tenneo-auth-plugin 1.0.2 → 1.0.4

package/dist/index.mjs

@@ -367,35 +367,7 @@ function createCookieStorageAdapter(namespace, options) {
   };
 }
 
-// src/infrastructure/storage/api.ts
-var KEY_SUFFIXES = {
-  tenantKey: "tenant_key",
-  codeVerifier: "code_verifier",
-  state: "state",
-  accessToken: "access_token",
-  refreshToken: "refresh_token",
-  expiresAt: "expires_at"
-};
-var STORAGE_KEYS = {
-  get tenantKey() {
-    return getStorageKey(KEY_SUFFIXES.tenantKey);
-  },
-  get codeVerifier() {
-    return getStorageKey(KEY_SUFFIXES.codeVerifier);
-  },
-  get state() {
-    return getStorageKey(KEY_SUFFIXES.state);
-  },
-  get accessToken() {
-    return getStorageKey(KEY_SUFFIXES.accessToken);
-  },
-  get refreshToken() {
-    return getStorageKey(KEY_SUFFIXES.refreshToken);
-  },
-  get expiresAt() {
-    return getStorageKey(KEY_SUFFIXES.expiresAt);
-  }
-};
+// src/infrastructure/storage/kv.ts
 function keyToSuffix(key) {
   const prefix = getStorageKeyPrefix();
   return key.startsWith(prefix) ? key.slice(prefix.length) : key;
@@ -431,6 +403,36 @@ function removeStorage(key) {
   } catch {
   }
 }
+
+// src/infrastructure/storage/api.ts
+var KEY_SUFFIXES = {
+  tenantKey: "tenant_key",
+  codeVerifier: "code_verifier",
+  state: "state",
+  accessToken: "access_token",
+  refreshToken: "refresh_token",
+  expiresAt: "expires_at"
+};
+var STORAGE_KEYS = {
+  get tenantKey() {
+    return getStorageKey(KEY_SUFFIXES.tenantKey);
+  },
+  get codeVerifier() {
+    return getStorageKey(KEY_SUFFIXES.codeVerifier);
+  },
+  get state() {
+    return getStorageKey(KEY_SUFFIXES.state);
+  },
+  get accessToken() {
+    return getStorageKey(KEY_SUFFIXES.accessToken);
+  },
+  get refreshToken() {
+    return getStorageKey(KEY_SUFFIXES.refreshToken);
+  },
+  get expiresAt() {
+    return getStorageKey(KEY_SUFFIXES.expiresAt);
+  }
+};
 function clearAuthStorage() {
   const keysToClear = [
     STORAGE_KEYS.accessToken,
@@ -493,28 +495,6 @@ function isAccessTokenExpired() {
   const buffer = 60 * 1e3;
   return Date.now() >= expiresAt - buffer;
 }
-function readHostConfig() {
-  try {
-    const raw = getStorage(getStorageKey("host_config"));
-    if (!raw) return {};
-    const parsed = JSON.parse(raw);
-    return parsed && typeof parsed === "object" ? parsed : {};
-  } catch {
-    return {};
-  }
-}
-function getClientId() {
-  const value = readHostConfig().clientId;
-  return typeof value === "string" && value.trim() ? value : null;
-}
-function getRedirectUri() {
-  const value = readHostConfig().redirectUri;
-  return typeof value === "string" && value.trim() ? value : null;
-}
-function getTenantId() {
-  const value = readHostConfig().tenantId;
-  return typeof value === "string" && value.trim() ? value : null;
-}
 function getCodeVerifier() {
   return getStorage(STORAGE_KEYS.codeVerifier);
 }
@@ -575,6 +555,252 @@ var Logger = class {
 };
 var logger = new Logger();
 
+// src/config/resolver-core.ts
+var inMemoryConfig = {};
+var hostConfigProvider = null;
+var CACHE_MARKER = "__tenneo_host_config_cache";
+var CACHE_AT = "__tenneo_host_config_cache_at";
+function setConfig(overrides) {
+  inMemoryConfig = { ...inMemoryConfig, ...overrides };
+}
+function clearConfigOverrides() {
+  inMemoryConfig = {};
+}
+function setHostConfigProvider(fn) {
+  hostConfigProvider = fn;
+}
+function readHostBridge() {
+  const out = {};
+  try {
+    if (typeof window !== "undefined" && window.__TENNEO_AUTH_HOST__) {
+      Object.assign(out, window.__TENNEO_AUTH_HOST__);
+    }
+  } catch {
+  }
+  try {
+    const fromProvider = hostConfigProvider?.();
+    if (fromProvider && typeof fromProvider === "object") {
+      Object.assign(out, fromProvider);
+    }
+  } catch (e) {
+    logger.warn("[config] hostConfigProvider threw", {
+      error: e instanceof Error ? e.message : String(e)
+    });
+  }
+  return out;
+}
+function readStorageConfigCache() {
+  try {
+    const raw = getStorage(getStorageKey("host_config"));
+    if (!raw) return {};
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== "object") return {};
+    const { [CACHE_MARKER]: _m, [CACHE_AT]: _t, ...rest } = parsed;
+    if (!rest.clientId && typeof rest.client_id === "string" && rest.client_id.trim()) {
+      rest.clientId = rest.client_id.trim();
+    }
+    return rest;
+  } catch {
+    return {};
+  }
+}
+function resolveSDKConfig(overrides) {
+  const stored = readStorageConfigCache();
+  const bridge = readHostBridge();
+  return {
+    ...stored,
+    ...bridge,
+    ...inMemoryConfig,
+    ...overrides ?? {}
+  };
+}
+function nonEmptyString(v) {
+  if (v == null) return void 0;
+  const s = String(v).trim();
+  return s || void 0;
+}
+function getConfigFieldSources(overrides) {
+  const stored = readStorageConfigCache();
+  const bridge = readHostBridge();
+  const layers = [
+    { src: "storage_cache", cfg: stored },
+    { src: "host_bridge", cfg: bridge },
+    { src: "memory", cfg: inMemoryConfig }
+  ];
+  if (overrides && Object.keys(overrides).length) {
+    layers.push({ src: "override", cfg: overrides });
+  }
+  const pick = (key) => {
+    for (let i = layers.length - 1; i >= 0; i--) {
+      const v = nonEmptyString(layers[i].cfg[key]);
+      if (v !== void 0) return layers[i].src;
+    }
+    return void 0;
+  };
+  return {
+    tenantCode: pick("tenantCode") ?? pick("tenantKey"),
+    tenantKey: pick("tenantKey") ?? pick("tenantCode"),
+    apiBaseUrl: pick("apiBaseUrl"),
+    authServerUrl: pick("authServerUrl"),
+    callbackUrl: pick("callbackUrl"),
+    clientCode: pick("clientCode"),
+    clientId: pick("clientId"),
+    tenantId: pick("tenantId"),
+    appId: pick("appId")
+  };
+}
+function getEffectiveTenantCode(overrides) {
+  const cfg = resolveSDKConfig(overrides);
+  const t = nonEmptyString(cfg.tenantCode) ?? nonEmptyString(cfg.tenantKey) ?? nonEmptyString(cfg.clientCode) ?? "";
+  return t;
+}
+var getEffectiveTenantKey = getEffectiveTenantCode;
+function trim(v) {
+  return v == null ? "" : String(v).trim();
+}
+function toResolvedConfig(cfg) {
+  const merged = { ...cfg };
+  if (!merged.tenantCode && merged.tenantKey) {
+    merged.tenantCode = merged.tenantKey;
+  }
+  const clientId = trim(merged.clientId) || trim(merged.clientCode);
+  return {
+    apiBaseUrl: trim(merged.apiBaseUrl),
+    authServerUrl: trim(merged.authServerUrl),
+    callbackUrl: trim(merged.callbackUrl) || trim(merged.redirectUri),
+    clientCode: trim(merged.clientCode),
+    tenantCode: trim(merged.tenantCode),
+    appId: trim(merged.appId),
+    clientId,
+    tenantId: trim(merged.tenantId)
+  };
+}
+var AuthConfigError = class extends Error {
+  constructor(missing, message) {
+    super(
+      message ?? `[tenneo-auth] Missing required auth configuration: ${missing.join(", ")}. Provide authServerUrl, callbackUrl (redirectUri), and tenant_key/tenant_code via AuthProvider/initPlugin or window.__TENNEO_AUTH_HOST__.`
+    );
+    this.code = "AUTH_CONFIG_MISSING";
+    this.name = "AuthConfigError";
+    this.missing = missing;
+  }
+};
+function resolveConfig(overrides) {
+  return toResolvedConfig(resolveSDKConfig(overrides));
+}
+function getAuthConfig(options) {
+  const resolved = toResolvedConfig(resolveSDKConfig(options?.overrides));
+  if (options?.strict) {
+    const missing = [];
+    if (!resolved.authServerUrl) missing.push("authServerUrl");
+    if (!resolved.callbackUrl) missing.push("callbackUrl");
+    if (!resolved.tenantCode) missing.push("tenantCode|tenantKey");
+    if (missing.length) throw new AuthConfigError(missing);
+  }
+  return resolved;
+}
+function syncHostConfigCacheFromMemory() {
+  const c = resolveSDKConfig();
+  const patch = {};
+  const keys = [
+    "apiBaseUrl",
+    "authServerUrl",
+    "callbackUrl",
