@ionite/core 0.0.24-beta.20260907.3 → 0.0.24-beta.20260915.2

package/dist/index.d.ts

@@ -1,4 +1,253 @@
 import { version } from "../package.json";
+import { StandardSchemaV1 as StandardSchemaV19 } from "@standard-schema/spec";
+import { StandardSchemaV1 as StandardSchemaV18 } from "@standard-schema/spec";
+/**
+* Third-party CIAM provider presets and claim mapping.
+*
+* Defines the built-in provider adapters used by the CIAM module for customer
+* login. Each preset supplies default OIDC/OAuth2 endpoints, scope, branding,
+* and a claim mapper that normalizes provider claims into a candidate customer.
+* The application's `CustomerStore` remains the system of record: the SDK only
+* extracts standard claims and hands a candidate to `lookup`/`upsert`.
+*/
+/** Built-in provider types. `oidc` is a generic OIDC provider; `magic-link` is the passwordless flow. */
+type CIAMProviderType = "oidc" | "google" | "github" | "microsoft" | "apple" | "magic-link";
+/** Branding colors for rendering a provider button in light and dark themes. */
+type CIAMProviderColors = {
+	/** Background/brand color for light theme (hex or CSS color). */
+	light: string;
+	/** Background/brand color for dark theme (hex or CSS color). */
+	dark: string;
+	/** Optional secondary/accent color. */
+	secondary?: string;
+};
+/** Operator-supplied branding so the UI can render a provider list without hardcoding. */
+type CIAMProviderBranding = {
+	/** Human-readable name shown on the login button (e.g. "Google"). */
+	displayName: string;
+	/** External icon URL (typically an SVG/PNG hosted on a CDN). */
+	iconUrl?: string;
+	/** Light/dark brand colors. */
+	colors?: CIAMProviderColors;
+	/** Optional provider info/marketing URL. */
+	url?: string;
+};
+/**
+* A single CIAM provider declaration. OIDC/OAuth2 endpoint and credential
+* fields come from the ConfigSource (never application code).
+*/
+type CIAMProviderConfig = {
+	/** Provider adapter type. Selects defaults and claim mapping. */
+	type: CIAMProviderType;
+	/** Whether this provider is enabled. Defaults to true when omitted. */
+	enabled?: boolean;
+	/** Recommended display order (ascending). Ties broken by declaration order. */
+	order?: number;
+	/** UI branding metadata. */
+	branding?: CIAMProviderBranding;
+	/** OIDC issuer/authority (used for discovery when explicit endpoints are omitted). */
+	authority?: string;
+	/** Authorization endpoint (overrides preset). */
+	authorizationUrl?: string;
+	/** Token endpoint (overrides preset). */
+	tokenUrl?: string;
+	/** JWKS endpoint for ID token verification (overrides preset). */
+	jwksUri?: string;
+	/** OAuth2 UserInfo endpoint for providers without an ID token (e.g. GitHub). */
+	userInfoUrl?: string;
+	/** OAuth2 client id (ConfigSource-only). */
+	clientId?: string;
+	/** OAuth2 client secret (ConfigSource-only). */
+	clientSecret?: string;
+	/** Requested scope (overrides preset). */
+	scope?: string;
+	/** Apple: team id for client-secret generation. */
+	teamId?: string;
+	/** Apple: key id for client-secret generation. */
+	keyId?: string;
+	/** Apple: PKCS#8 PEM private key for client-secret generation. */
+	privateKey?: string;
+};
+/** Sanitized provider entry returned by the discovery endpoint for the UI. */
+type CIAMProviderDescriptor = {
+	/** Provider key (matches the RemoteConfig map key); used as `?provider=`. */
+	name: string;
+	type: CIAMProviderType;
+	displayName: string;
+	/** SDK-derived login URL to navigate to (begins the flow). */
+	loginUrl: string;
+	iconUrl?: string;
+	colors?: CIAMProviderColors;
+	url?: string;
+};
+/**
+* Minimal logger interface compatible with common structured logging patterns.
+*/
+interface Logger {
+	trace(message?: unknown, ...optionalParams: unknown[]): void;
+	debug(message?: unknown, ...optionalParams: unknown[]): void;
+	info(message?: unknown, ...optionalParams: unknown[]): void;
+	warn(message?: unknown, ...optionalParams: unknown[]): void;
+	error(message?: unknown, ...optionalParams: unknown[]): void;
+}
+/**
+* Renders a structured logger call as one greppable line while leaving the source fields separate
+* for telemetry exporters.
+*/
+declare function formatLogLine(level: keyof Logger, message: unknown, optionalParams?: unknown[], timestamp?: Date): string;
+/**
+* No-op implementation — does nothing for any log level
+*/
+declare const silentLogger: Logger;
+/**
+* Default logger used until an ionite instance is configured with
+* an OpenTelemetry-backed logger or an application-provided logger.
+*/
+declare const defaultLogger: Logger;
+/**
+* Logger that logs messages debug, info, warn, and error to the console.
+*/
+declare const debugLogger: Logger;
+/**
+* Logger that logs messages info, warn, and error to the console.
+*/
+declare const infoLogger: Logger;
+/**
+* Logger that logs messages warn and error to the console.
+*/
+declare const warnLogger: Logger;
+/**
+* Human-readable single-line console logger for local application output.
+*/
+declare const prettyLogger: Logger;
+/** Synchronous, in-memory read surface for one code catalog entity kind. */
+type CodeCatalogNamespace<TEntity> = {
+	get(id: string): TEntity | undefined;
+	list(): readonly TEntity[];
+};
+/**
+* Normalized, frozen code-declared catalog produced by {@link defineCatalog}. All entities are
+* deep-frozen and id-indexed.
+*/
+type CodeCatalog = {
+	groups: CodeCatalogNamespace<Group>;
+	roles: CodeCatalogNamespace<Role>;
+	permissions: CodeCatalogNamespace<Permission>;
+};
+/** Declarative input for {@link defineCatalog} (plain arrays authored in app code). */
+type CodeCatalogInput = {
+	groups?: readonly Group[];
+	roles?: readonly Role[];
+	permissions?: readonly Permission[];
+};
+/** True when the value is already a normalized {@link CodeCatalog} (vs a declarative input). */
+declare function isCodeCatalog(value: CodeCatalog | CodeCatalogInput): value is CodeCatalog;
+/** Normalize an `authz.catalog` config value: pass through a {@link CodeCatalog}, build one from input. */
+declare function toCodeCatalog(value: CodeCatalog | CodeCatalogInput): CodeCatalog;
+type CatalogEntityKind = "group" | "role" | "permission";
+/**
+* Build a validated, frozen {@link CodeCatalog} from declarative arrays. Call it once at module
+* scope in a pure authz module (no store imports) and wire the result via
+* `FrameworkConfig.authz.catalog`.
+*
+* Validation (throws {@link Error} at module evaluation on the first violation):
+* - ids are globally unique across groups, roles, AND permissions (one SCIM Groups id space);
+* - every group -> group/role/permission reference (string id or embedded object) resolves to an
+*   entity declared in the catalog arrays, and every role -> permission reference likewise
+*   (`resources` refs are NOT validated here — resources live in the app's `ResourceProvider`);
+* - nested group composition is acyclic;
+* - every entitlement declares a required non-empty `assignableSubjectTypes` within the platform
+*   ceiling, and `recommendedSubjectTypes` is a subset of it.
+*
+* Side effects: every entity (and its arrays/metadata) is frozen.
+*/
+declare function defineCatalog(input: CodeCatalogInput): CodeCatalog;
+/** Resolve one code entity and its kind from the shared id space. */
+declare function getCodeCatalogEntity(code: CodeCatalog | undefined, id: string): {
+	entity: Group | Role | Permission;
+	kind: CatalogEntityKind;
+} | undefined;
+/** Return the entity namespace for one catalog kind. */
+declare function catalogEntityStore<TEntity extends Group | Role | Permission>(catalog: AccessCatalogStore, kind: CatalogEntityKind): EntityStore<TEntity>;
+/**
+* Merge a materialized row with its code template. The row owns receipts, lifecycle, other runtime
+* metadata, and any IAM-authored presentation overrides (`displayName`, `riskLevel`) — a stored
+* value means IAM expressed an opinion, an absent one keeps following code edits. Code owns ids,
+* subject scoping, and graph/resource structure.
+*/
+declare function mergeCodeCatalogEntity<TEntity extends Group | Role | Permission>(kind: CatalogEntityKind, code: TEntity, stored: TEntity): TEntity;
+/**
+* Insert a code template into the runtime catalog only when no row exists. Existing rows are never
+* rewritten, preserving IAM-authored presentation and receipts. `insertIfAbsent` closes the race
+* between the initial read and insert.
+*
+* Advisory presentation (`riskLevel`, `displayName`) is deliberately NOT persisted: on the durable
+* row an absent value means "no IAM override", so the merged read keeps following later code edits.
+* Snapshotting the seed here would freeze it — indistinguishable from an IAM-authored value.
+*/
+declare function materializeCodeCatalogEntity<TEntity extends Group | Role | Permission>(kind: CatalogEntityKind, code: TEntity, store: EntityStore<TEntity>): Promise<TEntity>;
+/**
+* Mark materialized code rows as deprecated when their template no longer exists. Callers choose
+* when to run this lifecycle sweep; it never runs during config apply.
+*/
+declare function deprecateRetiredCodeCatalogRows(code: CodeCatalog | undefined, store: AccessCatalogStore, onlyId?: string): Promise<void>;
+/**
+* {@link AccessCatalogStore}-shaped read union over code templates and the runtime store. Store rows
+* win presentation for code ids, code owns their structure, and unmaterialized code entities remain
+* visible. Returns undefined when neither source is wired.
+*/
+declare function unionCatalogRead(code: CodeCatalog | undefined, store: AccessCatalogStore | undefined): AccessCatalogStore | undefined;
+import { StandardSchemaV1 as StandardSchemaV15 } from "@standard-schema/spec";
+/**
+* Resolve an access subject/target/resource reference (a string id or an object carrying one) to its
+* canonical, trimmed string id. This is the single id-resolution rule shared across the authz stack
+* (AUDIT_HISTORY.md §8.4): `accessRootId`, the access stores, the access index, and SCIM diff keys all key off
+* the same normalization so distinct roots never collapse and identical references never diverge.
+* Returns `''` when no id can be resolved.
+*/
+declare function accessRefId(value: unknown): string;
+/**
+* Deterministic id for a granted root. Includes the resource scope so that two grants of the same
+* subject/target with different scopes are tracked as distinct roots. Application-wide scope (the
+* default, or `applyToApplication`) collapses to the `app` scope key.
+*/
+declare function accessRootId(change: AccessChange): string;
+/**
+* Shared minimal identity fields used to build both the workforce user
+* record (`BaseUser`) and the CIAM customer record (`BaseCustomer`), as well
+* as the authenticated session types (`WorkforceUser`, `Customer`).
+*
+* This is an internal structural base and is intentionally not part of the
+* public API surface; consumers extend the `BaseUser` Zod/Valibot schema
+* instead.
+*/
+interface BaseUserFields {
+	/**
+	* Unique identifier for the user
+	*/
+	id?: string;
+	/**
+	* REQUIRED. Unique identifier for login
+	*/
+	userName: string;
+	/**
+	* REQUIRED. Simple display name
+	*/
+	name: string;
+	/**
+	* REQUIRED. Primary email address
+	*/
+	email: string;
+	/**
+	* URL to user's avatar/profile picture
+	*/
+	avatar?: string;
+	/**
+	* User type (e.g., "employee", "contractor", "customer").
+	* Shared by SSO/CIAM and enterprise/SCIM user representations.
+	*/
+	userType?: string;
+}
 /**
 * Shared types for paginated list operations across stores.
 *
@@ -53,981 +302,921 @@ interface ListOptions {
 	/** Optional server-side filter applied before pagination. */
 	filter?: ListFilter;
 }
+import { StandardSchemaV1 } from "@standard-schema/spec";
 /**
-* Shared minimal identity fields used to build both the workforce user
-* record (`BaseUser`) and the CIAM customer record (`BaseCustomer`), as well
-* as the authenticated session types (`WorkforceUser`, `Customer`).
-*
-* This is an internal structural base and is intentionally not part of the
-* public API surface; consumers extend the `BaseUser` Zod/Valibot schema
-* instead.
+* SCIM 2.0 User Resource
+* @see https://datatracker.ietf.org/doc/html/rfc7643#section-4.1
 */
-interface BaseUserFields {
+/**
+* SCIM Name sub-attribute
+*/
+interface Name {
 	/**
-	* Unique identifier for the user
+	* The full name, including all middle names, titles, and suffixes as appropriate
 	*/
-	id?: string;
+	formatted?: string;
 	/**
-	* REQUIRED. Unique identifier for login
+	* The family name of the User, or last name
 	*/
-	userName: string;
+	familyName?: string;
 	/**
-	* REQUIRED. Simple display name
+	* The given name of the User, or first name
 	*/
-	name: string;
+	givenName?: string;
 	/**
-	* REQUIRED. Primary email address
+	* The middle name(s) of the User
 	*/
-	email: string;
+	middleName?: string;
 	/**
-	* URL to user's avatar/profile picture
+	* The honorific prefix(es) of the User, or title
 	*/
-	avatar?: string;
+	honorificPrefix?: string;
 	/**
-	* User type (e.g., "employee", "contractor", "customer").
-	* Shared by SSO/CIAM and enterprise/SCIM user representations.
+	* The honorific suffix(es) of the User, or suffix
 	*/
-	userType?: string;
+	honorificSuffix?: string;
 }
-import { StandardSchemaV1 } from "@standard-schema/spec";
 /**
-* OIDC Code Flow Callback URL Parameters
-* @see https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth
+* SCIM Photo sub-attribute
 */
-interface OidcCallbackParams {
+interface Photo {
 	/**
-	* REQUIRED. The authorization code returned from the authorization server.
+	* The photo url
 	*/
-	code: string;
+	value: string;
 	/**
-	* REQUIRED if the "state" parameter was present in the client authorization request.
-	* The exact value received from the client.
