@ionite/core 0.0.24-beta.20260922.9 → 0.0.24-beta.20260927.13

package/dist/server.d.ts

@@ -146,6 +146,56 @@ declare function orderedEnabledProviders(providers: Record<string, CIAMProviderC
 	name: string;
 	config: CIAMProviderConfig;
 }>;
+declare const DISPLAY_COOKIE_VERSION = 1;
+type DisplayCookieConfig = {
+	/**
+	* When true, the SDK writes a non-HttpOnly display cookie beside the opaque session cookie.
+	* ConfigSource-only. Default false.
+	*/
+	enabled?: boolean;
+	/**
+	* How many display cookies a single response may leave on the browser, newest session window
+	* first. ConfigSource-only. Values below 1 fall back to {@link DEFAULT_DISPLAY_COOKIE_MAX}.
+	* @default 10
+	*/
+	max?: number;
+	/**
+	* Session-less tenant hints written by an App after an explicit directory lookup.
+	* ConfigSource-only and off unless `enabled` is true.
+	*/
+	discovered?: DiscoveredDisplayCookieConfig;
+};
+type DiscoveredDisplayCookieConfig = {
+	enabled?: boolean;
+	/** Browser hint lifetime. This is not a session expiry. @default 14400 */
+	ttlSeconds?: number;
+	/** Independent cap; discovered hints never displace live-session entries. @default 10 */
+	max?: number;
+};
+/** What `${basePath}/auth/user` and `${basePath}/auth/customer` return. ConfigSource-only. */
+type UserEndpointPolicy = "full" | "display" | "off";
+type DisplayUser = Record<string, string | number | boolean | null>;
+type DisplayAuthType = "sso" | "ciam";
+type DisplayCookieEnvelope = {
+	v: typeof DISPLAY_COOKIE_VERSION;
+	/**
+	* Session envelopes omit this field (absent means `'session'`) so the wire format stays identical
+	* to cookies written before discovered hints existed; only discovered hints set it explicitly.
+	* Readers must treat `undefined` as `'session'`.
+	*/
+	kind?: "session" | "discovered";
+	tenantId?: string;
+	authType: DisplayAuthType;
+	/** ISO timestamp copied from the session window at write time. Display only. */
+	expiresAt: string;
+	user: DisplayUser;
+	tenantName?: string;
+};
+type ParsedDisplayCookie = {
+	name: string;
+	prefix: string;
+	envelope: DisplayCookieEnvelope;
+};
 /**
 * Minimal logger interface compatible with common structured logging patterns.
 */
@@ -2109,20 +2159,18 @@ type IamPrincipalKind = {
 	assignment: IamAssignmentPolicy;
 	delta?: IamDeltaMode;
 };
+/**
+* Destination-side inbox contract. The destination owns idempotency: when a pending request
+* already exists for the same (subjectType, subject, target, operation) tuple, `create` must
+* return that request with `created: false` (the handler answers 200 instead of 201). Operation
+* arrays are forbidden — one request carries exactly one `'grant' | 'revoke'`.
