tenneo-auth-gateway-plugin 1.0.7

package/dist/index.d.mts

@@ -0,0 +1,626 @@
+import React from 'react';
+
+/**
+ * Public bootstrap API. Delegates to default engine.init() when set; otherwise runs runBootstrap().
+ */
+declare function bootstrap(): Promise<void>;
+
+/**
+ * Logout: idempotent, host-driven config, no fragile host_config snapshot/restore.
+ *
+ * - Watchers suspended during teardown to avoid bootstrap races
+ * - Server logout: POST only (no unsafe GET fallback)
+ * - Local state always cleared even if server fails
+ * - Storage cache refreshed from current runtime config (memory/host), never a stale snapshot
+ */
+interface LogoutResponse {
+    success?: boolean;
+    message?: string;
+    logout?: boolean;
+}
+type LogoutResult = {
+    success: boolean;
+    message: string;
+    serverResponse?: LogoutResponse;
+};
+/**
+ * Idempotent logout: coalesces concurrent calls in the same JS realm; cross-tab deduped via short lock.
+ */
+declare function logout(tenantKey?: string): Promise<LogoutResult>;
+
+/**
+ * Domain types for the authentication gateway plugin.
+ * Pure types; no I/O.
+ */
+interface TenantConfig {
+    tenantId: string;
+    authServer: string;
+    tenantKey?: string;
+    client: {
+        clientId: string;
+        clientCode?: string;
+        redirectUri: string;
+        scopes: string;
+    };
+}
+interface TokenResponse {
+    access_token: string;
+    refresh_token: string;
+    expires_in: number;
+    token_type?: string;
+}
+interface AuthState {
+    isAuthenticated: boolean;
+    accessToken: string | null;
+    isLoading: boolean;
+    error: string | null;
+}
+interface AuthContextValue extends AuthState {
+    login: () => Promise<void>;
+    logout: () => Promise<void>;
+    refreshToken: () => Promise<string>;
+    getAccessToken: () => Promise<string>;
+    setTokens: (accessToken: string) => void;
+}
+interface EnvConfig {
+    authServerUrl: string;
+    clientId: string;
+    redirectUri: string;
+    tenantId: string;
+}
+
+/**
+ * OAuth2 PKCE token exchange and refresh.
+ * Strategy-owned implementation; uses API_AUTH_BASE_URL only.
+ */
+
+declare function refreshAccessToken(): Promise<string>;
+
+/**
+ * Token API: facades for public API.
+ * ensureValidAccessToken delegates to default engine when set; otherwise uses strategy refresh.
+ */
+
+declare function ensureValidAccessToken(): Promise<string>;
+declare function getAccessToken$1(): string | null;
+
+/**
+ * Storage adapter types for enterprise-grade token and key-value storage.
+ * SSR-safe: no direct window/document usage in interface.
+ */
+/**
+ * Shape of tokens stored by the adapter (used for getTokens/setTokens).
+ */
+interface AuthTokens {
+    accessToken: string;
+    refreshToken: string;
+    expiresAt: number;
+}
+/**
+ * Token-only storage contract (spec).
+ * Implementations must be SSR-safe: avoid window/document in method bodies
+ * or guard with typeof window !== 'undefined'.
+ */
+interface TokenStorageAdapter {
+    getTokens(): Promise<AuthTokens | null>;
+    setTokens(tokens: AuthTokens): Promise<void>;
+    clearTokens(): Promise<void>;
+}
+/**
+ * Optional key-value contract for config/flow flags.
+ * When implemented, allows replacing all sessionStorage/localStorage usage
+ * with a single injected adapter. Namespacing is applied by the adapter.
+ */
+interface KeyValueStorageAdapter {
+    getItem(key: string): Promise<string | null>;
+    setItem(key: string, value: string): Promise<void>;
+    removeItem(key: string): Promise<void>;
+    clear(): Promise<void>;
+}
+/**
+ * Optional synchronous access for backward compatibility with existing sync APIs.
+ * When implemented, storage layer uses these so callers remain sync.
+ */
+interface SyncStorageAdapter {
+    getTokensSync?(): AuthTokens | null;
+    setTokensSync?(tokens: AuthTokens): void;
+    clearTokensSync?(): void;
+    getItemSync?(key: string): string | null;
+    setItemSync?(key: string, value: string): void;
+    removeItemSync?(key: string): void;
+    clearSync?(): void;
+}
+/**
+ * Full storage adapter: tokens + key-value.
