@enterprisestandard/core 0.0.20-beta.20260706.1 → 0.0.20

package/dist/index.d.ts

@@ -3,7 +3,13 @@ import { version } from "../package.json";
 * Shared types for paginated list operations across stores.
 *
 * List methods return a ListResult with total, count, items, size, page, and pages.
-* Options accept optional start (0-based), limit (page size), and sort (store-specific).
+* Options accept optional start (0-based), limit (page size), and filter.
+*
+* ORDERING CONTRACT: `list()` does NOT accept a caller-specified sort. Every store MUST return items
+* in a stable, deterministic order (recommended: primary key ascending) so that offset pagination is
+* coherent across pages — page N+1 must continue exactly where page N ended for an unchanged dataset.
+* UI-style arbitrary sorting is the app's concern (sort the returned page, or push ORDER BY into a
+* SQL/search-backed custom store); the SDK only guarantees deterministic paging.
 */
 /**
 * Result of a paginated list operation.
@@ -24,13 +30,6 @@ interface ListResult<T> {
 	/** Total number of pages at the given size. */
 	pages: number;
 }
-/** Sort direction for list options. */
-type SortDirection = "asc" | "desc";
-/** Single sort option for paginated list operations. */
-interface SortOptions<TField extends string = string> {
-	field: TField;
-	direction: SortDirection;
-}
 /**
 * Optional server-side filter for list operations. Stores that understand a field apply it before
 * pagination so callers get correctly-totalled, filtered pages; unknown fields are ignored.
@@ -40,22 +39,14 @@ interface ListFilter {
 	requestable?: boolean;
 }
 /** Shared options for paginated list operations. */
-interface ListOptions<TField extends string = string> {
+interface ListOptions {
 	/** 0-based index of first item. Default 0. */
 	start?: number;
 	/** Max items to return. Omitted = implementation-defined (InMemory: no limit). */
 	limit?: number;
-	/** Sort order (applied in array order). */
-	sort?: SortOptions<TField>[];
 	/** Optional server-side filter applied before pagination. */
 	filter?: ListFilter;
 }
-type GroupSortOptions = SortOptions;
-type GroupListOptions = ListOptions;
-type UserSortOptions = SortOptions;
-type UserListOptions = ListOptions;
-type TenantSortOptions = SortOptions;
-type TenantListOptions = ListOptions;
 /**
 * Shared minimal identity fields used to build both the workforce user
 * record (`BaseUser`) and the CIAM customer record (`BaseCustomer`), as well
@@ -510,22 +501,73 @@ declare const infoLogger: Logger;
 * Logger that logs messages warn and error to the console.
 */
 declare const warnLogger: Logger;
+/** Synchronous, in-memory read surface for one code catalog entity kind. */
+type CodeCatalogNamespace<TEntity> = {
+	get(id: string): TEntity | undefined;
+	getByExternalId(externalId: string): TEntity | undefined;
+	list(): readonly TEntity[];
+};
+/**
+* Normalized, frozen code-declared catalog produced by {@link defineCatalog}. All entities are
+* deep-frozen, id-indexed, and carry `externalId` (defaulted to `id`).
+*/
+type CodeCatalog = {
+	groups: CodeCatalogNamespace<Group>;
+	roles: CodeCatalogNamespace<Role>;
+	permissions: CodeCatalogNamespace<Permission>;
+};
+/** Declarative input for {@link defineCatalog} (plain arrays authored in app code). */
+type CodeCatalogInput = {
+	groups?: readonly Group[];
+	roles?: readonly Role[];
+	permissions?: readonly Permission[];
+};
+/** True when the value is already a normalized {@link CodeCatalog} (vs a declarative input). */
+declare function isCodeCatalog(value: CodeCatalog | CodeCatalogInput): value is CodeCatalog;
+/** Normalize an `authz.catalog` config value: pass through a {@link CodeCatalog}, build one from input. */
+declare function toCodeCatalog(value: CodeCatalog | CodeCatalogInput): CodeCatalog;
+/**
+* Build a validated, frozen {@link CodeCatalog} from declarative arrays. Call it once at module
+* scope in a pure authz module (no store imports) and wire the result via
+* `FrameworkConfig.authz.catalog`.
+*
+* Validation (throws {@link Error} at module evaluation on the first violation):
+* - ids are globally unique across groups, roles, AND permissions (one SCIM Groups id space);
+* - `externalId`s (after defaulting to `id`) are globally unique (SCIM `externalId eq` contract);
+* - every group -> group/role/permission reference (string id or embedded object) resolves to an
+*   entity declared in the catalog arrays, and every role -> permission reference likewise
+*   (`resources` refs are NOT validated here — resources live in the app's `ResourceProvider`);
+* - nested group composition is acyclic;
+* - `recommendedSubjectTypes` is a subset of `assignableSubjectTypes`.
+*
+* Side effects: entities missing `externalId` are stamped with `externalId = id`, then every
+* entity (and its arrays/metadata) is frozen.
+*/
+declare function defineCatalog(input: CodeCatalogInput): CodeCatalog;
+/**
+* {@link AccessCatalogStore}-shaped READ union over the code-declared catalog and the optional
+* backing store (lookup order code -> store, per kind). This is the single surface SCIM Groups
+* reads and OAA projection enumerate so code entities are first-class entitlements to IAM tooling
+* without ever being stored. Returns undefined when neither source is wired.
+*/
+declare function unionCatalogRead(code: CodeCatalog | undefined, store: AccessCatalogStore | undefined): AccessCatalogStore | undefined;
 import { StandardSchemaV1 as StandardSchemaV15 } from "@standard-schema/spec";
 /**
 * IAM delta egress mode (RemoteConfig/ESI intent). Selects how access changes that occur inside the
 * application are surfaced to the enterprise's IAM/governance layer:
 *
 * - `'patch'`: outbound SCIM into the IAM tool (per-resource PATCH/POST, externalId-only). The IAM
-*   tool's view stays fresh as access changes in the app.
-* - `'event'`: emit a Security Event Token (RFC 8417 SET) delivered via RFC 8935 push to an event
-*   receiver, keyed by `externalId` only (no mapping store). Records an immutable fact rather than
-*   mutating the IAM tool's state. See the README "IAM delta egress" section and
-*   `examples/express-pm`.
+*   tool's view stays fresh as access changes in the app, and the tool can reconcile the echo
+*   against the originating request (an unmatched change is an out-of-band access grant for the
+*   enterprise's policy to handle). See the README "IAM delta egress" section.
 *
-* The SDK only surfaces the signal; it never dictates the enterprise's workflow or policy. The
-* enterprise decides how to respond (flag, auto-revoke + notify, or simply audit).
+* Origin/trust: every push is authenticated with the app's outgoing workload client (OAuth bearer);
+* the receiver treats the authenticated workload identity as the verified origin. Audit
+* accountability lives with the IdP that authenticated the workload and the IAM tool that granted
+* it access. The SDK only surfaces the signal; it never dictates the enterprise's workflow or
+* policy (flag, auto-revoke + notify, or simply audit).
 */
-type IamDeltaMode = "event" | "patch";
+type IamDeltaMode = "patch";
 /** SCIM resource types the delta patch adapter addresses. */
 type IamDeltaResourceType = "user" | "group";
 /**
@@ -561,17 +603,20 @@ type IamDeltaReconcileResult = {
 /**
 * Projects access-root changes to the configured IAM delta destination. Implemented by the server
 * package; threaded into the access-mutation chokepoint so every grant/revoke that flows through the
-* SDK (including direct SCIM calls) is surfaced. `onGrant`/`onRevoke` are fire-and-forget and
-* best-effort: they never block or fail the originating mutation, and they no-op when not ready.
+* SDK (including direct SCIM calls) is surfaced. `onGrant`/`onRevoke` resolve when the projection
+* completes (or resolve immediately when not ready). They are best-effort egress: the SCIM mutation
+* path awaits them (bounded) inside the request so no work is left detached (serverless-safe), but a
+* rejection is caught and reported as degraded egress — it never turns a committed store mutation
+* into a SCIM error. A rejected promise signals the projection failed so the caller can report it.
 *
 * Readiness follows the shared contract: `isReady()` is a synchronous check; `ready(timeout?)`
 * resolves once the emitter first becomes usable.
 */
 interface IamDeltaEmitter {
-	/** Fire-and-forget projection of a granted root. No-op when not ready. */
-	onGrant(change: AccessChange): void;
-	/** Fire-and-forget projection of a revoked root. No-op when not ready. */
-	onRevoke(change: AccessChange): void;
+	/** Project a granted root; resolves on completion (or immediately when not ready), rejects on push failure. */
+	onGrant(change: AccessChange): Promise<void>;
+	/** Project a revoked root; resolves on completion (or immediately when not ready), rejects on push failure. */
+	onRevoke(change: AccessChange): Promise<void>;
 	/** Re-push all active roots to the destination (app-driven full reconcile). */
 	reconcile(roots: AsyncIterable<AccessChange> | Iterable<AccessChange>): Promise<IamDeltaReconcileResult>;
 	isReady(): boolean;
@@ -710,7 +755,7 @@ interface Address {
 /**
 * SCIM Group reference (used within User resources)
 */
-interface Group {
+interface Group2 {
 	/**
 	* The identifier of the User's group
 	*/
@@ -790,7 +835,7 @@ interface GroupResource {
 /**
 * SCIM Role
 */
-interface Role {
+interface Role2 {
 	/**
 	* The value of the role
 	*/
@@ -992,7 +1037,7 @@ interface User {
 	/**
 	* A list of groups to which the user belongs
 	*/
-	groups?: Group[];
+	groups?: Group2[];
 	/**
 	* A list of entitlements for the User
 	*/
@@ -1005,7 +1050,7 @@ interface User {
 	/**
 	* A list of roles for the User
 	*/
-	roles?: Role[];
+	roles?: Role2[];
 	/**
 	* A list of certificates issued to the User
 	*/
@@ -1069,6 +1114,13 @@ type ModuleReadiness = {
 * Canonical Enterprise Standard module names used by the holistic readiness report and the
 * `requireReady([...])` helper. These are the config-driven module handles whose readiness can be
 * composed; `es.isReady()` itself stays the narrow "config applied" signal and is NOT one of these.
+*
+* IAM-delta egress is intentionally NOT a member. Delta patch-back is best-effort and non-fatal (a
+* failed push only logs `degraded` and is reconciled by a later full sync — the Batch 7 drift-signal
+* contract), so folding it into `iam` readiness would let a delta-target outage make
+* `requireReady(['iam'])` false and take the app out of rotation for a signal that is designed not to
+* block. Apps that DO treat delta as a hard dependency can gate on `es.iam.delta.isReady()` /
+* `es.iam.delta.ready()` explicitly instead.
 */
 type EsModuleName = "sso" | "ciam" | "iam" | "workload" | "otel" | "secrets" | "authz";
 /** Per-module readiness snapshot in {@link ReadinessReport}. */
@@ -1585,7 +1637,7 @@ type FrameworkWorkloadIncomingOutgoing = {
 type FrameworkWorkloadConfig = Partial<WorkloadConfig> | FrameworkWorkloadIncomingOutgoing;
 /**
 * Unified `getToken` call signature shared by the per-client {@link Workload} handle and the
-* aggregate `es.workload` (AUDIT §16.5). Both overloads are exposed so `es.workload.getToken(scope?)`
+* aggregate `es.workload` (AUDIT_HISTORY.md §16.5). Both overloads are exposed so `es.workload.getToken(scope?)`
 * (default/server client) and `es.workload.getToken('client', scope)` (a named outgoing client) both
 * type-check off the same handle without a cast. The aggregate dispatches on arity at runtime
 * (`getToken(...args)`); a per-client handle ignores a stray client argument.
