tenneo-auth-plugin 0.1.8 → 0.1.10

package/README.md

@@ -129,8 +129,7 @@ function App() {
 - Pluggable storage adapters (session, cookie, memory)
 - Authentication event system for observability
 - Strict TypeScript definitions throughout
-- Runtime configuration override support
-- Window-based configuration injection
+- Host-driven configuration (props / `setConfig()`)
 - Clean layered architecture
 - Tree-shakeable ESM and CJS builds
 - React 18+ compatibility
@@ -139,7 +138,11 @@ function App() {
 
 | Prop | Type | Required | Default | Description |
 |------|------|----------|---------|-------------|
+| `config` | `SDKConfig` | No | - | Pass all configuration as a single object (alternative to individual props) |
 | `tenantCode` | `string` | No | - | Tenant code for configuration resolution |
+| `apiBaseUrl` | `string` | Yes | - | Tenant resolution service base URL |
+| `authServerUrl` | `string` | Yes | - | Authorization server base URL (OIDC authorize) |
+| `callbackUrl` | `string` | Yes | - | Full callback/redirect URL |
 | `appId` | `string` | No | `''` | Application identifier for storage namespacing |
 | `autoInit` | `boolean` | No | `true` | Automatically initialize authentication on mount |
 | `storageAdapter` | `StorageAdapter` | No | `null` | Custom storage adapter instance |
@@ -276,62 +279,39 @@ const token = await engine.getAccessToken();
 
 ## Configuration
 
-### Environment Variables
+### Host app configuration (required)
 
-Configure the plugin using environment variables. For Vite applications, use the `VITE_` prefix.
+This SDK does **not** read `.env` or `window.__AUTH_CONFIG__`. Provide configuration from your host app:
 
-```env
-# OAuth Server URL
-VITE_AUTH_SERVER_URL=https://auth.example.com
-
-# API Base URLs
-VITE_API_TENANT_RESOLUTION_BASE_URL=https://api.example.com/api/v1
-VITE_API_AUTH_BASE_URL=https://auth.example.com
-
-# Default Configuration
-VITE_CLIENT_ID=your-client-id
-VITE_TENANT_ID=your-tenant-id
-VITE_CLIENTCODE=your-tenant-code
-```
-
-### Window Runtime Configuration
-
-Inject configuration at runtime without rebuilding the application.
+```tsx
+import { AuthProvider } from 'tenneo-auth-plugin';
 
-```html
-<script>
-  window.__AUTH_CONFIG__ = {
-    clientId: 'runtime-client-id',
-    tenantId: 'runtime-tenant-id',
-    basePath: '/app',
-  };
-</script>
+<AuthProvider
+  tenantCode="your-tenant-code"
+  apiBaseUrl="https://tenant-service.example.com"
+  authServerUrl="https://auth.example.com"
+  callbackUrl="https://app.example.com/callback"
+  appId="myapp"
+>
+  <App />
+</AuthProvider>
 ```
 
-### Configuration Priority
-
-Configuration is resolved in the following order (highest priority first):
-
-1. Props passed to AuthProvider
-2. Window configuration (`window.__AUTH_CONFIG__`)
-3. Environment variables
-4. Built-in defaults
-
 ### Programmatic Configuration
 
 ```tsx
 import { setConfig, Config } from 'tenneo-auth-plugin';
 
-// Override configuration
+// Override configuration (host-driven)
 setConfig({
-  clientId: 'custom-client-id',
-  tenantId: 'custom-tenant-id',
-  basePath: '/my-app',
+  tenantCode: 'your-tenant-code',
+  apiBaseUrl: 'https://tenant-service.example.com',
+  authServerUrl: 'https://auth.example.com',
+  callbackUrl: 'https://app.example.com/callback',
 });
 
