tenneo-auth-plugin 1.0.0 → 1.0.3

package/dist/index.js

@@ -21,64 +21,6 @@ function getAuthRuntime() {
 function isLocalhost(hostname) {
   return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname.startsWith("192.168.") || hostname.startsWith("10.") || hostname.endsWith(".local");
 }
-function extractTenantKeyFromDomain(urlOrHostname, config) {
-  try {
-    let hostname;
-    if (urlOrHostname.startsWith("http://") || urlOrHostname.startsWith("https://")) {
-      try {
-        const url = new URL(urlOrHostname);
-        hostname = url.hostname;
-      } catch {
-        hostname = urlOrHostname.replace(/^https?:\/\//, "").split("/")[0];
-      }
-    } else {
-      hostname = urlOrHostname;
-    }
-    const parts = hostname.split(".");
-    if (parts.length < 2) return config.getClientCode();
-    const tenantKey = parts[0];
-    if (!tenantKey || tenantKey.trim() === "") return config.getClientCode();
-    if (tenantKey.trim().toLowerCase() === "productlms") return config.getClientCode();
-    return tenantKey.trim();
-  } catch {
-    return config.getClientCode();
-  }
-}
-function extractTenantKeyFromUrl(url, config, getStorage3, getKey) {
-  try {
-    const propsConfigKey = getKey ? getKey("props_config") : "tenneo_auth_props_config";
-    const propsConfigStr = getStorage3(propsConfigKey);
-    if (propsConfigStr) {
-      try {
-        const propsConfig = JSON.parse(propsConfigStr);
-        if (propsConfig.tenantKey?.trim()) return propsConfig.tenantKey.trim();
-      } catch {
-      }
-    }
-    const tenantKeyStorageKey = getKey ? getKey("tenant_key") : "tenneo_auth_tenant_key";
-    const storedTenantKey = getStorage3(tenantKeyStorageKey);
-    if (storedTenantKey?.trim()) return storedTenantKey.trim();
-    const urlParams = new URLSearchParams(url.search);
-    const tenantKeyFromQuery = urlParams.get("t");
-    if (tenantKeyFromQuery?.trim()) {
-      const hostnameParts = url.hostname.split(".");
-      const baseDomain = hostnameParts.length >= 2 ? hostnameParts.slice(-2).join(".") : url.hostname;
-      const simulatedHostname = `${tenantKeyFromQuery.trim()}.${baseDomain}`;
-      const key = extractTenantKeyFromDomain(simulatedHostname, config);
-      if (key) return key;
-      return tenantKeyFromQuery.trim();
-    }
-    const keyFromHost = extractTenantKeyFromDomain(url.hostname, config);
-    if (keyFromHost) return keyFromHost;
-    const clientCode = config.getClientCode();
-    if (clientCode?.trim()) return clientCode.trim();
-    return config.getClientCode();
-  } catch {
-    const clientCode = config.getClientCode();
-    if (clientCode?.trim()) return clientCode.trim();
-    return config.getClientCode();
-  }
-}
 function isCallbackUrlFromUrl(url) {
   const params = new URLSearchParams(url.search);
   return params.has("code") && params.has("state");
@@ -139,8 +81,7 @@ var CONFIG_KEY_SUFFIXES = {
   stateMismatch: "state_mismatch",
   bootstrapInProgress: "bootstrap_in_progress",
   bootstrapTimestamp: "bootstrap_timestamp",
-  callbackHandled: "callback_handled",
-  idToken: "id_token"
+  callbackHandled: "callback_handled"
 };
 
 // src/infrastructure/storage/context.ts
@@ -432,51 +373,7 @@ function createCookieStorageAdapter(namespace, options) {
   };
 }
 
-// src/infrastructure/storage/api.ts
-var KEY_SUFFIXES = {
-  authServerUrl: "auth_server_url",
-  clientId: "client_id",
-  redirectUri: "redirect_uri",
-  tenantId: "tenant_id",
-  tenantKey: "tenant_key",
-  codeVerifier: "code_verifier",
-  state: "state",
-  accessToken: "access_token",
-  refreshToken: "refresh_token",
-  expiresAt: "expires_at"
-};
-var STORAGE_KEYS = {
-  get authServerUrl() {
-    return getStorageKey(KEY_SUFFIXES.authServerUrl);
-  },
-  get clientId() {
-    return getStorageKey(KEY_SUFFIXES.clientId);
-  },
-  get redirectUri() {
-    return getStorageKey(KEY_SUFFIXES.redirectUri);
-  },
-  get tenantId() {
-    return getStorageKey(KEY_SUFFIXES.tenantId);
-  },
-  get tenantKey() {
-    return getStorageKey(KEY_SUFFIXES.tenantKey);
-  },
-  get codeVerifier() {
-    return getStorageKey(KEY_SUFFIXES.codeVerifier);
-  },
-  get state() {
-    return getStorageKey(KEY_SUFFIXES.state);
-  },
-  get accessToken() {
-    return getStorageKey(KEY_SUFFIXES.accessToken);
-  },
-  get refreshToken() {
-    return getStorageKey(KEY_SUFFIXES.refreshToken);
-  },
-  get expiresAt() {
-    return getStorageKey(KEY_SUFFIXES.expiresAt);
-  }
-};
+// src/infrastructure/storage/kv.ts
 function keyToSuffix(key) {
   const prefix = getStorageKeyPrefix();
   return key.startsWith(prefix) ? key.slice(prefix.length) : key;
@@ -512,23 +409,53 @@ function removeStorage(key) {
   } catch {
   }
 }
-function clearAuthStorage() {
-  const adapter = getStorageAdapter();
-  if (!adapter?.clearSync) return;
-  try {
-    adapter.clearTokensSync?.();
-    adapter.clearSync();
-  } catch {
+
+// src/infrastructure/storage/api.ts
+var KEY_SUFFIXES = {
+  tenantKey: "tenant_key",
+  codeVerifier: "code_verifier",
+  state: "state",
+  accessToken: "access_token",
+  refreshToken: "refresh_token",
+  expiresAt: "expires_at"
+};
+var STORAGE_KEYS = {
+  get tenantKey() {
+    return getStorageKey(KEY_SUFFIXES.tenantKey);
+  },
+  get codeVerifier() {
+    return getStorageKey(KEY_SUFFIXES.codeVerifier);
+  },
+  get state() {
+    return getStorageKey(KEY_SUFFIXES.state);
+  },
+  get accessToken() {
+    return getStorageKey(KEY_SUFFIXES.accessToken);
+  },
+  get refreshToken() {
+    return getStorageKey(KEY_SUFFIXES.refreshToken);
+  },
+  get expiresAt() {
+    return getStorageKey(KEY_SUFFIXES.expiresAt);
   }
+};
+function clearAuthStorage() {
+  const keysToClear = [
+    STORAGE_KEYS.accessToken,
+    STORAGE_KEYS.refreshToken,
+    STORAGE_KEYS.expiresAt,
+    STORAGE_KEYS.codeVerifier,
+    STORAGE_KEYS.state,
+    getStorageKey("callback_processed"),
+    getStorageKey("props_config"),
+    getStorageKey("tenant_switched"),
+    getStorageKey("new_tenant_key"),
+    getStorageKey("preserved_tenant_key")
+  ];
+  for (const key of keysToClear) removeStorage(key);
 }
 function clearAuthSessionStorage() {
-  const adapter = getStorageAdapter();
-  if (!adapter?.clearSync) return;
-  try {
-    adapter.clearTokensSync?.();
-    adapter.clearSync();
-  } catch {
-  }
+  clearAuthStorage();
 }
 function clearAllCookies() {
   const runtime = getAuthRuntime();
@@ -537,27 +464,8 @@ function clearAllCookies() {
   } catch {
   }
 }
-function clearAllBrowserStorage() {
-  if (typeof window === "undefined") return;
-  try {
-    window.localStorage?.clear();
-  } catch {
-  }
-  try {
-    window.sessionStorage?.clear();
-  } catch {
-  }
-}
 function clearAllStorage() {
-  const forceLogin = getStorage(getStorageKey("force_login"));
-  const logoutInProgress = getStorage(getStorageKey("logout_in_progress"));
-  const preservedTenantKey = getStorage(getStorageKey("preserved_tenant_key"));
-  clearAuthSessionStorage();
   clearAuthStorage();
-  clearAllBrowserStorage();
-  if (forceLogin === "true") setStorage(getStorageKey("force_login"), "true");
-  if (logoutInProgress === "true") setStorage(getStorageKey("logout_in_progress"), "true");
-  if (preservedTenantKey) setStorage(getStorageKey("preserved_tenant_key"), preservedTenantKey);
   clearAllCookies();
 }
 function getAccessToken() {
@@ -593,15 +501,6 @@ function isAccessTokenExpired() {
   const buffer = 60 * 1e3;
   return Date.now() >= expiresAt - buffer;
 }
-function getClientId() {
-  return getStorage(STORAGE_KEYS.clientId);
-}
-function getRedirectUri() {
-  return getStorage(STORAGE_KEYS.redirectUri);
-}
-function getTenantId() {
-  return getStorage(STORAGE_KEYS.tenantId);
-}
 function getCodeVerifier() {
   return getStorage(STORAGE_KEYS.codeVerifier);
 }
@@ -662,6 +561,252 @@ var Logger = class {
 };
 var logger = new Logger();
 
