@lukoweb/apitogo 0.1.51 → 0.1.53

package/dist/declarations/config/apitogo-config-core.d.ts

@@ -0,0 +1,25 @@
+export declare const APITOGO_CONFIG_FILENAME = "apitogo.config.json";
+export type ApitogoJsonConfig = Record<string, unknown>;
+export type AuthenticationSecrets = {
+    oidc?: {
+        authority?: string;
+        clientId?: string;
+        clientSecret?: string;
+    };
+    stripe?: {
+        secretKey?: string;
+        webhookSecret?: string;
+    };
+};
+export declare function applyEnvOverrides(config: ApitogoJsonConfig, env?: NodeJS.ProcessEnv): ApitogoJsonConfig;
+type PlanCatalogItem = Record<string, unknown> & {
+    sku?: string;
+};
+export declare function readPlanCatalogItems(config: ApitogoJsonConfig): PlanCatalogItem[];
+export declare function normalizeApitogoConfig(config: ApitogoJsonConfig): ApitogoJsonConfig;
+export declare function isBillingEnabled(config: ApitogoJsonConfig): boolean;
+export declare function deriveManifestFields(config: ApitogoJsonConfig): ApitogoJsonConfig;
+export declare function extractManifest(config: ApitogoJsonConfig | null | undefined): ApitogoJsonConfig | null;
+export declare function extractSiteConfig(config: ApitogoJsonConfig | null | undefined): ApitogoJsonConfig;
+export declare function resolveProjectDisplayName(config: ApitogoJsonConfig): string;
+export {};

package/dist/declarations/config/apitogo-config-loader.d.ts

@@ -1,7 +1,2 @@
-export declare const APITOGO_CONFIG_FILENAME = "apitogo.config.json";
-export type ApitogoJsonConfig = Record<string, unknown>;
-export declare function applyEnvOverrides(config: ApitogoJsonConfig, env?: NodeJS.ProcessEnv): ApitogoJsonConfig;
-export declare function loadApitogoConfig(rootDir?: string): ApitogoJsonConfig;
-export declare function extractManifest(config: ApitogoJsonConfig | null | undefined): ApitogoJsonConfig | null;
-export declare function extractSiteConfig(config: ApitogoJsonConfig | null | undefined): ApitogoJsonConfig;
-export declare function apitogoConfigPath(rootDir: string): string;
+export * from "./apitogo-config-core.js";
+export { apitogoConfigPath, loadApitogoConfig, readAuthenticationSecrets, } from "./apitogo-config-loader.node.js";

package/dist/declarations/config/apitogo-config-loader.node.d.ts

@@ -0,0 +1,4 @@
+import { type ApitogoJsonConfig, type AuthenticationSecrets } from "./apitogo-config-core.js";
+export declare function loadApitogoConfig(rootDir?: string): ApitogoJsonConfig;
+export declare function readAuthenticationSecrets(env?: NodeJS.ProcessEnv): AuthenticationSecrets;
+export declare function apitogoConfigPath(rootDir: string): string;

package/dist/declarations/config/build-apitogo-config.d.ts

@@ -1,7 +1,8 @@
+import type { ApitogoPlugin } from "../lib/core/plugins.js";
+import { type ApitogoJsonConfig } from "./apitogo-config-core.js";
 import type { ApitogoConfig } from "./config.js";
-type BuildApitogoConfigOptions = {
-    rootDir?: string;
-    overrides?: Partial<ApitogoConfig>;
+type BuildApitogoConfigOptions = Partial<ApitogoConfig> & ApitogoJsonConfig & {
+    plugins?: ApitogoPlugin[];
 };
-export declare function buildApitogoConfig({ rootDir, overrides, }?: BuildApitogoConfigOptions): ApitogoConfig;
+export declare function buildApitogoConfig({ plugins, plans: _legacyPlans, ...jsonOverrides }?: BuildApitogoConfigOptions): ApitogoConfig;
 export {};

