export type ParamsOfEarlyInit = { /** * Base path of where is deployed the webapp * usually `import.meta.env.BASE_URL` * if omitted, can be provided to createOidc() */ BASE_URL?: string; /** * Determines how session restoration is handled. * Session restoration allows users to stay logged in between visits * without needing to explicitly sign in each time. * * Options: * * - **"auto" (default)**: * Automatically selects the best method. * If the app’s domain shares a common parent domain with the authorization endpoint, * an iframe is used for silent session restoration. * Otherwise, a full-page redirect is used. * * - **"full page redirect"**: * Forces full-page reloads for session restoration. * Use this if your application is served with a restrictive CSP * (e.g., `Content-Security-Policy: frame-ancestors "none"`) * or `X-Frame-Options: DENY`, and you cannot modify those headers. * This mode provides a slightly less seamless UX and will lead oidc-spa to * store tokens in `localStorage` if multiple OIDC clients are used * (e.g., your app communicates with several APIs). * * - **"iframe"**: * Forces iframe-based session restoration. * In development, if you go in your browser setting and allow your auth server’s domain * to set third-party cookies this value will let you test your app * with the local dev server as it will behave in production. * * See: https://docs.oidc-spa.dev/v/v10/resources/third-party-cookies-and-session-restoration */ sessionRestorationMethod?: "iframe" | "full page redirect" | "auto"; /** See: https://docs.oidc-spa.dev/v/v10/security-features/token-substitution */ securityDefenses?: { enableBrowserRuntimeFreeze?: () => void; enableDPoP?: () => void; enableTokenSubstitution?: () => void; }; }; export declare function oidcEarlyInit(params?: ParamsOfEarlyInit): { shouldLoadApp: boolean; };