+// src/config/resolver-core.ts
+var inMemoryConfig = {};
+var hostConfigProvider = null;
+var CACHE_MARKER = "__tenneo_host_config_cache";
+var CACHE_AT = "__tenneo_host_config_cache_at";
+function setConfig(overrides) {
+  inMemoryConfig = { ...inMemoryConfig, ...overrides };
+}
+function clearConfigOverrides() {
+  inMemoryConfig = {};
+}
+function setHostConfigProvider(fn) {
+  hostConfigProvider = fn;
+}
+function readHostBridge() {
+  const out = {};
+  try {
+    if (typeof window !== "undefined" && window.__TENNEO_AUTH_HOST__) {
+      Object.assign(out, window.__TENNEO_AUTH_HOST__);
+    }
+  } catch {
+  }
+  try {
+    const fromProvider = hostConfigProvider?.();
+    if (fromProvider && typeof fromProvider === "object") {
+      Object.assign(out, fromProvider);
+    }
+  } catch (e) {
+    logger.warn("[config] hostConfigProvider threw", {
+      error: e instanceof Error ? e.message : String(e)
+    });
+  }
+  return out;
+}
+function readStorageConfigCache() {
+  try {
+    const raw = getStorage(getStorageKey("host_config"));
+    if (!raw) return {};
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object") return {};
+    const { [CACHE_MARKER]: _m, [CACHE_AT]: _t, ...rest } = parsed;
+    if (!rest.clientId && typeof rest.client_id === "string" && rest.client_id.trim()) {
+      rest.clientId = rest.client_id.trim();
+    }
+    return rest;
+  } catch {
+    return {};
+  }
+}
+function resolveSDKConfig(overrides) {
+  const stored = readStorageConfigCache();
+  const bridge = readHostBridge();
+  return {
+    ...stored,
+    ...bridge,
+    ...inMemoryConfig,
+    ...overrides ?? {}
+  };
+}
+function nonEmptyString(v) {
+  if (v == null) return void 0;
+  const s = String(v).trim();
+  return s || void 0;
+}
+function getConfigFieldSources(overrides) {
+  const stored = readStorageConfigCache();
+  const bridge = readHostBridge();
+  const layers = [
+    { src: "storage_cache", cfg: stored },
+    { src: "host_bridge", cfg: bridge },
+    { src: "memory", cfg: inMemoryConfig }
+  ];
+  if (overrides && Object.keys(overrides).length) {
+    layers.push({ src: "override", cfg: overrides });
+  }
+  const pick = (key) => {
+    for (let i = layers.length - 1; i >= 0; i--) {
+      const v = nonEmptyString(layers[i].cfg[key]);
+      if (v !== void 0) return layers[i].src;
+    }
+    return void 0;
+  };
+  return {
+    tenantCode: pick("tenantCode") ?? pick("tenantKey"),
+    tenantKey: pick("tenantKey") ?? pick("tenantCode"),
+    apiBaseUrl: pick("apiBaseUrl"),
+    authServerUrl: pick("authServerUrl"),
+    callbackUrl: pick("callbackUrl"),
+    clientCode: pick("clientCode"),
+    clientId: pick("clientId"),
+    tenantId: pick("tenantId"),
+    appId: pick("appId")
+  };
+}
+function getEffectiveTenantCode(overrides) {
+  const cfg = resolveSDKConfig(overrides);
+  const t = nonEmptyString(cfg.tenantCode) ?? nonEmptyString(cfg.tenantKey) ?? nonEmptyString(cfg.clientCode) ?? "";
+  return t;
+}
+var getEffectiveTenantKey = getEffectiveTenantCode;
+function trim(v) {
+  return v == null ? "" : String(v).trim();
+}
+function toResolvedConfig(cfg) {
+  const merged = { ...cfg };
+  if (!merged.tenantCode && merged.tenantKey) {
+    merged.tenantCode = merged.tenantKey;
+  }
+  const clientId = trim(merged.clientId) || trim(merged.clientCode);
+  return {
+    apiBaseUrl: trim(merged.apiBaseUrl),
+    authServerUrl: trim(merged.authServerUrl),
+    callbackUrl: trim(merged.callbackUrl) || trim(merged.redirectUri),
+    clientCode: trim(merged.clientCode),
+    tenantCode: trim(merged.tenantCode),
+    appId: trim(merged.appId),
+    clientId,
+    tenantId: trim(merged.tenantId)
+  };
+}
+var AuthConfigError = class extends Error {
+  constructor(missing, message) {
+    super(
+      message ?? `[tenneo-auth] Missing required auth configuration: ${missing.join(", ")}. Provide authServerUrl, callbackUrl (redirectUri), and tenant_key/tenant_code via AuthProvider/initPlugin or window.__TENNEO_AUTH_HOST__.`
+    );
+    this.code = "AUTH_CONFIG_MISSING";
+    this.name = "AuthConfigError";
+    this.missing = missing;
+  }
+};
+function resolveConfig(overrides) {
+  return toResolvedConfig(resolveSDKConfig(overrides));
+}
+function getAuthConfig(options) {
+  const resolved = toResolvedConfig(resolveSDKConfig(options?.overrides));
+  if (options?.strict) {
+    const missing = [];
+    if (!resolved.authServerUrl) missing.push("authServerUrl");
+    if (!resolved.callbackUrl) missing.push("callbackUrl");
+    if (!resolved.tenantCode) missing.push("tenantCode|tenantKey");
+    if (missing.length) throw new AuthConfigError(missing);
+  }
+  return resolved;
+}
+function syncHostConfigCacheFromMemory() {
+  const c = resolveSDKConfig();
+  const patch = {};
+  const keys = [
+    "apiBaseUrl",
+    "authServerUrl",
+    "callbackUrl",
+    "redirectUri",
+    "tenantCode",
+    "tenantKey",
+    "clientCode",
+    "clientId",
+    "tenantId",
+    "appId",
+    "basePath"
+  ];
+  for (const k of keys) {
+    const v = c[k];
+    if (v != null && String(v).trim()) {
+      patch[k] = String(v).trim();
+    }
+  }
+  if (Object.keys(patch).length) writeHostConfigCache(patch);
+}
+function writeHostConfigCache(partial) {
+  try {
+    const key = getStorageKey("host_config");
+    const raw = getStorage(key);
+    let existing = {};
+    try {
+      if (raw) existing = JSON.parse(raw);
+    } catch {
+      existing = {};
+    }
+    const next = {
+      ...existing,
+      ...partial,
+      [CACHE_MARKER]: true,
+      [CACHE_AT]: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    setStorage(key, JSON.stringify(next));
+    logger.debug("[config] host_config cache updated (non-authoritative)", {
+      keys: Object.keys(partial)
+    });
+  } catch (e) {
+    logger.warn("[config] Failed to write host_config cache", {
+      error: e instanceof Error ? e.message : String(e)
+    });
+  }
+}
+function initPlugin(config, opts) {
+  setConfig(config);
+  logger.info("[config] initPlugin \u2014 runtime config updated", {
+    syncStorageCache: opts?.syncStorageCache !== false,
+    tenantCode: config.tenantCode ?? config.tenantKey ?? "(none)"
+  });
+  if (opts?.syncStorageCache !== false) {
+    writeHostConfigCache(config);
+  }
+}
+function logConfigResolutionDebug(context, overrides) {
+  const sources = getConfigFieldSources(overrides);
+  logger.debug(`[config] ${context}`, {
+    fieldSources: sources,
+    effectiveTenantCode: getEffectiveTenantCode(overrides) || "(empty)",
+    hasAuthServerUrl: !!resolveSDKConfig(overrides).authServerUrl,
+    hasCallbackUrl: !!resolveSDKConfig(overrides).callbackUrl
+  });
+}
+
+// src/config/host-fields.ts
+function trim2(v) {
+  if (v == null) return null;
+  const s = String(v).trim();
+  return s || null;
+}
+function oauthClientIdForTokenRequest(raw) {
+  if (!raw) return null;
+  let s = raw.trim();
+  if (!s) return null;
+  if (s.toLowerCase().startsWith("public-")) {
+    s = s.slice("public-".length).trim();
+  }
+  return s || null;
+}
+function getClientId() {
+  const c = resolveSDKConfig();
+  const fromId = oauthClientIdForTokenRequest(trim2(c.clientId));
+  if (fromId) return fromId;
+  return oauthClientIdForTokenRequest(trim2(c.clientCode));
+}
+function normalizeClientIdForOAuthTokenBody(raw) {
+  return oauthClientIdForTokenRequest(trim2(raw));
+}
+function getRedirectUri() {
+  const c = resolveSDKConfig();
+  return trim2(c.callbackUrl) ?? trim2(c.redirectUri);
+}
+function getTenantId() {
+  return trim2(resolveSDKConfig().tenantId);
+}
+
 // src/domain/errors.ts
 function isLocalhostHostname(hostname) {
   return hostname === "localhost" || hostname === "127.0.0.1" || hostname.startsWith("192.168.") || hostname.startsWith("10.") || hostname.startsWith("172.16.");
@@ -717,10 +862,8 @@ function resolveAuthLifecycleState(input) {
     hasRefreshToken,
     isTokenExpired
   } = input;
-  const forceLogin = getStorage3("force_login") === "true";
   const callbackProcessed = getStorage3("callback_processed") === "true";
   const tenantSwitched = getStorage3("tenant_switched") === "true";
-  if (forceLogin) return "FORCE_LOGIN" /* FORCE_LOGIN */;
   if (isCallbackUrl2(url)) return "PROCESSING_CALLBACK" /* PROCESSING_CALLBACK */;
   if (hasValidToken) return "AUTHENTICATED" /* AUTHENTICATED */;
   if (callbackProcessed && !hasToken) return "LOGIN_REQUIRED" /* LOGIN_REQUIRED */;
@@ -781,30 +924,58 @@ function setFlowFlags() {
   setFlowInProgress();
 }
 
-// src/strategies/oauth2-pkce/pkce.ts
-function generateCodeVerifier(length = 128) {
-  const array = new Uint8Array(length);
-  crypto.getRandomValues(array);
-  const base64 = btoa(String.fromCharCode(...array));
-  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+// src/application/events/AuthEvents.ts
+var AuthEventNames = {
+  LOGIN_STARTED: "LOGIN_STARTED",
+  LOGIN_SUCCESS: "LOGIN_SUCCESS",
+  LOGIN_FAILED: "LOGIN_FAILED",
+  CALLBACK_SUCCESS: "CALLBACK_SUCCESS",
+  CALLBACK_FAILED: "CALLBACK_FAILED",
+  TOKEN_REFRESH_SUCCESS: "TOKEN_REFRESH_SUCCESS",
+  TOKEN_REFRESH_FAILED: "TOKEN_REFRESH_FAILED",
+  TENANT_SWITCHED: "TENANT_SWITCHED",
+  LOGOUT_COMPLETED: "LOGOUT_COMPLETED",
+  BOOTSTRAP_STATE_DETECTED: "BOOTSTRAP_STATE_DETECTED",
+  REDIRECT_LOOP_RISK: "REDIRECT_LOOP_RISK"
+};
+var listeners = /* @__PURE__ */ new Map();
+function getHandlers(event) {
+  let set = listeners.get(event);
+  if (!set) {
+    set = /* @__PURE__ */ new Set();
+    listeners.set(event, set);
+  }
+  return set;
 }
-async function generateCodeChallenge(verifier) {
-  try {
-    const encoder = new TextEncoder();
-    const data = encoder.encode(verifier);
-    const hashBuffer = await crypto.subtle.digest("SHA-256", data);
-    const hashArray = Array.from(new Uint8Array(hashBuffer));
-    const base64 = btoa(String.fromCharCode(...hashArray));
-    return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-  } catch {
-    throw new Error("Failed to generate code challenge");
+function getWildcardHandlers() {
+  let set = listeners.get("*");
+  if (!set) {
+    set = /* @__PURE__ */ new Set();
+    listeners.set("*", set);
   }
+  return set;
 }
-function generateState() {
-  const array = new Uint8Array(32);
-  crypto.getRandomValues(array);
-  const base64 = btoa(String.fromCharCode(...array));
-  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+function emitAuthEvent(event, payload) {
+  const handlers = getHandlers(event);
+  const wildcard = getWildcardHandlers();
+  const p = payload ?? {};
+  handlers.forEach((fn) => {
+    try {
+      fn(p);
+    } catch {
+    }
+  });
+  wildcard.forEach((fn) => {
+    try {
+      fn({ ...p, event });
+    } catch {
+    }
+  });
+}
+function subscribeAuthEvent(event, handler) {
+  const set = event === "*" ? getWildcardHandlers() : getHandlers(event);
+  set.add(handler);
+  return () => set.delete(handler);
 }
 
 // src/config/constants.ts
@@ -834,342 +1005,169 @@ var DEFAULT_TOKEN_GRANT_TYPE = OAUTH_CONSTANTS.TOKEN_GRANT_TYPE;
 var DEFAULT_REFRESH_GRANT_TYPE = OAUTH_CONSTANTS.REFRESH_GRANT_TYPE;
 