 // Access resolved configuration
 const authServerUrl = Config.getAuthServerUrl();
-const clientId = Config.getClientId();
 const allConfig = Config.getAll();
 ```
 
@@ -420,13 +400,11 @@ import type {
   TokenResponse,
   AuthState,
   AuthContextValue,
-  EnvConfig,
   AuthTokens,
   StorageAdapter,
   AuthEngine,
   AuthEngineState,
   SDKConfig,
-  RuntimeConfigOverrides,
 } from 'tenneo-auth-plugin';
 ```
 

package/dist/index.d.mts

@@ -206,6 +206,80 @@ declare function isAccessTokenExpired(): boolean;
 
 declare function useAuthContext(): AuthContextValue;
 
+/**
+ * Configuration types.
+ *
+ * There is no "internal vs runtime" config anymore.
+ * Everything is provided by the host app via `AuthProvider` props / `setConfig()`.
+ */
+interface SDKConfig {
+    /** Tenant resolution service base URL. */
+    apiBaseUrl?: string;
+    /** Auth API base URL (token exchange/refresh/logout). */
+    apiAuthBaseUrl?: string;
+    /** Authorization server base URL (OIDC authorize endpoint). */
+    authServerUrl?: string;
+    /** Callback/redirect URL (full URL). */
+    callbackUrl?: string;
+    /** Optional tenant code/key (used for tenant resolution). */
+    tenantCode?: string;
+    /** Optional runtime identifiers (may be returned from tenant API). */
+    clientId?: string;
+    tenantId?: string;
+    clientCode?: string;
+    /** Optional UI/runtime overrides. */
+    basePath?: string;
+}
+type HostConfigOverride = SDKConfig;
+interface ResolvedConfig {
+    apiBaseUrl: string;
+    authServerUrl: string;
+    callbackUrl: string;
+    clientCode: string;
+}
+type ResolvedHostConfig = ResolvedConfig;
+
+/**
+ * OAuth constants and storage keys. No config resolution — pure constants.
+ */
+declare const OAUTH_CONSTANTS: {
+    readonly SCOPES: "openid profile email";
+    readonly RESPONSE_TYPE: "code";
+    readonly CODE_CHALLENGE_METHOD: "S256";
+    readonly TOKEN_GRANT_TYPE: "authorization_code";
+    readonly REFRESH_GRANT_TYPE: "refresh_token";
+};
+declare const STORAGE_KEY_PREFIX = "tenneo_auth_";
+declare const STORAGE_KEYS: {
+    readonly authServerUrl: "tenneo_auth_auth_server_url";
+    readonly clientId: "tenneo_auth_client_id";
+    readonly redirectUri: "tenneo_auth_redirect_uri";
+    readonly tenantId: "tenneo_auth_tenant_id";
+    readonly codeVerifier: "tenneo_auth_code_verifier";
+    readonly state: "tenneo_auth_state";
+    readonly accessToken: "tenneo_auth_access_token";
+    readonly refreshToken: "tenneo_auth_refresh_token";
+    readonly expiresAt: "tenneo_auth_expires_at";
+};
+
+/**
+ * Config: minimal host-driven config store + facade.
+ *
+ * No "internal" or "runtime" config separation.
+ * Everything comes from the host app via `setConfig()` / `AuthProvider` props.
+ */
+
+declare function resolveConfig(overrides?: HostConfigOverride): ResolvedConfig;
+declare function getConfig(): ResolvedConfig;
+declare function setConfig(overrides: HostConfigOverride): void;
+declare const Config: {
+    readonly getApiBaseUrl: () => string;
+    readonly getAuthServerUrl: () => string;
+    readonly getClientCode: () => string;
+    readonly getRedirectUri: () => string;
+    readonly getAll: () => ResolvedHostConfig;
+};
+
 /**
  * React Context Provider for authentication state (FINAL)
  */
@@ -213,8 +287,16 @@ declare function useAuthContext(): AuthContextValue;
 interface AuthProviderProps {
     children: React.ReactNode;
     autoInit?: boolean;
+    /** Optional config object from host app (alternative to passing individual props). */
+    config?: SDKConfig;
     /** Tenant code from host app (used to resolve tenant via GET /api/tenant/v1/public/tenants/by-code/{tenantCode}). */
     tenantCode?: string;
+    /** Tenant resolution base URL (host app). */
+    apiBaseUrl?: string;
+    /** Authorization server URL (host app). */
+    authServerUrl?: string;
+    /** Callback/redirect URL (host app). */
+    callbackUrl?: string;
     /** App id for storage namespacing (auth_${tenantId}_${appId}_*). */
     appId?: string;
     /** Optional storage adapter; default is SecureSessionStorageAdapter with namespacing. */
@@ -223,7 +305,7 @@ interface AuthProviderProps {
 /**
  * AuthProvider – UI-facing auth state only
  */
-declare function AuthProvider({ children, autoInit, tenantCode, appId, storageAdapter, }: AuthProviderProps): React.JSX.Element;
+declare function AuthProvider({ children, autoInit, config, tenantCode, apiBaseUrl, authServerUrl, callbackUrl, appId, storageAdapter, }: AuthProviderProps): React.JSX.Element;
 