+*/
 type IAMAccessRequestsConfig = {
 	create: (request: AccessRequestCreate) => Promise<{
 		request: AccessRequestResult;
 		created: boolean;
 	}>;
 };
-type AccessRequestSubmit = {
-	subject: AccessChange["subject"];
-	subjectType: SubjectType;
-	targetType: EntitlementType;
-	target: AccessChange["target"];
-	operation: "grant" | "revoke";
-	justification?: string;
-};
 type IAMEntitlementRequestUrlContext = {
 	request: Request;
 	tenantId?: string;
@@ -2818,6 +2866,68 @@ interface SessionStore<TExtended = object> {
 	*/
 	delete(sid: string): Promise<void>;
 }
+type DisplayCookieAttributes = {
+	path: string;
+	domain?: string;
+	secure: boolean;
+	sameSite: "Strict" | "Lax";
+};
+type DisplayCookieCandidate = ParsedDisplayCookie & {
+	kind: "session" | "discovered";
+	/** Authoritative session-window expiry from the peer session record. */
+	sessionExpiresAt?: Date;
+	live: boolean;
+};
+type DisplayCookieTrim = (candidates: DisplayCookieCandidate[], options: {
+	max: number;
+	maxDiscovered: number;
+}) => DisplayCookieCandidate[];
+/** Non-HttpOnly on purpose: browser UI reads this cookie. The server never trusts it. */
+declare function formatDisplaySetCookie(name: string, value: string, expires: Date, attr: DisplayCookieAttributes): string;
+declare function formatDisplayClearCookie(name: string, attr: DisplayCookieAttributes): string;
+/**
+* Clear-on-touch for the disabled state: emit a `Max-Age=0` clear only when the browser still
+* holds a profile cookie (even an undecodable one). Runs on every authenticated request, so it
+* is a raw substring probe, not a parse — a false positive (another cookie name sharing the
+* suffix) only emits one harmless clear.
+*/
+declare function planDisplayCookieClear(cookieHeader: string | null | undefined, cookiesPrefix: string, attr: DisplayCookieAttributes): string[];
+/**
+* Pick survivors. `ordered` is live sessions newest first followed by discovered hints newest
+* first. The two kinds have independent caps, and the session cookie being written is always kept.
+*/
+declare function selectDisplayCookies(ordered: DisplayCookieCandidate[], currentName: string, max: number, maxDiscovered: number, trim?: DisplayCookieTrim): DisplayCookieCandidate[];
+declare function planDisplayCookieHeaders(input: {
+	cookieHeader: string | null | undefined;
+	sessionStore: SessionStore | undefined;
+	cookiesPrefix: string;
+	authType: "sso" | "ciam";
+	tenantId?: string;
+	expiresAt: Date;
+	user: object;
+	projector?: (user: object) => unknown;
+	displayCookie?: DisplayCookieConfig;
+	trim?: DisplayCookieTrim;
+	attr: DisplayCookieAttributes;
+}): Promise<string[]>;
+type DiscoveredTenantCookie = {
+	tenantId: string;
+	tenantName?: string;
+};
+/**
+* Plans session-less tenant hints after an App-owned directory lookup. It never queries the
+* directory, session store, or another tenant runtime. The hints are browser-forgeable UI metadata.
+*/
+declare function planDiscoveredTenantCookies(input: {
+	cookieHeader: string | null | undefined;
+	tenants: DiscoveredTenantCookie[];
+	authType: "sso" | "ciam";
+	user: object;
+	projector?: (user: object) => unknown;
+	displayCookie?: DisplayCookieConfig;
+	attr: DisplayCookieAttributes;
+	now?: Date;
+}): string[];
 /**
 * What a login/logout `after*` hook may return:
 * - a `string` destination (validated against the same-origin safety floor),
@@ -2844,6 +2954,10 @@ type AfterLoginContext<
 > = {
 	request: Request;
 	context?: TCtx;
+	/** Current Ops policy for App-invoked discovered-tenant cookie planning. */
+	displayCookie?: DisplayCookieConfig;
+	/** Effective attributes shared by SDK session/display cookies. */
+	displayCookieAttributes: DisplayCookieAttributes;
 } & ({
 	ok: true;
 	user: TUser;
@@ -3056,6 +3170,11 @@ type SSOConfig<
 	cookiesSecure?: boolean;
 	cookiesSameSite?: "Strict" | "Lax";
 	/**
+	* Parent hostname shared by host-scoped tenants. Omit for host-only cookies.
+	* ConfigSource-only; must match the App's host routing `baseDomain`.
+	*/
+	cookiesDomain?: string;
+	/**
 	* Optional tenant/application id copied into server-side sessions.
 	* Server integrations default this from the Ionite instance id.
 	*/
@@ -3116,6 +3235,28 @@ type SSOConfig<
 	* @default 86400
 	*/
 	sessionWindowSeconds?: number;
+	/**
+	* Browser-readable display cookie beside the opaque session cookie. ConfigSource-only.
+	* Off unless `enabled` is true. The server never reads this cookie to authenticate.
+	*/
+	displayCookie?: DisplayCookieConfig;
+	/**
+	* What `GET ${basePath}/auth/user` returns. ConfigSource-only.
+	* `full` is the verified user, `display` is the {@link displayUser} projection, `off` is 404.
+	* @default 'full'
+	*/
+	userEndpoint?: UserEndpointPolicy;
+	/**
+	* Code-only projection of the full user into the display cookie and the `display` user endpoint.
+	* Omitted: name, email, and avatar. Cannot override a disabled {@link displayCookie}.
+	*/
+	displayUser?: (user: WorkforceUser) => unknown;
+	/**
+	* Code-only cap trim. Candidates are live sessions newest first, then discovered hints newest
+	* first. `max` and `maxDiscovered` are enforced independently after the hook; the session cookie
+	* being written is kept even if this hook omits it.
+	*/
+	trimDisplayCookies?: DisplayCookieTrim;
 } & SSOHandlerConfig;
 type StateCookie = {
 	state: string;
@@ -4152,6 +4293,33 @@ type CIAMConfig<
 	*/
 	cookiesSameSite?: "Strict" | "Lax";
 	/**
+	* Parent hostname shared by host-scoped tenants. Omit for host-only cookies.
+	* ConfigSource-only; must match the App's host routing `baseDomain`.
+	*/
+	cookiesDomain?: string;
+	/**
+	* Browser-readable display cookie beside the opaque customer session cookie. ConfigSource-only.
+	* Off unless `enabled` is true. The server never reads this cookie to authenticate.
+	*/
+	displayCookie?: DisplayCookieConfig;
+	/**
+	* What `GET ${basePath}/auth/customer` returns. ConfigSource-only.
+	* `full` is the verified customer, `display` is the {@link displayUser} projection, `off` is 404.
+	* @default 'full'
+	*/
+	userEndpoint?: UserEndpointPolicy;
+	/**
+	* Code-only projection of the full customer into the display cookie and the `display` customer
+	* endpoint. Omitted: name, email, and avatar. Cannot override a disabled {@link displayCookie}.
+	*/
+	displayUser?: (user: Customer) => unknown;
+	/**
+	* Code-only cap trim. Candidates are live sessions newest first, then discovered hints newest
+	* first. `max` and `maxDiscovered` are enforced independently after the hook; the session cookie
+	* being written is kept even if this hook omits it.
+	*/
+	trimDisplayCookies?: DisplayCookieTrim;
+	/**
 	* Optional tenant/application id copied into server-side sessions.
 	* Server integrations default this from the Ionite instance id.
 	*/
@@ -4224,6 +4392,8 @@ type CIAM<
 	resolveCustomer: (request: Request) => Promise<IdentityResolution<Customer>>;
 	logout: (request: Request) => Promise<Response>;
 	handler: (request: Request) => Promise<Response>;
+	/** `GET ${basePath}/auth/customer`, including the Ops `userEndpoint` policy and display-cookie sync. */
+	customerHandler: (request: Request) => Promise<Response>;
 	/**
 	* Returns the sanitized, ordered list of enabled customer-login providers
 	* for the given request origin (never includes secrets).
@@ -5154,6 +5324,10 @@ type Authz = {
 	entitlements: {
 		list(options?: ListOptions): Promise<ListResult<Entitlement>>;
 	};
+	/** Durable catalog authority, when wired. Used by explicit app-owned entitlement lifecycles. */
+	readonly catalogStore?: AccessCatalogStore;
+	/** Durable direct-grant authority, when wired. Used by explicit app-owned grant lifecycles. */
+	readonly accessStore?: AccessAssignmentStore;
 	/** The wired closure index powering `has*`, when the app provided one via stores. */
 	accessIndex?: AccessIndex;
 	has(subject: AccessRef<BaseUser>, targetType: OaaAccessTargetType, target: AccessRef<Group2 | Role2 | Permission>, resource: AccessRef<Resource> | undefined, subjectType: SubjectType): Promise<AuthzDecision>;
@@ -5462,6 +5636,45 @@ declare function generateLfvEd25519KeyPair(kid: string): Promise<{
 	privateJwk: LfvEd25519PrivateJwk;
 	publicJwks: LfvJwks;
 }>;
+type SigningKey = {
+	kid: string;
+	secret: string;
+};
+type SigningKeyRing = {
+	current(): SigningKey;
+	find(kid: string): SigningKey | undefined;
+};
+type StaticSigningKeyRingDocument = {
+	active: string;
+	keys: Record<string, string>;
+};
+/**
+* Builds an immutable key ring from a vault-secret document.
+*
+* Every replica must receive the same document. Rotate without invalidating live JWTs by adding the
+* next key, changing `active`, and retaining the previous key until the maximum token TTL has
+* elapsed. Serverless Apps should cache the parsed ring for a warm instance and replace it when
+* their secret subscription changes instead of reading the vault on every request.
+*/
+declare function staticSigningKeyRing(document: StaticSigningKeyRingDocument): SigningKeyRing;
+/**
+* Signs a short-lived HS256 JWT. Keep its payload to routing selectors and derive identity,
+* authorization, and current profile data from the authoritative session. Additional JWT state
+* shares the selector's rotation and expiry lifecycle and disappears when its verification key is
+* retired.
+*/
+declare function signCompactJwt(payload: Record<string, unknown>, ring: SigningKeyRing, options: {
+	ttlSeconds: number;
+}): Promise<string>;
+/**
+* Verifies an HS256 JWT against all non-retired keys addressable by `kid`.
+*
+* Malformed, expired, unknown-key, and invalid-signature tokens return `null`; operational errors
+* from a dynamic key ring still surface. WebCrypto performs the MAC verification without a
+* JavaScript-level timing-sensitive comparison. `iat`/`exp` are checked with a 60-second clock-skew
+* tolerance; size `ttlSeconds` for the artifact itself, not for that tolerance.
+*/
+declare function verifyCompactJwt(token: string, ring: SigningKeyRing): Promise<Record<string, unknown> | null>;
 type JWK = {
 	kty: string;
 	kid: string;
@@ -5746,4 +5959,59 @@ type VerifyUserOptions = {
 *   does not match, or the token is expired.
 */
 declare function verifyUser(jwt: string, options: VerifyUserOptions): Promise<WorkforceUser>;
-export { AccessRequestCreate, AccessRequestResult, AccessRequestSubmit, AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, AssertTrustedIdTokenClaimsOptions, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CACHE_BOUNDS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CIAM_PROVIDER_PRESETS, CatalogAdjacencyCache, CatalogView, CreateGroupOptions, CreateUserOptions, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMConfig, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundUserContext, IAMInboundUsersConfig, IAMUsersInbound, IAMValidators, InMemoryTenantStore, JWKS, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions, ResolvedCacheConfig, ResolvedJwksCacheConfig, ResolvedSessionCacheConfig, ResolvedSessionReadCacheConfig, SSO, SSOConfig, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimError, ScimListResponse, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, SessionDiscoveryOptions, SessionResponse, StateCookie, UsersInboundHandlerConfig, VerifyIdTokenOptions, VerifyLogoutTokenOptions, VerifyUserOptions, allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, assertSubjectTypeAssignable, assertTrustedIdTokenClaims, baseCustomerToScim, baseUserToScimUser, baseWorkloadToScim, blockDangerousUrls, buildAuthorizationUrl, buildLfvSigningInput, callback, captureRedirect, ciam, clearDiscoveryCache, clearJwksCache, collectReferencedDefinitions, configureJwksCache, defaultRedirectPolicies, discoverOidcEndpoints, discoverSessionRecords, discoverSessions, entitlementToScimGroup, exchangeAuthorizationCode, expandRoot, fetchUserInfo, generateAppleClientSecret, generateLfvEd25519KeyPair, getCachedVerificationKey, getCustomer, getDiscoveredSessionUsers, getJwks, getProviderPreset, getPublicKeyForKid, getPublicKeyFromJwks, getUser, getVerificationKeyForKid, has, hasAll2 as hasAll, hasAllScope, hasAny2 as hasAny, hasAnyScope, hasGroup2 as hasGroup, hasPermission2 as hasPermission, hasRole2 as hasRole, hasScope, iam, initiateLogin, isRedirectAllowed, listSsoClientIdsFromCookies, normalizeOidcIssuer, orderedEnabledProviders, parseLfvJwks, pkceChallengeFromVerifier, reconcileSubjectAccess, resolveAfterRedirect, resolveCacheConfig, resolveCapturedRedirect, resolveCiamProvider, resolveCustomer, resolveJwkForKid, resolveJwksCacheConfig, resolveProviderBranding, resolveRedirect, resolveSessionCacheConfig, resolveUser, sameOriginRedirectRules, sendTenantWebhook, setDiscoveryClock, setJwksClock, setJwksRetry, signLfvPayload, sso, stringifyLfvJwks, verifyIdToken, verifyLfvSignature, verifyLogoutToken, verifyUser, withSetCookies };
+declare const TENANT_OWNER_PERMISSION = "tenant.owner";
+/**
+* Catalog row for the shared owner permission. The `id` is fixed to {@link TENANT_OWNER_PERMISSION}
+* because `resolveTenantOwner`, `materializeTenantOwnerEntitlement`, and `getOwnedTenantIds` all
+* address that id — an app that renames it must also thread `ownerPermission` through every helper.
+* Presentation fields are overridable defaults.
+*/
+declare function tenantOwnerPermission(overrides?: Partial<Omit<Permission, "id">>): Permission;
+declare function tenantResourceId(tenantId: string): string;
+declare function tenantOwnerEntitlementId(tenantId: string): string;
+type TenantAccessSessionKind = "sso" | "customer" | "owner";
+type TenantAccessSession<Kind extends TenantAccessSessionKind = TenantAccessSessionKind> = {
+	id: string;
+	email?: string;
+	name?: string;
+	kind: Kind;
+};
+type TenantAccessDenialReason = "not_found" | "forbidden" | "unavailable" | "unauthenticated";
+type TenantAccessDenial = {
+	allow: false;
+	reason: TenantAccessDenialReason;
+	response(): Response;
+};
+type TenantAccessResult<Kind extends TenantAccessSessionKind = TenantAccessSessionKind> = {
+	allow: true;
+	session: TenantAccessSession<Kind>;
+} | TenantAccessDenial;
+type ResolveTenantSessionOptions = {
+	rootIon: Ionite;
+	tenantIon: Ionite | undefined;
+	tenantId: string;
+	permission?: string;
+	allowTenantCustomer?: boolean;
+	ownerPermission?: string;
+};
+type ResolveTenantOwnerOptions = {
+	rootIon: Ionite;
+	tenantId: string;
+	ownerPermission?: string;
+};
+declare function resolveTenantOwner(request: Request, options: ResolveTenantOwnerOptions): Promise<TenantAccessResult<"owner">>;
+declare function resolveTenantSession(request: Request, options: ResolveTenantSessionOptions & {
+	allowTenantCustomer: true;
+}): Promise<TenantAccessResult>;
+declare function resolveTenantSession(request: Request, options: ResolveTenantSessionOptions & {
+	allowTenantCustomer?: false;
+}): Promise<TenantAccessResult<"sso" | "owner">>;
+declare function getOwnedTenantIds(rootIon: Ionite, customerId: string): Promise<string[]>;
+type TenantAccessLoginUrlOptions = {
+	tenantIon: Ionite | undefined;
+	fallbackPath: string;
+	redirectTo: string;
+	tenantIonBasePath?: (tenantId: string) => string;
+};
+declare function tenantAccessLoginUrl(tenantId: string, options: TenantAccessLoginUrlOptions): string;
+export { AccessRequestCreate, AccessRequestResult, AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, AssertTrustedIdTokenClaimsOptions, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CACHE_BOUNDS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CIAM_PROVIDER_PRESETS, CatalogAdjacencyCache, CatalogView, CreateGroupOptions, CreateUserOptions, DiscoveredTenantCookie, DisplayCookieAttributes, DisplayCookieCandidate, DisplayCookieTrim, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMConfig, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundUserContext, IAMInboundUsersConfig, IAMUsersInbound, IAMValidators, InMemoryTenantStore, JWKS, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions, ResolveTenantOwnerOptions, ResolveTenantSessionOptions, ResolvedCacheConfig, ResolvedJwksCacheConfig, ResolvedSessionCacheConfig, ResolvedSessionReadCacheConfig, SSO, SSOConfig, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimError, ScimListResponse, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, SessionDiscoveryOptions, SessionResponse, SigningKey, SigningKeyRing, StateCookie, StaticSigningKeyRingDocument, TENANT_OWNER_PERMISSION, TenantAccessDenial, TenantAccessDenialReason, TenantAccessLoginUrlOptions, TenantAccessResult, TenantAccessSession, TenantAccessSessionKind, UsersInboundHandlerConfig, VerifyIdTokenOptions, VerifyLogoutTokenOptions, VerifyUserOptions, allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, assertSubjectTypeAssignable, assertTrustedIdTokenClaims, baseCustomerToScim, baseUserToScimUser, baseWorkloadToScim, blockDangerousUrls, buildAuthorizationUrl, buildLfvSigningInput, callback, captureRedirect, ciam, clearDiscoveryCache, clearJwksCache, collectReferencedDefinitions, configureJwksCache, defaultRedirectPolicies, discoverOidcEndpoints, discoverSessionRecords, discoverSessions, entitlementToScimGroup, exchangeAuthorizationCode, expandRoot, fetchUserInfo, formatDisplayClearCookie, formatDisplaySetCookie, generateAppleClientSecret, generateLfvEd25519KeyPair, getCachedVerificationKey, getCustomer, getDiscoveredSessionUsers, getJwks, getOwnedTenantIds, getProviderPreset, getPublicKeyForKid, getPublicKeyFromJwks, getUser, getVerificationKeyForKid, has, hasAll2 as hasAll, hasAllScope, hasAny2 as hasAny, hasAnyScope, hasGroup2 as hasGroup, hasPermission2 as hasPermission, hasRole2 as hasRole, hasScope, iam, initiateLogin, isRedirectAllowed, listSsoClientIdsFromCookies, normalizeOidcIssuer, orderedEnabledProviders, parseLfvJwks, pkceChallengeFromVerifier, planDiscoveredTenantCookies, planDisplayCookieClear, planDisplayCookieHeaders, reconcileSubjectAccess, resolveAfterRedirect, resolveCacheConfig, resolveCapturedRedirect, resolveCiamProvider, resolveCustomer, resolveJwkForKid, resolveJwksCacheConfig, resolveProviderBranding, resolveRedirect, resolveSessionCacheConfig, resolveTenantOwner, resolveTenantSession, resolveUser, sameOriginRedirectRules, selectDisplayCookies, sendTenantWebhook, setDiscoveryClock, setJwksClock, setJwksRetry, signCompactJwt, signLfvPayload, sso, staticSigningKeyRing, stringifyLfvJwks, tenantAccessLoginUrl, tenantOwnerEntitlementId, tenantOwnerPermission, tenantResourceId, verifyCompactJwt, verifyIdToken, verifyLfvSignature, verifyLogoutToken, verifyUser, withSetCookies };