tenneo-auth-plugin 1.0.2 → 1.0.4

package/dist/index.js

@@ -373,35 +373,7 @@ function createCookieStorageAdapter(namespace, options) {
   };
 }
 
-// src/infrastructure/storage/api.ts
-var KEY_SUFFIXES = {
-  tenantKey: "tenant_key",
-  codeVerifier: "code_verifier",
-  state: "state",
-  accessToken: "access_token",
-  refreshToken: "refresh_token",
-  expiresAt: "expires_at"
-};
-var STORAGE_KEYS = {
-  get tenantKey() {
-    return getStorageKey(KEY_SUFFIXES.tenantKey);
-  },
-  get codeVerifier() {
-    return getStorageKey(KEY_SUFFIXES.codeVerifier);
-  },
-  get state() {
-    return getStorageKey(KEY_SUFFIXES.state);
-  },
-  get accessToken() {
-    return getStorageKey(KEY_SUFFIXES.accessToken);
-  },
-  get refreshToken() {
-    return getStorageKey(KEY_SUFFIXES.refreshToken);
-  },
-  get expiresAt() {
-    return getStorageKey(KEY_SUFFIXES.expiresAt);
-  }
-};
+// src/infrastructure/storage/kv.ts
 function keyToSuffix(key) {
   const prefix = getStorageKeyPrefix();
   return key.startsWith(prefix) ? key.slice(prefix.length) : key;
@@ -437,6 +409,36 @@ function removeStorage(key) {
   } catch {
   }
 }
+
+// src/infrastructure/storage/api.ts
+var KEY_SUFFIXES = {
+  tenantKey: "tenant_key",
+  codeVerifier: "code_verifier",
+  state: "state",
+  accessToken: "access_token",
+  refreshToken: "refresh_token",
+  expiresAt: "expires_at"
+};
+var STORAGE_KEYS = {
+  get tenantKey() {
+    return getStorageKey(KEY_SUFFIXES.tenantKey);
+  },
+  get codeVerifier() {
+    return getStorageKey(KEY_SUFFIXES.codeVerifier);
+  },
+  get state() {
+    return getStorageKey(KEY_SUFFIXES.state);
+  },
+  get accessToken() {
+    return getStorageKey(KEY_SUFFIXES.accessToken);
+  },
+  get refreshToken() {
+    return getStorageKey(KEY_SUFFIXES.refreshToken);
+  },
+  get expiresAt() {
+    return getStorageKey(KEY_SUFFIXES.expiresAt);
+  }
+};
 function clearAuthStorage() {
   const keysToClear = [
     STORAGE_KEYS.accessToken,
@@ -499,28 +501,6 @@ function isAccessTokenExpired() {
   const buffer = 60 * 1e3;
   return Date.now() >= expiresAt - buffer;
 }
-function readHostConfig() {
-  try {
-    const raw = getStorage(getStorageKey("host_config"));
-    if (!raw) return {};
-    const parsed = JSON.parse(raw);
-    return parsed && typeof parsed === "object" ? parsed : {};
-  } catch {
-    return {};
-  }
-}
-function getClientId() {
-  const value = readHostConfig().clientId;
-  return typeof value === "string" && value.trim() ? value : null;
-}
-function getRedirectUri() {
-  const value = readHostConfig().redirectUri;
-  return typeof value === "string" && value.trim() ? value : null;
-}
-function getTenantId() {
-  const value = readHostConfig().tenantId;
-  return typeof value === "string" && value.trim() ? value : null;
-}
 function getCodeVerifier() {
   return getStorage(STORAGE_KEYS.codeVerifier);
 }
@@ -581,6 +561,252 @@ var Logger = class {
 };
 var logger = new Logger();
 
+// src/config/resolver-core.ts
+var inMemoryConfig = {};
+var hostConfigProvider = null;
+var CACHE_MARKER = "__tenneo_host_config_cache";
+var CACHE_AT = "__tenneo_host_config_cache_at";
+function setConfig(overrides) {
+  inMemoryConfig = { ...inMemoryConfig, ...overrides };
+}
+function clearConfigOverrides() {
+  inMemoryConfig = {};
+}
+function setHostConfigProvider(fn) {
+  hostConfigProvider = fn;
+}
+function readHostBridge() {
+  const out = {};
+  try {
+    if (typeof window !== "undefined" && window.__TENNEO_AUTH_HOST__) {
+      Object.assign(out, window.__TENNEO_AUTH_HOST__);
+    }
+  } catch {
+  }
+  try {
+    const fromProvider = hostConfigProvider?.();
+    if (fromProvider && typeof fromProvider === "object") {
+      Object.assign(out, fromProvider);
+    }
+  } catch (e) {
+    logger.warn("[config] hostConfigProvider threw", {
+      error: e instanceof Error ? e.message : String(e)
+    });
+  }
+  return out;
+}
+function readStorageConfigCache() {
+  try {
+    const raw = getStorage(getStorageKey("host_config"));
+    if (!raw) return {};
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object") return {};
+    const { [CACHE_MARKER]: _m, [CACHE_AT]: _t, ...rest } = parsed;
+    if (!rest.clientId && typeof rest.client_id === "string" && rest.client_id.trim()) {
+      rest.clientId = rest.client_id.trim();
+    }
+    return rest;
+  } catch {
+    return {};
+  }
+}
+function resolveSDKConfig(overrides) {
+  const stored = readStorageConfigCache();
+  const bridge = readHostBridge();
+  return {
+    ...stored,
+    ...bridge,
+    ...inMemoryConfig,
+    ...overrides ?? {}
+  };
+}
+function nonEmptyString(v) {
+  if (v == null) return void 0;
+  const s = String(v).trim();
+  return s || void 0;
+}
+function getConfigFieldSources(overrides) {
+  const stored = readStorageConfigCache();
+  const bridge = readHostBridge();
+  const layers = [
+    { src: "storage_cache", cfg: stored },
+    { src: "host_bridge", cfg: bridge },
+    { src: "memory", cfg: inMemoryConfig }
+  ];
+  if (overrides && Object.keys(overrides).length) {
+    layers.push({ src: "override", cfg: overrides });
+  }
+  const pick = (key) => {
+    for (let i = layers.length - 1; i >= 0; i--) {
+      const v = nonEmptyString(layers[i].cfg[key]);
+      if (v !== void 0) return layers[i].src;
+    }
+    return void 0;
+  };
+  return {
+    tenantCode: pick("tenantCode") ?? pick("tenantKey"),
+    tenantKey: pick("tenantKey") ?? pick("tenantCode"),
+    apiBaseUrl: pick("apiBaseUrl"),
+    authServerUrl: pick("authServerUrl"),
+    callbackUrl: pick("callbackUrl"),
+    clientCode: pick("clientCode"),
+    clientId: pick("clientId"),
+    tenantId: pick("tenantId"),
+    appId: pick("appId")
+  };
+}
+function getEffectiveTenantCode(overrides) {
+  const cfg = resolveSDKConfig(overrides);
+  const t = nonEmptyString(cfg.tenantCode) ?? nonEmptyString(cfg.tenantKey) ?? nonEmptyString(cfg.clientCode) ?? "";
+  return t;
+}
+var getEffectiveTenantKey = getEffectiveTenantCode;
+function trim(v) {
+  return v == null ? "" : String(v).trim();
+}
+function toResolvedConfig(cfg) {
+  const merged = { ...cfg };
+  if (!merged.tenantCode && merged.tenantKey) {
+    merged.tenantCode = merged.tenantKey;
+  }
+  const clientId = trim(merged.clientId) || trim(merged.clientCode);
+  return {
+    apiBaseUrl: trim(merged.apiBaseUrl),
+    authServerUrl: trim(merged.authServerUrl),
+    callbackUrl: trim(merged.callbackUrl) || trim(merged.redirectUri),
+    clientCode: trim(merged.clientCode),
+    tenantCode: trim(merged.tenantCode),
+    appId: trim(merged.appId),
+    clientId,
+    tenantId: trim(merged.tenantId)
+  };
+}
+var AuthConfigError = class extends Error {
+  constructor(missing, message) {
+    super(
+      message ?? `[tenneo-auth] Missing required auth configuration: ${missing.join(", ")}. Provide authServerUrl, callbackUrl (redirectUri), and tenant_key/tenant_code via AuthProvider/initPlugin or window.__TENNEO_AUTH_HOST__.`
+    );
+    this.code = "AUTH_CONFIG_MISSING";
+    this.name = "AuthConfigError";
+    this.missing = missing;
+  }
+};
+function resolveConfig(overrides) {
+  return toResolvedConfig(resolveSDKConfig(overrides));
+}
+function getAuthConfig(options) {
+  const resolved = toResolvedConfig(resolveSDKConfig(options?.overrides));
+  if (options?.strict) {
+    const missing = [];
+    if (!resolved.authServerUrl) missing.push("authServerUrl");
+    if (!resolved.callbackUrl) missing.push("callbackUrl");
+    if (!resolved.tenantCode) missing.push("tenantCode|tenantKey");
+    if (missing.length) throw new AuthConfigError(missing);
+  }
+  return resolved;
+}
+function syncHostConfigCacheFromMemory() {
+  const c = resolveSDKConfig();
+  const patch = {};
+  const keys = [
+    "apiBaseUrl",
+    "authServerUrl",
+    "callbackUrl",