 interface AuthCallbackProps {
     loginPath?: string;
@@ -296,10 +378,7 @@ interface ConfigProvider {
     getApiBaseUrl(): string;
     getAuthServerUrl(): string;
     getRedirectUri(): string;
-    getClientId(): string;
-    getTenantId(): string;
     getClientCode(): string;
-    getBasePath(): string;
 }
 /** Tenant resolution – replaces direct tenant API usage in core. */
 interface TenantResolver {
@@ -412,111 +491,6 @@ declare function isCallbackUrl(): boolean;
 
 declare function resolveTenant(tenantKey: string): Promise<TenantConfig | null>;
 
-/**
- * Configuration types.
- * Internal: non-overridable (from .env). Runtime: overridable (env + window + setConfig).
- *
- * BASE URL SEPARATION (mandatory — do not mix):
- * - API_TENANT_RESOLUTION_BASE_URL: Tenant resolution only.
- * - API_AUTH_BASE_URL: Token operations only (exchange, refresh, logout).
- * - AUTH_SERVER_URL: OpenID Connect authorization redirect only.
- */
-interface InternalConfig {
-    API_TENANT_RESOLUTION_BASE_URL: string;
-    API_AUTH_BASE_URL: string;
-    AUTH_SERVER_URL: string;
-    DEFAULT_DOMAIN: string;
-}
-/** Single source of truth: .env (VITE_CLIENT_ID, VITE_TENANT_ID, VITE_CLIENTCODE). */
-interface RuntimeConfig {
-    CLIENT_ID: string;
-    TENANT_ID: string;
-    CLIENTCODE: string;
-}
-type ResolvedConfig = InternalConfig & RuntimeConfig;
-type SDKConfig = ResolvedConfig;
-interface RuntimeConfigOverrides {
-    basePath?: string;
-    redirectUri?: string;
-}
-type HostConfigOverride = Partial<RuntimeConfig> & Partial<RuntimeConfigOverrides>;
-/** Window __APP_CONFIG__ / __AUTH_CONFIG__ shape (clientId, tenantId, clientcode only). */
-interface HostRuntimeConfig {
-    clientId?: string;
-    tenantId?: string;
-    clientcode?: string;
-}
-/** Full resolved config output (internal URLs + runtime + derived redirectUri, basePath). */
-interface ResolvedHostConfig {
-    apiTenantResolutionBaseUrl: string;
-    apiAuthBaseUrl: string;
-    authServerUrl: string;
-    defaultDomain: string;
-    clientId: string;
-    tenantId: string;
-    clientCode: string;
-    redirectUri: string;
-    basePath: string;
-}
-
-/**
- * OAuth constants and storage keys. No config resolution — pure constants.
- */
-declare const OAUTH_CONSTANTS: {
-    readonly SCOPES: "openid profile email";
-    readonly RESPONSE_TYPE: "code";
-    readonly CODE_CHALLENGE_METHOD: "S256";
