@lukoweb/apitogo 0.1.50 → 0.1.53

package/dist/flat-config.d.ts

@@ -61,31 +61,43 @@ export type _Schema9 = (("Inter" | "Roboto" | "Open Sans" | "Poppins" | "Montser
  * Whether this module is active in the application.
  */
 export type _Schema15 = boolean
-export type _Schema35 = ({
+/**
+ * Gateway plan catalog for /pricing preview and publish (canonical storage).
+ */
+export type _Schema35 = {
+  sku: string
+  displayName: string
+  priceAmount?: number
+  priceCurrency?: string
+  billingPeriod?: string
+  limitsJson?: string
+  includedActionKeys?: string[]
+}[]
+export type _Schema36 = ({
   type: "url"
-  input: (string | _Schema36[])
-  server?: _Schema37
-  path?: _Schema38
-  categories?: _Schema39
-  options?: _Schema41
+  input: (string | _Schema37[])
+  server?: _Schema38
+  path?: _Schema39
+  categories?: _Schema40
+  options?: _Schema42
 } | {
   type: "file"
-  input: (string | (string | _Schema36)[])
-  server?: _Schema37
-  path?: _Schema38
-  categories?: _Schema39
-  options?: _Schema41
+  input: (string | (string | _Schema37)[])
+  server?: _Schema38
+  path?: _Schema39
+  categories?: _Schema40
+  options?: _Schema42
 } | {
   type: "raw"
   input: string
-  server?: _Schema37
-  path?: _Schema38
-  categories?: _Schema39
-  options?: _Schema41
+  server?: _Schema38
+  path?: _Schema39
+  categories?: _Schema40
+  options?: _Schema42
 })
-export type _Schema37 = string
 export type _Schema38 = string
-export type _Schema39 = {
+export type _Schema39 = string
+export type _Schema40 = {
   label: string
   tags: string[]
 }[]
@@ -369,8 +381,8 @@ export interface FlatZudokuConfig {
     landing?: _Schema16
     userPanel?: _Schema23
   }
-  apis?: (_Schema35 | _Schema35[])
-  catalogs?: (_Schema42 | _Schema42[])
+  apis?: (_Schema36 | _Schema36[])
+  catalogs?: (_Schema43 | _Schema43[])
   apiKeys?: {
     enabled: boolean
     getConsumers?: unknown
@@ -398,7 +410,7 @@ export interface FlatZudokuConfig {
   }
   enableStatusPages?: boolean
   defaults?: {
-    apis: _Schema41
+    apis: _Schema42
     examplesLanguage?: string
   }
   __pluginDirs?: string[]
@@ -589,6 +601,7 @@ export interface _Schema23 {
       [k: string]: unknown
     }
     content?: _Schema34
+    items?: _Schema35
   }
 }
 /**
@@ -619,12 +632,12 @@ export interface _Schema34 {
     description?: string
   }[]
 }
-export interface _Schema36 {
+export interface _Schema37 {
   path: string
   input: string
   label?: string
 }
-export interface _Schema41 {
+export interface _Schema42 {
   examplesLanguage?: string
   supportedLanguages?: {
     value: string
@@ -641,7 +654,7 @@ export interface _Schema41 {
   transformExamples?: unknown
   generateCodeSnippet?: unknown
 }
-export interface _Schema42 {
+export interface _Schema43 {
   path: string
   label: string
   items?: string[]

package/docs/configuration/authentication.md

@@ -41,21 +41,24 @@ only.
 Set the backend API URL via environment variable (MCP writes this at scaffold/publish):
 
 ```bash
-VITE_APITOGO_DEV_PORTAL_API_URL=https://your-dev-portal-api.example.com
+VITE_APITOGO_AUTHENTICATION_API_BASE_URL=https://your-dev-portal-api.example.com
 ```
 
+You can also set `authentication.apiBaseUrl` in `apitogo.config.json` or
+`APITOGO_CONFIG_authentication__apiBaseUrl` in `.env`.
+
 **Local preview:** When the backend URL is a placeholder or unreachable, the account area shows a
 message that sign-in unlocks after publish. Docs and API reference remain public. Plans on
-`/pricing` load from `apitogo.json` with optional `apitogo.local.json` overrides (including
-`includedActionKeys` per plan). Plan edits hot-reload without restarting the dev server.
+`/pricing` load from `apitogo.config.json` (overridable via `.env` — see [Manifest](./manifest.md),
+including `includedActionKeys` per plan). Plan edits hot-reload without restarting the dev server.
 