package/dist/declarations/config/loader.d.ts

@@ -1,5 +1,6 @@
 import type { RollupOutput, RollupWatcher } from "rollup";
 import { type ConfigEnv } from "vite";
+import { type DevPortalPreviewPlan } from "./local-manifest.js";
 import type { ResolvedModulesConfig } from "./validators/ModulesSchema.js";
 import type { ZudokuConfig } from "./validators/ZudokuConfig.js";
 export type ConfigWithMeta = ZudokuConfig & {
@@ -11,6 +12,7 @@ export type ConfigWithMeta = ZudokuConfig & {
         dependencies: string[];
         pricingEnabled?: boolean;
         authenticationEnabled?: boolean;
+        previewPlans?: DevPortalPreviewPlan[];
     };
     __resolvedModules: ResolvedModulesConfig;
 };

package/dist/declarations/config/local-manifest.d.ts

@@ -1,6 +1,5 @@
 import { z } from "zod";
 import { APITOGO_CONFIG_FILENAME } from "./apitogo-config-loader.js";
-export declare const DEV_PORTAL_MANIFEST_FILENAME = "apitogo.local.json";
 export declare const APITOGO_MANIFEST_BASE_FILENAME = "apitogo.json";
 export declare const APITOGO_MANIFEST_ENV_FILES: {
     readonly development: "apitogo.local.json";
@@ -11,8 +10,7 @@ export type ApitogoManifestEnv = keyof typeof APITOGO_MANIFEST_ENV_FILES;
 export declare const ManifestPlanInputSchema: z.ZodObject<{
     sku: z.ZodString;
     displayName: z.ZodString;
-    isFree: z.ZodBoolean;
-    priceAmount: z.ZodOptional<z.ZodNumber>;
+    priceAmount: z.ZodDefault<z.ZodNumber>;
     priceCurrency: z.ZodOptional<z.ZodString>;
     billingPeriod: z.ZodOptional<z.ZodEnum<{
         month: "month";
@@ -23,6 +21,9 @@ export declare const ManifestPlanInputSchema: z.ZodObject<{
     limitsJson: z.ZodOptional<z.ZodString>;
     includedActionKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strip>;
+export declare function isPlanFree(plan: {
+    priceAmount?: number;
+}): boolean;
 export declare const DevPortalLocalManifestSchema: z.ZodObject<{
     siteName: z.ZodOptional<z.ZodString>;
     branding: z.ZodOptional<z.ZodObject<{
@@ -34,12 +35,13 @@ export declare const DevPortalLocalManifestSchema: z.ZodObject<{
     }, z.core.$strip>>;
     authentication: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
+        type: z.ZodOptional<z.ZodString>;
+        apiBaseUrl: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
     plans: z.ZodOptional<z.ZodArray<z.ZodObject<{
         sku: z.ZodString;
         displayName: z.ZodString;
-        isFree: z.ZodBoolean;
-        priceAmount: z.ZodOptional<z.ZodNumber>;
+        priceAmount: z.ZodDefault<z.ZodNumber>;
         priceCurrency: z.ZodOptional<z.ZodString>;
         billingPeriod: z.ZodOptional<z.ZodEnum<{
             month: "month";
@@ -70,14 +72,12 @@ export declare const DevPortalLocalManifestSchema: z.ZodObject<{
         publicHealthActionKey: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
     projectId: z.ZodOptional<z.ZodString>;
-    projectName: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export type ManifestPlanInput = z.infer<typeof ManifestPlanInputSchema>;
 export type DevPortalLocalManifest = z.infer<typeof DevPortalLocalManifestSchema>;
 export type DevPortalPreviewPlan = {
     sku: string;
     displayName: string;
-    isFree: boolean;
     priceAmount: number;
     priceCurrency: string;
     billingPeriod: string;
@@ -105,5 +105,5 @@ export declare function manifestPathsForEnv(rootDir: string, _env: ApitogoManife
 };
 export declare function parseLocalManifestJson(raw: string): DevPortalLocalManifest | null;
 export declare function readManifestFile(rootDir: string, filename: string): Promise<DevPortalLocalManifest | null>;
-export declare function readEffectiveManifest(rootDir: string, env: ApitogoManifestEnv): Promise<DevPortalLocalManifest | null>;
+export declare function readEffectiveManifest(rootDir: string, _env: ApitogoManifestEnv): Promise<DevPortalLocalManifest | null>;
 export declare function readLocalManifest(rootDir: string): Promise<DevPortalLocalManifest | null>;