-    readonly TOKEN_GRANT_TYPE: "authorization_code";
-    readonly REFRESH_GRANT_TYPE: "refresh_token";
-};
-declare const STORAGE_KEY_PREFIX = "tenneo_auth_";
-declare const STORAGE_KEYS: {
-    readonly authServerUrl: "tenneo_auth_auth_server_url";
-    readonly clientId: "tenneo_auth_client_id";
-    readonly redirectUri: "tenneo_auth_redirect_uri";
-    readonly tenantId: "tenneo_auth_tenant_id";
-    readonly codeVerifier: "tenneo_auth_code_verifier";
-    readonly state: "tenneo_auth_state";
-    readonly accessToken: "tenneo_auth_access_token";
-    readonly refreshToken: "tenneo_auth_refresh_token";
-    readonly expiresAt: "tenneo_auth_expires_at";
-};
-
-/**
- * Config: resolver + public Config facade.
- * Resolution order: runtime overrides > window > env > defaults.
- * Single source of truth: .env (see .env.example).
- */
-
-declare global {
-    interface Window {
-        __APP_CONFIG__?: HostRuntimeConfig | {
-            [key: string]: unknown;
-        };
-        __AUTH_CONFIG__?: HostRuntimeConfig | {
-            [key: string]: unknown;
-        };
-    }
-}
-declare function resolveConfig(overrides?: HostConfigOverride): InternalConfig & RuntimeConfig;
-declare function getConfig(): InternalConfig & RuntimeConfig;
-declare function setConfig(overrides: HostConfigOverride): void;
-declare const Config: {
-    readonly getApiTenantResolutionBaseUrl: () => string;
-    readonly getApiAuthBaseUrl: () => string;
-    readonly getAuthServerUrl: () => string;
-    readonly getDefaultDomain: () => string;
-    readonly getClientId: () => string;
-    readonly getTenantId: () => string;
-    readonly getClientCode: () => string;
-    readonly getRedirectUri: () => string;
-    readonly getBasePath: () => string;
-    readonly hasRuntimeConfig: () => boolean;
-    readonly getAll: () => ResolvedHostConfig;
-};
-declare function getEnvConfig(): Promise<EnvConfig | null>;
-declare function hasEnvFallback(): boolean;
-
 /**
  * Security and error utilities for authentication.
  * Domain layer: sanitized errors and HTTPS enforcement.
@@ -565,4 +539,4 @@ type AuthEventHandler = (payload?: AuthEventPayload) => void;
 declare function emitAuthEvent(event: AuthEventName, payload?: AuthEventPayload): void;
 declare function subscribeAuthEvent(event: AuthEventName | '*', handler: AuthEventHandler): () => void;
 