+    "redirectUri",
+    "tenantCode",
+    "tenantKey",
+    "clientCode",
+    "clientId",
+    "tenantId",
+    "appId",
+    "basePath"
+  ];
+  for (const k of keys) {
+    const v = c[k];
+    if (v != null && String(v).trim()) {
+      patch[k] = String(v).trim();
+    }
+  }
+  if (Object.keys(patch).length) writeHostConfigCache(patch);
+}
+function writeHostConfigCache(partial) {
+  try {
+    const key = getStorageKey("host_config");
+    const raw = getStorage(key);
+    let existing = {};
+    try {
+      if (raw) existing = JSON.parse(raw);
+    } catch {
+      existing = {};
+    }
+    const next = {
+      ...existing,
+      ...partial,
+      [CACHE_MARKER]: true,
+      [CACHE_AT]: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    setStorage(key, JSON.stringify(next));
+    logger.debug("[config] host_config cache updated (non-authoritative)", {
+      keys: Object.keys(partial)
+    });
+  } catch (e) {
+    logger.warn("[config] Failed to write host_config cache", {
+      error: e instanceof Error ? e.message : String(e)
+    });
+  }
+}
+function initPlugin(config, opts) {
+  setConfig(config);
+  logger.info("[config] initPlugin \u2014 runtime config updated", {
+    syncStorageCache: opts?.syncStorageCache !== false,
+    tenantCode: config.tenantCode ?? config.tenantKey ?? "(none)"
+  });
+  if (opts?.syncStorageCache !== false) {
+    writeHostConfigCache(config);
+  }
+}
+function logConfigResolutionDebug(context, overrides) {
+  const sources = getConfigFieldSources(overrides);
+  logger.debug(`[config] ${context}`, {
+    fieldSources: sources,
+    effectiveTenantCode: getEffectiveTenantCode(overrides) || "(empty)",
+    hasAuthServerUrl: !!resolveSDKConfig(overrides).authServerUrl,
+    hasCallbackUrl: !!resolveSDKConfig(overrides).callbackUrl
+  });
+}
+
+// src/config/host-fields.ts
+function trim2(v) {
+  if (v == null) return null;
+  const s = String(v).trim();
+  return s || null;
+}
+function oauthClientIdForTokenRequest(raw) {
+  if (!raw) return null;
+  let s = raw.trim();
+  if (!s) return null;
+  if (s.toLowerCase().startsWith("public-")) {
+    s = s.slice("public-".length).trim();
+  }
+  return s || null;
+}
+function getClientId() {
+  const c = resolveSDKConfig();
+  const fromId = oauthClientIdForTokenRequest(trim2(c.clientId));
+  if (fromId) return fromId;
+  return oauthClientIdForTokenRequest(trim2(c.clientCode));
+}
+function normalizeClientIdForOAuthTokenBody(raw) {
+  return oauthClientIdForTokenRequest(trim2(raw));
+}
+function getRedirectUri() {
+  const c = resolveSDKConfig();
+  return trim2(c.callbackUrl) ?? trim2(c.redirectUri);
+}
+function getTenantId() {
+  return trim2(resolveSDKConfig().tenantId);
+}
+
 // src/domain/errors.ts
 function isLocalhostHostname(hostname) {
   return hostname === "localhost" || hostname === "127.0.0.1" || hostname.startsWith("192.168.") || hostname.startsWith("10.") || hostname.startsWith("172.16.");
@@ -779,71 +1005,47 @@ var DEFAULT_TOKEN_GRANT_TYPE = OAUTH_CONSTANTS.TOKEN_GRANT_TYPE;
 var DEFAULT_REFRESH_GRANT_TYPE = OAUTH_CONSTANTS.REFRESH_GRANT_TYPE;
 
 // src/config/index.ts
-var inMemoryConfig = {};
-function readHostConfigFromStorage() {
-  try {
-    const raw = getStorage(getStorageKey("host_config"));
-    if (!raw) return {};
-    const parsed = JSON.parse(raw);
-    return parsed && typeof parsed === "object" ? parsed : {};
-  } catch {
-    return {};
-  }
-}
-function resolveMerged(overrides) {
-  const stored = readHostConfigFromStorage();
-  const cfg = { ...stored, ...inMemoryConfig, ...overrides ?? {} };
-  if (!cfg.tenantCode && cfg.tenantKey) {
-    cfg.tenantCode = cfg.tenantKey;
-  }
-  const trimmed = (v) => v == null ? "" : String(v).trim();
-  return {
-    apiBaseUrl: trimmed(cfg.apiBaseUrl),
-    authServerUrl: trimmed(cfg.authServerUrl),
-    callbackUrl: trimmed(cfg.callbackUrl),
-    clientCode: trimmed(cfg.clientCode),
-    tenantCode: trimmed(cfg.tenantCode),
-    appId: trimmed(cfg.appId)
-  };
+function getAuthConfig2(options) {
+  return getAuthConfig(options);
 }
-function resolveConfig(overrides) {
-  return resolveMerged(overrides);
+function requireAuthConfig(overrides) {
+  return getAuthConfig({ strict: true, overrides });
 }
 function getConfig() {
-  return resolveMerged();
-}
-function getAuthConfig() {
-  return resolveMerged();
-}
-function setConfig(overrides) {
-  inMemoryConfig = { ...inMemoryConfig, ...overrides };
-}
-function clearConfigOverrides() {
-  inMemoryConfig = {};
+  return resolveConfig();
 }
 function getRedirectUri2() {
-  const cfg = resolveMerged();
+  const cfg = resolveConfig();
   if (cfg.callbackUrl) return cfg.callbackUrl;
   if (typeof window !== "undefined") return `${window.location.origin}/callback`;
   return "";
 }
 var Config = {
   getApiBaseUrl() {
-    return resolveMerged().apiBaseUrl;
+    return resolveConfig().apiBaseUrl;
   },
   getAuthServerUrl() {
-    return resolveMerged().authServerUrl;
+    return resolveConfig().authServerUrl;
   },
   getClientCode() {
-    return resolveMerged().clientCode;
+    return resolveConfig().clientCode;
   },
   getRedirectUri() {
     return getRedirectUri2();
   },
   getAll() {
-    return resolveMerged();
+    return resolveConfig();
   }
 };
+function applyRuntimeTenantSwitch(tenantKey, opts) {
+  const t = tenantKey.trim();
+  if (!t) return;
+  setConfig({ tenantCode: t, tenantKey: t });
+  logConfigResolutionDebug("applyRuntimeTenantSwitch", { tenantCode: t, tenantKey: t });
+  if (opts?.syncStorageCache !== false) {
+    writeHostConfigCache({ tenantCode: t, tenantKey: t });
+  }
+}
 
 // src/infrastructure/tenant/TenantConfigCache.ts
 var DEFAULT_TTL_MS = 5 * 60 * 1e3;
@@ -919,16 +1121,6 @@ function consumePropsConfig() {
     removeStorage(propsConfigKey);
   }
 }
-function readHostConfig2() {
-  try {
-    const raw = getStorage(getStorageKey("host_config"));
-    if (!raw) return null;
-    const parsed = JSON.parse(raw);
-    return parsed && typeof parsed === "object" ? parsed : null;
-  } catch {
-    return null;
-  }
-}
 function validateTenantKey(value) {
   if (typeof value !== "string") return null;
   const trimmed = value.trim();
@@ -937,17 +1129,16 @@ function validateTenantKey(value) {
 function resolveTenantKey() {
   const propsConfig = consumePropsConfig();
   const tenantFromProps = validateTenantKey(propsConfig?.tenantKey);
-  if (tenantFromProps) return tenantFromProps;
-  const hostConfig = readHostConfig2();
-  if (!hostConfig) {
-    logger.warn("Missing host_config while resolving tenant");
-    return null;
+  if (tenantFromProps) {
+    logger.debug("[tenant] Resolved tenant from props_config", { tenantKey: tenantFromProps });
+    return tenantFromProps;
   }
-  const tenantFromHost = validateTenantKey(hostConfig?.tenantKey);
-  if (tenantFromHost) return tenantFromHost;
-  if (hostConfig.tenantKey != null) {
-    logger.warn("Invalid tenant key in host_config", { tenantKey: hostConfig.tenantKey });
+  const fromHost = validateTenantKey(getEffectiveTenantCode());
+  if (fromHost) {
+    logger.debug("[tenant] Resolved tenant from host/runtime config", { tenantKey: fromHost });
+    return fromHost;
   }
+  logger.warn("[tenant] Unable to resolve tenant key (props + host/runtime empty)");
   return null;
 }
 async function resolveTenantConfig(tenantKey, tenantResolver) {
@@ -1080,7 +1271,7 @@ async function refreshAccessToken() {
         });
         throw new Error("Cannot refresh token: missing required data");
       }
-      const apiAuthBaseUrl = Config.getApiBaseUrl();
+      const apiAuthBaseUrl = Config.getAuthServerUrl();
       const tokenUrl = `${apiAuthBaseUrl}/oauth/refresh`;
       const body = new URLSearchParams({
         grant_type: DEFAULT_REFRESH_GRANT_TYPE,