+ * Default adapters implement this and SyncStorageAdapter for sync compatibility.
+ */
+type StorageAdapter = TokenStorageAdapter & KeyValueStorageAdapter & Partial<SyncStorageAdapter>;
+/**
+ * Namespace for storage keys: auth_${tenantId}_${appId}_*
+ * Used to isolate data per tenant and app (microfrontend support).
+ */
+interface StorageNamespace {
+    tenantId: string;
+    appId: string;
+}
+
+/**
+ * Storage key namespacing: auth_${tenantId}_${appId}_*
+ * Backward compatibility: when both tenantId and appId are empty, use dynamic prefix (from tenant code).
+ */
+
+/**
+ * Builds a namespaced storage key.
+ * - When tenantId and appId are both falsy: returns getStorageKeyPrefix() + suffix (tenant-code-based or default).
+ * - Otherwise: returns auth_${tenantId}_${appId}_${suffix}.
+ */
+declare function buildStorageKey(ns: StorageNamespace, suffix: string): string;
+
+/**
+ * Storage context: current adapter and namespace.
+ * Can be set via setStorageContext (legacy) or setAuthRuntime (full runtime).
+ * No window/document usage.
+ */
+
+declare function setStorageContext(adapter: StorageAdapter | null, namespace?: Partial<StorageNamespace>): void;
+declare function getStorageAdapter(): StorageAdapter | null;
+declare function getStorageNamespace(): StorageNamespace;
+
+/**
+ * In-memory storage adapter. SSR-safe; no window/document usage.
+ * Default for server-side or when no persistent storage is desired.
+ */
+
+declare function createMemoryStorageAdapter(namespace: StorageNamespace): StorageAdapter;
+
+/**
+ * Session storage adapter with namespaced keys. SSR-safe: guards all
+ * window/sessionStorage access with typeof window !== 'undefined'.
+ */
+
+declare function createSecureSessionStorageAdapter(namespace: StorageNamespace): StorageAdapter;
+
+/**
+ * Cookie-based storage adapter (HttpOnly-compatible abstraction).
+ * Tokens are stored in cookies; config/flow flags use cookies or fallback.
+ * SSR-safe: all document/window access guarded with typeof window !== 'undefined'.
+ *
+ * Note: True HttpOnly cookies must be set by the server. This adapter uses
+ * document.cookie for client-readable tokens when running in the browser,
+ * and can be replaced by a server-backed implementation for HttpOnly.
+ */
+
+declare function createCookieStorageAdapter(namespace: StorageNamespace, options?: {
+    cookiePrefix?: string;
+}): StorageAdapter;
+
+/**
+ * Storage API: adapter-based get/set/clear. No direct window/sessionStorage.
+ * Keys use dynamic prefix from tenant code (see prefix.ts).
+ */
+
+declare function getAccessToken(): string | null;
+declare function isAccessTokenExpired(): boolean;
+
+declare function useAuthContext(): AuthContextValue;
+
+/**
+ * Configuration types.
+ *
+ * There is no "internal vs runtime" config anymore.
+ * Everything is provided by the host app via `AuthProvider` props / `setConfig()`.
+ */
+interface SDKConfig {
+    /** Tenant resolution service base URL. */
+    apiBaseUrl?: string;
+    /** Auth API base URL (token exchange/refresh/logout). */
+    apiAuthBaseUrl?: string;
+    /** Authorization server base URL (OIDC authorize endpoint). */
+    authServerUrl?: string;
+    /** Callback/redirect URL (full URL). */
+    callbackUrl?: string;
+    /** Alias some hosts use for OAuth redirect URI (same as callbackUrl). */
+    redirectUri?: string;
+    /** Optional tenant code/key (used for tenant resolution). */
+    tenantCode?: string;
+    tenantKey?: string;
+    /** Optional app identifier (storage namespacing). */
+    appId?: string;
+    /** Optional runtime identifiers (may be returned from tenant API). */
+    clientId?: string;
+    tenantId?: string;
+    clientCode?: string;
+    /** Optional UI/runtime overrides. */
+    basePath?: string;
+}
+type HostConfigOverride = SDKConfig;
+interface ResolvedConfig {
+    apiBaseUrl: string;
+    authServerUrl: string;
+    callbackUrl: string;
+    clientCode: string;
+    tenantCode: string;
+    appId: string;
+    /** OAuth client id (may match clientCode / public client). */
+    clientId: string;
+    /** Tenant id from tenant resolution API when available. */
+    tenantId: string;
+}
+
+/**
+ * Host-aware config resolution: memory → host bridge (window / provider) → storage cache (fallback).