+	* The type of the photo
 	*/
-	state?: string;
+	type?: "photo" | "thumbnail";
 	/**
-	* RECOMMENDED. The session state value. Clients should use this to verify the session state.
+	* A Boolean value indicating the 'primary' or preferred attribute value
 	*/
-	session_state?: string;
+	primary?: boolean;
+}
+/**
+* SCIM Email sub-attribute
+*/
+interface Email {
 	/**
-	* OAuth 2.0 error code if the authorization request failed.
+	* The email address value
 	*/
-	error?: string;
+	value: string;
 	/**
-	* Human-readable ASCII text providing additional information for the error.
+	* A human-readable name, primarily used for display purposes
 	*/
-	error_description?: string;
+	display?: string;
 	/**
-	* A URI identifying a human-readable web page with information about the error.
+	* A label indicating the attribute's function (e.g., "work" or "home")
 	*/
-	error_uri?: string;
+	type?: string;
 	/**
-	* The "iss" (issuer) parameter identifies the principal that issued the response.
-	* This is typically used in the implicit flow.
+	* A Boolean value indicating the 'primary' or preferred attribute value
 	*/
-	iss?: string;
-}
-/**
-* Creates a StandardSchemaV1 for validating OIDC callback URL parameters.
-* @param vendor - The name of the vendor creating this schema
-* @returns A StandardSchemaV1 instance for OIDC callback parameters
-*/
-declare function oidcCallbackSchema(vendor: string): StandardSchemaV1<Record<string, unknown>, OidcCallbackParams>;
-/**
-* Token Response from IdP
-*/
-interface TokenResponse {
-	access_token: string;
-	id_token: string;
-	refresh_token?: string;
-	token_type: string;
-	expires_in?: number;
-	scope?: string;
-	refresh_expires_in?: number;
-	session_state?: string;
-	expires?: string;
+	primary?: boolean;
 }
 /**
-* Creates a StandardSchemaV1 for validating OIDC Token Responses.
-* @param vendor - The name of the vendor creating this schema
-* @returns A StandardSchemaV1 instance for Token Response validation
-*/
-declare function tokenResponseSchema(vendor: string): StandardSchemaV1<Record<string, unknown>, TokenResponse>;
-/**
-* ID Token Claims
+* SCIM Phone Number sub-attribute
 */
-interface IdTokenClaims {
-	iss?: string;
-	aud?: string | string[];
-	exp?: number;
-	iat?: number;
-	sub?: string;
-	sid?: string;
-	name?: string;
-	email?: string;
-	preferred_username?: string;
-	picture?: string;
+interface PhoneNumber {
 	/**
-	* Enterprise Controlled ID claim (`ecid:<realm>:<opaque>`). When present it correlates this
-	* account to a single identity across systems. See https://ionite.com/docs/llms-ecid.txt.
+	* The phone number value
 	*/
-	ecid?: string;
-	[key: string]: unknown;
+	value: string;
+	/**
+	* A human-readable name, primarily used for display purposes
+	*/
+	display?: string;
+	/**
+	* A label indicating the attribute's function (e.g., "work", "home", "mobile")
+	*/
+	type?: string;
+	/**
+	* A Boolean value indicating the 'primary' or preferred attribute value
+	*/
+	primary?: boolean;
 }
 /**
-* Creates a StandardSchemaV1 for validating ID Token Claims.
-* @param vendor - The name of the vendor creating this schema
-* @returns A StandardSchemaV1 instance for ID Token Claims validation
-*/
-declare function idTokenClaimsSchema(vendor: string): StandardSchemaV1<Record<string, unknown>, IdTokenClaims>;
-import { StandardSchemaV1 as StandardSchemaV12 } from "@standard-schema/spec";
-/**
-* JWT Assertion Claims for OAuth2 JWT Bearer Grant (RFC 7523) and OAuth2 Access Tokens
-* @see https://datatracker.ietf.org/doc/html/rfc7523
-* @see https://datatracker.ietf.org/doc/html/rfc9068
+* SCIM Address sub-attribute
 */
-interface JWTAssertionClaims {
+interface Address {
 	/**
-	* REQUIRED. Issuer - the workload identity (e.g., SPIFFE ID) or authorization server
+	* The full mailing address, formatted for display
 	*/
-	iss: string;
+	formatted?: string;
 	/**
-	* REQUIRED. Subject - the workload identity or service account
+	* The full street address component
 	*/
-	sub: string;
+	streetAddress?: string;
 	/**
-	* OPTIONAL. Audience - may be a string or array of strings
-	* Note: Required for JWT assertions, but may be absent in OAuth2 access tokens
+	* The city or locality component
 	*/
-	aud?: string | string[];
+	locality?: string;
 	/**
-	* REQUIRED. Expiration time (Unix timestamp)
+	* The state or region component
 	*/
-	exp: number;
+	region?: string;
 	/**
-	* REQUIRED. Issued at time (Unix timestamp)
+	* The zip code or postal code component
 	*/
-	iat: number;
+	postalCode?: string;
 	/**
-	* OPTIONAL. JWT ID - unique identifier for this token
-	* Note: Required for JWT assertions, optional for access tokens
+	* The country name component
 	*/
-	jti?: string;
+	country?: string;
 	/**
-	* OPTIONAL. Requested OAuth scopes (space-delimited)
+	* A label indicating the attribute's function (e.g., "work" or "home")
 	*/
-	scope?: string;
+	type?: string;
 	/**
-	* Allow additional claims for extensibility
+	* A Boolean value indicating the 'primary' or preferred attribute value
 	*/
-	[key: string]: unknown;
+	primary?: boolean;
 }
 /**
-* Creates a StandardSchemaV1 for validating JWT Assertion Claims.
-* @param vendor - The name of the vendor creating this schema
-* @returns A StandardSchemaV1 instance for JWT Assertion Claims validation
-*/
-declare function jwtAssertionClaimsSchema(vendor: string): StandardSchemaV12<Record<string, unknown>, JWTAssertionClaims>;
-/**
-* Workload Token Response from OAuth2 token endpoint
-* @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.1
+* SCIM Group reference (used within User resources)
 */
-interface WorkloadTokenResponse {
-	/**
-	* REQUIRED. The access token issued by the authorization server.
-	*/
-	access_token: string;
-	/**
-	* REQUIRED. The type of the token (typically "Bearer").
-	*/
-	token_type: string;
+interface Group2 {
 	/**
-	* RECOMMENDED. The lifetime in seconds of the access token.
+	* The identifier of the User's group
 	*/
-	expires_in?: number;
+	value: string;
 	/**
-	* OPTIONAL. The scope of the access token.
+	* The URI of the corresponding 'Group' resource
 	*/
-	scope?: string;
+	$ref?: string;
 	/**
-	* OPTIONAL. The refresh token (rarely used for workload identities).
+	* A human-readable name, primarily used for display purposes
 	*/
-	refresh_token?: string;
+	display?: string;
 	/**
-	* OPTIONAL. The expiration time as an ISO 8601 string.
+	* A label indicating the attribute's function (e.g., "direct" or "indirect")
 	*/
-	expires?: string;
+	type?: string;
 }
 /**
-* Creates a StandardSchemaV1 for validating Workload Token Responses.
-* @param vendor - The name of the vendor creating this schema
-* @returns A StandardSchemaV1 instance for Workload Token Response validation
-*/
-declare function workloadTokenResponseSchema(vendor: string): StandardSchemaV12<Record<string, unknown>, WorkloadTokenResponse>;
-/**
-* Token Validation Result
+* SCIM Group Member reference
 */
-interface TokenValidationResult {
+interface GroupMember {
 	/**
-	* Whether the token is valid
+	* The identifier of the member (User or Group)
 	*/
-	valid: boolean;
+	value: string;
 	/**
-	* The decoded and validated claims (if valid)
+	* The URI of the corresponding member resource
 	*/
-	claims?: JWTAssertionClaims;
+	$ref?: string;
 	/**
-	* Error message (if invalid)
+	* A human-readable name of the member
 	*/
-	error?: string;
+	display?: string;
 	/**
-	* Token expiration time (if valid)
+	* The type of the member. `"Workload"` labels a service-account/workload principal (including
+	* config-declared trusted provisioning clients) and `"Customer"` a CIAM customer so SCIM consumers
+	* can distinguish them from a workforce `"User"` or a nested `"Group"`.
 	*/
-	expiresAt?: Date;
+	type?: "User" | "Group" | "Workload" | "Customer";
 }
 /**
-* Workload Identity extracted from a validated token.
-*
-* This is the raw, token-derived view of a calling workload. For authorization it is normalized
-* into a {@link WorkloadPrincipal} (which adds a stable `id`).
+* SCIM 2.0 Group Resource
+* @see https://datatracker.ietf.org/doc/html/rfc7643#section-4.2
 */
-type WorkloadIdentity = {
-	/** Workload identifier (for JWT Bearer Grant tokens). */
-	workloadId?: string;
-	/** Client identifier (for OAuth2 Client Credentials tokens). */
-	clientId?: string;
-	/** Granted OAuth scopes (space-delimited). */
-	scope?: string;
+interface GroupResource {
 	/**
-	* Whether the trusted IdP that validated this token opts into honoring its OAuth `scope` claim as
-	* entitlements (per-IdP intent, resolved at validation time). Consumed by the request-level `has*`
-	* helpers; `undefined` falls back to the global `RemoteConfig.authz.scopesAsEntitlements`.
+	* REQUIRED. The schemas attribute
 	*/
-	scopesAsEntitlements?: boolean;
+	schemas?: string[];
 	/**
-	* Enterprise Controlled ID for this workload (`ecid:<realm>:<opaque>`), when carried on the token
-	* `ecid` claim or enriched from a wired `WorkloadIdentityStore`. A workload is its own governance
-	* root. See https://ionite.com/docs/llms-ecid.txt.
+	* Unique identifier for the Group, assigned by the service provider
 	*/
-	ecid?: string;
-	/** Full JWT claims from the token. */
-	claims: JWTAssertionClaims;
-};
-/**
-* A workload resolved as an authorization subject. It is a {@link WorkloadIdentity} with a stable
-* `id` (chosen as `clientId ?? workloadId ?? claims.sub`) used as the AccessIndex subject for
-* `subjectType: 'workload'` checks. When a `WorkloadIdentityStore` is wired, the identity may also
-* carry stored enrichment fields (merged in by `getWorkloadIdentity`).
-*/
-type WorkloadPrincipal = WorkloadIdentity & {
-	/** Stable subject id used for entitlement checks (`clientId ?? workloadId ?? claims.sub`). */
-	id: string;
-};
-/**
-* Workforce user type for SSO/OIDC and IAM-backed applications.
-* Carries the SSO/OIDC context used by server helpers and user stores.
-*/
-interface WorkforceUser extends BaseUserFields {
+	id?: string;
 	/**
-	* SSO/OIDC authentication data
+	* External identifier from the provisioning client
 	*/
-	sso: {
-		/**
-		* ID Token claims from the identity provider
-		*/
-		profile: IdTokenClaims;
-		/**
-		* Tenant/organization information
-		*/
-		tenant: {
-			id: string;
-			name: string;
-		};
-		/**
-		* OAuth scopes granted
-		*/
-		scope?: string;
-		/**
-		* Token type (typically "Bearer")
-		*/
-		tokenType: string;
-		/**
-		* Session state from the identity provider
-		*/
-		sessionState?: string;
-		/**
-		* Token expiration time
-		*/
-		expires: Date;
+	externalId?: string;
+	/**
+	* Resource metadata
+	*/
+	meta?: {
+		resourceType?: string;
+		created?: string;
+		lastModified?: string;
+		location?: string;
+		version?: string;
 	};
+	/**
+	* REQUIRED. A human-readable name for the Group
+	*/
+	displayName: string;
+	/**
+	* A list of members of the Group
+	*/
+	members?: GroupMember[];
 }
-/**
-* Customer session type for CIAM-backed applications.
-* The persisted customer record is `BaseCustomer` (see customer-store.types).
-*/
-interface Customer extends BaseUserFields {
-	ciam: {
-		/**
-		* ID token-like claims for CIAM sessions.
-		*/
-		profile: IdTokenClaims;
-		/**
-		* OAuth scopes granted for this customer session.
-		*/
-		scope?: string;
-		/**
-		* Token type (typically "Bearer").
-		*/
-		tokenType: string;
-		/**
-		* Session expiration time.
-		*/
-		expires: Date;
+/** SCIM Workload resource — machine/service principal, not a User. */
+interface ScimWorkload {
+	[key: string]: unknown;
+	schemas?: string[];
+	id?: string;
+	externalId?: string;
+	/** Login identifier; typically the OAuth `clientId`. */
+	userName?: string;
+	displayName?: string;
+	description?: string;
+	active?: boolean;
+	providerId?: string;
+	requestUrl?: string;
+	/** Enterprise Controlled ID for workload correlation across datasources. */
+	ecid?: string;
+	meta?: {
+		resourceType?: string;
+		created?: string;
+		lastModified?: string;
+		location?: string;
+		version?: string;
 	};
 }
-/**
-* Union of currently authenticated user domains.
-*/
-type AuthenticatedUser = WorkforceUser | Customer;
-/**
-* Union of every principal kind that can be resolved as an authorization subject: human-facing
-* users (workforce/customer) plus non-human {@link WorkloadPrincipal}s. Use this where a resolved
-* subject may be any authenticated principal; keep {@link AuthenticatedUser} for browser/tenant-HRD
-* flows that are inherently human.
-*/
-type AuthenticatedPrincipal = AuthenticatedUser | WorkloadPrincipal;
-import { StandardSchemaV1 as StandardSchemaV19 } from "@standard-schema/spec";
-import { StandardSchemaV1 as StandardSchemaV18 } from "@standard-schema/spec";
-/**
-* Third-party CIAM provider presets and claim mapping.
-*
-* Defines the built-in provider adapters used by the CIAM module for customer
-* login. Each preset supplies default OIDC/OAuth2 endpoints, scope, branding,
-* and a claim mapper that normalizes provider claims into a candidate customer.