+    "redirectUri",
+    "tenantCode",
+    "tenantKey",
+    "clientCode",
+    "clientId",
+    "tenantId",
+    "appId",
+    "basePath"
+  ];
+  for (const k of keys) {
+    const v = c[k];
+    if (v != null && String(v).trim()) {
+      patch[k] = String(v).trim();
+    }
+  }
+  if (Object.keys(patch).length) writeHostConfigCache(patch);
+}
+function writeHostConfigCache(partial) {
+  try {
+    const key = getStorageKey("host_config");
+    const raw = getStorage(key);
+    let existing = {};
+    try {
+      if (raw) existing = JSON.parse(raw);
+    } catch {
+      existing = {};
+    }
+    const next = {
+      ...existing,
+      ...partial,
+      [CACHE_MARKER]: true,
+      [CACHE_AT]: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    setStorage(key, JSON.stringify(next));
+    logger.debug("[config] host_config cache updated (non-authoritative)", {
+      keys: Object.keys(partial)
+    });
+  } catch (e) {
+    logger.warn("[config] Failed to write host_config cache", {
+      error: e instanceof Error ? e.message : String(e)
+    });
+  }
+}
+function initPlugin(config, opts) {
+  setConfig(config);
+  logger.info("[config] initPlugin \u2014 runtime config updated", {
+    syncStorageCache: opts?.syncStorageCache !== false,
+    tenantCode: config.tenantCode ?? config.tenantKey ?? "(none)"
+  });
+  if (opts?.syncStorageCache !== false) {
+    writeHostConfigCache(config);
+  }
+}
+function logConfigResolutionDebug(context, overrides) {
+  const sources = getConfigFieldSources(overrides);
+  logger.debug(`[config] ${context}`, {
+    fieldSources: sources,
+    effectiveTenantCode: getEffectiveTenantCode(overrides) || "(empty)",
+    hasAuthServerUrl: !!resolveSDKConfig(overrides).authServerUrl,
+    hasCallbackUrl: !!resolveSDKConfig(overrides).callbackUrl
+  });
+}
+
+// src/config/host-fields.ts
+function trim2(v) {
+  if (v == null) return null;
+  const s = String(v).trim();
+  return s || null;
+}
+function oauthClientIdForTokenRequest(raw) {
+  if (!raw) return null;
+  let s = raw.trim();
+  if (!s) return null;
+  if (s.toLowerCase().startsWith("public-")) {
+    s = s.slice("public-".length).trim();
+  }
+  return s || null;
+}
+function getClientId() {
+  const c = resolveSDKConfig();
+  const fromId = oauthClientIdForTokenRequest(trim2(c.clientId));
+  if (fromId) return fromId;
+  return oauthClientIdForTokenRequest(trim2(c.clientCode));
+}
+function normalizeClientIdForOAuthTokenBody(raw) {
+  return oauthClientIdForTokenRequest(trim2(raw));
+}
+function getRedirectUri() {
+  const c = resolveSDKConfig();
+  return trim2(c.callbackUrl) ?? trim2(c.redirectUri);
+}
+function getTenantId() {
+  return trim2(resolveSDKConfig().tenantId);
+}
+
 // src/domain/errors.ts
 function isLocalhostHostname(hostname) {
   return hostname === "localhost" || hostname === "127.0.0.1" || hostname.startsWith("192.168.") || hostname.startsWith("10.") || hostname.startsWith("172.16.");
@@ -773,71 +999,47 @@ var DEFAULT_TOKEN_GRANT_TYPE = OAUTH_CONSTANTS.TOKEN_GRANT_TYPE;
 var DEFAULT_REFRESH_GRANT_TYPE = OAUTH_CONSTANTS.REFRESH_GRANT_TYPE;
 
 // src/config/index.ts
-var inMemoryConfig = {};
-function readHostConfigFromStorage() {
-  try {
-    const raw = getStorage(getStorageKey("host_config"));
-    if (!raw) return {};
-    const parsed = JSON.parse(raw);
-    return parsed && typeof parsed === "object" ? parsed : {};
-  } catch {
-    return {};
-  }
-}
-function resolveMerged(overrides) {
-  const stored = readHostConfigFromStorage();
-  const cfg = { ...stored, ...inMemoryConfig, ...overrides ?? {} };
-  if (!cfg.tenantCode && cfg.tenantKey) {
-    cfg.tenantCode = cfg.tenantKey;
-  }
-  const trimmed = (v) => v == null ? "" : String(v).trim();
-  return {
-    apiBaseUrl: trimmed(cfg.apiBaseUrl),
-    authServerUrl: trimmed(cfg.authServerUrl),
-    callbackUrl: trimmed(cfg.callbackUrl),
-    clientCode: trimmed(cfg.clientCode),
-    tenantCode: trimmed(cfg.tenantCode),
-    appId: trimmed(cfg.appId)
-  };
+function getAuthConfig2(options) {
+  return getAuthConfig(options);
 }
-function resolveConfig(overrides) {
-  return resolveMerged(overrides);
+function requireAuthConfig(overrides) {
+  return getAuthConfig({ strict: true, overrides });
 }
 function getConfig() {
-  return resolveMerged();
-}
-function getAuthConfig() {
-  return resolveMerged();
-}
-function setConfig(overrides) {
-  inMemoryConfig = { ...inMemoryConfig, ...overrides };
-}
-function clearConfigOverrides() {
-  inMemoryConfig = {};
+  return resolveConfig();
 }
 function getRedirectUri2() {
-  const cfg = resolveMerged();
+  const cfg = resolveConfig();
   if (cfg.callbackUrl) return cfg.callbackUrl;
   if (typeof window !== "undefined") return `${window.location.origin}/callback`;
   return "";
 }
 var Config = {
   getApiBaseUrl() {
-    return resolveMerged().apiBaseUrl;
+    return resolveConfig().apiBaseUrl;
   },
   getAuthServerUrl() {
-    return resolveMerged().authServerUrl;
+    return resolveConfig().authServerUrl;
   },
   getClientCode() {
-    return resolveMerged().clientCode;
+    return resolveConfig().clientCode;
   },
   getRedirectUri() {
     return getRedirectUri2();
   },
   getAll() {
-    return resolveMerged();
+    return resolveConfig();
   }
 };
+function applyRuntimeTenantSwitch(tenantKey, opts) {
+  const t = tenantKey.trim();
+  if (!t) return;
+  setConfig({ tenantCode: t, tenantKey: t });
+  logConfigResolutionDebug("applyRuntimeTenantSwitch", { tenantCode: t, tenantKey: t });
+  if (opts?.syncStorageCache !== false) {
+    writeHostConfigCache({ tenantCode: t, tenantKey: t });
+  }
+}
 
 // src/infrastructure/tenant/TenantConfigCache.ts
 var DEFAULT_TTL_MS = 5 * 60 * 1e3;
@@ -913,16 +1115,6 @@ function consumePropsConfig() {
     removeStorage(propsConfigKey);
   }
 }
-function readHostConfig2() {
-  try {
-    const raw = getStorage(getStorageKey("host_config"));
-    if (!raw) return null;
-    const parsed = JSON.parse(raw);
-    return parsed && typeof parsed === "object" ? parsed : null;
-  } catch {
-    return null;
-  }
-}
 function validateTenantKey(value) {
   if (typeof value !== "string") return null;
   const trimmed = value.trim();
@@ -931,17 +1123,16 @@ function validateTenantKey(value) {
 function resolveTenantKey() {
   const propsConfig = consumePropsConfig();
   const tenantFromProps = validateTenantKey(propsConfig?.tenantKey);
-  if (tenantFromProps) return tenantFromProps;
-  const hostConfig = readHostConfig2();
-  if (!hostConfig) {
-    logger.warn("Missing host_config while resolving tenant");
-    return null;
+  if (tenantFromProps) {
+    logger.debug("[tenant] Resolved tenant from props_config", { tenantKey: tenantFromProps });
+    return tenantFromProps;
   }
-  const tenantFromHost = validateTenantKey(hostConfig?.tenantKey);
-  if (tenantFromHost) return tenantFromHost;
-  if (hostConfig.tenantKey != null) {
-    logger.warn("Invalid tenant key in host_config", { tenantKey: hostConfig.tenantKey });
+  const fromHost = validateTenantKey(getEffectiveTenantCode());
+  if (fromHost) {
+    logger.debug("[tenant] Resolved tenant from host/runtime config", { tenantKey: fromHost });
+    return fromHost;
   }
+  logger.warn("[tenant] Unable to resolve tenant key (props + host/runtime empty)");
   return null;
 }
 async function resolveTenantConfig(tenantKey, tenantResolver) {
@@ -1074,7 +1265,7 @@ async function refreshAccessToken() {
         });
         throw new Error("Cannot refresh token: missing required data");
       }
-      const apiAuthBaseUrl = Config.getApiBaseUrl();
+      const apiAuthBaseUrl = Config.getAuthServerUrl();
       const tokenUrl = `${apiAuthBaseUrl}/oauth/refresh`;
       const body = new URLSearchParams({
         grant_type: DEFAULT_REFRESH_GRANT_TYPE,