package/dist/declarations/config/validators/ModulesSchema.d.ts

@@ -134,6 +134,15 @@ export declare const ApiKeysModuleSchema: z.ZodObject<{
     enabled: z.ZodOptional<z.ZodBoolean>;
     path: z.ZodDefault<z.ZodString>;
 }, z.core.$strip>;
+declare const PlanCatalogItemSchema: z.ZodObject<{
+    sku: z.ZodString;
+    displayName: z.ZodString;
+    priceAmount: z.ZodDefault<z.ZodNumber>;
+    priceCurrency: z.ZodOptional<z.ZodString>;
+    billingPeriod: z.ZodOptional<z.ZodString>;
+    limitsJson: z.ZodOptional<z.ZodString>;
+    includedActionKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
 export declare const PlansModuleSchema: z.ZodObject<{
     enabled: z.ZodOptional<z.ZodBoolean>;
     path: z.ZodDefault<z.ZodString>;
@@ -148,6 +157,15 @@ export declare const PlansModuleSchema: z.ZodObject<{
             description: z.ZodOptional<z.ZodString>;
         }, z.core.$strip>>>;
     }, z.core.$strip>>;
+    items: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        sku: z.ZodString;
+        displayName: z.ZodString;
+        priceAmount: z.ZodDefault<z.ZodNumber>;
+        priceCurrency: z.ZodOptional<z.ZodString>;
+        billingPeriod: z.ZodOptional<z.ZodString>;
+        limitsJson: z.ZodOptional<z.ZodString>;
+        includedActionKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>>;
 }, z.core.$strip>;
 export declare const DashboardModuleSchema: z.ZodObject<{
     enabled: z.ZodOptional<z.ZodBoolean>;
@@ -215,6 +233,15 @@ export declare const UserPanelModuleSchema: z.ZodObject<{
                 description: z.ZodOptional<z.ZodString>;
             }, z.core.$strip>>>;
         }, z.core.$strip>>;
+        items: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            sku: z.ZodString;
+            displayName: z.ZodString;
+            priceAmount: z.ZodDefault<z.ZodNumber>;
+            priceCurrency: z.ZodOptional<z.ZodString>;
+            billingPeriod: z.ZodOptional<z.ZodString>;
+            limitsJson: z.ZodOptional<z.ZodString>;
+            includedActionKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export declare const ModulesSchema: z.ZodOptional<z.ZodObject<{
@@ -320,6 +347,15 @@ export declare const ModulesSchema: z.ZodOptional<z.ZodObject<{
                     description: z.ZodOptional<z.ZodString>;
                 }, z.core.$strip>>>;
             }, z.core.$strip>>;
+            items: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                sku: z.ZodString;
+                displayName: z.ZodString;
+                priceAmount: z.ZodDefault<z.ZodNumber>;
+                priceCurrency: z.ZodOptional<z.ZodString>;
+                billingPeriod: z.ZodOptional<z.ZodString>;
+                limitsJson: z.ZodOptional<z.ZodString>;
+                includedActionKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strip>>>;
         }, z.core.$strip>>;
     }, z.core.$strip>>;
 }, z.core.$strip>>;
@@ -396,6 +432,7 @@ export type ResolvedPlansModule = {
     enabled: boolean;
     path: string;
     content: ResolvedPlansContent;
+    items?: z.infer<typeof PlanCatalogItemSchema>[];
 };
 export type ResolvedDashboardModule = {
     enabled: boolean;
@@ -415,3 +452,4 @@ export type ResolvedModulesConfig = {
     landing: ResolvedLandingModule;
     userPanel: ResolvedUserPanelModule;
 };
+export {};