@@ -1139,6 +1330,56 @@ async function refreshAccessToken() {
   return refreshPromise;
 }
 
+// src/strategies/oauth2-pkce/pkce.ts
+function generateCodeVerifier(length = 128) {
+  const array = new Uint8Array(length);
+  crypto.getRandomValues(array);
+  const base64 = btoa(String.fromCharCode(...array));
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+async function generateCodeChallenge(verifier) {
+  try {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(verifier);
+    const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    const base64 = btoa(String.fromCharCode(...hashArray));
+    return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+  } catch {
+    throw new Error("Failed to generate code challenge");
+  }
+}
+function generateState() {
+  const array = new Uint8Array(32);
+  crypto.getRandomValues(array);
+  const base64 = btoa(String.fromCharCode(...array));
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+
+// src/utils/validation.ts
+function isValidGuid(guid) {
+  if (!guid || typeof guid !== "string") {
+    return false;
+  }
+  const guidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  return guidRegex.test(guid.trim());
+}
+function validateTenantId(tenantId) {
+  if (!tenantId || tenantId.trim() === "") {
+    return {
+      isValid: false,
+      error: "Tenant ID is required"
+    };
+  }
+  if (!isValidGuid(tenantId)) {
+    return {
+      isValid: false,
+      error: "Tenant ID must be a valid GUID format (00000000-0000-0000-0000-000000000001)"
+    };
+  }
+  return { isValid: true };
+}
+
 // src/application/security/redirectLoopGuard.ts
 var DEFAULT_MAX_REDIRECTS = 5;
 var WINDOW_MS = 60 * 1e3;
@@ -1163,18 +1404,166 @@ function checkAndIncrementRedirect(maxAttempts = DEFAULT_MAX_REDIRECTS) {
   redirectCount++;
   return true;
 }
-function isProcessed() {
-  return getStorage(getStorageKey("callback_processed")) === "true";
-}
-function isProcessing() {
-  return isCallbackProcessing();
-}
-function markProcessing() {
-  setCallbackProcessing();
-}
-function markProcessed() {
-  setStorage(getStorageKey("callback_processed"), "true");
-  clearCallbackProcessing();
+
+// src/strategies/oauth2-pkce/oauth.ts
+function storeTenantConfig(config) {
+  const validation = validateTenantId(config.tenantId);
+  if (!validation.isValid) {
+    logger.warn("Tenant ID validation failed", { tenantId: config.tenantId });
+  }
+  const authServerToStore = Config.getAuthServerUrl() || config.authServer;
+  const redirectUriToStore = Config.getRedirectUri();
+  writeHostConfigCache({
+    authServerUrl: authServerToStore,
+    clientId: config.client.clientId,
+    clientCode: config.client.clientCode ?? config.client.clientId,
+    redirectUri: redirectUriToStore,
+    callbackUrl: redirectUriToStore,
+    tenantId: config.tenantId,
+    tenantKey: config.tenantKey ?? "",
+    tenantCode: config.tenantKey ?? ""
+  });
+  if (config.tenantKey) {
+    setStorage(STORAGE_KEYS.tenantKey, config.tenantKey);
+  }
+}
+async function initiateAuthFlow(config) {
+  try {
+    logger.info("Initiating OAuth authorization flow");
+    const authServerFromProps = Config.getAuthServerUrl();
+    const authServerEffective = (authServerFromProps || config?.authServer || "").replace(/\/+$/, "");
+    const redirectUriEffective = Config.getRedirectUri();
+    const tenantIdEffective = config?.tenantId || "";
+    const clientIdEffective = config?.client?.clientId || "";
+    logger.debug("[initiateAuthFlow] Resolved inputs", {
+      authServerFromProps: authServerFromProps ? "(provided)" : "(empty)",
+      authServerEffective,
+      redirectUriEffective,
+      tenantIdEffective,
+      clientIdEffective,
+      scopes: config?.client?.scopes,
+      hasRuntime: !!getAuthRuntime()
+    });
+    logger.info("[initiateAuthFlow] authServerUrl for OAuth", {
+      authServerFromProps: authServerFromProps || null,
+      authServerEffective,
+      redirectUriEffective,
+      tenantId: tenantIdEffective,
+      tenantKey: config.tenantKey ?? null,
+      clientIdEffective
+    });
+    const token = getAccessToken();
+    if (token && !isAccessTokenExpired()) {
+      logger.debug("Valid token already exists, skipping auth flow");
+      clearFlowFlags();
+      return;
+    }
+    if (isCallbackUrl()) {
+      logger.debug("Callback URL detected - clearing flow flag to allow callback processing");
+      clearFlowFlags();
+      return;
+    }
+    if (isFlowInProgress()) {
+      if (isFlowFlagStale(3e3)) {
+        logger.info("Stale auth flow flag detected, clearing and proceeding");
+        clearFlowFlags();
+      } else {
+        logger.debug("Auth flow already in progress (recent), skipping duplicate redirect");
+        return;
+      }
+    }
+    setFlowFlags();
+    if (!(Config.getAuthServerUrl() || config?.authServer) || !config.client?.clientId || !config.client?.redirectUri) {
+      logger.error("[initiateAuthFlow] Missing required tenant config", {
+        authServerEffective,
+        clientId: config?.client?.clientId,
+        redirectUriFromTenantApi: config?.client?.redirectUri,
+        redirectUriEffective
+      });
+      throw new Error("Invalid tenant configuration for auth flow");
+    }
+    storeTenantConfig(config);
+    logger.debug("[initiateAuthFlow] Stored tenant config, generating PKCE");
+    removeStorage(getStorageKey("callback_processed"));
+    removeStorage(getStorageKey("state_mismatch"));
+    clearCallbackProcessing();
+    const codeVerifier = generateCodeVerifier();
+    const codeChallenge = await generateCodeChallenge(codeVerifier);
+    const state = generateState();
+    removeStorage(STORAGE_KEYS.codeVerifier);
+    removeStorage(STORAGE_KEYS.state);
+    setStorage(STORAGE_KEYS.codeVerifier, codeVerifier);
+    setStorage(STORAGE_KEYS.state, state);
+    const authUrl = buildAuthorizationUrl(config, codeChallenge, state);
+    logger.debug("[initiateAuthFlow] Built authorization URL", {
+      authServerEffective,
+      urlPrefix: authUrl?.slice(0, 80)
+    });
+    if (!authUrl || !(authUrl.startsWith("http://") || authUrl.startsWith("https://"))) {
+      throw new Error("Invalid authorization URL generated");
+    }
+    if (!checkAndIncrementRedirect()) {
+      logger.warn("Redirect loop protection: max redirect attempts exceeded");
+      clearFlowFlags();
+      return;
+    }
+    logger.info("Redirecting to authorization server");
+    emitAuthEvent(AuthEventNames.LOGIN_STARTED, { tenantKey: config.tenantKey });
+    const runtime = getAuthRuntime();
+    if (runtime) {
+      logger.debug("[initiateAuthFlow] Redirect via runtime.urlProvider.redirect");
+      runtime.urlProvider.redirect(authUrl);
+    } else if (typeof window !== "undefined") {
+      logger.debug("[initiateAuthFlow] Redirect via window.location.replace");
+      window.location.replace(authUrl);
+    } else {
+      logger.error("[initiateAuthFlow] No runtime and no window; cannot redirect", { authUrl });
+    }
+  } catch (error) {
+    clearFlowFlags();
+    logger.error("Failed to initiate auth flow", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+    throw error;
+  }
+}
+function buildAuthorizationUrl(config, codeChallenge, state) {
+  const authServerBase = (Config.getAuthServerUrl() || config.authServer || "").replace(/\/+$/, "");
+  if (isLocalhost2()) {
+    logger.debug("Building authorization URL", {
+      authServer: authServerBase,
+      clientId: config.client.clientId,
+      redirectUri: config.client.redirectUri,
+      scopes: config.client.scopes
+    });
+  }
+  const tenantIdToUse = config.tenantId;
+  const clientIdToUse = config.client.clientId;
+  const redirectUriToUse = Config.getRedirectUri();
+  const params = new URLSearchParams({