@@ -1133,6 +1324,56 @@ async function refreshAccessToken() {
   return refreshPromise;
 }
 
+// src/strategies/oauth2-pkce/pkce.ts
+function generateCodeVerifier(length = 128) {
+  const array = new Uint8Array(length);
+  crypto.getRandomValues(array);
+  const base64 = btoa(String.fromCharCode(...array));
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+async function generateCodeChallenge(verifier) {
+  try {
+    const encoder = new TextEncoder();
+    const data = encoder.encode(verifier);
+    const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+    const hashArray = Array.from(new Uint8Array(hashBuffer));
+    const base64 = btoa(String.fromCharCode(...hashArray));
+    return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+  } catch {
+    throw new Error("Failed to generate code challenge");
+  }
+}
+function generateState() {
+  const array = new Uint8Array(32);
+  crypto.getRandomValues(array);
+  const base64 = btoa(String.fromCharCode(...array));
+  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+
+// src/utils/validation.ts
+function isValidGuid(guid) {
+  if (!guid || typeof guid !== "string") {
+    return false;
+  }
+  const guidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+  return guidRegex.test(guid.trim());
+}
+function validateTenantId(tenantId) {
+  if (!tenantId || tenantId.trim() === "") {
+    return {
+      isValid: false,
+      error: "Tenant ID is required"
+    };
+  }
+  if (!isValidGuid(tenantId)) {
+    return {
+      isValid: false,
+      error: "Tenant ID must be a valid GUID format (00000000-0000-0000-0000-000000000001)"
+    };
+  }
+  return { isValid: true };
+}
+
 // src/application/security/redirectLoopGuard.ts
 var DEFAULT_MAX_REDIRECTS = 5;
 var WINDOW_MS = 60 * 1e3;
@@ -1157,18 +1398,166 @@ function checkAndIncrementRedirect(maxAttempts = DEFAULT_MAX_REDIRECTS) {
   redirectCount++;
   return true;
 }
-function isProcessed() {
-  return getStorage(getStorageKey("callback_processed")) === "true";
-}
-function isProcessing() {
-  return isCallbackProcessing();
-}
-function markProcessing() {
-  setCallbackProcessing();
-}
-function markProcessed() {
-  setStorage(getStorageKey("callback_processed"), "true");
-  clearCallbackProcessing();
+
+// src/strategies/oauth2-pkce/oauth.ts
+function storeTenantConfig(config) {
+  const validation = validateTenantId(config.tenantId);
+  if (!validation.isValid) {
+    logger.warn("Tenant ID validation failed", { tenantId: config.tenantId });
+  }
+  const authServerToStore = Config.getAuthServerUrl() || config.authServer;
+  const redirectUriToStore = Config.getRedirectUri();
+  writeHostConfigCache({
+    authServerUrl: authServerToStore,
+    clientId: config.client.clientId,
+    clientCode: config.client.clientCode ?? config.client.clientId,
+    redirectUri: redirectUriToStore,
+    callbackUrl: redirectUriToStore,
+    tenantId: config.tenantId,
+    tenantKey: config.tenantKey ?? "",
+    tenantCode: config.tenantKey ?? ""
+  });
+  if (config.tenantKey) {
+    setStorage(STORAGE_KEYS.tenantKey, config.tenantKey);
+  }
+}
+async function initiateAuthFlow(config) {
+  try {
+    logger.info("Initiating OAuth authorization flow");
+    const authServerFromProps = Config.getAuthServerUrl();
+    const authServerEffective = (authServerFromProps || config?.authServer || "").replace(/\/+$/, "");
+    const redirectUriEffective = Config.getRedirectUri();
+    const tenantIdEffective = config?.tenantId || "";
+    const clientIdEffective = config?.client?.clientId || "";
+    logger.debug("[initiateAuthFlow] Resolved inputs", {
+      authServerFromProps: authServerFromProps ? "(provided)" : "(empty)",
+      authServerEffective,
+      redirectUriEffective,
+      tenantIdEffective,
+      clientIdEffective,
+      scopes: config?.client?.scopes,
+      hasRuntime: !!getAuthRuntime()
+    });
+    logger.info("[initiateAuthFlow] authServerUrl for OAuth", {
+      authServerFromProps: authServerFromProps || null,
+      authServerEffective,
+      redirectUriEffective,
+      tenantId: tenantIdEffective,
+      tenantKey: config.tenantKey ?? null,
+      clientIdEffective
+    });
+    const token = getAccessToken();
+    if (token && !isAccessTokenExpired()) {
+      logger.debug("Valid token already exists, skipping auth flow");
+      clearFlowFlags();
+      return;
+    }
+    if (isCallbackUrl()) {
+      logger.debug("Callback URL detected - clearing flow flag to allow callback processing");
+      clearFlowFlags();
+      return;
+    }
+    if (isFlowInProgress()) {
+      if (isFlowFlagStale(3e3)) {
+        logger.info("Stale auth flow flag detected, clearing and proceeding");
+        clearFlowFlags();
+      } else {
+        logger.debug("Auth flow already in progress (recent), skipping duplicate redirect");
+        return;
+      }
+    }
+    setFlowFlags();
+    if (!(Config.getAuthServerUrl() || config?.authServer) || !config.client?.clientId || !config.client?.redirectUri) {
+      logger.error("[initiateAuthFlow] Missing required tenant config", {
+        authServerEffective,
+        clientId: config?.client?.clientId,
+        redirectUriFromTenantApi: config?.client?.redirectUri,
+        redirectUriEffective
+      });
+      throw new Error("Invalid tenant configuration for auth flow");
+    }
+    storeTenantConfig(config);
+    logger.debug("[initiateAuthFlow] Stored tenant config, generating PKCE");
+    removeStorage(getStorageKey("callback_processed"));
+    removeStorage(getStorageKey("state_mismatch"));
+    clearCallbackProcessing();
+    const codeVerifier = generateCodeVerifier();
+    const codeChallenge = await generateCodeChallenge(codeVerifier);
+    const state = generateState();
+    removeStorage(STORAGE_KEYS.codeVerifier);
+    removeStorage(STORAGE_KEYS.state);
+    setStorage(STORAGE_KEYS.codeVerifier, codeVerifier);
+    setStorage(STORAGE_KEYS.state, state);
+    const authUrl = buildAuthorizationUrl(config, codeChallenge, state);
+    logger.debug("[initiateAuthFlow] Built authorization URL", {
+      authServerEffective,
+      urlPrefix: authUrl?.slice(0, 80)
+    });
+    if (!authUrl || !(authUrl.startsWith("http://") || authUrl.startsWith("https://"))) {
+      throw new Error("Invalid authorization URL generated");
+    }
+    if (!checkAndIncrementRedirect()) {
+      logger.warn("Redirect loop protection: max redirect attempts exceeded");
+      clearFlowFlags();
+      return;
+    }
+    logger.info("Redirecting to authorization server");
+    emitAuthEvent(AuthEventNames.LOGIN_STARTED, { tenantKey: config.tenantKey });
+    const runtime = getAuthRuntime();
+    if (runtime) {
+      logger.debug("[initiateAuthFlow] Redirect via runtime.urlProvider.redirect");
+      runtime.urlProvider.redirect(authUrl);
+    } else if (typeof window !== "undefined") {
+      logger.debug("[initiateAuthFlow] Redirect via window.location.replace");
+      window.location.replace(authUrl);
+    } else {
+      logger.error("[initiateAuthFlow] No runtime and no window; cannot redirect", { authUrl });
+    }
+  } catch (error) {
+    clearFlowFlags();
+    logger.error("Failed to initiate auth flow", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+    throw error;
+  }
+}
+function buildAuthorizationUrl(config, codeChallenge, state) {
+  const authServerBase = (Config.getAuthServerUrl() || config.authServer || "").replace(/\/+$/, "");
+  if (isLocalhost2()) {
+    logger.debug("Building authorization URL", {
+      authServer: authServerBase,
+      clientId: config.client.clientId,
+      redirectUri: config.client.redirectUri,
+      scopes: config.client.scopes
+    });
+  }
+  const tenantIdToUse = config.tenantId;
+  const clientIdToUse = config.client.clientId;
+  const redirectUriToUse = Config.getRedirectUri();