 // src/config/index.ts
-var inMemoryConfig = {};
-function readHostConfigFromStorage() {
-  try {
-    const raw = getStorage(getStorageKey("host_config"));
-    if (!raw) return {};
-    const parsed = JSON.parse(raw);
-    return parsed && typeof parsed === "object" ? parsed : {};
-  } catch {
-    return {};
-  }
+function getAuthConfig2(options) {
+  return getAuthConfig(options);
 }
-function resolveMerged(overrides) {
-  const stored = readHostConfigFromStorage();
-  const cfg = { ...stored, ...inMemoryConfig, ...overrides ?? {} };
-  const trimmed = (v) => v == null ? "" : String(v).trim();
-  return {
-    apiBaseUrl: trimmed(cfg.apiBaseUrl),
-    authServerUrl: trimmed(cfg.authServerUrl),
-    callbackUrl: trimmed(cfg.callbackUrl),
-    clientCode: trimmed(cfg.clientCode)
-  };
-}
-function resolveConfig(overrides) {
-  return resolveMerged(overrides);
+function requireAuthConfig(overrides) {
+  return getAuthConfig({ strict: true, overrides });
 }
 function getConfig() {
-  return resolveMerged();
-}
-function setConfig(overrides) {
-  inMemoryConfig = { ...inMemoryConfig, ...overrides };
-}
-function clearConfigOverrides() {
-  inMemoryConfig = {};
+  return resolveConfig();
 }
 function getRedirectUri2() {
-  const cfg = resolveMerged();
+  const cfg = resolveConfig();
   if (cfg.callbackUrl) return cfg.callbackUrl;
   if (typeof window !== "undefined") return `${window.location.origin}/callback`;
   return "";
 }
 var Config = {
   getApiBaseUrl() {
-    return resolveMerged().apiBaseUrl;
+    return resolveConfig().apiBaseUrl;
   },
   getAuthServerUrl() {
-    return resolveMerged().authServerUrl;
+    return resolveConfig().authServerUrl;
   },
   getClientCode() {
-    return resolveMerged().clientCode;
+    return resolveConfig().clientCode;
   },
   getRedirectUri() {
     return getRedirectUri2();
   },
   getAll() {
-    return resolveMerged();
+    return resolveConfig();
   }
 };
-
-// src/utils/validation.ts
-function isValidGuid(guid) {
-  if (!guid || typeof guid !== "string") {
-    return false;
-  }
-  const guidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-  return guidRegex.test(guid.trim());
-}
-function validateTenantId(tenantId) {
-  if (!tenantId || tenantId.trim() === "") {
-    return {
-      isValid: false,
-      error: "Tenant ID is required"
-    };
-  }
-  if (!isValidGuid(tenantId)) {
-    return {
-      isValid: false,
-      error: "Tenant ID must be a valid GUID format (00000000-0000-0000-0000-000000000001)"
-    };
+function applyRuntimeTenantSwitch(tenantKey, opts) {
+  const t = tenantKey.trim();
+  if (!t) return;
+  setConfig({ tenantCode: t, tenantKey: t });
+  logConfigResolutionDebug("applyRuntimeTenantSwitch", { tenantCode: t, tenantKey: t });
+  if (opts?.syncStorageCache !== false) {
+    writeHostConfigCache({ tenantCode: t, tenantKey: t });
   }
-  return { isValid: true };
 }
 
-// src/application/domain-facade.ts
-function isLocalhost2() {
-  const runtime = getAuthRuntime();
-  const hostname = runtime ? runtime.urlProvider.getCurrentUrl().hostname : typeof window !== "undefined" ? window.location.hostname : "";
-  return isLocalhost(hostname);
-}
-function extractTenantKey() {
-  const runtime = getAuthRuntime();
-  if (runtime) {
-    const url = runtime.urlProvider.getCurrentUrl();
-    return extractTenantKeyFromUrl(url, runtime.configProvider, getStorage, getStorageKey);
+// src/infrastructure/tenant/TenantConfigCache.ts
+var DEFAULT_TTL_MS = 5 * 60 * 1e3;
+var TenantConfigCache = class {
+  constructor(ttlMs = DEFAULT_TTL_MS) {
+    this.cache = /* @__PURE__ */ new Map();
+    this.inFlight = /* @__PURE__ */ new Map();
+    this.ttlMs = ttlMs;
   }
-  return extractTenantKeyLegacy();
-}
-function extractTenantKeyLegacy() {
-  if (typeof window === "undefined") return Config.getClientCode();
-  try {
-    const propsConfigStr = getStorage(getStorageKey("props_config"));
-    if (propsConfigStr) {
-      const propsConfig = JSON.parse(propsConfigStr);
-      if (propsConfig.tenantKey?.trim()) return propsConfig.tenantKey.trim();
+  get(tenantKey) {
+    const entry = this.cache.get(tenantKey);
+    if (!entry) return null;
+    if (Date.now() >= entry.expiresAt) {
+      this.cache.delete(tenantKey);
+      return null;
     }
-    const stored = getStorage(getStorageKey("tenant_key"));
-    if (stored?.trim()) return stored.trim();
-    const urlParams = new URLSearchParams(window.location.search);
-    const t = urlParams.get("t");
-    if (t?.trim()) return t.trim();
-    const hostname = window.location.hostname;
-    const parts = hostname.split(".");
-    if (parts.length >= 2 && parts[0] && parts[0].toLowerCase() !== "productlms") return parts[0].trim();
-    return Config.getClientCode();
-  } catch {
-    return Config.getClientCode();
+    return entry.config;
   }
-}
-function isCallbackUrl() {
-  const runtime = getAuthRuntime();
-  if (runtime) return isCallbackUrlFromUrl(runtime.urlProvider.getCurrentUrl());
-  if (typeof window === "undefined") return false;
-  const params = new URLSearchParams(window.location.search);
-  return params.has("code") && params.has("state");
-}
-
-// src/application/events/AuthEvents.ts
-var AuthEventNames = {
-  LOGIN_STARTED: "LOGIN_STARTED",
-  LOGIN_SUCCESS: "LOGIN_SUCCESS",
-  LOGIN_FAILED: "LOGIN_FAILED",
-  CALLBACK_SUCCESS: "CALLBACK_SUCCESS",
-  CALLBACK_FAILED: "CALLBACK_FAILED",
-  TOKEN_REFRESH_SUCCESS: "TOKEN_REFRESH_SUCCESS",
-  TOKEN_REFRESH_FAILED: "TOKEN_REFRESH_FAILED",
-  TENANT_SWITCHED: "TENANT_SWITCHED",
-  LOGOUT_COMPLETED: "LOGOUT_COMPLETED",
-  BOOTSTRAP_STATE_DETECTED: "BOOTSTRAP_STATE_DETECTED",
-  REDIRECT_LOOP_RISK: "REDIRECT_LOOP_RISK"
-};
-var listeners = /* @__PURE__ */ new Map();
-function getHandlers(event) {
-  let set = listeners.get(event);
-  if (!set) {
-    set = /* @__PURE__ */ new Set();
-    listeners.set(event, set);
+  set(tenantKey, config) {
+    this.cache.set(tenantKey, {
+      config,
+      expiresAt: Date.now() + this.ttlMs
+    });
   }
-  return set;
-}
-function getWildcardHandlers() {
-  let set = listeners.get("*");
-  if (!set) {
-    set = /* @__PURE__ */ new Set();
-    listeners.set("*", set);
+  invalidate(tenantKey) {
+    if (tenantKey) {
+      this.cache.delete(tenantKey);
+      this.inFlight.delete(tenantKey);
+    } else {
+      this.cache.clear();
+      this.inFlight.clear();
+    }
   }
-  return set;
-}
-function emitAuthEvent(event, payload) {
-  const handlers = getHandlers(event);
-  const wildcard = getWildcardHandlers();
-  const p = payload ?? {};
-  handlers.forEach((fn) => {
-    try {
-      fn(p);
-    } catch {
+  async getOrResolve(tenantKey, resolver) {
+    if (!tenantKey || !tenantKey.trim()) return null;
+    const key = tenantKey.trim();
+    const cached = this.get(key);
+    if (cached) {
+      logger.debug("Tenant config from cache", { tenantKey: key });
+      return cached;
     }
-  });
-  wildcard.forEach((fn) => {
-    try {
-      fn({ ...p, event });
-    } catch {
+    const existing = this.inFlight.get(key);
+    if (existing) {
+      logger.debug("Tenant resolution reused (in-flight)", { tenantKey: key });
+      return existing;
     }
-  });
-}
-function subscribeAuthEvent(event, handler) {
-  const set = event === "*" ? getWildcardHandlers() : getHandlers(event);
-  set.add(handler);
-  return () => set.delete(handler);
-}
-
-// src/application/security/redirectLoopGuard.ts
-var DEFAULT_MAX_REDIRECTS = 5;
-var WINDOW_MS = 60 * 1e3;
-var redirectCount = 0;
-var firstRedirectAt = 0;
-function resetRedirectLoopGuard() {
-  redirectCount = 0;
-  firstRedirectAt = 0;
-}
-function checkAndIncrementRedirect(maxAttempts = DEFAULT_MAX_REDIRECTS) {
-  const now = Date.now();
-  if (now - firstRedirectAt > WINDOW_MS) {
-    redirectCount = 0;
-    firstRedirectAt = now;
-  }
-  if (redirectCount >= maxAttempts) {
-    emitAuthEvent(AuthEventNames.REDIRECT_LOOP_RISK, {
-      message: `Redirect attempt limit (${maxAttempts}) exceeded`
-    });
-    return false;
+    const promise = (async () => {
+      try {
+        const config = await resolver(key);
+        if (config) this.set(key, config);
+        return config;
+      } finally {
+        this.inFlight.delete(key);
+      }
+    })();
+    this.inFlight.set(key, promise);
+    return promise;
   }
-  redirectCount++;
-  return true;
-}
+};
 