+    client_id: `public-${clientIdToUse}`,
+    tenant_id: tenantIdToUse,
+    redirect_uri: redirectUriToUse,
+    response_type: DEFAULT_RESPONSE_TYPE,
+    scope: config.client.scopes,
+    state,
+    code_challenge: codeChallenge,
+    code_challenge_method: DEFAULT_CODE_CHALLENGE_METHOD
+  });
+  return `${authServerBase}/connect/authorize?${params.toString()}`;
+}
+function isProcessed() {
+  return getStorage(getStorageKey("callback_processed")) === "true";
+}
+function isProcessing() {
+  return isCallbackProcessing();
+}
+function markProcessing() {
+  setCallbackProcessing();
+}
+function markProcessed() {
+  setStorage(getStorageKey("callback_processed"), "true");
+  clearCallbackProcessing();
 }
 function clearProcessing() {
   clearCallbackProcessing();
@@ -1193,6 +1582,38 @@ function cleanUrlSoft() {
 function clearAllAuthFlags() {
   clearFlowFlags();
 }
+async function tryRecoverOAuthConfigFromTenant() {
+  const runtime = getAuthRuntime();
+  const tenantKey = (resolveTenantKey() ?? getTenantKey() ?? "").trim();
+  if (!runtime?.tenantResolver || !tenantKey) {
+    logger.debug("[Callback] OAuth config recovery skipped \u2014 no tenantResolver or tenantKey", {
+      hasResolver: !!runtime?.tenantResolver,
+      tenantKey: tenantKey || "(empty)"
+    });
+    return null;
+  }
+  try {
+    const tc = await runtime.tenantResolver.resolve(tenantKey);
+    if (!tc?.client?.clientId || !tc.tenantId) {
+      logger.warn("[Callback] OAuth config recovery: tenant resolve missing client or tenantId", {
+        tenantKey
+      });
+      return null;
+    }
+    storeTenantConfig(tc);
+    return {
+      clientId: tc.client.clientId.trim() || null,
+      redirectUri: tc.client.redirectUri?.trim() || getRedirectUri(),
+      tenantId: tc.tenantId.trim() || null
+    };
+  } catch (e) {
+    logger.warn("[Callback] OAuth config recovery: tenant re-resolve failed", {
+      tenantKey,
+      error: e instanceof Error ? e.message : String(e)
+    });
+    return null;
+  }
+}
 async function handleCallback() {
   const runtimeSearch = getAuthRuntime()?.urlProvider.getCurrentUrl().search;
   const windowSearch = typeof window !== "undefined" ? window.location.search : "";
@@ -1275,9 +1696,22 @@ async function handleCallback() {
       cleanUrlSoft();
       return false;
     }
-    const clientId = getClientId();
-    const redirectUri = getRedirectUri();
-    const tenantId = getTenantId();
+    let clientId = getClientId();
+    let redirectUri = getRedirectUri();
+    let tenantId = getTenantId();
+    if (!clientId || !redirectUri || !tenantId) {
+      logger.warn("[Callback] OAuth config incomplete \u2014 attempting tenant re-resolve", {
+        hasClientId: !!clientId,
+        hasRedirectUri: !!redirectUri,
+        hasTenantId: !!tenantId
+      });
+      const recovered = await tryRecoverOAuthConfigFromTenant();
+      if (recovered) {
+        if (!redirectUri) redirectUri = recovered.redirectUri;
+        if (!tenantId) tenantId = recovered.tenantId;
+        clientId = getClientId() ?? normalizeClientIdForOAuthTokenBody(recovered.clientId) ?? null;
+      }
+    }
     if (!clientId || !redirectUri || !tenantId) {
       logger.error("[Callback] Early exit: missing OAuth config during callback", {
         hasClientId: !!clientId,
@@ -1335,320 +1769,120 @@ async function handleCallback() {
       if (status === 400 && errorCode === "invalid_grant" && (String(errorDescription).includes("already used") || String(errorDescription).includes("Code not found") || String(errorDescription).includes("expired, already used"))) {
         const existingToken2 = getAccessToken();
         const tokenValid2 = existingToken2 && !isAccessTokenExpired();
-        if (tokenValid2) {
-          removeStorage(STORAGE_KEYS.codeVerifier);
-          removeStorage(STORAGE_KEYS.state);
-          clearAllAuthFlags();
-          markProcessed();
-          cleanUrlSoft();
-          logger.info("OAuth callback processed successfully (code already used, but token exists)");
-          resetRedirectLoopGuard();
-          emitAuthEvent(AuthEventNames.CALLBACK_SUCCESS);
-          return true;
-        }
-      }
-      emitAuthEvent(AuthEventNames.CALLBACK_FAILED, {
-        error: err.message,
-        message: responseData?.error_description ?? err.message
-      });
-      logger.error("OAuth callback failed (Axios error)", {
-        status,
-        statusText: err.response?.statusText,
-        responseData: err.response?.data,
-        message: err.message,
-        url: err.config?.url
-      });
-    } else {
-      logger.error("OAuth callback failed", {
-        error: err instanceof Error ? err.message : String(err)
-      });
-    }
-    clearAllAuthFlags();
-    const existingToken = getAccessToken();
-    const tokenValid = existingToken && !isAccessTokenExpired();
-    if (tokenValid) {
-      markProcessed();
-      cleanUrlSoft();
-      resetRedirectLoopGuard();
-      emitAuthEvent(AuthEventNames.CALLBACK_SUCCESS);
-      return true;
-    }
-    emitAuthEvent(AuthEventNames.CALLBACK_FAILED, {
-      error: err instanceof Error ? err.message : String(err)
-    });
-    clearProcessing();
-    if (isCallbackUrl()) cleanUrlSoft();
-    return false;
-  }
-}
-
-// src/application/flows/CallbackFlow.ts
-var CallbackFlow = class {
-  async execute(context) {
-    const { runtime } = context;
-    const { urlProvider, logger: log } = runtime;
-    const getUrl = () => urlProvider.getCurrentUrl();
-    clearFlowFlags();
-    const handled = await handleCallback();
-    if (handled) {
-      if (isCallbackUrlFromUrl(getUrl())) {
-        if (isCallbackProcessing()) return { completed: true };
-        const u = getUrl();
-        urlProvider.redirect(`${u.origin}${u.pathname}`);
-        return { completed: true };
-      }
-      return { completed: true };
-    }
-    if (isCallbackUrlFromUrl(getUrl())) {
-      const u = getUrl();
-      urlProvider.redirect(`${u.origin}${u.pathname}`);
-    }
-    return { completed: true };
-  }
-};
-
-// src/application/flows/AuthenticatedFlow.ts
-var AuthenticatedFlow = class {
-  async execute(_context) {
-    return { completed: true };
-  }
-};
-
-// src/application/engine/defaultEngine.ts
-var defaultEngine = null;
-function getDefaultAuthEngine() {
-  return defaultEngine;
-}
-function setDefaultAuthEngine(engine) {
-  defaultEngine = engine;
-}
-
-// src/application/token.ts
-var lastNoRefreshLog = 0;
-var NO_REFRESH_LOG_INTERVAL_MS = 5e3;
-async function ensureValidAccessToken() {
-  const engine = getDefaultAuthEngine();
-  if (engine) {
-    try {
-      return await engine.getAccessToken();
-    } catch {
-    }
-  }
-  const token = getAccessToken();
-  if (token && !isAccessTokenExpired()) return token;
-  const refreshToken = getRefreshToken();
-  if (!refreshToken) {
-    const now = Date.now();
-    if (now - lastNoRefreshLog >= NO_REFRESH_LOG_INTERVAL_MS) {
-      lastNoRefreshLog = now;
-      logger.debug("No refresh token - cannot refresh; login required");
-    }
-    throw new Error("No refresh token; login required");
-  }
-  return await refreshAccessToken();
-}
-function getAccessToken2() {
-  return getAccessToken();
-}
-
-// src/strategies/oauth2-pkce/pkce.ts
-function generateCodeVerifier(length = 128) {
-  const array = new Uint8Array(length);
-  crypto.getRandomValues(array);
-  const base64 = btoa(String.fromCharCode(...array));
-  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-}
-async function generateCodeChallenge(verifier) {
-  try {
-    const encoder = new TextEncoder();
-    const data = encoder.encode(verifier);
-    const hashBuffer = await crypto.subtle.digest("SHA-256", data);
-    const hashArray = Array.from(new Uint8Array(hashBuffer));