 ### Dev portal configuration files
 
-| Concern                                                           | File                                                             |
-| ----------------------------------------------------------------- | ---------------------------------------------------------------- |
-| Site nav, docs, plugins, auth wiring                              | `apitogo.config.tsx`                                             |
-| Plans, rate limits, `includedActionKeys`, project/deploy metadata | `apitogo.json` (+ env overrides — see [Manifest](./manifest.md)) |
-| OIDC and Stripe for publish (MCP only)                            | `apitogo.local.secrets.json`                                     |
+| Concern                                                  | File                                                                       |
+| -------------------------------------------------------- | -------------------------------------------------------------------------- |
+| Site, plans, modules, branding, backend/gateway metadata | `apitogo.config.json` (+ `.env` overrides — see [Manifest](./manifest.md)) |
+| Plugins and custom code                                  | `apitogo.config.tsx`                                                       |
+| OIDC and Stripe for publish                              | `.env.local` via `APITOGO_CONFIG_authentication__*`                        |
 
 **Production:** Register one OIDC app with redirect URI `https://{backend}/signin-oidc` (see MCP
 `manualSteps.oidcRedirectUri`). The frontend uses cookie sessions via `credentials: "include"` on

package/docs/configuration/manifest.md

@@ -1,116 +1,106 @@
----
-title: Manifest (apitogo.json)
-sidebar_icon: file-json
----
+# Site configuration (apitogo.config.json)
 
-Dev portal sites provisioned through APItoGo use JSON manifest files for plans, branding, backend
-paths, and gateway settings. Shared defaults live in **`apitogo.json`**; optional per-environment
-files override values without duplicating the full config.
+Dev portal sites use a single JSON file for site settings, plans, authentication, and backend
+metadata. Code-only pieces (plugins, custom components) stay in `apitogo.config.tsx`.
 
 ## Files
 
-| File                         | When used        | Purpose                                                                   |
-| ---------------------------- | ---------------- | ------------------------------------------------------------------------- |
-| `apitogo.json`               | Always (base)    | Committed defaults: `siteName`, `branding`, `plans`, `backend`, `gateway` |
-| `apitogo.local.json`         | `npm run dev`    | Local-only overrides (optional)                                           |
-| `apitogo.prod.json`          | `npm run build`  | Production build overrides (optional)                                     |
-| `apitogo.local.secrets.json` | MCP publish only | OIDC and Stripe credentials — never loaded by the dev server              |
-
-New scaffolds ship `apitogo.json` plus `apitogo.local.example.json` and `apitogo.prod.example.json`
-to show how overrides work. Copy or rename the examples when you need environment-specific values.
-
-## Resolution
-
-At dev and build time the tooling merges the base file with the environment override:
-
-```mermaid
-flowchart LR
-  base["apitogo.json"]
-  local["apitogo.local.json"]
-  prod["apitogo.prod.json"]
-  devMerge["merge"]
-  buildMerge["merge"]
-  viteDev["npm run dev"]
-  viteBuild["npm run build"]
-
-  base --> devMerge
-  local --> devMerge
-  base --> buildMerge
-  prod --> buildMerge
-  viteDev --> devMerge
-  buildMerge --> viteBuild
-```
-
-- **Local preview** (`npm run dev`): `apitogo.json` + `apitogo.local.json`
-- **Production build** (`npm run build`): `apitogo.json` + `apitogo.prod.json`
-- **Deployed site**: plans are served from the live dev-portal API (`GET /api/v1/plans`), not from
-  JSON files in the browser bundle
-
-If `apitogo.json` is missing but `apitogo.local.json` exists, the local file is used as the full
-manifest (legacy single-file projects).
-
-## Merge rules
-
-Override files patch the base manifest:
+| File                  | Purpose                                                     |
+| --------------------- | ----------------------------------------------------------- |
+| `apitogo.config.json` | Committed defaults: site, modules, authentication, backend  |
+| `apitogo.config.tsx`  | Plugins and other non-JSON configuration                    |
+| `.env` / `.env.local` | Public client vars + publish secrets via `APITOGO_CONFIG_*` |
 
-- Top-level keys: override wins
-- `branding`, `backend`, `gateway`: deep-merged (override fields patch nested objects)
-- `plans`: merged by `sku` — an override plan with the same SKU updates only the fields you specify
-
-Example base (`apitogo.json`):
+## Canonical shape
 
 ```json
 {
-  "siteName": "My API",
-  "branding": { "title": "My API" },
-  "plans": [
-    {
-      "sku": "pro",
-      "displayName": "Pro",
-      "isFree": false,
-      "priceAmount": 9.99,
-      "billingPeriod": "month"
+  "site": {
+    "title": "My API",
+    "logo": {
+      "src": { "light": "/logo-light.png", "dark": "/logo-dark.png" },
+      "alt": "My API",
+      "width": "130px"
+    }
+  },
+  "authentication": {
+    "enabled": true,
+    "type": "dev-portal",
+    "apiBaseUrl": "https://your-dev-portal-api.example.com",
+    "gateway": {
+      "authMode": "bringYourOwnOidc",
+      "oidcMetadataUrl": "https://login.example.com/.well-known/openid-configuration"
+    }
+  },
+  "modules": {
+    "docs": { "files": "/pages/**/*.{md,mdx}" },
+    "landing": { "enabled": true, "path": "/", "layout": "landing" },
+    "userPanel": {
+      "enabled": true,
+      "dashboard": { "enabled": true },
+      "userManagement": { "enabled": true },
+      "plans": {
+        "enabled": true,
+        "items": [
+          {
+            "sku": "free",
+            "displayName": "Free",
+            "priceAmount": 0
+          }
+        ]
+      }
     }
-  ]
+  },
+  "apis": [{ "type": "file", "input": "./apis/openapi.yaml", "path": "api" }]
 }
 ```
 