+ * Does not import application/storage barrel to avoid circular deps — uses storage/kv only.
+ */
+
+type ConfigLayerSource = 'override' | 'memory' | 'host_bridge' | 'storage_cache';
+declare global {
+    interface Window {
+        /** Optional host-injected auth config (runtime). Lowest priority vs setConfig memory, above storage cache. */
+        __TENNEO_AUTH_HOST__?: Partial<SDKConfig>;
+    }
+}
+declare function setConfig(overrides: HostConfigOverride): void;
+declare function setHostConfigProvider(fn: (() => Partial<SDKConfig> | null | undefined) | null): void;
+interface FieldSourceMap {
+    tenantCode?: ConfigLayerSource;
+    tenantKey?: ConfigLayerSource;
+    apiBaseUrl?: ConfigLayerSource;
+    authServerUrl?: ConfigLayerSource;
+    callbackUrl?: ConfigLayerSource;
+    clientCode?: ConfigLayerSource;
+    clientId?: ConfigLayerSource;
+    tenantId?: ConfigLayerSource;
+    appId?: ConfigLayerSource;
+}
+/**
+ * Per-field source for debugging (first layer that supplied a non-empty value).
+ */
+declare function getConfigFieldSources(overrides?: HostConfigOverride): FieldSourceMap;
+declare function getEffectiveTenantCode(overrides?: HostConfigOverride): string;
+/** @alias getEffectiveTenantCode — tenant_key / tenant_code / clientCode from resolved config */
+declare const getEffectiveTenantKey: typeof getEffectiveTenantCode;
+interface GetAuthConfigOptions {
+    /** When true, throws if required OAuth / tenant fields are missing. */
+    strict?: boolean;
+    overrides?: HostConfigOverride;
+}
+declare class AuthConfigError extends Error {
+    readonly code = "AUTH_CONFIG_MISSING";
+    readonly missing: string[];
+    constructor(missing: string[], message?: string);
+}
+declare function resolveConfig(overrides?: HostConfigOverride): ResolvedConfig;
+/**
+ * Persist a non-authoritative copy for early readers (bootstrap before React).
+ * Never use as sole source of truth — memory/host win at resolve time.
+ */
+/**
+ * After logout or host-driven updates: persist a cache snapshot from current resolved SDK config (non-empty fields only).
+ */
+declare function syncHostConfigCacheFromMemory(): void;
+declare function writeHostConfigCache(partial: HostConfigOverride): void;
+/**
+ * Host entrypoint: merge into memory and optionally refresh storage cache.
+ */
+declare function initPlugin(config: HostConfigOverride, opts?: {
+    syncStorageCache?: boolean;
+}): void;
+declare function logConfigResolutionDebug(context: string, overrides?: HostConfigOverride): void;
+
+/**
+ * OAuth constants and storage keys. No config resolution — pure constants.
+ */
+declare const OAUTH_CONSTANTS: {
+    readonly SCOPES: "openid profile email";
+    readonly RESPONSE_TYPE: "code";
+    readonly CODE_CHALLENGE_METHOD: "S256";
+    readonly TOKEN_GRANT_TYPE: "authorization_code";
+    readonly REFRESH_GRANT_TYPE: "refresh_token";
+};
+declare const STORAGE_KEY_PREFIX = "tenneo_auth_";
+declare const STORAGE_KEYS: {
+    readonly authServerUrl: "tenneo_auth_auth_server_url";
+    readonly clientId: "tenneo_auth_client_id";
+    readonly redirectUri: "tenneo_auth_redirect_uri";
+    readonly tenantId: "tenneo_auth_tenant_id";
+    readonly codeVerifier: "tenneo_auth_code_verifier";
+    readonly state: "tenneo_auth_state";
+    readonly accessToken: "tenneo_auth_access_token";
+    readonly refreshToken: "tenneo_auth_refresh_token";
+    readonly expiresAt: "tenneo_auth_expires_at";
+};
+
+/** Resolved config; pass `{ strict: true }` to fail fast if OAuth fields are missing. */
+declare function getAuthConfig(options?: GetAuthConfigOptions): ResolvedConfig;
+/** Fail fast when authServerUrl, callbackUrl, or tenant are missing. */
+declare function requireAuthConfig(overrides?: HostConfigOverride): ResolvedConfig;
+declare function getConfig(): ResolvedConfig;
+declare const Config: {
+    readonly getApiBaseUrl: () => string;
+    readonly getAuthServerUrl: () => string;
+    readonly getClientCode: () => string;
+    readonly getRedirectUri: () => string;
+    readonly getAll: () => ResolvedConfig;
+};
+/**
+ * Apply tenant switch in runtime config (memory + optional cache). Does not read stale snapshots.