-export { AuthCallback, type AuthContextValue, type AuthEngine, type AuthEngineConfig, type AuthEngineState, type AuthEventHandler, type AuthEventName, AuthEventNames, type AuthEventPayload, AuthProvider, type AuthRuntime, type AuthState, type AuthStateListener, type AuthStrategy, type AuthTokens, Config, type ConfigProvider, type CookieClearer, type CurrentUrl, type EnvConfig, type HostConfigOverride, type InternalConfig, type Logger, OAUTH_CONSTANTS, ProtectedRoute, type ResolvedConfig, type RuntimeConfigOverrides, type SDKConfig, type RuntimeConfig as SDKRuntimeConfig, STORAGE_KEYS, STORAGE_KEY_PREFIX, SanitizedError, type StorageAdapter, type StorageNamespace, type TenantConfig, type TenantResolver, type TokenResponse, type TokenStorageAdapter, type Unsubscribe, type UrlProvider, bootstrap, buildStorageKey, createAuthEngine, createCookieStorageAdapter, createMemoryStorageAdapter, createOAuth2PkceStrategy, createSecureSessionStorageAdapter, emitAuthEvent, enforceHttps, ensureValidAccessToken, extractTenantKey, getAccessToken$1 as getAccessToken, getAuthRuntime, getConfig, getEnvConfig, getStorageAdapter, getStorageNamespace, getAccessToken as getStoredAccessToken, hasEnvFallback, isAccessTokenExpired, isCallbackUrl, logout, refreshAccessToken, resetCookieWatcher, resolveConfig, resolveTenant, sanitizeErrorMessage, setAuthRuntime, setConfig, setStorageContext, startCookieWatcher, stopCookieWatcher, subscribeAuthEvent, useAuth, useAuthContext, useAuthInit };
+export { AuthCallback, type AuthContextValue, type AuthEngine, type AuthEngineConfig, type AuthEngineState, type AuthEventHandler, type AuthEventName, AuthEventNames, type AuthEventPayload, AuthProvider, type AuthRuntime, type AuthState, type AuthStateListener, type AuthStrategy, type AuthTokens, Config, type ConfigProvider, type CookieClearer, type CurrentUrl, type EnvConfig, type HostConfigOverride, type Logger, OAUTH_CONSTANTS, ProtectedRoute, type ResolvedConfig, type SDKConfig, STORAGE_KEYS, STORAGE_KEY_PREFIX, SanitizedError, type StorageAdapter, type StorageNamespace, type TenantConfig, type TenantResolver, type TokenResponse, type TokenStorageAdapter, type Unsubscribe, type UrlProvider, bootstrap, buildStorageKey, createAuthEngine, createCookieStorageAdapter, createMemoryStorageAdapter, createOAuth2PkceStrategy, createSecureSessionStorageAdapter, emitAuthEvent, enforceHttps, ensureValidAccessToken, extractTenantKey, getAccessToken$1 as getAccessToken, getAuthRuntime, getConfig, getStorageAdapter, getStorageNamespace, getAccessToken as getStoredAccessToken, isAccessTokenExpired, isCallbackUrl, logout, refreshAccessToken, resetCookieWatcher, resolveConfig, resolveTenant, sanitizeErrorMessage, setAuthRuntime, setConfig, setStorageContext, startCookieWatcher, stopCookieWatcher, subscribeAuthEvent, useAuth, useAuthContext, useAuthInit };

package/dist/index.d.ts

@@ -206,6 +206,80 @@ declare function isAccessTokenExpired(): boolean;
 
 declare function useAuthContext(): AuthContextValue;
 
+/**
+ * Configuration types.
+ *
+ * There is no "internal vs runtime" config anymore.
+ * Everything is provided by the host app via `AuthProvider` props / `setConfig()`.
+ */
+interface SDKConfig {
+    /** Tenant resolution service base URL. */
+    apiBaseUrl?: string;
+    /** Auth API base URL (token exchange/refresh/logout). */
+    apiAuthBaseUrl?: string;
+    /** Authorization server base URL (OIDC authorize endpoint). */
+    authServerUrl?: string;
+    /** Callback/redirect URL (full URL). */
+    callbackUrl?: string;
+    /** Optional tenant code/key (used for tenant resolution). */
+    tenantCode?: string;
+    /** Optional runtime identifiers (may be returned from tenant API). */
+    clientId?: string;
+    tenantId?: string;
+    clientCode?: string;
+    /** Optional UI/runtime overrides. */
+    basePath?: string;
+}
+type HostConfigOverride = SDKConfig;
+interface ResolvedConfig {
+    apiBaseUrl: string;
+    authServerUrl: string;
+    callbackUrl: string;
+    clientCode: string;
+}
+type ResolvedHostConfig = ResolvedConfig;
+
+/**
+ * OAuth constants and storage keys. No config resolution — pure constants.
+ */
+declare const OAUTH_CONSTANTS: {
+    readonly SCOPES: "openid profile email";
+    readonly RESPONSE_TYPE: "code";
+    readonly CODE_CHALLENGE_METHOD: "S256";
+    readonly TOKEN_GRANT_TYPE: "authorization_code";
+    readonly REFRESH_GRANT_TYPE: "refresh_token";
+};
+declare const STORAGE_KEY_PREFIX = "tenneo_auth_";
+declare const STORAGE_KEYS: {
+    readonly authServerUrl: "tenneo_auth_auth_server_url";
+    readonly clientId: "tenneo_auth_client_id";
+    readonly redirectUri: "tenneo_auth_redirect_uri";
+    readonly tenantId: "tenneo_auth_tenant_id";
+    readonly codeVerifier: "tenneo_auth_code_verifier";
+    readonly state: "tenneo_auth_state";
+    readonly accessToken: "tenneo_auth_access_token";
+    readonly refreshToken: "tenneo_auth_refresh_token";
+    readonly expiresAt: "tenneo_auth_expires_at";
+};
+
+/**
+ * Config: minimal host-driven config store + facade.
+ *
+ * No "internal" or "runtime" config separation.
+ * Everything comes from the host app via `setConfig()` / `AuthProvider` props.
+ */
+
+declare function resolveConfig(overrides?: HostConfigOverride): ResolvedConfig;
+declare function getConfig(): ResolvedConfig;
+declare function setConfig(overrides: HostConfigOverride): void;
+declare const Config: {
+    readonly getApiBaseUrl: () => string;
+    readonly getAuthServerUrl: () => string;
+    readonly getClientCode: () => string;
+    readonly getRedirectUri: () => string;
+    readonly getAll: () => ResolvedHostConfig;
+};
+
 /**
  * React Context Provider for authentication state (FINAL)
  */
@@ -213,8 +287,16 @@ declare function useAuthContext(): AuthContextValue;
 interface AuthProviderProps {
     children: React.ReactNode;
     autoInit?: boolean;
+    /** Optional config object from host app (alternative to passing individual props). */
+    config?: SDKConfig;
     /** Tenant code from host app (used to resolve tenant via GET /api/tenant/v1/public/tenants/by-code/{tenantCode}). */
     tenantCode?: string;
+    /** Tenant resolution base URL (host app). */
+    apiBaseUrl?: string;
+    /** Authorization server URL (host app). */
+    authServerUrl?: string;
+    /** Callback/redirect URL (host app). */
+    callbackUrl?: string;
     /** App id for storage namespacing (auth_${tenantId}_${appId}_*). */
     appId?: string;
     /** Optional storage adapter; default is SecureSessionStorageAdapter with namespacing. */
@@ -223,7 +305,7 @@ interface AuthProviderProps {
 /**
  * AuthProvider – UI-facing auth state only
  */
-declare function AuthProvider({ children, autoInit, tenantCode, appId, storageAdapter, }: AuthProviderProps): React.JSX.Element;
+declare function AuthProvider({ children, autoInit, config, tenantCode, apiBaseUrl, authServerUrl, callbackUrl, appId, storageAdapter, }: AuthProviderProps): React.JSX.Element;
 
 interface AuthCallbackProps {
     loginPath?: string;
@@ -296,10 +378,7 @@ interface ConfigProvider {
     getApiBaseUrl(): string;
     getAuthServerUrl(): string;
     getRedirectUri(): string;
-    getClientId(): string;
-    getTenantId(): string;
     getClientCode(): string;
-    getBasePath(): string;
 }
 /** Tenant resolution – replaces direct tenant API usage in core. */
 interface TenantResolver {
@@ -412,111 +491,6 @@ declare function isCallbackUrl(): boolean;
 
 declare function resolveTenant(tenantKey: string): Promise<TenantConfig | null>;
 
-/**
- * Configuration types.
- * Internal: non-overridable (from .env). Runtime: overridable (env + window + setConfig).
- *
- * BASE URL SEPARATION (mandatory — do not mix):
- * - API_TENANT_RESOLUTION_BASE_URL: Tenant resolution only.
- * - API_AUTH_BASE_URL: Token operations only (exchange, refresh, logout).
- * - AUTH_SERVER_URL: OpenID Connect authorization redirect only.
- */
-interface InternalConfig {
-    API_TENANT_RESOLUTION_BASE_URL: string;
-    API_AUTH_BASE_URL: string;
-    AUTH_SERVER_URL: string;
-    DEFAULT_DOMAIN: string;
-}
-/** Single source of truth: .env (VITE_CLIENT_ID, VITE_TENANT_ID, VITE_CLIENTCODE). */
-interface RuntimeConfig {
-    CLIENT_ID: string;
-    TENANT_ID: string;
-    CLIENTCODE: string;
-}
-type ResolvedConfig = InternalConfig & RuntimeConfig;
-type SDKConfig = ResolvedConfig;
-interface RuntimeConfigOverrides {
-    basePath?: string;
-    redirectUri?: string;
-}
-type HostConfigOverride = Partial<RuntimeConfig> & Partial<RuntimeConfigOverrides>;
-/** Window __APP_CONFIG__ / __AUTH_CONFIG__ shape (clientId, tenantId, clientcode only). */
-interface HostRuntimeConfig {
-    clientId?: string;
-    tenantId?: string;
-    clientcode?: string;
-}
-/** Full resolved config output (internal URLs + runtime + derived redirectUri, basePath). */
-interface ResolvedHostConfig {
-    apiTenantResolutionBaseUrl: string;
-    apiAuthBaseUrl: string;
-    authServerUrl: string;
-    defaultDomain: string;
-    clientId: string;
-    tenantId: string;
-    clientCode: string;
-    redirectUri: string;
-    basePath: string;
-}
-
-/**
- * OAuth constants and storage keys. No config resolution — pure constants.
- */
-declare const OAUTH_CONSTANTS: {
-    readonly SCOPES: "openid profile email";
-    readonly RESPONSE_TYPE: "code";
-    readonly CODE_CHALLENGE_METHOD: "S256";
-    readonly TOKEN_GRANT_TYPE: "authorization_code";
-    readonly REFRESH_GRANT_TYPE: "refresh_token";
-};
-declare const STORAGE_KEY_PREFIX = "tenneo_auth_";
-declare const STORAGE_KEYS: {
-    readonly authServerUrl: "tenneo_auth_auth_server_url";
-    readonly clientId: "tenneo_auth_client_id";
-    readonly redirectUri: "tenneo_auth_redirect_uri";
-    readonly tenantId: "tenneo_auth_tenant_id";
-    readonly codeVerifier: "tenneo_auth_code_verifier";
-    readonly state: "tenneo_auth_state";
-    readonly accessToken: "tenneo_auth_access_token";
-    readonly refreshToken: "tenneo_auth_refresh_token";
-    readonly expiresAt: "tenneo_auth_expires_at";
-};
-
-/**
- * Config: resolver + public Config facade.
- * Resolution order: runtime overrides > window > env > defaults.
- * Single source of truth: .env (see .env.example).
- */
-
-declare global {
-    interface Window {
-        __APP_CONFIG__?: HostRuntimeConfig | {
-            [key: string]: unknown;
-        };
-        __AUTH_CONFIG__?: HostRuntimeConfig | {
-            [key: string]: unknown;
-        };
-    }
-}
-declare function resolveConfig(overrides?: HostConfigOverride): InternalConfig & RuntimeConfig;
-declare function getConfig(): InternalConfig & RuntimeConfig;
-declare function setConfig(overrides: HostConfigOverride): void;
-declare const Config: {
-    readonly getApiTenantResolutionBaseUrl: () => string;
-    readonly getApiAuthBaseUrl: () => string;
-    readonly getAuthServerUrl: () => string;
-    readonly getDefaultDomain: () => string;
-    readonly getClientId: () => string;
-    readonly getTenantId: () => string;
-    readonly getClientCode: () => string;
-    readonly getRedirectUri: () => string;
-    readonly getBasePath: () => string;
-    readonly hasRuntimeConfig: () => boolean;
-    readonly getAll: () => ResolvedHostConfig;
-};
-declare function getEnvConfig(): Promise<EnvConfig | null>;
-declare function hasEnvFallback(): boolean;
-
 /**
  * Security and error utilities for authentication.
  * Domain layer: sanitized errors and HTTPS enforcement.
@@ -565,4 +539,4 @@ type AuthEventHandler = (payload?: AuthEventPayload) => void;
 declare function emitAuthEvent(event: AuthEventName, payload?: AuthEventPayload): void;
 declare function subscribeAuthEvent(event: AuthEventName | '*', handler: AuthEventHandler): () => void;
 