+  const params = new URLSearchParams({
+    client_id: `public-${clientIdToUse}`,
+    tenant_id: tenantIdToUse,
+    redirect_uri: redirectUriToUse,
+    response_type: DEFAULT_RESPONSE_TYPE,
+    scope: config.client.scopes,
+    state,
+    code_challenge: codeChallenge,
+    code_challenge_method: DEFAULT_CODE_CHALLENGE_METHOD
+  });
+  return `${authServerBase}/connect/authorize?${params.toString()}`;
+}
+function isProcessed() {
+  return getStorage(getStorageKey("callback_processed")) === "true";
+}
+function isProcessing() {
+  return isCallbackProcessing();
+}
+function markProcessing() {
+  setCallbackProcessing();
+}
+function markProcessed() {
+  setStorage(getStorageKey("callback_processed"), "true");
+  clearCallbackProcessing();
 }
 function clearProcessing() {
   clearCallbackProcessing();
@@ -1187,6 +1576,38 @@ function cleanUrlSoft() {
 function clearAllAuthFlags() {
   clearFlowFlags();
 }
+async function tryRecoverOAuthConfigFromTenant() {
+  const runtime = getAuthRuntime();
+  const tenantKey = (resolveTenantKey() ?? getTenantKey() ?? "").trim();
+  if (!runtime?.tenantResolver || !tenantKey) {
+    logger.debug("[Callback] OAuth config recovery skipped \u2014 no tenantResolver or tenantKey", {
+      hasResolver: !!runtime?.tenantResolver,
+      tenantKey: tenantKey || "(empty)"
+    });
+    return null;
+  }
+  try {
+    const tc = await runtime.tenantResolver.resolve(tenantKey);
+    if (!tc?.client?.clientId || !tc.tenantId) {
+      logger.warn("[Callback] OAuth config recovery: tenant resolve missing client or tenantId", {
+        tenantKey
+      });
+      return null;
+    }
+    storeTenantConfig(tc);
+    return {
+      clientId: tc.client.clientId.trim() || null,
+      redirectUri: tc.client.redirectUri?.trim() || getRedirectUri(),
+      tenantId: tc.tenantId.trim() || null
+    };
+  } catch (e) {
+    logger.warn("[Callback] OAuth config recovery: tenant re-resolve failed", {
+      tenantKey,
+      error: e instanceof Error ? e.message : String(e)
+    });
+    return null;
+  }
+}
 async function handleCallback() {
   const runtimeSearch = getAuthRuntime()?.urlProvider.getCurrentUrl().search;
   const windowSearch = typeof window !== "undefined" ? window.location.search : "";
@@ -1269,9 +1690,22 @@ async function handleCallback() {
       cleanUrlSoft();
       return false;
     }
-    const clientId = getClientId();
-    const redirectUri = getRedirectUri();
-    const tenantId = getTenantId();
+    let clientId = getClientId();
+    let redirectUri = getRedirectUri();
+    let tenantId = getTenantId();
+    if (!clientId || !redirectUri || !tenantId) {
+      logger.warn("[Callback] OAuth config incomplete \u2014 attempting tenant re-resolve", {
+        hasClientId: !!clientId,
+        hasRedirectUri: !!redirectUri,
+        hasTenantId: !!tenantId
+      });
+      const recovered = await tryRecoverOAuthConfigFromTenant();
+      if (recovered) {
+        if (!redirectUri) redirectUri = recovered.redirectUri;
+        if (!tenantId) tenantId = recovered.tenantId;
+        clientId = getClientId() ?? normalizeClientIdForOAuthTokenBody(recovered.clientId) ?? null;
+      }
+    }
     if (!clientId || !redirectUri || !tenantId) {
       logger.error("[Callback] Early exit: missing OAuth config during callback", {
         hasClientId: !!clientId,
@@ -1329,320 +1763,120 @@ async function handleCallback() {
       if (status === 400 && errorCode === "invalid_grant" && (String(errorDescription).includes("already used") || String(errorDescription).includes("Code not found") || String(errorDescription).includes("expired, already used"))) {
         const existingToken2 = getAccessToken();
         const tokenValid2 = existingToken2 && !isAccessTokenExpired();
-        if (tokenValid2) {
-          removeStorage(STORAGE_KEYS.codeVerifier);
-          removeStorage(STORAGE_KEYS.state);
-          clearAllAuthFlags();
-          markProcessed();
-          cleanUrlSoft();
-          logger.info("OAuth callback processed successfully (code already used, but token exists)");
-          resetRedirectLoopGuard();
-          emitAuthEvent(AuthEventNames.CALLBACK_SUCCESS);
-          return true;
-        }
-      }
-      emitAuthEvent(AuthEventNames.CALLBACK_FAILED, {
-        error: err.message,
-        message: responseData?.error_description ?? err.message
-      });
-      logger.error("OAuth callback failed (Axios error)", {
-        status,
-        statusText: err.response?.statusText,
-        responseData: err.response?.data,
-        message: err.message,
-        url: err.config?.url
-      });
-    } else {
-      logger.error("OAuth callback failed", {
-        error: err instanceof Error ? err.message : String(err)
-      });
-    }
-    clearAllAuthFlags();
-    const existingToken = getAccessToken();
-    const tokenValid = existingToken && !isAccessTokenExpired();
-    if (tokenValid) {
-      markProcessed();
-      cleanUrlSoft();
-      resetRedirectLoopGuard();
-      emitAuthEvent(AuthEventNames.CALLBACK_SUCCESS);
-      return true;
-    }
-    emitAuthEvent(AuthEventNames.CALLBACK_FAILED, {
-      error: err instanceof Error ? err.message : String(err)
-    });
-    clearProcessing();
-    if (isCallbackUrl()) cleanUrlSoft();
-    return false;
-  }
-}
-
-// src/application/flows/CallbackFlow.ts
-var CallbackFlow = class {
-  async execute(context) {
-    const { runtime } = context;
-    const { urlProvider, logger: log } = runtime;
-    const getUrl = () => urlProvider.getCurrentUrl();
-    clearFlowFlags();
-    const handled = await handleCallback();
-    if (handled) {
-      if (isCallbackUrlFromUrl(getUrl())) {
-        if (isCallbackProcessing()) return { completed: true };
-        const u = getUrl();
-        urlProvider.redirect(`${u.origin}${u.pathname}`);
-        return { completed: true };
-      }
-      return { completed: true };
-    }
-    if (isCallbackUrlFromUrl(getUrl())) {
-      const u = getUrl();
-      urlProvider.redirect(`${u.origin}${u.pathname}`);
-    }
-    return { completed: true };
-  }
-};
-
-// src/application/flows/AuthenticatedFlow.ts
-var AuthenticatedFlow = class {
-  async execute(_context) {
-    return { completed: true };
-  }
-};
-
-// src/application/engine/defaultEngine.ts
-var defaultEngine = null;
-function getDefaultAuthEngine() {
-  return defaultEngine;
-}
-function setDefaultAuthEngine(engine) {
-  defaultEngine = engine;
-}
-
-// src/application/token.ts
-var lastNoRefreshLog = 0;
-var NO_REFRESH_LOG_INTERVAL_MS = 5e3;
-async function ensureValidAccessToken() {
-  const engine = getDefaultAuthEngine();
-  if (engine) {
-    try {
-      return await engine.getAccessToken();
-    } catch {
-    }
-  }
-  const token = getAccessToken();
-  if (token && !isAccessTokenExpired()) return token;
-  const refreshToken = getRefreshToken();
-  if (!refreshToken) {
-    const now = Date.now();
-    if (now - lastNoRefreshLog >= NO_REFRESH_LOG_INTERVAL_MS) {
-      lastNoRefreshLog = now;
-      logger.debug("No refresh token - cannot refresh; login required");
-    }
-    throw new Error("No refresh token; login required");
-  }
-  return await refreshAccessToken();
-}
-function getAccessToken2() {
-  return getAccessToken();
-}
-
-// src/strategies/oauth2-pkce/pkce.ts
-function generateCodeVerifier(length = 128) {
-  const array = new Uint8Array(length);
-  crypto.getRandomValues(array);
-  const base64 = btoa(String.fromCharCode(...array));
-  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-}
-async function generateCodeChallenge(verifier) {
-  try {
-    const encoder = new TextEncoder();
-    const data = encoder.encode(verifier);
-    const hashBuffer = await crypto.subtle.digest("SHA-256", data);
-    const hashArray = Array.from(new Uint8Array(hashBuffer));