-// src/strategies/oauth2-pkce/oauth.ts
-function storeTenantConfig(config) {
-  const validation = validateTenantId(config.tenantId);
-  if (!validation.isValid) {
-    logger.warn("Tenant ID validation failed", { tenantId: config.tenantId });
-  }
-  const authServerToStore = Config.getAuthServerUrl() || config.authServer;
-  setStorage(STORAGE_KEYS.authServerUrl, authServerToStore);
-  setStorage(STORAGE_KEYS.clientId, config.client.clientId);
-  setStorage(STORAGE_KEYS.redirectUri, Config.getRedirectUri());
-  setStorage(STORAGE_KEYS.tenantId, config.tenantId);
-  if (config.tenantKey) {
-    setStorage(STORAGE_KEYS.tenantKey, config.tenantKey);
-  }
-}
-async function initiateAuthFlow(config) {
+// src/infrastructure/tenant/tenantResolution.ts
+var defaultTenantConfigCache = new TenantConfigCache();
+function consumePropsConfig() {
+  const propsConfigKey = getStorageKey("props_config");
   try {
-    logger.info("Initiating OAuth authorization flow");
-    const authServerFromProps = Config.getAuthServerUrl();
-    const authServerEffective = (authServerFromProps || config?.authServer || "").replace(/\/+$/, "");
-    const redirectUriEffective = Config.getRedirectUri();
-    const storedTenantId = getStorage(STORAGE_KEYS.tenantId);
-    const storedClientId = getStorage(STORAGE_KEYS.clientId);
-    const tenantIdEffective = storedTenantId || config?.tenantId || "";
-    const clientIdEffective = storedClientId || config?.client?.clientId || "";
-    logger.debug("[initiateAuthFlow] Resolved inputs", {
-      authServerFromProps: authServerFromProps ? "(provided)" : "(empty)",
-      authServerEffective,
-      redirectUriEffective,
-      tenantIdEffective,
-      clientIdEffective,
-      scopes: config?.client?.scopes,
-      hasRuntime: !!getAuthRuntime()
-    });
-    const token = getAccessToken();
-    if (token && !isAccessTokenExpired()) {
-      logger.debug("Valid token already exists, skipping auth flow");
-      clearFlowFlags();
-      return;
-    }
-    if (isCallbackUrl()) {
-      logger.debug("Callback URL detected - clearing flow flag to allow callback processing");
-      clearFlowFlags();
-      return;
-    }
-    if (isFlowInProgress()) {
-      if (isFlowFlagStale(3e3)) {
-        logger.info("Stale auth flow flag detected, clearing and proceeding");
-        clearFlowFlags();
-      } else {
-        logger.debug("Auth flow already in progress (recent), skipping duplicate redirect");
-        return;
-      }
-    }
-    setFlowFlags();
-    if (!(Config.getAuthServerUrl() || config?.authServer) || !config.client?.clientId || !config.client?.redirectUri) {
-      logger.error("[initiateAuthFlow] Missing required tenant config", {
-        authServerEffective,
-        clientId: config?.client?.clientId,
-        redirectUriFromTenantApi: config?.client?.redirectUri,
-        redirectUriEffective
-      });
-      throw new Error("Invalid tenant configuration for auth flow");
-    }
-    storeTenantConfig(config);
-    logger.debug("[initiateAuthFlow] Stored tenant config, generating PKCE");
-    const codeVerifier = generateCodeVerifier();
-    const codeChallenge = await generateCodeChallenge(codeVerifier);
-    const state = generateState();
-    removeStorage(STORAGE_KEYS.codeVerifier);
-    removeStorage(STORAGE_KEYS.state);
-    setStorage(STORAGE_KEYS.codeVerifier, codeVerifier);
-    setStorage(STORAGE_KEYS.state, state);
-    const authUrl = buildAuthorizationUrl(config, codeChallenge, state);
-    logger.debug("[initiateAuthFlow] Built authorization URL", {
-      authServerEffective,
-      urlPrefix: authUrl?.slice(0, 80)
-    });
-    if (!authUrl || !(authUrl.startsWith("http://") || authUrl.startsWith("https://"))) {
-      throw new Error("Invalid authorization URL generated");
-    }
-    if (!checkAndIncrementRedirect()) {
-      logger.warn("Redirect loop protection: max redirect attempts exceeded");
-      clearFlowFlags();
-      return;
-    }
-    logger.info("Redirecting to authorization server");
-    emitAuthEvent(AuthEventNames.LOGIN_STARTED, { tenantKey: config.tenantKey });
-    const runtime = getAuthRuntime();
-    if (runtime) {
-      logger.debug("[initiateAuthFlow] Redirect via runtime.urlProvider.redirect");
-      runtime.urlProvider.redirect(authUrl);
-    } else if (typeof window !== "undefined") {
-      logger.debug("[initiateAuthFlow] Redirect via window.location.replace");
-      window.location.replace(authUrl);
-    } else {
-      logger.error("[initiateAuthFlow] No runtime and no window; cannot redirect", { authUrl });
-    }
-  } catch (error) {
-    clearFlowFlags();
-    logger.error("Failed to initiate auth flow", {
-      error: error instanceof Error ? error.message : String(error)
-    });
-    throw error;
+    const propsConfigStr = getStorage(propsConfigKey);
+    if (!propsConfigStr) return null;
+    const parsed = JSON.parse(propsConfigStr);
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  } finally {
+    removeStorage(propsConfigKey);
   }
-}
-function buildAuthorizationUrl(config, codeChallenge, state) {
-  const authServerBase = (Config.getAuthServerUrl() || config.authServer || "").replace(/\/+$/, "");
-  if (isLocalhost2()) {
-    logger.debug("Building authorization URL", {
-      authServer: authServerBase,
-      clientId: config.client.clientId,
-      redirectUri: config.client.redirectUri,
-      scopes: config.client.scopes
-    });
+}
+function validateTenantKey(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed ? trimmed : null;
+}
+function resolveTenantKey() {
+  const propsConfig = consumePropsConfig();
+  const tenantFromProps = validateTenantKey(propsConfig?.tenantKey);
+  if (tenantFromProps) {
+    logger.debug("[tenant] Resolved tenant from props_config", { tenantKey: tenantFromProps });
+    return tenantFromProps;
   }
-  const storedTenantId = getStorage(STORAGE_KEYS.tenantId);
-  const storedClientId = getStorage(STORAGE_KEYS.clientId);
-  const tenantIdToUse = storedTenantId || config.tenantId;
-  const clientIdToUse = storedClientId || config.client.clientId;
-  const redirectUriToUse = Config.getRedirectUri();
-  const params = new URLSearchParams({
-    client_id: `public-${clientIdToUse}`,
-    tenant_id: tenantIdToUse,
-    redirect_uri: redirectUriToUse,
-    response_type: DEFAULT_RESPONSE_TYPE,
-    scope: config.client.scopes,
-    state,
-    code_challenge: codeChallenge,
-    code_challenge_method: DEFAULT_CODE_CHALLENGE_METHOD
-  });
-  return `${authServerBase}/connect/authorize?${params.toString()}`;
+  const fromHost = validateTenantKey(getEffectiveTenantCode());
+  if (fromHost) {
+    logger.debug("[tenant] Resolved tenant from host/runtime config", { tenantKey: fromHost });
+    return fromHost;
+  }
+  logger.warn("[tenant] Unable to resolve tenant key (props + host/runtime empty)");
+  return null;
+}
+async function resolveTenantConfig(tenantKey, tenantResolver) {
+  const resolved = await tenantResolver.resolve(tenantKey);
+  if (!resolved) return null;
+  return { ...resolved, tenantKey };
+}
+async function resolveTenantConfigCached(tenantKey, tenantResolver) {
+  return defaultTenantConfigCache.getOrResolve(
+    tenantKey,
+    (key) => resolveTenantConfig(key, tenantResolver)
+  );
+}
+
+// src/application/domain-facade.ts
+function isLocalhost2() {
+  const runtime = getAuthRuntime();
+  const hostname = runtime ? runtime.urlProvider.getCurrentUrl().hostname : typeof window !== "undefined" ? window.location.hostname : "";
+  return isLocalhost(hostname);
+}
+function extractTenantKey() {
+  return resolveTenantKey();
+}
+function isCallbackUrl() {
+  const runtime = getAuthRuntime();
+  if (runtime) return isCallbackUrlFromUrl(runtime.urlProvider.getCurrentUrl());
+  if (typeof window === "undefined") return false;
+  const params = new URLSearchParams(window.location.search);
+  return params.has("code") && params.has("state");
 }
 