+ */
+declare function applyRuntimeTenantSwitch(tenantKey: string, opts?: {
+    syncStorageCache?: boolean;
+}): void;
+
+/**
+ * React Context Provider for authentication state (FINAL)
+ */
+
+interface AuthProviderProps {
+    children: React.ReactNode;
+    autoInit?: boolean;
+    /** Optional config object from host app (alternative to passing individual props). */
+    config?: SDKConfig;
+    /** Tenant code from host app (used to resolve tenant via GET /api/tenant/v1/public/tenants/by-code/{tenantCode}). */
+    tenantCode?: string;
+    /** Tenant resolution base URL (host app). */
+    apiBaseUrl?: string;
+    /** Authorization server URL (host app). */
+    authServerUrl?: string;
+    /** Callback/redirect URL (host app). */
+    callbackUrl?: string;
+    /** App id for storage namespacing (auth_${tenantId}_${appId}_*). */
+    appId?: string;
+    /** Optional storage adapter; default is SecureSessionStorageAdapter with namespacing. */
+    storageAdapter?: StorageAdapter | null;
+}
+/**
+ * AuthProvider – UI-facing auth state only
+ */
+declare function AuthProvider({ children, autoInit, config, tenantCode, apiBaseUrl, authServerUrl, callbackUrl, appId, storageAdapter, }: AuthProviderProps): React.JSX.Element;
+
+interface AuthCallbackProps {
+    loginPath?: string;
+    successPath?: string;
+    homePath?: string;
+}
+declare function AuthCallback({ loginPath, successPath, homePath, }: AuthCallbackProps): React.JSX.Element;
+
+interface ProtectedRouteProps {
+    children: React.ReactNode;
+    fallback?: React.ReactNode;
+    autoLogin?: boolean;
+}
+declare function ProtectedRoute({ children, fallback, autoLogin, }: ProtectedRouteProps): React.JSX.Element;
+
+/**
+ * useAuth hook for accessing authentication state and methods
+ */
+
+/**
+ * Hook to access authentication state and methods
+ * @returns Authentication context value
+ */
+declare function useAuth(): AuthContextValue;
+
+/**
+ * useAuthInit hook
+ *
+ * RULES:
+ * - Only prevents parallel init calls
+ * - Does NOT block based on flags (bootstrap handles that)
+ */
+interface UseAuthInitResult {
+    isLoading: boolean;
+    error: string | null;
+    init: () => Promise<void>;
+}
+declare function useAuthInit(): UseAuthInitResult;
+
+/**
+ * Framework-agnostic runtime interfaces for the auth core.
+ * No React, window, or document dependencies.
+ */
+
+/** Current URL snapshot (replaces direct window.location usage in core). */
+interface CurrentUrl {
+    href: string;
+    origin: string;
+    pathname: string;
+    search: string;
+    hostname: string;
+}
+/** Logger interface – no console in core. */
+interface Logger {
+    info(message: string, meta?: Record<string, unknown>): void;
+    warn(message: string, meta?: Record<string, unknown>): void;
+    error(message: string, meta?: Record<string, unknown>): void;
+    debug(message: string, meta?: Record<string, unknown>): void;
+}
+/** URL and navigation – replaces window.location / window.history in core. */
+interface UrlProvider {
+    getCurrentUrl(): CurrentUrl;
+    /** Full redirect (e.g. window.location.replace). */
+    redirect(url: string): void;
+    /** Soft replace (e.g. history.replaceState) without reload. */
+    replaceState(url: string): void;
+}
+/** Configuration – replaces direct Config / window.__APP_CONFIG__ in core. */
+interface ConfigProvider {
+    getApiBaseUrl(): string;
+    getAuthServerUrl(): string;
+    getRedirectUri(): string;
+    getClientCode(): string;
+}
+/** Tenant resolution – replaces direct tenant API usage in core. */
+interface TenantResolver {
+    resolve(tenantKey: string): Promise<TenantConfig | null>;
+}
+/** Optional: clear cookies (e.g. on logout). Called by core when provided. */
+interface CookieClearer {
+    clearCookies(): void;
+}
+/**
+ * Auth runtime: all external dependencies injected.