package/dist/declarations/config/validators/ZudokuConfig.d.ts

@@ -6926,6 +6926,15 @@ export declare const ZudokuConfig: z.ZodObject<{
                         description: z.ZodOptional<z.ZodString>;
                     }, z.core.$strip>>>;
                 }, z.core.$strip>>;
+                items: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    sku: z.ZodString;
+                    displayName: z.ZodString;
+                    priceAmount: z.ZodDefault<z.ZodNumber>;
+                    priceCurrency: z.ZodOptional<z.ZodString>;
+                    billingPeriod: z.ZodOptional<z.ZodString>;
+                    limitsJson: z.ZodOptional<z.ZodString>;
+                    includedActionKeys: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                }, z.core.$strip>>>;
             }, z.core.$strip>>;
         }, z.core.$strip>>;
     }, z.core.$strip>>>;

package/dist/declarations/index.d.ts

@@ -18,4 +18,4 @@ export { cn } from "./lib/ui/util.js";
 export { joinUrl } from "./lib/util/joinUrl.js";
 export { type ProblemJson, throwIfProblemJson, } from "./lib/util/problemJson.js";
 export { buildApitogoConfig } from "./config/build-apitogo-config.js";
-export { APITOGO_CONFIG_FILENAME, applyEnvOverrides, extractManifest, extractSiteConfig, loadApitogoConfig, } from "./config/apitogo-config-loader.js";
+export { APITOGO_CONFIG_FILENAME, applyEnvOverrides, extractManifest, extractSiteConfig, normalizeApitogoConfig, resolveProjectDisplayName, } from "./config/apitogo-config-core.js";

package/dist/declarations/lib/core/plugins.d.ts

@@ -7,6 +7,7 @@ import type { ZudokuConfig } from "../../config/validators/ZudokuConfig.js";
 import type { AuthenticationPlugin } from "../authentication/authentication.js";
 import type { MdxComponentsType } from "../util/MdxComponents.js";
 import type { ApiIdentity, ApitogoEvents, ZudokuContext } from "./ZudokuContext.js";
+export { createPlugin } from "../../config/create-plugin.js";
 export { runPluginTransformConfig } from "./transform-config.js";
 export type ApitogoPlugin = CommonPlugin | ProfileMenuPlugin | NavigationPlugin | ApiIdentityPlugin | SearchProviderPlugin | EventConsumerPlugin | AuthenticationPlugin | TransformConfigPlugin;
 export type { AuthenticationPlugin, RouteObject };