 // src/strategies/oauth2-pkce/token-exchange.ts
@@ -1331,6 +1329,221 @@ async function refreshAccessToken() {
   })();
   return refreshPromise;
 }
+
+// src/strategies/oauth2-pkce/pkce.ts
+function generateCodeVerifier(length = 128) {
+  const array = new Uint8Array(length);
+  crypto.getRandomValues(array);
+  const base64 = btoa(String.fromCharCode(...array));
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+async function generateCodeChallenge(verifier) {
+  try {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(verifier);
+    const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    const base64 = btoa(String.fromCharCode(...hashArray));
+    return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+  } catch {
+    throw new Error("Failed to generate code challenge");
+  }
+}
+function generateState() {
+  const array = new Uint8Array(32);
+  crypto.getRandomValues(array);
+  const base64 = btoa(String.fromCharCode(...array));
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+
+// src/utils/validation.ts
+function isValidGuid(guid) {
+  if (!guid || typeof guid !== "string") {
+    return false;
+  }
+  const guidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  return guidRegex.test(guid.trim());
+}
+function validateTenantId(tenantId) {
+  if (!tenantId || tenantId.trim() === "") {
+    return {
+      isValid: false,
+      error: "Tenant ID is required"
+    };
+  }
+  if (!isValidGuid(tenantId)) {
+    return {
+      isValid: false,
+      error: "Tenant ID must be a valid GUID format (00000000-0000-0000-0000-000000000001)"
+    };
+  }
+  return { isValid: true };
+}
+
+// src/application/security/redirectLoopGuard.ts
+var DEFAULT_MAX_REDIRECTS = 5;
+var WINDOW_MS = 60 * 1e3;
+var redirectCount = 0;
+var firstRedirectAt = 0;
+function resetRedirectLoopGuard() {
+  redirectCount = 0;
+  firstRedirectAt = 0;
+}
+function checkAndIncrementRedirect(maxAttempts = DEFAULT_MAX_REDIRECTS) {
+  const now = Date.now();
+  if (now - firstRedirectAt > WINDOW_MS) {
+    redirectCount = 0;
+    firstRedirectAt = now;
+  }
+  if (redirectCount >= maxAttempts) {
+    emitAuthEvent(AuthEventNames.REDIRECT_LOOP_RISK, {
+      message: `Redirect attempt limit (${maxAttempts}) exceeded`
+    });
+    return false;
+  }
+  redirectCount++;
+  return true;
+}
+
+// src/strategies/oauth2-pkce/oauth.ts
+function storeTenantConfig(config) {
+  const validation = validateTenantId(config.tenantId);
+  if (!validation.isValid) {
+    logger.warn("Tenant ID validation failed", { tenantId: config.tenantId });
+  }
+  const authServerToStore = Config.getAuthServerUrl() || config.authServer;
+  const redirectUriToStore = Config.getRedirectUri();
+  writeHostConfigCache({
+    authServerUrl: authServerToStore,
+    clientId: config.client.clientId,
+    clientCode: config.client.clientCode ?? config.client.clientId,
+    redirectUri: redirectUriToStore,
+    callbackUrl: redirectUriToStore,
+    tenantId: config.tenantId,
+    tenantKey: config.tenantKey ?? "",
+    tenantCode: config.tenantKey ?? ""
+  });
+  if (config.tenantKey) {
+    setStorage(STORAGE_KEYS.tenantKey, config.tenantKey);
+  }
+}
+async function initiateAuthFlow(config) {
+  try {
+    logger.info("Initiating OAuth authorization flow");
+    const authServerFromProps = Config.getAuthServerUrl();
+    const authServerEffective = (authServerFromProps || config?.authServer || "").replace(/\/+$/, "");
+    const redirectUriEffective = Config.getRedirectUri();
+    const tenantIdEffective = config?.tenantId || "";
+    const clientIdEffective = config?.client?.clientId || "";
+    logger.debug("[initiateAuthFlow] Resolved inputs", {
+      authServerFromProps: authServerFromProps ? "(provided)" : "(empty)",
+      authServerEffective,
+      redirectUriEffective,
+      tenantIdEffective,
+      clientIdEffective,
+      scopes: config?.client?.scopes,
+      hasRuntime: !!getAuthRuntime()
+    });
+    const token = getAccessToken();
+    if (token && !isAccessTokenExpired()) {
+      logger.debug("Valid token already exists, skipping auth flow");
+      clearFlowFlags();
+      return;
+    }
+    if (isCallbackUrl()) {
+      logger.debug("Callback URL detected - clearing flow flag to allow callback processing");
+      clearFlowFlags();
+      return;
+    }
+    if (isFlowInProgress()) {
+      if (isFlowFlagStale(3e3)) {
+        logger.info("Stale auth flow flag detected, clearing and proceeding");
+        clearFlowFlags();
+      } else {
+        logger.debug("Auth flow already in progress (recent), skipping duplicate redirect");
+        return;
+      }
+    }
+    setFlowFlags();
+    if (!(Config.getAuthServerUrl() || config?.authServer) || !config.client?.clientId || !config.client?.redirectUri) {
+      logger.error("[initiateAuthFlow] Missing required tenant config", {
+        authServerEffective,
+        clientId: config?.client?.clientId,
+        redirectUriFromTenantApi: config?.client?.redirectUri,
+        redirectUriEffective
+      });
+      throw new Error("Invalid tenant configuration for auth flow");
+    }
+    storeTenantConfig(config);
+    logger.debug("[initiateAuthFlow] Stored tenant config, generating PKCE");
+    removeStorage(getStorageKey("callback_processed"));
+    removeStorage(getStorageKey("state_mismatch"));
+    clearCallbackProcessing();
+    const codeVerifier = generateCodeVerifier();
+    const codeChallenge = await generateCodeChallenge(codeVerifier);
+    const state = generateState();
+    removeStorage(STORAGE_KEYS.codeVerifier);
+    removeStorage(STORAGE_KEYS.state);
+    setStorage(STORAGE_KEYS.codeVerifier, codeVerifier);
+    setStorage(STORAGE_KEYS.state, state);
+    const authUrl = buildAuthorizationUrl(config, codeChallenge, state);
+    logger.debug("[initiateAuthFlow] Built authorization URL", {
+      authServerEffective,
+      urlPrefix: authUrl?.slice(0, 80)
+    });
+    if (!authUrl || !(authUrl.startsWith("http://") || authUrl.startsWith("https://"))) {
+      throw new Error("Invalid authorization URL generated");
+    }
+    if (!checkAndIncrementRedirect()) {
+      logger.warn("Redirect loop protection: max redirect attempts exceeded");
+      clearFlowFlags();
+      return;
+    }
+    logger.info("Redirecting to authorization server");
+    emitAuthEvent(AuthEventNames.LOGIN_STARTED, { tenantKey: config.tenantKey });
+    const runtime = getAuthRuntime();
+    if (runtime) {
+      logger.debug("[initiateAuthFlow] Redirect via runtime.urlProvider.redirect");
+      runtime.urlProvider.redirect(authUrl);
+    } else if (typeof window !== "undefined") {
+      logger.debug("[initiateAuthFlow] Redirect via window.location.replace");
+      window.location.replace(authUrl);
+    } else {
+      logger.error("[initiateAuthFlow] No runtime and no window; cannot redirect", { authUrl });
+    }
+  } catch (error) {
+    clearFlowFlags();
+    logger.error("Failed to initiate auth flow", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+    throw error;
+  }
+}
+function buildAuthorizationUrl(config, codeChallenge, state) {
+  const authServerBase = (Config.getAuthServerUrl() || config.authServer || "").replace(/\/+$/, "");
+  if (isLocalhost2()) {
+    logger.debug("Building authorization URL", {
+      authServer: authServerBase,
+      clientId: config.client.clientId,
+      redirectUri: config.client.redirectUri,
+      scopes: config.client.scopes
+    });
+  }
+  const tenantIdToUse = config.tenantId;
+  const clientIdToUse = config.client.clientId;
+  const redirectUriToUse = Config.getRedirectUri();
+  const params = new URLSearchParams({
+    client_id: `public-${clientIdToUse}`,
+    tenant_id: tenantIdToUse,
+    redirect_uri: redirectUriToUse,
+    response_type: DEFAULT_RESPONSE_TYPE,
+    scope: config.client.scopes,
+    state,
+    code_challenge: codeChallenge,
+    code_challenge_method: DEFAULT_CODE_CHALLENGE_METHOD
+  });
+  return `${authServerBase}/connect/authorize?${params.toString()}`;
+}
 function isProcessed() {
   return getStorage(getStorageKey("callback_processed")) === "true";
 }
@@ -1349,15 +1562,6 @@ function clearProcessing() {
   removeStorage(getStorageKey("callback_processed"));
 }
 var urlCleaned = false;
-function cleanUrl() {
-  if (urlCleaned) return;
-  if (isProcessing()) return;
-  const runtime = getAuthRuntime();
-  const clean = runtime ? `${runtime.urlProvider.getCurrentUrl().origin}${runtime.urlProvider.getCurrentUrl().pathname}` : typeof window !== "undefined" ? `${window.location.origin}${window.location.pathname}` : "/";
-  if (runtime) runtime.urlProvider.redirect(clean);
-  else if (typeof window !== "undefined") window.location.replace(clean);
-  urlCleaned = true;
-}
 function cleanUrlSoft() {
   if (urlCleaned) return;
   if (isProcessing()) return;
@@ -1368,13 +1572,52 @@ function cleanUrlSoft() {
   urlCleaned = true;
 }
 function clearAllAuthFlags() {
-  removeStorage(getStorageKey("force_login"));
-  removeStorage(getStorageKey("logout_in_progress"));
   clearFlowFlags();
 }
+async function tryRecoverOAuthConfigFromTenant() {
+  const runtime = getAuthRuntime();
+  const tenantKey = (resolveTenantKey() ?? getTenantKey() ?? "").trim();
+  if (!runtime?.tenantResolver || !tenantKey) {
+    logger.debug("[Callback] OAuth config recovery skipped \u2014 no tenantResolver or tenantKey", {
+      hasResolver: !!runtime?.tenantResolver,
+      tenantKey: tenantKey || "(empty)"
+    });
+    return null;
+  }
+  try {
+    const tc = await runtime.tenantResolver.resolve(tenantKey);
+    if (!tc?.client?.clientId || !tc.tenantId) {
+      logger.warn("[Callback] OAuth config recovery: tenant resolve missing client or tenantId", {
+        tenantKey
+      });
+      return null;
+    }
+    storeTenantConfig(tc);
+    return {
+      clientId: tc.client.clientId.trim() || null,
+      redirectUri: tc.client.redirectUri?.trim() || getRedirectUri(),
+      tenantId: tc.tenantId.trim() || null
+    };
+  } catch (e) {
+    logger.warn("[Callback] OAuth config recovery: tenant re-resolve failed", {
+      tenantKey,
+      error: e instanceof Error ? e.message : String(e)
+    });
+    return null;
+  }
+}
 async function handleCallback() {
+  const runtimeSearch = getAuthRuntime()?.urlProvider.getCurrentUrl().search;
+  const windowSearch = typeof window !== "undefined" ? window.location.search : "";
+  logger.debug("[Callback] handleCallback invoked", {
+    isProcessed: isProcessed(),
+    isProcessing: isProcessing(),
+    isCallbackUrl: isCallbackUrl(),
+    runtimeSearch: runtimeSearch ?? "(none)",
+    windowSearch: windowSearch || "(none)"
+  });
   if (isProcessed()) {
-    logger.debug("Callback already processed in this session - preventing duplicate processing");
+    logger.warn("[Callback] Early exit: callback already processed");
     if (isCallbackUrl()) {
       if (!isProcessing()) cleanUrlSoft();
     }
@@ -1382,31 +1625,16 @@ async function handleCallback() {
     return true;
   }
   if (isProcessing()) {
-    logger.debug("Callback processing already in progress - waiting for completion");
+    logger.warn("[Callback] Early exit: callback processing already in progress");
     return true;
   }
-  if (getStorage(getStorageKey("force_login")) === "true") {
-    logger.info("Force-login flag present \u2192 callback skipped (logout occurred)");
-    const runtime = getAuthRuntime();
-    if (runtime && runtime.urlProvider.getCurrentUrl().search) cleanUrlSoft();
-    else if (typeof window !== "undefined" && window.location.search) cleanUrlSoft();
-    clearAllAuthFlags();
-    clearProcessing();
-    return false;
-  }
   const storedTenantKey = getTenantKey();
-  let currentTenantKey = null;
-  try {
-    const propsConfigStr = getStorage(getStorageKey("props_config"));
-    if (propsConfigStr) {
-      const propsConfig = JSON.parse(propsConfigStr);
-      currentTenantKey = propsConfig.tenantKey || null;
-    }
-  } catch {
-  }
-  if (!currentTenantKey) currentTenantKey = storedTenantKey;
+  const currentTenantKey = resolveTenantKey() ?? storedTenantKey;
   if (currentTenantKey && storedTenantKey && currentTenantKey !== storedTenantKey) {
-    logger.info("TenantKey changed - bypassing callback, starting fresh login");
+    logger.warn("[Callback] Early exit: tenant key changed before exchange", {
+      currentTenantKey,
+      storedTenantKey
+    });
     clearAllStorage();
     clearAllAuthFlags();
     clearProcessing();
@@ -1416,7 +1644,10 @@ async function handleCallback() {
     if (isCallbackUrl()) cleanUrlSoft();
     return false;
   }
-  if (!isCallbackUrl()) return false;
+  if (!isCallbackUrl()) {
+    logger.warn("[Callback] Early exit: URL is not callback URL");
+    return false;
+  }
   markProcessing();
   clearFlowFlags();
   urlCleaned = false;
@@ -1427,70 +1658,76 @@ async function handleCallback() {
     const state = params.get("state");
     const error = params.get("error");
     if (error || !code || !state) {
-      logger.error("Invalid OAuth callback params", { error, code, state });
+      logger.error("[Callback] Early exit: invalid OAuth callback params", { error, code, state });
       clearAllAuthFlags();
       clearProcessing();
-      markProcessed();
       cleanUrlSoft();
       return false;
     }
     const storedState = getState();
     if (!storedState || storedState !== state) {
       const currentTenantKeyFromUrl = extractTenantKey();
-      let storedTenantKeyFromProps = null;
-      try {
-        const propsConfigStr = getStorage(getStorageKey("props_config"));
-        if (propsConfigStr) {
-          const propsConfig = JSON.parse(propsConfigStr);
-          storedTenantKeyFromProps = propsConfig.tenantKey || null;
-        }
-      } catch {
-      }
-      const tenantKeyChanged = currentTenantKeyFromUrl && storedTenantKeyFromProps && currentTenantKeyFromUrl !== storedTenantKeyFromProps;
+      const resolvedTenantKey = resolveTenantKey();
+      const tenantKeyChanged = currentTenantKeyFromUrl && resolvedTenantKey && currentTenantKeyFromUrl !== resolvedTenantKey;
       if (tenantKeyChanged) {
-        logger.info("OAuth state mismatch due to tenantKey change - expected behavior, starting fresh login");
+        logger.warn("[Callback] Early exit: state mismatch due to tenant key change");
       } else {
-        logger.error("OAuth state mismatch - redirecting to login");
+        logger.error("[Callback] Early exit: OAuth state mismatch - redirecting to login");
       }
       clearAllAuthFlags();
       clearProcessing();
-      markProcessed();
       cleanUrlSoft();
       setStorage(getStorageKey("state_mismatch"), "true");
       return false;
     }
     const codeVerifier = getCodeVerifier();
     if (!codeVerifier) {
-      logger.error("Missing PKCE verifier");
+      logger.error("[Callback] Early exit: missing PKCE verifier");
       clearAllAuthFlags();
       clearProcessing();
-      markProcessed();
       cleanUrlSoft();
       return false;
     }
-    const clientId = getClientId();
-    const redirectUri = getRedirectUri();
-    const tenantId = getTenantId();
+    let clientId = getClientId();
+    let redirectUri = getRedirectUri();
+    let tenantId = getTenantId();
+    if (!clientId || !redirectUri || !tenantId) {
+      logger.warn("[Callback] OAuth config incomplete \u2014 attempting tenant re-resolve", {
+        hasClientId: !!clientId,
+        hasRedirectUri: !!redirectUri,
+        hasTenantId: !!tenantId
+      });
+      const recovered = await tryRecoverOAuthConfigFromTenant();
+      if (recovered) {
+        if (!redirectUri) redirectUri = recovered.redirectUri;
+        if (!tenantId) tenantId = recovered.tenantId;
+        clientId = getClientId() ?? normalizeClientIdForOAuthTokenBody(recovered.clientId) ?? null;
+      }
+    }
     if (!clientId || !redirectUri || !tenantId) {
-      logger.error("Missing OAuth config during callback");
+      logger.error("[Callback] Early exit: missing OAuth config during callback", {
+        hasClientId: !!clientId,
+        hasRedirectUri: !!redirectUri,
+        hasTenantId: !!tenantId
+      });
       clearAllAuthFlags();
       clearProcessing();
-      markProcessed();
       cleanUrlSoft();
       return false;
     }
     const existingToken = getAccessToken();
     if (existingToken && !isAccessTokenExpired()) {
-      logger.debug("Valid token already exists - skipping code exchange");
+      logger.warn("[Callback] Early exit: valid token already exists - skipping code exchange");
       removeStorage(STORAGE_KEYS.codeVerifier);
       removeStorage(STORAGE_KEYS.state);
       clearAllAuthFlags();
       markProcessed();
-      cleanUrl();
+      cleanUrlSoft();
       resetRedirectLoopGuard();
       emitAuthEvent(AuthEventNames.CALLBACK_SUCCESS);
       return true;
     }
+    logger.info("[Callback] Entering token exchange");
     const tokenData = await exchangeCodeForTokens({
       code,
       codeVerifier,
@@ -1510,7 +1747,7 @@ async function handleCallback() {
     removeStorage(STORAGE_KEYS.state);
     clearAllAuthFlags();
     markProcessed();
-    cleanUrl();
+    cleanUrlSoft();
     logger.info("OAuth callback processed successfully");
     resetRedirectLoopGuard();
     emitAuthEvent(AuthEventNames.CALLBACK_SUCCESS);
@@ -1571,157 +1808,6 @@ async function handleCallback() {
   }
 }
 