-    const base64 = btoa(String.fromCharCode(...hashArray));
-    return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-  } catch {
-    throw new Error("Failed to generate code challenge");
-  }
-}
-function generateState() {
-  const array = new Uint8Array(32);
-  crypto.getRandomValues(array);
-  const base64 = btoa(String.fromCharCode(...array));
-  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-}
-
-// src/utils/validation.ts
-function isValidGuid(guid) {
-  if (!guid || typeof guid !== "string") {
-    return false;
-  }
-  const guidRegex = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-  return guidRegex.test(guid.trim());
-}
-function validateTenantId(tenantId) {
-  if (!tenantId || tenantId.trim() === "") {
-    return {
-      isValid: false,
-      error: "Tenant ID is required"
-    };
-  }
-  if (!isValidGuid(tenantId)) {
-    return {
-      isValid: false,
-      error: "Tenant ID must be a valid GUID format (00000000-0000-0000-0000-000000000001)"
-    };
-  }
-  return { isValid: true };
-}
-
-// src/strategies/oauth2-pkce/oauth.ts
-function storeTenantConfig(config) {
-  const validation = validateTenantId(config.tenantId);
-  if (!validation.isValid) {
-    logger.warn("Tenant ID validation failed", { tenantId: config.tenantId });
-  }
-  const authServerToStore = Config.getAuthServerUrl() || config.authServer;
-  const redirectUriToStore = Config.getRedirectUri();
-  const hostConfigKey = getStorageKey("host_config");
-  let existing = {};
-  try {
-    const raw = getStorage(hostConfigKey);
-    if (raw) existing = JSON.parse(raw);
-  } catch {
-    existing = {};
-  }
-  setStorage(
-    hostConfigKey,
-    JSON.stringify({
-      ...existing,
-      authServerUrl: authServerToStore,
-      clientId: config.client.clientId,
-      redirectUri: redirectUriToStore,
-      tenantId: config.tenantId,
-      tenantKey: config.tenantKey ?? existing.tenantKey ?? "",
-      tenantCode: config.tenantKey ?? existing.tenantCode ?? ""
-    })
-  );
-  if (config.tenantKey) {
-    setStorage(STORAGE_KEYS.tenantKey, config.tenantKey);
-  }
-}
-async function initiateAuthFlow(config) {
-  try {
-    logger.info("Initiating OAuth authorization flow");
-    const authServerFromProps = Config.getAuthServerUrl();
-    const authServerEffective = (authServerFromProps || config?.authServer || "").replace(/\/+$/, "");
-    const redirectUriEffective = Config.getRedirectUri();
-    const tenantIdEffective = config?.tenantId || "";
-    const clientIdEffective = config?.client?.clientId || "";
-    logger.debug("[initiateAuthFlow] Resolved inputs", {
-      authServerFromProps: authServerFromProps ? "(provided)" : "(empty)",
-      authServerEffective,
-      redirectUriEffective,
-      tenantIdEffective,
-      clientIdEffective,
-      scopes: config?.client?.scopes,
-      hasRuntime: !!getAuthRuntime()
-    });
-    const token = getAccessToken();
-    if (token && !isAccessTokenExpired()) {
-      logger.debug("Valid token already exists, skipping auth flow");
-      clearFlowFlags();
-      return;
-    }
-    if (isCallbackUrl()) {
-      logger.debug("Callback URL detected - clearing flow flag to allow callback processing");
-      clearFlowFlags();
-      return;
-    }
-    if (isFlowInProgress()) {
-      if (isFlowFlagStale(3e3)) {
-        logger.info("Stale auth flow flag detected, clearing and proceeding");
-        clearFlowFlags();
-      } else {
-        logger.debug("Auth flow already in progress (recent), skipping duplicate redirect");
-        return;
+        if (tokenValid2) {
+          removeStorage(STORAGE_KEYS.codeVerifier);
+          removeStorage(STORAGE_KEYS.state);
+          clearAllAuthFlags();
+          markProcessed();
+          cleanUrlSoft();
+          logger.info("OAuth callback processed successfully (code already used, but token exists)");
+          resetRedirectLoopGuard();
+          emitAuthEvent(AuthEventNames.CALLBACK_SUCCESS);
+          return true;
+        }
       }
-    }
-    setFlowFlags();
-    if (!(Config.getAuthServerUrl() || config?.authServer) || !config.client?.clientId || !config.client?.redirectUri) {
-      logger.error("[initiateAuthFlow] Missing required tenant config", {
-        authServerEffective,
-        clientId: config?.client?.clientId,
-        redirectUriFromTenantApi: config?.client?.redirectUri,
-        redirectUriEffective
+      emitAuthEvent(AuthEventNames.CALLBACK_FAILED, {
+        error: err.message,
+        message: responseData?.error_description ?? err.message
+      });
+      logger.error("OAuth callback failed (Axios error)", {
+        status,
+        statusText: err.response?.statusText,
+        responseData: err.response?.data,
+        message: err.message,
+        url: err.config?.url
+      });
+    } else {
+      logger.error("OAuth callback failed", {
+        error: err instanceof Error ? err.message : String(err)
       });
-      throw new Error("Invalid tenant configuration for auth flow");
     }
-    storeTenantConfig(config);
-    logger.debug("[initiateAuthFlow] Stored tenant config, generating PKCE");
-    removeStorage(getStorageKey("callback_processed"));
-    removeStorage(getStorageKey("state_mismatch"));
-    clearCallbackProcessing();
-    const codeVerifier = generateCodeVerifier();
-    const codeChallenge = await generateCodeChallenge(codeVerifier);
-    const state = generateState();
-    removeStorage(STORAGE_KEYS.codeVerifier);
-    removeStorage(STORAGE_KEYS.state);
-    setStorage(STORAGE_KEYS.codeVerifier, codeVerifier);
-    setStorage(STORAGE_KEYS.state, state);
-    const authUrl = buildAuthorizationUrl(config, codeChallenge, state);
-    logger.debug("[initiateAuthFlow] Built authorization URL", {
-      authServerEffective,
-      urlPrefix: authUrl?.slice(0, 80)
-    });
-    if (!authUrl || !(authUrl.startsWith("http://") || authUrl.startsWith("https://"))) {
-      throw new Error("Invalid authorization URL generated");
+    clearAllAuthFlags();
+    const existingToken = getAccessToken();
+    const tokenValid = existingToken && !isAccessTokenExpired();
+    if (tokenValid) {
+      markProcessed();
+      cleanUrlSoft();
+      resetRedirectLoopGuard();
+      emitAuthEvent(AuthEventNames.CALLBACK_SUCCESS);
+      return true;
     }
-    if (!checkAndIncrementRedirect()) {
-      logger.warn("Redirect loop protection: max redirect attempts exceeded");
-      clearFlowFlags();
-      return;
+    emitAuthEvent(AuthEventNames.CALLBACK_FAILED, {
+      error: err instanceof Error ? err.message : String(err)
+    });
+    clearProcessing();
+    if (isCallbackUrl()) cleanUrlSoft();
+    return false;
+  }
+}
+
+// src/application/flows/CallbackFlow.ts
+var CallbackFlow = class {
+  async execute(context) {
+    const { runtime } = context;
+    const { urlProvider, logger: log } = runtime;
+    const getUrl = () => urlProvider.getCurrentUrl();
+    clearFlowFlags();
+    const handled = await handleCallback();
+    if (handled) {
+      if (isCallbackUrlFromUrl(getUrl())) {
+        if (isCallbackProcessing()) return { completed: true };
+        const u = getUrl();
+        urlProvider.redirect(`${u.origin}${u.pathname}`);
+        return { completed: true };
+      }
+      return { completed: true };
     }
-    logger.info("Redirecting to authorization server");
-    emitAuthEvent(AuthEventNames.LOGIN_STARTED, { tenantKey: config.tenantKey });
-    const runtime = getAuthRuntime();
-    if (runtime) {
-      logger.debug("[initiateAuthFlow] Redirect via runtime.urlProvider.redirect");
-      runtime.urlProvider.redirect(authUrl);
-    } else if (typeof window !== "undefined") {
-      logger.debug("[initiateAuthFlow] Redirect via window.location.replace");