@@ -1705,15 +1757,12 @@ type IAMConfig = {
 	groups?: IAMEndpointFlag;
 	/**
 	* RemoteConfig/ESI intent: how access changes that occur inside the application are surfaced to the
-	* enterprise IAM/governance layer. Not configurable from application code (ESI knows whether the
-	* company's IAM tool supports SCIM Events vs. SCIM PATCH-based aggregation).
+	* enterprise IAM/governance layer. Not configurable from application code.
 	*
-	* - `'patch'`: outbound SCIM into the IAM tool keyed strictly by `externalId` (uses `url` as the
-	*   destination base and `deltaAudience` for the outgoing workload client). Keeps the IAM tool's
-	*   view fresh as the app grants/revokes access directly.
-	* - `'event'`: Security Event Token (RFC 8417 SET) pushed (RFC 8935) to an event receiver, keyed
-	*   by `externalId` only (no mapping store). Records an immutable fact rather than mutating the
-	*   IAM tool's state. See the README "IAM delta egress" section and `examples/express-pm`.
+	* `'patch'`: outbound SCIM into the IAM tool keyed strictly by `externalId` (uses `url` as the
+	* destination base and `deltaAudience` for the outgoing workload client). Keeps the IAM tool's
+	* view fresh as the app grants/revokes access directly, so the tool can reconcile the echo
+	* against the originating request. See the README "IAM delta egress" section.
 	*
 	* When omitted, delta egress is disabled. The SDK only emits the signal; the enterprise's IAM
 	* tooling owns the response (flag, auto-revoke + notify, or audit). See `IamDeltaMode`.
@@ -2144,12 +2193,8 @@ type Session<TExtended = object> = {
 	*/
 	createdAt: Date;
 	/**
-	* Timestamp of the last activity in this session.
-	* Can be updated to track session activity.
-	*/
-	lastActivityAt: Date;
-	/**
-	* Optional absolute expiration for the browser/session credential.
+	* Optional absolute expiration for the browser/session credential. Drives the store TTL (Redis `EX`)
+	* and the session cookie expiry; a record whose `expiresAt` has passed is treated as signed out.
 	* Stores may serialize this as a Date or ISO string.
 	*/
 	expiresAt?: Date | string;
@@ -2231,7 +2276,9 @@ interface SessionStore<TExtended = object> {
 	/**
 	* Update an existing session with partial data.
 	*
-	* Commonly used to update lastActivityAt or add custom fields.
+	* Used at trust boundaries (e.g. token refresh) to merge new token material/claims/expiry, or to
+	* add custom fields. A store SHOULD refresh its TTL from the merged `expiresAt`. The authenticated
+	* read path does NOT call this — reads never write.
 	*
 	* @param sid - The session.sid to update
 	* @param data - Partial session data to merge
@@ -2310,133 +2357,6 @@ type BeforeLogoutHook<TUser = AuthenticatedUser> = (ctx: BeforeLogoutContext<TUs
 /** The `afterLogout` hook: runs after teardown. Return a destination `string`, a `Response`, or nothing (→ `/`). */
 type AfterLogoutHook = (ctx: AfterLogoutContext) => RedirectResult | Promise<RedirectResult>;
 /**
-* The verdict a single {@link RedirectRule} returns for a candidate destination:
-* - `'deny'` — a hard veto that ALWAYS wins, even if another rule allowed (use for protocol/format
-*   hygiene such as `javascript:`, `//evil`, `/\evil`).
-* - `'allow'` — this rule authorizes the destination (some allow is required to pass).
-* - `'abstain'` — this rule has no opinion; defer to the others.
-*/
-type RedirectVerdict = "allow" | "deny" | "abstain";
-/** Parsed context handed to every {@link RedirectRule}. */
-interface RedirectRuleContext {
-	/** The raw candidate string exactly as supplied (hook return value / captured query param). */
-	candidate: string;
-	/**
-	* The candidate resolved against the current request URL the same way a browser resolves a
-	* `Location` header (so `/foo` is same-origin, `//evil` and `https://evil` are cross-origin).
-	* `null` when the candidate cannot be parsed into a URL at all.
-	*/
-	url: URL | null;
-	/** Origin of the current request (the app's own origin), or `''` if `requestUrl` was unparseable. */
-	requestOrigin: string;
-}
-/**
-* One composable redirect policy rule. Build policies by layering rules (a hard-veto hygiene rule
-* plus one or more allow rules) and evaluating them with {@link resolveRedirect} / {@link isRedirectAllowed}.
-*/
-type RedirectRule = (ctx: RedirectRuleContext) => RedirectVerdict;
-/**
-* Hard-veto hygiene rule. Denies the URL shapes that enable open redirects / XSS regardless of any
-* allow rule: control characters, backslash tricks (`/\evil`), protocol-relative URLs (`//evil`),
-* unparseable candidates, non-`http(s)` schemes (`javascript:`, `data:`, …), and embedded
-* `user:pass@` credentials. Put this FIRST in every policy.
-*/
-declare function blockDangerousUrls(): RedirectRule;
-/** Allow in-app deep links: a clean relative path (`/foo`), but not `//host` or `/\host`. */
-declare function allowRelativePaths(): RedirectRule;
-/** Allow destinations on the same origin as the current request. */
-declare function allowSameOrigin(): RedirectRule;
-/** Allow destinations whose origin is in the given allowlist (e.g. `allowOrigins('https://app.example.com')`). */
-declare function allowOrigins(...origins: string[]): RedirectRule;
-/**
-* Allow destinations whose host is in the given allowlist. A host prefixed with `.` matches that
-* host and all its subdomains (e.g. `allowHosts('.example.com')` allows `app.example.com`).
-*/
-declare function allowHosts(...hosts: string[]): RedirectRule;
-/**
-* The default same-origin policy: hygiene veto + relative paths + same-origin absolute URLs. This is
-* the floor the SDK applies to any `string` an `after*` hook returns. Pass it to
-* {@link resolveRedirect} / {@link isRedirectAllowed}, or spread it and add `allowOrigins(...)` /
-* `allowHosts(...)` to permit specific cross-origin destinations.
-*/
-declare function sameOriginRedirectRules(): RedirectRule[];
-/**
-* Returns `true` when `candidate` is permitted by the given `rules` (deny-by-default; any `'deny'`
-* vetoes; at least one `'allow'` is required). Useful to validate a deep link at capture time, e.g.
-* inside `beforeLogin` before storing it in the login state cookie.
-*/
-declare function isRedirectAllowed(candidate: string | undefined, rules: RedirectRule[], requestUrl: string): boolean;
-/**
-* Resolve a candidate destination against a redirect policy: returns `candidate` when the `rules`
-* allow it, otherwise `fallback`. This is the composable replacement for the old fixed same-origin
-* floor — pass {@link sameOriginRedirectRules} for the default behavior, or your own rule list.
-*/
-declare function resolveRedirect(candidate: string | undefined, options: {
-	rules: RedirectRule[];
-	fallback: string;
-	requestUrl: string;
-}): string;
-/**
-* A reusable redirect policy: the ordered {@link RedirectRule}s plus the `fallback` destination used
-* when a candidate is missing or rejected. Bundling rules + fallback keeps the capture hook
-* ({@link captureRedirect}) and the resolve hook ({@link resolveCapturedRedirect}) in lock-step so a
-* deep link that passes at capture time resolves the same way after the IdP round-trip.
-*/
-interface RedirectPolicy {
-	rules: RedirectRule[];
-	fallback: string;
-}
-/**
-* The canonical context shape written by {@link captureRedirect} and read by
-* {@link resolveCapturedRedirect}: a single same-origin deep link stored under `redirect`.
-*/
-interface RedirectContext {
-	redirect?: string;
-}
-/**
-* The default {@link RedirectPolicy} that fits virtually every app: the hard-veto hygiene rule
-* ({@link blockDangerousUrls}) plus same-origin absolute URLs and in-app relative paths, falling back
-* to `/`. Pass it straight to {@link captureRedirect} / {@link resolveCapturedRedirect}. Treat it as
-* read-only; to customize, spread it — override the fallback with
-* `{ ...defaultRedirectPolicies, fallback: \`/${tenant.id}/\` }`, or allow specific cross-origin
-* destinations with `{ ...defaultRedirectPolicies, rules: [...defaultRedirectPolicies.rules, allowOrigins('https://app.example.com')] }`.
-*/
-declare const defaultRedirectPolicies: RedirectPolicy;
-/**
-* `beforeLogin` helper. Reads the `param` query string (default `redirect`) from `request`, validates
-* it against `policy.rules` at capture time, and returns it as `{ redirect }` context for the SDK to
-* carry across the IdP round-trip — or `undefined` when the param is absent or rejected (so nothing is
-* stored). Pair with {@link resolveCapturedRedirect}. Example: `beforeLogin: ({ request }) =>
-* captureRedirect(request, redirectPolicy)`.
-*/
-declare function captureRedirect(request: Request, policy: RedirectPolicy, param?: string): RedirectContext | undefined;
-/**
-* `afterLogin` helper. Reads the captured `redirect` from `ctx.context` (an UNSIGNED state cookie —
-* untrusted) and re-resolves it against `policy`, returning the destination string or `policy.fallback`
-* when it is missing/rejected. Pair with {@link captureRedirect}. Example: `afterLogin: (ctx) =>
-* ctx.ok ? resolveCapturedRedirect(ctx, redirectPolicy) : '/?auth_error=login_failed'`.
-*/
-declare function resolveCapturedRedirect(ctx: {
-	request: Request;
-	context?: unknown;
-}, policy: RedirectPolicy): string;
-/**
-* Resolve a hook's {@link RedirectResult} into either a ready `Response` (when the hook
-* returned one) or a same-origin-floored `location` string (string or fallback).
-*/
-declare function resolveAfterRedirect(result: RedirectResult, fallback: string, requestUrl: string): {
-	location: string;
-	response?: undefined;
-} | {
-	location?: undefined;
-	response: Response;
-};
-/**
-* Return a copy of `response` with the given `Set-Cookie` header values appended. Used to apply
-* SDK-owned cookie clears/sets to a `Response` an `after*` hook returned.
-*/
-declare function withSetCookies(response: Response, setCookies: string[]): Response;
-/**
 * Outcome of resolving an authenticated principal (workforce user or customer) from a request.
 *
 * This is the degraded-aware companion to the `get*` helpers (`getUser`/`getCustomer`), which
@@ -2444,7 +2364,7 @@ declare function withSetCookies(response: Response, setCookies: string[]): Respo
 * "no credential present" (`unauthenticated` — the visitor is genuinely signed out) apart from
 * "we could not verify the credential" (`degraded` — a JWKS outage / misconfiguration). Treating the
 * latter as anonymous is a fail-open trap: a request handler should usually answer `503` on
-* `degraded` rather than render a signed-out experience (AUDIT §4.4).
+* `degraded` rather than render a signed-out experience (AUDIT_HISTORY.md §4.4).
 *
 * It is a plain value (never thrown), consistent with the SDK's "ask a question, get an answer" auth
 * helper contract.
@@ -2595,19 +2515,27 @@ type SSOConfig<
 	* @default 600
 	*/
 	loginStateTtl?: number;
+	/**
+	* Grace window (seconds) for the superseded session record after a refresh rotates the `sid`.