-// src/infrastructure/tenant/TenantConfigCache.ts
-var DEFAULT_TTL_MS = 5 * 60 * 1e3;
-var TenantConfigCache = class {
-  constructor(ttlMs = DEFAULT_TTL_MS) {
-    this.cache = /* @__PURE__ */ new Map();
-    this.inFlight = /* @__PURE__ */ new Map();
-    this.ttlMs = ttlMs;
-  }
-  get(tenantKey) {
-    const entry = this.cache.get(tenantKey);
-    if (!entry) return null;
-    if (Date.now() >= entry.expiresAt) {
-      this.cache.delete(tenantKey);
-      return null;
-    }
-    return entry.config;
-  }
-  set(tenantKey, config) {
-    this.cache.set(tenantKey, {
-      config,
-      expiresAt: Date.now() + this.ttlMs
-    });
-  }
-  invalidate(tenantKey) {
-    if (tenantKey) {
-      this.cache.delete(tenantKey);
-      this.inFlight.delete(tenantKey);
-    } else {
-      this.cache.clear();
-      this.inFlight.clear();
-    }
-  }
-  async getOrResolve(tenantKey, resolver) {
-    if (!tenantKey || !tenantKey.trim()) return null;
-    const key = tenantKey.trim();
-    const cached = this.get(key);
-    if (cached) {
-      logger.debug("Tenant config from cache", { tenantKey: key });
-      return cached;
-    }
-    const existing = this.inFlight.get(key);
-    if (existing) {
-      logger.debug("Tenant resolution reused (in-flight)", { tenantKey: key });
-      return existing;
-    }
-    const promise = (async () => {
-      try {
-        const config = await resolver(key);
-        if (config) this.set(key, config);
-        return config;
-      } finally {
-        this.inFlight.delete(key);
-      }
-    })();
-    this.inFlight.set(key, promise);
-    return promise;
-  }
-};
-
-// src/infrastructure/tenant/tenantResolution.ts
-var defaultTenantConfigCache = new TenantConfigCache();
-function getTenantKeyFromRuntime(url, config) {
-  try {
-    const propsConfigStr = getStorage(getStorageKey("props_config"));
-    if (propsConfigStr) {
-      const propsConfig = JSON.parse(propsConfigStr);
-      if (propsConfig.tenantKey?.trim()) return propsConfig.tenantKey.trim();
-      return null;
-    }
-  } catch {
-  }
-  return extractTenantKeyFromUrl(url, config, getStorage, getStorageKey);
-}
-function getPropsConfig() {
-  try {
-    const propsConfigStr = getStorage(getStorageKey("props_config"));
-    if (!propsConfigStr) return null;
-    const parsed = JSON.parse(propsConfigStr);
-    if (parsed && typeof parsed === "object" && "authServerUrl" in parsed) {
-      delete parsed.authServerUrl;
-    }
-    return parsed;
-  } catch {
-    removeStorage(getStorageKey("props_config"));
-    return null;
-  }
-}
-function mergeConfigWithProps(apiEnvConfig, propsConfig, tenantKey) {
-  return {
-    tenantId: propsConfig.tenantId || apiEnvConfig.tenantId,
-    authServer: apiEnvConfig.authServer,
-    tenantKey: tenantKey || apiEnvConfig.tenantKey,
-    client: {
-      clientId: propsConfig.clientId || apiEnvConfig.client.clientId,
-      redirectUri: apiEnvConfig.client.redirectUri,
-      scopes: apiEnvConfig.client.scopes
-    }
-  };
-}
-async function resolveTenantConfig(tenantKey, tenantResolver) {
-  if (!tenantKey) return null;
-  const propsConfig = getPropsConfig();
-  const resolved = await tenantResolver.resolve(tenantKey);
-  if (!resolved) return null;
-  removeStorage(getStorageKey("props_config"));
-  return {
-    ...propsConfig ? mergeConfigWithProps(resolved, propsConfig, tenantKey) : resolved,
-    tenantKey: tenantKey || resolved.tenantKey
-  };
-}
-async function resolveTenantConfigCached(tenantKey, tenantResolver) {
-  if (!tenantKey) return null;
-  return defaultTenantConfigCache.getOrResolve(
-    tenantKey,
-    (key) => resolveTenantConfig(key, tenantResolver)
-  );
-}
-
-// src/application/flows/ForceLoginFlow.ts
-var ForceLoginFlow = class {
-  async execute(context) {
-    const { runtime } = context;
-    const { urlProvider, logger: log } = runtime;
-    const getUrl = () => urlProvider.getCurrentUrl();
-    if (isCallbackUrlFromUrl(getUrl())) {
-      await handleCallback();
-      if (isCallbackUrlFromUrl(getUrl())) {
-        log.warn("Callback URL still present after cleanup, forcing URL clean");
-        const u = getUrl();
-        urlProvider.redirect(`${u.origin}${u.pathname}`);
-        return { completed: true };
-      }
-    }
-    clearFlowFlags();
-    const tenantKey = getTenantKeyFromRuntime(getUrl(), runtime.configProvider);
-    if (!tenantKey) return { completed: true };
-    const tenantConfig = await resolveTenantConfigCached(tenantKey, runtime.tenantResolver);
-    if (!tenantConfig) {
-      log.error("Tenant config resolution failed for force login", { tenantKey });
-      throw new SanitizedError(
-        "TENANT_CONFIG_RESOLUTION_FAILED",
-        "Unable to resolve tenant configuration",
-        new Error(`Tenant config resolution failed for tenantKey: ${tenantKey}`)
-      );
-    }
-    storeTenantConfig(tenantConfig);
-    await initiateAuthFlow(tenantConfig);
-    return { completed: true };
-  }
-};
-
 // src/application/flows/CallbackFlow.ts
 var CallbackFlow = class {
   async execute(context) {
@@ -1809,21 +1895,16 @@ var RefreshFlow = class {
         error: error instanceof Error ? error.message : String(error)
       });
     }
-    const tenantKeyFromRuntime = getTenantKeyFromRuntime(getUrl(), runtime.configProvider);
-    const tenantKeyFromStorage = getStorage(getStorageKey("tenant_key"));
-    const tenantKeyFromConfig = runtime.configProvider.getClientCode?.() ?? "";
-    const tenantKey = (tenantKeyFromRuntime || tenantKeyFromStorage || tenantKeyFromConfig)?.trim();
+    const tenantKey = resolveTenantKey();
     log.debug("[RefreshFlow] Tenant key resolved", {
       tenantKey: tenantKey ?? "(null)",
-      fromRuntime: tenantKeyFromRuntime ?? "(null)",
-      fromStorage: tenantKeyFromStorage ?? "(null)",
-      fromConfig: tenantKeyFromConfig || "(null)"
+      source: tenantKey ? "resolved" : "none"
     });
     if (!tenantKey) {
       throw new SanitizedError(
         "TENANT_KEY_RESOLUTION_FAILED",
         "Unable to resolve tenant",
-        new Error("Tenant key missing")
+        new Error(`Tenant key missing for refresh flow at url=${getUrl().href}`)
       );
     }
     const tenantConfig = await resolveTenantConfigCached(tenantKey, runtime.tenantResolver);
@@ -1852,22 +1933,17 @@ var TenantSwitchFlow = class {
     emitAuthEvent(AuthEventNames.TENANT_SWITCHED, { tenantKey: newTenantKey ?? void 0 });
     removeStorage(getStorageKey("tenant_switched"));
     removeStorage(getStorageKey("new_tenant_key"));
-    const tenantKeyFromRuntime = getTenantKeyFromRuntime(getUrl(), runtime.configProvider);
-    const tenantKeyFromStorage = getStorage(getStorageKey("tenant_key"));
-    const tenantKeyFromConfig = runtime.configProvider.getClientCode?.() ?? "";
-    const tenantKey = (newTenantKey || tenantKeyFromRuntime || tenantKeyFromStorage || tenantKeyFromConfig)?.trim();
+    const tenantKey = (newTenantKey || resolveTenantKey())?.trim() || null;
     log.debug("[TenantSwitchFlow] Tenant key resolved", {
       tenantKey: tenantKey ?? "(null)",
       fromNewTenantKey: newTenantKey ?? "(null)",
-      fromRuntime: tenantKeyFromRuntime ?? "(null)",
-      fromStorage: tenantKeyFromStorage ?? "(null)",
-      fromConfig: tenantKeyFromConfig || "(null)"
+      source: newTenantKey ? "new_tenant_key" : tenantKey ? "resolved" : "none"
     });
     if (!tenantKey) {
       throw new SanitizedError(
         "TENANT_KEY_RESOLUTION_FAILED",
         "Unable to resolve tenant after switch",
-        new Error("Tenant key missing after switch")
+        new Error(`Tenant key missing after switch at url=${getUrl().href}`)
       );
     }
     const tenantConfig = await resolveTenantConfigCached(tenantKey, runtime.tenantResolver);
@@ -1878,6 +1954,21 @@ var TenantSwitchFlow = class {
         new Error(`Tenant config resolution failed for tenantKey: ${tenantKey}`)
       );
     }
+    try {
+      const cfg = getAuthConfig2();
+      writeHostConfigCache({
+        apiBaseUrl: cfg.apiBaseUrl,
+        authServerUrl: cfg.authServerUrl,
+        callbackUrl: cfg.callbackUrl,
+        appId: cfg.appId,
+        clientCode: tenantConfig.client?.clientCode ?? cfg.clientCode ?? "",
+        clientId: cfg.clientId || tenantConfig.client?.clientId,
+        tenantId: tenantConfig.tenantId ?? cfg.tenantId,
+        tenantKey,
+        tenantCode: tenantKey
+      });
+    } catch {
+    }
     setTenantKey(tenantKey);
     storeTenantConfig(tenantConfig);
     await initiateAuthFlow(tenantConfig);
@@ -1902,21 +1993,16 @@ var LoginFlow = class {
     }
     const wasStateMismatch = getStorage(getStorageKey("state_mismatch")) === "true";
     if (wasStateMismatch) removeStorage(getStorageKey("state_mismatch"));
-    const tenantKeyFromRuntime = getTenantKeyFromRuntime(url, runtime.configProvider);
-    const tenantKeyFromStorage = getStorage(getStorageKey("tenant_key"));
-    const tenantKeyFromConfig = runtime.configProvider.getClientCode?.() ?? "";
-    const tenantKey = (tenantKeyFromRuntime || tenantKeyFromStorage || tenantKeyFromConfig)?.trim();
+    const tenantKey = resolveTenantKey();
     log.debug("[LoginFlow] Tenant key resolved", {
       tenantKey: tenantKey ?? "(null)",
-      fromRuntime: tenantKeyFromRuntime ?? "(null)",
-      fromStorage: tenantKeyFromStorage ?? "(null)",
-      fromConfig: tenantKeyFromConfig || "(null)"
+      source: tenantKey ? "resolved" : "none"
     });
     if (!tenantKey) {
       throw new SanitizedError(
         "TENANT_KEY_RESOLUTION_FAILED",
         "Unable to resolve tenant",
-        new Error("Tenant key missing")
+        new Error(`Tenant key missing for login flow at url=${url.href}`)
       );
     }
     log.debug("[LoginFlow] Resolving tenant config", { tenantKey });
@@ -1945,7 +2031,6 @@ var LoginFlow = class {
 };
 
 // src/application/flows/getFlowForState.ts
-var forceLoginFlow = new ForceLoginFlow();
 var callbackFlow = new CallbackFlow();
 var authenticatedFlow = new AuthenticatedFlow();
 var refreshFlow = new RefreshFlow();
@@ -1953,8 +2038,6 @@ var tenantSwitchFlow = new TenantSwitchFlow();
 var loginFlow = new LoginFlow();
 function getFlowForState(state) {
   switch (state) {
-    case "FORCE_LOGIN" /* FORCE_LOGIN */:
-      return forceLoginFlow;
     case "PROCESSING_CALLBACK" /* PROCESSING_CALLBACK */:
       return callbackFlow;
     case "AUTHENTICATED" /* AUTHENTICATED */:
@@ -2047,6 +2130,22 @@ async function bootstrap() {
   return bootstrapImpl();
 }
 