-      window.location.replace(authUrl);
-    } else {
-      logger.error("[initiateAuthFlow] No runtime and no window; cannot redirect", { authUrl });
+    if (isCallbackUrlFromUrl(getUrl())) {
+      const u = getUrl();
+      urlProvider.redirect(`${u.origin}${u.pathname}`);
     }
-  } catch (error) {
-    clearFlowFlags();
-    logger.error("Failed to initiate auth flow", {
-      error: error instanceof Error ? error.message : String(error)
-    });
-    throw error;
+    return { completed: true };
   }
+};
+
+// src/application/flows/AuthenticatedFlow.ts
+var AuthenticatedFlow = class {
+  async execute(_context) {
+    return { completed: true };
+  }
+};
+
+// src/application/engine/defaultEngine.ts
+var defaultEngine = null;
+function getDefaultAuthEngine() {
+  return defaultEngine;
 }
-function buildAuthorizationUrl(config, codeChallenge, state) {
-  const authServerBase = (Config.getAuthServerUrl() || config.authServer || "").replace(/\/+$/, "");
-  if (isLocalhost2()) {
-    logger.debug("Building authorization URL", {
-      authServer: authServerBase,
-      clientId: config.client.clientId,
-      redirectUri: config.client.redirectUri,
-      scopes: config.client.scopes
-    });
+function setDefaultAuthEngine(engine) {
+  defaultEngine = engine;
+}
+
+// src/application/token.ts
+var lastNoRefreshLog = 0;
+var NO_REFRESH_LOG_INTERVAL_MS = 5e3;
+async function ensureValidAccessToken() {
+  const engine = getDefaultAuthEngine();
+  if (engine) {
+    try {
+      return await engine.getAccessToken();
+    } catch {
+    }
   }
-  const tenantIdToUse = config.tenantId;
-  const clientIdToUse = config.client.clientId;
-  const redirectUriToUse = Config.getRedirectUri();
-  const params = new URLSearchParams({
-    client_id: `public-${clientIdToUse}`,
-    tenant_id: tenantIdToUse,
-    redirect_uri: redirectUriToUse,
-    response_type: DEFAULT_RESPONSE_TYPE,
-    scope: config.client.scopes,
-    state,
-    code_challenge: codeChallenge,
-    code_challenge_method: DEFAULT_CODE_CHALLENGE_METHOD
-  });
-  return `${authServerBase}/connect/authorize?${params.toString()}`;
+  const token = getAccessToken();
+  if (token && !isAccessTokenExpired()) return token;
+  const refreshToken = getRefreshToken();
+  if (!refreshToken) {
+    const now = Date.now();
+    if (now - lastNoRefreshLog >= NO_REFRESH_LOG_INTERVAL_MS) {
+      lastNoRefreshLog = now;
+      logger.debug("No refresh token - cannot refresh; login required");
+    }
+    throw new Error("No refresh token; login required");
+  }
+  return await refreshAccessToken();
+}
+function getAccessToken2() {
+  return getAccessToken();
 }
 
 // src/application/flows/RefreshFlow.ts
@@ -1723,13 +1957,18 @@ var TenantSwitchFlow = class {
       );
     }
     try {
-      const cfg = getAuthConfig();
-      setStorage(getStorageKey("host_config"), JSON.stringify({
-        ...cfg,
+      const cfg = getAuthConfig2();
+      writeHostConfigCache({
+        apiBaseUrl: cfg.apiBaseUrl,
+        authServerUrl: cfg.authServerUrl,
+        callbackUrl: cfg.callbackUrl,
+        appId: cfg.appId,
+        clientCode: tenantConfig.client?.clientCode ?? cfg.clientCode ?? "",
+        clientId: cfg.clientId || tenantConfig.client?.clientId,
+        tenantId: tenantConfig.tenantId ?? cfg.tenantId,
         tenantKey,
-        tenantCode: tenantKey,
-        clientCode: tenantConfig.client?.clientCode ?? cfg.clientCode ?? ""
-      }));
+        tenantCode: tenantKey
+      });
     } catch {
     }
     setTenantKey(tenantKey);
@@ -1893,6 +2132,22 @@ async function bootstrap() {
   return bootstrapImpl();
 }
 
+// src/infrastructure/watchers/watcher-guard.ts
+var suspended = false;
+var generation = 0;
+function suspendWatchers() {
+  suspended = true;
+  generation += 1;
+  return generation;
+}
+function resumeWatchers(expectedGen) {
+  if (expectedGen !== void 0 && expectedGen !== generation) return;
+  suspended = false;
+}
+function areWatchersSuspended() {
+  return suspended;
+}
+
 // src/strategies/cookie/cookie-auth.ts
 var COOKIE_NAMES = {
   accessToken: "tenneo_auth_access_token",
@@ -2019,6 +2274,10 @@ function checkCookiesDeleted() {
   }
 }
 function handleCookieDeletion() {
+  if (areWatchersSuspended()) {
+    logger.debug("Cookie deletion handler skipped \u2014 watchers suspended (logout/teardown)");
+    return;
+  }
   try {
     logger.info("Cookies deleted detected - clearing session and redirecting to login");
     clearAuthStorage();
@@ -2056,6 +2315,7 @@ function startCookieWatcher() {
     allCookies: initialCookies
   });
   watchInterval = setInterval(async () => {
+    if (areWatchersSuspended()) return;
     const cookiesDeleted = checkCookiesDeleted();
     if (cookiesDeleted) {
       logger.info("Cookies deleted detected by cookie watcher");
@@ -2119,9 +2379,11 @@ function checkStorageCleared() {
   }
 }
 function handleStorageEvent(event) {
+  if (areWatchersSuspended()) return;
   if (typeof window !== "undefined" && event.storageArea === window.sessionStorage) {
     const wasCleared = checkStorageCleared();
     if (wasCleared) {
+      if (areWatchersSuspended()) return;
       logger.info("Detected manual sessionStorage clear! Redirecting to login...");
       const cb = getSessionClearedCallback();
       if (cb) {
@@ -2141,8 +2403,10 @@ function startStorageWatcher() {
   storageEventListener = handleStorageEvent;
   window.addEventListener("storage", storageEventListener);
   const pollInterval = setInterval(() => {
+    if (areWatchersSuspended()) return;
     const wasCleared = checkStorageCleared();
     if (wasCleared) {
+      if (areWatchersSuspended()) return;
       logger.info("Detected manual sessionStorage clear (polling)! Redirecting to login...");
       clearInterval(pollInterval);
       const cb = getSessionClearedCallback();
@@ -2213,27 +2477,6 @@ function buildUrl(baseUrl, path) {
   url.pathname = url.pathname.endsWith("/") ? `${url.pathname}${normalizedPath.slice(1)}` : `${url.pathname}${normalizedPath}`;
   return url.toString();
 }
-function snapshotHostConfig() {
-  try {
-    const raw = getStorage(getStorageKey("host_config"));
-    if (!raw) return null;
-    const parsed = JSON.parse(raw);
-    return parsed && typeof parsed === "object" ? parsed : null;
-  } catch {
-    return null;
-  }
-}
-function restoreHostConfig(config) {
-  if (!config) return;
-  try {
-    setStorage(getStorageKey("host_config"), JSON.stringify(config));
-    logger.debug("Restored host_config after logout cleanup");
-  } catch (error) {
-    logger.warn("Failed to restore host_config after logout cleanup", {
-      error: error instanceof Error ? error.message : String(error)
-    });
-  }
-}
 function getCsrfToken() {
   try {
     if (typeof document === "undefined") return null;
@@ -2248,62 +2491,68 @@ function getCsrfToken() {
 }
 async function callServerLogout(logoutUrl) {
   const csrfToken = getCsrfToken();
-  async function doRequest(method) {
-    const isPost = method === "POST";
-    const headers = {
-      "X-Requested-With": "XMLHttpRequest",
-      Accept: "application/json, */*"
-    };
-    if (isPost) {
-      headers["Content-Type"] = "application/x-www-form-urlencoded";
-    }
-    if (csrfToken) {
-      headers["X-CSRF-Token"] = csrfToken;
-    }
+  const headers = {
+    "X-Requested-With": "XMLHttpRequest",
+    Accept: "application/json, */*",
+    "Content-Type": "application/x-www-form-urlencoded"
+  };
+  if (csrfToken) {
+    headers["X-CSRF-Token"] = csrfToken;
+  }
+  try {
     const response = await fetch(logoutUrl, {
-      method,
+      method: "POST",
       mode: "cors",
       headers,
-      credentials: "include"
+      credentials: "include",
+      body: ""
     });
     if (!response.ok) {
-      logger.warn("Server logout HTTP error", {
-        method,
+      logger.warn("[logout] Server logout HTTP error", {
         status: response.status,
         statusText: response.statusText
       });
       return { success: false };
     }
-    const data = await response.json().catch(() => ({}));
-    logger.info(`Server logout response (${method})`, { response: data });
+    const contentType = response.headers.get("content-type") || "";
+    if (!contentType.includes("application/json")) {
+      logger.info("[logout] Server logout: OK without JSON body", {
+        status: response.status
+      });
+      return { success: true, response: { success: true } };
+    }
+    const text = await response.text();
+    let data = {};
+    if (text?.trim()) {
+      try {
+        data = JSON.parse(text);
+      } catch {
+        logger.warn("[logout] Server returned non-JSON body with JSON content-type");
+        return { success: false };
+      }
+    }
+    logger.info("[logout] Server logout response", { response: data });
     if (data && (data.success === true || data.logout === true)) {
       return { success: true, response: data };
     }
-    logger.warn("Server logout response invalid payload", {
-      method,
-      response: data
-    });
+    if (!text || text.trim() === "") {
+      return { success: true, response: { success: true } };
+    }
+    logger.warn("[logout] Server logout: unexpected JSON payload", { response: data });
     return { success: false, response: data };
-  }
-  try {
-    const postResult = await doRequest("POST");
-    if (postResult.success) return postResult;
-    logger.debug("POST logout did not succeed, trying GET");
-    const getResult = await doRequest("GET");
-    return getResult;
   } catch (error) {
-    logger.warn("Server logout failed (both POST and GET)", {
+    logger.warn("[logout] Server logout request failed", {
       error: error instanceof Error ? error.message : String(error)
     });
     return { success: false };
   }
 }
 function performLocalLogoutCleanup() {
-  logger.debug("Performing local logout cleanup");
+  logger.debug("[logout] Local cleanup: cookies + auth storage");
   try {
     getAuthRuntime()?.clearCookies?.clearCookies();
   } catch (error) {
-    logger.debug("Runtime cookie clearer failed (ignored)", {
+    logger.debug("[logout] Runtime cookie clearer failed (ignored)", {
       error: error instanceof Error ? error.message : String(error)
     });
   }
@@ -2311,11 +2560,11 @@ function performLocalLogoutCleanup() {
   try {
     clearAuthStorage();
   } catch (error) {
-    logger.warn("clearAuthStorage failed (ignored)", {
+    logger.warn("[logout] clearAuthStorage failed", {
       error: error instanceof Error ? error.message : String(error)
     });
   }
-  logger.info("Local logout cleanup completed");
+  logger.info("[logout] Local cleanup completed");
 }
 function acquireLogoutLock() {
   const LOCK_KEY = getStorageKey("logout_lock");
@@ -2324,7 +2573,7 @@ function acquireLogoutLock() {
   if (existingLock) {
     const lockTime = Number(existingLock);
     if (!Number.isNaN(lockTime) && now - lockTime < 5e3) {
-      logger.debug("Logout lock active \u2013 skipping duplicate logout", {
+      logger.debug("[logout] Lock active \u2014 duplicate tab logout skipped", {
         now,
         lockTime
       });
@@ -2340,72 +2589,95 @@ function releaseLogoutLock() {
   } catch {
   }
 }
-async function logout(tenantKey) {
-  const preservedHostConfig = snapshotHostConfig();
-  if (tenantKey?.trim()) {
-    const updated = {
-      ...preservedHostConfig ?? {},
-      tenantKey: tenantKey.trim(),
-      tenantCode: tenantKey.trim()
-    };
-    setStorage(getStorageKey("host_config"), JSON.stringify(updated));
-  }
+var logoutInFlight = null;
+async function runLogoutPipeline(tenantKey) {
+  const gen = suspendWatchers();
+  logger.info("[logout] Lifecycle: suspend watchers", { generation: gen });
+  stopStorageWatcher();
+  stopCookieWatcher();
   if (!acquireLogoutLock()) {
-    return { success: true, message: "Logout already in progress." };
+    resumeWatchers(gen);
+    logger.debug("[logout] Lifecycle: resume (skipped \u2014 lock)");
+    return { success: true, message: "Logout already in progress in another tab." };
   }
+  let serverLogoutSuccess = false;
+  let serverResponse;
   try {
-    stopStorageWatcher();
-    stopCookieWatcher();
-    const authConfig = getAuthConfig();
-    const apiAuthBaseUrl = authConfig.authServerUrl || Config.getAuthServerUrl();
-    let serverLogoutSuccess = false;
-    let serverResponse;
+    if (tenantKey?.trim()) {
+      applyRuntimeTenantSwitch(tenantKey.trim(), { syncStorageCache: true });
+      logger.info("[logout] Runtime tenant applied for logout context", {
+        tenantKey: tenantKey.trim()
+      });
+    }
+    const authConfig = getAuthConfig2();
+    const apiAuthBaseUrl = authConfig.authServerUrl;
     if (apiAuthBaseUrl) {
       const logoutUrl = buildUrl(apiAuthBaseUrl, "account/logout");
-      logger.info("Calling auth server logout", { logoutUrl });
+      logger.info("[logout] Calling auth server logout (POST)", { logoutUrl });
       const logoutResult = await callServerLogout(logoutUrl);
       serverLogoutSuccess = logoutResult.success;
       serverResponse = logoutResult.response;
       if (!serverLogoutSuccess) {
-        logger.warn("Server logout failed \u2013 session may still exist", {
+        logger.warn("[logout] Server logout did not confirm success \u2014 clearing local session anyway", {
           logoutUrl,
           serverResponse
         });
       }
     } else {
-      logger.warn("API auth base URL not configured, performing local logout only");
+      logger.warn("[logout] authServerUrl missing \u2014 local logout only");
     }
+  } catch (error) {
+    logger.error("[logout] Unexpected error before local cleanup", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
+  try {
     performLocalLogoutCleanup();
-    restoreHostConfig(preservedHostConfig);
-    resetCookieWatcher();
-    startStorageWatcher();
-    releaseLogoutLock();
-    logger.info("Logout completed \u2013 flags set, storage cleared, fresh login required", {
-      serverLogoutSuccess,
-      serverResponse
+  } catch (error) {
+    logger.error("[logout] Local cleanup threw", {
+      error: error instanceof Error ? error.message : String(error)
     });
-    emitAuthEvent(AuthEventNames.LOGOUT_COMPLETED, {
-      serverLogoutSuccess,
-      tenantKey: tenantKey?.trim() || preservedHostConfig?.tenantKey || void 0,
-      message: serverLogoutSuccess ? "Server logout success" : "Local logout only"
+  }
+  try {
+    syncHostConfigCacheFromMemory();
+    logger.debug("[logout] host_config cache refreshed from runtime (not restored from snapshot)");
+  } catch (error) {
+    logger.warn("[logout] Failed to sync host config cache", {
+      error: error instanceof Error ? error.message : String(error)
     });
-    return {
-      success: true,
-      message: serverLogoutSuccess ? serverResponse?.message || "Logout successful. Session cookies cleared. Fresh login required." : "Logged out locally. Fresh login required (server logout may have failed).",
-      serverResponse
-    };
+  }
+  try {
+    resetCookieWatcher();
+    startStorageWatcher();
+    logger.info("[logout] Watchers restarted");
   } catch (error) {
-    logger.error("Logout failed unexpectedly", {
+    logger.warn("[logout] Watcher restart failed", {
       error: error instanceof Error ? error.message : String(error)
     });
-    performLocalLogoutCleanup();
-    restoreHostConfig(preservedHostConfig);
-    releaseLogoutLock();
-    return {
-      success: true,
-      message: "Logged out locally due to an error. Fresh login required."
