessToken2 as getAccessToken, getAuthRuntime, getConfig, getEnvConfig, getStorageAdapter, getStorageNamespace, getAccessToken as getStoredAccessToken, hasEnvFallback, isAccessTokenExpired, isCallbackUrl, logout, refreshAccessToken, resetCookieWatcher, resolveConfig, resolveTenant, sanitizeErrorMessage, setAuthRuntime, setConfig, setStorageContext, startCookieWatcher, stopCookieWatcher, subscribeAuthEvent, useAuth, useAuthContext, useAuthInit };
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map