+// src/infrastructure/watchers/watcher-guard.ts
+var suspended = false;
+var generation = 0;
+function suspendWatchers() {
+  suspended = true;
+  generation += 1;
+  return generation;
+}
+function resumeWatchers(expectedGen) {
+  if (expectedGen !== void 0 && expectedGen !== generation) return;
+  suspended = false;
+}
+function areWatchersSuspended() {
+  return suspended;
+}
+
 // src/strategies/cookie/cookie-auth.ts
 var COOKIE_NAMES = {
   accessToken: "tenneo_auth_access_token",
@@ -2173,36 +2272,14 @@ function checkCookiesDeleted() {
   }
 }
 function handleCookieDeletion() {
+  if (areWatchersSuspended()) {
+    logger.debug("Cookie deletion handler skipped \u2014 watchers suspended (logout/teardown)");
+    return;
+  }
   try {
     logger.info("Cookies deleted detected - clearing session and redirecting to login");
-    const forceLoginSet = getStorage(getStorageKey("force_login")) === "true";
-    const logoutInProgress = getStorage(getStorageKey("logout_in_progress")) === "true";
-    if (forceLoginSet || logoutInProgress) {
-      logger.debug(
-        "Force login or logout in progress - skipping bootstrap from cookie watcher (avoids duplicate by-code API call)"
-      );
-      return;
-    }
     clearAuthStorage();
-    try {
-      if (typeof window !== "undefined") {
-        const forceLogin = window.localStorage.getItem(getStorageKey("force_login"));
-        const logoutInProgressPreserve = window.localStorage.getItem(
-          getStorageKey("logout_in_progress")
-        );
-        clearAuthSessionStorage();
-        if (forceLogin === "true")
-          window.localStorage.setItem(getStorageKey("force_login"), "true");
-        if (logoutInProgressPreserve === "true")
-          window.localStorage.setItem(getStorageKey("logout_in_progress"), "true");
-      } else {
-        clearAuthSessionStorage();
-      }
-    } catch (error) {
-      logger.warn("Failed to clear sessionStorage", {
-        error: error instanceof Error ? error.message : String(error)
-      });
-    }
+    clearAuthSessionStorage();
     const cb = getSessionClearedCallback();
     if (cb) {
       Promise.resolve(cb()).catch((error) => {
@@ -2236,13 +2313,7 @@ function startCookieWatcher() {
     allCookies: initialCookies
   });
   watchInterval = setInterval(async () => {
-    const logoutInProgress = typeof window !== "undefined" && window.localStorage.getItem(getStorageKey("logout_in_progress")) === "true";
-    if (logoutInProgress) {
-      logger.debug("Logout detected. Cookie watcher will not trigger bootstrap.");
-      lastCookieSnapshot = getCookieSnapshot();
-      lastCookieMap = getCookieMap();
-      return;
-    }
+    if (areWatchersSuspended()) return;
     const cookiesDeleted = checkCookiesDeleted();
     if (cookiesDeleted) {
       logger.info("Cookies deleted detected by cookie watcher");
@@ -2306,9 +2377,11 @@ function checkStorageCleared() {
   }
 }
 function handleStorageEvent(event) {
+  if (areWatchersSuspended()) return;
   if (typeof window !== "undefined" && event.storageArea === window.sessionStorage) {
     const wasCleared = checkStorageCleared();
     if (wasCleared) {
+      if (areWatchersSuspended()) return;
       logger.info("Detected manual sessionStorage clear! Redirecting to login...");
       const cb = getSessionClearedCallback();
       if (cb) {
@@ -2328,13 +2401,10 @@ function startStorageWatcher() {
   storageEventListener = handleStorageEvent;
   window.addEventListener("storage", storageEventListener);
   const pollInterval = setInterval(() => {
-    const logoutInProgress = typeof window !== "undefined" && window.localStorage.getItem(getStorageKey("logout_in_progress")) === "true";
-    if (logoutInProgress) {
-      logger.debug("Logout detected. Storage watcher will not trigger bootstrap.");
-      return;
-    }
+    if (areWatchersSuspended()) return;
     const wasCleared = checkStorageCleared();
     if (wasCleared) {
+      if (areWatchersSuspended()) return;
       logger.info("Detected manual sessionStorage clear (polling)! Redirecting to login...");
       clearInterval(pollInterval);
       const cb = getSessionClearedCallback();
@@ -2419,62 +2489,68 @@ function getCsrfToken() {
 }
 async function callServerLogout(logoutUrl) {
   const csrfToken = getCsrfToken();
-  async function doRequest(method) {
-    const isPost = method === "POST";
-    const headers = {
-      "X-Requested-With": "XMLHttpRequest",
-      Accept: "application/json, */*"
-    };
-    if (isPost) {
-      headers["Content-Type"] = "application/x-www-form-urlencoded";
-    }
-    if (csrfToken) {
-      headers["X-CSRF-Token"] = csrfToken;
-    }
+  const headers = {
+    "X-Requested-With": "XMLHttpRequest",
+    Accept: "application/json, */*",
+    "Content-Type": "application/x-www-form-urlencoded"
+  };
+  if (csrfToken) {
+    headers["X-CSRF-Token"] = csrfToken;
+  }
+  try {
     const response = await fetch(logoutUrl, {
-      method,
+      method: "POST",
       mode: "cors",
       headers,
-      credentials: "include"
+      credentials: "include",
+      body: ""
     });
     if (!response.ok) {
-      logger.warn("Server logout HTTP error", {
-        method,
+      logger.warn("[logout] Server logout HTTP error", {
         status: response.status,
         statusText: response.statusText
       });
       return { success: false };
     }
-    const data = await response.json().catch(() => ({}));
-    logger.info(`Server logout response (${method})`, { response: data });
+    const contentType = response.headers.get("content-type") || "";
+    if (!contentType.includes("application/json")) {
+      logger.info("[logout] Server logout: OK without JSON body", {
+        status: response.status
+      });
+      return { success: true, response: { success: true } };
+    }
+    const text = await response.text();
+    let data = {};
+    if (text?.trim()) {
+      try {
+        data = JSON.parse(text);
+      } catch {
+        logger.warn("[logout] Server returned non-JSON body with JSON content-type");
+        return { success: false };
+      }
+    }
+    logger.info("[logout] Server logout response", { response: data });
     if (data && (data.success === true || data.logout === true)) {
       return { success: true, response: data };
     }
-    logger.warn("Server logout response invalid payload", {
-      method,
-      response: data
-    });
+    if (!text || text.trim() === "") {
+      return { success: true, response: { success: true } };
+    }
+    logger.warn("[logout] Server logout: unexpected JSON payload", { response: data });
     return { success: false, response: data };
-  }
-  try {
-    const postResult = await doRequest("POST");
-    if (postResult.success) return postResult;
-    logger.debug("POST logout did not succeed, trying GET");
-    const getResult = await doRequest("GET");
-    return getResult;
   } catch (error) {
-    logger.warn("Server logout failed (both POST and GET)", {
+    logger.warn("[logout] Server logout request failed", {
       error: error instanceof Error ? error.message : String(error)
     });
     return { success: false };
   }
 }
 function performLocalLogoutCleanup() {
-  logger.debug("Performing local logout cleanup");
+  logger.debug("[logout] Local cleanup: cookies + auth storage");
   try {
     getAuthRuntime()?.clearCookies?.clearCookies();
   } catch (error) {
-    logger.debug("Runtime cookie clearer failed (ignored)", {
+    logger.debug("[logout] Runtime cookie clearer failed (ignored)", {
       error: error instanceof Error ? error.message : String(error)
     });
   }
@@ -2482,11 +2558,11 @@ function performLocalLogoutCleanup() {
   try {
     clearAuthStorage();
   } catch (error) {
-    logger.warn("clearAuthStorage failed (ignored)", {
+    logger.warn("[logout] clearAuthStorage failed", {
       error: error instanceof Error ? error.message : String(error)
     });
   }
-  logger.info("Local logout cleanup completed");
+  logger.info("[logout] Local cleanup completed");
 }
 function acquireLogoutLock() {
   const LOCK_KEY = getStorageKey("logout_lock");
@@ -2495,7 +2571,7 @@ function acquireLogoutLock() {
   if (existingLock) {
     const lockTime = Number(existingLock);
     if (!Number.isNaN(lockTime) && now - lockTime < 5e3) {
-      logger.debug("Logout lock active \u2013 skipping duplicate logout", {
+      logger.debug("[logout] Lock active \u2014 duplicate tab logout skipped", {
         now,
         lockTime
       });
@@ -2511,102 +2587,95 @@ function releaseLogoutLock() {
   } catch {
   }
 }
-async function logout(tenantKey) {
-  setStorage(getStorageKey("force_login"), "true");
-  if (tenantKey?.trim()) {
-    setStorage(getStorageKey("preserved_tenant_key"), tenantKey.trim());
-  }
+var logoutInFlight = null;
+async function runLogoutPipeline(tenantKey) {
+  const gen = suspendWatchers();
+  logger.info("[logout] Lifecycle: suspend watchers", { generation: gen });
+  stopStorageWatcher();
+  stopCookieWatcher();
   if (!acquireLogoutLock()) {
-    return { success: true, message: "Logout already in progress." };
+    resumeWatchers(gen);
+    logger.debug("[logout] Lifecycle: resume (skipped \u2014 lock)");
+    return { success: true, message: "Logout already in progress in another tab." };
   }
+  let serverLogoutSuccess = false;
+  let serverResponse;
   try {
-    stopStorageWatcher();
-    stopCookieWatcher();
-    const apiAuthBaseUrl = Config.getAuthServerUrl();
-    let serverLogoutSuccess = false;
-    let serverResponse;
+    if (tenantKey?.trim()) {
+      applyRuntimeTenantSwitch(tenantKey.trim(), { syncStorageCache: true });
+      logger.info("[logout] Runtime tenant applied for logout context", {
+        tenantKey: tenantKey.trim()
+      });
+    }
+    const authConfig = getAuthConfig2();
+    const apiAuthBaseUrl = authConfig.authServerUrl;
     if (apiAuthBaseUrl) {
       const logoutUrl = buildUrl(apiAuthBaseUrl, "account/logout");
-      logger.info("Calling auth server logout", { logoutUrl });
+      logger.info("[logout] Calling auth server logout (POST)", { logoutUrl });
       const logoutResult = await callServerLogout(logoutUrl);
       serverLogoutSuccess = logoutResult.success;
       serverResponse = logoutResult.response;
       if (!serverLogoutSuccess) {
-        logger.warn("Server logout failed \u2013 session may still exist", {
+        logger.warn("[logout] Server logout did not confirm success \u2014 clearing local session anyway", {
           logoutUrl,
           serverResponse
         });
       }
     } else {
-      logger.warn("API auth base URL not configured, performing local logout only");
+      logger.warn("[logout] authServerUrl missing \u2014 local logout only");
     }
+  } catch (error) {
+    logger.error("[logout] Unexpected error before local cleanup", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
+  try {
     performLocalLogoutCleanup();
-    const preservedTenantKey = getStorage(getStorageKey("preserved_tenant_key"));
-    if (preservedTenantKey) {
-      const propsKey = getStorageKey("props_config");
-      let existing = {};
-      try {
-        const raw = getStorage(propsKey);
-        if (raw) {
-          existing = JSON.parse(raw);
-        }
-      } catch {
-        existing = {};
-      }
-      const merged = {
-        ...existing,
-        tenantKey: preservedTenantKey
-      };
-      setStorage(propsKey, JSON.stringify(merged));
-      removeStorage(getStorageKey("preserved_tenant_key"));
-    }
-    resetCookieWatcher();
-    startStorageWatcher();
-    releaseLogoutLock();
-    logger.info("Logout completed \u2013 flags set, storage cleared, fresh login required", {
-      serverLogoutSuccess,
-      serverResponse
+  } catch (error) {
+    logger.error("[logout] Local cleanup threw", {
+      error: error instanceof Error ? error.message : String(error)
     });
-    emitAuthEvent(AuthEventNames.LOGOUT_COMPLETED, {
-      serverLogoutSuccess,
-      tenantKey: getStorage(getStorageKey("preserved_tenant_key")) || void 0,
-      message: serverLogoutSuccess ? "Server logout success" : "Local logout only"
+  }
+  try {
+    syncHostConfigCacheFromMemory();
+    logger.debug("[logout] host_config cache refreshed from runtime (not restored from snapshot)");
+  } catch (error) {
+    logger.warn("[logout] Failed to sync host config cache", {
+      error: error instanceof Error ? error.message : String(error)
     });
-    return {
-      success: true,
-      message: serverLogoutSuccess ? serverResponse?.message || "Logout successful. Session cookies cleared. Fresh login required." : "Logged out locally. Fresh login required (server logout may have failed).",
-      serverResponse
-    };
+  }
+  try {
+    resetCookieWatcher();
+    startStorageWatcher();
+    logger.info("[logout] Watchers restarted");
   } catch (error) {
-    logger.error("Logout failed unexpectedly", {
+    logger.warn("[logout] Watcher restart failed", {
       error: error instanceof Error ? error.message : String(error)
     });
-    performLocalLogoutCleanup();
-    const preservedTenantKey = getStorage(getStorageKey("preserved_tenant_key"));
-    if (preservedTenantKey) {
-      const propsKey = getStorageKey("props_config");
-      let existing = {};
-      try {
-        const raw = getStorage(propsKey);
-        if (raw) {
-          existing = JSON.parse(raw);
-        }
-      } catch {
-        existing = {};
-      }
-      const merged = {
-        ...existing,
-        tenantKey: preservedTenantKey
-      };
-      setStorage(propsKey, JSON.stringify(merged));
-      removeStorage(getStorageKey("preserved_tenant_key"));
-    }
-    releaseLogoutLock();
-    return {
-      success: true,
-      message: "Logged out locally due to an error. Fresh login required."
-    };
   }
+  releaseLogoutLock();
+  resumeWatchers(gen);
+  logger.info("[logout] Lifecycle: complete", { serverLogoutSuccess });
+  emitAuthEvent(AuthEventNames.LOGOUT_COMPLETED, {
+    serverLogoutSuccess,
+    tenantKey: tenantKey?.trim() || getAuthConfig2().tenantCode || void 0,
+    message: serverLogoutSuccess ? "Server logout success" : "Local logout (server may be pending)"
+  });
+  return {
+    success: true,
+    message: serverLogoutSuccess ? serverResponse?.message || "Logout successful. Fresh login required." : "Logged out locally. Fresh login required (server logout may have failed).",
+    serverResponse
+  };
+}
+async function logout(tenantKey) {
+  if (logoutInFlight) {
+    logger.debug("[logout] Coalescing with in-flight logout");
+    return logoutInFlight;
+  }
+  logoutInFlight = runLogoutPipeline(tenantKey).finally(() => {
+    logoutInFlight = null;
+  });
+  return logoutInFlight;
 }
 var AuthContext = react.createContext(void 0);
 function useAuthContext() {
@@ -2681,7 +2750,6 @@ async function resolveTenant(tenantKey) {
           scopes: DEFAULT_SCOPES2
         }
       };
-      console.log("config====", config);
       logger.debug("Resolved tenant config", { tenantCode });
       return config;
     } catch (error) {
@@ -2942,27 +3010,29 @@ function AuthProvider({
       logger.warn("[AuthProvider] callbackUrl missing from host props");
     }
     setConfig({
-      ...mergedTenantCode ? { tenantCode: mergedTenantCode } : {},
+      ...mergedTenantCode ? { tenantCode: mergedTenantCode, tenantKey: mergedTenantCode } : {},
       ...mergedApiBaseUrl ? { apiBaseUrl: mergedApiBaseUrl } : {},
       ...mergedAuthServerUrl ? { authServerUrl: mergedAuthServerUrl } : {},
       ...mergedCallbackUrl ? { callbackUrl: mergedCallbackUrl } : {}
     });
+    logConfigResolutionDebug("AuthProvider host props applied");
     return () => {
       clearConfigOverrides();
     };
   }, [mergedTenantCode, mergedApiBaseUrl, mergedAuthServerUrl, mergedCallbackUrl]);
   react.useEffect(() => {
     try {
-      const payload = {
+      writeHostConfigCache({
         tenantCode: mergedTenantCode ?? "",
+        tenantKey: mergedTenantCode ?? "",
+        appId: appId ?? "",
         apiBaseUrl: mergedApiBaseUrl ?? "",
         authServerUrl: mergedAuthServerUrl ?? "",
         callbackUrl: mergedCallbackUrl ?? ""
-      };
-      setStorage(getStorageKey("host_config"), JSON.stringify(payload));
+      });
     } catch {
     }
-  }, [mergedTenantCode, mergedApiBaseUrl, mergedAuthServerUrl, mergedCallbackUrl]);
+  }, [mergedTenantCode, mergedApiBaseUrl, mergedAuthServerUrl, mergedCallbackUrl, appId]);
   react.useLayoutEffect(() => {
     setStorageKeyPrefix(resolvedTenantKey ?? "");
     const adapter = storageAdapter !== void 0 && storageAdapter !== null ? storageAdapter : createSecureSessionStorageAdapter(namespace);
@@ -3003,24 +3073,18 @@ function AuthProvider({
           const currentUrl = window.location.href;
           const isCallback = currentUrl.includes("code=") || currentUrl.includes("state=");
           if (isCallback) {
-            const cleanUrl2 = window.location.origin + window.location.pathname;
-            window.history.replaceState({}, document.title, cleanUrl2);
+            const cleanUrl = window.location.origin + window.location.pathname;
+            window.history.replaceState({}, document.title, cleanUrl);
           }
         }
         removeStorage(getStorageKey("access_token"));
         removeStorage(getStorageKey("refresh_token"));
         removeStorage(getStorageKey("expires_at"));
-        removeStorage(getStorageKey("id_token"));
         removeStorage(getStorageKey("state"));
         removeStorage(getStorageKey("code_verifier"));
         removeStorage(getStorageKey("callback_processed"));
         clearCallbackProcessing();
         clearFlowFlags();
-        removeStorage(getStorageKey("tenant_id"));
-        if (typeof window !== "undefined") {
-          window.localStorage.removeItem(getStorageKey("force_login"));
-          window.localStorage.removeItem(getStorageKey("logout_in_progress"));
-        }
         setStorage(getStorageKey("props_changed"), "true");
         setStorage(getStorageKey("tenant_switched"), "true");
         setStorage(getStorageKey("new_tenant_key"), resolvedTenantKey2);
@@ -3033,7 +3097,17 @@ function AuthProvider({
       } else if (previousTenantKey) {
         logger.debug("[AuthProvider] TenantKey unchanged", { tenantKey: resolvedTenantKey2 });
       }
-      setStorage(getStorageKey("props_config"), JSON.stringify({ tenantKey: resolvedTenantKey2 }));
+      try {
+        writeHostConfigCache({
+          tenantKey: resolvedTenantKey2,
+          tenantCode: resolvedTenantKey2
+        });
+        logConfigResolutionDebug("AuthProvider tenant key synced to cache", {
+          tenantCode: resolvedTenantKey2,
+          tenantKey: resolvedTenantKey2
+        });
+      } catch {
+      }
       setStorage(getStorageKey("tenant_key"), resolvedTenantKey2);
     } else {
       logger.debug("[AuthProvider] No tenant code determined");
@@ -3232,17 +3306,29 @@ function AuthCallback({
       setStatus("loading");
       setMessage("Completing sign-in...");
       const handled = await handleCallback();
-      if (handled) {
-        const token = getAccessToken();
-        if (token) setTokens(token);
-        setStatus("success");
-        setMessage("Authentication successful. Redirecting...");
-        window.location.replace(successPath);
-      } else {
+      if (!handled) {
         setStatus("error");
         setMessage("Authentication failed. Please try again.");
         window.history.replaceState({}, document.title, window.location.origin + window.location.pathname);
+        return;
+      }
+      const startedAt = Date.now();
+      const MAX_WAIT_MS = 5e3;
+      while (true) {
+        const token = getAccessToken();
+        if (token) {
+          setTokens(token);
+          setStatus("success");
+          setMessage("Authentication successful. Redirecting...");
+          window.location.replace(successPath);
+          return;
+        }
+        if (Date.now() - startedAt > MAX_WAIT_MS) break;
+        await new Promise((r) => setTimeout(r, 200));
       }
+      setStatus("error");
+      setMessage("Authentication did not complete. Please try again.");
+      window.history.replaceState({}, document.title, window.location.origin + window.location.pathname);
     };
     runCallback();
   }, [homePath, loginPath, successPath, setTokens]);
@@ -3424,6 +3510,7 @@ function useAuthInit() {
 }
 