+	* On refresh the SDK mints a new `sid` (new record + cookie) and re-TTLs the OLD record to this
+	* window with its `refresh_token` stripped, so in-flight requests still holding the old cookie
+	* complete (read-only) while the stale token material is reaped promptly by the store TTL. `0`
+	* deletes the old record immediately. Ops-governed (ConfigSource); clamped to `[0, 600]`.
+	* @default 60
+	*/
+	rotationGraceSeconds?: number;
 } & SSOHandlerConfig;
 type StateCookie = {
 	state: string;
 	codeVerifier: string;
+	/** OIDC `nonce` issued at initiation and enforced against the ID token at the callback (AUDIT_HISTORY.md v2 §1.8). */
+	nonce: string;
 	/**
 	* Appdev context returned by `beforeLogin`, carried across the IdP round-trip. UNSIGNED and
 	* therefore untrusted: validate before using for anything security-sensitive.
 	*/
 	context?: unknown;
 };
-declare function listSsoClientIdsFromCookies(requestOrCookieHeader: Request | string | null | undefined, options?: {
-	cookiePrefix?: string;
-}): string[];
 type SSOHandlerConfig = {
 	loginUrl?: string;
 	userUrl?: string;
@@ -3035,6 +2963,22 @@ type VaultLfvSecretsConfig = {
 	/** Warning interval in milliseconds for LFV retry logs. Set to 0 to disable warnings. */
 	warnInterval?: number;
 	/**
+	* Freshness bound (in seconds) for inbound signed callbacks. Delivery/events callbacks carry a
+	* signed `issued_at`; a callback older than this window is rejected as stale, and a previously
+	* accepted callback signature within the window is rejected as a replay. Generous by default to
+	* tolerate clock skew. Defaults to 300 seconds.
+	*/
+	callbackMaxAgeSeconds?: number;
+	/**
+	* Optional maximum age (in seconds) for a cached secret before a read forces a fresh re-fetch.
+	* LFV is push-based — deliveries/events keep the cache current — so the cache is unbounded by
+	* default. This knob is defense-in-depth against a silently missed event (e.g. a dropped events
+	* callback): once an entry is older than this, the next read bypasses the cache hit and joins the
+	* per-path single-flight re-read instead of serving a potentially stale value. Unset/<=0 means no
+	* age bound.
+	*/
+	cacheMaxAgeSeconds?: number;
+	/**
 	* Optional logger for request/response tracing.
 	*/
 	log?: Logger;
@@ -3379,12 +3323,28 @@ type AuthzConfig = {
 	* provenance. Never written to a remote store at init.
 	*/
 	trustedProvisioningClients?: TrustedProvisioningClient[];
+	/**
+	* Code-declared catalog (Framework-only; a ConfigSource can never supply it). An in-memory,
+	* read-path definition source for code-authored groups/roles/permissions: never seeded or
+	* written to any store, unified with `catalogStore` and resource-derived entitlements on every
+	* read (lookup order code -> store -> derived), and immutable through SCIM (member grant/revoke
+	* allowed; metadata writes return 403 `mutability`). Accepts declarative arrays or a
+	* `defineCatalog(...)` result; validated/normalized at config apply. See `defineCatalog`.
+	*/
+	catalog?: CodeCatalog | CodeCatalogInput;
+	/** Durable catalog store for SCIM/IAM-sourced entitlement definitions (full SCIM CRUD). */
 	catalogStore?: AccessCatalogStore;
 	/** Granted roots (source of truth) used by SCIM/IAM orchestration and OAA projection. */
 	accessStore?: AccessAssignmentStore;
 	/** Derived closure index for fast `has*` checks; materialized from accessStore + catalogStore. */
 	accessIndex?: AccessIndex;
 	/**
+	* Read-through provider over the application's own resource data (teams, projects, ...), including
+	* optional derived-entitlement functions. The SDK never stores resources itself; see
+	* {@link ResourceProvider}.
+	*/
+	resources?: ResourceProvider;
+	/**
 	* Opt-in transform applied to a permission before OAA projection to derive its `permission_type`.
 	* Applied identically on incremental push and full sync. Undefined => identity (use the
 	* permission's own `permissionTypes`/`action`).
@@ -3394,9 +3354,9 @@ type AuthzConfig = {
 	* Opt-in transform applied to a group before OAA projection (e.g. computed `custom_properties`,
 	* redaction). Applied identically on incremental push and full sync. Undefined => identity.
 	*/
-	mapGroup?: (group: Group2) => Group2;
+	mapGroup?: (group: Group) => Group;
 	/** Opt-in transform applied to a role before OAA projection. Undefined => identity. */
-	mapRole?: (role: Role2) => Role2;
+	mapRole?: (role: Role) => Role;
 	/** Opt-in transform applied to a resource before OAA projection. Undefined => identity. */
 	mapResource?: (resource: Resource) => Resource;
 	/**
@@ -3444,7 +3404,7 @@ type FrameworkWorkloadConfigFromCode = WorkloadServerConfigFromCode | {
 	incoming?: WorkloadServerConfigFromCode;
 	outgoing?: FrameworkWorkloadIncomingOutgoing["outgoing"];
 };
-type CIAMConfigFromCodeInput = Omit<CIAMConfig, "signingKey" | "providers" | "magicLinkUrl" | "magicLinkLoginUrl" | "customerUrl" | "customerLoginUrl" | "customerCallbackUrl" | "customerProvidersUrl" | "logoutUrl">;
+type CIAMConfigFromCodeInput = Omit<CIAMConfig, "providers" | "magicLinkUrl" | "magicLinkLoginUrl" | "customerUrl" | "customerLoginUrl" | "customerCallbackUrl" | "customerProvidersUrl" | "logoutUrl">;
 /**
 * The application-facing configuration surface for `enterpriseStandard(source, config)`.
 * Identical to {@link FrameworkConfig} except endpoint URLs are removed (derived from `basePath`)
@@ -3539,16 +3499,6 @@ type CacheConfig = {
 	};
 	/** Session-related caching knobs. Portable. */
 	session?: {
-		/**
-		* Minimum seconds between `lastActivityAt` persists for an active session. Contract:
-		* `lastActivityAt` MUST be persisted at least once per interval of continued activity and MUST
-		* NOT be persisted more often than once per interval; `0` persists on every authenticated
-		* request (pre-tuning behavior). Evaluated statelessly against the just-read session record, so
-		* it is correct with or without session affinity.
-		*
-		* Clamp: [0, 86400] (default 60).
-		*/
-		activityUpdateSeconds?: number;
 		/**
 		* Instance-local read-through cache for `sessionStore.get`. DISABLED by default. Contract: when
 		* enabled, an implementation MAY serve `get(sid)` from a local cache for up to `ttlSeconds`,
@@ -3573,7 +3523,11 @@ type FrameworkStores = {
 	customerStore?: CustomerStore<unknown>;
 	accessStore?: AccessAssignmentStore<unknown>;
 	accessIndex?: AccessIndex;
+	/** Code-declared catalog (read-path, in-memory; never stored). See `AuthzConfig.catalog`. */
+	catalog?: CodeCatalog | CodeCatalogInput;
 	catalogStore?: AccessCatalogStore;
+	/** Read-through {@link ResourceProvider} over the app's own resource data (never SDK-stored). */
+	resources?: ResourceProvider;
 	magicLinkStore?: MagicLinkStore<unknown>;
 	workloadTokenStore?: WorkloadTokenStore;
 	/**
@@ -3656,8 +3610,6 @@ type RemoteConfigRetryOptions = {
 	jitterRatio?: number;
 	/** Timeout for each ConfigSource load attempt. Defaults to 30000ms. */
 	loadTimeoutMs?: number;
-	/** Called before each retry is scheduled. Throw to stop retrying and reject ready(). */
-	onRetry?: RemoteConfigRetryHook;
 };
 type ConfigSubscriptionOptions = {
 	/**
@@ -3793,11 +3745,6 @@ type CIAMConfig<
 	*/
 	ciamId?: string;
 	/**
-	* Signing key for CIAM JWT tokens. Must be provided via Vault only (never in code).
-	* Store in Vault under ciam.signingKey.
-	*/
-	signingKey?: string;
-	/**
 	* Server-side session store for CIAM sessions (required for server-side session
 	* tracking and first-party logout).
 	*/
@@ -3871,14 +3818,13 @@ type CIAM<
 	ready?: (timeout?: number) => Promise<void>;
 };
 /**
-* CIAM config that code may provide; excludes vault-only secrets (`signingKey`,
-* `providers`) and ES-derived endpoint URLs (`customerLoginUrl`,
-* `customerCallbackUrl`, `customerProvidersUrl`).
+* CIAM config that code may provide; excludes vault-only secrets (`providers`) and ES-derived
+* endpoint URLs (`customerLoginUrl`, `customerCallbackUrl`, `customerProvidersUrl`).
 */
 type CIAMConfigFromCode<
 	TMagicLinkData = Record<string, never>,
 	TCustomerData = Record<string, never>
-> = Omit<CIAMConfig<TMagicLinkData, TCustomerData>, "signingKey" | "providers" | "customerLoginUrl" | "customerCallbackUrl" | "customerProvidersUrl">;
+> = Omit<CIAMConfig<TMagicLinkData, TCustomerData>, "providers" | "customerLoginUrl" | "customerCallbackUrl" | "customerProvidersUrl">;
 /** Read Users and Groups via the SCIM endpoints. Gates `GET /iam/Users` and `GET /iam/Groups`. */
 declare const ES_IAM_READ: Permission;
 /**
@@ -3908,7 +3854,7 @@ declare const ES_SDK_PERMISSIONS: readonly Permission[];
 /**
 * The logical SDK endpoint operations that require authorization, mapped to the Permission and the
 * principal scope to check. This is the single source of truth the router/guards consult so the
-* enforcement contract lives in one place rather than scattered per route (AUDIT §1.32). The IAM
+* enforcement contract lives in one place rather than scattered per route (AUDIT_HISTORY.md §1.32). The IAM
 * permission for a SCIM request is chosen from `iam.read` / `iam.users.write` / `iam.groups.write`
 * by SCIM resource + HTTP method (no request-body introspection).
 */
@@ -3994,8 +3940,16 @@ type ESResolvedRoute = {
 	* before the handler runs: the caller must hold the {@link EsEndpointPermission.permission} as a
 	* granted entitlement, or—when `RemoteConfig.authz.scopesAsEntitlements` is enabled—carry the
 	* matching OAuth scope. Login/public/discovery routes omit it.
-	*/
-	requiredPermission?: EsEndpointPermission;
+	*
+	* Three states, chosen so a custom `resolve` cannot silently drop authorization by omission:
+	* - a permission object → enforce it;
+	* - `undefined` (omitted) → when this route replaces a default route that DID carry a permission,
+	*   the router inherits the default's permission (see `routeRequest`); otherwise the route is public;
+	* - `null` → an EXPLICIT opt-out ("this route is intentionally public"): inheritance is suppressed
+	*   even when it shadows a protected default. Making the caller write `null` keeps the downgrade a
+	*   conscious act rather than a forgotten spread.
+	*/
+	requiredPermission?: EsEndpointPermission | null;
 	handler: (request: Request) => Promise<Response>;
 };
 type ESRouteFilterResult = "continue" | "not_handled" | Response;
@@ -4009,10 +3963,17 @@ type ESRoutingOptions = {
 	*/
 	filter?: (request: Request, es: EnterpriseStandard) => Promise<ESRouteFilterResult | undefined> | ESRouteFilterResult;
 	/**
-	* Resolve/replace route target. Return undefined to use default resolution.
-	* `resolveDefault` returns the default route match for this request.