-    const base64 = btoa(String.fromCharCode(...hashArray));
-    return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-  } catch {
-    throw new Error("Failed to generate code challenge");
-  }
-}
-function generateState() {
-  const array = new Uint8Array(32);
-  crypto.getRandomValues(array);
-  const base64 = btoa(String.fromCharCode(...array));
-  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-}
-
-// src/utils/validation.ts
-function isValidGuid(guid) {
-  if (!guid || typeof guid !== "string") {
-    return false;
-  }
-  const guidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-  return guidRegex.test(guid.trim());
-}
-function validateTenantId(tenantId) {
-  if (!tenantId || tenantId.trim() === "") {
-    return {
-      isValid: false,
-      error: "Tenant ID is required"
-    };
-  }
-  if (!isValidGuid(tenantId)) {
-    return {
-      isValid: false,
-      error: "Tenant ID must be a valid GUID format (00000000-0000-0000-0000-000000000001)"
-    };
-  }
-  return { isValid: true };
-}
-
-// src/strategies/oauth2-pkce/oauth.ts
-function storeTenantConfig(config) {
-  const validation = validateTenantId(config.tenantId);
-  if (!validation.isValid) {
-    logger.warn("Tenant ID validation failed", { tenantId: config.tenantId });
-  }
-  const authServerToStore = Config.getAuthServerUrl() || config.authServer;
-  const redirectUriToStore = Config.getRedirectUri();
-  const hostConfigKey = getStorageKey("host_config");
-  let existing = {};
-  try {
-    const raw = getStorage(hostConfigKey);
-    if (raw) existing = JSON.parse(raw);
-  } catch {
-    existing = {};
-  }
-  setStorage(
-    hostConfigKey,
-    JSON.stringify({
-      ...existing,
-      authServerUrl: authServerToStore,
-      clientId: config.client.clientId,
-      redirectUri: redirectUriToStore,
-      tenantId: config.tenantId,
-      tenantKey: config.tenantKey ?? existing.tenantKey ?? "",
-      tenantCode: config.tenantKey ?? existing.tenantCode ?? ""
-    })
-  );
-  if (config.tenantKey) {
-    setStorage(STORAGE_KEYS.tenantKey, config.tenantKey);
-  }
-}
-async function initiateAuthFlow(config) {
-  try {
-    logger.info("Initiating OAuth authorization flow");
-    const authServerFromProps = Config.getAuthServerUrl();
-    const authServerEffective = (authServerFromProps || config?.authServer || "").replace(/\/+$/, "");
-    const redirectUriEffective = Config.getRedirectUri();
-    const tenantIdEffective = config?.tenantId || "";
-    const clientIdEffective = config?.client?.clientId || "";
-    logger.debug("[initiateAuthFlow] Resolved inputs", {
-      authServerFromProps: authServerFromProps ? "(provided)" : "(empty)",
-      authServerEffective,
-      redirectUriEffective,
-      tenantIdEffective,
-      clientIdEffective,
-      scopes: config?.client?.scopes,
-      hasRuntime: !!getAuthRuntime()
-    });
-    const token = getAccessToken();
-    if (token && !isAccessTokenExpired()) {
-      logger.debug("Valid token already exists, skipping auth flow");
-      clearFlowFlags();
-      return;
-    }
-    if (isCallbackUrl()) {
-      logger.debug("Callback URL detected - clearing flow flag to allow callback processing");
-      clearFlowFlags();
-      return;
-    }
-    if (isFlowInProgress()) {
-      if (isFlowFlagStale(3e3)) {
-        logger.info("Stale auth flow flag detected, clearing and proceeding");
-        clearFlowFlags();
-      } else {
-        logger.debug("Auth flow already in progress (recent), skipping duplicate redirect");
-        return;
+        if (tokenValid2) {
+          removeStorage(STORAGE_KEYS.codeVerifier);
+          removeStorage(STORAGE_KEYS.state);
+          clearAllAuthFlags();
+          markProcessed();
+          cleanUrlSoft();
+          logger.info("OAuth callback processed successfully (code already used, but token exists)");
+          resetRedirectLoopGuard();
+          emitAuthEvent(AuthEventNames.CALLBACK_SUCCESS);
+          return true;
+        }
       }
-    }
-    setFlowFlags();
-    if (!(Config.getAuthServerUrl() || config?.authServer) || !config.client?.clientId || !config.client?.redirectUri) {
-      logger.error("[initiateAuthFlow] Missing required tenant config", {
-        authServerEffective,
-        clientId: config?.client?.clientId,
-        redirectUriFromTenantApi: config?.client?.redirectUri,
-        redirectUriEffective
+      emitAuthEvent(AuthEventNames.CALLBACK_FAILED, {
+        error: err.message,
+        message: responseData?.error_description ?? err.message
+      });
+      logger.error("OAuth callback failed (Axios error)", {
+        status,
+        statusText: err.response?.statusText,
+        responseData: err.response?.data,
+        message: err.message,
+        url: err.config?.url
+      });
+    } else {
+      logger.error("OAuth callback failed", {
+        error: err instanceof Error ? err.message : String(err)
       });
-      throw new Error("Invalid tenant configuration for auth flow");
     }
-    storeTenantConfig(config);
-    logger.debug("[initiateAuthFlow] Stored tenant config, generating PKCE");
-    removeStorage(getStorageKey("callback_processed"));
-    removeStorage(getStorageKey("state_mismatch"));
-    clearCallbackProcessing();
-    const codeVerifier = generateCodeVerifier();
-    const codeChallenge = await generateCodeChallenge(codeVerifier);
-    const state = generateState();
-    removeStorage(STORAGE_KEYS.codeVerifier);
-    removeStorage(STORAGE_KEYS.state);
-    setStorage(STORAGE_KEYS.codeVerifier, codeVerifier);
-    setStorage(STORAGE_KEYS.state, state);
-    const authUrl = buildAuthorizationUrl(config, codeChallenge, state);
-    logger.debug("[initiateAuthFlow] Built authorization URL", {
-      authServerEffective,
-      urlPrefix: authUrl?.slice(0, 80)
-    });
-    if (!authUrl || !(authUrl.startsWith("http://") || authUrl.startsWith("https://"))) {
-      throw new Error("Invalid authorization URL generated");
+    clearAllAuthFlags();
+    const existingToken = getAccessToken();
+    const tokenValid = existingToken && !isAccessTokenExpired();
+    if (tokenValid) {
+      markProcessed();
+      cleanUrlSoft();
+      resetRedirectLoopGuard();
+      emitAuthEvent(AuthEventNames.CALLBACK_SUCCESS);
+      return true;
     }
-    if (!checkAndIncrementRedirect()) {
-      logger.warn("Redirect loop protection: max redirect attempts exceeded");
-      clearFlowFlags();
-      return;
+    emitAuthEvent(AuthEventNames.CALLBACK_FAILED, {
+      error: err instanceof Error ? err.message : String(err)
+    });
+    clearProcessing();
+    if (isCallbackUrl()) cleanUrlSoft();
+    return false;
+  }
+}
+
+// src/application/flows/CallbackFlow.ts
+var CallbackFlow = class {
+  async execute(context) {
+    const { runtime } = context;
+    const { urlProvider, logger: log } = runtime;
+    const getUrl = () => urlProvider.getCurrentUrl();
+    clearFlowFlags();
+    const handled = await handleCallback();
+    if (handled) {
+      if (isCallbackUrlFromUrl(getUrl())) {
+        if (isCallbackProcessing()) return { completed: true };
+        const u = getUrl();
+        urlProvider.redirect(`${u.origin}${u.pathname}`);
+        return { completed: true };
+      }
+      return { completed: true };
     }
-    logger.info("Redirecting to authorization server");
-    emitAuthEvent(AuthEventNames.LOGIN_STARTED, { tenantKey: config.tenantKey });
-    const runtime = getAuthRuntime();
-    if (runtime) {
-      logger.debug("[initiateAuthFlow] Redirect via runtime.urlProvider.redirect");
-      runtime.urlProvider.redirect(authUrl);
-    } else if (typeof window !== "undefined") {
-      logger.debug("[initiateAuthFlow] Redirect via window.location.replace");
-      window.location.replace(authUrl);