 exports.AuthCallback = AuthCallback;
+exports.AuthConfigError = AuthConfigError;
 exports.AuthEventNames = AuthEventNames;
 exports.AuthProvider = AuthProvider;
 exports.Config = Config;
@@ -3432,6 +3519,8 @@ exports.ProtectedRoute = ProtectedRoute;
 exports.STORAGE_KEYS = STORAGE_KEYS2;
 exports.STORAGE_KEY_PREFIX = STORAGE_KEY_PREFIX;
 exports.SanitizedError = SanitizedError;
+exports.applyRuntimeTenantSwitch = applyRuntimeTenantSwitch;
+exports.areWatchersSuspended = areWatchersSuspended;
 exports.bootstrap = bootstrap;
 exports.buildStorageKey = buildStorageKey;
 exports.createAuthEngine = createAuthEngine;
@@ -3444,27 +3533,41 @@ exports.enforceHttps = enforceHttps;
 exports.ensureValidAccessToken = ensureValidAccessToken;
 exports.extractTenantKey = extractTenantKey;
 exports.getAccessToken = getAccessToken2;
+exports.getAuthConfig = getAuthConfig2;
 exports.getAuthRuntime = getAuthRuntime;
 exports.getConfig = getConfig;
+exports.getConfigFieldSources = getConfigFieldSources;
+exports.getEffectiveTenantCode = getEffectiveTenantCode;
+exports.getEffectiveTenantKey = getEffectiveTenantKey;
 exports.getStorageAdapter = getStorageAdapter;
 exports.getStorageNamespace = getStorageNamespace;
 exports.getStoredAccessToken = getAccessToken;
+exports.initPlugin = initPlugin;
 exports.isAccessTokenExpired = isAccessTokenExpired;
 exports.isCallbackUrl = isCallbackUrl;
+exports.logConfigResolutionDebug = logConfigResolutionDebug;
 exports.logout = logout;
 exports.refreshAccessToken = refreshAccessToken;
+exports.requireAuthConfig = requireAuthConfig;
 exports.resetCookieWatcher = resetCookieWatcher;
 exports.resolveConfig = resolveConfig;
 exports.resolveTenant = resolveTenant;
+exports.resumeWatchers = resumeWatchers;
 exports.sanitizeErrorMessage = sanitizeErrorMessage;
 exports.setAuthRuntime = setAuthRuntime;
 exports.setConfig = setConfig;
+exports.setHostConfigProvider = setHostConfigProvider;
 exports.setStorageContext = setStorageContext;
 exports.startCookieWatcher = startCookieWatcher;
+exports.startStorageWatcher = startStorageWatcher;
 exports.stopCookieWatcher = stopCookieWatcher;
+exports.stopStorageWatcher = stopStorageWatcher;
 exports.subscribeAuthEvent = subscribeAuthEvent;
+exports.suspendWatchers = suspendWatchers;
+exports.syncHostConfigCacheFromMemory = syncHostConfigCacheFromMemory;
 exports.useAuth = useAuth;
 exports.useAuthContext = useAuthContext;
 exports.useAuthInit = useAuthInit;
+exports.writeHostConfigCache = writeHostConfigCache;
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map