-* The application's `CustomerStore` remains the system of record: the SDK only
-* extracts standard claims and hands a candidate to `lookup`/`upsert`.
-*/
-/** Built-in provider types. `oidc` is a generic OIDC provider; `magic-link` is the passwordless flow. */
-type CIAMProviderType = "oidc" | "google" | "github" | "microsoft" | "apple" | "magic-link";
-/** Branding colors for rendering a provider button in light and dark themes. */
-type CIAMProviderColors = {
-	/** Background/brand color for light theme (hex or CSS color). */
-	light: string;
-	/** Background/brand color for dark theme (hex or CSS color). */
-	dark: string;
-	/** Optional secondary/accent color. */
-	secondary?: string;
-};
-/** Operator-supplied branding so the UI can render a provider list without hardcoding. */
-type CIAMProviderBranding = {
-	/** Human-readable name shown on the login button (e.g. "Google"). */
-	displayName: string;
-	/** External icon URL (typically an SVG/PNG hosted on a CDN). */
-	iconUrl?: string;
-	/** Light/dark brand colors. */
-	colors?: CIAMProviderColors;
-	/** Optional provider info/marketing URL. */
-	url?: string;
-};
-/**
-* A single CIAM provider declaration. OIDC/OAuth2 endpoint and credential
-* fields come from the ConfigSource (never application code).
-*/
-type CIAMProviderConfig = {
-	/** Provider adapter type. Selects defaults and claim mapping. */
-	type: CIAMProviderType;
-	/** Whether this provider is enabled. Defaults to true when omitted. */
-	enabled?: boolean;
-	/** Recommended display order (ascending). Ties broken by declaration order. */
-	order?: number;
-	/** UI branding metadata. */
-	branding?: CIAMProviderBranding;
-	/** OIDC issuer/authority (used for discovery when explicit endpoints are omitted). */
-	authority?: string;
-	/** Authorization endpoint (overrides preset). */
-	authorizationUrl?: string;
-	/** Token endpoint (overrides preset). */
-	tokenUrl?: string;
-	/** JWKS endpoint for ID token verification (overrides preset). */
-	jwksUri?: string;
-	/** OAuth2 UserInfo endpoint for providers without an ID token (e.g. GitHub). */
-	userInfoUrl?: string;
-	/** OAuth2 client id (ConfigSource-only). */
-	clientId?: string;
-	/** OAuth2 client secret (ConfigSource-only). */
-	clientSecret?: string;
-	/** Requested scope (overrides preset). */
-	scope?: string;
-	/** Apple: team id for client-secret generation. */
-	teamId?: string;
-	/** Apple: key id for client-secret generation. */
-	keyId?: string;
-	/** Apple: PKCS#8 PEM private key for client-secret generation. */
-	privateKey?: string;
-};
-/** Sanitized provider entry returned by the discovery endpoint for the UI. */
-type CIAMProviderDescriptor = {
-	/** Provider key (matches the RemoteConfig map key); used as `?provider=`. */
-	name: string;
-	type: CIAMProviderType;
-	displayName: string;
-	/** SDK-derived login URL to navigate to (begins the flow). */
-	loginUrl: string;
-	iconUrl?: string;
-	colors?: CIAMProviderColors;
-	url?: string;
-};
-/**
-* Minimal logger interface compatible with common structured logging patterns.
-*/
-interface Logger {
-	trace(message?: unknown, ...optionalParams: unknown[]): void;
-	debug(message?: unknown, ...optionalParams: unknown[]): void;
-	info(message?: unknown, ...optionalParams: unknown[]): void;
-	warn(message?: unknown, ...optionalParams: unknown[]): void;
-	error(message?: unknown, ...optionalParams: unknown[]): void;
+/** SCIM Customer resource — CIAM consumer principal, not a workforce User. */
+interface ScimCustomer {
+	[key: string]: unknown;
+	schemas?: string[];
+	id?: string;
+	externalId?: string;
+	userName?: string;
+	displayName?: string;
+	active?: boolean;
+	emails?: Email[];
+	providerId?: string;
+	requestUrl?: string;
+	meta?: {
+		resourceType?: string;
+		created?: string;
+		lastModified?: string;
+		location?: string;
+		version?: string;
+	};
 }
 /**
-* No-op implementation — does nothing for any log level
-*/
-declare const silentLogger: Logger;
-/**
-* Default logger used until an ionite instance is configured with
-* an OpenTelemetry-backed logger or an application-provided logger.
-*/
-declare const defaultLogger: Logger;
-/**
-* Logger that logs messages debug, info, warn, and error to the console.
-*/
-declare const debugLogger: Logger;
-/**
-* Logger that logs messages info, warn, and error to the console.
-*/
-declare const infoLogger: Logger;
-/**
-* Logger that logs messages warn and error to the console.
-*/
-declare const warnLogger: Logger;
-/** Synchronous, in-memory read surface for one code catalog entity kind. */
-type CodeCatalogNamespace<TEntity> = {
-	get(id: string): TEntity | undefined;
-	list(): readonly TEntity[];
-};
-/**
-* Normalized, frozen code-declared catalog produced by {@link defineCatalog}. All entities are
-* deep-frozen and id-indexed.
-*/
-type CodeCatalog = {
-	groups: CodeCatalogNamespace<Group>;
-	roles: CodeCatalogNamespace<Role>;
-	permissions: CodeCatalogNamespace<Permission>;
-};
-/** Declarative input for {@link defineCatalog} (plain arrays authored in app code). */
-type CodeCatalogInput = {
-	groups?: readonly Group[];
-	roles?: readonly Role[];
-	permissions?: readonly Permission[];
-};
-/** True when the value is already a normalized {@link CodeCatalog} (vs a declarative input). */
-declare function isCodeCatalog(value: CodeCatalog | CodeCatalogInput): value is CodeCatalog;
-/** Normalize an `authz.catalog` config value: pass through a {@link CodeCatalog}, build one from input. */
-declare function toCodeCatalog(value: CodeCatalog | CodeCatalogInput): CodeCatalog;
-type CatalogEntityKind = "group" | "role" | "permission";
-/**
-* Build a validated, frozen {@link CodeCatalog} from declarative arrays. Call it once at module
-* scope in a pure authz module (no store imports) and wire the result via
-* `FrameworkConfig.authz.catalog`.
-*
-* Validation (throws {@link Error} at module evaluation on the first violation):
-* - ids are globally unique across groups, roles, AND permissions (one SCIM Groups id space);
-* - every group -> group/role/permission reference (string id or embedded object) resolves to an
-*   entity declared in the catalog arrays, and every role -> permission reference likewise
-*   (`resources` refs are NOT validated here — resources live in the app's `ResourceProvider`);
-* - nested group composition is acyclic;
-* - every entitlement declares a required non-empty `assignableSubjectTypes` within the platform
-*   ceiling, and `recommendedSubjectTypes` is a subset of it.
-*
-* Side effects: every entity (and its arrays/metadata) is frozen.
-*/
-declare function defineCatalog(input: CodeCatalogInput): CodeCatalog;
-/** Resolve one code entity and its kind from the shared id space. */
-declare function getCodeCatalogEntity(code: CodeCatalog | undefined, id: string): {
-	entity: Group | Role | Permission;
-	kind: CatalogEntityKind;
-} | undefined;
-/** Return the entity namespace for one catalog kind. */
-declare function catalogEntityStore<TEntity extends Group | Role | Permission>(catalog: AccessCatalogStore, kind: CatalogEntityKind): EntityStore<TEntity>;
-/**
-* Merge a materialized row with its code template. The row owns presentation, receipts, lifecycle,
-* and other runtime metadata; code owns ids, subject scoping, and graph/resource structure.
-*/
-declare function mergeCodeCatalogEntity<TEntity extends Group | Role | Permission>(kind: CatalogEntityKind, code: TEntity, stored: TEntity): TEntity;
-/**
-* Insert a code template into the runtime catalog only when no row exists. Existing rows are never
-* rewritten, preserving IAM-renamed presentation and receipts. `insertIfAbsent` closes the race
-* between the initial read and insert.
-*/
-declare function materializeCodeCatalogEntity<TEntity extends Group | Role | Permission>(kind: CatalogEntityKind, code: TEntity, store: EntityStore<TEntity>): Promise<TEntity>;
-/**
-* Mark materialized code rows as deprecated when their template no longer exists. Callers choose
-* when to run this lifecycle sweep; it never runs during config apply.
-*/
-declare function deprecateRetiredCodeCatalogRows(code: CodeCatalog | undefined, store: AccessCatalogStore, onlyId?: string): Promise<void>;
-/**
-* {@link AccessCatalogStore}-shaped read union over code templates and the runtime store. Store rows
-* win presentation for code ids, code owns their structure, and unmaterialized code entities remain
-* visible. Returns undefined when neither source is wired.
-*/
-declare function unionCatalogRead(code: CodeCatalog | undefined, store: AccessCatalogStore | undefined): AccessCatalogStore | undefined;
-import { StandardSchemaV1 as StandardSchemaV15 } from "@standard-schema/spec";
-/**
-* Resolve an access subject/target/resource reference (a string id or an object carrying one) to its
-* canonical, trimmed string id. This is the single id-resolution rule shared across the authz stack
-* (AUDIT_HISTORY.md §8.4): `accessRootId`, the access stores, the access index, and SCIM diff keys all key off
-* the same normalization so distinct roots never collapse and identical references never diverge.
-* Returns `''` when no id can be resolved.
-*/
-declare function accessRefId(value: unknown): string;
-/**
-* Deterministic id for a granted root. Includes the resource scope so that two grants of the same
-* subject/target with different scopes are tracked as distinct roots. Application-wide scope (the
-* default, or `applyToApplication`) collapses to the `app` scope key.
+* SCIM Role
 */
-declare function accessRootId(change: AccessChange): string;
-import { StandardSchemaV1 as StandardSchemaV13 } from "@standard-schema/spec";
+interface Role2 {
+	/**
+	* The value of the role
+	*/
+	value: string;
+	/**
+	* A human-readable name, primarily used for display purposes
+	*/
+	display?: string;
+	/**
+	* A label indicating the attribute's function
+	*/
+	type?: string;
+	/**
+	* A Boolean value indicating the 'primary' or preferred attribute value
+	*/
+	primary?: boolean;
+}
 /**
-* SCIM 2.0 User Resource
-* @see https://datatracker.ietf.org/doc/html/rfc7643#section-4.1
+* SCIM X509 Certificate
 */
+interface X509Certificate {
+	/**
+	* The value of the X.509 certificate
+	*/
+	value: string;
+	/**
+	* A human-readable name, primarily used for display purposes
+	*/
+	display?: string;
+	/**
+	* A label indicating the attribute's function
+	*/
+	type?: string;
+	/**
+	* A Boolean value indicating the 'primary' or preferred attribute value
+	*/
+	primary?: boolean;
+}
 /**
-* SCIM Name sub-attribute
+* SCIM Enterprise User Extension
+* @see https://datatracker.ietf.org/doc/html/rfc7643#section-4.3
 */
-interface Name {
+interface EnterpriseExtension {
 	/**
-	* The full name, including all middle names, titles, and suffixes as appropriate
+	* Numeric or alphanumeric identifier assigned to a person
 	*/
-	formatted?: string;
+	employeeNumber?: string;
 	/**
-	* The family name of the User, or last name
+	* Identifies the name of a cost center
 	*/
-	familyName?: string;
+	costCenter?: string;
 	/**
-	* The given name of the User, or first name
+	* Identifies the name of an organization
 	*/
-	givenName?: string;
+	organization?: string;
 	/**
-	* The middle name(s) of the User
+	* Identifies the name of a division
 	*/
-	middleName?: string;
+	division?: string;
 	/**
-	* The honorific prefix(es) of the User, or title
+	* Identifies the name of a department
 	*/
-	honorificPrefix?: string;
+	department?: string;
 	/**
-	* The honorific suffix(es) of the User, or suffix
+	* The user's manager
 	*/
-	honorificSuffix?: string;
+	manager?: {
+		/**
+		* The "id" of the SCIM resource representing the User's manager
+		*/
+		value?: string;
+		/**
+		* The URI of the SCIM resource representing the User's manager
+		*/
+		$ref?: string;
+		/**
+		* The displayName of the User's manager
+		*/
+		displayName?: string;
+	};
 }
 /**
-* SCIM Photo sub-attribute
+* SCIM URN for the ionite User extension, carrying the ECID identity correlator and
+* the account purpose (`accountClass`). Hosted schema:
+* https://ionite.com/schemas/ion-scim-user-extension.json
 */
-interface Photo {
-	/**
-	* The photo url
-	*/
-	value: string;
+declare const ION_SCIM_USER_EXTENSION_URN = "urn:ionite:scim:schemas:extension:ion:2.0:User";
+/** SCIM core schema for a Workload principal (distinct ResourceType from User). */
+declare const ION_SCIM_WORKLOAD_SCHEMA = "urn:ionite:scim:schemas:core:2.0:Workload";
+/** SCIM core schema for a Customer principal (distinct ResourceType from User). */
+declare const ION_SCIM_CUSTOMER_SCHEMA = "urn:ionite:scim:schemas:core:2.0:Customer";
+/**
+* ionite SCIM User extension. See https://ionite.com/docs/llms-ecid.txt.
+*/
+interface IoniteUserExtension {
 	/**
-	* The type of the photo
+	* Enterprise Controlled ID: `ecid:<realm>:<opaque>` (realm = the minting authority's id).
+	* Correlates multiple accounts to one identity across systems.
 	*/
-	type?: "photo" | "thumbnail";
+	ecid?: string;
 	/**
-	* A Boolean value indicating the 'primary' or preferred attribute value
+	* Account purpose (distinct from `userType` persona). Open value set:
+	* `daily`, `privileged`, `break_glass`, `service`.