-    } else {
-      logger.error("[initiateAuthFlow] No runtime and no window; cannot redirect", { authUrl });
+    if (isCallbackUrlFromUrl(getUrl())) {
+      const u = getUrl();
+      urlProvider.redirect(`${u.origin}${u.pathname}`);
     }
-  } catch (error) {
-    clearFlowFlags();
-    logger.error("Failed to initiate auth flow", {
-      error: error instanceof Error ? error.message : String(error)
-    });
-    throw error;
+    return { completed: true };
   }
+};
+
+// src/application/flows/AuthenticatedFlow.ts
+var AuthenticatedFlow = class {
+  async execute(_context) {
+    return { completed: true };
+  }
+};
+
+// src/application/engine/defaultEngine.ts
+var defaultEngine = null;
+function getDefaultAuthEngine() {
+  return defaultEngine;
 }
-function buildAuthorizationUrl(config, codeChallenge, state) {
-  const authServerBase = (Config.getAuthServerUrl() || config.authServer || "").replace(/\/+$/, "");
-  if (isLocalhost2()) {
-    logger.debug("Building authorization URL", {
-      authServer: authServerBase,
-      clientId: config.client.clientId,
-      redirectUri: config.client.redirectUri,
-      scopes: config.client.scopes
-    });
+function setDefaultAuthEngine(engine) {
+  defaultEngine = engine;
+}
+
+// src/application/token.ts
+var lastNoRefreshLog = 0;
+var NO_REFRESH_LOG_INTERVAL_MS = 5e3;
+async function ensureValidAccessToken() {
+  const engine = getDefaultAuthEngine();
+  if (engine) {
+    try {
+      return await engine.getAccessToken();
+    } catch {
+    }
   }
-  const tenantIdToUse = config.tenantId;
-  const clientIdToUse = config.client.clientId;
-  const redirectUriToUse = Config.getRedirectUri();
-  const params = new URLSearchParams({
-    client_id: `public-${clientIdToUse}`,
-    tenant_id: tenantIdToUse,
-    redirect_uri: redirectUriToUse,
-    response_type: DEFAULT_RESPONSE_TYPE,
-    scope: config.client.scopes,
-    state,
-    code_challenge: codeChallenge,
-    code_challenge_method: DEFAULT_CODE_CHALLENGE_METHOD
-  });
-  return `${authServerBase}/connect/authorize?${params.toString()}`;
+  const token = getAccessToken();
+  if (token && !isAccessTokenExpired()) return token;
+  const refreshToken = getRefreshToken();
+  if (!refreshToken) {
+    const now = Date.now();
+    if (now - lastNoRefreshLog >= NO_REFRESH_LOG_INTERVAL_MS) {
+      lastNoRefreshLog = now;
+      logger.debug("No refresh token - cannot refresh; login required");
+    }
+    throw new Error("No refresh token; login required");
+  }
+  return await refreshAccessToken();
+}
+function getAccessToken2() {
+  return getAccessToken();
 }
 
 // src/application/flows/RefreshFlow.ts
@@ -1729,13 +1963,18 @@ var TenantSwitchFlow = class {
       );
     }
     try {
-      const cfg = getAuthConfig();
-      setStorage(getStorageKey("host_config"), JSON.stringify({
-        ...cfg,
+      const cfg = getAuthConfig2();
+      writeHostConfigCache({
+        apiBaseUrl: cfg.apiBaseUrl,
+        authServerUrl: cfg.authServerUrl,
+        callbackUrl: cfg.callbackUrl,
+        appId: cfg.appId,
+        clientCode: tenantConfig.client?.clientCode ?? cfg.clientCode ?? "",
+        clientId: cfg.clientId || tenantConfig.client?.clientId,
+        tenantId: tenantConfig.tenantId ?? cfg.tenantId,
         tenantKey,
-        tenantCode: tenantKey,
-        clientCode: tenantConfig.client?.clientCode ?? cfg.clientCode ?? ""
-      }));
+        tenantCode: tenantKey
+      });
     } catch {
     }
     setTenantKey(tenantKey);
@@ -1899,6 +2138,22 @@ async function bootstrap() {
   return bootstrapImpl();
 }
 
+// src/infrastructure/watchers/watcher-guard.ts
+var suspended = false;
+var generation = 0;
+function suspendWatchers() {
+  suspended = true;
+  generation += 1;
+  return generation;
+}
+function resumeWatchers(expectedGen) {
+  if (expectedGen !== void 0 && expectedGen !== generation) return;
+  suspended = false;
+}
+function areWatchersSuspended() {
+  return suspended;
+}
+
 // src/strategies/cookie/cookie-auth.ts
 var COOKIE_NAMES = {
   accessToken: "tenneo_auth_access_token",
@@ -2025,6 +2280,10 @@ function checkCookiesDeleted() {
   }
 }
 function handleCookieDeletion() {
+  if (areWatchersSuspended()) {
+    logger.debug("Cookie deletion handler skipped \u2014 watchers suspended (logout/teardown)");
+    return;
+  }
   try {
     logger.info("Cookies deleted detected - clearing session and redirecting to login");
     clearAuthStorage();
@@ -2062,6 +2321,7 @@ function startCookieWatcher() {
     allCookies: initialCookies
   });
   watchInterval = setInterval(async () => {
+    if (areWatchersSuspended()) return;
     const cookiesDeleted = checkCookiesDeleted();
     if (cookiesDeleted) {
       logger.info("Cookies deleted detected by cookie watcher");
@@ -2125,9 +2385,11 @@ function checkStorageCleared() {
   }
 }
 function handleStorageEvent(event) {
+  if (areWatchersSuspended()) return;
   if (typeof window !== "undefined" && event.storageArea === window.sessionStorage) {
     const wasCleared = checkStorageCleared();
     if (wasCleared) {
+      if (areWatchersSuspended()) return;
       logger.info("Detected manual sessionStorage clear! Redirecting to login...");
       const cb = getSessionClearedCallback();
       if (cb) {
@@ -2147,8 +2409,10 @@ function startStorageWatcher() {
   storageEventListener = handleStorageEvent;
   window.addEventListener("storage", storageEventListener);
   const pollInterval = setInterval(() => {
+    if (areWatchersSuspended()) return;
     const wasCleared = checkStorageCleared();
     if (wasCleared) {
+      if (areWatchersSuspended()) return;
       logger.info("Detected manual sessionStorage clear (polling)! Redirecting to login...");
       clearInterval(pollInterval);
       const cb = getSessionClearedCallback();
@@ -2219,27 +2483,6 @@ function buildUrl(baseUrl, path) {
   url.pathname = url.pathname.endsWith("/") ? `${url.pathname}${normalizedPath.slice(1)}` : `${url.pathname}${normalizedPath}`;
   return url.toString();
 }
-function snapshotHostConfig() {
-  try {
-    const raw = getStorage(getStorageKey("host_config"));
-    if (!raw) return null;
-    const parsed = JSON.parse(raw);
-    return parsed && typeof parsed === "object" ? parsed : null;
-  } catch {
-    return null;
-  }
-}
-function restoreHostConfig(config) {
-  if (!config) return;
-  try {
-    setStorage(getStorageKey("host_config"), JSON.stringify(config));
-    logger.debug("Restored host_config after logout cleanup");
-  } catch (error) {
-    logger.warn("Failed to restore host_config after logout cleanup", {
-      error: error instanceof Error ? error.message : String(error)
-    });
-  }
-}
 function getCsrfToken() {
   try {
     if (typeof document === "undefined") return null;
@@ -2254,62 +2497,68 @@ function getCsrfToken() {
 }
 async function callServerLogout(logoutUrl) {
   const csrfToken = getCsrfToken();
-  async function doRequest(method) {
-    const isPost = method === "POST";
-    const headers = {
-      "X-Requested-With": "XMLHttpRequest",
-      Accept: "application/json, */*"
-    };
-    if (isPost) {
-      headers["Content-Type"] = "application/x-www-form-urlencoded";
-    }
-    if (csrfToken) {
-      headers["X-CSRF-Token"] = csrfToken;
-    }
+  const headers = {
+    "X-Requested-With": "XMLHttpRequest",
+    Accept: "application/json, */*",
+    "Content-Type": "application/x-www-form-urlencoded"
+  };
+  if (csrfToken) {
+    headers["X-CSRF-Token"] = csrfToken;
+  }
+  try {
     const response = await fetch(logoutUrl, {
-      method,
+      method: "POST",
       mode: "cors",
       headers,
-      credentials: "include"
+      credentials: "include",
+      body: ""
     });
     if (!response.ok) {
-      logger.warn("Server logout HTTP error", {