+	* Resolve/replace route target. Return `undefined` to use default resolution.
+	*
+	* `defaultRoute` is the SDK's default match for this request (already resolved), or `undefined`
+	* when no default route matches. When you REPLACE a default route (same path, custom handler), the
+	* router inherits the default's `requiredPermission` unless your returned route sets
+	* `requiredPermission` explicitly (a permission to override it, or `null` to make the route public).
+	* Spreading the default (`{ ...defaultRoute, handler }`) also carries the gate. This is why the
+	* default is passed as a resolved object rather than a thunk: dropping authorization must be
+	* deliberate, not the result of forgetting to copy a field.
 	*/
-	resolve?: (request: Request, es: EnterpriseStandard, resolveDefault: () => ESResolvedRoute | undefined) => Promise<ESResolvedRoute | undefined> | ESResolvedRoute | undefined;
+	resolve?: (request: Request, es: EnterpriseStandard, defaultRoute: ESResolvedRoute | undefined) => Promise<ESResolvedRoute | undefined> | ESResolvedRoute | undefined;
 	/**
 	* Wrap the final handler (logging, metrics, policy, etc.).
 	*/
@@ -4153,6 +4114,37 @@ type BaseTenant = {
 	configLocator: TenantConfigLocator;
 };
 type TenantEsFactory<TTenant extends BaseTenant = BaseTenant> = (tenant: TTenant) => EnterpriseStandard;
+/**
+* A single-flight cache of per-tenant {@link EnterpriseStandard} instances, supplied by the app.
+*
+* The SDK does NOT cache tenant runtimes itself: constructing an `EnterpriseStandard` opens a
+* ConfigSource load/subscribe (a vault round-trip / websocket join) and holds timers, so one
+* instance per tenant-routed request would be both a per-request cold start and an unbounded leak.
+* Instead, apps bring a cache — `lru-cache` is the recommended implementation, and this type is
+* deliberately structurally compatible with `LRUCache<string, EnterpriseStandard>` so an app can
+* pass its cache instance straight through:
+*
+* ```ts
+* const esCache = new LRUCache<string, EnterpriseStandard>({
+*   max: 100,
+*   ttl: 1000 * 60 * 60,
+*   dispose: (es) => es.close(), // full lifecycle: evicted/invalidated runtimes are closed
+*   fetchMethod: async (id) => {
+*     const tenant = await tenants.get(id); // `tenants` assigned below; resolved at call time
+*     return tenant ? createTenantEs(tenant) : undefined;
+*   },
+* });
+* const tenants = new InMemoryTenantStore({ esCache });
+* ```
+*
+* `fetch` MUST be single-flight (concurrent calls for one id share one construction) — `lru-cache`
+* guarantees this. `delete` is called by the store on `upsert`/`delete` so a changed/removed tenant
+* record invalidates (and, via `dispose`, closes) the stale runtime.
+*/
+type TenantEsCache = {
+	fetch(id: string): Promise<EnterpriseStandard | undefined>;
+	delete(id: string): unknown;
+};
 interface TenantStore<TTenant extends BaseTenant = BaseTenant> {
 	get(id: string): Promise<TTenant | undefined>;
 	list(options?: ListOptions): Promise<ListResult<TTenant>>;
@@ -4160,20 +4152,13 @@ interface TenantStore<TTenant extends BaseTenant = BaseTenant> {
 	delete(id: string): Promise<number>;
 	getEs(id: string): Promise<EnterpriseStandard | undefined>;
 }
-type InMemoryTenantStoreOptions<TTenant extends BaseTenant = BaseTenant> = {
-	createEs?: TenantEsFactory<TTenant>;
+type InMemoryTenantStoreOptions = {
+	/**
+	* App-owned cache of per-tenant `EnterpriseStandard` instances (see {@link TenantEsCache}).
+	* Required to use {@link InMemoryTenantStore.getEs}; the store never constructs runtimes itself.
+	*/
+	esCache?: TenantEsCache;
 };
-declare class InMemoryTenantStore<TTenant extends BaseTenant = BaseTenant> implements TenantStore<TTenant> {
-	private readonly store;
-	private readonly createEs?;
-	constructor(options?: InMemoryTenantStoreOptions<TTenant>);
-	get(id: string): Promise<TTenant | undefined>;
-	list(options?: ListOptions): Promise<ListResult<TTenant>>;
-	upsert(tenant: TTenant): Promise<TTenant>;
-	delete(id: string): Promise<number>;
-	getEs(id: string): Promise<EnterpriseStandard | undefined>;
-}
-declare function sendTenantWebhook(webhookUrl: string, payload: TenantWebhookPayload, log: Logger): Promise<void>;
 /**
 * Persisted workforce user record with identity fields and tracking metadata.
 *
@@ -4286,12 +4271,12 @@ type BaseUser<TExtended = object> = BaseUserFields & {
 	* Optional SCIM roles.
 	* Commonly set by IAM inbound SCIM provisioning flows.
 	*/
-	roles?: Role[];
+	roles?: Role2[];
 	/**
 	* Optional SCIM groups.
 	* Commonly set by IAM inbound SCIM provisioning flows.
 	*/
-	groups?: Group[];
+	groups?: Group2[];
 	/**
 	* Optional SCIM entitlements.
 	* Commonly set by IAM inbound SCIM provisioning flows.
@@ -4447,21 +4432,19 @@ type Permission = AuthzEntityBase & SubjectTypeScoping & {
 	/** When true, the permission also applies to a resource's sub-resources (maps to OAA `apply_to_sub_resources`). */
 	applyToSubResources?: boolean;
 };
-type Role2 = AuthzEntityBase & SubjectTypeScoping & {
+type Role = AuthzEntityBase & SubjectTypeScoping & {
 	/** True when this catalog entry should be exposed as requestable access in IAM tooling. */
 	requestable?: boolean;
-	/** Nested child roles composed into this role (definitional). */
-	roles?: Array<string | Role2>;
-	/** Permissions this role confers (definitional). */
+	/** Permissions this role confers (definitional). Roles are flat bundles — OAA has no nested-role edge. */
 	permissions?: Array<string | Permission>;
 };
-type Group2 = AuthzEntityBase & SubjectTypeScoping & {
+type Group = AuthzEntityBase & SubjectTypeScoping & {
 	/** True when this catalog entry should be exposed as requestable access in IAM tooling. */
 	requestable?: boolean;
 	/** Nested child groups composed into this group (definitional). */
-	groups?: Array<string | Group2>;
+	groups?: Array<string | Group>;
 	/** Roles this group confers (group is the principal). Projected as OAA `local_group` role assignments. */
-	roles?: Array<string | Role2>;
+	roles?: Array<string | Role>;
 	/** Permissions this group confers (group is the principal). Projected as OAA `local_group` application permissions. */
 	permissions?: Array<string | Permission>;
 	/**
@@ -4484,7 +4467,7 @@ type OaaAccessTargetType = "group" | "role" | "permission";
 */
 type EntitlementType = OaaAccessTargetType;
 /** A catalog Entitlement: a group, role, or permission (see {@link EntitlementType}). */
-type Entitlement = Group2 | Role2 | Permission;
+type Entitlement = Group | Role | Permission;
 declare const ENTERPRISE_AUTHZ_GROUP_SCHEMA = "urn:enterprisestandard:params:scim:schemas:extension:authz:2.0:Group";
 type AuthzScimGroupType = OaaAccessTargetType;
 type AuthzScimGroupExtension = {
@@ -4529,24 +4512,27 @@ interface EntityStore<TEntity> {
 	list(options?: ListOptions): Promise<ListResult<TEntity>>;
 	/**
 	* Optional `externalId` secondary lookup. When implemented, the SDK resolves SCIM
-	* `externalId eq "..."` filters through this index instead of a full `list()` scan (AUDIT §7.4).
+	* `externalId eq "..."` filters through this index instead of a full `list()` scan (AUDIT_HISTORY.md §7.4).
 	* Returns the single entity with the given `externalId`, or `undefined` when none matches. Stores
 	* that omit it fall back to scanning `list()`.
 	*/
 	getByExternalId?(externalId: string): Promise<TEntity | undefined>;
 }
 /** The catalog entity kind a {@link CatalogChange} refers to. */
-type CatalogChangeKind = OaaAccessTargetType | "resource";
+type CatalogChangeKind = OaaAccessTargetType;
 /**
 * A reactive catalog change emitted AFTER a durable `set()`/`delete()` lands on the backing store.
 * `set` carries the persisted entity so subscribers can project exactly what was stored without an
 * extra read; `delete` carries only the id, which the SDK projects as an incremental OAA entity
 * delete (full incremental CRUD). A later full `oaa.sync` remains the reconciliation safety net.
+*
+* Resource changes are NOT catalog changes: resources live in the application's own store and are
+* signaled through {@link ResourceProvider.changed} instead.
 */
 type CatalogChange = {
 	op: "set";
 	kind: CatalogChangeKind;
-	entity: Group2 | Role2 | Permission | Resource;
+	entity: Group | Role | Permission;
 } | {
 	op: "delete";
 	kind: CatalogChangeKind;
@@ -4555,10 +4541,9 @@ type CatalogChange = {
 /** Listener invoked with a {@link CatalogChange} after a durable catalog write lands. */
 type CatalogChangeListener = (change: CatalogChange) => void;
 type AccessCatalogStore = {
-	groups: EntityStore<Group2>;
-	roles: EntityStore<Role2>;
+	groups: EntityStore<Group>;
+	roles: EntityStore<Role>;
 	permissions: EntityStore<Permission>;
-	resources: EntityStore<Resource>;
 	/**
 	* Reactive change subscription (the catalog analog of {@link ReactiveHandle}). When implemented,
 	* the SDK subscribes once at wiring time and projects each change to OAA. Stores that omit it do
@@ -4567,6 +4552,64 @@ type AccessCatalogStore = {
 	*/
 	afterChange?(listener: CatalogChangeListener): () => void;
 };
+/** A resource change signaled by a {@link ResourceProvider} after the app's own write lands. */
+type ResourceChange = {
+	id: string;
+	deleted?: boolean;
+};
+/** Listener invoked with a {@link ResourceChange}; see {@link ResourceProvider.changed}. */
+type ResourceChangeListener = (change: ResourceChange) => void;
+/**
+* Read-through view over the application's own resource data (teams, projects, regions, ...).
+*
+* Resources are app-domain rows the application already persists in its own database/ORM — they are
+* NOT authorization state, so the SDK never stores a copy. Instead the app wires a `ResourceProvider`
+* (via `FrameworkStores.resources` / `AuthzConfig.resources`) and the SDK reads through it for
+* closure expansion, SCIM Group projection, and OAA projection. There is no seeding step, no
+* dual-write on CRUD routes, and no lifecycle to keep in sync: `db.insert(...)` (plus a `changed`
+* signal) is the whole integration.
+*
+* **Resource-derived entitlements.** `entitlements(resource)` is an app-authored PURE function that
+* derives the per-resource requestable entitlement {@link Group}s (e.g. "Team X (member)") on demand.
+* Unlike catalog entitlements (definitions authored as rows in the {@link AccessCatalogStore}),
+* resource-derived groups are rules, not rows: their definitions are never stored, they appear in
+* SCIM Groups list/get and OAA projection automatically, and member grants against their ids expand
+* with the group's `resources` scope like any catalog group (grants against both kinds are stored
+* identically as access roots). Keep the function next to your catalog entitlement definitions so the
+* logic stays grep-able and debuggable — it is plain code the SDK calls, not configuration.