package/dist/flat-config.d.ts

@@ -61,31 +61,43 @@ export type _Schema9 = (("Inter" | "Roboto" | "Open Sans" | "Poppins" | "Montser
  * Whether this module is active in the application.
  */
 export type _Schema15 = boolean
-export type _Schema35 = ({
+/**
+ * Gateway plan catalog for /pricing preview and publish (canonical storage).
+ */
+export type _Schema35 = {
+  sku: string
+  displayName: string
+  priceAmount?: number
+  priceCurrency?: string
+  billingPeriod?: string
+  limitsJson?: string
+  includedActionKeys?: string[]
+}[]
+export type _Schema36 = ({
   type: "url"
-  input: (string | _Schema36[])
-  server?: _Schema37
-  path?: _Schema38
-  categories?: _Schema39
-  options?: _Schema41
+  input: (string | _Schema37[])
+  server?: _Schema38
+  path?: _Schema39
+  categories?: _Schema40
+  options?: _Schema42
 } | {
   type: "file"
-  input: (string | (string | _Schema36)[])
-  server?: _Schema37
-  path?: _Schema38
-  categories?: _Schema39
-  options?: _Schema41
+  input: (string | (string | _Schema37)[])
+  server?: _Schema38
+  path?: _Schema39
+  categories?: _Schema40
+  options?: _Schema42
 } | {
   type: "raw"
   input: string
-  server?: _Schema37
-  path?: _Schema38
-  categories?: _Schema39
-  options?: _Schema41
+  server?: _Schema38
+  path?: _Schema39
+  categories?: _Schema40
+  options?: _Schema42
 })
-export type _Schema37 = string
 export type _Schema38 = string
-export type _Schema39 = {
+export type _Schema39 = string
+export type _Schema40 = {
   label: string
   tags: string[]
 }[]
@@ -369,8 +381,8 @@ export interface FlatZudokuConfig {
     landing?: _Schema16
     userPanel?: _Schema23
   }
-  apis?: (_Schema35 | _Schema35[])
-  catalogs?: (_Schema42 | _Schema42[])
+  apis?: (_Schema36 | _Schema36[])
+  catalogs?: (_Schema43 | _Schema43[])
   apiKeys?: {
     enabled: boolean
     getConsumers?: unknown
@@ -398,7 +410,7 @@ export interface FlatZudokuConfig {
   }
   enableStatusPages?: boolean
   defaults?: {
-    apis: _Schema41
+    apis: _Schema42
     examplesLanguage?: string
   }
   __pluginDirs?: string[]
@@ -589,6 +601,7 @@ export interface _Schema23 {
       [k: string]: unknown
     }
     content?: _Schema34
+    items?: _Schema35
   }
 }
 /**
@@ -619,12 +632,12 @@ export interface _Schema34 {
     description?: string
   }[]
 }
-export interface _Schema36 {
+export interface _Schema37 {
   path: string
   input: string
   label?: string
 }
-export interface _Schema41 {
+export interface _Schema42 {
   examplesLanguage?: string
   supportedLanguages?: {
     value: string
@@ -641,7 +654,7 @@ export interface _Schema41 {
   transformExamples?: unknown
   generateCodeSnippet?: unknown
 }
-export interface _Schema42 {
+export interface _Schema43 {
   path: string
   label: string
   items?: string[]

package/docs/configuration/authentication.md

@@ -41,22 +41,24 @@ only.
 Set the backend API URL via environment variable (MCP writes this at scaffold/publish):
 
 ```bash
-VITE_APITOGO_DEV_PORTAL_API_URL=https://your-dev-portal-api.example.com
+VITE_APITOGO_AUTHENTICATION_API_BASE_URL=https://your-dev-portal-api.example.com
 ```
 
+You can also set `authentication.apiBaseUrl` in `apitogo.config.json` or
+`APITOGO_CONFIG_authentication__apiBaseUrl` in `.env`.
+
 **Local preview:** When the backend URL is a placeholder or unreachable, the account area shows a
 message that sign-in unlocks after publish. Docs and API reference remain public. Plans on
-`/pricing` load from `apitogo.config.json` (overridable via `.env` — see
-[Manifest](./manifest.md), including `includedActionKeys` per plan). Plan edits hot-reload without
-restarting the dev server.
+`/pricing` load from `apitogo.config.json` (overridable via `.env` — see [Manifest](./manifest.md),
+including `includedActionKeys` per plan). Plan edits hot-reload without restarting the dev server.
 