-        method,
+      logger.warn("[logout] Server logout HTTP error", {
         status: response.status,
         statusText: response.statusText
       });
       return { success: false };
     }
-    const data = await response.json().catch(() => ({}));
-    logger.info(`Server logout response (${method})`, { response: data });
+    const contentType = response.headers.get("content-type") || "";
+    if (!contentType.includes("application/json")) {
+      logger.info("[logout] Server logout: OK without JSON body", {
+        status: response.status
+      });
+      return { success: true, response: { success: true } };
+    }
+    const text = await response.text();
+    let data = {};
+    if (text?.trim()) {
+      try {
+        data = JSON.parse(text);
+      } catch {
+        logger.warn("[logout] Server returned non-JSON body with JSON content-type");
+        return { success: false };
+      }
+    }
+    logger.info("[logout] Server logout response", { response: data });
     if (data && (data.success === true || data.logout === true)) {
       return { success: true, response: data };
     }
-    logger.warn("Server logout response invalid payload", {
-      method,
-      response: data
-    });
+    if (!text || text.trim() === "") {
+      return { success: true, response: { success: true } };
+    }
+    logger.warn("[logout] Server logout: unexpected JSON payload", { response: data });
     return { success: false, response: data };
-  }
-  try {
-    const postResult = await doRequest("POST");
-    if (postResult.success) return postResult;
-    logger.debug("POST logout did not succeed, trying GET");
-    const getResult = await doRequest("GET");
-    return getResult;
   } catch (error) {
-    logger.warn("Server logout failed (both POST and GET)", {
+    logger.warn("[logout] Server logout request failed", {
       error: error instanceof Error ? error.message : String(error)
     });
     return { success: false };
   }
 }
 function performLocalLogoutCleanup() {
-  logger.debug("Performing local logout cleanup");
+  logger.debug("[logout] Local cleanup: cookies + auth storage");
   try {
     getAuthRuntime()?.clearCookies?.clearCookies();
   } catch (error) {
-    logger.debug("Runtime cookie clearer failed (ignored)", {
+    logger.debug("[logout] Runtime cookie clearer failed (ignored)", {
       error: error instanceof Error ? error.message : String(error)
     });
   }
@@ -2317,11 +2566,11 @@ function performLocalLogoutCleanup() {
   try {
     clearAuthStorage();
   } catch (error) {
-    logger.warn("clearAuthStorage failed (ignored)", {
+    logger.warn("[logout] clearAuthStorage failed", {
       error: error instanceof Error ? error.message : String(error)
     });
   }
-  logger.info("Local logout cleanup completed");
+  logger.info("[logout] Local cleanup completed");
 }
 function acquireLogoutLock() {
   const LOCK_KEY = getStorageKey("logout_lock");
@@ -2330,7 +2579,7 @@ function acquireLogoutLock() {
   if (existingLock) {
     const lockTime = Number(existingLock);
     if (!Number.isNaN(lockTime) && now - lockTime < 5e3) {
-      logger.debug("Logout lock active \u2013 skipping duplicate logout", {
+      logger.debug("[logout] Lock active \u2014 duplicate tab logout skipped", {
         now,
         lockTime
       });
@@ -2346,72 +2595,95 @@ function releaseLogoutLock() {
   } catch {
   }
 }
-async function logout(tenantKey) {
-  const preservedHostConfig = snapshotHostConfig();
-  if (tenantKey?.trim()) {
-    const updated = {
-      ...preservedHostConfig ?? {},
-      tenantKey: tenantKey.trim(),
-      tenantCode: tenantKey.trim()
-    };
-    setStorage(getStorageKey("host_config"), JSON.stringify(updated));
-  }
+var logoutInFlight = null;
+async function runLogoutPipeline(tenantKey) {
+  const gen = suspendWatchers();
+  logger.info("[logout] Lifecycle: suspend watchers", { generation: gen });
+  stopStorageWatcher();
+  stopCookieWatcher();
   if (!acquireLogoutLock()) {
-    return { success: true, message: "Logout already in progress." };
+    resumeWatchers(gen);
+    logger.debug("[logout] Lifecycle: resume (skipped \u2014 lock)");
+    return { success: true, message: "Logout already in progress in another tab." };
   }
+  let serverLogoutSuccess = false;
+  let serverResponse;
   try {
-    stopStorageWatcher();
-    stopCookieWatcher();
-    const authConfig = getAuthConfig();
-    const apiAuthBaseUrl = authConfig.authServerUrl || Config.getAuthServerUrl();
-    let serverLogoutSuccess = false;
-    let serverResponse;
+    if (tenantKey?.trim()) {
+      applyRuntimeTenantSwitch(tenantKey.trim(), { syncStorageCache: true });
+      logger.info("[logout] Runtime tenant applied for logout context", {
+        tenantKey: tenantKey.trim()
+      });
+    }
+    const authConfig = getAuthConfig2();
+    const apiAuthBaseUrl = authConfig.authServerUrl;
     if (apiAuthBaseUrl) {
       const logoutUrl = buildUrl(apiAuthBaseUrl, "account/logout");
-      logger.info("Calling auth server logout", { logoutUrl });
+      logger.info("[logout] Calling auth server logout (POST)", { logoutUrl });
       const logoutResult = await callServerLogout(logoutUrl);
       serverLogoutSuccess = logoutResult.success;
       serverResponse = logoutResult.response;
       if (!serverLogoutSuccess) {
-        logger.warn("Server logout failed \u2013 session may still exist", {
+        logger.warn("[logout] Server logout did not confirm success \u2014 clearing local session anyway", {
           logoutUrl,
           serverResponse
         });
       }
     } else {
-      logger.warn("API auth base URL not configured, performing local logout only");
+      logger.warn("[logout] authServerUrl missing \u2014 local logout only");
     }
+  } catch (error) {
+    logger.error("[logout] Unexpected error before local cleanup", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
+  try {
     performLocalLogoutCleanup();
-    restoreHostConfig(preservedHostConfig);
-    resetCookieWatcher();
-    startStorageWatcher();
-    releaseLogoutLock();
-    logger.info("Logout completed \u2013 flags set, storage cleared, fresh login required", {
-      serverLogoutSuccess,
-      serverResponse
+  } catch (error) {
+    logger.error("[logout] Local cleanup threw", {
+      error: error instanceof Error ? error.message : String(error)
     });
-    emitAuthEvent(AuthEventNames.LOGOUT_COMPLETED, {
-      serverLogoutSuccess,
-      tenantKey: tenantKey?.trim() || preservedHostConfig?.tenantKey || void 0,
-      message: serverLogoutSuccess ? "Server logout success" : "Local logout only"
+  }
+  try {
+    syncHostConfigCacheFromMemory();
+    logger.debug("[logout] host_config cache refreshed from runtime (not restored from snapshot)");
+  } catch (error) {
+    logger.warn("[logout] Failed to sync host config cache", {
+      error: error instanceof Error ? error.message : String(error)
     });
-    return {
-      success: true,
-      message: serverLogoutSuccess ? serverResponse?.message || "Logout successful. Session cookies cleared. Fresh login required." : "Logged out locally. Fresh login required (server logout may have failed).",
-      serverResponse
-    };
+  }
+  try {
+    resetCookieWatcher();
+    startStorageWatcher();
+    logger.info("[logout] Watchers restarted");
   } catch (error) {
-    logger.error("Logout failed unexpectedly", {
+    logger.warn("[logout] Watcher restart failed", {
       error: error instanceof Error ? error.message : String(error)
     });
-    performLocalLogoutCleanup();
-    restoreHostConfig(preservedHostConfig);
-    releaseLogoutLock();
-    return {
-      success: true,
-      message: "Logged out locally due to an error. Fresh login required."
-    };
   }
+  releaseLogoutLock();
+  resumeWatchers(gen);
+  logger.info("[logout] Lifecycle: complete", { serverLogoutSuccess });
+  emitAuthEvent(AuthEventNames.LOGOUT_COMPLETED, {
+    serverLogoutSuccess,
+    tenantKey: tenantKey?.trim() || getAuthConfig2().tenantCode || void 0,
+    message: serverLogoutSuccess ? "Server logout success" : "Local logout (server may be pending)"
+  });
+  return {
+    success: true,
+    message: serverLogoutSuccess ? serverResponse?.message || "Logout successful. Fresh login required." : "Logged out locally. Fresh login required (server logout may have failed).",
+    serverResponse
+  };
+}
+async function logout(tenantKey) {
+  if (logoutInFlight) {
+    logger.debug("[logout] Coalescing with in-flight logout");
+    return logoutInFlight;
+  }
+  logoutInFlight = runLogoutPipeline(tenantKey).finally(() => {
+    logoutInFlight = null;
+  });
+  return logoutInFlight;
 }
 var AuthContext = react.createContext(void 0);
 function useAuthContext() {
@@ -2486,7 +2758,6 @@ async function resolveTenant(tenantKey) {
           scopes: DEFAULT_SCOPES2
         }
       };
-      console.log("config====", config);
       logger.debug("Resolved tenant config", { tenantCode });
       return config;
     } catch (error) {
@@ -2747,33 +3018,29 @@ function AuthProvider({
       logger.warn("[AuthProvider] callbackUrl missing from host props");
     }
     setConfig({
-      ...mergedTenantCode ? { tenantCode: mergedTenantCode } : {},
+      ...mergedTenantCode ? { tenantCode: mergedTenantCode, tenantKey: mergedTenantCode } : {},
       ...mergedApiBaseUrl ? { apiBaseUrl: mergedApiBaseUrl } : {},
       ...mergedAuthServerUrl ? { authServerUrl: mergedAuthServerUrl } : {},
       ...mergedCallbackUrl ? { callbackUrl: mergedCallbackUrl } : {}
     });
+    logConfigResolutionDebug("AuthProvider host props applied");
     return () => {
       clearConfigOverrides();
     };
   }, [mergedTenantCode, mergedApiBaseUrl, mergedAuthServerUrl, mergedCallbackUrl]);
   react.useEffect(() => {
     try {
-      const hostConfigKey = getStorageKey("host_config");
-      const raw = getStorage(hostConfigKey);
-      const existing = raw ? JSON.parse(raw) : {};
-      const payload = {
-        ...existing,
+      writeHostConfigCache({
         tenantCode: mergedTenantCode ?? "",
         tenantKey: mergedTenantCode ?? "",
         appId: appId ?? "",
         apiBaseUrl: mergedApiBaseUrl ?? "",
         authServerUrl: mergedAuthServerUrl ?? "",
         callbackUrl: mergedCallbackUrl ?? ""
-      };
-      setStorage(hostConfigKey, JSON.stringify(payload));
+      });
     } catch {
     }
-  }, [mergedTenantCode, mergedApiBaseUrl, mergedAuthServerUrl, mergedCallbackUrl]);
+  }, [mergedTenantCode, mergedApiBaseUrl, mergedAuthServerUrl, mergedCallbackUrl, appId]);
   react.useLayoutEffect(() => {
     setStorageKeyPrefix(resolvedTenantKey ?? "");
     const adapter = storageAdapter !== void 0 && storageAdapter !== null ? storageAdapter : createSecureSessionStorageAdapter(namespace);
@@ -2839,14 +3106,14 @@ function AuthProvider({
         logger.debug("[AuthProvider] TenantKey unchanged", { tenantKey: resolvedTenantKey2 });
       }
       try {
-        const hostConfigKey = getStorageKey("host_config");
-        const raw = getStorage(hostConfigKey);
-        const existing = raw ? JSON.parse(raw) : {};
-        setStorage(hostConfigKey, JSON.stringify({
-          ...existing,
+        writeHostConfigCache({
           tenantKey: resolvedTenantKey2,
           tenantCode: resolvedTenantKey2
-        }));
+        });
+        logConfigResolutionDebug("AuthProvider tenant key synced to cache", {
+          tenantCode: resolvedTenantKey2,
+          tenantKey: resolvedTenantKey2
+        });
       } catch {
       }
       setStorage(getStorageKey("tenant_key"), resolvedTenantKey2);
@@ -3251,6 +3518,7 @@ function useAuthInit() {
 }
 
 exports.AuthCallback = AuthCallback;
+exports.AuthConfigError = AuthConfigError;
 exports.AuthEventNames = AuthEventNames;
 exports.AuthProvider = AuthProvider;
 exports.Config = Config;
@@ -3259,6 +3527,8 @@ exports.ProtectedRoute = ProtectedRoute;
 exports.STORAGE_KEYS = STORAGE_KEYS2;
 exports.STORAGE_KEY_PREFIX = STORAGE_KEY_PREFIX;
 exports.SanitizedError = SanitizedError;
+exports.applyRuntimeTenantSwitch = applyRuntimeTenantSwitch;
+exports.areWatchersSuspended = areWatchersSuspended;
 exports.bootstrap = bootstrap;
 exports.buildStorageKey = buildStorageKey;
 exports.createAuthEngine = createAuthEngine;
@@ -3271,28 +3541,41 @@ exports.enforceHttps = enforceHttps;
 exports.ensureValidAccessToken = ensureValidAccessToken;
 exports.extractTenantKey = extractTenantKey;
 exports.getAccessToken = getAccessToken2;
-exports.getAuthConfig = getAuthConfig;
+exports.getAuthConfig = getAuthConfig2;
 exports.getAuthRuntime = getAuthRuntime;
 exports.getConfig = getConfig;
+exports.getConfigFieldSources = getConfigFieldSources;
+exports.getEffectiveTenantCode = getEffectiveTenantCode;
+exports.getEffectiveTenantKey = getEffectiveTenantKey;
 exports.getStorageAdapter = getStorageAdapter;
 exports.getStorageNamespace = getStorageNamespace;
 exports.getStoredAccessToken = getAccessToken;
+exports.initPlugin = initPlugin;
 exports.isAccessTokenExpired = isAccessTokenExpired;
 exports.isCallbackUrl = isCallbackUrl;
+exports.logConfigResolutionDebug = logConfigResolutionDebug;
 exports.logout = logout;
 exports.refreshAccessToken = refreshAccessToken;
+exports.requireAuthConfig = requireAuthConfig;
 exports.resetCookieWatcher = resetCookieWatcher;
 exports.resolveConfig = resolveConfig;
 exports.resolveTenant = resolveTenant;
+exports.resumeWatchers = resumeWatchers;
 exports.sanitizeErrorMessage = sanitizeErrorMessage;
 exports.setAuthRuntime = setAuthRuntime;
 exports.setConfig = setConfig;
+exports.setHostConfigProvider = setHostConfigProvider;
 exports.setStorageContext = setStorageContext;
 exports.startCookieWatcher = startCookieWatcher;
+exports.startStorageWatcher = startStorageWatcher;
 exports.stopCookieWatcher = stopCookieWatcher;
+exports.stopStorageWatcher = stopStorageWatcher;
 exports.subscribeAuthEvent = subscribeAuthEvent;
+exports.suspendWatchers = suspendWatchers;
+exports.syncHostConfigCacheFromMemory = syncHostConfigCacheFromMemory;
 exports.useAuth = useAuth;
 exports.useAuthContext = useAuthContext;
 exports.useAuthInit = useAuthInit;
+exports.writeHostConfigCache = writeHostConfigCache;
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map