+* `entitlement(id)` is the deliberate, app-authored reverse resolver (derived group id -> group);
+* both must be provided together.
+*/
+type ResourceProvider = {
+	/** Point lookup by resource id (e.g. `'team:t1'`). */
+	get(id: string): Promise<Resource | undefined>;
+	/** Offset-paginated enumeration of all resources (standard `start`/`limit`/`total` ListResult). */
+	list(options?: ListOptions): Promise<ListResult<Resource>>;
+	/**
+	* Direct children of a resource (for nested resource trees, e.g. a team's projects). When omitted,
+	* the SDK falls back to the `Resource.resources` refs returned by `get`/`list`.
+	*/
+	children?(id: string): Promise<Resource[]>;
+	/**
+	* Pure, synchronous derivation of a resource's requestable entitlement {@link Group}s. Called on
+	* demand (results are memoized alongside catalog adjacency and invalidated by `changed`); must be
+	* deterministic for a given resource. Requires `entitlement` to be provided as well.
+	*/
+	entitlements?(resource: Resource): Group[];
+	/**
+	* Reverse resolution of a resource-derived entitlement id to its {@link Group} (or `undefined`
+	* when the id is not a resource-derived entitlement). App-authored on purpose — the id scheme is
+	* the app's, and an explicit resolver keeps derivation traceable. Required when `entitlements` is
+	* provided.
+	*/
+	entitlement?(id: string): Promise<Group | undefined>;
+	/**
+	* Change signal invoked after the app's own resource write/delete lands. Drives adjacency-cache
+	* invalidation, targeted index reconciliation, and incremental OAA resource projection. Returns an
+	* unsubscribe function. Without it, drift is only repaired by a later full reconcile/sync.
+	*/
+	changed?(listener: ResourceChangeListener): () => void;
+};
 /**
 * Audit provenance captured for a granted root. The active OpenTelemetry trace is the
 * primary correlator; vendor request/correlation ids are retained alongside it.
@@ -4614,7 +4657,7 @@ type SubjectScope = SubjectType | SubjectType[] | "any";
 * Platform-wide ceiling of principal kinds the SDK currently allows to hold an entitlement. This is
 * the upper bound on {@link SubjectTypeScoping.assignableSubjectTypes}: even an unset (unrestricted)
 * entitlement is implicitly capped to these kinds. `customer` is intentionally excluded until the
-* customer-grant model (AUDIT §1.30) is resolved; granting a `customer` is rejected platform-wide.
+* customer-grant model (AUDIT_HISTORY.md §1.30) is resolved; granting a `customer` is rejected platform-wide.
 */
 declare const PLATFORM_ASSIGNABLE_SUBJECT_TYPES: SubjectType[];
 /**
@@ -4635,8 +4678,8 @@ declare function assertValidSubjectTypeScoping(entity: SubjectTypeScoping & {
 */
 type AccessChange<
 	TUser = BaseUser,
-	TGroup = Group2,
-	TRole = Role2,
+	TGroup = Group,
+	TRole = Role,
 	TPermission = Permission
 > = {
 	/** Deterministic id derived from `subjectType:subject:targetType:target[:scope]`; assigned by stores/orchestration. */
@@ -4683,7 +4726,7 @@ interface AccessAssignmentStore<TAccess = AccessChange> {
 	/**
 	* Optional batched form of {@link listByTarget}: return the active roots for many targets in one
 	* call, keyed by the input `"${targetType}:${target}"` string. When implemented, SCIM list projects
-	* a whole page of entitlement members without an N+1 `listByTarget` fan-out (AUDIT §7.4). Stores
+	* a whole page of entitlement members without an N+1 `listByTarget` fan-out (AUDIT_HISTORY.md §7.4). Stores
 	* that omit it fall back to per-target `listByTarget`.
 	*/
 	listByTargets?(targets: Array<{
@@ -4703,7 +4746,7 @@ type SubjectRef = {
 	subjectType?: SubjectType;
 };
 /** A single check target, optionally scoped to a resource. */
-type AccessCheckTarget<TTarget = Group2 | Role2 | Permission> = {
+type AccessCheckTarget<TTarget = Group | Role | Permission> = {
 	targetType: OaaAccessTargetType;
 	target: AccessRef<TTarget>;
 	resource?: AccessRef<Resource>;
@@ -4732,9 +4775,9 @@ type EffectiveEdge = {
 * Revoking one role removes only its rows — overlapping permissions from the other role remain.
 */
 interface AccessIndex {
-	has(subject: AccessRef<BaseUser>, targetType: OaaAccessTargetType, target: AccessRef<Group2 | Role2 | Permission>, resource?: AccessRef<Resource>, subjectType?: SubjectType): Promise<AuthzDecision>;
-	hasGroup(subject: AccessRef<BaseUser>, group: AccessRef<Group2>, resource?: AccessRef<Resource>, subjectType?: SubjectType): Promise<AuthzDecision>;
-	hasRole(subject: AccessRef<BaseUser>, role: AccessRef<Role2>, resource?: AccessRef<Resource>, subjectType?: SubjectType): Promise<AuthzDecision>;
+	has(subject: AccessRef<BaseUser>, targetType: OaaAccessTargetType, target: AccessRef<Group | Role | Permission>, resource?: AccessRef<Resource>, subjectType?: SubjectType): Promise<AuthzDecision>;
+	hasGroup(subject: AccessRef<BaseUser>, group: AccessRef<Group>, resource?: AccessRef<Resource>, subjectType?: SubjectType): Promise<AuthzDecision>;
+	hasRole(subject: AccessRef<BaseUser>, role: AccessRef<Role>, resource?: AccessRef<Resource>, subjectType?: SubjectType): Promise<AuthzDecision>;
 	hasPermission(subject: AccessRef<BaseUser>, permission: AccessRef<Permission>, resource?: AccessRef<Resource>, subjectType?: SubjectType): Promise<AuthzDecision>;
 	hasAny(subject: AccessRef<BaseUser>, targets: AccessCheckTarget[], subjectType?: SubjectType): Promise<AuthzDecision>;
 	hasAll(subject: AccessRef<BaseUser>, targets: AccessCheckTarget[], subjectType?: SubjectType): Promise<AuthzDecision>;
@@ -4750,6 +4793,18 @@ interface AccessIndex {
 	* enumerate subjects simply restrict full reconcile to subjects known from the assignment store.
 	*/
 	listSubjects?(): Promise<SubjectRef[]>;
+	/**
+	* Set or clear the subject-disabled marker. While set, every `has*` check for the subject MUST
+	* deny (`allowed: false`, `metadata.reason: 'subject_disabled'`) without touching the subject's
+	* grants — re-enabling restores the previous decisions unchanged. Driven by SCIM lifecycle
+	* (`active: false` sets it, `active: true` clears it, delete clears it after revoking roots);
+	* session invalidation stays the IdP's job (back-channel logout), this only blocks authorization.
+	* The marker is independent of edge materialization: `materialize`/`removeByRoot`/`clear` and
+	* reconcile never set or clear it. Optional, but implement it on any index used with SCIM Users.
+	*/
+	setSubjectDisabled?(subject: string, subjectType: SubjectType, disabled: boolean): Promise<void>;
+	/** Whether the subject-disabled marker is currently set (see {@link setSubjectDisabled}). */
+	isSubjectDisabled?(subject: string, subjectType?: SubjectType): Promise<boolean>;
 }
 type OaaSyncOptions = {
 	mode?: "snapshot" | "incremental";
@@ -4773,21 +4828,26 @@ type OaaSyncInput<
 	TResource
 > = {
 	users?: Iterable<TUser> | AsyncIterable<TUser>;
-	groups?: Iterable<TGroup | Group2> | AsyncIterable<TGroup | Group2>;
-	roles?: Iterable<Role2> | AsyncIterable<Role2>;
+	groups?: Iterable<TGroup | Group> | AsyncIterable<TGroup | Group>;
+	roles?: Iterable<Role> | AsyncIterable<Role>;
 	permissions?: Iterable<Permission> | AsyncIterable<Permission>;
 	resources?: Iterable<TResource> | AsyncIterable<TResource>;
 	access?: Iterable<AccessChange> | AsyncIterable<AccessChange>;
 };
+/** One item in a batched incremental access push ({@link OaaClient.pushAccessChanges}). */
+type OaaAccessChangeBatchItem = {
+	change: AccessChange;
+	op: "add" | "delete";
+};
 interface OaaClient<
 	TUser = BaseUser,
-	TGroup = Group2,
-	TRole = Role2,
+	TGroup = Group,
+	TRole = Role,
 	TPermission = Permission,
 	TResource = Resource
 > {
 	pushUser(user: TUser): Promise<void>;
-	pushGroup(group: TGroup | Group2): Promise<void>;
+	pushGroup(group: TGroup | Group): Promise<void>;
 	pushRole(role: TRole): Promise<void>;
 	pushPermission(permission: TPermission): Promise<void>;
 	pushResource(resource: TResource): Promise<void>;
@@ -4805,6 +4865,15 @@ interface OaaClient<
 	deleteResource(id: string): Promise<void>;
 	grant(change: AccessChange): Promise<void>;
 	revoke(change: AccessChange): Promise<void>;
+	/**
+	* Project a batch of access grants/revokes as ONE incremental payload (many
+	* `identity_to_permissions` / `local_users` entries in a single request), rather than one HTTPS
+	* push per change. Used by the SCIM mutation path so a group PUT with N member changes is O(1)
+	* pushes, not O(N). Referentially-closed like {@link OaaClient.grant}: each `add` item's conferred
+	* definitions are merged into the payload. Best-effort — a failure is non-fatal to the SCIM
+	* response (a later full `sync` reconciles), same contract as the single-change methods.
+	*/
+	pushAccessChanges(items: OaaAccessChangeBatchItem[]): Promise<void>;
 	sync(input: OaaSyncInput<TUser, TGroup, TResource>, options?: OaaSyncOptions): Promise<OaaSyncResult>;
 	/**
 	* Synchronous readiness check. Returns true once OAA config (url, providerId,
@@ -4843,40 +4912,40 @@ type AccessMutationResult<TChange = AccessChange> = {
 type ScimMutationSummary<TChange = AccessChange> = {
 	metadataApplied: boolean;
 	access: AccessMutationResult<TChange>[];
+	/**
+	* Best-effort egress outcome for the mutation, populated after the store loop commits. Egress (OAA
+	* incremental push and IAM-delta patch-back) is awaited inside the request but is NON-fatal: a
+	* failure sets `degraded` here and warn-logs, but never turns a committed store mutation into a SCIM
+	* error. Absent when the mutation failed before egress ran or nothing was committed. The IAM server
+	* relies on periodic full sync / its own aggregation to reconcile a degraded egress.
+	*/
+	egress?: EgressOutcome;
+};
+/**
+* Outcome of the best-effort egress fan-out that runs after a SCIM mutation's store writes commit.
+* Each channel is `ok` when it either succeeded or was not attempted (not configured). `degraded`
+* with a `reason` when the awaited push/patch-back failed.
+*/
+type EgressOutcome = {
+	oaa: EgressChannelOutcome;
+	delta: EgressChannelOutcome;
+};
+type EgressChannelOutcome = {
+	status: "ok" | "degraded" | "skipped";
+	reason?: string;
 };
 type AuthzDecision = {
 	allow: boolean;
 	matched?: AccessChange[];
 	metadata?: Record<string, unknown>;
 };
-/**
-* Scope for {@link Authz.reconcile}. The `AccessIndex` is a disposable derivation of
-* `AccessAssignmentStore` roots + `AccessCatalogStore`; reconcile re-derives it (idempotently) at one
-* of three scopes:
-* - **per-root**: re-expand and re-materialize a single root (idempotent; the inline grant path).
