tenneo-auth-plugin 1.0.0 → 1.0.3

package/dist/index.mjs

@@ -15,64 +15,6 @@ function getAuthRuntime() {
 function isLocalhost(hostname) {
   return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname.startsWith("192.168.") || hostname.startsWith("10.") || hostname.endsWith(".local");
 }
-function extractTenantKeyFromDomain(urlOrHostname, config) {
-  try {
-    let hostname;
-    if (urlOrHostname.startsWith("http://") || urlOrHostname.startsWith("https://")) {
-      try {
-        const url = new URL(urlOrHostname);
-        hostname = url.hostname;
-      } catch {
-        hostname = urlOrHostname.replace(/^https?:\/\//, "").split("/")[0];
-      }
-    } else {
-      hostname = urlOrHostname;
-    }
-    const parts = hostname.split(".");
-    if (parts.length < 2) return config.getClientCode();
-    const tenantKey = parts[0];
-    if (!tenantKey || tenantKey.trim() === "") return config.getClientCode();
-    if (tenantKey.trim().toLowerCase() === "productlms") return config.getClientCode();
-    return tenantKey.trim();
-  } catch {
-    return config.getClientCode();
-  }
-}
-function extractTenantKeyFromUrl(url, config, getStorage3, getKey) {
-  try {
-    const propsConfigKey = getKey ? getKey("props_config") : "tenneo_auth_props_config";
-    const propsConfigStr = getStorage3(propsConfigKey);
-    if (propsConfigStr) {
-      try {
-        const propsConfig = JSON.parse(propsConfigStr);
-        if (propsConfig.tenantKey?.trim()) return propsConfig.tenantKey.trim();
-      } catch {
-      }
-    }
-    const tenantKeyStorageKey = getKey ? getKey("tenant_key") : "tenneo_auth_tenant_key";
-    const storedTenantKey = getStorage3(tenantKeyStorageKey);
-    if (storedTenantKey?.trim()) return storedTenantKey.trim();
-    const urlParams = new URLSearchParams(url.search);
-    const tenantKeyFromQuery = urlParams.get("t");
-    if (tenantKeyFromQuery?.trim()) {
-      const hostnameParts = url.hostname.split(".");
-      const baseDomain = hostnameParts.length >= 2 ? hostnameParts.slice(-2).join(".") : url.hostname;
-      const simulatedHostname = `${tenantKeyFromQuery.trim()}.${baseDomain}`;
-      const key = extractTenantKeyFromDomain(simulatedHostname, config);
-      if (key) return key;
-      return tenantKeyFromQuery.trim();
-    }
-    const keyFromHost = extractTenantKeyFromDomain(url.hostname, config);
-    if (keyFromHost) return keyFromHost;
-    const clientCode = config.getClientCode();
-    if (clientCode?.trim()) return clientCode.trim();
-    return config.getClientCode();
-  } catch {
-    const clientCode = config.getClientCode();
-    if (clientCode?.trim()) return clientCode.trim();
-    return config.getClientCode();
-  }
-}
 function isCallbackUrlFromUrl(url) {
   const params = new URLSearchParams(url.search);
   return params.has("code") && params.has("state");
@@ -133,8 +75,7 @@ var CONFIG_KEY_SUFFIXES = {
   stateMismatch: "state_mismatch",
   bootstrapInProgress: "bootstrap_in_progress",
   bootstrapTimestamp: "bootstrap_timestamp",
-  callbackHandled: "callback_handled",
-  idToken: "id_token"
+  callbackHandled: "callback_handled"
 };
 
 // src/infrastructure/storage/context.ts
@@ -426,51 +367,7 @@ function createCookieStorageAdapter(namespace, options) {
   };
 }
 
-// src/infrastructure/storage/api.ts
-var KEY_SUFFIXES = {
-  authServerUrl: "auth_server_url",
-  clientId: "client_id",
-  redirectUri: "redirect_uri",
-  tenantId: "tenant_id",
-  tenantKey: "tenant_key",
-  codeVerifier: "code_verifier",
-  state: "state",
-  accessToken: "access_token",
-  refreshToken: "refresh_token",
-  expiresAt: "expires_at"
-};
-var STORAGE_KEYS = {
-  get authServerUrl() {
-    return getStorageKey(KEY_SUFFIXES.authServerUrl);
-  },
-  get clientId() {
-    return getStorageKey(KEY_SUFFIXES.clientId);
-  },
-  get redirectUri() {
-    return getStorageKey(KEY_SUFFIXES.redirectUri);
-  },
-  get tenantId() {
-    return getStorageKey(KEY_SUFFIXES.tenantId);
-  },
-  get tenantKey() {
-    return getStorageKey(KEY_SUFFIXES.tenantKey);
-  },
-  get codeVerifier() {
-    return getStorageKey(KEY_SUFFIXES.codeVerifier);
-  },
-  get state() {
-    return getStorageKey(KEY_SUFFIXES.state);
-  },
-  get accessToken() {
-    return getStorageKey(KEY_SUFFIXES.accessToken);
-  },
-  get refreshToken() {
-    return getStorageKey(KEY_SUFFIXES.refreshToken);
-  },
-  get expiresAt() {
-    return getStorageKey(KEY_SUFFIXES.expiresAt);
-  }
-};
+// src/infrastructure/storage/kv.ts
 function keyToSuffix(key) {
   const prefix = getStorageKeyPrefix();
   return key.startsWith(prefix) ? key.slice(prefix.length) : key;
@@ -506,23 +403,53 @@ function removeStorage(key) {
   } catch {
   }
 }
-function clearAuthStorage() {
-  const adapter = getStorageAdapter();
-  if (!adapter?.clearSync) return;
-  try {
-    adapter.clearTokensSync?.();
-    adapter.clearSync();
-  } catch {
+
+// src/infrastructure/storage/api.ts
+var KEY_SUFFIXES = {
+  tenantKey: "tenant_key",
+  codeVerifier: "code_verifier",
+  state: "state",
+  accessToken: "access_token",
+  refreshToken: "refresh_token",
+  expiresAt: "expires_at"
+};
+var STORAGE_KEYS = {
+  get tenantKey() {
+    return getStorageKey(KEY_SUFFIXES.tenantKey);
+  },
+  get codeVerifier() {
+    return getStorageKey(KEY_SUFFIXES.codeVerifier);
+  },
+  get state() {
+    return getStorageKey(KEY_SUFFIXES.state);
+  },
+  get accessToken() {
+    return getStorageKey(KEY_SUFFIXES.accessToken);
+  },
+  get refreshToken() {
+    return getStorageKey(KEY_SUFFIXES.refreshToken);
+  },
+  get expiresAt() {
+    return getStorageKey(KEY_SUFFIXES.expiresAt);
   }
+};
+function clearAuthStorage() {
+  const keysToClear = [
+    STORAGE_KEYS.accessToken,
+    STORAGE_KEYS.refreshToken,
+    STORAGE_KEYS.expiresAt,
+    STORAGE_KEYS.codeVerifier,
+    STORAGE_KEYS.state,
+    getStorageKey("callback_processed"),
+    getStorageKey("props_config"),
+    getStorageKey("tenant_switched"),
+    getStorageKey("new_tenant_key"),
+    getStorageKey("preserved_tenant_key")
+  ];
+  for (const key of keysToClear) removeStorage(key);
 }
 function clearAuthSessionStorage() {
-  const adapter = getStorageAdapter();
-  if (!adapter?.clearSync) return;
-  try {
-    adapter.clearTokensSync?.();
-    adapter.clearSync();
-  } catch {
-  }
+  clearAuthStorage();
 }
 function clearAllCookies() {
   const runtime = getAuthRuntime();
@@ -531,27 +458,8 @@ function clearAllCookies() {
   } catch {
   }
 }
-function clearAllBrowserStorage() {
-  if (typeof window === "undefined") return;
-  try {
-    window.localStorage?.clear();
-  } catch {
-  }
-  try {
-    window.sessionStorage?.clear();
-  } catch {
-  }
-}
 function clearAllStorage() {
-  const forceLogin = getStorage(getStorageKey("force_login"));
-  const logoutInProgress = getStorage(getStorageKey("logout_in_progress"));
-  const preservedTenantKey = getStorage(getStorageKey("preserved_tenant_key"));
-  clearAuthSessionStorage();
   clearAuthStorage();
-  clearAllBrowserStorage();
-  if (forceLogin === "true") setStorage(getStorageKey("force_login"), "true");
-  if (logoutInProgress === "true") setStorage(getStorageKey("logout_in_progress"), "true");
-  if (preservedTenantKey) setStorage(getStorageKey("preserved_tenant_key"), preservedTenantKey);
   clearAllCookies();
 }
 function getAccessToken() {
@@ -587,15 +495,6 @@ function isAccessTokenExpired() {
   const buffer = 60 * 1e3;
   return Date.now() >= expiresAt - buffer;
 }
-function getClientId() {
-  return getStorage(STORAGE_KEYS.clientId);
-}
-function getRedirectUri() {
-  return getStorage(STORAGE_KEYS.redirectUri);
-}
-function getTenantId() {
-  return getStorage(STORAGE_KEYS.tenantId);
-}
 function getCodeVerifier() {
   return getStorage(STORAGE_KEYS.codeVerifier);
 }
@@ -656,6 +555,252 @@ var Logger = class {
 };
 var logger = new Logger();
 