+ * Core uses only this; no direct browser or framework APIs.
+ */
+interface AuthRuntime {
+    /** Required. Token + key-value storage. */
+    storageAdapter: StorageAdapter;
+    storageNamespace: StorageNamespace;
+    /** Required. No console.log in core. */
+    logger: Logger;
+    /** Required for redirects and URL checks. */
+    urlProvider: UrlProvider;
+    /** Required for OAuth and tenant config. */
+    configProvider: ConfigProvider;
+    /** Required for resolving tenant by key. */
+    tenantResolver: TenantResolver;
+    /** Optional. If not set, core will not clear cookies on logout. */
+    clearCookies?: CookieClearer;
+}
+
+/**
+ * Runtime context: single get/set for auth runtime.
+ * Core reads from here; host (e.g. React layer) sets before any core code runs.
+ */
+
+declare function setAuthRuntime(runtime: AuthRuntime | null): void;
+declare function getAuthRuntime(): AuthRuntime | null;
+
+/**
+ * Auth strategy interface for pluggable authentication.
+ * Engine and bootstrap depend on this interface, not concrete OAuth2 PKCE.
+ */
+
+interface AuthStrategy {
+    /** Start the auth flow (e.g. redirect to IdP). */
+    initiate(tenantConfig: TenantConfig): Promise<void>;
+    /** Handle OAuth callback (code exchange). Returns true if callback was handled. */
+    handleCallback(): Promise<boolean>;
+    /** Refresh access token. Returns new access token or throws. */
+    refresh(): Promise<string>;
+    /** Log out and clear session. */
+    logout(options?: {
+        tenantKey?: string;
+    }): Promise<void>;
+}
+
+/**
+ * Auth engine types. No React, no browser globals.
+ */
+
+type AuthEngineConfig = AuthRuntime & {
+    strategy?: AuthStrategy;
+};
+interface AuthEngineState {
+    status: 'idle' | 'loading' | 'authenticated' | 'unauthenticated' | 'error';
+    accessToken: string | null;
+    expiresAt: number | null;
+    error: string | null;
+}
+type AuthStateListener = (state: AuthEngineState) => void;
+type Unsubscribe = () => void;
+interface AuthEngine {
+    init(): Promise<void>;
+    login(): Promise<void>;
+    logout(options?: {
+        tenantKey?: string;
+    }): Promise<void>;
+    refresh(): Promise<string>;
+    getAccessToken(): Promise<string>;
+    handleCallback(): Promise<boolean>;
+    subscribe(listener: AuthStateListener): Unsubscribe;
+    getState(): AuthEngineState;
+}
+
+/**
+ * Creates the auth engine. No React, no direct browser usage.
+ */
+
+declare function createAuthEngine(config: AuthEngineConfig): AuthEngine;
+
+/**
+ * OAuth2 PKCE implementation of AuthStrategy.
+ * Wraps initiateAuthFlow, handleCallback, refreshAccessToken, and logout.
+ */
+
+declare function createOAuth2PkceStrategy(): AuthStrategy;
+
+/**
+ * Runtime-backed facade for domain tenant/callback helpers.
+ * Provides extractTenantKey(), isCallbackUrl(), isLocalhost() for public API and internal use.
+ * Uses runtime when set; falls back to window for backward compatibility.
+ */
+
+declare function extractTenantKey(): string | null;
+declare function isCallbackUrl(): boolean;
+
+/**
+ * Tenant resolution API client.
+ * Resolves tenant configuration via GET /api/tenant/v1/public/tenants/by-code/{tenantCode}.
+ */
+
+declare function resolveTenant(tenantKey: string): Promise<TenantConfig | null>;
+
+/**
+ * Security and error utilities for authentication.
+ * Domain layer: sanitized errors and HTTPS enforcement.
+ */
+declare function enforceHttps(allowLocalhost?: boolean): void;
+declare function sanitizeErrorMessage(error: unknown, genericMessage: string): string;
+declare class SanitizedError extends Error {
+    readonly code: string;
+    readonly originalMessage?: string;
+    constructor(code: string, genericMessage: string, originalError?: unknown);
+}
+
+/**
+ * Cookie watcher to detect cookie deletion and clear session.
+ * Infrastructure layer: uses storage and callback; application sets callback to bootstrap.
