export interface ApiConfig {
    /** Default API base URL (e.g. "http://localhost:8080/api"). */
    apiBaseUrl: string;
    /**
     * Prefix used to namespace platform-storage entries
     * (`${prefix}_session_token`, `${prefix}_server_url_override`).
     * Lowercase with no whitespace; must be stable across releases —
     * changing it orphans previously stored sessions and forces re-login.
     */
    storagePrefix: string;
    /**
     * Optional `window` key for runtime-config override (web only). Apps
     * that ship a docker image emitting `/config.js` set this to match
     * the global the script writes. Defaults to
     * `__ENTROPY_RUNTIME_CONFIG__`.
     */
    runtimeConfigKey?: string;
    /**
     * Auth request shape. `"email"` (default) is the single-tenant contract
     * used by vault/kryptonite/simple-finance: login is `{ email, password }`
     * and returns `{ user, session_token }`. `"multi-tenant"` is for IdP-style
     * servers (access): login is `{ tenant, identifier, password }`, forgot
     * is `{ tenant, email }`, and the login response is the user record
     * directly (session is a cookie). The tenant is contextual — set it with
     * {@link setTenant} (e.g. from the OIDC `?tenant=` param) rather than here.
     */
    authMode?: "email" | "multi-tenant";
    /** Initial tenant for `"multi-tenant"` mode; usually set via {@link setTenant}. */
    tenant?: string;
}
/**
 * Install runtime configuration. Apps call this once at startup,
 * BEFORE `AuthService` is used. Re-configuring at runtime is
 * supported but only the base URL changes — the storage prefix is
 * locked after first call.
 */
export declare function configureApi(config: ApiConfig): void;
export declare function getStoragePrefix(): string;
/** Current auth request shape (see {@link ApiConfig.authMode}). */
export declare function getAuthMode(): "email" | "multi-tenant";
/**
 * Active tenant for `"multi-tenant"` auth mode. In an IdP the tenant is
 * contextual (resolved from the OIDC `?tenant=` param / the client), not
 * typed by the user — the consuming app calls this before login. Returns
 * an empty string when unset.
 */
export declare function getTenant(): string;
/** Set the active tenant for `"multi-tenant"` auth mode. */
export declare function setTenant(tenant: string): void;
/**
 * Internal key-value put. Native: SecureStore (encrypted at rest,
 * Keychain on iOS, AES-encrypted on Android). Web: sessionStorage
 * (origin-isolated, but plaintext AND readable by XSS).
 *
 * Web callers MUST NOT pass secrets — only UI preferences whose
 * disclosure is acceptable (server-url override, etc.). The web
 * branch deliberately uses sessionStorage rather than localStorage
 * so a misconfigured caller leaks values for the current tab only.
 *
 * For session credentials, use {@link storeSessionToken} (no-op on
 * web — the server sets an HttpOnly cookie). For the authenticated
 * user record, use {@link AuthService.persistAuthSession} (web path
 * stores in process memory).
 */
export declare function kvPut(key: string, value: string | null): Promise<void>;
/** Internal key-value get. See {@link kvPut} for the storage tier matrix. */
export declare function kvGet(key: string): Promise<string | null>;
export declare function getBaseUrl(): string;
export declare function getDefaultBaseUrl(): string;
export declare function setBaseUrl(url: string): Promise<void>;
export declare function resetBaseUrl(): Promise<void>;
export declare function loadServerUrlOverride(): Promise<void>;
/**
 * Session credential used as a `Bearer` token.
 * - Native: SecureStore (encrypted at rest).
 * - Web: sessionStorage (origin-isolated, cleared on tab close). Production
 *   web also has the HttpOnly session cookie; the sessionStorage Bearer is what
 *   keeps a *split-origin dev* session (Expo :8081 → API :8100) alive across a
 *   refresh, since a SameSite=Lax cookie can't ride cross-origin XHR. Readable
 *   by XSS — acceptable tradeoff chosen for dev parity; clears on tab close.
 */
export declare function getSessionToken(): Promise<string | null>;
export declare function storeSessionToken(token: string | null): Promise<void>;
export declare function clearSessionToken(): Promise<void>;
/** Test-only — reset the singleton's state. */
export declare function __resetApiConfigStoreForTests(): void;
//# sourceMappingURL=api-config.d.ts.map