 	*/
-	primary?: boolean;
+	accountClass?: string;
 }
 /**
-* SCIM Email sub-attribute
+* SCIM User Resource
 */
-interface Email {
+interface User {
+	[key: string]: unknown;
 	/**
-	* The email address value
+	* REQUIRED. Unique identifier for the User, typically from the provider
 	*/
-	value: string;
+	id?: string;
+	/**
+	* REQUIRED. A unique identifier for a SCIM resource as defined by the service provider
+	*/
+	externalId?: string;
+	/**
+	* Resource metadata
+	*/
+	meta?: {
+		resourceType?: string;
+		created?: string;
+		lastModified?: string;
+		location?: string;
+		version?: string;
+	};
 	/**
-	* A human-readable name, primarily used for display purposes
+	* REQUIRED. Unique identifier for the User, typically used for login
 	*/
-	display?: string;
+	userName: string;
 	/**
-	* A label indicating the attribute's function (e.g., "work" or "home")
+	* The components of the user's name
 	*/
-	type?: string;
+	name?: Name;
 	/**
-	* A Boolean value indicating the 'primary' or preferred attribute value
+	* The name of the User, suitable for display to end-users
 	*/
-	primary?: boolean;
-}
-/**
-* SCIM Phone Number sub-attribute
-*/
-interface PhoneNumber {
+	displayName?: string;
 	/**
-	* The phone number value
+	* The casual way to address the user
 	*/
-	value: string;
+	nickName?: string;
 	/**
-	* A human-readable name, primarily used for display purposes
+	* A fully qualified URL pointing to a page representing the User's online profile
 	*/
-	display?: string;
+	profileUrl?: string;
 	/**
-	* A label indicating the attribute's function (e.g., "work", "home", "mobile")
+	* The user's title, such as "Vice President"
 	*/
-	type?: string;
+	title?: string;
 	/**
-	* A Boolean value indicating the 'primary' or preferred attribute value
+	* Used to identify the relationship between the organization and the user
 	*/
-	primary?: boolean;
-}
-/**
-* SCIM Address sub-attribute
-*/
-interface Address {
+	userType?: string;
 	/**
-	* The full mailing address, formatted for display
+	* Indicates the User's preferred written or spoken language
 	*/
-	formatted?: string;
+	preferredLanguage?: string;
 	/**
-	* The full street address component
+	* Used to indicate the User's default location for purposes of localizing items such as currency
 	*/
-	streetAddress?: string;
+	locale?: string;
 	/**
-	* The city or locality component
+	* The User's time zone in the "Olson" time zone database format
 	*/
-	locality?: string;
+	timezone?: string;
 	/**
-	* The state or region component
+	* A Boolean value indicating the User's administrative status
 	*/
-	region?: string;
+	active?: boolean;
 	/**
-	* The zip code or postal code component
+	* Email addresses for the user
 	*/
-	postalCode?: string;
+	emails?: Email[];
 	/**
-	* The country name component
+	* Phone numbers for the User
 	*/
-	country?: string;
+	phoneNumbers?: PhoneNumber[];
 	/**
-	* A label indicating the attribute's function (e.g., "work" or "home")
+	* Instant messaging addresses for the User
 	*/
-	type?: string;
+	ims?: Array<{
+		value: string;
+		display?: string;
+		type?: string;
+		primary?: boolean;
+	}>;
 	/**
-	* A Boolean value indicating the 'primary' or preferred attribute value
+	* URLs of photos of the User
 	*/
-	primary?: boolean;
-}
-/**
-* SCIM Group reference (used within User resources)
-*/
-interface Group2 {
+	photos?: Array<{
+		value: string;
+		display?: string;
+		type?: string;
+		primary?: boolean;
+	}>;
 	/**
-	* The identifier of the User's group
+	* Physical mailing addresses for this User
 	*/
-	value: string;
+	addresses?: Address[];
 	/**
-	* The URI of the corresponding 'Group' resource
+	* A list of groups to which the user belongs
 	*/
-	$ref?: string;
+	groups?: Group2[];
 	/**
-	* A human-readable name, primarily used for display purposes
+	* A list of entitlements for the User
 	*/
-	display?: string;
+	entitlements?: Array<{
+		value: string;
+		display?: string;
+		type?: string;
+		primary?: boolean;
+	}>;
 	/**
-	* A label indicating the attribute's function (e.g., "direct" or "indirect")
+	* A list of roles for the User
 	*/
-	type?: string;
-}
-/**
-* SCIM Group Member reference
-*/
-interface GroupMember {
+	roles?: Role2[];
 	/**
-	* The identifier of the member (User or Group)
+	* A list of certificates issued to the User
 	*/
-	value: string;
+	x509Certificates?: X509Certificate[];
 	/**
-	* The URI of the corresponding member resource
+	* Enterprise User Extension
 	*/
-	$ref?: string;
+	"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"?: EnterpriseExtension;
 	/**
-	* A human-readable name of the member
+	* ionite User Extension (ECID + accountClass).
 	*/
-	display?: string;
+	"urn:ionite:scim:schemas:extension:ion:2.0:User"?: IoniteUserExtension;
 	/**
-	* The type of the member. `"Workload"` labels a service-account/workload principal (including
-	* config-declared trusted provisioning clients) and `"Customer"` a CIAM customer so SCIM consumers
-	* can distinguish them from a workforce `"User"` or a nested `"Group"`.
+	* REQUIRED. The schemas attribute is an array of Strings which allows introspection of the supported schema version
 	*/
-	type?: "User" | "Group" | "Workload" | "Customer";
+	schemas?: string[];
 }
 /**
-* SCIM 2.0 Group Resource
-* @see https://datatracker.ietf.org/doc/html/rfc7643#section-4.2
+* Creates a StandardSchemaV1 for validating SCIM User resources.
+* @param vendor - The name of the vendor creating this schema
+* @returns A StandardSchemaV1 instance for SCIM User resources
 */
-interface GroupResource {
+declare function userSchema(vendor: string): StandardSchemaV1<Record<string, unknown>, User>;
+/**
+* Creates a StandardSchemaV1 for validating SCIM Group resources.
+* @param vendor - The name of the vendor creating this schema
+* @returns A StandardSchemaV1 instance for SCIM Group resources
+*/
+declare function groupResourceSchema(vendor: string): StandardSchemaV1<Record<string, unknown>, GroupResource>;
+/** Validates a SCIM Workload resource. */
+declare const workloadResourceSchema: StandardSchemaV1<unknown, ScimWorkload>;
+/** Validates a SCIM Customer resource. */
+declare const customerResourceSchema: StandardSchemaV1<unknown, ScimCustomer>;
+import { StandardSchemaV1 as StandardSchemaV12 } from "@standard-schema/spec";
+/**
+* OIDC Code Flow Callback URL Parameters
+* @see https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth
+*/
+interface OidcCallbackParams {
 	/**
-	* REQUIRED. The schemas attribute
+	* REQUIRED. The authorization code returned from the authorization server.
 	*/
-	schemas?: string[];
+	code: string;
 	/**
-	* Unique identifier for the Group, assigned by the service provider
+	* REQUIRED if the "state" parameter was present in the client authorization request.
+	* The exact value received from the client.
 	*/
-	id?: string;
+	state?: string;
 	/**
-	* External identifier from the provisioning client
+	* RECOMMENDED. The session state value. Clients should use this to verify the session state.
 	*/
-	externalId?: string;
+	session_state?: string;
 	/**
-	* Resource metadata
+	* OAuth 2.0 error code if the authorization request failed.
 	*/
-	meta?: {
-		resourceType?: string;
-		created?: string;
-		lastModified?: string;
-		location?: string;
-		version?: string;
-	};
+	error?: string;
 	/**
-	* REQUIRED. A human-readable name for the Group
+	* Human-readable ASCII text providing additional information for the error.
 	*/
-	displayName: string;
+	error_description?: string;
 	/**
-	* A list of members of the Group
+	* A URI identifying a human-readable web page with information about the error.
 	*/
-	members?: GroupMember[];
+	error_uri?: string;
+	/**
+	* The "iss" (issuer) parameter identifies the principal that issued the response.
+	* This is typically used in the implicit flow.
+	*/
+	iss?: string;
 }
-/** SCIM Workload resource — machine/service principal, not a User. */
-interface ScimWorkload {
-	schemas?: string[];
-	id?: string;
-	externalId?: string;
-	/** Login identifier; typically the OAuth `clientId`. */
-	userName?: string;
-	displayName?: string;
-	description?: string;
-	active?: boolean;
-	providerId?: string;
-	requestUrl?: string;
-	meta?: {
-		resourceType?: string;
-		created?: string;
-		lastModified?: string;
-		location?: string;
-		version?: string;
-	};
+/**
+* Creates a StandardSchemaV1 for validating OIDC callback URL parameters.
+* @param vendor - The name of the vendor creating this schema
+* @returns A StandardSchemaV1 instance for OIDC callback parameters
+*/
+declare function oidcCallbackSchema(vendor: string): StandardSchemaV12<Record<string, unknown>, OidcCallbackParams>;
+/**
+* Token Response from IdP
+*/
+interface TokenResponse {
+	access_token: string;
+	id_token: string;
+	refresh_token?: string;
+	token_type: string;
+	expires_in?: number;
+	scope?: string;
+	refresh_expires_in?: number;
+	session_state?: string;
+	expires?: string;
 }
-/** SCIM Customer resource — CIAM consumer principal, not a workforce User. */
-interface ScimCustomer {
-	schemas?: string[];
-	id?: string;
-	externalId?: string;
-	userName?: string;
-	displayName?: string;
-	active?: boolean;
-	emails?: Email[];
-	providerId?: string;
-	requestUrl?: string;
-	meta?: {
-		resourceType?: string;
-		created?: string;
-		lastModified?: string;
-		location?: string;
-		version?: string;
-	};
+/**
+* Creates a StandardSchemaV1 for validating OIDC Token Responses.
+* @param vendor - The name of the vendor creating this schema
+* @returns A StandardSchemaV1 instance for Token Response validation
+*/
+declare function tokenResponseSchema(vendor: string): StandardSchemaV12<Record<string, unknown>, TokenResponse>;
+/**
+* ID Token Claims
+*/
+interface IdTokenClaims {
+	iss?: string;
+	aud?: string | string[];
+	exp?: number;
+	iat?: number;
+	sub?: string;
+	sid?: string;
+	name?: string;
+	email?: string;
+	preferred_username?: string;
+	picture?: string;
+	/**
+	* Enterprise Controlled ID claim (`ecid:<realm>:<opaque>`). When present it correlates this
+	* account to a single identity across systems. See https://ionite.com/docs/llms-ecid.txt.
+	*/
+	ecid?: string;
+	[key: string]: unknown;
 }
 /**
-* SCIM Role
+* Creates a StandardSchemaV1 for validating ID Token Claims.
+* @param vendor - The name of the vendor creating this schema
+* @returns A StandardSchemaV1 instance for ID Token Claims validation
 */
-interface Role2 {
+declare function idTokenClaimsSchema(vendor: string): StandardSchemaV12<Record<string, unknown>, IdTokenClaims>;
+import { StandardSchemaV1 as StandardSchemaV13 } from "@standard-schema/spec";
+/**
+* JWT Assertion Claims for OAuth2 JWT Bearer Grant (RFC 7523) and OAuth2 Access Tokens
+* @see https://datatracker.ietf.org/doc/html/rfc7523
+* @see https://datatracker.ietf.org/doc/html/rfc9068
+*/
+interface JWTAssertionClaims {
 	/**
-	* The value of the role
+	* REQUIRED. Issuer - the workload identity (e.g., SPIFFE ID) or authorization server
 	*/
-	value: string;
+	iss: string;
 	/**
-	* A human-readable name, primarily used for display purposes
+	* REQUIRED. Subject - the workload identity or service account
 	*/
-	display?: string;
+	sub: string;
 	/**
-	* A label indicating the attribute's function
+	* OPTIONAL. Audience - may be a string or array of strings
+	* Note: Required for JWT assertions, but may be absent in OAuth2 access tokens
 	*/
-	type?: string;
+	aud?: string | string[];
 	/**
-	* A Boolean value indicating the 'primary' or preferred attribute value
+	* REQUIRED. Expiration time (Unix timestamp)
 	*/
-	primary?: boolean;
+	exp: number;
+	/**
+	* REQUIRED. Issued at time (Unix timestamp)
+	*/
+	iat: number;
+	/**
+	* OPTIONAL. JWT ID - unique identifier for this token
+	* Note: Required for JWT assertions, optional for access tokens
+	*/
+	jti?: string;
+	/**
+	* OPTIONAL. Requested OAuth scopes (space-delimited)
+	*/
+	scope?: string;
+	/**
+	* Allow additional claims for extensibility
+	*/
+	[key: string]: unknown;
 }
 /**
-* SCIM X509 Certificate
+* Creates a StandardSchemaV1 for validating JWT Assertion Claims.
+* @param vendor - The name of the vendor creating this schema
+* @returns A StandardSchemaV1 instance for JWT Assertion Claims validation
 */
-interface X509Certificate {
+declare function jwtAssertionClaimsSchema(vendor: string): StandardSchemaV13<Record<string, unknown>, JWTAssertionClaims>;
+/**
+* Workload Token Response from OAuth2 token endpoint
+* @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.1
+*/
+interface WorkloadTokenResponse {
 	/**
-	* The value of the X.509 certificate
+	* REQUIRED. The access token issued by the authorization server.
 	*/
-	value: string;
+	access_token: string;
 	/**
-	* A human-readable name, primarily used for display purposes
+	* REQUIRED. The type of the token (typically "Bearer").
 	*/
-	display?: string;
+	token_type: string;
 	/**
-	* A label indicating the attribute's function
+	* RECOMMENDED. The lifetime in seconds of the access token.
 	*/
-	type?: string;
+	expires_in?: number;
 	/**
-	* A Boolean value indicating the 'primary' or preferred attribute value
+	* OPTIONAL. The scope of the access token.
 	*/
-	primary?: boolean;
+	scope?: string;
+	/**
+	* OPTIONAL. The refresh token (rarely used for workload identities).
+	*/
+	refresh_token?: string;
+	/**
+	* OPTIONAL. The expiration time as an ISO 8601 string.
+	*/
+	expires?: string;
 }
 /**
-* SCIM Enterprise User Extension
-* @see https://datatracker.ietf.org/doc/html/rfc7643#section-4.3
+* Creates a StandardSchemaV1 for validating Workload Token Responses.