+ */
+declare function startCookieWatcher(): void;
+declare function stopCookieWatcher(): void;
+declare function resetCookieWatcher(): void;
+
+/**
+ * Storage watcher to detect manual storage clears and restart auth flow.
+ * Infrastructure layer: uses storage and callback; application sets callback to bootstrap.
+ */
+declare function startStorageWatcher(): void;
+declare function stopStorageWatcher(): void;
+
+/**
+ * Suppress watcher side effects during intentional auth teardown (e.g. logout).
+ * Deterministic: set before storage/cookie mutation, clear after cleanup completes.
+ */
+declare function suspendWatchers(): number;
+declare function resumeWatchers(expectedGen?: number): void;
+declare function areWatchersSuspended(): boolean;
+
+/**
+ * Structured auth event emitter for observability and audit.
+ */
+declare const AuthEventNames: {
+    readonly LOGIN_STARTED: "LOGIN_STARTED";
+    readonly LOGIN_SUCCESS: "LOGIN_SUCCESS";
+    readonly LOGIN_FAILED: "LOGIN_FAILED";
+    readonly CALLBACK_SUCCESS: "CALLBACK_SUCCESS";
+    readonly CALLBACK_FAILED: "CALLBACK_FAILED";
+    readonly TOKEN_REFRESH_SUCCESS: "TOKEN_REFRESH_SUCCESS";
+    readonly TOKEN_REFRESH_FAILED: "TOKEN_REFRESH_FAILED";
+    readonly TENANT_SWITCHED: "TENANT_SWITCHED";
+    readonly LOGOUT_COMPLETED: "LOGOUT_COMPLETED";
+    readonly BOOTSTRAP_STATE_DETECTED: "BOOTSTRAP_STATE_DETECTED";
+    readonly REDIRECT_LOOP_RISK: "REDIRECT_LOOP_RISK";
+};
+type AuthEventName = (typeof AuthEventNames)[keyof typeof AuthEventNames];
+interface AuthEventPayload {
+    state?: string;
+    tenantKey?: string;
+    error?: string;
+    message?: string;
+    [key: string]: unknown;
+}
+type AuthEventHandler = (payload?: AuthEventPayload) => void;
+declare function emitAuthEvent(event: AuthEventName, payload?: AuthEventPayload): void;
+declare function subscribeAuthEvent(event: AuthEventName | '*', handler: AuthEventHandler): () => void;
+
+export { AuthCallback, AuthConfigError, type AuthContextValue, type AuthEngine, type AuthEngineConfig, type AuthEngineState, type AuthEventHandler, type AuthEventName, AuthEventNames, type AuthEventPayload, AuthProvider, type AuthRuntime, type AuthState, type AuthStateListener, type AuthStrategy, type AuthTokens, Config, type ConfigLayerSource, type ConfigProvider, type CookieClearer, type CurrentUrl, type EnvConfig, type FieldSourceMap, type GetAuthConfigOptions, type HostConfigOverride, type Logger, OAUTH_CONSTANTS, ProtectedRoute, type ResolvedConfig, type SDKConfig, STORAGE_KEYS, STORAGE_KEY_PREFIX, SanitizedError, type StorageAdapter, type StorageNamespace, type TenantConfig, type TenantResolver, type TokenResponse, type TokenStorageAdapter, type Unsubscribe, type UrlProvider, applyRuntimeTenantSwitch, areWatchersSuspended, bootstrap, buildStorageKey, createAuthEngine, createCookieStorageAdapter, createMemoryStorageAdapter, createOAuth2PkceStrategy, createSecureSessionStorageAdapter, emitAuthEvent, enforceHttps, ensureValidAccessToken, extractTenantKey, getAccessToken$1 as getAccessToken, getAuthConfig, getAuthRuntime, getConfig, getConfigFieldSources, getEffectiveTenantCode, getEffectiveTenantKey, getStorageAdapter, getStorageNamespace, getAccessToken as getStoredAccessToken, initPlugin, isAccessTokenExpired, isCallbackUrl, logConfigResolutionDebug, logout, refreshAccessToken, requireAuthConfig, resetCookieWatcher, resolveConfig, resolveTenant, resumeWatchers, sanitizeErrorMessage, setAuthRuntime, setConfig, setHostConfigProvider, setStorageContext, startCookieWatcher, startStorageWatcher, stopCookieWatcher, stopStorageWatcher, subscribeAuthEvent, suspendWatchers, syncHostConfigCacheFromMemory, useAuth, useAuthContext, useAuthInit, writeHostConfigCache };