 ### Dev portal configuration files
 
-| Concern                                                           | File                                                             |
-| ----------------------------------------------------------------- | ---------------------------------------------------------------- |
-| Site, plans, modules, branding, backend/gateway metadata          | `apitogo.config.json` (+ `.env` overrides — see [Manifest](./manifest.md)) |
-| Plugins and custom code                                           | `apitogo.config.tsx`                                             |
-| OIDC and Stripe for publish                                       | `.env.local` via `APITOGO_CONFIG_*` (or legacy `apitogo.local.secrets.json`) |
+| Concern                                                  | File                                                                       |
+| -------------------------------------------------------- | -------------------------------------------------------------------------- |
+| Site, plans, modules, branding, backend/gateway metadata | `apitogo.config.json` (+ `.env` overrides — see [Manifest](./manifest.md)) |
+| Plugins and custom code                                  | `apitogo.config.tsx`                                                       |
+| OIDC and Stripe for publish                              | `.env.local` via `APITOGO_CONFIG_authentication__*`                        |
 
 **Production:** Register one OIDC app with redirect URI `https://{backend}/signin-oidc` (see MCP
 `manualSteps.oidcRedirectUri`). The frontend uses cookie sessions via `credentials: "include"` on

package/docs/configuration/manifest.md

@@ -1,59 +1,20 @@
----
-title: Site configuration (apitogo.config.json)
-sidebar_icon: file-json
----
+# Site configuration (apitogo.config.json)
 
-Dev portal sites use a single JSON configuration file for site settings, plans,
-branding, backend paths, and gateway metadata. Code-only pieces (plugins, custom
-components) stay in `apitogo.config.tsx`.
+Dev portal sites use a single JSON file for site settings, plans, authentication, and backend
+metadata. Code-only pieces (plugins, custom components) stay in `apitogo.config.tsx`.
 
 ## Files
 
-| File | Purpose |
-| --- | --- |
-| `apitogo.config.json` | Committed defaults: site, modules, plans, branding, backend, gateway |
-| `apitogo.config.tsx` | Plugins and other non-JSON configuration |
-| `.env` / `.env.local` / `.env.production` | Per-environment overrides via `APITOGO_CONFIG_*` and `VITE_*` vars |
+| File                  | Purpose                                                     |
+| --------------------- | ----------------------------------------------------------- |
+| `apitogo.config.json` | Committed defaults: site, modules, authentication, backend  |
+| `apitogo.config.tsx`  | Plugins and other non-JSON configuration                    |
+| `.env` / `.env.local` | Public client vars + publish secrets via `APITOGO_CONFIG_*` |
 
-## Environment overrides
-
-Use `APITOGO_CONFIG_<path>` with double underscores for nested paths:
-
-```sh
-APITOGO_CONFIG_site__title=My Local Site
-APITOGO_CONFIG_pricing__enabled=true
-APITOGO_CONFIG_projectId=your-local-project-id
-APITOGO_CONFIG_backend__sourceDirectory=../my-api
-```
-
-Values are parsed as JSON when possible (`true`, `false`, numbers, objects).
-
-For the live dev-portal API URL (client-visible):
-
-```sh
-VITE_APITOGO_DEV_PORTAL_API_URL=https://your-dev-portal-api.example.com
-```
-
-Keep secrets (OIDC client secret, Stripe keys, etc.) in `.env.local` using the
-same `APITOGO_CONFIG_*` pattern — never commit them.
-
-## Example `apitogo.config.json`
+## Canonical shape
 
 ```json
 {
-  "siteName": "My API",
-  "branding": { "title": "My API" },
-  "pricing": { "enabled": true },
-  "authentication": { "enabled": true, "type": "dev-portal" },
-  "plans": [
-    {
-      "sku": "pro",
-      "displayName": "Pro",
-      "isFree": false,
-      "priceAmount": 9.99,
-      "billingPeriod": "month"
-    }
-  ],
   "site": {
     "title": "My API",
     "logo": {
@@ -62,10 +23,72 @@ same `APITOGO_CONFIG_*` pattern — never commit them.
       "width": "130px"
     }
   },
-  "docs": { "files": "/pages/**/*.{md,mdx}" }
+  "authentication": {
+    "enabled": true,
+    "type": "dev-portal",
+    "apiBaseUrl": "https://your-dev-portal-api.example.com",
+    "gateway": {
+      "authMode": "bringYourOwnOidc",
+      "oidcMetadataUrl": "https://login.example.com/.well-known/openid-configuration"
+    }
+  },
+  "modules": {
+    "docs": { "files": "/pages/**/*.{md,mdx}" },
+    "landing": { "enabled": true, "path": "/", "layout": "landing" },
+    "userPanel": {
+      "enabled": true,
+      "dashboard": { "enabled": true },
+      "userManagement": { "enabled": true },
+      "plans": {
+        "enabled": true,
+        "items": [
+          {
+            "sku": "free",
+            "displayName": "Free",
+            "priceAmount": 0
+          }
+        ]
+      }
+    }
+  },
+  "apis": [{ "type": "file", "input": "./apis/openapi.yaml", "path": "api" }]
 }
 ```
 