-* - **per-subject**: clear the subject's index rows, then re-materialize its live roots. One pass
-*   handles both adds and removes and bounds any deny window to that subject. Basis for SCIM delete
-*   and partial-failure repair.
-* - **full** (`{ all: true }`): reconcile the union of assignment subjects and index subjects;
-*   index subjects with no live roots are cleared to empty (sweeps orphans). Avoids a global clear so
-*   there is no all-denied window. This is the rebuild that rides the periodic OAA full-sync cadence.
-*/
-type ReconcileScope = {
-	root: AccessChange | string;
-} | {
-	subject: string;
-	subjectType?: SubjectType;
-} | {
-	all: true;
-};
-/** Result of an {@link Authz.reconcile} run. */
+/** Result of an {@link Authz.reconcile} run (a full reconciliation). */
 type ReconcileReport = {
-	scope: "root" | "subject" | "full";
-	/** Subjects reconciled (1 for per-subject; the union size for full; 0 for per-root). */
+	/** Subjects reconciled (the union of assignment-store subjects and index subjects). */
 	subjects: number;
 	/** Roots re-expanded + re-materialized. */
 	roots: number;
-	/** Subjects cleared because they had no live roots (orphans swept; full/per-subject only). */
+	/** Subjects cleared because they had no live roots (orphans swept). */
 	cleared: number;
 };
 /**
@@ -4889,20 +4958,48 @@ type Authz = {
 	oaa: OaaClient;
 	/** The wired closure index powering `has*`, when the app provided one via stores. */
 	accessIndex?: AccessIndex;
-	has(subject: AccessRef<BaseUser>, targetType: OaaAccessTargetType, target: AccessRef<Group2 | Role2 | Permission>, resource?: AccessRef<Resource>, subjectType?: SubjectType): Promise<AuthzDecision>;
-	hasGroup(subject: AccessRef<BaseUser>, group: AccessRef<Group2>, resource?: AccessRef<Resource>, subjectType?: SubjectType): Promise<AuthzDecision>;
-	hasRole(subject: AccessRef<BaseUser>, role: AccessRef<Role2>, resource?: AccessRef<Resource>, subjectType?: SubjectType): Promise<AuthzDecision>;
+	has(subject: AccessRef<BaseUser>, targetType: OaaAccessTargetType, target: AccessRef<Group | Role | Permission>, resource?: AccessRef<Resource>, subjectType?: SubjectType): Promise<AuthzDecision>;
+	hasGroup(subject: AccessRef<BaseUser>, group: AccessRef<Group>, resource?: AccessRef<Resource>, subjectType?: SubjectType): Promise<AuthzDecision>;
+	hasRole(subject: AccessRef<BaseUser>, role: AccessRef<Role>, resource?: AccessRef<Resource>, subjectType?: SubjectType): Promise<AuthzDecision>;
 	hasPermission(subject: AccessRef<BaseUser>, permission: AccessRef<Permission>, resource?: AccessRef<Resource>, subjectType?: SubjectType): Promise<AuthzDecision>;
 	hasAny(subject: AccessRef<BaseUser>, targets: AccessCheckTarget[], subjectType?: SubjectType): Promise<AuthzDecision>;
 	hasAll(subject: AccessRef<BaseUser>, targets: AccessCheckTarget[], subjectType?: SubjectType): Promise<AuthzDecision>;
 	/**
-	* Re-derive the `AccessIndex` from `AccessAssignmentStore` roots + `AccessCatalogStore` at the given
-	* {@link ReconcileScope}. Idempotent and SDK-owned (it encodes the `expandRoot` closure); stores only
-	* provide persistence. Run it off the request path — on catalog/resource-tree edits (§1.2a), to
-	* repair a partially-applied SCIM mutation, or on the periodic full-sync cadence. Resolves to a
-	* {@link ReconcileReport}. No-op (empty report) when no `accessIndex`/`catalogStore` is wired.
+	* Run a **full reconciliation**: re-derive the entire `AccessIndex` from `AccessAssignmentStore`
+	* roots + `AccessCatalogStore`. It enumerates the union of every assignment-store subject and every
+	* index subject, re-expands every one of their roots through the catalog closure (`expandRoot`), and
+	* sweeps orphaned index rows (subjects with no live roots). It is idempotent and SDK-owned; stores
+	* only provide persistence.
+	*
+	* This is DELIBERATELY the only reconcile scope on the public surface, and it is EXPENSIVE: its time
+	* and memory cost grow with the total number of grants (it lists and re-expands every root in the
+	* system). Treat it as a maintenance/backstop operation, NOT a per-mutation step.
+	*
+	* WHEN to call it:
+	* - From a cron job, scheduled worker, or queue task on a maintenance cadence (drift/orphan sweep).
+	* - Via the SDK-owned, Ops-gated `POST ${basePath}/authz/oaa/sync` endpoint (which runs this full
+	*   reconcile and then a full OAA snapshot sync).
+	*
+	* When NOT to call it:
+	* - NEVER inline with CRUD-style mutations. Catalog edits (`AccessCatalogStore` `afterChange`),
+	*   resource changes ({@link ResourceProvider.changed}), and SCIM grant/revoke/delete — including
+	*   automatic repair of a partially-applied SCIM mutation — are reconciled by the SDK internally
+	*   and targeted to the affected subjects. App code does not need to call `reconcile()` after a
+	*   catalog, resource, or membership write.
+	*
+	* Resolves to a {@link ReconcileReport}. No-op (empty report) when no `accessIndex`/`catalogStore`
+	* is wired. Always run it off the request path.
+	*/
+	reconcile(): Promise<ReconcileReport>;
+	/**
+	* Resolve once the internal reconcile queue is drained (every catalog-/resource-change reconcile
+	* enqueued so far has finished). Those reconciles are serialized and coalescing (a queued full
+	* reconcile absorbs later ones); `settle()` returns the current queue tail so a caller can guarantee
+	* request-triggered reconciles complete inside the request lifecycle (serverless-safe — no detached
+	* reconcile survives the response). The SCIM mutation path awaits this after its store writes. It
+	* never rejects (queued reconcile failures are isolated and logged).
 	*/
-	reconcile(scope: ReconcileScope): Promise<ReconcileReport>;
+	settle(): Promise<void>;
 };
 /** Why an {@link AccessCheckResult} resolved the way it did. */
 type AccessCheckReason = "ok" | "unauthenticated" | "forbidden" | "not_configured";
@@ -4947,7 +5044,7 @@ declare function configTrustedClientGrants(authz: AuthzConfig | null | undefined
 /**
 * Resolve an access subject/target/resource reference (a string id or an object carrying one) to its
 * canonical, trimmed string id. This is the single id-resolution rule shared across the authz stack
-* (AUDIT §8.4): `accessRootId`, the access stores, the access index, and SCIM diff keys all key off
+* (AUDIT_HISTORY.md §8.4): `accessRootId`, the access stores, the access index, and SCIM diff keys all key off
 * the same normalization so distinct roots never collapse and identical references never diverge.
 * Returns `''` when no id can be resolved.
 */
@@ -4958,63 +5055,6 @@ declare function accessRefId(value: unknown): string;
 * default, or `applyToApplication`) collapses to the `app` scope key.
 */
 declare function accessRootId(change: AccessChange): string;
-/**
-* Memoizes catalog node reads (`groups/roles/permissions/resources.get`) and resolved sub-resource
-* trees across multiple `expandRoot` calls so that re-expanding many roots that share catalog nodes
-* (the reconcile path after a catalog change, AUDIT §7.4) does not re-read the same nodes once per
-* root. The cache is scoped to a single {@link AccessCatalogStore} instance (never module-global) so
-* it cannot bleed catalog state across tenants. Invalidate it (or `clear()` it) whenever the catalog
-* changes; the SDK wires this to the catalog's `afterChange` stream.
-*/
-declare class CatalogAdjacencyCache {
-	private readonly catalog;
-	private readonly nodes;
-	private readonly subResources;
-	constructor(catalog: AccessCatalogStore);
-	getNode(kind: "group" | "role" | "permission" | "resource", id: string): Promise<Group2 | Role2 | Permission | Resource | undefined>;
-	resourceAndSubResourceIds(resourceId: string): Promise<string[]>;
-	/**
-	* Drop memoized entries affected by a catalog change. Catalog edits are infrequent relative to
-	* reads, and graph/resource-tree edges are interdependent, so we clear conservatively: the changed
-	* node plus the whole resource sub-tree memo (a single edit can change many sub-trees).
-	*/
-	invalidate(_change?: CatalogChange): void;
-	clear(): void;
-}
-/**
-* Expand a granted root into the set of effective edges it justifies, traversing the catalog
-* composition graph (`Group.groups/roles/permissions`, `Role.roles/permissions`). Cycles are
-* tolerated via a per-root visited set. Resource-scoped permissions that declare
-* `applyToSubResources` are expanded across the resource's sub-resource tree.
-*
-* Catalog-graph or resource-tree drift is repaired off the request path via
-* `es.authz.reconcile` (catalog `afterChange` triggers targeted or full reconcile).
-*
-* Pass a {@link CatalogAdjacencyCache} to memoize catalog node reads across many roots (the
-* reconcile path, AUDIT §7.4); omit it to read the catalog directly per node.
-*/
-declare function expandRoot(root: AccessChange, catalog: AccessCatalogStore, cache?: CatalogAdjacencyCache): Promise<EffectiveEdge[]>;
-/**
-* The catalog entity definitions transitively referenced by an entitlement (group or role): the
-* conferred roles (and their nested roles), permissions, nested groups, and resource scopes. Used to
-* make an incremental OAA push referentially closed — every id an entitlement references is
-* accompanied by its definition so the downstream projection never carries a dangling reference.
-*/
-type ReferencedDefinitions = {
-	groups: Group2[];
-	roles: Role2[];
-	permissions: Permission[];
-	resources: Resource[];
-};
-/**
-* Collect the catalog definitions reachable from an entitlement's own references, EXCLUDING the root
-* entity itself (the caller pushes that separately). Walks `Group.groups/roles/permissions/resources`
-* and `Role.roles/permissions`, plus each resource's sub-resource tree. String references are
-* resolved through the catalog (or the shared {@link CatalogAdjacencyCache}); inline object
-* references are used directly. Unresolvable string ids are skipped (a later full sync reconciles).
-* Cycle-safe via a per-call visited set.
-*/
-declare function collectReferencedDefinitions(root: Group2 | Role2, rootKind: "group" | "role", catalog: AccessCatalogStore, cache?: CatalogAdjacencyCache): Promise<ReferencedDefinitions>;
 type EsCapabilityKey = "sso.login" | "sso.jit" | "sso.logout" | "sso.back_channel_logout" | "ciam.magic_link" | "ciam.oidc_login" | "ciam.customer" | "ciam.logout" | "iam.users" | "iam.groups" | "workload.incoming" | "workload.outgoing" | "authz.oaa";
 type EsCapabilityEndpointUrls = {
 	readyzUrl: string;
@@ -5061,6 +5101,48 @@ type EsCapabilitiezManifest = {
 	capabilities: Record<EsCapabilityKey, EsCapabilityState>;
 };
 /**
+* Fields a {@link ConfigSource} may attach to a thrown error so the SDK can classify load/subscribe
+* failures structurally instead of by fragile message-substring matching (§2.1). All fields are
+* optional except `kind`; a custom source SHOULD set as many as it knows.