-export { AuthCallback, type AuthContextValue, type AuthEngine, type AuthEngineConfig, type AuthEngineState, type AuthEventHandler, type AuthEventName, AuthEventNames, type AuthEventPayload, AuthProvider, type AuthRuntime, type AuthState, type AuthStateListener, type AuthStrategy, type AuthTokens, Config, type ConfigProvider, type CookieClearer, type CurrentUrl, type EnvConfig, type HostConfigOverride, type InternalConfig, type Logger, OAUTH_CONSTANTS, ProtectedRoute, type ResolvedConfig, type RuntimeConfigOverrides, type SDKConfig, type RuntimeConfig as SDKRuntimeConfig, STORAGE_KEYS, STORAGE_KEY_PREFIX, SanitizedError, type StorageAdapter, type StorageNamespace, type TenantConfig, type TenantResolver, type TokenResponse, type TokenStorageAdapter, type Unsubscribe, type UrlProvider, bootstrap, buildStorageKey, createAuthEngine, createCookieStorageAdapter, createMemoryStorageAdapter, createOAuth2PkceStrategy, createSecureSessionStorageAdapter, emitAuthEvent, enforceHttps, ensureValidAccessToken, extractTenantKey, getAccessToken$1 as getAccessToken, getAuthRuntime, getConfig, getEnvConfig, getStorageAdapter, getStorageNamespace, getAccessToken as getStoredAccessToken, hasEnvFallback, isAccessTokenExpired, isCallbackUrl, logout, refreshAccessToken, resetCookieWatcher, resolveConfig, resolveTenant, sanitizeErrorMessage, setAuthRuntime, setConfig, setStorageContext, startCookieWatcher, stopCookieWatcher, subscribeAuthEvent, useAuth, useAuthContext, useAuthInit };
+export { AuthCallback, type AuthContextValue, type AuthEngine, type AuthEngineConfig, type AuthEngineState, type AuthEventHandler, type AuthEventName, AuthEventNames, type AuthEventPayload, AuthProvider, type AuthRuntime, type AuthState, type AuthStateListener, type AuthStrategy, type AuthTokens, Config, type ConfigProvider, type CookieClearer, type CurrentUrl, type EnvConfig, type HostConfigOverride, type Logger, OAUTH_CONSTANTS, ProtectedRoute, type ResolvedConfig, type SDKConfig, STORAGE_KEYS, STORAGE_KEY_PREFIX, SanitizedError, type StorageAdapter, type StorageNamespace, type TenantConfig, type TenantResolver, type TokenResponse, type TokenStorageAdapter, type Unsubscribe, type UrlProvider, bootstrap, buildStorageKey, createAuthEngine, createCookieStorageAdapter, createMemoryStorageAdapter, createOAuth2PkceStrategy, createSecureSessionStorageAdapter, emitAuthEvent, enforceHttps, ensureValidAccessToken, extractTenantKey, getAccessToken$1 as getAccessToken, getAuthRuntime, getConfig, getStorageAdapter, getStorageNamespace, getAccessToken as getStoredAccessToken, isAccessTokenExpired, isCallbackUrl, logout, refreshAccessToken, resetCookieWatcher, resolveConfig, resolveTenant, sanitizeErrorMessage, setAuthRuntime, setConfig, setStorageContext, startCookieWatcher, stopCookieWatcher, subscribeAuthEvent, useAuth, useAuthContext, useAuthInit };