+* @param vendor - The name of the vendor creating this schema
+* @returns A StandardSchemaV1 instance for Workload Token Response validation
 */
-interface EnterpriseExtension {
+declare function workloadTokenResponseSchema(vendor: string): StandardSchemaV13<Record<string, unknown>, WorkloadTokenResponse>;
+/**
+* Token Validation Result
+*/
+interface TokenValidationResult {
 	/**
-	* Numeric or alphanumeric identifier assigned to a person
+	* Whether the token is valid
 	*/
-	employeeNumber?: string;
+	valid: boolean;
 	/**
-	* Identifies the name of a cost center
+	* The decoded and validated claims (if valid)
 	*/
-	costCenter?: string;
+	claims?: JWTAssertionClaims;
 	/**
-	* Identifies the name of an organization
+	* Error message (if invalid)
 	*/
-	organization?: string;
+	error?: string;
 	/**
-	* Identifies the name of a division
+	* Token expiration time (if valid)
 	*/
-	division?: string;
+	expiresAt?: Date;
+}
+/**
+* Workload Identity extracted from a validated token.
+*
+* This is the raw, token-derived view of a calling workload. For authorization it is normalized
+* into a {@link WorkloadPrincipal} (which adds a stable `id`).
+*/
+type WorkloadIdentity = {
+	/** Workload identifier (for JWT Bearer Grant tokens). */
+	workloadId?: string;
+	/** Client identifier (for OAuth2 Client Credentials tokens). */
+	clientId?: string;
+	/** Granted OAuth scopes (space-delimited). */
+	scope?: string;
 	/**
-	* Identifies the name of a department
+	* Whether the trusted IdP that validated this token opts into honoring its OAuth `scope` claim as
+	* entitlements (per-IdP intent, resolved at validation time). Consumed by the request-level `has*`
+	* helpers; `undefined` falls back to the global `RemoteConfig.authz.scopesAsEntitlements`.
 	*/
-	department?: string;
+	scopesAsEntitlements?: boolean;
 	/**
-	* The user's manager
+	* Enterprise Controlled ID for this workload (`ecid:<realm>:<opaque>`), when carried on the token
+	* `ecid` claim or enriched from a wired `WorkloadIdentityStore`. A workload is its own governance
+	* root. See https://ionite.com/docs/llms-ecid.txt.
 	*/
-	manager?: {
+	ecid?: string;
+	/** Full JWT claims from the token. */
+	claims: JWTAssertionClaims;
+};
+/**
+* A workload resolved as an authorization subject. It is a {@link WorkloadIdentity} with a stable
+* `id` (chosen as `clientId ?? workloadId ?? claims.sub`) used as the AccessIndex subject for
+* `subjectType: 'workload'` checks. When a `WorkloadIdentityStore` is wired, the identity may also
+* carry stored enrichment fields (merged in by `getWorkloadIdentity`).
+*/
+type WorkloadPrincipal = WorkloadIdentity & {
+	/** Stable subject id used for entitlement checks (`clientId ?? workloadId ?? claims.sub`). */
+	id: string;
+};
+/**
+* Workforce user type for SSO/OIDC and IAM-backed applications.
+* Carries the SSO/OIDC context used by server helpers and user stores.
+*/
+interface WorkforceUser extends BaseUserFields {
+	/**
+	* SSO/OIDC authentication data
+	*/
+	sso: {
 		/**
-		* The "id" of the SCIM resource representing the User's manager
+		* ID Token claims from the identity provider
 		*/
-		value?: string;
+		profile: IdTokenClaims;
 		/**
-		* The URI of the SCIM resource representing the User's manager
+		* Tenant/organization information
 		*/
-		$ref?: string;
+		tenant: {
+			id: string;
+			name: string;
+		};
 		/**
-		* The displayName of the User's manager
+		* OAuth scopes granted
 		*/
-		displayName?: string;
+		scope?: string;
+		/**
+		* Token type (typically "Bearer")
+		*/
+		tokenType: string;
+		/**
+		* Session state from the identity provider
+		*/
+		sessionState?: string;
+		/**
+		* Token expiration time
+		*/
+		expires: Date;
 	};
 }
 /**
-* SCIM URN for the ionite User extension, carrying the ECID identity correlator and
-* the account purpose (`accountClass`). Hosted schema:
-* https://ionite.com/schemas/ion-scim-user-extension.json
+* Customer session type for CIAM-backed applications.
+* The persisted customer record is `BaseCustomer` (see customer-store.types).
 */
-declare const ION_SCIM_USER_EXTENSION_URN = "urn:ionite:scim:schemas:extension:ion:2.0:User";
-/** SCIM core schema for a Workload principal (distinct ResourceType from User). */
-declare const ION_SCIM_WORKLOAD_SCHEMA = "urn:ionite:scim:schemas:core:2.0:Workload";
-/** SCIM core schema for a Customer principal (distinct ResourceType from User). */
-declare const ION_SCIM_CUSTOMER_SCHEMA = "urn:ionite:scim:schemas:core:2.0:Customer";
+interface Customer extends BaseUserFields {
+	ciam: {
+		/**
+		* ID token-like claims for CIAM sessions.
+		*/
+		profile: IdTokenClaims;
+		/**
+		* OAuth scopes granted for this customer session.
+		*/
+		scope?: string;
+		/**
+		* Token type (typically "Bearer").
+		*/
+		tokenType: string;
+		/**
+		* Session expiration time.
+		*/
+		expires: Date;
+	};
+}
 /**
-* ionite SCIM User extension. See https://ionite.com/docs/llms-ecid.txt.
+* Union of currently authenticated user domains.
 */
-interface IoniteUserExtension {
-	/**
-	* Enterprise Controlled ID: `ecid:<realm>:<opaque>` (realm = the minting authority's id).
-	* Correlates multiple accounts to one identity across systems.
-	*/
-	ecid?: string;
-	/**
-	* Account purpose (distinct from `userType` persona). Open value set:
-	* `daily`, `privileged`, `break_glass`, `service`.
-	*/
-	accountClass?: string;
-}
+type AuthenticatedUser = WorkforceUser | Customer;
 /**
-* SCIM User Resource
+* Union of every principal kind that can be resolved as an authorization subject: human-facing
+* users (workforce/customer) plus non-human {@link WorkloadPrincipal}s. Use this where a resolved
+* subject may be any authenticated principal; keep {@link AuthenticatedUser} for browser/tenant-HRD
+* flows that are inherently human.
+*/
+type AuthenticatedPrincipal = AuthenticatedUser | WorkloadPrincipal;
+/**
+* Persisted workforce user record with identity fields and tracking metadata.
+*
+* Builds on the shared minimal identity fields with:
+* - Optional SCIM attributes commonly set by IAM inbound provisioning
+* - An optional workforce (`sso`) session envelope
+* - Timestamps for tracking when users were first seen and last updated
+* - Optional custom extended data
+*
+* This is the type returned by `UserStore`. Apps typically extend the
+* `BaseUser` Zod/Valibot schema and name their extension `User`.
+*
+* @template TExtended - Type-safe custom data that consumers can add to users
 */
-interface User {
+type BaseUser<TExtended = object> = BaseUserFields & {
 	/**
-	* REQUIRED. Unique identifier for the User, typically from the provider
+	* Optional ionite tenant identifier for tenant-aware apps.
+	* Built-in user stores can use this when registering HRD mappings.
 	*/
-	id?: string;
+	tenantId?: string;
 	/**
-	* REQUIRED. A unique identifier for a SCIM resource as defined by the service provider
+	* Optional external identifier from the provisioning client.
+	* Commonly set by IAM inbound SCIM provisioning flows.
 	*/
 	externalId?: string;
 	/**
-	* Resource metadata
+	* Optional destination service-provider id captured after IAM materializes this user.
 	*/
-	meta?: {
-		resourceType?: string;
-		created?: string;
-		lastModified?: string;
-		location?: string;
-		version?: string;
-	};
+	providerId?: string;
 	/**
-	* REQUIRED. Unique identifier for the User, typically used for login
+	* Optional IAM-owned deep link associated with this user receipt.
 	*/
-	userName: string;
+	requestUrl?: string;
 	/**
-	* The components of the user's name
+	* Optional Enterprise Controlled ID: a system-of-record-owned identity correlator formatted as
+	* `ecid:<realm>:<opaque>` (realm = the minting authority's id). Correlates this account to a
+	* single identity across systems. Minted by the enterprise SOR (via an ECI), never by the app;
+	* received on the SCIM ionite extension or the `ecid` JWT claim. Never an authorization subject.
+	* See https://ionite.com/docs/llms-ecid.txt.
 	*/
-	name?: Name;
+	ecid?: string;
 	/**
-	* The name of the User, suitable for display to end-users
+	* Optional account purpose (distinct from `userType` persona). Documented open value set:
+	* `daily`, `privileged`, `break_glass`, `service`.
 	*/
-	displayName?: string;
+	accountClass?: string;
 	/**
-	* The casual way to address the user
+	* Optional SCIM display name distinct from the simple `name` field.
+	* Commonly set by IAM inbound SCIM provisioning flows.
 	*/
-	nickName?: string;
+	displayName?: string;
 	/**
-	* A fully qualified URL pointing to a page representing the User's online profile
+	* Optional structured SCIM name.
+	* Commonly set by IAM inbound SCIM provisioning flows.
 	*/
-	profileUrl?: string;
+	scimName?: Name;
 	/**
-	* The user's title, such as "Vice President"
+	* Optional SCIM email collection.
+	* The simple `email` field still stores the primary email for convenience.
 	*/
-	title?: string;
+	emails?: Email[];
 	/**
-	* Used to identify the relationship between the organization and the user
+	* Optional SCIM nickname.
+	* Commonly set by IAM inbound SCIM provisioning flows.
 	*/
-	userType?: string;
+	nickName?: string;
 	/**
-	* Indicates the User's preferred written or spoken language
+	* Optional SCIM account state.
+	* Commonly set by IAM inbound SCIM provisioning flows.
 	*/
-	preferredLanguage?: string;
+	active?: boolean;
 	/**
-	* Used to indicate the User's default location for purposes of localizing items such as currency
+	* Optional SCIM job title.
+	* Commonly set by IAM inbound SCIM provisioning flows.
 	*/
-	locale?: string;
+	title?: string;
 	/**
-	* The User's time zone in the "Olson" time zone database format
+	* Optional SCIM preferred language.
+	* Commonly set by IAM inbound SCIM provisioning flows.
 	*/
-	timezone?: string;
+	preferredLanguage?: string;
 	/**
-	* A Boolean value indicating the User's administrative status
+	* Optional SCIM locale.
+	* Commonly set by IAM inbound SCIM provisioning flows.
 	*/
-	active?: boolean;
+	locale?: string;
 	/**
-	* Email addresses for the user
+	* Optional SCIM timezone.
+	* Commonly set by IAM inbound SCIM provisioning flows.
 	*/
-	emails?: Email[];
+	timezone?: string;
 	/**
-	* Phone numbers for the User
+	* Optional SCIM phone numbers.
+	* Commonly set by IAM inbound SCIM provisioning flows.
 	*/
 	phoneNumbers?: PhoneNumber[];
 	/**
-	* Instant messaging addresses for the User
+	* Optional SCIM instant messaging addresses.
+	* Commonly set by IAM inbound SCIM provisioning flows.
 	*/
 	ims?: Array<{
 		value: string;
@@ -1036,24 +1225,28 @@ interface User {
 		primary?: boolean;
 	}>;
 	/**
-	* URLs of photos of the User
+	* Optional SCIM photos.
+	* Commonly set by IAM inbound SCIM provisioning flows.
 	*/
-	photos?: Array<{
-		value: string;
-		display?: string;
-		type?: string;
-		primary?: boolean;
-	}>;
+	photos?: Photo[];
 	/**
-	* Physical mailing addresses for this User
+	* Optional SCIM addresses.
+	* Commonly set by IAM inbound SCIM provisioning flows.
 	*/
 	addresses?: Address[];
 	/**
-	* A list of groups to which the user belongs
+	* Optional SCIM roles.
+	* Commonly set by IAM inbound SCIM provisioning flows.
+	*/
+	roles?: Role2[];
+	/**
+	* Optional SCIM groups.
+	* Commonly set by IAM inbound SCIM provisioning flows.
 	*/
 	groups?: Group2[];
 	/**
-	* A list of entitlements for the User
+	* Optional SCIM entitlements.
+	* Commonly set by IAM inbound SCIM provisioning flows.
 	*/
 	entitlements?: Array<{
 		value: string;
@@ -1062,151 +1255,111 @@ interface User {
 		primary?: boolean;
 	}>;
 	/**
-	* A list of roles for the User
-	*/
-	roles?: Role2[];
-	/**
-	* A list of certificates issued to the User
+	* Optional SCIM X.509 certificates.
+	* Commonly set by IAM inbound SCIM provisioning flows.
 	*/
 	x509Certificates?: X509Certificate[];
 	/**
-	* Enterprise User Extension
-	*/
-	"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"?: EnterpriseExtension;
-	/**
-	* ionite User Extension (ECID + accountClass).
-	*/
-	"urn:ionite:scim:schemas:extension:ion:2.0:User"?: IoniteUserExtension;
-	/**
-	* REQUIRED. The schemas attribute is an array of Strings which allows introspection of the supported schema version
-	*/
-	schemas?: string[];
-}
-/**
-* Creates a StandardSchemaV1 for validating SCIM User resources.
-* @param vendor - The name of the vendor creating this schema
-* @returns A StandardSchemaV1 instance for SCIM User resources
-*/
-declare function userSchema(vendor: string): StandardSchemaV13<Record<string, unknown>, User>;
-/**
-* Creates a StandardSchemaV1 for validating SCIM Group resources.