-Example local override (`apitogo.local.json`):
+- **Site name / logo:** only `site.title` and `site.logo` (platform branding is derived at publish).
+- **OpenAPI path:** `backend.openApiPath` is derived from `apis[0].input`.
+- **Billing / account plans:** use `modules.userPanel.plans.enabled` and store the plan catalog in
+  `modules.userPanel.plans.items`. Legacy root `plans` is migrated on load. Legacy `pricing.enabled`
+  is migrated and stripped from site JSON; MCP/publish still receives derived `pricing.enabled`.
+- **Docs / API keys:** configure under `modules.docs` and `modules.userPanel.apiKeys` only.
 
-```json
-{
-  "projectId": "your-local-project-id",
-  "backend": { "sourceDirectory": "../my-api" }
-}
+## Environment variables
+
+Public client URL (mirrors `authentication.apiBaseUrl`):
+
+```sh
+VITE_APITOGO_AUTHENTICATION_API_BASE_URL=https://your-dev-portal-api.example.com
 ```
 
-Example production override (`apitogo.prod.json`):
+Nested config overrides:
 
-```json
-{
-  "plans": [{ "sku": "pro", "priceAmount": 19.99 }],
-  "backend": { "deployed": true }
-}
+```sh
+APITOGO_CONFIG_site__title=My Local Site
+APITOGO_CONFIG_pricing__enabled=true
+APITOGO_CONFIG_projectId=your-local-project-id
+APITOGO_CONFIG_authentication__apiBaseUrl=https://your-dev-portal-api.example.com
 ```
 
-## What to put where
+Publish secrets (`.env.local`, never commit):
+
+```sh
+APITOGO_CONFIG_authentication__oidc__authority=https://login.example.com
+APITOGO_CONFIG_authentication__oidc__clientId=your-client-id
+APITOGO_CONFIG_authentication__oidc__clientSecret=your-client-secret
+APITOGO_CONFIG_authentication__stripe__secretKey=sk_test_...
+APITOGO_CONFIG_authentication__stripe__webhookSecret=whsec_...
+```
 
-| Concern                                      | Recommended file                                                         |
-| -------------------------------------------- | ------------------------------------------------------------------------ |
-| Plans, rate limits, `includedActionKeys`     | `apitogo.json` (shared)                                                  |
-| Branding, site name                          | `apitogo.json`                                                           |
-| Backend paths, OpenAPI location              | `apitogo.json`; machine-specific paths in `apitogo.local.json`           |
-| `projectId` after bootstrap                  | `apitogo.local.json` until MCP writes to the correct file                |
-| Production-only plan pricing or deploy flags | `apitogo.prod.json`                                                      |
-| OIDC / Stripe                                | `apitogo.local.secrets.json` (see [Authentication](./authentication.md)) |
+## Thin `apitogo.config.tsx`
 
-## Hot reload
+```tsx
+import { buildApitogoConfig } from "@lukoweb/apitogo";
+import { devPortalBillingPlugin } from "@lukoweb/apitogo-plugin-dev-portal-billing";
 
-During `npm run dev`, changes to `apitogo.json` or `apitogo.local.json` hot-reload on `/pricing`
-without restarting the server. Restart the dev server after changing
-`VITE_APITOGO_DEV_PORTAL_API_URL` in `.env`.
+export default buildApitogoConfig({
+  plugins: [devPortalBillingPlugin()],
+});
+```
 
-## Related configuration
+## Related
 
-- Site navigation, docs, and plugins: [`apitogo.config.tsx`](./overview.md)
-- Authentication for dev-portal sites: [Authentication](./authentication.md)
+- [Authentication](./authentication.md)
+- [Overview](./overview.md)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lukoweb/apitogo",
-  "version": "0.1.50",
+  "version": "0.1.53",
   "type": "module",
   "sideEffects": [
     "**/*.css",
@@ -153,6 +153,14 @@
     "./local-manifest": {
       "types": "./dist/declarations/config/local-manifest.d.ts",
       "default": "./src/config/local-manifest.ts"
+    },
+    "./build-config": {
+      "types": "./dist/declarations/config/build-apitogo-config.d.ts",
+      "default": "./src/config/build-apitogo-config.ts"
+    },
+    "./config-loader": {
+      "types": "./dist/declarations/config/apitogo-config-loader.d.ts",
+      "default": "./src/config/apitogo-config-loader.ts"
     }
   },
   "scripts": {
@@ -467,6 +475,14 @@
       "./local-manifest": {
         "types": "./dist/declarations/config/local-manifest.d.ts",
         "default": "./src/config/local-manifest.ts"
+      },
+      "./build-config": {
+        "types": "./dist/declarations/config/build-apitogo-config.d.ts",
+        "default": "./src/config/build-apitogo-config.ts"
+      },
+      "./config-loader": {
+        "types": "./dist/declarations/config/apitogo-config-loader.d.ts",
+        "default": "./src/config/apitogo-config-loader.ts"
       }
     },
     "access": "public"