+*/
+type ConfigSourceErrorInit = {
+	/** Best-effort classification of the failure. */
+	kind: RemoteConfigLoadErrorKind;
+	/**
+	* Explicit recoverability. When set, it wins over any heuristic: `true` forces a retry, `false`
+	* forces the initial load to reject `ready()` permanently. Omit to let the SDK decide (retry unless
+	* provably unrecoverable).
+	*/
+	recoverable?: boolean;
+	/** Transport/error code when known (e.g. `'ECONNREFUSED'`, `'not_found'`). */
+	code?: string;
+	/** HTTP-like status when known (e.g. `401`, `503`). */
+	status?: number;
+	/** Config path/key when known. */
+	path?: string;
+	/** Config source transport when known (e.g. `'vault'`, `'azure'`). */
+	sourceType?: ConfigSourceType | string;
+	/** Underlying cause, preserved on the standard `Error.cause` chain. */
+	cause?: unknown;
+};
+/**
+* Structured error a {@link ConfigSource} can throw from `load()`/`subscribe()` so the SDK classifies
+* and retries it based on typed fields rather than message substrings. The vault source's typed errors
+* already carry `code`/`status`/`sourceType`; custom sources SHOULD throw this (or an error carrying
+* the same fields) for the initial-load retry policy to make the right call. See
+* https://enterprisestandard.com/llms-configuration.txt.
+*/
+declare class ConfigSourceError extends Error {
+	readonly kind: RemoteConfigLoadErrorKind;
+	readonly recoverable?: boolean;
+	readonly code?: string;
+	readonly status?: number;
+	readonly path?: string;
+	readonly sourceType?: ConfigSourceType | string;
+	constructor(message: string, init: ConfigSourceErrorInit);
+}
+declare function isConfigSourceError(value: unknown): value is ConfigSourceError;
+/**
 * Enterprise Controlled ID (ECID) helpers.
 *
 * The ECID is a stable, system-of-record-owned identifier for a single identity (a person or a
@@ -5148,25 +5230,6 @@ type LfvEd25519PrivateJwk = LfvEd25519PublicJwk & {
 type LfvJwks = {
 	keys: LfvEd25519PublicJwk[];
 };
-declare function buildLfvSigningInput(requestId: string, rawBody: string | Uint8Array): Uint8Array;
-declare function parseLfvJwks(jwksJson: string): LfvJwks;
-declare function stringifyLfvJwks(jwks: LfvJwks): string;
-declare function verifyLfvSignature(params: {
-	jwks: string | LfvJwks;
-	kid: string;
-	signatureB64Url: string;
-	requestId: string;
-	rawBody: string;
-}): Promise<boolean>;
-declare function signLfvPayload(params: {
-	privateKeyJwk: LfvEd25519PrivateJwk;
-	requestId: string;
-	rawBody: string;
-}): Promise<string>;
-declare function generateLfvEd25519KeyPair(kid: string): Promise<{
-	privateJwk: LfvEd25519PrivateJwk;
-	publicJwks: LfvJwks;
-}>;
 /**
 * List result from total count, sliced items, start index, and optional limit.
 * When limit is omitted, size is set to total (one logical page), page and pages are 1.
@@ -5190,27 +5253,6 @@ declare function listGenerator<T>(listFn: (start: number, limit: number) => Prom
 * {@link ReadyAccessCatalogEntry.ready} is awaited.
 */
 declare function readyCatalogEntry<TEntity extends object>(entity: TEntity, write: Promise<void>): ReadyAccessCatalogEntry<TEntity>;
-type SessionResponse = {
-	sid: string;
-	authType: "sso" | "ciam";
-	tenantId?: string;
-	sub: string;
-	expiresAt?: Date | string;
-	createdAt: Date | string;
-	lastActivityAt: Date | string;
-	claims?: Record<string, unknown>;
-};
-type SessionDiscoveryOptions = {
-	/**
-	* Restrict discovery to session cookies whose name is `${cookiesPrefix}.session`. Pass the
-	* SSO/CIAM `cookiesPrefix` (or several prefixes) so an app-owned switcher on a SHARED session
-	* store only surfaces its own sessions instead of every `*.session` cookie present on the host.
-	* When omitted, any `*.session` cookie is considered (single-app/dev convenience).
-	*/
-	cookiesPrefix?: string | string[];
-};
-declare function discoverSessions(request: Request, sessionStore: SessionStore, options?: SessionDiscoveryOptions): Promise<SessionResponse[]>;
-declare function discoverSessionRecords(request: Request, sessionStore: SessionStore, options?: SessionDiscoveryOptions): Promise<Session[]>;
 /**
 * Typed store-layer conflict (§5.9). Persistence stores throw this instead of a generic `Error` when
 * a create/uniqueness invariant is violated, so callers (SCIM, iam-delta, app code) can distinguish a
@@ -5369,4 +5411,4 @@ type LfvErrorResponse = {
 };
 /** Generates a ULID */
 declare function generateULID(prefix?: string): string;
-export { workloadTokenResponseSchema, withValidate, withSetCookies, warnLogger, waitOn, version, verifyLfvSignature, validationFailureResponse, userSchema, trustedClientPermissionsForPrincipal, trimTrailingSlash, tokenResponseSchema, stripJsonComments, stringifyLfvJwks, stableConfigHash, silentLogger, signLfvPayload, serializeESConfig, sendTenantWebhook, sameOriginRedirectRules, resolveRedirect, resolveCapturedRedirect, resolveAfterRedirect, readyCatalogEntry, parseLfvJwks, parseJsonc, parseEcid, oidcCallbackSchema, normalizeTenantRoutingStrategy, normalizeTenantPathNamespace, must, mergeConfig, matchTenantPath, listSsoClientIdsFromCookies, listGenerator, list, jwtAssertionClaimsSchema, isStoreConflictError, isRedirectAllowed, isEcid, isConfigLocator, infoLogger, idTokenClaimsSchema, groupResourceSchema, generateULID, generateLfvEd25519KeyPair, formatEcid, expandRoot, discoverSessions, discoverSessionRecords, defaultRedirectPolicies, defaultLogger, deepEqualPlain, decodeUser, debugLogger, configTrustedClientGrants, collectReferencedDefinitions, claimsToUser, captureRedirect, buildTenantPath, buildLfvSigningInput, blockDangerousUrls, assertValidSubjectTypeScoping, assertEcid, allowSameOrigin, allowRelativePaths, allowOrigins, allowHosts, accessRootId, accessRefId, X509Certificate, WorkloadValidators, WorkloadTokenStore, WorkloadTokenResponse, WorkloadPrincipal, WorkloadIncomingOutgoing, WorkloadIdentityStore, WorkloadIdentity, WorkloadGetToken, WorkloadConfigMap, WorkloadConfig, WorkloadClient, Workload, WorkforceUser, VaultWorkloadAuthConfig, VaultWebSocketSecretsConfig, VaultWebSocketAuthHeader, VaultSecretsConfig, VaultLfvSecretsConfig, VaultConfigLocator, ValidateResult, UsersInboundHandlerConfig, UserStoreOptions, UserStore, UserSortOptions, UserListOptions, UpdateTenantRequest, TrustedProvisioningClient, TrustedIdp, TokenValidationResult, TokenResponse, TenantWebhookPayload, TenantValidators, TenantStore, TenantStatus, TenantSortOptions, TenantRoutingStrategy, TenantResponse, TenantPathRoutingStrategy, TenantPathNamespace, TenantPathMatch, TenantListOptions, TenantEsFactory, TenantConfigLocator, SubscriptionMode, SubjectTypeScoping, SubjectType, SubjectScope, SubjectRef, StoreConflictKind, StoreConflictError, StateCookie, StandardSchemaWithValidate, SortOptions, SortDirection, SessionStore, SessionResponse, SessionDiscoveryOptions, Session, ServerOnlyWorkloadConfig, SecretsValidators, SecretsSubscriptionOptions, SecretsSourceType, SecretsSourceMap, SecretsSourceConfig, SecretsSource, SecretsOperationOptions, SecretsModuleConfig, Secrets, SecretRequestSeverity, SecretLifecycleRequest, Secret, User as ScimUser, ScimServiceProviderConfig, ScimSchemaDefinition, ScimSchemaAttributeDefinition, Role as ScimRole, ScimResult, ScimResourceTypeSchemaExtension, ScimResourceType, ScimMutationSummary, ScimListResponse, Group as ScimGroup, ScimError, ScimAuthenticationScheme, SSOValidators, SSOHandlerConfig, SSOConfigFromCode, SSOConfig, SSOAppValidators, SSOAppRegistry, SSO, Role2 as Role, Resource, ResolvedVaultLfvSecretsConfig, RequireReadyResult, RemoteConfigRetryOptions, RemoteConfigRetryHook, RemoteConfigRetryContext, RemoteConfigLoadErrorKind, RemoteConfig, RegisterSSOAppResult, RegisterSSOAppPayload, RegisterSSOAppError, RegisterIAMAppResult, RegisterIAMAppPayload, RegisterIAMAppError, ReferencedDefinitions, RedirectVerdict, RedirectRuleContext, RedirectRule, RedirectResult, RedirectPolicy, RedirectContext, ReconcileScope, ReconcileReport, ReadyzEndpointConfig, ReadyAccessCatalogEntry, ReadinessReport, ReactiveHandle, Photo, PhoneNumber, Permission, ParsedEcid, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, OtelSignalName, OtelSignalConfig, OtelProviderType, OtelProtocol, OtelOAuthClientCredentialsConfig, OtelMetricsSignalConfig, OtelLogRecord, OtelLogLevel, OtelLevels, OtelConfig, OtelAttributes, OtelAttributeValue, Otel, OidcCallbackParams, OaaSyncResult, OaaSyncOptions, OaaSyncInput, OaaClient, OaaAccessTargetType, Name, ModuleReadinessState, ModuleReadiness, ModifiableFrameworkConfig, MetaData, MagicLinkStore, MagicLink, Logger, ListResult, ListOptions, ListFilter, LfvOtpResponse, LfvOtpRequest, LfvJwks, LfvErrorResponse, LfvErrorCode, LfvEd25519PublicJwk, LfvEd25519PrivateJwk, LfvActionRequestBase, LfvActionName, LfvActionAcceptedResponse, JwtBearerWorkloadConfig, JWTAssertionClaims, InMemoryTenantStoreOptions, InMemoryTenantStore, IdentityResolution, IdTokenClaims, IamDeltaResourceType, IamDeltaReconcileResult, IamDeltaMode, IamDeltaIdMapStore, IamDeltaIdMapKey, IamDeltaEmitter, IAMValidators, IAMUsersInbound, IAMInboundUsersConfig, IAMInboundUserContext, IAMHandlerConfig, IAMGroupsOutbound, IAMGroupsInbound, IAMDiscoveryHandlerConfig, IAMDiscoveryContext, IAMDiscoveryConfig, IAMConfigFromCode, IAMConfig, IAMAppValidators, IAMAppRegistry, IAM, GroupsInboundHandlerConfig, GroupSortOptions, GroupResource, GroupMember, GroupListOptions, Group2 