-* @param vendor - The name of the vendor creating this schema
-* @returns A StandardSchemaV1 instance for SCIM Group resources
-*/
-declare function groupResourceSchema(vendor: string): StandardSchemaV13<Record<string, unknown>, GroupResource>;
-/** Validates a SCIM Workload resource. */
-declare const workloadResourceSchema: StandardSchemaV13<unknown, ScimWorkload>;
-/** Validates a SCIM Customer resource. */
-declare const customerResourceSchema: StandardSchemaV13<unknown, ScimCustomer>;
-/**
-* Persisted CIAM customer record with identity fields and tracking metadata.
-*
-* Builds on the shared minimal identity fields with a lightweight set of
-* consumer-oriented attributes and an optional CIAM (`ciam`) session envelope.
-* This is the type returned by `CustomerStore`. Apps typically extend the
-* `BaseCustomer` Zod/Valibot schema to add custom attributes.
-*
-* @template TExtended - Type-safe custom data that consumers can add to customers
-*/
-type BaseCustomer<TExtended = object> = BaseUserFields & {
-	/**
-	* Optional ionite tenant identifier for tenant-aware apps.
-	*/
-	tenantId?: string;
-	/**
-	* Optional external identifier from a provisioning client.
-	*/
-	externalId?: string;
-	/**
-	* Optional destination service-provider id captured after IAM materializes this customer.
-	*/
-	providerId?: string;
-	/**
-	* Optional IAM-owned deep link associated with this customer receipt.
-	*/
-	requestUrl?: string;
-	/**
-	* Optional display name distinct from the simple `name` field.
-	*/
-	displayName?: string;
-	/**
-	* Optional email collection.
-	* The simple `email` field still stores the primary email for convenience.
-	*/
-	emails?: Email[];
-	/**
-	* Optional phone numbers.
+	* Optional SCIM enterprise extension.
+	* Mirrors `urn:ietf:params:scim:schemas:extension:enterprise:2.0:User`.
+	* Commonly set by IAM inbound SCIM provisioning flows.
 	*/
-	phoneNumbers?: PhoneNumber[];
+	scimEnterprise?: EnterpriseExtension;
 	/**
-	* Optional account state.
+	* Optional pass-through SCIM schema extensions keyed by full URN.
+	* Use this when your validator accepts custom top-level SCIM extensions and
+	* you want them to round-trip through a `UserStore` implementation.
 	*/
-	active?: boolean;
+	scimSchemaExtensions?: Record<string, unknown>;
 	/**
-	* Timestamp when the customer was first stored.
+	* Timestamp when the user was first stored.
 	*/
 	createdAt?: Date;
 	/**
-	* Timestamp when the customer was last updated (e.g., on re-login).
+	* Timestamp when the user was last updated (e.g., on re-login).
 	*/
 	updatedAt?: Date;
 	/**
-	* Optional CIAM envelope for stores that persist customer session profile data.
+	* Optional SSO envelope for stores that persist full auth profile data.
 	* Simple app stores MAY omit this field.
 	*/
-	ciam?: Customer["ciam"];
+	sso?: WorkforceUser["sso"];
 } & TExtended;
-type CustomerStoreOptions = {
+type UserStoreOptions = {
 	tenantId: string;
 	tenants: TenantStore;
 };
 /**
-* Abstract interface for customer storage backends.
+* Abstract interface for user storage backends.
 *
-* Mirrors `UserStore` but for the CIAM customer domain. Consumers can
-* implement this for in-memory, Redis, or database-backed persistence.
+* Consumers can implement this interface to use different storage backends:
+* - In-memory (for development/testing)
+* - Redis (for production with fast lookups)
+* - Database (PostgreSQL, MySQL, etc.)
 *
-* @template TExtended - Type-safe custom data that consumers can add to customers
+* @template TExtended - Type-safe custom data that consumers can add to users
+*
+* @example
+* ```typescript
+* // Custom user data
+* type MyUserData = {
+*   department: string;
+*   roles: string[];
+* };
+*
+* // Implement custom store
+* class RedisUserStore implements UserStore<MyUserData> {
+*   async get(sub: string): Promise<BaseUser<MyUserData> | null> {
+*     const data = await redis.get(`user:${sub}`);
+*     return data ? JSON.parse(data) : null;
+*   }
+*   // ... other methods
+* }
+* ```
 */
-interface CustomerStore<TExtended = object> {
+interface UserStore<TExtended = object> {
 	/**
-	* Retrieve a customer by their unique identifier.
+	* Retrieve a user by their unique identifier.
 	*
-	* @param id - The customer's unique identifier as defined by the store implementation
-	* @returns The customer if found, undefined otherwise
+	* @param id - The user's unique identifier as defined by the store implementation
+	* @returns The user if found, undefined otherwise
 	*/
-	get(id: string): Promise<BaseCustomer<TExtended> | undefined>;
+	get(id: string): Promise<BaseUser<TExtended> | undefined>;
 	/**
-	* Retrieve a customer based on their identity attributes or CIAM claims.
-	*
-	* @param customer - The customer to lookup
-	* @returns The customer if found, undefined otherwise
+	* Optional secondary-index lookup for the stable enterprise correlation key. Implementations that
+	* omit it remain correct; callers fall back to paged `list()` scans.
 	*/
-	lookup(customer: BaseCustomer<TExtended>): Promise<BaseCustomer<TExtended> | undefined>;
+	getByExternalId?(externalId: string): Promise<BaseUser<TExtended> | undefined>;
 	/**
-	* Optional indexed lookup by `externalId`. When omitted, callers fall back to `lookup` or a list scan.
+	* Retrieve a user based on their SCIM attributes or SSO JWT Claims.
+	*
+	* @param user - The user to lookup by SCIM attributes or SSO JWT Claims
+	* @returns The user if found, undefined otherwise
 	*/
-	getByExternalId?(externalId: string): Promise<BaseCustomer<TExtended> | undefined>;
+	lookup(user: BaseUser<TExtended>): Promise<BaseUser<TExtended> | undefined>;
 	/**
-	* Create or update a customer in the store.
+	* Create or update a user in the store.
 	*
-	* @param customer - The customer data to store
+	* If a user with the same `id` (sub) exists, it will be updated.
+	* Otherwise, a new user will be created.
+	*
+	* @param user - The user data to store
 	*/
-	upsert(customer: BaseCustomer<TExtended>): Promise<BaseCustomer<TExtended>>;
+	upsert(user: BaseUser<TExtended>): Promise<BaseUser<TExtended>>;
 	/**
-	* Delete a customer by their unique identifier.
+	* Delete a user by their unique identifier.
 	*
-	* @param id - The customer's unique identifier as defined by the store implementation
-	* @returns The number of customers deleted (0 or 1)
+	* @param id - The user's unique identifier as defined by the store implementation
+	* @returns The number of users deleted (0 or 1)
 	*/
 	delete(id: string): Promise<number>;
 	/**
-	* List customers in the store with optional pagination and sort.
+	* List users in the store with optional pagination and sort.
 	*
 	* @param options - Optional start (0-based), limit (page size), and sort
 	* @returns ListResult with total, count, items, size, page, pages
 	*/
-	list(options?: ListOptions): Promise<ListResult<BaseCustomer<TExtended>>>;
+	list(options?: ListOptions): Promise<ListResult<BaseUser<TExtended>>>;
 }
 /**
 * Persisted workload principal record. Mirrors the registry/enrichment shape of `BaseUser`, scoped
@@ -1373,6 +1526,14 @@ interface IamDeltaEmitter {
 	onUserUpsert(user: BaseUser): Promise<void>;
 	/** Delete a destination User identified strictly by externalId. */
 	onUserDelete(externalId: string): Promise<void>;
+	/** Upsert a full AppDev-projected SCIM Workload representation at the destination. */
+	onWorkloadUpsert(workload: BaseWorkloadIdentity): Promise<void>;
+	/** Delete a destination Workload identified by externalId (falling back to its App-owned id). */
+	onWorkloadDelete(externalId: string): Promise<void>;
+	/** Upsert a full AppDev-projected SCIM Customer representation at the destination. */
+	onCustomerUpsert(customer: BaseCustomer): Promise<void>;
+	/** Delete a destination Customer identified by externalId (falling back to its App-owned id). */
+	onCustomerDelete(externalId: string): Promise<void>;
 	/** Upsert a full SCIM Group representation for a group, role, or permission definition. */
 	onEntitlementUpsert(entity: Entitlement, type: EntitlementType): Promise<void>;
 	/** Delete a destination entitlement Group identified by the App-owned catalog id. */
@@ -1997,6 +2158,10 @@ type IAMConfig = {
 	* for your application's database model.
 	*/
 	inboundUsers?: IAMInboundUsersConfig;
+	/** AppDev-owned SCIM projection and persistence hooks for customer principals. */
+	inboundCustomers?: IAMInboundCustomersConfig;
+	/** AppDev-owned SCIM projection and persistence hooks for workload principals. */
+	inboundWorkloads?: IAMInboundWorkloadsConfig;
 	/**
 	* FrameworkConfig-only fallback that mints an IAM-owned deep link where access to an entitlement
 	* can be requested. A `requestUrl` written back into the catalog row by IAM takes precedence.
@@ -2105,6 +2270,20 @@ interface IAMInboundUsersConfig {
 	*/
 	mapBaseUserToScim?: (stored: BaseUser) => User | Promise<User>;
 }
+interface IAMInboundPrincipalContext<TStored> {
+	/** Current stored principal when replacing or patching an existing resource. */
+	existing?: TStored;
+	/** Operation mode for the inbound mapper. */
+	mode: "create" | "replace" | "patch";
+}
+interface IAMInboundCustomersConfig {
+	mapValidatedScimToBaseCustomer?: (validated: ScimCustomer, context: IAMInboundPrincipalContext<BaseCustomer>) => BaseCustomer | Promise<BaseCustomer>;
+	mapBaseCustomerToScim?: (stored: BaseCustomer) => ScimCustomer | Promise<ScimCustomer>;
+}
+interface IAMInboundWorkloadsConfig {
+	mapValidatedScimToBaseWorkload?: (validated: ScimWorkload, context: IAMInboundPrincipalContext<BaseWorkloadIdentity>) => BaseWorkloadIdentity | Promise<BaseWorkloadIdentity>;
+	mapBaseWorkloadToScim?: (stored: BaseWorkloadIdentity) => ScimWorkload | Promise<ScimWorkload>;
+}
 interface ScimAuthenticationScheme {
 	type: string;
 	name: string;
@@ -2548,6 +2727,8 @@ type OtelProtocol = "http/protobuf" | "http/json";
 type OtelProviderType = "otlp" | "grafana-lgtm" | "datadog" | "splunk" | "elastic";
 type OtelLogLevel = "trace" | "debug" | "info" | "warn" | "error";
 type OtelLevels = Partial<Record<OtelLogLevel, boolean>>;
+/** Local console mirror policy: disable it or set its minimum emitted severity. */
+type OtelConsoleMode = "off" | OtelLogLevel;
 type OtelAttributeValue = string | number | boolean | string[] | number[] | boolean[];
 type OtelAttributes = Record<string, OtelAttributeValue>;
 type OtelSignalConfig = {
@@ -2594,6 +2775,8 @@ type OtelConfig = {
 	deploymentEnvironment?: string;
 	resourceAttributes?: OtelAttributes;
 	levels?: OtelLevels;
+	/** `'off'` exports only to OTel; a level dual-emits at or above that severity. Defaults to `'info'`. */
+	console?: OtelConsoleMode;
 	traces?: boolean | OtelSignalConfig;
 	metrics?: boolean | OtelMetricsSignalConfig;
 	logs?: boolean | OtelSignalConfig;
@@ -2605,7 +2788,8 @@ type OtelConfig = {
 type FrameworkOtelConfig = {
 	levels?: OtelLevels;
 	instrument?: unknown[];
-	console?: boolean | ((record: OtelLogRecord) => void);
+	/** Optional app-owned destination/renderer for records admitted by `RemoteConfig.otel.console`. */
+	console?: (record: OtelLogRecord) => void;
 	spanProcessors?: unknown[];
 	metricReaders?: unknown[];
 	logRecordProcessors?: unknown[];
@@ -3802,6 +3986,14 @@ type IoniteValidators = {
 type ApplicationValidators<TTenantValidators extends TenantValidators = TenantValidators> = IoniteValidators & {
 	tenant: TTenantValidators;
 };
+type AuthzOaaPrincipalConfig = {
+	/**
+	* Principals included in OAA snapshots. `'all'` enumerates the wired store; `'access'` includes
+	* only principals referenced by access roots. Access-root subjects are always projected so OAA
+	* edges remain referentially closed.
+	*/
+	population?: OaaPrincipalPopulation;
+};
 type AuthzOaaConfig = {
 	url?: string;
 	apiKey?: string;
@@ -3809,6 +4001,12 @@ type AuthzOaaConfig = {
 	datasourceId?: string;
 	applicationName?: string;
 	applicationType?: string;
+	/** Workforce population. Defaults to `'all'` to preserve existing OAA snapshot behavior. */
+	users?: AuthzOaaPrincipalConfig;
+	/** CIAM customer population. Defaults to `'access'`. */
+	customers?: AuthzOaaPrincipalConfig;
+	/** Workload population. Defaults to `'access'`. */
+	workloads?: AuthzOaaPrincipalConfig;
 	compression?: "gzip" | "none";
 	multipart?: "auto" | "always" | "never";
 	maxPayloadBytes?: number;
@@ -4716,247 +4914,114 @@ type InMemoryTenantStoreOptions = {
 	ionCache?: TenantIonCache;
 };
 /**
-* Persisted workforce user record with identity fields and tracking metadata.
-*
-* Builds on the shared minimal identity fields with:
-* - Optional SCIM attributes commonly set by IAM inbound provisioning
-* - An optional workforce (`sso`) session envelope
-* - Timestamps for tracking when users were first seen and last updated
-* - Optional custom extended data
+* Persisted CIAM customer record with identity fields and tracking metadata.
 *
-* This is the type returned by `UserStore`. Apps typically extend the
-* `BaseUser` Zod/Valibot schema and name their extension `User`.
+* Builds on the shared minimal identity fields with a lightweight set of
+* consumer-oriented attributes and an optional CIAM (`ciam`) session envelope.
+* This is the type returned by `CustomerStore`. Apps typically extend the
+* `BaseCustomer` Zod/Valibot schema to add custom attributes.