-    };
   }
+  releaseLogoutLock();
+  resumeWatchers(gen);
+  logger.info("[logout] Lifecycle: complete", { serverLogoutSuccess });
+  emitAuthEvent(AuthEventNames.LOGOUT_COMPLETED, {
+    serverLogoutSuccess,
+    tenantKey: tenantKey?.trim() || getAuthConfig2().tenantCode || void 0,
+    message: serverLogoutSuccess ? "Server logout success" : "Local logout (server may be pending)"
+  });
+  return {
+    success: true,
+    message: serverLogoutSuccess ? serverResponse?.message || "Logout successful. Fresh login required." : "Logged out locally. Fresh login required (server logout may have failed).",
+    serverResponse
+  };
+}
+async function logout(tenantKey) {
+  if (logoutInFlight) {
+    logger.debug("[logout] Coalescing with in-flight logout");
+    return logoutInFlight;
+  }
+  logoutInFlight = runLogoutPipeline(tenantKey).finally(() => {
+    logoutInFlight = null;
+  });
+  return logoutInFlight;
 }
 var AuthContext = createContext(void 0);
 function useAuthContext() {
@@ -2480,7 +2752,6 @@ async function resolveTenant(tenantKey) {
           scopes: DEFAULT_SCOPES2
         }
       };
-      console.log("config====", config);
       logger.debug("Resolved tenant config", { tenantCode });
       return config;
     } catch (error) {
@@ -2741,33 +3012,29 @@ function AuthProvider({
       logger.warn("[AuthProvider] callbackUrl missing from host props");
     }
     setConfig({
-      ...mergedTenantCode ? { tenantCode: mergedTenantCode } : {},
+      ...mergedTenantCode ? { tenantCode: mergedTenantCode, tenantKey: mergedTenantCode } : {},
       ...mergedApiBaseUrl ? { apiBaseUrl: mergedApiBaseUrl } : {},
       ...mergedAuthServerUrl ? { authServerUrl: mergedAuthServerUrl } : {},
       ...mergedCallbackUrl ? { callbackUrl: mergedCallbackUrl } : {}
     });
+    logConfigResolutionDebug("AuthProvider host props applied");
     return () => {
       clearConfigOverrides();
     };
   }, [mergedTenantCode, mergedApiBaseUrl, mergedAuthServerUrl, mergedCallbackUrl]);
   useEffect(() => {
     try {
-      const hostConfigKey = getStorageKey("host_config");
-      const raw = getStorage(hostConfigKey);
-      const existing = raw ? JSON.parse(raw) : {};
-      const payload = {
-        ...existing,
+      writeHostConfigCache({
         tenantCode: mergedTenantCode ?? "",
         tenantKey: mergedTenantCode ?? "",
         appId: appId ?? "",
         apiBaseUrl: mergedApiBaseUrl ?? "",
         authServerUrl: mergedAuthServerUrl ?? "",
         callbackUrl: mergedCallbackUrl ?? ""
-      };
-      setStorage(hostConfigKey, JSON.stringify(payload));
+      });
     } catch {
     }
-  }, [mergedTenantCode, mergedApiBaseUrl, mergedAuthServerUrl, mergedCallbackUrl]);
+  }, [mergedTenantCode, mergedApiBaseUrl, mergedAuthServerUrl, mergedCallbackUrl, appId]);
   useLayoutEffect(() => {
     setStorageKeyPrefix(resolvedTenantKey ?? "");
     const adapter = storageAdapter !== void 0 && storageAdapter !== null ? storageAdapter : createSecureSessionStorageAdapter(namespace);
@@ -2833,14 +3100,14 @@ function AuthProvider({
         logger.debug("[AuthProvider] TenantKey unchanged", { tenantKey: resolvedTenantKey2 });
       }
       try {
-        const hostConfigKey = getStorageKey("host_config");
-        const raw = getStorage(hostConfigKey);
-        const existing = raw ? JSON.parse(raw) : {};
-        setStorage(hostConfigKey, JSON.stringify({
-          ...existing,
+        writeHostConfigCache({
           tenantKey: resolvedTenantKey2,
           tenantCode: resolvedTenantKey2
-        }));
+        });
+        logConfigResolutionDebug("AuthProvider tenant key synced to cache", {
+          tenantCode: resolvedTenantKey2,
+          tenantKey: resolvedTenantKey2
+        });
       } catch {
       }
       setStorage(getStorageKey("tenant_key"), resolvedTenantKey2);
@@ -3244,6 +3511,6 @@ function useAuthInit() {
   );
 }
 
-export { AuthCallback, AuthEventNames, AuthProvider, Config, OAUTH_CONSTANTS, ProtectedRoute, STORAGE_KEYS2 as STORAGE_KEYS, STORAGE_KEY_PREFIX, SanitizedError, bootstrap, buildStorageKey, createAuthEngine, createCookieStorageAdapter, createMemoryStorageAdapter, createOAuth2PkceStrategy, createSecureSessionStorageAdapter, emitAuthEvent, enforceHttps, ensureValidAccessToken, extractTenantKey, getAccessToken2 as getAccessToken, getAuthConfig, getAuthRuntime, getConfig, getStorageAdapter, getStorageNamespace, getAccessToken as getStoredAccessToken, isAccessTokenExpired, isCallbackUrl, logout, refreshAccessToken, resetCookieWatcher, resolveConfig, resolveTenant, sanitizeErrorMessage, setAuthRuntime, setConfig, setStorageContext, startCookieWatcher, stopCookieWatcher, subscribeAuthEvent, useAuth, useAuthContext, useAuthInit };
+export { AuthCallback, AuthConfigError, AuthEventNames, AuthProvider, Config, OAUTH_CONSTANTS, ProtectedRoute, STORAGE_KEYS2 as STORAGE_KEYS, STORAGE_KEY_PREFIX, SanitizedError, applyRuntimeTenantSwitch, areWatchersSuspended, bootstrap, buildStorageKey, createAuthEngine, createCookieStorageAdapter, createMemoryStorageAdapter, createOAuth2PkceStrategy, createSecureSessionStorageAdapter, emitAuthEvent, enforceHttps, ensureValidAccessToken, extractTenantKey, getAccessToken2 as getAccessToken, getAuthConfig2 as getAuthConfig, getAuthRuntime, getConfig, getConfigFieldSources, getEffectiveTenantCode, getEffectiveTenantKey, getStorageAdapter, getStorageNamespace, getAccessToken as getStoredAccessToken, initPlugin, isAccessTokenExpired, isCallbackUrl, logConfigResolutionDebug, logout, refreshAccessToken, requireAuthConfig, resetCookieWatcher, resolveConfig, resolveTenant, resumeWatchers, sanitizeErrorMessage, setAuthRuntime, setConfig, setHostConfigProvider, setStorageContext, startCookieWatcher, startStorageWatcher, stopCookieWatcher, stopStorageWatcher, subscribeAuthEvent, suspendWatchers, syncHostConfigCacheFromMemory, useAuth, useAuthContext, useAuthInit, writeHostConfigCache };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map