as Group, GcpSecretsConfig, GcpConfigLocator, FrameworkWorkloadIncomingOutgoing, FrameworkWorkloadConfigFromCode, FrameworkWorkloadConfig, FrameworkStores, FrameworkSecretsSourceConfig, FrameworkSecretsModuleConfig, FrameworkOtelConfig, FrameworkConfigInput, FrameworkConfig, EsUserExtension, EsModuleName, EsEndpointPermission, EsEndpointOperation, EsCapabilityState, EsCapabilityKey, EsCapabilityEndpointUrls, EsCapabilitiezManifest, EnvironmentType, EntityStore, EntitlementType, Entitlement, EnterpriseStandardBase, EnterpriseStandard, EnterpriseExtension, Email, EffectiveEdge, EcidFormatError, ES_TENANT_MANAGE, ES_SDK_PERMISSIONS, ES_SCIM_USER_EXTENSION_URN, ES_IAM_USERS_WRITE, ES_IAM_READ, ES_IAM_GROUPS_WRITE, ES_ENDPOINT_PERMISSIONS, ES_CIAM_MAGIC_LINK_CREATE, ES_CAPABILITIEZ_READ, ES_AUTHZ_OAA_SYNC, ESValidators, ESRoutingOptions, ESRouteModule, ESRouteFilterResult, ESResolvedRoute, ESErrorOptions, ESError, ESConfigChangeResult, ESConfigChangeOptions, ESConfigChangeCallback, ESConfig, ENTERPRISE_AUTHZ_GROUP_SCHEMA, ECID_SCHEME, DevSecretsConfig, DEFAULT_TENANT_UI_NAMESPACE, DEFAULT_TENANT_API_NAMESPACE, CustomerStoreOptions, CustomerStore, Customer, CreateUserOptions, CreateTenantRequest, CreateGroupOptions, ConfigSubscriptionOptions, ConfigSourceType, ConfigSourceResolver, ConfigSourceEnv, ConfigSource, ConfigLocator, ConfigErrorKind, ConfigApplyStatus, ClientCredentialsWorkloadConfig, ChangeListener, CatalogChangeListener, CatalogChangeKind, CatalogChange, CatalogAdjacencyCache, CachedWorkloadToken, CacheConfig, CIAMValidators, CIAMProviderType, CIAMProviderDescriptor, CIAMProviderConfig, CIAMProviderColors, CIAMProviderBranding, CIAMConfigFromCodeInput, CIAMConfigFromCode, CIAMConfig, CIAM, BeforeLogoutHook, BeforeLogoutContext, BeforeLoginHook, BeforeLoginContext, BaseWorkloadIdentity, BaseUser, BaseTenant, BaseCustomer, AzureSecretsConfig, AzureConfigLocator, AzureAuthMethod, AwsSecretsConfig, AwsConfigLocator, AuthzScimGroupType, AuthzScimGroupExtension, AuthzOaaConfig, AuthzEntityBase, AuthzDecision, AuthzConfig, Authz, AuthenticatedUser, AuthenticatedPrincipal, ApplicationValidators, AfterLogoutHook, AfterLogoutContext, AfterLoginHook, AfterLoginContext, Address, AccessStatus, AccessRef, AccessProvenance, AccessMutationStatus, AccessMutationResult, AccessIndex, AccessCheckTarget, AccessCheckResult, AccessCheckReason, AccessChange, AccessCatalogStore, AccessAssignmentStore };
+export { workloadTokenResponseSchema, withValidate, warnLogger, waitOn, version, validationFailureResponse, userSchema, unionCatalogRead, trustedClientPermissionsForPrincipal, trimTrailingSlash, tokenResponseSchema, toCodeCatalog, stripJsonComments, stableConfigHash, silentLogger, serializeESConfig, readyCatalogEntry, parseJsonc, parseEcid, oidcCallbackSchema, normalizeTenantRoutingStrategy, normalizeTenantPathNamespace, must, mergeConfig, matchTenantPath, listGenerator, list, jwtAssertionClaimsSchema, isStoreConflictError, isEcid, isConfigSourceError, isConfigLocator, isCodeCatalog, infoLogger, idTokenClaimsSchema, groupResourceSchema, generateULID, formatEcid, defineCatalog, defaultLogger, deepEqualPlain, decodeUser, debugLogger, configTrustedClientGrants, claimsToUser, buildTenantPath, assertValidSubjectTypeScoping, assertEcid, accessRootId, accessRefId, X509Certificate, WorkloadValidators, WorkloadTokenStore, WorkloadTokenResponse, WorkloadPrincipal, WorkloadIncomingOutgoing, WorkloadIdentityStore, WorkloadIdentity, WorkloadGetToken, WorkloadConfigMap, WorkloadConfig, WorkloadClient, Workload, WorkforceUser, VaultWorkloadAuthConfig, VaultWebSocketSecretsConfig, VaultWebSocketAuthHeader, VaultSecretsConfig, VaultLfvSecretsConfig, VaultConfigLocator, ValidateResult, UsersInboundHandlerConfig, UserStoreOptions, UserStore, UpdateTenantRequest, TrustedProvisioningClient, TrustedIdp, TokenValidationResult, TokenResponse, TenantWebhookPayload, TenantValidators, TenantStore, TenantStatus, TenantRoutingStrategy, TenantResponse, TenantPathRoutingStrategy, TenantPathNamespace, TenantPathMatch, TenantEsFactory, TenantEsCache, TenantConfigLocator, SubscriptionMode, SubjectTypeScoping, SubjectType, SubjectScope, SubjectRef, StoreConflictKind, StoreConflictError, StateCookie, StandardSchemaWithValidate, SessionStore, Session, ServerOnlyWorkloadConfig, SecretsValidators, SecretsSubscriptionOptions, SecretsSourceType, SecretsSourceMap, SecretsSourceConfig, SecretsSource, SecretsOperationOptions, SecretsModuleConfig, Secrets, SecretRequestSeverity, SecretLifecycleRequest, Secret, User as ScimUser, ScimServiceProviderConfig, ScimSchemaDefinition, ScimSchemaAttributeDefinition, Role2 as ScimRole, ScimResult, ScimResourceTypeSchemaExtension, ScimResourceType, ScimMutationSummary, ScimListResponse, Group2 as ScimGroup, ScimError, ScimAuthenticationScheme, SSOValidators, SSOHandlerConfig, SSOConfigFromCode, SSOConfig, SSOAppValidators, SSOAppRegistry, SSO, Role, ResourceProvider, ResourceChangeListener, ResourceChange, Resource, ResolvedVaultLfvSecretsConfig, RequireReadyResult, RemoteConfigRetryOptions, RemoteConfigRetryHook, RemoteConfigRetryContext, RemoteConfigLoadErrorKind, RemoteConfig, RegisterSSOAppResult, RegisterSSOAppPayload, RegisterSSOAppError, RegisterIAMAppResult, RegisterIAMAppPayload, RegisterIAMAppError, ReconcileReport, ReadyzEndpointConfig, ReadyAccessCatalogEntry, ReadinessReport, ReactiveHandle, Photo, PhoneNumber, Permission, ParsedEcid, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, OtelSignalName, OtelSignalConfig, OtelProviderType, OtelProtocol, OtelOAuthClientCredentialsConfig, OtelMetricsSignalConfig, OtelLogRecord, OtelLogLevel, OtelLevels, OtelConfig, OtelAttributes, OtelAttributeValue, Otel, OidcCallbackParams, OaaSyncResult, OaaSyncOptions, OaaSyncInput, OaaClient, OaaAccessTargetType, OaaAccessChangeBatchItem, Name, ModuleReadinessState, ModuleReadiness, ModifiableFrameworkConfig, MetaData, MagicLinkStore, MagicLink, Logger, ListResult, ListOptions, ListFilter, LfvOtpResponse, LfvOtpRequest, LfvJwks, LfvErrorResponse, LfvErrorCode, LfvEd25519PublicJwk, LfvEd25519PrivateJwk, LfvActionRequestBase, LfvActionName, LfvActionAcceptedResponse, JwtBearerWorkloadConfig, JWTAssertionClaims, InMemoryTenantStoreOptions, IdentityResolution, IdTokenClaims, IamDeltaResourceType, IamDeltaReconcileResult, IamDeltaMode, IamDeltaIdMapStore, IamDeltaIdMapKey, IamDeltaEmitter, IAMValidators, IAMUsersInbound, IAMInboundUsersConfig, IAMInboundUserContext, IAMHandlerConfig, IAMGroupsOutbound, IAMGroupsInbound, IAMDiscoveryHandlerConfig, IAMDiscoveryContext, IAMDiscoveryConfig, IAMConfigFromCode, IAMConfig, IAMAppValidators, IAMAppRegistry, IAM, GroupsInboundHandlerConfig, GroupResource, GroupMember, Group, GcpSecretsConfig, GcpConfigLocator, FrameworkWorkloadIncomingOutgoing, FrameworkWorkloadConfigFromCode, FrameworkWorkloadConfig, FrameworkStores, FrameworkSecretsSourceConfig, FrameworkSecretsModuleConfig, FrameworkOtelConfig, FrameworkConfigInput, FrameworkConfig, EsUserExtension, EsModuleName, EsEndpointPermission, EsEndpointOperation, EsCapabilityState, EsCapabilityKey, EsCapabilityEndpointUrls, EsCapabilitiezManifest, EnvironmentType, EntityStore, EntitlementType, Entitlement, EnterpriseStandardBase, EnterpriseStandard, EnterpriseExtension, Email, EgressOutcome, EgressChannelOutcome, EffectiveEdge, EcidFormatError, ES_TENANT_MANAGE, ES_SDK_PERMISSIONS, ES_SCIM_USER_EXTENSION_URN, ES_IAM_USERS_WRITE, ES_IAM_READ, ES_IAM_GROUPS_WRITE, ES_ENDPOINT_PERMISSIONS, ES_CIAM_MAGIC_LINK_CREATE, ES_CAPABILITIEZ_READ, ES_AUTHZ_OAA_SYNC, ESValidators, ESRoutingOptions, ESRouteModule, ESRouteFilterResult, ESResolvedRoute, ESErrorOptions, ESError, ESConfigChangeResult, ESConfigChangeOptions, ESConfigChangeCallback, ESConfig, ENTERPRISE_AUTHZ_GROUP_SCHEMA, ECID_SCHEME, DevSecretsConfig, DEFAULT_TENANT_UI_NAMESPACE, DEFAULT_TENANT_API_NAMESPACE, CustomerStoreOptions, CustomerStore, Customer, CreateUserOptions, CreateTenantRequest, CreateGroupOptions, ConfigSubscriptionOptions, ConfigSourceType, ConfigSourceResolver, ConfigSourceErrorInit, ConfigSourceError, ConfigSourceEnv, ConfigSource, ConfigLocator, ConfigErrorKind, ConfigApplyStatus, CodeCatalogNamespace, CodeCatalogInput, CodeCatalog, ClientCredentialsWorkloadConfig, ChangeListener, CatalogChangeListener, CatalogChangeKind, CatalogChange, CachedWorkloadToken, CacheConfig, CIAMValidators, CIAMProviderType, CIAMProviderDescriptor, CIAMProviderConfig, CIAMProviderColors, CIAMProviderBranding, CIAMConfigFromCodeInput, CIAMConfigFromCode, CIAMConfig, CIAM, BaseWorkloadIdentity, BaseUser, BaseTenant, BaseCustomer, AzureSecretsConfig, AzureConfigLocator, AzureAuthMethod, AwsSecretsConfig, AwsConfigLocator, AuthzScimGroupType, AuthzScimGroupExtension, AuthzOaaConfig, AuthzEntityBase, AuthzDecision, AuthzConfig, Authz, AuthenticatedUser, AuthenticatedPrincipal, ApplicationValidators, Address, AccessStatus, AccessRef, AccessProvenance, AccessMutationStatus, AccessMutationResult, AccessIndex, AccessCheckTarget, AccessCheckResult, AccessCheckReason, AccessChange, AccessCatalogStore, AccessAssignmentStore };