+- **Site name / logo:** only `site.title` and `site.logo` (platform branding is derived at publish).
+- **OpenAPI path:** `backend.openApiPath` is derived from `apis[0].input`.
+- **Billing / account plans:** use `modules.userPanel.plans.enabled` and store the plan catalog in
+  `modules.userPanel.plans.items`. Legacy root `plans` is migrated on load. Legacy `pricing.enabled`
+  is migrated and stripped from site JSON; MCP/publish still receives derived `pricing.enabled`.
+- **Docs / API keys:** configure under `modules.docs` and `modules.userPanel.apiKeys` only.
+
+## Environment variables
+
+Public client URL (mirrors `authentication.apiBaseUrl`):
+
+```sh
+VITE_APITOGO_AUTHENTICATION_API_BASE_URL=https://your-dev-portal-api.example.com
+```
+
+Nested config overrides:
+
+```sh
+APITOGO_CONFIG_site__title=My Local Site
+APITOGO_CONFIG_pricing__enabled=true
+APITOGO_CONFIG_projectId=your-local-project-id
+APITOGO_CONFIG_authentication__apiBaseUrl=https://your-dev-portal-api.example.com
+```
+
+Publish secrets (`.env.local`, never commit):
+
+```sh
+APITOGO_CONFIG_authentication__oidc__authority=https://login.example.com
+APITOGO_CONFIG_authentication__oidc__clientId=your-client-id
+APITOGO_CONFIG_authentication__oidc__clientSecret=your-client-secret
+APITOGO_CONFIG_authentication__stripe__secretKey=sk_test_...
+APITOGO_CONFIG_authentication__stripe__webhookSecret=whsec_...
+```
+
 ## Thin `apitogo.config.tsx`
 
 ```tsx
@@ -77,29 +100,7 @@ export default buildApitogoConfig({
 });
 ```
 
-## What to put where
-
-| Concern | Recommended location |
-| --- | --- |
-| Plans, rate limits, `includedActionKeys` | `apitogo.config.json` |
-| Branding, site name, modules, navigation | `apitogo.config.json` |
-| Machine-specific paths, `projectId` | `.env.local` via `APITOGO_CONFIG_*` |
-| OIDC / Stripe for publish | `.env.local` via `APITOGO_CONFIG_*` |
-| Plugins | `apitogo.config.tsx` |
-
-## Hot reload
-
-During `npm run dev`, changes to `apitogo.config.json` hot-reload on `/pricing`
-without restarting the server. Restart the dev server after changing
-`VITE_APITOGO_DEV_PORTAL_API_URL` in `.env`.
-
-## Legacy manifests
-
-Older projects may still have `apitogo.json` with optional
-`apitogo.local.json` / `apitogo.prod.json` overrides. The tooling falls back to
-those files when `apitogo.config.json` is missing.
-
-## Related configuration
+## Related
 
-- Site navigation, docs, and plugins: [`apitogo.config.tsx`](./overview.md)
-- Authentication for dev-portal sites: [Authentication](./authentication.md)
+- [Authentication](./authentication.md)
+- [Overview](./overview.md)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lukoweb/apitogo",
-  "version": "0.1.51",
+  "version": "0.1.53",
   "type": "module",
   "sideEffects": [
     "**/*.css",