 *
-* @template TExtended - Type-safe custom data that consumers can add to users
+* @template TExtended - Type-safe custom data that consumers can add to customers
 */
-type BaseUser<TExtended = object> = BaseUserFields & {
+type BaseCustomer<TExtended = object> = BaseUserFields & {
 	/**
 	* Optional ionite tenant identifier for tenant-aware apps.
-	* Built-in user stores can use this when registering HRD mappings.
 	*/
 	tenantId?: string;
 	/**
-	* Optional external identifier from the provisioning client.
-	* Commonly set by IAM inbound SCIM provisioning flows.
+	* Optional external identifier from a provisioning client.
 	*/
 	externalId?: string;
 	/**
-	* Optional destination service-provider id captured after IAM materializes this user.
+	* Optional destination service-provider id captured after IAM materializes this customer.
 	*/
 	providerId?: string;
 	/**
-	* Optional IAM-owned deep link associated with this user receipt.
+	* Optional IAM-owned deep link associated with this customer receipt.
 	*/
 	requestUrl?: string;
 	/**
-	* Optional Enterprise Controlled ID: a system-of-record-owned identity correlator formatted as
-	* `ecid:<realm>:<opaque>` (realm = the minting authority's id). Correlates this account to a
-	* single identity across systems. Minted by the enterprise SOR (via an ECI), never by the app;
-	* received on the SCIM ionite extension or the `ecid` JWT claim. Never an authorization subject.
-	* See https://ionite.com/docs/llms-ecid.txt.
-	*/
-	ecid?: string;
-	/**
-	* Optional account purpose (distinct from `userType` persona). Documented open value set:
-	* `daily`, `privileged`, `break_glass`, `service`.
-	*/
-	accountClass?: string;
-	/**
-	* Optional SCIM display name distinct from the simple `name` field.
-	* Commonly set by IAM inbound SCIM provisioning flows.
+	* Optional display name distinct from the simple `name` field.
 	*/
 	displayName?: string;
 	/**
-	* Optional structured SCIM name.
-	* Commonly set by IAM inbound SCIM provisioning flows.
-	*/
-	scimName?: Name;
-	/**
-	* Optional SCIM email collection.
+	* Optional email collection.
 	* The simple `email` field still stores the primary email for convenience.
 	*/
 	emails?: Email[];
 	/**
-	* Optional SCIM nickname.
-	* Commonly set by IAM inbound SCIM provisioning flows.
-	*/
-	nickName?: string;
-	/**
-	* Optional SCIM account state.
-	* Commonly set by IAM inbound SCIM provisioning flows.
-	*/
-	active?: boolean;
-	/**
-	* Optional SCIM job title.
-	* Commonly set by IAM inbound SCIM provisioning flows.
-	*/
-	title?: string;
-	/**
-	* Optional SCIM preferred language.
-	* Commonly set by IAM inbound SCIM provisioning flows.
-	*/
-	preferredLanguage?: string;
-	/**
-	* Optional SCIM locale.
-	* Commonly set by IAM inbound SCIM provisioning flows.
-	*/
-	locale?: string;
-	/**
-	* Optional SCIM timezone.
-	* Commonly set by IAM inbound SCIM provisioning flows.
-	*/
-	timezone?: string;
-	/**
-	* Optional SCIM phone numbers.
-	* Commonly set by IAM inbound SCIM provisioning flows.
+	* Optional phone numbers.
 	*/
 	phoneNumbers?: PhoneNumber[];
 	/**
-	* Optional SCIM instant messaging addresses.
-	* Commonly set by IAM inbound SCIM provisioning flows.
-	*/
-	ims?: Array<{
-		value: string;
-		display?: string;
-		type?: string;
-		primary?: boolean;
-	}>;
-	/**
-	* Optional SCIM photos.
-	* Commonly set by IAM inbound SCIM provisioning flows.
-	*/
-	photos?: Photo[];
-	/**
-	* Optional SCIM addresses.
-	* Commonly set by IAM inbound SCIM provisioning flows.
-	*/
-	addresses?: Address[];
-	/**
-	* Optional SCIM roles.
-	* Commonly set by IAM inbound SCIM provisioning flows.
-	*/
-	roles?: Role2[];
-	/**
-	* Optional SCIM groups.
-	* Commonly set by IAM inbound SCIM provisioning flows.
-	*/
-	groups?: Group2[];
-	/**
-	* Optional SCIM entitlements.
-	* Commonly set by IAM inbound SCIM provisioning flows.
-	*/
-	entitlements?: Array<{
-		value: string;
-		display?: string;
-		type?: string;
-		primary?: boolean;
-	}>;
-	/**
-	* Optional SCIM X.509 certificates.
-	* Commonly set by IAM inbound SCIM provisioning flows.
-	*/
-	x509Certificates?: X509Certificate[];
-	/**
-	* Optional SCIM enterprise extension.
-	* Mirrors `urn:ietf:params:scim:schemas:extension:enterprise:2.0:User`.
-	* Commonly set by IAM inbound SCIM provisioning flows.
-	*/
-	scimEnterprise?: EnterpriseExtension;
-	/**
-	* Optional pass-through SCIM schema extensions keyed by full URN.
-	* Use this when your validator accepts custom top-level SCIM extensions and
-	* you want them to round-trip through a `UserStore` implementation.
+	* Optional account state.
 	*/
-	scimSchemaExtensions?: Record<string, unknown>;
+	active?: boolean;
 	/**
-	* Timestamp when the user was first stored.
+	* Timestamp when the customer was first stored.
 	*/
 	createdAt?: Date;
 	/**
-	* Timestamp when the user was last updated (e.g., on re-login).
+	* Timestamp when the customer was last updated (e.g., on re-login).
 	*/
 	updatedAt?: Date;
 	/**
-	* Optional SSO envelope for stores that persist full auth profile data.
+	* Optional CIAM envelope for stores that persist customer session profile data.
 	* Simple app stores MAY omit this field.
 	*/
-	sso?: WorkforceUser["sso"];
+	ciam?: Customer["ciam"];
 } & TExtended;
-type UserStoreOptions = {
+type CustomerStoreOptions = {
 	tenantId: string;
 	tenants: TenantStore;
 };
 /**
-* Abstract interface for user storage backends.
-*
-* Consumers can implement this interface to use different storage backends:
-* - In-memory (for development/testing)
-* - Redis (for production with fast lookups)
-* - Database (PostgreSQL, MySQL, etc.)
-*
-* @template TExtended - Type-safe custom data that consumers can add to users
+* Abstract interface for customer storage backends.
 *
-* @example
-* ```typescript
-* // Custom user data
-* type MyUserData = {
-*   department: string;
-*   roles: string[];
-* };
+* Mirrors `UserStore` but for the CIAM customer domain. Consumers can
+* implement this for in-memory, Redis, or database-backed persistence.
 *
-* // Implement custom store
-* class RedisUserStore implements UserStore<MyUserData> {
-*   async get(sub: string): Promise<BaseUser<MyUserData> | null> {
-*     const data = await redis.get(`user:${sub}`);
-*     return data ? JSON.parse(data) : null;
-*   }
-*   // ... other methods
-* }
-* ```
+* @template TExtended - Type-safe custom data that consumers can add to customers
 */
-interface UserStore<TExtended = object> {
+interface CustomerStore<TExtended = object> {
 	/**
-	* Retrieve a user by their unique identifier.
+	* Retrieve a customer by their unique identifier.
 	*
-	* @param id - The user's unique identifier as defined by the store implementation
-	* @returns The user if found, undefined otherwise
+	* @param id - The customer's unique identifier as defined by the store implementation
+	* @returns The customer if found, undefined otherwise
 	*/
-	get(id: string): Promise<BaseUser<TExtended> | undefined>;
+	get(id: string): Promise<BaseCustomer<TExtended> | undefined>;
 	/**
-	* Optional secondary-index lookup for the stable enterprise correlation key. Implementations that
-	* omit it remain correct; callers fall back to paged `list()` scans.
+	* Retrieve a customer based on their identity attributes or CIAM claims.
+	*
+	* @param customer - The customer to lookup
+	* @returns The customer if found, undefined otherwise
 	*/
-	getByExternalId?(externalId: string): Promise<BaseUser<TExtended> | undefined>;
+	lookup(customer: BaseCustomer<TExtended>): Promise<BaseCustomer<TExtended> | undefined>;
 	/**
-	* Retrieve a user based on their SCIM attributes or SSO JWT Claims.
-	*
-	* @param user - The user to lookup by SCIM attributes or SSO JWT Claims
-	* @returns The user if found, undefined otherwise
+	* Optional indexed lookup by `externalId`. When omitted, callers fall back to `lookup` or a list scan.
 	*/
-	lookup(user: BaseUser<TExtended>): Promise<BaseUser<TExtended> | undefined>;
+	getByExternalId?(externalId: string): Promise<BaseCustomer<TExtended> | undefined>;
 	/**
-	* Create or update a user in the store.
-	*
-	* If a user with the same `id` (sub) exists, it will be updated.
-	* Otherwise, a new user will be created.
+	* Create or update a customer in the store.
 	*
-	* @param user - The user data to store
+	* @param customer - The customer data to store
 	*/
-	upsert(user: BaseUser<TExtended>): Promise<BaseUser<TExtended>>;
+	upsert(customer: BaseCustomer<TExtended>): Promise<BaseCustomer<TExtended>>;
 	/**
-	* Delete a user by their unique identifier.
+	* Delete a customer by their unique identifier.
 	*
-	* @param id - The user's unique identifier as defined by the store implementation
-	* @returns The number of users deleted (0 or 1)
+	* @param id - The customer's unique identifier as defined by the store implementation
+	* @returns The number of customers deleted (0 or 1)
 	*/
 	delete(id: string): Promise<number>;
 	/**
-	* List users in the store with optional pagination and sort.
+	* List customers in the store with optional pagination and sort.
 	*
 	* @param options - Optional start (0-based), limit (page size), and sort
 	* @returns ListResult with total, count, items, size, page, pages
 	*/
-	list(options?: ListOptions): Promise<ListResult<BaseUser<TExtended>>>;
+	list(options?: ListOptions): Promise<ListResult<BaseCustomer<TExtended>>>;
 }
 type AuthzEntityBase = {
 	id: string;
@@ -4995,9 +5060,20 @@ type SubjectTypeScoping = {
 	/** AppDev advisory default principal kinds; must be a subset of `assignableSubjectTypes` (read-only to IAM). */
 	recommendedSubjectTypes?: SubjectType[];
 };
+/** Suggested IAM governance labels for an entitlement's advisory risk classification. */
+declare const CANONICAL_RISK_LEVELS: readonly ["basic", "elevated", "privileged", "admin"];
+/** Canonical IAM governance suggestions with autocomplete, while allowing AppDev-defined labels. */
+type RiskLevel = (typeof CANONICAL_RISK_LEVELS)[number] | (string & {});
+/** Risk projected to IAM when an entitlement does not declare or store an explicit classification. */
+declare const DEFAULT_RISK_LEVEL = "basic";
 type Permission = AuthzEntityBase & SubjectTypeScoping & {
 	/** True when this catalog entry should be exposed as requestable access in IAM tooling. */
 	requestable?: boolean;
+	/**
+	* Advisory access-risk classification. App code seeds the initial value; IAM may replace it after
+	* materialization. Unset values project to IAM as {@link DEFAULT_RISK_LEVEL}.
+	*/
+	riskLevel?: RiskLevel;
 	/** IAM-owned deep link where a principal can request this entitlement, when the destination provides one. */
 	requestUrl?: string;
 	action?: string;
@@ -5011,6 +5087,11 @@ type Permission = AuthzEntityBase & SubjectTypeScoping & {
 type Role = AuthzEntityBase & SubjectTypeScoping & {
 	/** True when this catalog entry should be exposed as requestable access in IAM tooling. */
 	requestable?: boolean;
+	/**
+	* Advisory access-risk classification. App code seeds the initial value; IAM may replace it after
+	* materialization. Unset values project to IAM as {@link DEFAULT_RISK_LEVEL}.
+	*/
+	riskLevel?: RiskLevel;
 	/** IAM-owned deep link where a principal can request this entitlement, when the destination provides one. */
 	requestUrl?: string;
 	/** Permissions this role confers (definitional). Roles are flat bundles — OAA has no nested-role edge. */
@@ -5019,6 +5100,11 @@ type Role = AuthzEntityBase & SubjectTypeScoping & {
 type Group = AuthzEntityBase & SubjectTypeScoping & {
 	/** True when this catalog entry should be exposed as requestable access in IAM tooling. */
 	requestable?: boolean;
+	/**
+	* Advisory access-risk classification. App code seeds the initial value; IAM may replace it after
+	* materialization. Unset values project to IAM as {@link DEFAULT_RISK_LEVEL}.