+// src/config/resolver-core.ts
+var inMemoryConfig = {};
+var hostConfigProvider = null;
+var CACHE_MARKER = "__tenneo_host_config_cache";
+var CACHE_AT = "__tenneo_host_config_cache_at";
+function setConfig(overrides) {
+  inMemoryConfig = { ...inMemoryConfig, ...overrides };
+}
+function clearConfigOverrides() {
+  inMemoryConfig = {};
+}
+function setHostConfigProvider(fn) {
+  hostConfigProvider = fn;
+}
+function readHostBridge() {
+  const out = {};
+  try {
+    if (typeof window !== "undefined" && window.__TENNEO_AUTH_HOST__) {
+      Object.assign(out, window.__TENNEO_AUTH_HOST__);
+    }
+  } catch {
+  }
+  try {
+    const fromProvider = hostConfigProvider?.();
+    if (fromProvider && typeof fromProvider === "object") {
+      Object.assign(out, fromProvider);
+    }
+  } catch (e) {
+    logger.warn("[config] hostConfigProvider threw", {
+      error: e instanceof Error ? e.message : String(e)
+    });
+  }
+  return out;
+}
+function readStorageConfigCache() {
+  try {
+    const raw = getStorage(getStorageKey("host_config"));
+    if (!raw) return {};
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object") return {};
+    const { [CACHE_MARKER]: _m, [CACHE_AT]: _t, ...rest } = parsed;
+    if (!rest.clientId && typeof rest.client_id === "string" && rest.client_id.trim()) {
+      rest.clientId = rest.client_id.trim();
+    }
+    return rest;
+  } catch {
+    return {};
+  }
+}
+function resolveSDKConfig(overrides) {
+  const stored = readStorageConfigCache();
+  const bridge = readHostBridge();
+  return {
+    ...stored,
+    ...bridge,
+    ...inMemoryConfig,
+    ...overrides ?? {}
+  };
+}
+function nonEmptyString(v) {
+  if (v == null) return void 0;
+  const s = String(v).trim();
+  return s || void 0;
+}
+function getConfigFieldSources(overrides) {
+  const stored = readStorageConfigCache();
+  const bridge = readHostBridge();
+  const layers = [
+    { src: "storage_cache", cfg: stored },
+    { src: "host_bridge", cfg: bridge },
+    { src: "memory", cfg: inMemoryConfig }
+  ];
+  if (overrides && Object.keys(overrides).length) {
+    layers.push({ src: "override", cfg: overrides });
+  }
+  const pick = (key) => {
+    for (let i = layers.length - 1; i >= 0; i--) {
+      const v = nonEmptyString(layers[i].cfg[key]);
+      if (v !== void 0) return layers[i].src;
+    }
+    return void 0;
+  };
+  return {
+    tenantCode: pick("tenantCode") ?? pick("tenantKey"),
+    tenantKey: pick("tenantKey") ?? pick("tenantCode"),
+    apiBaseUrl: pick("apiBaseUrl"),
+    authServerUrl: pick("authServerUrl"),
+    callbackUrl: pick("callbackUrl"),
+    clientCode: pick("clientCode"),
+    clientId: pick("clientId"),
+    tenantId: pick("tenantId"),
+    appId: pick("appId")
+  };
+}
+function getEffectiveTenantCode(overrides) {
+  const cfg = resolveSDKConfig(overrides);
+  const t = nonEmptyString(cfg.tenantCode) ?? nonEmptyString(cfg.tenantKey) ?? nonEmptyString(cfg.clientCode) ?? "";
+  return t;
+}
+var getEffectiveTenantKey = getEffectiveTenantCode;
+function trim(v) {
+  return v == null ? "" : String(v).trim();
+}
+function toResolvedConfig(cfg) {
+  const merged = { ...cfg };
+  if (!merged.tenantCode && merged.tenantKey) {
+    merged.tenantCode = merged.tenantKey;
+  }
+  const clientId = trim(merged.clientId) || trim(merged.clientCode);
+  return {
+    apiBaseUrl: trim(merged.apiBaseUrl),
+    authServerUrl: trim(merged.authServerUrl),
+    callbackUrl: trim(merged.callbackUrl) || trim(merged.redirectUri),
+    clientCode: trim(merged.clientCode),
+    tenantCode: trim(merged.tenantCode),
+    appId: trim(merged.appId),
+    clientId,
+    tenantId: trim(merged.tenantId)
+  };
+}
+var AuthConfigError = class extends Error {
+  constructor(missing, message) {
+    super(
+      message ?? `[tenneo-auth] Missing required auth configuration: ${missing.join(", ")}. Provide authServerUrl, callbackUrl (redirectUri), and tenant_key/tenant_code via AuthProvider/initPlugin or window.__TENNEO_AUTH_HOST__.`
+    );
+    this.code = "AUTH_CONFIG_MISSING";
+    this.name = "AuthConfigError";
+    this.missing = missing;
+  }
+};
+function resolveConfig(overrides) {
+  return toResolvedConfig(resolveSDKConfig(overrides));
+}
+function getAuthConfig(options) {
+  const resolved = toResolvedConfig(resolveSDKConfig(options?.overrides));
+  if (options?.strict) {
+    const missing = [];
+    if (!resolved.authServerUrl) missing.push("authServerUrl");
+    if (!resolved.callbackUrl) missing.push("callbackUrl");
+    if (!resolved.tenantCode) missing.push("tenantCode|tenantKey");
+    if (missing.length) throw new AuthConfigError(missing);
+  }
+  return resolved;
+}
+function syncHostConfigCacheFromMemory() {
+  const c = resolveSDKConfig();
+  const patch = {};
+  const keys = [
+    "apiBaseUrl",
+    "authServerUrl",
+    "callbackUrl",
+    "redirectUri",
+    "tenantCode",
+    "tenantKey",
+    "clientCode",
+    "clientId",
+    "tenantId",
+    "appId",
+    "basePath"
+  ];
+  for (const k of keys) {
+    const v = c[k];
+    if (v != null && String(v).trim()) {
+      patch[k] = String(v).trim();
+    }
+  }
+  if (Object.keys(patch).length) writeHostConfigCache(patch);
+}
+function writeHostConfigCache(partial) {
+  try {
+    const key = getStorageKey("host_config");
+    const raw = getStorage(key);
+    let existing = {};
+    try {
+      if (raw) existing = JSON.parse(raw);
+    } catch {
+      existing = {};
+    }
+    const next = {
+      ...existing,
+      ...partial,
+      [CACHE_MARKER]: true,
+      [CACHE_AT]: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    setStorage(key, JSON.stringify(next));
+    logger.debug("[config] host_config cache updated (non-authoritative)", {
+      keys: Object.keys(partial)
+    });
+  } catch (e) {
+    logger.warn("[config] Failed to write host_config cache", {
+      error: e instanceof Error ? e.message : String(e)
+    });
+  }
+}
+function initPlugin(config, opts) {
+  setConfig(config);
+  logger.info("[config] initPlugin \u2014 runtime config updated", {
+    syncStorageCache: opts?.syncStorageCache !== false,
+    tenantCode: config.tenantCode ?? config.tenantKey ?? "(none)"
+  });
+  if (opts?.syncStorageCache !== false) {
+    writeHostConfigCache(config);
+  }
+}
+function logConfigResolutionDebug(context, overrides) {
+  const sources = getConfigFieldSources(overrides);
+  logger.debug(`[config] ${context}`, {
+    fieldSources: sources,
+    effectiveTenantCode: getEffectiveTenantCode(overrides) || "(empty)",
+    hasAuthServerUrl: !!resolveSDKConfig(overrides).authServerUrl,
+    hasCallbackUrl: !!resolveSDKConfig(overrides).callbackUrl
+  });
+}
+
+// src/config/host-fields.ts
+function trim2(v) {
+  if (v == null) return null;
+  const s = String(v).trim();
+  return s || null;
+}
+function oauthClientIdForTokenRequest(raw) {
+  if (!raw) return null;
+  let s = raw.trim();
+  if (!s) return null;
+  if (s.toLowerCase().startsWith("public-")) {
+    s = s.slice("public-".length).trim();
+  }
+  return s || null;
+}
+function getClientId() {
+  const c = resolveSDKConfig();
+  const fromId = oauthClientIdForTokenRequest(trim2(c.clientId));
+  if (fromId) return fromId;
+  return oauthClientIdForTokenRequest(trim2(c.clientCode));
+}
+function normalizeClientIdForOAuthTokenBody(raw) {
+  return oauthClientIdForTokenRequest(trim2(raw));
+}
+function getRedirectUri() {
+  const c = resolveSDKConfig();
+  return trim2(c.callbackUrl) ?? trim2(c.redirectUri);
+}
+function getTenantId() {
+  return trim2(resolveSDKConfig().tenantId);
+}
+
 // src/domain/errors.ts
 function isLocalhostHostname(hostname) {
   return hostname === "localhost" || hostname === "127.0.0.1" || hostname.startsWith("192.168.") || hostname.startsWith("10.") || hostname.startsWith("172.16.");
@@ -711,10 +856,8 @@ function resolveAuthLifecycleState(input) {
     hasRefreshToken,
     isTokenExpired
   } = input;
-  const forceLogin = getStorage3("force_login") === "true";
   const callbackProcessed = getStorage3("callback_processed") === "true";
   const tenantSwitched = getStorage3("tenant_switched") === "true";
-  if (forceLogin) return "FORCE_LOGIN" /* FORCE_LOGIN */;
   if (isCallbackUrl2(url)) return "PROCESSING_CALLBACK" /* PROCESSING_CALLBACK */;
   if (hasValidToken) return "AUTHENTICATED" /* AUTHENTICATED */;
   if (callbackProcessed && !hasToken) return "LOGIN_REQUIRED" /* LOGIN_REQUIRED */;
@@ -775,30 +918,58 @@ function setFlowFlags() {
   setFlowInProgress();
 }
 
-// src/strategies/oauth2-pkce/pkce.ts
-function generateCodeVerifier(length = 128) {
-  const array = new Uint8Array(length);
-  crypto.getRandomValues(array);
-  const base64 = btoa(String.fromCharCode(...array));
-  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+// src/application/events/AuthEvents.ts
+var AuthEventNames = {
+  LOGIN_STARTED: "LOGIN_STARTED",
+  LOGIN_SUCCESS: "LOGIN_SUCCESS",
+  LOGIN_FAILED: "LOGIN_FAILED",
+  CALLBACK_SUCCESS: "CALLBACK_SUCCESS",
+  CALLBACK_FAILED: "CALLBACK_FAILED",
+  TOKEN_REFRESH_SUCCESS: "TOKEN_REFRESH_SUCCESS",
+  TOKEN_REFRESH_FAILED: "TOKEN_REFRESH_FAILED",
+  TENANT_SWITCHED: "TENANT_SWITCHED",
+  LOGOUT_COMPLETED: "LOGOUT_COMPLETED",
+  BOOTSTRAP_STATE_DETECTED: "BOOTSTRAP_STATE_DETECTED",
+  REDIRECT_LOOP_RISK: "REDIRECT_LOOP_RISK"
+};
+var listeners = /* @__PURE__ */ new Map();
+function getHandlers(event) {
+  let set = listeners.get(event);
+  if (!set) {
+    set = /* @__PURE__ */ new Set();
+    listeners.set(event, set);
+  }
+  return set;
 }
-async function generateCodeChallenge(verifier) {
-  try {
-    const encoder = new TextEncoder();
-    const data = encoder.encode(verifier);
-    const hashBuffer = await crypto.subtle.digest("SHA-256", data);
-    const hashArray = Array.from(new Uint8Array(hashBuffer));
-    const base64 = btoa(String.fromCharCode(...hashArray));
-    return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-  } catch {
-    throw new Error("Failed to generate code challenge");
+function getWildcardHandlers() {
+  let set = listeners.get("*");
+  if (!set) {
+    set = /* @__PURE__ */ new Set();
+    listeners.set("*", set);
   }
+  return set;
 }
-function generateState() {
-  const array = new Uint8Array(32);
-  crypto.getRandomValues(array);
-  const base64 = btoa(String.fromCharCode(...array));
-  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+function emitAuthEvent(event, payload) {
+  const handlers = getHandlers(event);
+  const wildcard = getWildcardHandlers();
+  const p = payload ?? {};
+  handlers.forEach((fn) => {
+    try {
+      fn(p);
+    } catch {
+    }
+  });
+  wildcard.forEach((fn) => {
+    try {
+      fn({ ...p, event });
+    } catch {
+    }
+  });
+}
+function subscribeAuthEvent(event, handler) {
+  const set = event === "*" ? getWildcardHandlers() : getHandlers(event);
+  set.add(handler);
+  return () => set.delete(handler);
 }
 
 // src/config/constants.ts
@@ -828,342 +999,169 @@ var DEFAULT_TOKEN_GRANT_TYPE = OAUTH_CONSTANTS.TOKEN_GRANT_TYPE;
 var DEFAULT_REFRESH_GRANT_TYPE = OAUTH_CONSTANTS.REFRESH_GRANT_TYPE;
 
 // src/config/index.ts
-var inMemoryConfig = {};
-function readHostConfigFromStorage() {
-  try {
-    const raw = getStorage(getStorageKey("host_config"));
-    if (!raw) return {};
-    const parsed = JSON.parse(raw);
-    return parsed && typeof parsed === "object" ? parsed : {};
-  } catch {
-    return {};
-  }
+function getAuthConfig2(options) {
+  return getAuthConfig(options);
 }
-function resolveMerged(overrides) {
-  const stored = readHostConfigFromStorage();
-  const cfg = { ...stored, ...inMemoryConfig, ...overrides ?? {} };
-  const trimmed = (v) => v == null ? "" : String(v).trim();
-  return {
-    apiBaseUrl: trimmed(cfg.apiBaseUrl),
-    authServerUrl: trimmed(cfg.authServerUrl),
-    callbackUrl: trimmed(cfg.callbackUrl),
-    clientCode: trimmed(cfg.clientCode)
-  };
-}
-function resolveConfig(overrides) {
-  return resolveMerged(overrides);
+function requireAuthConfig(overrides) {
+  return getAuthConfig({ strict: true, overrides });
 }
 function getConfig() {
-  return resolveMerged();
-}
-function setConfig(overrides) {
-  inMemoryConfig = { ...inMemoryConfig, ...overrides };
-}
-function clearConfigOverrides() {
-  inMemoryConfig = {};
+  return resolveConfig();
 }
 function getRedirectUri2() {
-  const cfg = resolveMerged();
+  const cfg = resolveConfig();
   if (cfg.callbackUrl) return cfg.callbackUrl;
   if (typeof window !== "undefined") return `${window.location.origin}/callback`;
   return "";
 }
 var Config = {
   getApiBaseUrl() {
-    return resolveMerged().apiBaseUrl;
+    return resolveConfig().apiBaseUrl;
   },
   getAuthServerUrl() {
-    return resolveMerged().authServerUrl;
+    return resolveConfig().authServerUrl;
   },
   getClientCode() {
-    return resolveMerged().clientCode;
+    return resolveConfig().clientCode;
   },
   getRedirectUri() {
     return getRedirectUri2();
   },
   getAll() {
-    return resolveMerged();
+    return resolveConfig();
   }
 };
-
-// src/utils/validation.ts
-function isValidGuid(guid) {
-  if (!guid || typeof guid !== "string") {
-    return false;
-  }
-  const guidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-  return guidRegex.test(guid.trim());
-}
-function validateTenantId(tenantId) {
-  if (!tenantId || tenantId.trim() === "") {
-    return {
-      isValid: false,
-      error: "Tenant ID is required"
-    };
-  }
-  if (!isValidGuid(tenantId)) {
-    return {
-      isValid: false,
-      error: "Tenant ID must be a valid GUID format (00000000-0000-0000-0000-000000000001)"
-    };
+function applyRuntimeTenantSwitch(tenantKey, opts) {
+  const t = tenantKey.trim();
+  if (!t) return;
+  setConfig({ tenantCode: t, tenantKey: t });
+  logConfigResolutionDebug("applyRuntimeTenantSwitch", { tenantCode: t, tenantKey: t });
+  if (opts?.syncStorageCache !== false) {
+    writeHostConfigCache({ tenantCode: t, tenantKey: t });
   }
-  return { isValid: true };
 }
 
-// src/application/domain-facade.ts
-function isLocalhost2() {
-  const runtime = getAuthRuntime();
-  const hostname = runtime ? runtime.urlProvider.getCurrentUrl().hostname : typeof window !== "undefined" ? window.location.hostname : "";
-  return isLocalhost(hostname);
-}
-function extractTenantKey() {
-  const runtime = getAuthRuntime();
-  if (runtime) {
-    const url = runtime.urlProvider.getCurrentUrl();
-    return extractTenantKeyFromUrl(url, runtime.configProvider, getStorage, getStorageKey);
+// src/infrastructure/tenant/TenantConfigCache.ts
+var DEFAULT_TTL_MS = 5 * 60 * 1e3;
+var TenantConfigCache = class {
+  constructor(ttlMs = DEFAULT_TTL_MS) {
+    this.cache = /* @__PURE__ */ new Map();
+    this.inFlight = /* @__PURE__ */ new Map();
+    this.ttlMs = ttlMs;
   }
-  return extractTenantKeyLegacy();
-}
-function extractTenantKeyLegacy() {
-  if (typeof window === "undefined") return Config.getClientCode();
-  try {
-    const propsConfigStr = getStorage(getStorageKey("props_config"));
-    if (propsConfigStr) {
-      const propsConfig = JSON.parse(propsConfigStr);
-      if (propsConfig.tenantKey?.trim()) return propsConfig.tenantKey.trim();
+  get(tenantKey) {
+    const entry = this.cache.get(tenantKey);
+    if (!entry) return null;
+    if (Date.now() >= entry.expiresAt) {
+      this.cache.delete(tenantKey);
+      return null;
     }
-    const stored = getStorage(getStorageKey("tenant_key"));
-    if (stored?.trim()) return stored.trim();
-    const urlParams = new URLSearchParams(window.location.search);
-    const t = urlParams.get("t");
-    if (t?.trim()) return t.trim();
-    const hostname = window.location.hostname;
-    const parts = hostname.split(".");
-    if (parts.length >= 2 && parts[0] && parts[0].toLowerCase() !== "productlms") return parts[0].trim();
-    return Config.getClientCode();
-  } catch {
-    return Config.getClientCode();
+    return entry.config;
   }
-}
-function isCallbackUrl() {
-  const runtime = getAuthRuntime();
-  if (runtime) return isCallbackUrlFromUrl(runtime.urlProvider.getCurrentUrl());
-  if (typeof window === "undefined") return false;
-  const params = new URLSearchParams(window.location.search);
-  return params.has("code") && params.has("state");
-}
-
-// src/application/events/AuthEvents.ts
-var AuthEventNames = {
-  LOGIN_STARTED: "LOGIN_STARTED",
-  LOGIN_SUCCESS: "LOGIN_SUCCESS",
-  LOGIN_FAILED: "LOGIN_FAILED",
-  CALLBACK_SUCCESS: "CALLBACK_SUCCESS",
-  CALLBACK_FAILED: "CALLBACK_FAILED",
-  TOKEN_REFRESH_SUCCESS: "TOKEN_REFRESH_SUCCESS",
-  TOKEN_REFRESH_FAILED: "TOKEN_REFRESH_FAILED",
-  TENANT_SWITCHED: "TENANT_SWITCHED",
-  LOGOUT_COMPLETED: "LOGOUT_COMPLETED",
-  BOOTSTRAP_STATE_DETECTED: "BOOTSTRAP_STATE_DETECTED",
-  REDIRECT_LOOP_RISK: "REDIRECT_LOOP_RISK"
-};
-var listeners = /* @__PURE__ */ new Map();
-function getHandlers(event) {
-  let set = listeners.get(event);
-  if (!set) {
-    set = /* @__PURE__ */ new Set();
-    listeners.set(event, set);
+  set(tenantKey, config) {
+    this.cache.set(tenantKey, {
+      config,
+      expiresAt: Date.now() + this.ttlMs
+    });
   }
-  return set;
-}
-function getWildcardHandlers() {
-  let set = listeners.get("*");
-  if (!set) {
-    set = /* @__PURE__ */ new Set();
-    listeners.set("*", set);
+  invalidate(tenantKey) {
+    if (tenantKey) {
+      this.cache.delete(tenantKey);
+      this.inFlight.delete(tenantKey);
+    } else {
+      this.cache.clear();
+      this.inFlight.clear();
+    }
   }
-  return set;
-}
-function emitAuthEvent(event, payload) {
-  const handlers = getHandlers(event);
-  const wildcard = getWildcardHandlers();
-  const p = payload ?? {};
-  handlers.forEach((fn) => {
-    try {
-      fn(p);
-    } catch {
+  async getOrResolve(tenantKey, resolver) {
+    if (!tenantKey || !tenantKey.trim()) return null;
+    const key = tenantKey.trim();
+    const cached = this.get(key);
+    if (cached) {
+      logger.debug("Tenant config from cache", { tenantKey: key });
+      return cached;
     }
-  });
-  wildcard.forEach((fn) => {
-    try {
-      fn({ ...p, event });
-    } catch {
+    const existing = this.inFlight.get(key);
+    if (existing) {
+      logger.debug("Tenant resolution reused (in-flight)", { tenantKey: key });
+      return existing;
     }
-  });
-}
-function subscribeAuthEvent(event, handler) {
-  const set = event === "*" ? getWildcardHandlers() : getHandlers(event);
-  set.add(handler);
-  return () => set.delete(handler);
-}
-
-// src/application/security/redirectLoopGuard.ts
-var DEFAULT_MAX_REDIRECTS = 5;
-var WINDOW_MS = 60 * 1e3;
-var redirectCount = 0;
-var firstRedirectAt = 0;
-function resetRedirectLoopGuard() {
-  redirectCount = 0;
-  firstRedirectAt = 0;
-}
-function checkAndIncrementRedirect(maxAttempts = DEFAULT_MAX_REDIRECTS) {
-  const now = Date.now();
-  if (now - firstRedirectAt > WINDOW_MS) {
-    redirectCount = 0;
-    firstRedirectAt = now;
-  }
-  if (redirectCount >= maxAttempts) {
-    emitAuthEvent(AuthEventNames.REDIRECT_LOOP_RISK, {
-      message: `Redirect attempt limit (${maxAttempts}) exceeded`
-    });
-    return false;
+    const promise = (async () => {
+      try {
+        const config = await resolver(key);
+        if (config) this.set(key, config);
+        return config;
+      } finally {
+        this.inFlight.delete(key);
+      }
+    })();
+    this.inFlight.set(key, promise);
+    return promise;
   }
-  redirectCount++;
-  return true;
-}
+};
 
-// src/strategies/oauth2-pkce/oauth.ts
-function storeTenantConfig(config) {
-  const validation = validateTenantId(config.tenantId);
-  if (!validation.isValid) {
-    logger.warn("Tenant ID validation failed", { tenantId: config.tenantId });
-  }
-  const authServerToStore = Config.getAuthServerUrl() || config.authServer;
-  setStorage(STORAGE_KEYS.authServerUrl, authServerToStore);
-  setStorage(STORAGE_KEYS.clientId, config.client.clientId);
-  setStorage(STORAGE_KEYS.redirectUri, Config.getRedirectUri());
-  setStorage(STORAGE_KEYS.tenantId, config.tenantId);
-  if (config.tenantKey) {
-    setStorage(STORAGE_KEYS.tenantKey, config.tenantKey);
-  }
-}
-async function initiateAuthFlow(config) {
+// src/infrastructure/tenant/tenantResolution.ts
+var defaultTenantConfigCache = new TenantConfigCache();
+function consumePropsConfig() {
+  const propsConfigKey = getStorageKey("props_config");
   try {
-    logger.info("Initiating OAuth authorization flow");
-    const authServerFromProps = Config.getAuthServerUrl();
-    const authServerEffective = (authServerFromProps || config?.authServer || "").replace(/\/+$/, "");
-    const redirectUriEffective = Config.getRedirectUri();
-    const storedTenantId = getStorage(STORAGE_KEYS.tenantId);
-    const storedClientId = getStorage(STORAGE_KEYS.clientId);
-    const tenantIdEffective = storedTenantId || config?.tenantId || "";
-    const clientIdEffective = storedClientId || config?.client?.clientId || "";
-    logger.debug("[initiateAuthFlow] Resolved inputs", {
-      authServerFromProps: authServerFromProps ? "(provided)" : "(empty)",
-      authServerEffective,
-      redirectUriEffective,
-      tenantIdEffective,
-      clientIdEffective,
-      scopes: config?.client?.scopes,
-      hasRuntime: !!getAuthRuntime()
-    });
-    const token = getAccessToken();
-    if (token && !isAccessTokenExpired()) {
-      logger.debug("Valid token already exists, skipping auth flow");
-      clearFlowFlags();
-      return;
-    }
-    if (isCallbackUrl()) {
-      logger.debug("Callback URL detected - clearing flow flag to allow callback processing");
-      clearFlowFlags();
-      return;
-    }
-    if (isFlowInProgress()) {
-      if (isFlowFlagStale(3e3)) {
-        logger.info("Stale auth flow flag detected, clearing and proceeding");
-        clearFlowFlags();
-      } else {
-        logger.debug("Auth flow already in progress (recent), skipping duplicate redirect");
-        return;
-      }
-    }
-    setFlowFlags();
-    if (!(Config.getAuthServerUrl() || config?.authServer) || !config.client?.clientId || !config.client?.redirectUri) {
-      logger.error("[initiateAuthFlow] Missing required tenant config", {
-        authServerEffective,
-        clientId: config?.client?.clientId,
-        redirectUriFromTenantApi: config?.client?.redirectUri,
-        redirectUriEffective
-      });
-      throw new Error("Invalid tenant configuration for auth flow");
-    }
-    storeTenantConfig(config);
-    logger.debug("[initiateAuthFlow] Stored tenant config, generating PKCE");
-    const codeVerifier = generateCodeVerifier();
-    const codeChallenge = await generateCodeChallenge(codeVerifier);
-    const state = generateState();
-    removeStorage(STORAGE_KEYS.codeVerifier);
-    removeStorage(STORAGE_KEYS.state);
-    setStorage(STORAGE_KEYS.codeVerifier, codeVerifier);
-    setStorage(STORAGE_KEYS.state, state);
-    const authUrl = buildAuthorizationUrl(config, codeChallenge, state);
-    logger.debug("[initiateAuthFlow] Built authorization URL", {
-      authServerEffective,
-      urlPrefix: authUrl?.slice(0, 80)
-    });
-    if (!authUrl || !(authUrl.startsWith("http://") || authUrl.startsWith("https://"))) {
-      throw new Error("Invalid authorization URL generated");
-    }
-    if (!checkAndIncrementRedirect()) {
-      logger.warn("Redirect loop protection: max redirect attempts exceeded");
-      clearFlowFlags();
-      return;
-    }
-    logger.info("Redirecting to authorization server");
-    emitAuthEvent(AuthEventNames.LOGIN_STARTED, { tenantKey: config.tenantKey });
-    const runtime = getAuthRuntime();
-    if (runtime) {
-      logger.debug("[initiateAuthFlow] Redirect via runtime.urlProvider.redirect");
-      runtime.urlProvider.redirect(authUrl);
-    } else if (typeof window !== "undefined") {
-      logger.debug("[initiateAuthFlow] Redirect via window.location.replace");
-      window.location.replace(authUrl);
-    } else {
-      logger.error("[initiateAuthFlow] No runtime and no window; cannot redirect", { authUrl });
-    }
-  } catch (error) {
-    clearFlowFlags();
-    logger.error("Failed to initiate auth flow", {
-      error: error instanceof Error ? error.message : String(error)
-    });
-    throw error;
+    const propsConfigStr = getStorage(propsConfigKey);
+    if (!propsConfigStr) return null;
+    const parsed = JSON.parse(propsConfigStr);
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  } finally {
+    removeStorage(propsConfigKey);
   }
-}
-function buildAuthorizationUrl(config, codeChallenge, state) {
-  const authServerBase = (Config.getAuthServerUrl() || config.authServer || "").replace(/\/+$/, "");
-  if (isLocalhost2()) {
-    logger.debug("Building authorization URL", {
-      authServer: authServerBase,
-      clientId: config.client.clientId,
-      redirectUri: config.client.redirectUri,
-      scopes: config.client.scopes
-    });
+}
+function validateTenantKey(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed ? trimmed : null;
+}
+function resolveTenantKey() {
+  const propsConfig = consumePropsConfig();
+  const tenantFromProps = validateTenantKey(propsConfig?.tenantKey);
+  if (tenantFromProps) {
+    logger.debug("[tenant] Resolved tenant from props_config", { tenantKey: tenantFromProps });
+    return tenantFromProps;
   }
-  const storedTenantId = getStorage(STORAGE_KEYS.tenantId);
-  const storedClientId = getStorage(STORAGE_KEYS.clientId);
-  const tenantIdToUse = storedTenantId || config.tenantId;
-  const clientIdToUse = storedClientId || config.client.clientId;
-  const redirectUriToUse = Config.getRedirectUri();
-  const params = new URLSearchParams({
-    client_id: `public-${clientIdToUse}`,
-    tenant_id: tenantIdToUse,
-    redirect_uri: redirectUriToUse,
-    response_type: DEFAULT_RESPONSE_TYPE,
-    scope: config.client.scopes,
-    state,
-    code_challenge: codeChallenge,
-    code_challenge_method: DEFAULT_CODE_CHALLENGE_METHOD
-  });
-  return `${authServerBase}/connect/authorize?${params.toString()}`;
+  const fromHost = validateTenantKey(getEffectiveTenantCode());
+  if (fromHost) {
+    logger.debug("[tenant] Resolved tenant from host/runtime config", { tenantKey: fromHost });
+    return fromHost;
+  }
+  logger.warn("[tenant] Unable to resolve tenant key (props + host/runtime empty)");
+  return null;
+}
+async function resolveTenantConfig(tenantKey, tenantResolver) {
+  const resolved = await tenantResolver.resolve(tenantKey);
+  if (!resolved) return null;
+  return { ...resolved, tenantKey };
+}
+async function resolveTenantConfigCached(tenantKey, tenantResolver) {
+  return defaultTenantConfigCache.getOrResolve(
+    tenantKey,
+    (key) => resolveTenantConfig(key, tenantResolver)
+  );
+}
+
+// src/application/domain-facade.ts
+function isLocalhost2() {
+  const runtime = getAuthRuntime();
+  const hostname = runtime ? runtime.urlProvider.getCurrentUrl().hostname : typeof window !== "undefined" ? window.location.hostname : "";
+  return isLocalhost(hostname);
+}
+function extractTenantKey() {
+  return resolveTenantKey();
+}
+function isCallbackUrl() {
+  const runtime = getAuthRuntime();
+  if (runtime) return isCallbackUrlFromUrl(runtime.urlProvider.getCurrentUrl());
+  if (typeof window === "undefined") return false;
+  const params = new URLSearchParams(window.location.search);
+  return params.has("code") && params.has("state");
 }
 
 // src/strategies/oauth2-pkce/token-exchange.ts
@@ -1325,6 +1323,221 @@ async function refreshAccessToken() {
   })();
   return refreshPromise;
 }
+
+// src/strategies/oauth2-pkce/pkce.ts
+function generateCodeVerifier(length = 128) {
+  const array = new Uint8Array(length);
+  crypto.getRandomValues(array);
+  const base64 = btoa(String.fromCharCode(...array));
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+async function generateCodeChallenge(verifier) {
+  try {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(verifier);
+    const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    const base64 = btoa(String.fromCharCode(...hashArray));
+    return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+  } catch {
+    throw new Error("Failed to generate code challenge");
+  }
+}
+function generateState() {
+  const array = new Uint8Array(32);
+  crypto.getRandomValues(array);
+  const base64 = btoa(String.fromCharCode(...array));
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+
+// src/utils/validation.ts
+function isValidGuid(guid) {
+  if (!guid || typeof guid !== "string") {
+    return false;
+  }
+  const guidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  return guidRegex.test(guid.trim());
+}
+function validateTenantId(tenantId) {
+  if (!tenantId || tenantId.trim() === "") {
+    return {
+      isValid: false,
+      error: "Tenant ID is required"
+    };
+  }
+  if (!isValidGuid(tenantId)) {
+    return {
+      isValid: false,
+      error: "Tenant ID must be a valid GUID format (00000000-0000-0000-0000-000000000001)"
+    };
+  }
+  return { isValid: true };
+}
+
+// src/application/security/redirectLoopGuard.ts
+var DEFAULT_MAX_REDIRECTS = 5;
+var WINDOW_MS = 60 * 1e3;
+var redirectCount = 0;
+var firstRedirectAt = 0;
+function resetRedirectLoopGuard() {
+  redirectCount = 0;
+  firstRedirectAt = 0;
+}
+function checkAndIncrementRedirect(maxAttempts = DEFAULT_MAX_REDIRECTS) {
+  const now = Date.now();
+  if (now - firstRedirectAt > WINDOW_MS) {
+    redirectCount = 0;
+    firstRedirectAt = now;
+  }
+  if (redirectCount >= maxAttempts) {
+    emitAuthEvent(AuthEventNames.REDIRECT_LOOP_RISK, {
+      message: `Redirect attempt limit (${maxAttempts}) exceeded`
+    });
+    return false;
+  }
+  redirectCount++;
+  return true;
+}
+
+// src/strategies/oauth2-pkce/oauth.ts
+function storeTenantConfig(config) {
+  const validation = validateTenantId(config.tenantId);
+  if (!validation.isValid) {
+    logger.warn("Tenant ID validation failed", { tenantId: config.tenantId });
+  }
+  const authServerToStore = Config.getAuthServerUrl() || config.authServer;
+  const redirectUriToStore = Config.getRedirectUri();
+  writeHostConfigCache({
+    authServerUrl: authServerToStore,
+    clientId: config.client.clientId,
+    clientCode: config.client.clientCode ?? config.client.clientId,
+    redirectUri: redirectUriToStore,
+    callbackUrl: redirectUriToStore,
+    tenantId: config.tenantId,
+    tenantKey: config.tenantKey ?? "",
+    tenantCode: config.tenantKey ?? ""
+  });
+  if (config.tenantKey) {
+    setStorage(STORAGE_KEYS.tenantKey, config.tenantKey);
+  }
+}
+async function initiateAuthFlow(config) {
+  try {
+    logger.info("Initiating OAuth authorization flow");
+    const authServerFromProps = Config.getAuthServerUrl();
+    const authServerEffective = (authServerFromProps || config?.authServer || "").replace(/\/+$/, "");
+    const redirectUriEffective = Config.getRedirectUri();
+    const tenantIdEffective = config?.tenantId || "";
+    const clientIdEffective = config?.client?.clientId || "";
+    logger.debug("[initiateAuthFlow] Resolved inputs", {
+      authServerFromProps: authServerFromProps ? "(provided)" : "(empty)",
+      authServerEffective,
+      redirectUriEffective,
+      tenantIdEffective,
+      clientIdEffective,
+      scopes: config?.client?.scopes,
+      hasRuntime: !!getAuthRuntime()
+    });
+    const token = getAccessToken();
+    if (token && !isAccessTokenExpired()) {
+      logger.debug("Valid token already exists, skipping auth flow");
+      clearFlowFlags();
+      return;
+    }
+    if (isCallbackUrl()) {
+      logger.debug("Callback URL detected - clearing flow flag to allow callback processing");
+      clearFlowFlags();
+      return;
+    }
+    if (isFlowInProgress()) {
+      if (isFlowFlagStale(3e3)) {
+        logger.info("Stale auth flow flag detected, clearing and proceeding");
+        clearFlowFlags();
+      } else {
+        logger.debug("Auth flow already in progress (recent), skipping duplicate redirect");
+        return;
+      }
+    }
+    setFlowFlags();
+    if (!(Config.getAuthServerUrl() || config?.authServer) || !config.client?.clientId || !config.client?.redirectUri) {
+      logger.error("[initiateAuthFlow] Missing required tenant config", {
+        authServerEffective,
+        clientId: config?.client?.clientId,
+        redirectUriFromTenantApi: config?.client?.redirectUri,
+        redirectUriEffective
+      });
+      throw new Error("Invalid tenant configuration for auth flow");
+    }
+    storeTenantConfig(config);
+    logger.debug("[initiateAuthFlow] Stored tenant config, generating PKCE");
+    removeStorage(getStorageKey("callback_processed"));
+    removeStorage(getStorageKey("state_mismatch"));
+    clearCallbackProcessing();
+    const codeVerifier = generateCodeVerifier();
+    const codeChallenge = await generateCodeChallenge(codeVerifier);
+    const state = generateState();
+    removeStorage(STORAGE_KEYS.codeVerifier);
+    removeStorage(STORAGE_KEYS.state);
+    setStorage(STORAGE_KEYS.codeVerifier, codeVerifier);
+    setStorage(STORAGE_KEYS.state, state);
+    const authUrl = buildAuthorizationUrl(config, codeChallenge, state);
+    logger.debug("[initiateAuthFlow] Built authorization URL", {
+      authServerEffective,
+      urlPrefix: authUrl?.slice(0, 80)
+    });
+    if (!authUrl || !(authUrl.startsWith("http://") || authUrl.startsWith("https://"))) {
+      throw new Error("Invalid authorization URL generated");
+    }
+    if (!checkAndIncrementRedirect()) {
+      logger.warn("Redirect loop protection: max redirect attempts exceeded");
+      clearFlowFlags();
+      return;
+    }
+    logger.info("Redirecting to authorization server");
+    emitAuthEvent(AuthEventNames.LOGIN_STARTED, { tenantKey: config.tenantKey });
+    const runtime = getAuthRuntime();
+    if (runtime) {
+      logger.debug("[initiateAuthFlow] Redirect via runtime.urlProvider.redirect");
+      runtime.urlProvider.redirect(authUrl);
+    } else if (typeof window !== "undefined") {
+      logger.debug("[initiateAuthFlow] Redirect via window.location.replace");
+      window.location.replace(authUrl);
+    } else {
+      logger.error("[initiateAuthFlow] No runtime and no window; cannot redirect", { authUrl });
+    }
+  } catch (error) {
+    clearFlowFlags();
+    logger.error("Failed to initiate auth flow", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+    throw error;
+  }
+}
+function buildAuthorizationUrl(config, codeChallenge, state) {
+  const authServerBase = (Config.getAuthServerUrl() || config.authServer || "").replace(/\/+$/, "");
+  if (isLocalhost2()) {
+    logger.debug("Building authorization URL", {
+      authServer: authServerBase,
+      clientId: config.client.clientId,
+      redirectUri: config.client.redirectUri,
+      scopes: config.client.scopes
+    });
+  }
+  const tenantIdToUse = config.tenantId;
+  const clientIdToUse = config.client.clientId;
+  const redirectUriToUse = Config.getRedirectUri();
+  const params = new URLSearchParams({
+    client_id: `public-${clientIdToUse}`,
+    tenant_id: tenantIdToUse,
+    redirect_uri: redirectUriToUse,
+    response_type: DEFAULT_RESPONSE_TYPE,
+    scope: config.client.scopes,
+    state,
+    code_challenge: codeChallenge,
+    code_challenge_method: DEFAULT_CODE_CHALLENGE_METHOD
+  });
+  return `${authServerBase}/connect/authorize?${params.toString()}`;
+}
 function isProcessed() {
   return getStorage(getStorageKey("callback_processed")) === "true";
 }
@@ -1343,15 +1556,6 @@ function clearProcessing() {
   removeStorage(getStorageKey("callback_processed"));
 }
 var urlCleaned = false;
-function cleanUrl() {
-  if (urlCleaned) return;
-  if (isProcessing()) return;
-  const runtime = getAuthRuntime();
-  const clean = runtime ? `${runtime.urlProvider.getCurrentUrl().origin}${runtime.urlProvider.getCurrentUrl().pathname}` : typeof window !== "undefined" ? `${window.location.origin}${window.location.pathname}` : "/";
-  if (runtime) runtime.urlProvider.redirect(clean);
-  else if (typeof window !== "undefined") window.location.replace(clean);
-  urlCleaned = true;
-}
 function cleanUrlSoft() {
   if (urlCleaned) return;
   if (isProcessing()) return;
@@ -1362,13 +1566,52 @@ function cleanUrlSoft() {
   urlCleaned = true;
 }
 function clearAllAuthFlags() {
-  removeStorage(getStorageKey("force_login"));
-  removeStorage(getStorageKey("logout_in_progress"));
   clearFlowFlags();
 }
+async function tryRecoverOAuthConfigFromTenant() {
+  const runtime = getAuthRuntime();
+  const tenantKey = (resolveTenantKey() ?? getTenantKey() ?? "").trim();
+  if (!runtime?.tenantResolver || !tenantKey) {
+    logger.debug("[Callback] OAuth config recovery skipped \u2014 no tenantResolver or tenantKey", {
+      hasResolver: !!runtime?.tenantResolver,
+      tenantKey: tenantKey || "(empty)"
+    });
+    return null;
+  }
+  try {
+    const tc = await runtime.tenantResolver.resolve(tenantKey);
+    if (!tc?.client?.clientId || !tc.tenantId) {
+      logger.warn("[Callback] OAuth config recovery: tenant resolve missing client or tenantId", {
+        tenantKey
+      });
+      return null;
+    }
+    storeTenantConfig(tc);
+    return {
+      clientId: tc.client.clientId.trim() || null,
+      redirectUri: tc.client.redirectUri?.trim() || getRedirectUri(),
+      tenantId: tc.tenantId.trim() || null
+    };
+  } catch (e) {
+    logger.warn("[Callback] OAuth config recovery: tenant re-resolve failed", {
+      tenantKey,
+      error: e instanceof Error ? e.message : String(e)
+    });
+    return null;
+  }
+}
 async function handleCallback() {
+  const runtimeSearch = getAuthRuntime()?.urlProvider.getCurrentUrl().search;
+  const windowSearch = typeof window !== "undefined" ? window.location.search : "";
+  logger.debug("[Callback] handleCallback invoked", {
+    isProcessed: isProcessed(),
+    isProcessing: isProcessing(),
+    isCallbackUrl: isCallbackUrl(),
+    runtimeSearch: runtimeSearch ?? "(none)",
+    windowSearch: windowSearch || "(none)"
+  });
   if (isProcessed()) {
-    logger.debug("Callback already processed in this session - preventing duplicate processing");
+    logger.warn("[Callback] Early exit: callback already processed");
     if (isCallbackUrl()) {
       if (!isProcessing()) cleanUrlSoft();
     }
@@ -1376,31 +1619,16 @@ async function handleCallback() {
     return true;
   }
   if (isProcessing()) {
-    logger.debug("Callback processing already in progress - waiting for completion");
+    logger.warn("[Callback] Early exit: callback processing already in progress");
     return true;
   }
-  if (getStorage(getStorageKey("force_login")) === "true") {
-    logger.info("Force-login flag present \u2192 callback skipped (logout occurred)");
-    const runtime = getAuthRuntime();
-    if (runtime && runtime.urlProvider.getCurrentUrl().search) cleanUrlSoft();
-    else if (typeof window !== "undefined" && window.location.search) cleanUrlSoft();
-    clearAllAuthFlags();
-    clearProcessing();
-    return false;
-  }
   const storedTenantKey = getTenantKey();
-  let currentTenantKey = null;
-  try {
-    const propsConfigStr = getStorage(getStorageKey("props_config"));
-    if (propsConfigStr) {
-      const propsConfig = JSON.parse(propsConfigStr);
-      currentTenantKey = propsConfig.tenantKey || null;
-    }
-  } catch {
-  }
-  if (!currentTenantKey) currentTenantKey = storedTenantKey;
+  const currentTenantKey = resolveTenantKey() ?? storedTenantKey;
   if (currentTenantKey && storedTenantKey && currentTenantKey !== storedTenantKey) {
-    logger.info("TenantKey changed - bypassing callback, starting fresh login");
+    logger.warn("[Callback] Early exit: tenant key changed before exchange", {
+      currentTenantKey,
+      storedTenantKey
+    });
     clearAllStorage();
     clearAllAuthFlags();
     clearProcessing();
@@ -1410,7 +1638,10 @@ async function handleCallback() {
     if (isCallbackUrl()) cleanUrlSoft();
     return false;
   }
-  if (!isCallbackUrl()) return false;
+  if (!isCallbackUrl()) {
+    logger.warn("[Callback] Early exit: URL is not callback URL");
+    return false;
+  }
   markProcessing();
   clearFlowFlags();
   urlCleaned = false;
@@ -1421,70 +1652,76 @@ async function handleCallback() {
     const state = params.get("state");
     const error = params.get("error");
     if (error || !code || !state) {
-      logger.error("Invalid OAuth callback params", { error, code, state });
+      logger.error("[Callback] Early exit: invalid OAuth callback params", { error, code, state });
       clearAllAuthFlags();
       clearProcessing();
-      markProcessed();
       cleanUrlSoft();
       return false;
     }
     const storedState = getState();
     if (!storedState || storedState !== state) {
       const currentTenantKeyFromUrl = extractTenantKey();
-      let storedTenantKeyFromProps = null;
-      try {
-        const propsConfigStr = getStorage(getStorageKey("props_config"));
-        if (propsConfigStr) {
-          const propsConfig = JSON.parse(propsConfigStr);
-          storedTenantKeyFromProps = propsConfig.tenantKey || null;
-        }
-      } catch {
-      }
-      const tenantKeyChanged = currentTenantKeyFromUrl && storedTenantKeyFromProps && currentTenantKeyFromUrl !== storedTenantKeyFromProps;
+      const resolvedTenantKey = resolveTenantKey();
+      const tenantKeyChanged = currentTenantKeyFromUrl && resolvedTenantKey && currentTenantKeyFromUrl !== resolvedTenantKey;
       if (tenantKeyChanged) {
-        logger.info("OAuth state mismatch due to tenantKey change - expected behavior, starting fresh login");
+        logger.warn("[Callback] Early exit: state mismatch due to tenant key change");
       } else {
-        logger.error("OAuth state mismatch - redirecting to login");
+        logger.error("[Callback] Early exit: OAuth state mismatch - redirecting to login");
       }
       clearAllAuthFlags();
       clearProcessing();
-      markProcessed();
       cleanUrlSoft();
       setStorage(getStorageKey("state_mismatch"), "true");
       return false;
     }
     const codeVerifier = getCodeVerifier();
     if (!codeVerifier) {
-      logger.error("Missing PKCE verifier");
+      logger.error("[Callback] Early exit: missing PKCE verifier");
       clearAllAuthFlags();
       clearProcessing();
-      markProcessed();
       cleanUrlSoft();
       return false;
     }
-    const clientId = getClientId();
-    const redirectUri = getRedirectUri();
-    const tenantId = getTenantId();
+    let clientId = getClientId();
+    let redirectUri = getRedirectUri();
+    let tenantId = getTenantId();
+    if (!clientId || !redirectUri || !tenantId) {
+      logger.warn("[Callback] OAuth config incomplete \u2014 attempting tenant re-resolve", {
+        hasClientId: !!clientId,
+        hasRedirectUri: !!redirectUri,
+        hasTenantId: !!tenantId
+      });
+      const recovered = await tryRecoverOAuthConfigFromTenant();
+      if (recovered) {
+        if (!redirectUri) redirectUri = recovered.redirectUri;
+        if (!tenantId) tenantId = recovered.tenantId;
+        clientId = getClientId() ?? normalizeClientIdForOAuthTokenBody(recovered.clientId) ?? null;
+      }
+    }
     if (!clientId || !redirectUri || !tenantId) {
-      logger.error("Missing OAuth config during callback");
+      logger.error("[Callback] Early exit: missing OAuth config during callback", {
+        hasClientId: !!clientId,
+        hasRedirectUri: !!redirectUri,
+        hasTenantId: !!tenantId
+      });
       clearAllAuthFlags();
       clearProcessing();
-      markProcessed();
       cleanUrlSoft();
       return false;
     }
     const existingToken = getAccessToken();
     if (existingToken && !isAccessTokenExpired()) {
-      logger.debug("Valid token already exists - skipping code exchange");
+      logger.warn("[Callback] Early exit: valid token already exists - skipping code exchange");
       removeStorage(STORAGE_KEYS.codeVerifier);
       removeStorage(STORAGE_KEYS.state);
       clearAllAuthFlags();
       markProcessed();
-      cleanUrl();
+      cleanUrlSoft();
       resetRedirectLoopGuard();
       emitAuthEvent(AuthEventNames.CALLBACK_SUCCESS);
       return true;
     }
+    logger.info("[Callback] Entering token exchange");
     const tokenData = await exchangeCodeForTokens({
       code,
       codeVerifier,
@@ -1504,7 +1741,7 @@ async function handleCallback() {
     removeStorage(STORAGE_KEYS.state);
     clearAllAuthFlags();
     markProcessed();
-    cleanUrl();
+    cleanUrlSoft();
     logger.info("OAuth callback processed successfully");
     resetRedirectLoopGuard();
     emitAuthEvent(AuthEventNames.CALLBACK_SUCCESS);
@@ -1565,157 +1802,6 @@ async function handleCallback() {
   }
 }
 
-// src/infrastructure/tenant/TenantConfigCache.ts
-var DEFAULT_TTL_MS = 5 * 60 * 1e3;
-var TenantConfigCache = class {
-  constructor(ttlMs = DEFAULT_TTL_MS) {
-    this.cache = /* @__PURE__ */ new Map();
-    this.inFlight = /* @__PURE__ */ new Map();
-    this.ttlMs = ttlMs;
-  }
-  get(tenantKey) {
-    const entry = this.cache.get(tenantKey);
-    if (!entry) return null;
-    if (Date.now() >= entry.expiresAt) {
-      this.cache.delete(tenantKey);
-      return null;
-    }
-    return entry.config;
-  }
-  set(tenantKey, config) {
-    this.cache.set(tenantKey, {
-      config,
-      expiresAt: Date.now() + this.ttlMs
-    });
-  }
-  invalidate(tenantKey) {
-    if (tenantKey) {
-      this.cache.delete(tenantKey);
-      this.inFlight.delete(tenantKey);
-    } else {
-      this.cache.clear();
-      this.inFlight.clear();
-    }
-  }
-  async getOrResolve(tenantKey, resolver) {
-    if (!tenantKey || !tenantKey.trim()) return null;
-    const key = tenantKey.trim();
-    const cached = this.get(key);
-    if (cached) {
-      logger.debug("Tenant config from cache", { tenantKey: key });
-      return cached;
-    }
-    const existing = this.inFlight.get(key);
-    if (existing) {
-      logger.debug("Tenant resolution reused (in-flight)", { tenantKey: key });
-      return existing;
-    }
-    const promise = (async () => {
-      try {
-        const config = await resolver(key);
-        if (config) this.set(key, config);
-        return config;
-      } finally {
-        this.inFlight.delete(key);
-      }
-    })();
-    this.inFlight.set(key, promise);
-    return promise;
-  }
-};
-
-// src/infrastructure/tenant/tenantResolution.ts
-var defaultTenantConfigCache = new TenantConfigCache();
-function getTenantKeyFromRuntime(url, config) {
-  try {
-    const propsConfigStr = getStorage(getStorageKey("props_config"));
-    if (propsConfigStr) {
-      const propsConfig = JSON.parse(propsConfigStr);
-      if (propsConfig.tenantKey?.trim()) return propsConfig.tenantKey.trim();
-      return null;
-    }
-  } catch {
-  }
-  return extractTenantKeyFromUrl(url, config, getStorage, getStorageKey);
-}
-function getPropsConfig() {
-  try {
-    const propsConfigStr = getStorage(getStorageKey("props_config"));
-    if (!propsConfigStr) return null;
-    const parsed = JSON.parse(propsConfigStr);
-    if (parsed && typeof parsed === "object" && "authServerUrl" in parsed) {
-      delete parsed.authServerUrl;
-    }
-    return parsed;
-  } catch {
-    removeStorage(getStorageKey("props_config"));
-    return null;
-  }
-}
-function mergeConfigWithProps(apiEnvConfig, propsConfig, tenantKey) {
-  return {
-    tenantId: propsConfig.tenantId || apiEnvConfig.tenantId,
-    authServer: apiEnvConfig.authServer,
-    tenantKey: tenantKey || apiEnvConfig.tenantKey,
-    client: {
-      clientId: propsConfig.clientId || apiEnvConfig.client.clientId,
-      redirectUri: apiEnvConfig.client.redirectUri,
-      scopes: apiEnvConfig.client.scopes
-    }
-  };
-}
-async function resolveTenantConfig(tenantKey, tenantResolver) {
-  if (!tenantKey) return null;
-  const propsConfig = getPropsConfig();
-  const resolved = await tenantResolver.resolve(tenantKey);
-  if (!resolved) return null;
-  removeStorage(getStorageKey("props_config"));
-  return {
-    ...propsConfig ? mergeConfigWithProps(resolved, propsConfig, tenantKey) : resolved,
-    tenantKey: tenantKey || resolved.tenantKey
-  };
-}
-async function resolveTenantConfigCached(tenantKey, tenantResolver) {
-  if (!tenantKey) return null;
-  return defaultTenantConfigCache.getOrResolve(
-    tenantKey,
-    (key) => resolveTenantConfig(key, tenantResolver)
-  );
-}
-
-// src/application/flows/ForceLoginFlow.ts
-var ForceLoginFlow = class {
-  async execute(context) {
-    const { runtime } = context;
-    const { urlProvider, logger: log } = runtime;
-    const getUrl = () => urlProvider.getCurrentUrl();
-    if (isCallbackUrlFromUrl(getUrl())) {
-      await handleCallback();
-      if (isCallbackUrlFromUrl(getUrl())) {
-        log.warn("Callback URL still present after cleanup, forcing URL clean");
-        const u = getUrl();
-        urlProvider.redirect(`${u.origin}${u.pathname}`);
-        return { completed: true };
-      }
-    }
-    clearFlowFlags();
-    const tenantKey = getTenantKeyFromRuntime(getUrl(), runtime.configProvider);
-    if (!tenantKey) return { completed: true };
-    const tenantConfig = await resolveTenantConfigCached(tenantKey, runtime.tenantResolver);
-    if (!tenantConfig) {
-      log.error("Tenant config resolution failed for force login", { tenantKey });
-      throw new SanitizedError(
-        "TENANT_CONFIG_RESOLUTION_FAILED",
-        "Unable to resolve tenant configuration",
-        new Error(`Tenant config resolution failed for tenantKey: ${tenantKey}`)
-      );
-    }
-    storeTenantConfig(tenantConfig);
-    await initiateAuthFlow(tenantConfig);
-    return { completed: true };
-  }
-};
-
 // src/application/flows/CallbackFlow.ts
 var CallbackFlow = class {
   async execute(context) {
@@ -1803,21 +1889,16 @@ var RefreshFlow = class {
         error: error instanceof Error ? error.message : String(error)
       });
     }
-    const tenantKeyFromRuntime = getTenantKeyFromRuntime(getUrl(), runtime.configProvider);
-    const tenantKeyFromStorage = getStorage(getStorageKey("tenant_key"));
-    const tenantKeyFromConfig = runtime.configProvider.getClientCode?.() ?? "";
-    const tenantKey = (tenantKeyFromRuntime || tenantKeyFromStorage || tenantKeyFromConfig)?.trim();
+    const tenantKey = resolveTenantKey();
     log.debug("[RefreshFlow] Tenant key resolved", {
       tenantKey: tenantKey ?? "(null)",
-      fromRuntime: tenantKeyFromRuntime ?? "(null)",
-      fromStorage: tenantKeyFromStorage ?? "(null)",
-      fromConfig: tenantKeyFromConfig || "(null)"
+      source: tenantKey ? "resolved" : "none"
     });
     if (!tenantKey) {
       throw new SanitizedError(
         "TENANT_KEY_RESOLUTION_FAILED",
         "Unable to resolve tenant",
-        new Error("Tenant key missing")
+        new Error(`Tenant key missing for refresh flow at url=${getUrl().href}`)
       );
     }
     const tenantConfig = await resolveTenantConfigCached(tenantKey, runtime.tenantResolver);
@@ -1846,22 +1927,17 @@ var TenantSwitchFlow = class {
     emitAuthEvent(AuthEventNames.TENANT_SWITCHED, { tenantKey: newTenantKey ?? void 0 });
     removeStorage(getStorageKey("tenant_switched"));
     removeStorage(getStorageKey("new_tenant_key"));
-    const tenantKeyFromRuntime = getTenantKeyFromRuntime(getUrl(), runtime.configProvider);
-    const tenantKeyFromStorage = getStorage(getStorageKey("tenant_key"));
-    const tenantKeyFromConfig = runtime.configProvider.getClientCode?.() ?? "";
-    const tenantKey = (newTenantKey || tenantKeyFromRuntime || tenantKeyFromStorage || tenantKeyFromConfig)?.trim();
+    const tenantKey = (newTenantKey || resolveTenantKey())?.trim() || null;
     log.debug("[TenantSwitchFlow] Tenant key resolved", {
       tenantKey: tenantKey ?? "(null)",
       fromNewTenantKey: newTenantKey ?? "(null)",
-      fromRuntime: tenantKeyFromRuntime ?? "(null)",
-      fromStorage: tenantKeyFromStorage ?? "(null)",
-      fromConfig: tenantKeyFromConfig || "(null)"
+      source: newTenantKey ? "new_tenant_key" : tenantKey ? "resolved" : "none"
     });
     if (!tenantKey) {
       throw new SanitizedError(
         "TENANT_KEY_RESOLUTION_FAILED",
         "Unable to resolve tenant after switch",
-        new Error("Tenant key missing after switch")
+        new Error(`Tenant key missing after switch at url=${getUrl().href}`)
       );
     }
     const tenantConfig = await resolveTenantConfigCached(tenantKey, runtime.tenantResolver);
@@ -1872,6 +1948,21 @@ var TenantSwitchFlow = class {
         new Error(`Tenant config resolution failed for tenantKey: ${tenantKey}`)
       );
     }
+    try {
+      const cfg = getAuthConfig2();
+      writeHostConfigCache({
+        apiBaseUrl: cfg.apiBaseUrl,
+        authServerUrl: cfg.authServerUrl,
+        callbackUrl: cfg.callbackUrl,
+        appId: cfg.appId,
+        clientCode: tenantConfig.client?.clientCode ?? cfg.clientCode ?? "",
+        clientId: cfg.clientId || tenantConfig.client?.clientId,
+        tenantId: tenantConfig.tenantId ?? cfg.tenantId,
+        tenantKey,
+        tenantCode: tenantKey
+      });
+    } catch {
+    }
     setTenantKey(tenantKey);
     storeTenantConfig(tenantConfig);
     await initiateAuthFlow(tenantConfig);
@@ -1896,21 +1987,16 @@ var LoginFlow = class {
     }
     const wasStateMismatch = getStorage(getStorageKey("state_mismatch")) === "true";
     if (wasStateMismatch) removeStorage(getStorageKey("state_mismatch"));
-    const tenantKeyFromRuntime = getTenantKeyFromRuntime(url, runtime.configProvider);
-    const tenantKeyFromStorage = getStorage(getStorageKey("tenant_key"));
-    const tenantKeyFromConfig = runtime.configProvider.getClientCode?.() ?? "";
-    const tenantKey = (tenantKeyFromRuntime || tenantKeyFromStorage || tenantKeyFromConfig)?.trim();
+    const tenantKey = resolveTenantKey();
     log.debug("[LoginFlow] Tenant key resolved", {
       tenantKey: tenantKey ?? "(null)",
-      fromRuntime: tenantKeyFromRuntime ?? "(null)",
-      fromStorage: tenantKeyFromStorage ?? "(null)",
-      fromConfig: tenantKeyFromConfig || "(null)"
+      source: tenantKey ? "resolved" : "none"
     });
     if (!tenantKey) {
       throw new SanitizedError(
         "TENANT_KEY_RESOLUTION_FAILED",
         "Unable to resolve tenant",
-        new Error("Tenant key missing")
+        new Error(`Tenant key missing for login flow at url=${url.href}`)
       );
     }
     log.debug("[LoginFlow] Resolving tenant config", { tenantKey });
@@ -1939,7 +2025,6 @@ var LoginFlow = class {
 };
 
 // src/application/flows/getFlowForState.ts
-var forceLoginFlow = new ForceLoginFlow();
 var callbackFlow = new CallbackFlow();
 var authenticatedFlow = new AuthenticatedFlow();
 var refreshFlow = new RefreshFlow();
@@ -1947,8 +2032,6 @@ var tenantSwitchFlow = new TenantSwitchFlow();
 var loginFlow = new LoginFlow();
 function getFlowForState(state) {
   switch (state) {
-    case "FORCE_LOGIN" /* FORCE_LOGIN */:
-      return forceLoginFlow;
     case "PROCESSING_CALLBACK" /* PROCESSING_CALLBACK */:
       return callbackFlow;
     case "AUTHENTICATED" /* AUTHENTICATED */:
@@ -2041,6 +2124,22 @@ async function bootstrap() {
   return bootstrapImpl();
 }
 
+// src/infrastructure/watchers/watcher-guard.ts
+var suspended = false;
+var generation = 0;
+function suspendWatchers() {
+  suspended = true;
+  generation += 1;
+  return generation;
+}
+function resumeWatchers(expectedGen) {
+  if (expectedGen !== void 0 && expectedGen !== generation) return;
+  suspended = false;
+}
+function areWatchersSuspended() {
+  return suspended;
+}
+
 // src/strategies/cookie/cookie-auth.ts
 var COOKIE_NAMES = {
   accessToken: "tenneo_auth_access_token",
@@ -2167,36 +2266,14 @@ function checkCookiesDeleted() {
   }
 }
 function handleCookieDeletion() {
+  if (areWatchersSuspended()) {
+    logger.debug("Cookie deletion handler skipped \u2014 watchers suspended (logout/teardown)");
+    return;
+  }
   try {
     logger.info("Cookies deleted detected - clearing session and redirecting to login");
-    const forceLoginSet = getStorage(getStorageKey("force_login")) === "true";
-    const logoutInProgress = getStorage(getStorageKey("logout_in_progress")) === "true";
-    if (forceLoginSet || logoutInProgress) {
-      logger.debug(
-        "Force login or logout in progress - skipping bootstrap from cookie watcher (avoids duplicate by-code API call)"
-      );
-      return;
-    }
     clearAuthStorage();
-    try {
-      if (typeof window !== "undefined") {
-        const forceLogin = window.localStorage.getItem(getStorageKey("force_login"));
-        const logoutInProgressPreserve = window.localStorage.getItem(
-          getStorageKey("logout_in_progress")
-        );
-        clearAuthSessionStorage();
-        if (forceLogin === "true")
-          window.localStorage.setItem(getStorageKey("force_login"), "true");
-        if (logoutInProgressPreserve === "true")
-          window.localStorage.setItem(getStorageKey("logout_in_progress"), "true");
-      } else {
-        clearAuthSessionStorage();
-      }
-    } catch (error) {
-      logger.warn("Failed to clear sessionStorage", {
-        error: error instanceof Error ? error.message : String(error)
-      });
-    }
+    clearAuthSessionStorage();
     const cb = getSessionClearedCallback();
     if (cb) {
       Promise.resolve(cb()).catch((error) => {
@@ -2230,13 +2307,7 @@ function startCookieWatcher() {
     allCookies: initialCookies
   });
   watchInterval = setInterval(async () => {
-    const logoutInProgress = typeof window !== "undefined" && window.localStorage.getItem(getStorageKey("logout_in_progress")) === "true";
-    if (logoutInProgress) {
-      logger.debug("Logout detected. Cookie watcher will not trigger bootstrap.");
-      lastCookieSnapshot = getCookieSnapshot();
-      lastCookieMap = getCookieMap();
-      return;
-    }
+    if (areWatchersSuspended()) return;
     const cookiesDeleted = checkCookiesDeleted();
     if (cookiesDeleted) {
       logger.info("Cookies deleted detected by cookie watcher");
@@ -2300,9 +2371,11 @@ function checkStorageCleared() {
   }
 }
 function handleStorageEvent(event) {
+  if (areWatchersSuspended()) return;
   if (typeof window !== "undefined" && event.storageArea === window.sessionStorage) {
     const wasCleared = checkStorageCleared();
     if (wasCleared) {
+      if (areWatchersSuspended()) return;
       logger.info("Detected manual sessionStorage clear! Redirecting to login...");
       const cb = getSessionClearedCallback();
       if (cb) {
@@ -2322,13 +2395,10 @@ function startStorageWatcher() {
   storageEventListener = handleStorageEvent;
   window.addEventListener("storage", storageEventListener);
   const pollInterval = setInterval(() => {
-    const logoutInProgress = typeof window !== "undefined" && window.localStorage.getItem(getStorageKey("logout_in_progress")) === "true";
-    if (logoutInProgress) {
-      logger.debug("Logout detected. Storage watcher will not trigger bootstrap.");
-      return;
-    }
+    if (areWatchersSuspended()) return;
     const wasCleared = checkStorageCleared();
     if (wasCleared) {
+      if (areWatchersSuspended()) return;
       logger.info("Detected manual sessionStorage clear (polling)! Redirecting to login...");
       clearInterval(pollInterval);
       const cb = getSessionClearedCallback();
@@ -2413,62 +2483,68 @@ function getCsrfToken() {
 }
 async function callServerLogout(logoutUrl) {
   const csrfToken = getCsrfToken();
-  async function doRequest(method) {
-    const isPost = method === "POST";
-    const headers = {
-      "X-Requested-With": "XMLHttpRequest",
-      Accept: "application/json, */*"
-    };
-    if (isPost) {
-      headers["Content-Type"] = "application/x-www-form-urlencoded";
-    }
-    if (csrfToken) {
-      headers["X-CSRF-Token"] = csrfToken;
-    }
+  const headers = {
+    "X-Requested-With": "XMLHttpRequest",
+    Accept: "application/json, */*",
+    "Content-Type": "application/x-www-form-urlencoded"
+  };
+  if (csrfToken) {
+    headers["X-CSRF-Token"] = csrfToken;
+  }
+  try {
     const response = await fetch(logoutUrl, {
-      method,
+      method: "POST",
       mode: "cors",
       headers,
-      credentials: "include"
+      credentials: "include",
+      body: ""
     });
     if (!response.ok) {
-      logger.warn("Server logout HTTP error", {
-        method,
+      logger.warn("[logout] Server logout HTTP error", {
         status: response.status,
         statusText: response.statusText
       });
       return { success: false };
     }
-    const data = await response.json().catch(() => ({}));
-    logger.info(`Server logout response (${method})`, { response: data });
+    const contentType = response.headers.get("content-type") || "";
+    if (!contentType.includes("application/json")) {
+      logger.info("[logout] Server logout: OK without JSON body", {
+        status: response.status
+      });
+      return { success: true, response: { success: true } };
+    }
+    const text = await response.text();
+    let data = {};
+    if (text?.trim()) {
+      try {
+        data = JSON.parse(text);
+      } catch {
+        logger.warn("[logout] Server returned non-JSON body with JSON content-type");
+        return { success: false };
+      }
+    }
+    logger.info("[logout] Server logout response", { response: data });
     if (data && (data.success === true || data.logout === true)) {
       return { success: true, response: data };
     }
-    logger.warn("Server logout response invalid payload", {
-      method,
-      response: data
-    });
+    if (!text || text.trim() === "") {
+      return { success: true, response: { success: true } };
+    }
+    logger.warn("[logout] Server logout: unexpected JSON payload", { response: data });
     return { success: false, response: data };
-  }
-  try {
-    const postResult = await doRequest("POST");
-    if (postResult.success) return postResult;
-    logger.debug("POST logout did not succeed, trying GET");
-    const getResult = await doRequest("GET");
-    return getResult;
   } catch (error) {
-    logger.warn("Server logout failed (both POST and GET)", {
+    logger.warn("[logout] Server logout request failed", {
       error: error instanceof Error ? error.message : String(error)
     });
     return { success: false };
   }
 }
 function performLocalLogoutCleanup() {
-  logger.debug("Performing local logout cleanup");
+  logger.debug("[logout] Local cleanup: cookies + auth storage");
   try {
     getAuthRuntime()?.clearCookies?.clearCookies();
   } catch (error) {
-    logger.debug("Runtime cookie clearer failed (ignored)", {
+    logger.debug("[logout] Runtime cookie clearer failed (ignored)", {
       error: error instanceof Error ? error.message : String(error)
     });
   }
@@ -2476,11 +2552,11 @@ function performLocalLogoutCleanup() {
   try {
     clearAuthStorage();
   } catch (error) {
-    logger.warn("clearAuthStorage failed (ignored)", {
+    logger.warn("[logout] clearAuthStorage failed", {
       error: error instanceof Error ? error.message : String(error)
     });
   }
-  logger.info("Local logout cleanup completed");
+  logger.info("[logout] Local cleanup completed");
 }
 function acquireLogoutLock() {
   const LOCK_KEY = getStorageKey("logout_lock");
@@ -2489,7 +2565,7 @@ function acquireLogoutLock() {
   if (existingLock) {
     const lockTime = Number(existingLock);
     if (!Number.isNaN(lockTime) && now - lockTime < 5e3) {
-      logger.debug("Logout lock active \u2013 skipping duplicate logout", {
+      logger.debug("[logout] Lock active \u2014 duplicate tab logout skipped", {
         now,
         lockTime
       });
@@ -2505,102 +2581,95 @@ function releaseLogoutLock() {
   } catch {
   }
 }
-async function logout(tenantKey) {
-  setStorage(getStorageKey("force_login"), "true");
-  if (tenantKey?.trim()) {
-    setStorage(getStorageKey("preserved_tenant_key"), tenantKey.trim());
-  }
+var logoutInFlight = null;
+async function runLogoutPipeline(tenantKey) {
+  const gen = suspendWatchers();
+  logger.info("[logout] Lifecycle: suspend watchers", { generation: gen });
+  stopStorageWatcher();
+  stopCookieWatcher();
   if (!acquireLogoutLock()) {
-    return { success: true, message: "Logout already in progress." };
+    resumeWatchers(gen);
+    logger.debug("[logout] Lifecycle: resume (skipped \u2014 lock)");
+    return { success: true, message: "Logout already in progress in another tab." };
   }
+  let serverLogoutSuccess = false;
+  let serverResponse;
   try {
-    stopStorageWatcher();
-    stopCookieWatcher();
-    const apiAuthBaseUrl = Config.getAuthServerUrl();
-    let serverLogoutSuccess = false;
-    let serverResponse;
+    if (tenantKey?.trim()) {
+      applyRuntimeTenantSwitch(tenantKey.trim(), { syncStorageCache: true });
+      logger.info("[logout] Runtime tenant applied for logout context", {
+        tenantKey: tenantKey.trim()
+      });
+    }
+    const authConfig = getAuthConfig2();
+    const apiAuthBaseUrl = authConfig.authServerUrl;
     if (apiAuthBaseUrl) {
       const logoutUrl = buildUrl(apiAuthBaseUrl, "account/logout");
-      logger.info("Calling auth server logout", { logoutUrl });
+      logger.info("[logout] Calling auth server logout (POST)", { logoutUrl });
       const logoutResult = await callServerLogout(logoutUrl);
       serverLogoutSuccess = logoutResult.success;
       serverResponse = logoutResult.response;
       if (!serverLogoutSuccess) {
-        logger.warn("Server logout failed \u2013 session may still exist", {
+        logger.warn("[logout] Server logout did not confirm success \u2014 clearing local session anyway", {
           logoutUrl,
           serverResponse
         });
       }
     } else {
-      logger.warn("API auth base URL not configured, performing local logout only");
+      logger.warn("[logout] authServerUrl missing \u2014 local logout only");
     }
+  } catch (error) {
+    logger.error("[logout] Unexpected error before local cleanup", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
+  try {
     performLocalLogoutCleanup();
-    const preservedTenantKey = getStorage(getStorageKey("preserved_tenant_key"));
-    if (preservedTenantKey) {
-      const propsKey = getStorageKey("props_config");
-      let existing = {};
-      try {
-        const raw = getStorage(propsKey);
-        if (raw) {
-          existing = JSON.parse(raw);
-        }
-      } catch {
-        existing = {};
-      }
-      const merged = {
-        ...existing,
-        tenantKey: preservedTenantKey
-      };
-      setStorage(propsKey, JSON.stringify(merged));
-      removeStorage(getStorageKey("preserved_tenant_key"));
-    }
-    resetCookieWatcher();
-    startStorageWatcher();
-    releaseLogoutLock();
-    logger.info("Logout completed \u2013 flags set, storage cleared, fresh login required", {
-      serverLogoutSuccess,
-      serverResponse
+  } catch (error) {
+    logger.error("[logout] Local cleanup threw", {
+      error: error instanceof Error ? error.message : String(error)
     });
-    emitAuthEvent(AuthEventNames.LOGOUT_COMPLETED, {
-      serverLogoutSuccess,
-      tenantKey: getStorage(getStorageKey("preserved_tenant_key")) || void 0,
-      message: serverLogoutSuccess ? "Server logout success" : "Local logout only"
+  }
+  try {
+    syncHostConfigCacheFromMemory();
+    logger.debug("[logout] host_config cache refreshed from runtime (not restored from snapshot)");
+  } catch (error) {
+    logger.warn("[logout] Failed to sync host config cache", {
+      error: error instanceof Error ? error.message : String(error)
     });
-    return {
-      success: true,
-      message: serverLogoutSuccess ? serverResponse?.message || "Logout successful. Session cookies cleared. Fresh login required." : "Logged out locally. Fresh login required (server logout may have failed).",
-      serverResponse
-    };
+  }
+  try {
+    resetCookieWatcher();
+    startStorageWatcher();
+    logger.info("[logout] Watchers restarted");
   } catch (error) {
-    logger.error("Logout failed unexpectedly", {
+    logger.warn("[logout] Watcher restart failed", {
       error: error instanceof Error ? error.message : String(error)
     });
-    performLocalLogoutCleanup();
-    const preservedTenantKey = getStorage(getStorageKey("preserved_tenant_key"));
-    if (preservedTenantKey) {
-      const propsKey = getStorageKey("props_config");
-      let existing = {};
-      try {
-        const raw = getStorage(propsKey);
-        if (raw) {
-          existing = JSON.parse(raw);
-        }
-      } catch {
-        existing = {};
-      }
-      const merged = {
-        ...existing,
-        tenantKey: preservedTenantKey
-      };
-      setStorage(propsKey, JSON.stringify(merged));
-      removeStorage(getStorageKey("preserved_tenant_key"));
-    }
-    releaseLogoutLock();
-    return {
-      success: true,
-      message: "Logged out locally due to an error. Fresh login required."
-    };
   }
+  releaseLogoutLock();
+  resumeWatchers(gen);
+  logger.info("[logout] Lifecycle: complete", { serverLogoutSuccess });
+  emitAuthEvent(AuthEventNames.LOGOUT_COMPLETED, {
+    serverLogoutSuccess,
+    tenantKey: tenantKey?.trim() || getAuthConfig2().tenantCode || void 0,
+    message: serverLogoutSuccess ? "Server logout success" : "Local logout (server may be pending)"
+  });
+  return {
+    success: true,
+    message: serverLogoutSuccess ? serverResponse?.message || "Logout successful. Fresh login required." : "Logged out locally. Fresh login required (server logout may have failed).",
+    serverResponse
+  };
+}
+async function logout(tenantKey) {
+  if (logoutInFlight) {
+    logger.debug("[logout] Coalescing with in-flight logout");
+    return logoutInFlight;
+  }
+  logoutInFlight = runLogoutPipeline(tenantKey).finally(() => {
+    logoutInFlight = null;
+  });
+  return logoutInFlight;
 }
 var AuthContext = createContext(void 0);
 function useAuthContext() {
@@ -2675,7 +2744,6 @@ async function resolveTenant(tenantKey) {
           scopes: DEFAULT_SCOPES2
         }
       };
-      console.log("config====", config);
       logger.debug("Resolved tenant config", { tenantCode });
       return config;
     } catch (error) {
@@ -2936,27 +3004,29 @@ function AuthProvider({
       logger.warn("[AuthProvider] callbackUrl missing from host props");
     }
     setConfig({
-      ...mergedTenantCode ? { tenantCode: mergedTenantCode } : {},
+      ...mergedTenantCode ? { tenantCode: mergedTenantCode, tenantKey: mergedTenantCode } : {},
       ...mergedApiBaseUrl ? { apiBaseUrl: mergedApiBaseUrl } : {},
       ...mergedAuthServerUrl ? { authServerUrl: mergedAuthServerUrl } : {},
       ...mergedCallbackUrl ? { callbackUrl: mergedCallbackUrl } : {}
     });
+    logConfigResolutionDebug("AuthProvider host props applied");
     return () => {
       clearConfigOverrides();
     };
   }, [mergedTenantCode, mergedApiBaseUrl, mergedAuthServerUrl, mergedCallbackUrl]);
   useEffect(() => {
     try {
-      const payload = {
+      writeHostConfigCache({
         tenantCode: mergedTenantCode ?? "",
+        tenantKey: mergedTenantCode ?? "",
+        appId: appId ?? "",
         apiBaseUrl: mergedApiBaseUrl ?? "",
         authServerUrl: mergedAuthServerUrl ?? "",
         callbackUrl: mergedCallbackUrl ?? ""
-      };
-      setStorage(getStorageKey("host_config"), JSON.stringify(payload));
+      });
     } catch {
     }
-  }, [mergedTenantCode, mergedApiBaseUrl, mergedAuthServerUrl, mergedCallbackUrl]);
+  }, [mergedTenantCode, mergedApiBaseUrl, mergedAuthServerUrl, mergedCallbackUrl, appId]);
   useLayoutEffect(() => {
     setStorageKeyPrefix(resolvedTenantKey ?? "");
     const adapter = storageAdapter !== void 0 && storageAdapter !== null ? storageAdapter : createSecureSessionStorageAdapter(namespace);
@@ -2997,24 +3067,18 @@ function AuthProvider({
           const currentUrl = window.location.href;
           const isCallback = currentUrl.includes("code=") || currentUrl.includes("state=");
           if (isCallback) {
-            const cleanUrl2 = window.location.origin + window.location.pathname;
-            window.history.replaceState({}, document.title, cleanUrl2);
+            const cleanUrl = window.location.origin + window.location.pathname;
+            window.history.replaceState({}, document.title, cleanUrl);
           }
         }
         removeStorage(getStorageKey("access_token"));
         removeStorage(getStorageKey("refresh_token"));
         removeStorage(getStorageKey("expires_at"));
-        removeStorage(getStorageKey("id_token"));
         removeStorage(getStorageKey("state"));
         removeStorage(getStorageKey("code_verifier"));
         removeStorage(getStorageKey("callback_processed"));
         clearCallbackProcessing();
         clearFlowFlags();
-        removeStorage(getStorageKey("tenant_id"));
-        if (typeof window !== "undefined") {
-          window.localStorage.removeItem(getStorageKey("force_login"));
-          window.localStorage.removeItem(getStorageKey("logout_in_progress"));
-        }
         setStorage(getStorageKey("props_changed"), "true");
         setStorage(getStorageKey("tenant_switched"), "true");
         setStorage(getStorageKey("new_tenant_key"), resolvedTenantKey2);
@@ -3027,7 +3091,17 @@ function AuthProvider({
       } else if (previousTenantKey) {
         logger.debug("[AuthProvider] TenantKey unchanged", { tenantKey: resolvedTenantKey2 });
       }
-      setStorage(getStorageKey("props_config"), JSON.stringify({ tenantKey: resolvedTenantKey2 }));
+      try {
+        writeHostConfigCache({
+          tenantKey: resolvedTenantKey2,
+          tenantCode: resolvedTenantKey2
+        });
+        logConfigResolutionDebug("AuthProvider tenant key synced to cache", {
+          tenantCode: resolvedTenantKey2,
+          tenantKey: resolvedTenantKey2
+        });
+      } catch {
+      }
       setStorage(getStorageKey("tenant_key"), resolvedTenantKey2);
     } else {
       logger.debug("[AuthProvider] No tenant code determined");
@@ -3226,17 +3300,29 @@ function AuthCallback({
       setStatus("loading");
       setMessage("Completing sign-in...");
       const handled = await handleCallback();
-      if (handled) {
-        const token = getAccessToken();
-        if (token) setTokens(token);
-        setStatus("success");
-        setMessage("Authentication successful. Redirecting...");
-        window.location.replace(successPath);
-      } else {
+      if (!handled) {
         setStatus("error");
         setMessage("Authentication failed. Please try again.");
         window.history.replaceState({}, document.title, window.location.origin + window.location.pathname);
+        return;
+      }
+      const startedAt = Date.now();
+      const MAX_WAIT_MS = 5e3;
+      while (true) {
+        const token = getAccessToken();
+        if (token) {
+          setTokens(token);
+          setStatus("success");
+          setMessage("Authentication successful. Redirecting...");
+          window.location.replace(successPath);
+          return;
+        }
+        if (Date.now() - startedAt > MAX_WAIT_MS) break;
+        await new Promise((r) => setTimeout(r, 200));
       }
+      setStatus("error");
+      setMessage("Authentication did not complete. Please try again.");
+      window.history.replaceState({}, document.title, window.location.origin + window.location.pathname);
     };
     runCallback();
   }, [homePath, loginPath, successPath, setTokens]);
@@ -3417,6 +3503,6 @@ function useAuthInit() {
   );
 }
 
-export { AuthCallback, AuthEventNames, AuthProvider, Config, OAUTH_CONSTANTS, ProtectedRoute, STORAGE_KEYS2 as STORAGE_KEYS, STORAGE_KEY_PREFIX, SanitizedError, bootstrap, buildStorageKey, createAuthEngine, createCookieStorageAdapter, createMemoryStorageAdapter, createOAuth2PkceStrategy, createSecureSessionStorageAdapter, emitAuthEvent, enforceHttps, ensureValidAccessToken, extractTenantKey, getAccessToken2 as getAccessToken, getAuthRuntime, getConfig, getStorageAdapter, getStorageNamespace, getAccessToken as getStoredAccessToken, isAccessTokenExpired, isCallbackUrl, logout, refreshAccessToken, resetCookieWatcher, resolveConfig, resolveTenant, sanitizeErrorMessage, setAuthRuntime, setConfig, setStorageContext, startCookieWatcher, stopCookieWatcher, subscribeAuthEvent, useAuth, useAuthContext, useAuthInit };
+export { AuthCallback, AuthConfigError, AuthEventNames, AuthProvider, Config, OAUTH_CONSTANTS, ProtectedRoute, STORAGE_KEYS2 as STORAGE_KEYS, STORAGE_KEY_PREFIX, SanitizedError, applyRuntimeTenantSwitch, areWatchersSuspended, bootstrap, buildStorageKey, createAuthEngine, createCookieStorageAdapter, createMemoryStorageAdapter, createOAuth2PkceStrategy, createSecureSessionStorageAdapter, emitAuthEvent, enforceHttps, ensureValidAccessToken, extractTenantKey, getAccessToken2 as getAccessToken, getAuthConfig2 as getAuthConfig, getAuthRuntime, getConfig, getConfigFieldSources, getEffectiveTenantCode, getEffectiveTenantKey, getStorageAdapter, getStorageNamespace, getAccessToken as getStoredAccessToken, initPlugin, isAccessTokenExpired, isCallbackUrl, logConfigResolutionDebug, logout, refreshAccessToken, requireAuthConfig, resetCookieWatcher, resolveConfig, resolveTenant, resumeWatchers, sanitizeErrorMessage, setAuthRuntime, setConfig, setHostConfigProvider, setStorageContext, startCookieWatcher, startStorageWatcher, stopCookieWatcher, stopStorageWatcher, subscribeAuthEvent, suspendWatchers, syncHostConfigCacheFromMemory, useAuth, useAuthContext, useAuthInit, writeHostConfigCache };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map