+	*/
+	riskLevel?: RiskLevel;
 	/** IAM-owned deep link where a principal can request this entitlement, when the destination provides one. */
 	requestUrl?: string;
 	/** Nested child groups composed into this group (definitional). */
@@ -5053,6 +5139,8 @@ type AuthzScimGroupType = OaaAccessTargetType;
 type AuthzScimGroupExtension = {
 	type?: AuthzScimGroupType;
 	requestable?: boolean;
+	/** Advisory access-risk classification. Writable by IAM; unset catalog values project as `basic`. */
+	riskLevel?: string;
 	/** Destination service-provider id written back by IAM. */
 	providerId?: string;
 	/** IAM-owned deep link for requesting this entitlement. Writable by IAM. */
@@ -5394,6 +5482,7 @@ type OaaSyncOptions = {
 	multipartThresholdBytes?: number;
 	partSizeBytes?: number;
 };
+type OaaPrincipalPopulation = "all" | "access";
 type OaaSyncResult = {
 	success: boolean;
 	syncToken?: string;
@@ -5405,9 +5494,13 @@ type OaaSyncResult = {
 type OaaSyncInput<
 	TUser,
 	TGroup,
-	TResource
+	TResource,
+	TCustomer = BaseCustomer,
+	TWorkload = BaseWorkloadIdentity
 > = {
 	users?: Iterable<TUser> | AsyncIterable<TUser>;
+	customers?: Iterable<TCustomer> | AsyncIterable<TCustomer>;
+	workloads?: Iterable<TWorkload> | AsyncIterable<TWorkload>;
 	groups?: Iterable<TGroup | Group> | AsyncIterable<TGroup | Group>;
 	roles?: Iterable<Role> | AsyncIterable<Role>;
 	permissions?: Iterable<Permission> | AsyncIterable<Permission>;
@@ -5424,9 +5517,13 @@ interface OaaClient<
 	TGroup = Group,
 	TRole = Role,
 	TPermission = Permission,
-	TResource = Resource
+	TResource = Resource,
+	TCustomer = BaseCustomer,
+	TWorkload = BaseWorkloadIdentity
 > {
 	pushUser(user: TUser): Promise<void>;
+	pushCustomer(customer: TCustomer): Promise<void>;
+	pushWorkload(workload: TWorkload): Promise<void>;
 	pushGroup(group: TGroup | Group): Promise<void>;
 	pushRole(role: TRole): Promise<void>;
 	pushPermission(permission: TPermission): Promise<void>;
@@ -5439,6 +5536,8 @@ interface OaaClient<
 	* `sync` remains the safety net for any drift (e.g. an outage between revoke and delete).
 	*/
 	deleteUser(id: string): Promise<void>;
+	deleteCustomer(id: string): Promise<void>;
+	deleteWorkload(id: string): Promise<void>;
 	deleteGroup(id: string): Promise<void>;
 	deleteRole(id: string): Promise<void>;
 	deletePermission(id: string): Promise<void>;
@@ -5454,7 +5553,12 @@ interface OaaClient<
 	* response (a later full `sync` reconciles), same contract as the single-change methods.
 	*/
 	pushAccessChanges(items: OaaAccessChangeBatchItem[]): Promise<void>;
-	sync(input: OaaSyncInput<TUser, TGroup, TResource>, options?: OaaSyncOptions): Promise<OaaSyncResult>;
+	sync(input: OaaSyncInput<TUser, TGroup, TResource, TCustomer, TWorkload>, options?: OaaSyncOptions): Promise<OaaSyncResult>;
+	/**
+	* Resolved Ops-owned snapshot population for a principal kind. Apps may use this as an
+	* enumeration optimization; the SDK enforces it independently.
+	*/
+	population(kind: SubjectType): OaaPrincipalPopulation;
 	/**
 	* Synchronous readiness check. Returns true once OAA config (url, providerId,
 	* datasourceId) is available from RemoteConfig/FrameworkConfig. Use this in request
@@ -6065,4 +6169,4 @@ type LfvErrorResponse = {
 };
 /** Generates a ULID */
 declare function generateULID(prefix?: string): string;
-export { workloadTokenResponseSchema, workloadResourceSchema, withValidate, warnLogger, waitOn, version, validationFailureResponse, userSchema, unionCatalogRead, trustedClientPermissionsForPrincipal, trimTrailingSlash, tokenResponseSchema, toCodeCatalog, stripJsonComments, stableConfigHash, silentLogger, serializeConfig, remoteConfigSecretType, readyCatalogEntry, parseKmsPoolDocument, parseKmsPoolControlDocument, parseJsonc, parseEcid, oidcCallbackSchema, normalizeTenantRoutingStrategy, normalizeTenantPathNamespace, must, mergeConfig, mergeCodeCatalogEntity, materializeCodeCatalogEntity, matchesListFilter, matchTenantPath, listGenerator, list, jwtAssertionClaimsSchema, isStoreConflictError, isEcid, isConfigSourceError, isConfigLocator, isCodeCatalog, infoLogger, idTokenClaimsSchema, groupResourceSchema, getCodeCatalogEntity, generateULID, formatEcid, deprecateRetiredCodeCatalogRows, defineSecretType, defineCatalog, defaultSecretContentType, defaultLogger, deepEqualPlain, decodeUser, debugLogger, customerResourceSchema, configTrustedClientGrants, claimsToUser, catalogEntityStore, buildTenantPath, assertValidSubjectTypeScoping, assertRequiredSubjectType, assertEcid, accessRootId, accessRefId, X509Certificate, WorkloadValidators, WorkloadTokenStore, WorkloadTokenResponse, WorkloadPrincipal, WorkloadIncomingOutgoing, WorkloadIdentityStore, WorkloadIdentity, WorkloadGetToken, WorkloadConfigMap, WorkloadConfig, WorkloadClient, Workload, WorkforceUser, VaultWorkloadAuthConfig, VaultWebSocketSecretsConfig, VaultWebSocketAuthHeader, VaultSecretsConfig, VaultLfvSecretsConfig, VaultConfigLocator, ValidateResult, UsersInboundHandlerConfig, UserStoreOptions, UserStore, UpdateTenantRequest, TrustedProvisioningClient, TrustedIdp, TokenValidationResult, TokenResponse, TenantWebhookPayload, TenantValidators, TenantStore, TenantStatus, TenantRoutingStrategy, TenantResponse, TenantPathRoutingStrategy, TenantPathNamespace, TenantPathMatch, TenantIonCache, SubscriptionMode, SubjectTypeScoping, SubjectType, SubjectScope, SubjectRef, StoreConflictKind, StoreConflictError, StateCookie, StandardSchemaWithValidate, SessionStore, Session, ServerOnlyWorkloadConfig, SecretsWriteOptions, SecretsValidators, SecretsSubscriptionOptions, SecretsSourceType, SecretsSourceMap, SecretsSourceConfig, SecretsSource, SecretsOperationOptions, SecretsModuleConfig, Secrets, SecretTypeRegistryEntry, SecretTypeInput, SecretTypeDescriptor, SecretRequestSeverity, SecretLifecycleRequest, SecretHandle, SecretFormat, SecretEventName, SecretEventListener, SecretEvent, SecretContentTypeMismatchError, SecretContentType, Secret, ScimWorkload, User as ScimUser, ScimServiceProviderConfig, ScimSchemaDefinition, ScimSchemaAttributeDefinition, Role2 as ScimRole, ScimResult, ScimResourceTypeSchemaExtension, ScimResourceType, ScimMutationSummary, ScimListResponse, Group2 as ScimGroup, ScimError, ScimCustomer, ScimAuthenticationScheme, SSOValidators, SSOHandlerConfig, SSOConfigFromCode, SSOConfig, SSOAppValidators, SSOAppRegistry, SSO, RoutingOptions, RouteModule, RouteFilterResult, Role, ResourceProvider, ResourceChangeListener, ResourceChange, Resource, ResolvedVaultLfvSecretsConfig, ResolvedRoute, RequireReadyResult, RemoteConfigRetryOptions, RemoteConfigRetryHook, RemoteConfigRetryContext, RemoteConfigLoadErrorKind, RemoteConfig, RegisterSSOAppResult, RegisterSSOAppPayload, RegisterSSOAppError, RegisterIAMAppResult, RegisterIAMAppPayload, RegisterIAMAppError, ReconcileReport, ReadyzEndpointConfig, ReadyAccessCatalogEntry, ReadinessReport, ReactiveHandle, PrincipalInboundHandlerConfig, Photo, PhoneNumber, Permission, ParsedEcid, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, OtelSignalName, OtelSignalConfig, OtelProviderType, OtelProtocol, OtelOAuthClientCredentialsConfig, OtelMetricsSignalConfig, OtelLogRecord, OtelLogLevel, OtelLevels, OtelConfig, OtelAttributes, OtelAttributeValue, Otel, OidcCallbackParams, OaaSyncResult, OaaSyncOptions, OaaSyncInput, OaaClient, OaaAccessTargetType, OaaAccessChangeBatchItem, Name, ModuleReadinessState, ModuleReadiness, ModuleName, ModifiableFrameworkConfig, MirrorConfigLocator, MetaData, MagicLinkStore, MagicLink, Logger, ListResult, ListOptions, ListFilter, LfvOtpResponse, LfvOtpRequest, LfvJwks, LfvErrorResponse, LfvErrorCode, LfvEd25519PublicJwk, LfvEd25519PrivateJwk, LfvCallbackTransport, LfvCallbackKind, LfvCallbackHeaders, LfvCallbackEnvelope, LfvActionRequestBase, LfvActionName, LfvActionAcceptedResponse, KmsRevokeKeyResult, KmsRevokeKeyRequest, KmsPoolSlot, KmsPoolListener, KmsPoolIssuer, KmsPoolDocument, KmsPoolControlDocument, KmsPoolConfig, KmsPool, KmsParkResult, KmsParkRequest, KmsParkReport, KmsParkDisposition, KmsKeyState, KmsKey, KmsIssuerEventName, KmsIssuerEventListener, KmsIssuerEvent, KmsIssuedKey, KmsConfig, KmsAllocationStrategy, KmsAllocationPolicy, KmsAddKeysResult, KmsAddKeysRequest, Kms, JwtBearerWorkloadConfig, JWTAssertionClaims, IoniteValidators, IoniteUserExtension, IoniteErrorOptions, IoniteError, IoniteBase, Ionite, InferSecretType, InMemoryTenantStoreOptions, IdentityResolution, IdTokenClaims, IamPrincipalKindFlag, IamPrincipalKind, IamDeltaResourceType, IamDeltaReconcileResult, IamDeltaReconcileInput, IamDeltaMode, IamDeltaEmitter, IamAssignmentPolicy, ION_TENANT_MANAGE, ION_SDK_PERMISSIONS, ION_SCIM_WORKLOAD_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_CUSTOMER_SCHEMA, ION_IAM_WORKLOADS_WRITE, ION_IAM_USERS_WRITE, ION_IAM_READ, ION_IAM_GROUPS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_ACCESS_REQUESTS_WRITE, ION_ENDPOINT_PERMISSIONS, ION_CIAM_MAGIC_LINK_CREATE, ION_CAPABILITIEZ_READ, ION_AUTHZ_OAA_SYNC, ION_AUTHZ_GROUP_SCHEMA, IAMValidators, IAMUsersInbound, IAMPrincipalsInbound, IAMInboundUsersConfig, IAMInboundUserContext, IAMHandlerConfig, IAMGroupsOutbound, IAMGroupsInbound, IAMEndpointFlag, IAMDiscoveryHandlerConfig, IAMDiscoveryContext, IAMDiscoveryConfig, IAMConfigFromCode, IAMConfig, IAMAppValidators, IAMAppRegistry, IAMAccessRequestsConfig, IAM, GroupsInboundHandlerConfig, GroupResource, GroupMember, Group, GcpSecretsConfig, GcpConfigLocator, FrameworkWorkloadIncomingOutgoing, FrameworkWorkloadConfigFromCode, FrameworkWorkloadConfig, FrameworkStores, FrameworkSecretsSourceConfig, FrameworkSecretsModuleConfig, FrameworkOtelConfig, FrameworkLfvConfig, FrameworkConfigInput, FrameworkConfig, EnvironmentType, EntityStore, EntitlementType, Entitlement, EnterpriseExtension, EndpointPermission, EndpointOperation, Email, EgressOutcome, EgressChannelOutcome, EffectiveEdge, EcidFormatError, ECID_SCHEME, DevSecretsConfig, DestinationReference, DEFAULT_TENANT_UI_NAMESPACE, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_SECRET_MIME_TYPES, CustomerStoreOptions, CustomerStore, Customer, CreateUserOptions, CreateTenantRequest, CreateGroupOptions, ConfigSubscriptionOptions, ConfigSourceType, ConfigSourceResolver, ConfigSourceErrorInit, ConfigSourceError, ConfigSourceEnv, ConfigSource, ConfigLocator, ConfigErrorKind, ConfigChangeResult, ConfigChangeOptions, ConfigChangeCallback, ConfigApplyStatus, CodeCatalogNamespace, CodeCatalogInput, CodeCatalog, ClientCredentialsWorkloadConfig, ChangeListener, CatalogEntityKind, CatalogChangeListener, CatalogChangeKind, CatalogChange, CapabilityState, CapabilityKey, CapabilityEndpointUrls, CapabilitiezManifest, CachedWorkloadToken, CacheConfig, CIAMValidators, CIAMProviderType, CIAMProviderDescriptor, CIAMProviderConfig, CIAMProviderColors, CIAMProviderBranding, CIAMConfigFromCodeInput, CIAMConfigFromCode, CIAMConfig, CIAM, BaseWorkloadIdentity, BaseUser, BaseTenant, BaseCustomer, AzureSecretsConfig, AzureConfigLocator, AzureAuthMethod, AwsSecretsConfig, AwsConfigLocator, AuthzScimGroupType, AuthzScimGroupExtension, AuthzOaaConfig, AuthzEntityBase, AuthzDecision, AuthzConfig, Authz, AuthenticatedUser, AuthenticatedPrincipal, AssignmentPolicyError, ApplicationValidators, Address, AccessStatus, AccessRequestSubmit, AccessRequestResult, AccessRequestCreate, AccessRef, AccessProvenance, AccessMutationStatus, AccessMutationResult, AccessIndex, AccessCheckTarget, AccessCheckResult, AccessCheckReason, AccessChange, AccessCatalogStore, AccessAssignmentStore };
+export { AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestResult, AccessRequestSubmit, AccessStatus, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DestinationReference, DevSecretsConfig, ECID_SCHEME, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InferSecretType, Ionite, IoniteBase, IoniteError, IoniteErrorOptions, IoniteUserExtension, IoniteValidators, JWTAssertionClaims, JwtBearerWorkloadConfig, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleName, ModuleReadiness, ModuleReadinessState, Name, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceMap, SecretsSourceType, SecretsSubscriptionOptions, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantIonCache, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UpdateTenantRequest, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWebSocketAuthHeader, VaultWebSocketSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadConfig, WorkloadConfigMap, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadValidators, X509Certificate, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, catalogEntityStore, claimsToUser, configTrustedClientGrants, customerResourceSchema, debugLogger, decodeUser, deepEqualPlain, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, readyCatalogEntry, remoteConfigSecretType, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unionCatalogRead, userSchema, validationFailureResponse, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };