@ionite/core 0.0.24-beta.20260928.18 → 0.0.24-beta.20260930.19

package/dist/index.d.ts

@@ -16,212 +16,6 @@ declare const KNOWN_WORKLOAD_KEYS: readonly ["id", "clientId", "displayName", "d
 declare function customAttributes(value: object, knownKeys: readonly PropertyKey[]): Record<string, unknown> | undefined;
 import { StandardSchemaV1 as StandardSchemaV19 } from "@standard-schema/spec";
 import { StandardSchemaV1 as StandardSchemaV18 } from "@standard-schema/spec";
-/**
-* Third-party CIAM provider presets and claim mapping.
-*
-* Defines the built-in provider adapters used by the CIAM module for customer
-* login. Each preset supplies default OIDC/OAuth2 endpoints, scope, branding,
-* and a claim mapper that normalizes provider claims into a candidate customer.
-* The application's `CustomerStore` remains the system of record: the SDK only
-* extracts standard claims and hands a candidate to `lookup`/`upsert`.
-*/
-/** Built-in provider types. `oidc` is a generic OIDC provider; `magic-link` is the passwordless flow. */
-type CIAMProviderType = "oidc" | "google" | "github" | "microsoft" | "apple" | "magic-link";
-/** Branding colors for rendering a provider button in light and dark themes. */
-type CIAMProviderColors = {
-	/** Background/brand color for light theme (hex or CSS color). */
-	light: string;
-	/** Background/brand color for dark theme (hex or CSS color). */
-	dark: string;
-	/** Optional secondary/accent color. */
-	secondary?: string;
-};
-/** Operator-supplied branding so the UI can render a provider list without hardcoding. */
-type CIAMProviderBranding = {
-	/** Human-readable name shown on the login button (e.g. "Google"). */
-	displayName: string;
-	/** External icon URL (typically an SVG/PNG hosted on a CDN). */
-	iconUrl?: string;
-	/** Light/dark brand colors. */
-	colors?: CIAMProviderColors;
-	/** Optional provider info/marketing URL. */
-	url?: string;
-};
-/**
-* A single CIAM provider declaration. OIDC/OAuth2 endpoint and credential
-* fields come from the ConfigSource (never application code).
-*/
-type CIAMProviderConfig = {
-	/** Provider adapter type. Selects defaults and claim mapping. */
-	type: CIAMProviderType;
-	/** Whether this provider is enabled. Defaults to true when omitted. */
-	enabled?: boolean;
-	/** Recommended display order (ascending). Ties broken by declaration order. */
-	order?: number;
-	/** UI branding metadata. */
-	branding?: CIAMProviderBranding;
-	/** OIDC issuer/authority (used for discovery when explicit endpoints are omitted). */
-	authority?: string;
-	/** Authorization endpoint (overrides preset). */
-	authorizationUrl?: string;
-	/** Token endpoint (overrides preset). */
-	tokenUrl?: string;
-	/** JWKS endpoint for ID token verification (overrides preset). */
-	jwksUri?: string;
-	/** OAuth2 UserInfo endpoint for providers without an ID token (e.g. GitHub). */
-	userInfoUrl?: string;
-	/** OAuth2 client id (ConfigSource-only). */
-	clientId?: string;
-	/** OAuth2 client secret (ConfigSource-only). */
-	clientSecret?: string;
-	/** Requested scope (overrides preset). */
-	scope?: string;
-	/** Apple: team id for client-secret generation. */
-	teamId?: string;
-	/** Apple: key id for client-secret generation. */
-	keyId?: string;
-	/** Apple: PKCS#8 PEM private key for client-secret generation. */
-	privateKey?: string;
-};
-/** Sanitized provider entry returned by the discovery endpoint for the UI. */
-type CIAMProviderDescriptor = {
-	/** Provider key (matches the RemoteConfig map key); used as `?provider=`. */
-	name: string;
-	type: CIAMProviderType;
-	displayName: string;
-	/** SDK-derived login URL to navigate to (begins the flow). */
-	loginUrl: string;
-	iconUrl?: string;
-	colors?: CIAMProviderColors;
-	url?: string;
-};
-/**
-* Light display cookies (`${cookiesPrefix}.profile`).
-*
-* The envelope is SDK-owned. App code supplies only `user`. The cookie is not an
-* authentication input: the server never reads it to resolve a session, and the browser
-* may forge it. `expiresAt` is display metadata so a client can order entries without a
-* round trip; authoritative expiry is the peer `${cookiesPrefix}.session` record.
-*/
-declare const DISPLAY_COOKIE_SUFFIX = ".profile";
-declare const DISPLAY_COOKIE_VERSION = 1;
-declare const DEFAULT_DISPLAY_COOKIE_MAX = 10;
-declare const DEFAULT_DISCOVERED_COOKIE_MAX = 10;
-declare const DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS: number;
-declare const DISCOVERED_COOKIE_PREFIX = "ion.discovered";
-type DisplayCookieConfig = {
-	/**
-	* When true, the SDK writes a non-HttpOnly display cookie beside the opaque session cookie.
-	* ConfigSource-only. Default false.
-	*/
-	enabled?: boolean;
-	/**
-	* How many display cookies a single response may leave on the browser, newest session window
-	* first. ConfigSource-only. Values below 1 fall back to {@link DEFAULT_DISPLAY_COOKIE_MAX}.
-	* @default 10
-	*/
-	max?: number;
-	/**
-	* Session-less tenant hints written by an App after an explicit directory lookup.
-	* ConfigSource-only and off unless `enabled` is true.
-	*/
-	discovered?: DiscoveredDisplayCookieConfig;
-};
-type DiscoveredDisplayCookieConfig = {
-	enabled?: boolean;
-	/** Browser hint lifetime. This is not a session expiry. @default 14400 */
-	ttlSeconds?: number;
-	/** Independent cap; discovered hints never displace live-session entries. @default 10 */
-	max?: number;
-};
-/** What `${basePath}/auth/user` and `${basePath}/auth/customer` return. ConfigSource-only. */
-type UserEndpointPolicy = "full" | "display" | "off";
-type DisplayUser = Record<string, string | number | boolean | null>;
-type DisplayAuthType = "sso" | "ciam";
-type DisplayCookieEnvelope = {
-	v: typeof DISPLAY_COOKIE_VERSION;
-	/**
-	* Session envelopes omit this field (absent means `'session'`) so the wire format stays identical
-	* to cookies written before discovered hints existed; only discovered hints set it explicitly.
-	* Readers must treat `undefined` as `'session'`.
-	*/
-	kind?: "session" | "discovered";
-	tenantId?: string;
-	authType: DisplayAuthType;
-	/** ISO timestamp copied from the session window at write time. Display only. */
-	expiresAt: string;
-	user: DisplayUser;
-	tenantName?: string;
-};
-type DisplayIdentity = {
-	name?: string;
-	email?: string;
-	avatar?: string;
-};
-declare function resolveDisplayCookieMax(max: number | undefined): number;
-declare function resolveDiscoveredCookieMax(max: number | undefined): number;
-declare function resolveDiscoveredCookieTtlSeconds(ttlSeconds: number | undefined): number;
-declare function defaultDisplayUser(identity: DisplayIdentity): DisplayUser;
-/** Drop non-primitives and auth-bearing keys. Display cookies carry UI fields only. */
-declare function sanitizeDisplayUser(value: unknown): DisplayUser;
-/**
-* AppDev projection runs on the full user (including custom attributes). When omitted, or when it
-* throws, the cookie carries name, email, and avatar only. Forbidden and non-primitive fields are
-* dropped either way — a projector cannot put a session id or token into the cookie.
-*/
-declare function projectDisplayUser<TUser extends object>(user: TUser, projector?: (user: TUser) => unknown): DisplayUser;
-declare function encodeDisplayCookie(envelope: DisplayCookieEnvelope): string;
-declare function decodeDisplayCookie(raw: string): DisplayCookieEnvelope | undefined;
-type ParsedDisplayCookie = {
-	name: string;
-	prefix: string;
-	envelope: DisplayCookieEnvelope;
-};
-declare function readDisplayCookies(cookieHeader: string | null | undefined): ParsedDisplayCookie[];
-/** Client ordering: newest session window first. Invalid timestamps sort last. */
-declare function compareDisplayExpiryDesc(a: string | undefined, b: string | undefined): number;
-declare function profileCookieName(cookiesPrefix: string): string;
-declare function discoveredProfileCookieName(tenantId: string): string;
-/**
-* Minimal logger interface compatible with common structured logging patterns.
-*/
-interface Logger {
-	trace(message?: unknown, ...optionalParams: unknown[]): void;
-	debug(message?: unknown, ...optionalParams: unknown[]): void;
-	info(message?: unknown, ...optionalParams: unknown[]): void;
-	warn(message?: unknown, ...optionalParams: unknown[]): void;
-	error(message?: unknown, ...optionalParams: unknown[]): void;
-}
-/**
-* Renders a structured logger call as one greppable line while leaving the source fields separate
-* for telemetry exporters.
-*/
-declare function formatLogLine(level: keyof Logger, message: unknown, optionalParams?: unknown[], timestamp?: Date): string;
-/**
-* No-op implementation — does nothing for any log level
-*/
-declare const silentLogger: Logger;
-/**
-* Default logger used until an ionite instance is configured with
-* an OpenTelemetry-backed logger or an application-provided logger.
-*/
-declare const defaultLogger: Logger;
-/**
-* Logger that logs messages debug, info, warn, and error to the console.
-*/
-declare const debugLogger: Logger;
-/**
-* Logger that logs messages info, warn, and error to the console.
-*/
-declare const infoLogger: Logger;
-/**
-* Logger that logs messages warn and error to the console.
-*/
-declare const warnLogger: Logger;
-/**
-* Human-readable single-line console logger for local application output.
-*/
-declare const prettyLogger: Logger;
 /** Synchronous, in-memory read surface for one code catalog entity kind. */
 type CodeCatalogNamespace<TEntity> = {
 	get(id: string): TEntity | undefined;
@@ -300,7 +94,6 @@ declare function deprecateRetiredCodeCatalogRows(code: CodeCatalog | undefined,
 * visible. Returns undefined when neither source is wired.
 */
 declare function unionCatalogRead(code: CodeCatalog | undefined, store: AccessCatalogStore | undefined): AccessCatalogStore | undefined;
-import { StandardSchemaV1 as StandardSchemaV15 } from "@standard-schema/spec";
 /**
 * Resolve an access subject/target/resource reference (a string id or an object carrying one) to its
 * canonical, trimmed string id. This is the single id-resolution rule shared across the authz stack
@@ -315,495 +108,106 @@ declare function accessRefId(value: unknown): string;
 * default, or `applyToApplication`) collapses to the `app` scope key.
 */
 declare function accessRootId(change: AccessChange): string;
-type ChangeListener = () => void;
-/**
-* Reactive source/adapter contract. Implemented by config-source-backed adapters
-* (for example `SecretsSource`) to advertise change subscription and source liveness.
-* `isAvailable()` here is an adapter liveness hook and is intentionally distinct from
-* module readiness (`ModuleReadiness.isReady()` / `ready()`).
-*/
-type ReactiveHandle = {
-	beforeChange?(listener: ChangeListener): () => void;
-	afterChange?(listener: ChangeListener): () => void;
-	isAvailable?(): boolean;
-};
 /**
-* Readiness contract for reactive module/service handles whose usability depends on
-* RemoteConfig that can arrive or change at runtime (for example `ion.secrets`,
-* `ion.workload`, `ion.otel`, `ion.authz.oaa`).
+* ConfigSource-only block that lets an issuing IdP's token claims satisfy `has*` checks.
+* Placed independently on `sso`, each CIAM provider, and each incoming workload IdP.
+* Absent means that issuer's claims never satisfy entitlements.
 *
-* - `isReady()` is a synchronous check; use it in request handlers and health probes and
-*   return 503 (or branch) when false instead of blocking.
-* - `ready(timeout?)` resolves once the handle first becomes usable; use it at startup or
-*   as a feature gate. With no timeout it waits indefinitely; with `timeout > 0` it rejects
-*   after that many milliseconds.
+* Derived rows are session-scoped for users and customers (expanded onto the session at login
+* and refresh) and per-request for workloads. They are never written to the access stores.
 */
-type ModuleReadiness = {
-	beforeChange?(listener: ChangeListener): () => void;
-	afterChange?(listener: ChangeListener): () => void;
-	isReady?(): boolean;
-	ready?(timeout?: number): Promise<void>;
+type ClaimsAsEntitlements = {
+	/**
+	* Claim names to read. A dotted path addresses a nested claim (`realm_access.roles`).
+	* `scope` is space-delimited; every other string claim is one value; arrays contribute each string.
+	* Required and non-empty.
+	*/
+	claims: string[];
+	/**
+	* Expand a matched catalog role or group into the permissions it confers.
+	* Default false: a claim value matches only the catalog id it names.
+	*/
+	expand?: boolean;
+	/**
+	* Let catalog-bound resources on expanded rows satisfy resource-scoped checks.
+	* Default false. Ignored unless `expand` is true: a claim string cannot name a resource.
+	*/
+	resources?: boolean;
+};
+/** One effective entitlement derived from a token claim. Not a stored grant. */
+type DerivedEntitlement = {
+	targetType: OaaAccessTargetType;
+	target: string;
+	/** Set only when the plane opted into `resources` and the catalog row binds this resource. */
+	resource?: string;
+	/** Claim name the value was read from. */
+	claim: string;
+	/** Expansion root id when the row came from catalog expansion. Absent for a direct id match. */
+	root?: string;
+};
+/** Secret-free projection of a configured claims block, including whether the App can persist it. */
+type ClaimsAsEntitlementsDescription = {
+	claims: string[];
+	expand: boolean;
+	resources: boolean;
+	/**
+	* User and customer planes: the session store declares it persists `Session.entitlements`.
+	* Workload plane: always true (nothing is stored).
+	*/
+	capable: boolean;
 };
 /**
-* Canonical ionite module names used by the holistic readiness report and the
-* `requireReady([...])` helper. These are the config-driven module handles whose readiness can be
-* composed; `ion.isReady()` itself stays the narrow "config applied" signal and is NOT one of these.
+* Shared minimal identity fields used to build both the workforce user
+* record (`BaseUser`) and the CIAM customer record (`BaseCustomer`), as well
+* as the authenticated session types (`WorkforceUser`, `Customer`).
 *
-* IAM-delta egress is intentionally NOT a member. Delta patch-back is best-effort and non-fatal (a
-* failed push only logs `degraded` and is reconciled by a later full sync — the Batch 7 drift-signal
-* contract), so folding it into `iam` readiness would let a delta-target outage make
-* `requireReady(['iam'])` false and take the app out of rotation for a signal that is designed not to
-* block. Apps that DO treat delta as a hard dependency can gate on `ion.iam.delta.isReady()` /
-* `ion.iam.delta.ready()` explicitly instead.
+* This is an internal structural base and is intentionally not part of the
+* public API surface; consumers extend the `BaseUser` Zod/Valibot schema
+* instead.
 */
-type ModuleName = "sso" | "ciam" | "iam" | "workload" | "otel" | "secrets" | "kms" | "authz" | "tm";
-/** Per-module readiness snapshot in {@link ReadinessReport}. */
-type ModuleReadinessState = {
-	/** Whether the module is active (present/requested) in the effective config. Inactive modules never block readiness. */
-	active: boolean;
-	/** Synchronous readiness of the module right now (mirrors the module's own `isReady()`). */
-	ready: boolean;
-	/** Human-readable explanation when the module is `active` but not `ready`. */
-	reason?: string;
-};
-/**
-* Holistic, read-only readiness snapshot for an ionite instance. Returned by
-* `ion.readiness()` and used by the built-in `${basePath}/readyz` endpoint. This is composition
-* DATA, not a request gate: applications combine it (via `ion.requireReady([...])`) with their own
-* non-ionite dependency checks to build their health endpoints.
-*/
-type ReadinessReport = {
-	/** True when config has been applied (`applied`) and every ACTIVE module is ready. */
-	ok: boolean;
-	/** Whether RemoteConfig has been applied at least once (mirrors `ion.isReady()`). */
-	applied: boolean;
-	/** Per-module readiness keyed by {@link ModuleName}. */
-	modules: Record<ModuleName, ModuleReadinessState>;
-	/** Most recent config-application outcome (last applied time and last error, if any). */
-	config: ConfigApplyStatus;
-};
-/** Result of `ion.requireReady(names)`: a synchronous, declarative readiness gate over selected modules. */
-type RequireReadyResult = {
-	/** True when config is applied and every requested module is ready. */
-	ok: boolean;
-	/** The requested modules that are not ready, with reasons when available. */
-	notReady: Array<{
-		name: ModuleName;
-		reason?: string;
-	}>;
-};
-type CapabilityKey = "sso.login" | "sso.jit" | "sso.logout" | "sso.back_channel_logout" | "ciam.magic_link" | "ciam.oidc_login" | "ciam.customer" | "ciam.logout" | "iam.users" | "iam.groups" | "iam.workloads" | "iam.customers" | "workload.incoming" | "workload.outgoing" | "authz.oaa" | "tm.integration";
-type CapabilityEndpointUrls = {
-	readyzUrl: string;
-	capabilitiezUrl: string;
-	sso: {
-		loginUrl: string;
-		userUrl: string;
-		logoutUrl: string;
-		logoutBackChannelUrl: string;
-		refreshUrl: string;
-		callbackUrl: string;
-	};
-	workload: {
-		validateUrl: string;
-		jwksUrl: string;
-	};
-	iam: {
-		basePath: string;
-		usersUrl: string;
-		groupsUrl: string;
-		workloadsUrl: string;
-		customersUrl: string;
-	};
-	ciam: {
-		magicLinkUrl: string;
-		magicLinkLoginUrl: string;
-		customerUrl: string;
-		customerLoginUrl: string;
-		customerCallbackUrl: string;
-		customerProvidersUrl: string;
-		logoutUrl: string;
-	};
-};
-type CapabilityState = {
-	module: ModuleName;
-	active: boolean;
-	ready: boolean;
-	testable: boolean;
-	urls?: string[];
-	reason?: string;
-};
-type CapabilitiezManifest = {
-	sdk: {
-		/** Runtime @ionite/server version serving this manifest. */
-		version: string;
-		/** Version of the stable capability/test-unit vocabulary. */
-		catalogVersion: number;
-	};
-	basePath: string;
-	urls: CapabilityEndpointUrls;
-	modules: Record<ModuleName, ModuleReadinessState>;
-	capabilities: Record<CapabilityKey, CapabilityState>;
+interface BaseUserFields {
 	/**
-	* True when FrameworkConfig wired a live LFV callback transport. Boolean only — the transport
-	* object, Redis URL, and credentials are never exposed.
+	* Unique identifier for the user
 	*/
-	lfvCallbackTransport: boolean;
-};
-type OtelSignalName = "traces" | "metrics" | "logs";
-type OtelProtocol = "http/protobuf" | "http/json";
-type OtelProviderType = "otlp" | "grafana-lgtm" | "datadog" | "splunk" | "elastic";
-type OtelLogLevel = "trace" | "debug" | "info" | "warn" | "error";
-type OtelLevels = Partial<Record<OtelLogLevel, boolean>>;
-/** Local console mirror policy: disable it or set its minimum emitted severity. */
-type OtelConsoleMode = "off" | OtelLogLevel;
-type OtelAttributeValue = string | number | boolean | string[] | number[] | boolean[];
-type OtelAttributes = Record<string, OtelAttributeValue>;
-type OtelSignalConfig = {
-	/** Per-signal OTLP endpoint. When omitted, the module appends /v1/{signal} to `endpoint`. */
-	endpoint?: string;
-	headers?: Record<string, string>;
-	timeoutMillis?: number;
-	concurrencyLimit?: number;
-};
-type OtelMetricsSignalConfig = OtelSignalConfig & {
-	exportIntervalMillis?: number;
-	exportTimeoutMillis?: number;
-};
-type OtelOAuthClientCredentialsConfig = {
-	tokenUrl: string;
-	clientId: string;
-	clientSecret: string;
-	scope?: string;
-	audience?: string;
-	headers?: Record<string, string>;
-};
-type OtelLogRecord = {
-	severityNumber?: number;
-	severityText?: string;
-	body?: unknown;
-	attributes?: Record<string, unknown>;
-};
+	id?: string;
+	/**
+	* REQUIRED. Unique identifier for login
+	*/
+	userName: string;
+	/**
+	* REQUIRED. Simple display name
+	*/
+	name: string;
+	/**
+	* REQUIRED. Primary email address
+	*/
+	email: string;
+	/**
+	* URL to user's avatar/profile picture
+	*/
+	avatar?: string;
+	/**
+	* User type (e.g., "employee", "contractor", "customer").
+	* Shared by SSO/CIAM and enterprise/SCIM user representations.
+	*/
+	userType?: string;
+}
 /**
-* OpenTelemetry config supplied by ConfigSource/RemoteConfig.
-* Keep environment-specific URLs and credentials here, not in FrameworkConfig.
+* Shared types for paginated list operations across stores.
+*
+* List methods return a ListResult with total, count, items, size, page, and pages.
+* Options accept optional start (0-based), limit (page size), and filter.
+*
+* ORDERING CONTRACT: `list()` does NOT accept a caller-specified sort. Every store MUST return items
+* in a stable, deterministic order (recommended: primary key ascending) so that offset pagination is
+* coherent across pages — page N+1 must continue exactly where page N ended for an unchanged dataset.
+* UI-style arbitrary sorting is the app's concern (sort the returned page, or push ORDER BY into a
+* SQL/search-backed custom store); the SDK only guarantees deterministic paging.
 */
-type OtelConfig = {
-	type?: OtelProviderType;
-	name: string;
-	endpoint?: string;
-	protocol?: OtelProtocol;
-	headers?: Record<string, string>;
-	apiKey?: string;
-	/** Name of a `RemoteConfig.kms` key pool used for exporter authentication. */
-	apiKeyPool?: string;
-	apiKeyHeader?: string;
-	oauth?: OtelOAuthClientCredentialsConfig;
-	version?: string;
-	deploymentEnvironment?: string;
-	resourceAttributes?: OtelAttributes;
-	levels?: OtelLevels;
-	/** `'off'` exports only to OTel; a level dual-emits at or above that severity. Defaults to `'info'`. */
-	console?: OtelConsoleMode;
-	traces?: boolean | OtelSignalConfig;
-	metrics?: boolean | OtelMetricsSignalConfig;
-	logs?: boolean | OtelSignalConfig;
-};
 /**
-* OpenTelemetry app/runtime wiring supplied by code.
-* Instrumentation instances and callbacks live here because they are framework-specific code.
-*/
-type FrameworkOtelConfig = {
-	levels?: OtelLevels;
-	instrument?: unknown[];
-	/** Optional app-owned destination/renderer for records admitted by `RemoteConfig.otel.console`. */
-	console?: (record: OtelLogRecord) => void;
-	spanProcessors?: unknown[];
-	metricReaders?: unknown[];
-	logRecordProcessors?: unknown[];
-	sampler?: unknown;
-	textMapPropagator?: unknown;
-	contextManager?: unknown;
-	configure?: (options: Record<string, unknown>) => Record<string, unknown> | void;
-};
-type Otel = {
-	/** Secret-free, JSON-serializable configuration and readiness summary. */
-	describe(): OtelDescription;
-	beforeChange(listener: ChangeListener): () => void;
-	afterChange(listener: ChangeListener): () => void;
-	isReady(): boolean;
-	ready(timeout?: number): Promise<void>;
-	logger: Logger;
-	forceFlush(): Promise<void>;
-	shutdown(): Promise<void>;
-};
-type ModuleDescriptionBase<TModule extends ModuleName> = {
-	module: TModule;
-	active: boolean;
-	ready: boolean;
-};
-type CookieDescription = {
-	prefix?: string;
-	path?: string;
-	secure?: boolean;
-	sameSite?: "Strict" | "Lax";
-	domain?: string;
-};
-type SsoDescription = ModuleDescriptionBase<"sso"> & {
-	authority?: string;
-	tokenUrl?: string;
-	authorizationUrl?: string;
-	clientId?: string;
-	redirectUri?: string;
-	responseType?: "code";
-	scope?: string;
-	silentRedirectUri?: string;
-	jwksUri?: string;
-	endSessionEndpoint?: string;
-	revocationEndpoint?: string;
-	cookies: CookieDescription;
-	loginStateTtl?: number;
-	rotationGraceSeconds?: number;
-	sessionWindowSeconds?: number;
-	displayCookie?: DisplayCookieConfig;
-	jit: {
-		enabled: boolean;
-		userStore: boolean;
-	};
-	sessionStore: boolean;
-	urls: Partial<CapabilityEndpointUrls["sso"]>;
-};
-type CiamProviderDescription = {
-	name: string;
-	type: CIAMProviderType;
-	enabled: boolean;
-	order?: number;
-	branding?: CIAMProviderBranding;
-	authority?: string;
-	authorizationUrl?: string;
-	tokenUrl?: string;
-	jwksUri?: string;
-	userInfoUrl?: string;
-	clientId?: string;
-	scope?: string;
-	loginUrl: string;
-};
-type CiamDescription = ModuleDescriptionBase<"ciam"> & {
-	magicLinkTtl?: number;
-	loginStateTtl?: number;
-	sessionTtl?: number;
-	cookies: CookieDescription;
-	displayCookie?: DisplayCookieConfig;
-	jit: {
-		enabled: boolean;
-		customerStore: boolean;
-	};
-	sessionStore: boolean;
-	magicLinkStore: boolean;
-	providers: CiamProviderDescription[];
-	urls: Partial<CapabilityEndpointUrls["ciam"]>;
-};
-type IamPrincipalDescription = {
-	enabled: boolean;
-	assignment: "app" | "iam" | "iam-request";
-	delta?: "patch";
-	storeWired: boolean;
-};
-type IamDescription = ModuleDescriptionBase<"iam"> & {
-	url?: string;
-	deltaAudience?: string;
-	users: IamPrincipalDescription;
-	workloads: IamPrincipalDescription;
-	customers: IamPrincipalDescription;
-	groups: {
-		enabled: boolean;
-		catalogWired: boolean;
-	};
-	urls: Partial<CapabilityEndpointUrls["iam"]>;
-};
-type WorkloadTrustedIdpDescription = {
-	issuer: string;
-	jwksUri: string;
-	audience: string | string[];
-	scopesAsEntitlements?: boolean;
-};
-type WorkloadClientDescription = {
-	name: string;
-	ready: boolean;
-	clientId?: string;
-	workloadId?: string;
-	idpTokenUrl?: string;
-	scope?: string;
-	audience?: string;
-	authMethod: "client_secret" | "private_key_jwt" | "server_only";
-};
-type WorkloadDescription = ModuleDescriptionBase<"workload"> & {
-	incoming: {
-		trustedIdps: WorkloadTrustedIdpDescription[];
-	};
-	outgoing: WorkloadClientDescription[];
-	urls: Partial<CapabilityEndpointUrls["workload"]>;
-};
-type SecretsSourceDescription = {
-	name: string;
-	type: "dev" | "gcp" | "vault" | "aws" | "azure";
-	ready: boolean;
-	url?: string;
-	clientId?: string;
-	authMethod?: string;
-};
-type SecretsDescription = ModuleDescriptionBase<"secrets"> & {
-	sources: SecretsSourceDescription[];
-};
-type KmsPoolDescription = {
-	name: string;
-	source?: string;
-	path: string;
-	ready: boolean;
-};
-type KmsDescription = ModuleDescriptionBase<"kms"> & {
-	pools: KmsPoolDescription[];
-};
-type OtelSignalDescription = {
-	enabled: boolean;
-	endpoint?: string;
-	timeoutMillis?: number;
-	concurrencyLimit?: number;
-	exportIntervalMillis?: number;
-	exportTimeoutMillis?: number;
-};
-type OtelDescription = ModuleDescriptionBase<"otel"> & {
-	type?: OtelProviderType;
-	name?: string;
-	endpoint?: string;
-	protocol?: OtelProtocol;
-	apiKeyPool?: string;
-	apiKeyHeader?: string;
-	oauth?: {
-		tokenUrl: string;
-		clientId: string;
-		scope?: string;
-		audience?: string;
-	};
-	version?: string;
-	deploymentEnvironment?: string;
-	resourceAttributes?: OtelAttributes;
-	levels?: OtelLevels;
-	console?: OtelConsoleMode;
-	signals: {
-		traces: OtelSignalDescription;
-		metrics: OtelSignalDescription;
-		logs: OtelSignalDescription;
-	};
-};
-type OaaDescription = {
-	ready: boolean;
-	url?: string;
-	providerId?: string;
-	datasourceId?: string;
-	applicationName?: string;
-	applicationType?: string;
-	population?: Record<string, string>;
-	fullSync: boolean;
-};
-type AuthzDescription = ModuleDescriptionBase<"authz"> & {
-	scopesAsEntitlements: boolean;
-	trustedProvisioningClients: Array<{
-		issuer: string;
-		audience: string | string[];
-		clientId: string;
-		permissions: string[];
-	}>;
-	oaa?: OaaDescription;
-	stores: {
-		accessStore: boolean;
-		accessIndex: boolean;
-		catalogStore: boolean;
-		resources: boolean;
-	};
-};
-type TmDescription = ModuleDescriptionBase<"tm"> & {
-	enabled: boolean;
-	integrator?: {
-		id: string;
-		name?: string;
-		url: string;
-		issuer: string;
-		jwksUri: string;
-		audience: string;
-		clientId: string;
-	};
-	consentTtlSeconds?: number;
-	maxRedeemAttempts?: number;
-};
-type ModuleDescription = SsoDescription | CiamDescription | IamDescription | WorkloadDescription | SecretsDescription | KmsDescription | OtelDescription | AuthzDescription | TmDescription;
-type IoniteDescription = {
-	id?: string;
-	sdk: {
-		version: string;
-		catalogVersion: number;
-	};
-	basePath: string;
-	urls: CapabilityEndpointUrls;
-	ok: boolean;
-	applied: boolean;
-	config: ConfigApplyStatus;
-	modules: Record<ModuleName, ModuleReadinessState & {
-		description?: ModuleDescription;
-	}>;
-};
-/**
-* Shared minimal identity fields used to build both the workforce user
-* record (`BaseUser`) and the CIAM customer record (`BaseCustomer`), as well
-* as the authenticated session types (`WorkforceUser`, `Customer`).
-*
-* This is an internal structural base and is intentionally not part of the
-* public API surface; consumers extend the `BaseUser` Zod/Valibot schema
-* instead.
-*/
-interface BaseUserFields {
-	/**
-	* Unique identifier for the user
-	*/
-	id?: string;
-	/**
-	* REQUIRED. Unique identifier for login
-	*/
-	userName: string;
-	/**
-	* REQUIRED. Simple display name
-	*/
-	name: string;
-	/**
-	* REQUIRED. Primary email address
-	*/
-	email: string;
-	/**
-	* URL to user's avatar/profile picture
-	*/
-	avatar?: string;
-	/**
-	* User type (e.g., "employee", "contractor", "customer").
-	* Shared by SSO/CIAM and enterprise/SCIM user representations.
-	*/
-	userType?: string;
-}
-/**
-* Shared types for paginated list operations across stores.
-*
-* List methods return a ListResult with total, count, items, size, page, and pages.
-* Options accept optional start (0-based), limit (page size), and filter.
-*
-* ORDERING CONTRACT: `list()` does NOT accept a caller-specified sort. Every store MUST return items
-* in a stable, deterministic order (recommended: primary key ascending) so that offset pagination is
-* coherent across pages — page N+1 must continue exactly where page N ended for an unchanged dataset.
-* UI-style arbitrary sorting is the app's concern (sort the returned page, or push ORDER BY into a
-* SQL/search-backed custom store); the SDK only guarantees deterministic paging.
-*/
-/**
-* Result of a paginated list operation.
-*
-* @template T - Item type (e.g. Group, BaseUser, BaseTenant)
+* Result of a paginated list operation.
+*
+* @template T - Item type (e.g. Group, BaseUser, BaseTenant)
 */
 interface ListResult<T> {
 	/** Total number of records matching (before pagination). */
@@ -1567,11 +971,10 @@ type WorkloadIdentity = {
 	/** Granted OAuth scopes (space-delimited). */
 	scope?: string;
 	/**
-	* Whether the trusted IdP that validated this token opts into honoring its OAuth `scope` claim as
-	* entitlements (per-IdP intent, resolved at validation time). Consumed by the request-level `has*`
-	* helpers; `undefined` falls back to the global `RemoteConfig.authz.scopesAsEntitlements`.
+	* Claim-derived entitlements for this request. Present only when the matched incoming IdP
+	* configured `claimsAsEntitlements`. Never persisted.
 	*/
-	scopesAsEntitlements?: boolean;
+	derivedEntitlements?: DerivedEntitlement[];
 	/**
 	* Enterprise Controlled ID for this workload (`ecid:<realm>:<opaque>`), when carried on the token
 	* `ecid` claim or enriched from a wired `WorkloadIdentityStore`. A workload is its own governance
@@ -1953,165 +1356,823 @@ type BaseWorkloadIdentitySdkFields = {
 	/** Optional free-form metadata bag. */
 	metadata?: Record<string, unknown>;
 };
-type BaseWorkloadIdentityReservedKey = keyof BaseWorkloadIdentitySdkFields;
-type BaseWorkloadIdentity<TExtended = object> = BaseWorkloadIdentitySdkFields & NoReserved<TExtended, BaseWorkloadIdentityReservedKey, "id">;
-/**
-* Abstract interface for workload identity storage backends. Implement to back the registry with
-* in-memory, Redis, or a database. Mirrors {@link UserStore}.
-*
-* @template TExtended - Type-safe custom data that consumers can add to workload identities.
-*/
-interface WorkloadIdentityStore<TExtended = object> {
-	/**
-	* Retrieve a workload identity by its unique id.
-	*
-	* @param id - The workload's unique identifier.
-	* @returns The workload identity if found, undefined otherwise.
-	*/
-	get(id: string): Promise<BaseWorkloadIdentity<TExtended> | undefined>;
-	/**
-	* Retrieve a workload identity by matching identifying attributes (e.g. `clientId`, `externalId`).
-	*
-	* @param identity - The workload identity to look up.
-	* @returns The workload identity if found, undefined otherwise.
-	*/
-	lookup(identity: BaseWorkloadIdentity<TExtended>): Promise<BaseWorkloadIdentity<TExtended> | undefined>;
-	/**
-	* Optional indexed lookup by `externalId`. When omitted, callers fall back to `lookup` or a list scan.
-	*/
-	getByExternalId?(externalId: string): Promise<BaseWorkloadIdentity<TExtended> | undefined>;
-	/**
-	* Create or update a workload identity. If a record with the same `id` exists it is updated,
-	* otherwise a new record is created.
-	*
-	* @param identity - The workload identity to store.
-	*/
-	upsert(identity: BaseWorkloadIdentity<TExtended>): Promise<BaseWorkloadIdentity<TExtended>>;
-	/**
-	* Delete a workload identity by id.
-	*
-	* @param id - The workload's unique identifier.
-	* @returns The number of records deleted (0 or 1).
-	*/
-	delete(id: string): Promise<number>;
-	/**
-	* List workload identities with optional pagination and sort.
-	*
-	* @param options - Optional start (0-based), limit (page size), and sort.
-	* @returns ListResult with total, count, items, size, page, pages.
-	*/
-	list(options?: ListOptions): Promise<ListResult<BaseWorkloadIdentity<TExtended>>>;
-}
-/**
-* IAM delta egress mode (RemoteConfig/ECI intent). Selects how IAM-visible runtime changes that
-* occur inside the application are surfaced to the enterprise's IAM/governance layer:
-*
-* - `'patch'`: outbound SCIM into the IAM tool (per-resource POST/PUT/PATCH/DELETE,
-*   correlated by the App-owned id carried as SCIM `externalId`). The IAM tool's view stays fresh as users, materialized entitlement
-*   definitions, and access change in the app. See the README "IAM delta egress" section.
-*
-* Origin/trust: every push is authenticated with the app's outgoing workload client (OAuth bearer);
-* the receiver treats the authenticated workload identity as the verified origin. Audit
-* accountability lives with the IdP that authenticated the workload and the IAM tool that granted
-* it access. The SDK only surfaces the signal; it never dictates the enterprise's workflow or
-* policy (flag, auto-revoke + notify, or simply audit).
-*/
-type IamDeltaMode = "patch";
-type AccessRequestCreate = {
-	subject: string;
-	subjectType: SubjectType;
-	targetType: EntitlementType;
-	target: string;
-	operation: "grant" | "revoke";
-	justification?: string;
+type BaseWorkloadIdentityReservedKey = keyof BaseWorkloadIdentitySdkFields;
+type BaseWorkloadIdentity<TExtended = object> = BaseWorkloadIdentitySdkFields & NoReserved<TExtended, BaseWorkloadIdentityReservedKey, "id">;
+/**
+* Abstract interface for workload identity storage backends. Implement to back the registry with
+* in-memory, Redis, or a database. Mirrors {@link UserStore}.
+*
+* @template TExtended - Type-safe custom data that consumers can add to workload identities.
+*/
+interface WorkloadIdentityStore<TExtended = object> {
+	/**
+	* Retrieve a workload identity by its unique id.
+	*
+	* @param id - The workload's unique identifier.
+	* @returns The workload identity if found, undefined otherwise.
+	*/
+	get(id: string): Promise<BaseWorkloadIdentity<TExtended> | undefined>;
+	/**
+	* Retrieve a workload identity by matching identifying attributes (e.g. `clientId`, `externalId`).
+	*
+	* @param identity - The workload identity to look up.
+	* @returns The workload identity if found, undefined otherwise.
+	*/
+	lookup(identity: BaseWorkloadIdentity<TExtended>): Promise<BaseWorkloadIdentity<TExtended> | undefined>;
+	/**
+	* Optional indexed lookup by `externalId`. When omitted, callers fall back to `lookup` or a list scan.
+	*/
+	getByExternalId?(externalId: string): Promise<BaseWorkloadIdentity<TExtended> | undefined>;
+	/**
+	* Create or update a workload identity. If a record with the same `id` exists it is updated,
+	* otherwise a new record is created.
+	*
+	* @param identity - The workload identity to store.
+	*/
+	upsert(identity: BaseWorkloadIdentity<TExtended>): Promise<BaseWorkloadIdentity<TExtended>>;
+	/**
+	* Delete a workload identity by id.
+	*
+	* @param id - The workload's unique identifier.
+	* @returns The number of records deleted (0 or 1).
+	*/
+	delete(id: string): Promise<number>;
+	/**
+	* List workload identities with optional pagination and sort.
+	*
+	* @param options - Optional start (0-based), limit (page size), and sort.
+	* @returns ListResult with total, count, items, size, page, pages.
+	*/
+	list(options?: ListOptions): Promise<ListResult<BaseWorkloadIdentity<TExtended>>>;
+}
+/**
+* IAM delta egress mode (RemoteConfig/ECI intent). Selects how IAM-visible runtime changes that
+* occur inside the application are surfaced to the enterprise's IAM/governance layer:
+*
+* - `'patch'`: outbound SCIM into the IAM tool (per-resource POST/PUT/PATCH/DELETE,
+*   correlated by the App-owned id carried as SCIM `externalId`). The IAM tool's view stays fresh as users, materialized entitlement
+*   definitions, and access change in the app. See the README "IAM delta egress" section.
+*
+* Origin/trust: every push is authenticated with the app's outgoing workload client (OAuth bearer);
+* the receiver treats the authenticated workload identity as the verified origin. Audit
+* accountability lives with the IdP that authenticated the workload and the IAM tool that granted
+* it access. The SDK only surfaces the signal; it never dictates the enterprise's workflow or
+* policy (flag, auto-revoke + notify, or simply audit).
+*/
+type IamDeltaMode = "patch";
+/** ConfigSource-owned authenticated destination for the AccessRequests protocol. */
+type AccessRequestsDestination = {
+	url: string;
+	/** Named outgoing workload client. Omit to use the default workload server identity. */
+	audience?: string;
+};
+type AccessRequestCreate = {
+	subject: string;
+	subjectType: SubjectType;
+	targetType: EntitlementType;
+	target: string;
+	operation: "grant" | "revoke";
+	justification?: string;
+};
+type AccessRequestResult = {
+	id: string;
+	status: "pending" | "approved" | "denied";
+	operation: "grant" | "revoke";
+	trackingUrl: string;
+};
+/** SCIM resource types the delta patch adapter addresses. */
+type IamDeltaResourceType = "user" | "group" | "workload" | "customer";
+/** Destination-owned reference captured from a SCIM User/Group response. */
+type DestinationReference = {
+	/** Service-provider-assigned SCIM resource id. */
+	providerId: string;
+	/** IAM-owned deep link where access to an entitlement can be requested, when supplied. */
+	requestUrl?: string;
+};
+/**
+* Full IAM delta snapshot supplied by the app's maintenance/reconcile path. It mirrors the entities
+* visible through IAM aggregation: users, durable entitlement definitions, and active access roots.
+*/
+type IamDeltaReconcileInput = {
+	users?: Iterable<BaseUser> | AsyncIterable<BaseUser>;
+	workloads?: Iterable<BaseWorkloadIdentity> | AsyncIterable<BaseWorkloadIdentity>;
+	customers?: Iterable<BaseCustomer> | AsyncIterable<BaseCustomer>;
+	groups?: Iterable<Group> | AsyncIterable<Group>;
+	roles?: Iterable<Role> | AsyncIterable<Role>;
+	permissions?: Iterable<Permission> | AsyncIterable<Permission>;
+	access?: Iterable<AccessChange> | AsyncIterable<AccessChange>;
+};
+/** Result of an app-driven full reconcile (re-push of definitions, users, and active roots). */
+type IamDeltaReconcileResult = {
+	pushed: number;
+	skipped: number;
+	errors: string[];
+};
+/**
+* Projects observed runtime mutations to the configured IAM delta destination. The invariant is:
+* every runtime mutation the SDK observes that would change what IAM full sync shows must also
+* egress through this handle. That includes users, materialized entitlement definitions, and access
+* roots. Code templates are not pushed during config apply.
+*
+* Request-triggered methods resolve when projection completes (or immediately when not ready). They
+* are best-effort egress: the SCIM mutation path awaits them inside the request, but a rejection is
+* caught and reported as degraded egress — it never turns a committed store mutation into a SCIM
+* error. Reactive catalog/resource events use the same methods outside a request and warn on failure.
+*
+* Readiness follows the shared contract: `isReady()` is a synchronous check; `ready(timeout?)`
+* resolves once the emitter first becomes usable.
+*/
+interface IamDeltaEmitter {
+	/** Upsert a full SCIM User representation at the destination. */
+	onUserUpsert(user: BaseUser): Promise<void>;
+	/** Delete a destination User identified strictly by externalId. */
+	onUserDelete(externalId: string): Promise<void>;
+	/** Upsert a full AppDev-projected SCIM Workload representation at the destination. */
+	onWorkloadUpsert(workload: BaseWorkloadIdentity): Promise<void>;
+	/** Delete a destination Workload identified by externalId (falling back to its App-owned id). */
+	onWorkloadDelete(externalId: string): Promise<void>;
+	/** Upsert a full AppDev-projected SCIM Customer representation at the destination. */
+	onCustomerUpsert(customer: BaseCustomer): Promise<void>;
+	/** Delete a destination Customer identified by externalId (falling back to its App-owned id). */
+	onCustomerDelete(externalId: string): Promise<void>;
+	/** Upsert a full SCIM Group representation for a group, role, or permission definition. */
+	onEntitlementUpsert(entity: Entitlement, type: EntitlementType): Promise<void>;
+	/** Delete a destination entitlement Group identified by the App-owned catalog id. */
+	onEntitlementDelete(type: EntitlementType, id: string): Promise<void>;
+	/** Project a granted root; resolves on completion (or immediately when not ready), rejects on push failure. */
+	onGrant(change: AccessChange): Promise<void>;
+	/** Project a revoked root; resolves on completion (or immediately when not ready), rejects on push failure. */
+	onRevoke(change: AccessChange): Promise<void>;
+	/** Re-push the complete IAM-visible snapshot to the destination (app-driven full reconcile). */
+	reconcile(input: IamDeltaReconcileInput): Promise<IamDeltaReconcileResult>;
+	/**
+	* Submit an on-behalf access request at `${iam.url}/AccessRequests`. Requires only the
+	* destination channel (`url` plus the `deltaAudience` workload client) — not `isReady()`, which
+	* additionally demands delta egress (a per-kind `'patch'` mode and its receipt stores). A tenant
+	* whose IAM aggregates by pull alone may still submit requests.
+	*/
+	requestAccess(input: AccessRequestCreate): Promise<AccessRequestResult>;
+	/** Read the current state of a request previously submitted to this destination. */
+	getAccessRequest(id: string): Promise<AccessRequestResult>;
+	/**
+	* Read a previously captured destination reference without making a network request. Returns
+	* undefined until the resource has been resolved or pushed to the configured IAM destination.
+	* `correlationId` is a User's `externalId` or an entitlement's App-owned catalog `id`.
+	*/
+	getDestinationRef(resourceType: IamDeltaResourceType, correlationId: string): Promise<DestinationReference | undefined>;
+	isReady(): boolean;
+	ready(timeout?: number): Promise<void>;
+}
+/** Built-in provider types. `oidc` is a generic OIDC provider; `magic-link` is the passwordless flow. */
+type CIAMProviderType = "oidc" | "google" | "github" | "microsoft" | "apple" | "magic-link";
+/** Branding colors for rendering a provider button in light and dark themes. */
+type CIAMProviderColors = {
+	/** Background/brand color for light theme (hex or CSS color). */
+	light: string;
+	/** Background/brand color for dark theme (hex or CSS color). */
+	dark: string;
+	/** Optional secondary/accent color. */
+	secondary?: string;
+};
+/** Operator-supplied branding so the UI can render a provider list without hardcoding. */
+type CIAMProviderBranding = {
+	/** Human-readable name shown on the login button (e.g. "Google"). */
+	displayName: string;
+	/** External icon URL (typically an SVG/PNG hosted on a CDN). */
+	iconUrl?: string;
+	/** Light/dark brand colors. */
+	colors?: CIAMProviderColors;
+	/** Optional provider info/marketing URL. */
+	url?: string;
+};
+/**
+* A single CIAM provider declaration. OIDC/OAuth2 endpoint and credential
+* fields come from the ConfigSource (never application code).
+*/
+type CIAMProviderConfig = {
+	/** Provider adapter type. Selects defaults and claim mapping. */
+	type: CIAMProviderType;
+	/** Whether this provider is enabled. Defaults to true when omitted. */
+	enabled?: boolean;
+	/** Recommended display order (ascending). Ties broken by declaration order. */
+	order?: number;
+	/** UI branding metadata. */
+	branding?: CIAMProviderBranding;
+	/** OIDC issuer/authority (used for discovery when explicit endpoints are omitted). */
+	authority?: string;
+	/** Authorization endpoint (overrides preset). */
+	authorizationUrl?: string;
+	/** Token endpoint (overrides preset). */
+	tokenUrl?: string;
+	/** JWKS endpoint for ID token verification (overrides preset). */
+	jwksUri?: string;
+	/** OAuth2 UserInfo endpoint for providers without an ID token (e.g. GitHub). */
+	userInfoUrl?: string;
+	/** OAuth2 client id (ConfigSource-only). */
+	clientId?: string;
+	/** OAuth2 client secret (ConfigSource-only). */
+	clientSecret?: string;
+	/** Requested scope (overrides preset). */
+	scope?: string;
+	/** Apple: team id for client-secret generation. */
+	teamId?: string;
+	/** Apple: key id for client-secret generation. */
+	keyId?: string;
+	/** Apple: PKCS#8 PEM private key for client-secret generation. */
+	privateKey?: string;
+	/**
+	* ConfigSource-only. When set, this provider's token claims are derived into session-scoped
+	* customer entitlements at login. Magic link has no issuer and ignores this block.
+	*/
+	claimsAsEntitlements?: ClaimsAsEntitlements;
+	/** ConfigSource-only IdP assignment workflow used when IAM assignment is `'idp'`. */
+	accessRequests?: AccessRequestsDestination;
+};
+/** Sanitized provider entry returned by the discovery endpoint for the UI. */
+type CIAMProviderDescriptor = {
+	/** Provider key (matches the RemoteConfig map key); used as `?provider=`. */
+	name: string;
+	type: CIAMProviderType;
+	displayName: string;
+	/** SDK-derived login URL to navigate to (begins the flow). */
+	loginUrl: string;
+	iconUrl?: string;
+	colors?: CIAMProviderColors;
+	url?: string;
+};
+/**
+* Light display cookies (`${cookiesPrefix}.profile`).
+*
+* The envelope is SDK-owned. App code supplies only `user`. The cookie is not an
+* authentication input: the server never reads it to resolve a session, and the browser
+* may forge it. `expiresAt` is display metadata so a client can order entries without a
+* round trip; authoritative expiry is the peer `${cookiesPrefix}.session` record.
+*/
+declare const DISPLAY_COOKIE_SUFFIX = ".profile";
+declare const DISPLAY_COOKIE_VERSION = 1;
+declare const DEFAULT_DISPLAY_COOKIE_MAX = 10;
+declare const DEFAULT_DISCOVERED_COOKIE_MAX = 10;
+declare const DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS: number;
+declare const DISCOVERED_COOKIE_PREFIX = "ion.discovered";
+type DisplayCookieConfig = {
+	/**
+	* When true, the SDK writes a non-HttpOnly display cookie beside the opaque session cookie.
+	* ConfigSource-only. Default false.
+	*/
+	enabled?: boolean;
+	/**
+	* How many display cookies a single response may leave on the browser, newest session window
+	* first. ConfigSource-only. Values below 1 fall back to {@link DEFAULT_DISPLAY_COOKIE_MAX}.
+	* @default 10
+	*/
+	max?: number;
+	/**
+	* Session-less tenant hints written by an App after an explicit directory lookup.
+	* ConfigSource-only and off unless `enabled` is true.
+	*/
+	discovered?: DiscoveredDisplayCookieConfig;
+};
+type DiscoveredDisplayCookieConfig = {
+	enabled?: boolean;
+	/** Browser hint lifetime. This is not a session expiry. @default 14400 */
+	ttlSeconds?: number;
+	/** Independent cap; discovered hints never displace live-session entries. @default 10 */
+	max?: number;
+};
+/** What `${basePath}/auth/user` and `${basePath}/auth/customer` return. ConfigSource-only. */
+type UserEndpointPolicy = "full" | "display" | "off";
+type DisplayUser = Record<string, string | number | boolean | null>;
+type DisplayAuthType = "sso" | "ciam";
+type DisplayCookieEnvelope = {
+	v: typeof DISPLAY_COOKIE_VERSION;
+	/**
+	* Session envelopes omit this field (absent means `'session'`) so the wire format stays identical
+	* to cookies written before discovered hints existed; only discovered hints set it explicitly.
+	* Readers must treat `undefined` as `'session'`.
+	*/
+	kind?: "session" | "discovered";
+	tenantId?: string;
+	authType: DisplayAuthType;
+	/** ISO timestamp copied from the session window at write time. Display only. */
+	expiresAt: string;
+	user: DisplayUser;
+	tenantName?: string;
+};
+type DisplayIdentity = {
+	name?: string;
+	email?: string;
+	avatar?: string;
+};
+declare function resolveDisplayCookieMax(max: number | undefined): number;
+declare function resolveDiscoveredCookieMax(max: number | undefined): number;
+declare function resolveDiscoveredCookieTtlSeconds(ttlSeconds: number | undefined): number;
+declare function defaultDisplayUser(identity: DisplayIdentity): DisplayUser;
+/** Drop non-primitives and auth-bearing keys. Display cookies carry UI fields only. */
+declare function sanitizeDisplayUser(value: unknown): DisplayUser;
+/**
+* AppDev projection runs on the full user (including custom attributes). When omitted, or when it
+* throws, the cookie carries name, email, and avatar only. Forbidden and non-primitive fields are
+* dropped either way — a projector cannot put a session id or token into the cookie.
+*/
+declare function projectDisplayUser<TUser extends object>(user: TUser, projector?: (user: TUser) => unknown): DisplayUser;
+declare function encodeDisplayCookie(envelope: DisplayCookieEnvelope): string;
+declare function decodeDisplayCookie(raw: string): DisplayCookieEnvelope | undefined;
+type ParsedDisplayCookie = {
+	name: string;
+	prefix: string;
+	envelope: DisplayCookieEnvelope;
+};
+declare function readDisplayCookies(cookieHeader: string | null | undefined): ParsedDisplayCookie[];
+/** Client ordering: newest session window first. Invalid timestamps sort last. */
+declare function compareDisplayExpiryDesc(a: string | undefined, b: string | undefined): number;
+declare function profileCookieName(cookiesPrefix: string): string;
+declare function discoveredProfileCookieName(tenantId: string): string;
+/**
+* Minimal logger interface compatible with common structured logging patterns.
+*/
+interface Logger {
+	trace(message?: unknown, ...optionalParams: unknown[]): void;
+	debug(message?: unknown, ...optionalParams: unknown[]): void;
+	info(message?: unknown, ...optionalParams: unknown[]): void;
+	warn(message?: unknown, ...optionalParams: unknown[]): void;
+	error(message?: unknown, ...optionalParams: unknown[]): void;
+}
+/**
+* Renders a structured logger call as one greppable line while leaving the source fields separate
+* for telemetry exporters.
+*/
+declare function formatLogLine(level: keyof Logger, message: unknown, optionalParams?: unknown[], timestamp?: Date): string;
+/**
+* No-op implementation — does nothing for any log level
+*/
+declare const silentLogger: Logger;
+/**
+* Default logger used until an ionite instance is configured with
+* an OpenTelemetry-backed logger or an application-provided logger.
+*/
+declare const defaultLogger: Logger;
+/**
+* Logger that logs messages debug, info, warn, and error to the console.
+*/
+declare const debugLogger: Logger;
+/**
+* Logger that logs messages info, warn, and error to the console.
+*/
+declare const infoLogger: Logger;
+/**
+* Logger that logs messages warn and error to the console.
+*/
+declare const warnLogger: Logger;
+/**
+* Human-readable single-line console logger for local application output.
+*/
+declare const prettyLogger: Logger;
+import { StandardSchemaV1 as StandardSchemaV15 } from "@standard-schema/spec";
+type ChangeListener = () => void;
+/**
+* Reactive source/adapter contract. Implemented by config-source-backed adapters
+* (for example `SecretsSource`) to advertise change subscription and source liveness.
+* `isAvailable()` here is an adapter liveness hook and is intentionally distinct from
+* module readiness (`ModuleReadiness.isReady()` / `ready()`).
+*/
+type ReactiveHandle = {
+	beforeChange?(listener: ChangeListener): () => void;
+	afterChange?(listener: ChangeListener): () => void;
+	isAvailable?(): boolean;
+};
+/**
+* Readiness contract for reactive module/service handles whose usability depends on
+* RemoteConfig that can arrive or change at runtime (for example `ion.secrets`,
+* `ion.workload`, `ion.otel`, `ion.authz.oaa`).
+*
+* - `isReady()` is a synchronous check; use it in request handlers and health probes and
+*   return 503 (or branch) when false instead of blocking.
+* - `ready(timeout?)` resolves once the handle first becomes usable; use it at startup or
+*   as a feature gate. With no timeout it waits indefinitely; with `timeout > 0` it rejects
+*   after that many milliseconds.
+*/
+type ModuleReadiness = {
+	beforeChange?(listener: ChangeListener): () => void;
+	afterChange?(listener: ChangeListener): () => void;
+	isReady?(): boolean;
+	ready?(timeout?: number): Promise<void>;
+};
+/**
+* Canonical ionite module names used by the holistic readiness report and the
+* `requireReady([...])` helper. These are the config-driven module handles whose readiness can be
+* composed; `ion.isReady()` itself stays the narrow "config applied" signal and is NOT one of these.
+*
+* IAM-delta egress is intentionally NOT a member. Delta patch-back is best-effort and non-fatal (a
+* failed push only logs `degraded` and is reconciled by a later full sync — the Batch 7 drift-signal
+* contract), so folding it into `iam` readiness would let a delta-target outage make
+* `requireReady(['iam'])` false and take the app out of rotation for a signal that is designed not to
+* block. Apps that DO treat delta as a hard dependency can gate on `ion.iam.delta.isReady()` /
+* `ion.iam.delta.ready()` explicitly instead.
+*/
+type ModuleName = "sso" | "ciam" | "iam" | "workload" | "otel" | "secrets" | "kms" | "authz" | "tm";
+/** Per-module readiness snapshot in {@link ReadinessReport}. */
+type ModuleReadinessState = {
+	/** Whether the module is active (present/requested) in the effective config. Inactive modules never block readiness. */
+	active: boolean;
+	/** Synchronous readiness of the module right now (mirrors the module's own `isReady()`). */
+	ready: boolean;
+	/** Human-readable explanation when the module is `active` but not `ready`. */
+	reason?: string;
+};
+/**
+* Holistic, read-only readiness snapshot for an ionite instance. Returned by
+* `ion.readiness()` and used by the built-in `${basePath}/readyz` endpoint. This is composition
+* DATA, not a request gate: applications combine it (via `ion.requireReady([...])`) with their own
+* non-ionite dependency checks to build their health endpoints.
+*/
+type ReadinessReport = {
+	/** True when config has been applied (`applied`) and every ACTIVE module is ready. */
+	ok: boolean;
+	/** Whether RemoteConfig has been applied at least once (mirrors `ion.isReady()`). */
+	applied: boolean;
+	/** Per-module readiness keyed by {@link ModuleName}. */
+	modules: Record<ModuleName, ModuleReadinessState>;
+	/** Most recent config-application outcome (last applied time and last error, if any). */
+	config: ConfigApplyStatus;
+};
+/** Result of `ion.requireReady(names)`: a synchronous, declarative readiness gate over selected modules. */
+type RequireReadyResult = {
+	/** True when config is applied and every requested module is ready. */
+	ok: boolean;
+	/** The requested modules that are not ready, with reasons when available. */
+	notReady: Array<{
+		name: ModuleName;
+		reason?: string;
+	}>;
+};
+type CapabilityKey = "sso.login" | "sso.jit" | "sso.logout" | "sso.back_channel_logout" | "sso.claims_authz" | "ciam.magic_link" | "ciam.oidc_login" | "ciam.customer" | "ciam.logout" | "ciam.claims_authz" | "iam.users" | "iam.groups" | "iam.workloads" | "iam.customers" | "workload.incoming" | "workload.outgoing" | "workload.claims_authz" | "authz.oaa" | "authz.access_requests" | "tm.integration";
+type CapabilityEndpointUrls = {
+	readyzUrl: string;
+	capabilitiezUrl: string;
+	sso: {
+		loginUrl: string;
+		userUrl: string;
+		logoutUrl: string;
+		logoutBackChannelUrl: string;
+		refreshUrl: string;
+		callbackUrl: string;
+	};
+	workload: {
+		validateUrl: string;
+		jwksUrl: string;
+	};
+	iam: {
+		basePath: string;
+		usersUrl: string;
+		groupsUrl: string;
+		workloadsUrl: string;
+		customersUrl: string;
+	};
+	ciam: {
+		magicLinkUrl: string;
+		magicLinkLoginUrl: string;
+		customerUrl: string;
+		customerLoginUrl: string;
+		customerCallbackUrl: string;
+		customerProvidersUrl: string;
+		logoutUrl: string;
+	};
+};
+type CapabilityState = {
+	module: ModuleName;
+	active: boolean;
+	ready: boolean;
+	testable: boolean;
+	urls?: string[];
+	reason?: string;
+};
+type CapabilitiezManifest = {
+	sdk: {
+		/** Runtime @ionite/server version serving this manifest. */
+		version: string;
+		/** Version of the stable capability/test-unit vocabulary. */
+		catalogVersion: number;
+	};
+	basePath: string;
+	urls: CapabilityEndpointUrls;
+	modules: Record<ModuleName, ModuleReadinessState>;
+	capabilities: Record<CapabilityKey, CapabilityState>;
+	/**
+	* True when FrameworkConfig wired a live LFV callback transport. Boolean only — the transport
+	* object, Redis URL, and credentials are never exposed.
+	*/
+	lfvCallbackTransport: boolean;
+};
+type OtelSignalName = "traces" | "metrics" | "logs";
+type OtelProtocol = "http/protobuf" | "http/json";
+type OtelProviderType = "otlp" | "grafana-lgtm" | "datadog" | "splunk" | "elastic";
+type OtelLogLevel = "trace" | "debug" | "info" | "warn" | "error";
+type OtelLevels = Partial<Record<OtelLogLevel, boolean>>;
+/** Local console mirror policy: disable it or set its minimum emitted severity. */
+type OtelConsoleMode = "off" | OtelLogLevel;
+type OtelAttributeValue = string | number | boolean | string[] | number[] | boolean[];
+type OtelAttributes = Record<string, OtelAttributeValue>;
+type OtelSignalConfig = {
+	/** Per-signal OTLP endpoint. When omitted, the module appends /v1/{signal} to `endpoint`. */
+	endpoint?: string;
+	headers?: Record<string, string>;
+	timeoutMillis?: number;
+	concurrencyLimit?: number;
+};
+type OtelMetricsSignalConfig = OtelSignalConfig & {
+	exportIntervalMillis?: number;
+	exportTimeoutMillis?: number;
+};
+type OtelOAuthClientCredentialsConfig = {
+	tokenUrl: string;
+	clientId: string;
+	clientSecret: string;
+	scope?: string;
+	audience?: string;
+	headers?: Record<string, string>;
+};
+type OtelLogRecord = {
+	severityNumber?: number;
+	severityText?: string;
+	body?: unknown;
+	attributes?: Record<string, unknown>;
+};
+/**
+* OpenTelemetry config supplied by ConfigSource/RemoteConfig.
+* Keep environment-specific URLs and credentials here, not in FrameworkConfig.
+*/
+type OtelConfig = {
+	type?: OtelProviderType;
+	name: string;
+	endpoint?: string;
+	protocol?: OtelProtocol;
+	headers?: Record<string, string>;
+	apiKey?: string;
+	/** Name of a `RemoteConfig.kms` key pool used for exporter authentication. */
+	apiKeyPool?: string;
+	apiKeyHeader?: string;
+	oauth?: OtelOAuthClientCredentialsConfig;
+	version?: string;
+	deploymentEnvironment?: string;
+	resourceAttributes?: OtelAttributes;
+	levels?: OtelLevels;
+	/** `'off'` exports only to OTel; a level dual-emits at or above that severity. Defaults to `'info'`. */
+	console?: OtelConsoleMode;
+	traces?: boolean | OtelSignalConfig;
+	metrics?: boolean | OtelMetricsSignalConfig;
+	logs?: boolean | OtelSignalConfig;
+};
+/**
+* OpenTelemetry app/runtime wiring supplied by code.
+* Instrumentation instances and callbacks live here because they are framework-specific code.
+*/
+type FrameworkOtelConfig = {
+	levels?: OtelLevels;
+	instrument?: unknown[];
+	/** Optional app-owned destination/renderer for records admitted by `RemoteConfig.otel.console`. */
+	console?: (record: OtelLogRecord) => void;
+	spanProcessors?: unknown[];
+	metricReaders?: unknown[];
+	logRecordProcessors?: unknown[];
+	sampler?: unknown;
+	textMapPropagator?: unknown;
+	contextManager?: unknown;
+	configure?: (options: Record<string, unknown>) => Record<string, unknown> | void;
+};
+type Otel = {
+	/** Secret-free, JSON-serializable configuration and readiness summary. */
+	describe(): OtelDescription;
+	beforeChange(listener: ChangeListener): () => void;
+	afterChange(listener: ChangeListener): () => void;
+	isReady(): boolean;
+	ready(timeout?: number): Promise<void>;
+	logger: Logger;
+	forceFlush(): Promise<void>;
+	shutdown(): Promise<void>;
+};
+type ModuleDescriptionBase<TModule extends ModuleName> = {
+	module: TModule;
+	active: boolean;
+	ready: boolean;
+};
+type CookieDescription = {
+	prefix?: string;
+	path?: string;
+	secure?: boolean;
+	sameSite?: "Strict" | "Lax";
+	domain?: string;
+};
+type SsoDescription = ModuleDescriptionBase<"sso"> & {
+	authority?: string;
+	tokenUrl?: string;
+	authorizationUrl?: string;
+	clientId?: string;
+	redirectUri?: string;
+	responseType?: "code";
+	scope?: string;
+	silentRedirectUri?: string;
+	jwksUri?: string;
+	endSessionEndpoint?: string;
+	revocationEndpoint?: string;
+	cookies: CookieDescription;
+	loginStateTtl?: number;
+	rotationGraceSeconds?: number;
+	sessionWindowSeconds?: number;
+	displayCookie?: DisplayCookieConfig;
+	jit: {
+		enabled: boolean;
+		userStore: boolean;
+	};
+	sessionStore: boolean;
+	/** Present when RemoteConfig configured claim-derived entitlements for this workforce issuer. */
+	claimsAsEntitlements?: ClaimsAsEntitlementsDescription;
+	urls: Partial<CapabilityEndpointUrls["sso"]>;
+};
+type CiamProviderDescription = {
+	name: string;
+	type: CIAMProviderType;
+	enabled: boolean;
+	order?: number;
+	branding?: CIAMProviderBranding;
+	authority?: string;
+	authorizationUrl?: string;
+	tokenUrl?: string;
+	jwksUri?: string;
+	userInfoUrl?: string;
+	clientId?: string;
+	scope?: string;
+	claimsAsEntitlements?: ClaimsAsEntitlementsDescription;
+	loginUrl: string;
+};
+type CiamDescription = ModuleDescriptionBase<"ciam"> & {
+	magicLinkTtl?: number;
+	loginStateTtl?: number;
+	sessionTtl?: number;
+	cookies: CookieDescription;
+	displayCookie?: DisplayCookieConfig;
+	jit: {
+		enabled: boolean;
+		customerStore: boolean;
+	};
+	sessionStore: boolean;
+	magicLinkStore: boolean;
+	providers: CiamProviderDescription[];
+	urls: Partial<CapabilityEndpointUrls["ciam"]>;
+};
+type IamPrincipalDescription = {
+	enabled: boolean;
+	assignment: IamAssignmentPolicy;
+	delta?: "patch";
+	storeWired: boolean;
+};
+type AccessRequestsChannelsDescription = {
+	iam?: string;
+	sso?: string;
+	ciam: Record<string, string>;
+};
+type IamDescription = ModuleDescriptionBase<"iam"> & {
+	url?: string;
+	deltaAudience?: string;
+	accessRequests: AccessRequestsChannelsDescription;
+	users: IamPrincipalDescription;
+	workloads: IamPrincipalDescription;
+	customers: IamPrincipalDescription;
+	groups: {
+		enabled: boolean;
+		catalogWired: boolean;
+	};
+	urls: Partial<CapabilityEndpointUrls["iam"]>;
+};
+type WorkloadTrustedIdpDescription = {
+	issuer: string;
+	jwksUri: string;
+	audience: string | string[];
+	claimsAsEntitlements?: ClaimsAsEntitlementsDescription;
+};
+type WorkloadClientDescription = {
+	name: string;
+	ready: boolean;
+	clientId?: string;
+	workloadId?: string;
+	idpTokenUrl?: string;
+	scope?: string;
+	audience?: string;
+	authMethod: "client_secret" | "private_key_jwt" | "server_only";
+};
+type WorkloadDescription = ModuleDescriptionBase<"workload"> & {
+	incoming: {
+		trustedIdps: WorkloadTrustedIdpDescription[];
+	};
+	outgoing: WorkloadClientDescription[];
+	urls: Partial<CapabilityEndpointUrls["workload"]>;
+};
+type SecretsSourceDescription = {
+	name: string;
+	type: "dev" | "gcp" | "vault" | "aws" | "azure";
+	ready: boolean;
+	url?: string;
+	clientId?: string;
+	authMethod?: string;
+};
+type SecretsDescription = ModuleDescriptionBase<"secrets"> & {
+	sources: SecretsSourceDescription[];
+};
+type KmsPoolDescription = {
+	name: string;
+	source?: string;
+	path: string;
+	ready: boolean;
+};
+type KmsDescription = ModuleDescriptionBase<"kms"> & {
+	pools: KmsPoolDescription[];
+};
+type OtelSignalDescription = {
+	enabled: boolean;
+	endpoint?: string;
+	timeoutMillis?: number;
+	concurrencyLimit?: number;
+	exportIntervalMillis?: number;
+	exportTimeoutMillis?: number;
 };
-type AccessRequestResult = {
-	id: string;
-	status: "pending" | "approved" | "denied";
-	operation: "grant" | "revoke";
-	trackingUrl: string;
+type OtelDescription = ModuleDescriptionBase<"otel"> & {
+	type?: OtelProviderType;
+	name?: string;
+	endpoint?: string;
+	protocol?: OtelProtocol;
+	apiKeyPool?: string;
+	apiKeyHeader?: string;
+	oauth?: {
+		tokenUrl: string;
+		clientId: string;
+		scope?: string;
+		audience?: string;
+	};
+	version?: string;
+	deploymentEnvironment?: string;
+	resourceAttributes?: OtelAttributes;
+	levels?: OtelLevels;
+	console?: OtelConsoleMode;
+	signals: {
+		traces: OtelSignalDescription;
+		metrics: OtelSignalDescription;
+		logs: OtelSignalDescription;
+	};
 };
-/** SCIM resource types the delta patch adapter addresses. */
-type IamDeltaResourceType = "user" | "group" | "workload" | "customer";
-/** Destination-owned reference captured from a SCIM User/Group response. */
-type DestinationReference = {
-	/** Service-provider-assigned SCIM resource id. */
-	providerId: string;
-	/** IAM-owned deep link where access to an entitlement can be requested, when supplied. */
-	requestUrl?: string;
+type OaaDescription = {
+	ready: boolean;
+	url?: string;
+	providerId?: string;
+	datasourceId?: string;
+	applicationName?: string;
+	applicationType?: string;
+	population?: Record<string, string>;
+	fullSync: boolean;
 };
-/**
-* Full IAM delta snapshot supplied by the app's maintenance/reconcile path. It mirrors the entities
-* visible through IAM aggregation: users, durable entitlement definitions, and active access roots.
-*/
-type IamDeltaReconcileInput = {
-	users?: Iterable<BaseUser> | AsyncIterable<BaseUser>;
-	workloads?: Iterable<BaseWorkloadIdentity> | AsyncIterable<BaseWorkloadIdentity>;
-	customers?: Iterable<BaseCustomer> | AsyncIterable<BaseCustomer>;
-	groups?: Iterable<Group> | AsyncIterable<Group>;
-	roles?: Iterable<Role> | AsyncIterable<Role>;
-	permissions?: Iterable<Permission> | AsyncIterable<Permission>;
-	access?: Iterable<AccessChange> | AsyncIterable<AccessChange>;
+type AuthzDescription = ModuleDescriptionBase<"authz"> & {
+	trustedProvisioningClients: Array<{
+		issuer: string;
+		audience: string | string[];
+		clientId: string;
+		permissions: string[];
+	}>;
+	oaa?: OaaDescription;
+	stores: {
+		accessStore: boolean;
+		accessIndex: boolean;
+		catalogStore: boolean;
+		resources: boolean;
+	};
 };
-/** Result of an app-driven full reconcile (re-push of definitions, users, and active roots). */
-type IamDeltaReconcileResult = {
-	pushed: number;
-	skipped: number;
-	errors: string[];
+type TmDescription = ModuleDescriptionBase<"tm"> & {
+	enabled: boolean;
+	integrator?: {
+		id: string;
+		name?: string;
+		url: string;
+		issuer: string;
+		jwksUri: string;
+		audience: string;
+		clientId: string;
+	};
+	consentTtlSeconds?: number;
+	maxRedeemAttempts?: number;
+};
+type ModuleDescription = SsoDescription | CiamDescription | IamDescription | WorkloadDescription | SecretsDescription | KmsDescription | OtelDescription | AuthzDescription | TmDescription;
+type IoniteDescription = {
+	id?: string;
+	sdk: {
+		version: string;
+		catalogVersion: number;
+	};
+	basePath: string;
+	urls: CapabilityEndpointUrls;
+	ok: boolean;
+	applied: boolean;
+	config: ConfigApplyStatus;
+	modules: Record<ModuleName, ModuleReadinessState & {
+		description?: ModuleDescription;
+	}>;
 };
-/**
-* Projects observed runtime mutations to the configured IAM delta destination. The invariant is:
-* every runtime mutation the SDK observes that would change what IAM full sync shows must also
-* egress through this handle. That includes users, materialized entitlement definitions, and access
-* roots. Code templates are not pushed during config apply.
-*
-* Request-triggered methods resolve when projection completes (or immediately when not ready). They
-* are best-effort egress: the SCIM mutation path awaits them inside the request, but a rejection is
-* caught and reported as degraded egress — it never turns a committed store mutation into a SCIM
-* error. Reactive catalog/resource events use the same methods outside a request and warn on failure.
-*
-* Readiness follows the shared contract: `isReady()` is a synchronous check; `ready(timeout?)`
-* resolves once the emitter first becomes usable.
-*/
-interface IamDeltaEmitter {
-	/** Upsert a full SCIM User representation at the destination. */
-	onUserUpsert(user: BaseUser): Promise<void>;
-	/** Delete a destination User identified strictly by externalId. */
-	onUserDelete(externalId: string): Promise<void>;
-	/** Upsert a full AppDev-projected SCIM Workload representation at the destination. */
-	onWorkloadUpsert(workload: BaseWorkloadIdentity): Promise<void>;
-	/** Delete a destination Workload identified by externalId (falling back to its App-owned id). */
-	onWorkloadDelete(externalId: string): Promise<void>;
-	/** Upsert a full AppDev-projected SCIM Customer representation at the destination. */
-	onCustomerUpsert(customer: BaseCustomer): Promise<void>;
-	/** Delete a destination Customer identified by externalId (falling back to its App-owned id). */
-	onCustomerDelete(externalId: string): Promise<void>;
-	/** Upsert a full SCIM Group representation for a group, role, or permission definition. */
-	onEntitlementUpsert(entity: Entitlement, type: EntitlementType): Promise<void>;
-	/** Delete a destination entitlement Group identified by the App-owned catalog id. */
-	onEntitlementDelete(type: EntitlementType, id: string): Promise<void>;
-	/** Project a granted root; resolves on completion (or immediately when not ready), rejects on push failure. */
-	onGrant(change: AccessChange): Promise<void>;
-	/** Project a revoked root; resolves on completion (or immediately when not ready), rejects on push failure. */
-	onRevoke(change: AccessChange): Promise<void>;
-	/** Re-push the complete IAM-visible snapshot to the destination (app-driven full reconcile). */
-	reconcile(input: IamDeltaReconcileInput): Promise<IamDeltaReconcileResult>;
-	/**
-	* Submit an on-behalf access request at `${iam.url}/AccessRequests`. Requires only the
-	* destination channel (`url` plus the `deltaAudience` workload client) — not `isReady()`, which
-	* additionally demands delta egress (a per-kind `'patch'` mode and its receipt stores). A tenant
-	* whose IAM aggregates by pull alone may still submit requests.
-	*/
-	requestAccess(input: AccessRequestCreate): Promise<AccessRequestResult>;
-	/**
-	* Read a previously captured destination reference without making a network request. Returns
-	* undefined until the resource has been resolved or pushed to the configured IAM destination.
-	* `correlationId` is a User's `externalId` or an entitlement's App-owned catalog `id`.
-	*/
-	getDestinationRef(resourceType: IamDeltaResourceType, correlationId: string): Promise<DestinationReference | undefined>;
-	isReady(): boolean;
-	ready(timeout?: number): Promise<void>;
-}
 import { StandardSchemaV1 as StandardSchemaV14 } from "@standard-schema/spec";
 /**
 * Token caching for workload identity authentication.
@@ -2303,12 +2364,10 @@ type WorkloadConfigBase = {
 	*/
 	audience?: string;
 	/**
-	* Per-IdP intent (incoming/server role only): when `true`, tokens validated against THIS trust
-	* anchor have their OAuth `scope` claim auto-honored as entitlements by the request-level `has*`
-	* helpers (audience-bound). Mirrors `RemoteConfig.authz.scopesAsEntitlements` but scoped to a single
-	* trusted IdP so first-party scopes can be honored while federated/third-party ones are not.
+	* Per-IdP intent (incoming/server role only): token claims from THIS trust anchor may satisfy
+	* `has*` (audience-bound). ConfigSource-only. There is no global fallback.
 	*/
-	scopesAsEntitlements?: boolean;
+	claimsAsEntitlements?: ClaimsAsEntitlements;
 	/**
 	* Default OAuth2 scopes (space-delimited)
 	*/
@@ -2484,8 +2543,8 @@ type TrustedIdp = {
 	* one of these values (with `azp` fallback). REQUIRED: prevents cross-app token reuse.
 	*/
 	audience: string | string[];
-	/** Per-IdP scopesAsEntitlements intent (see {@link WorkloadConfigBase.scopesAsEntitlements}). */
-	scopesAsEntitlements?: boolean;
+	/** Per-IdP claims intent (see {@link WorkloadConfigBase.claimsAsEntitlements}). */
+	claimsAsEntitlements?: ClaimsAsEntitlements;
 };
 /**
 * Workload config with separate incoming (server) and outgoing (client) roles.
@@ -2720,6 +2779,7 @@ type IAMAccessRequestsConfig = {
 		request: AccessRequestResult;
 		created: boolean;
 	}>;
+	get?: (id: string) => Promise<AccessRequestResult | undefined>;
 };
 type IAMEntitlementRequestUrlContext = {
 	request: Request;
@@ -3301,6 +3361,12 @@ type Session<TExtended = object> = {
 	*/
 	claims?: Record<string, unknown>;
 	/**
+	* Entitlements derived from token claims at login and refresh. Session-scoped: they die with the
+	* record (TTL, rotation, back-channel logout) and are never written to the access stores.
+	* Only meaningful when the store declares {@link SessionStoreCapabilities.derivedEntitlements}.
+	*/
+	entitlements?: DerivedEntitlement[];
+	/**
 	* Optional access-token claims for modules that keep access/id claims separate.
 	*/
 	accessClaims?: Record<string, unknown>;
@@ -3337,7 +3403,21 @@ type Session<TExtended = object> = {
 * }
 * ```
 */
+/**
+* Store-declared capabilities. The SDK does not probe a custom store (a write at init is forbidden);
+* a store that omits the declaration is treated as incapable.
+*/
+type SessionStoreCapabilities = {
+	/**
+	* The store persists {@link Session.entitlements} round-trip. JSON-backed stores (the SDK Redis
+	* and in-memory implementations) declare this. A column-mapped SQL store declares it only after
+	* it has a column for the derived set.
+	*/
+	derivedEntitlements?: boolean;
+};
 interface SessionStore<TExtended = object> {
+	/** Declaration of what this store persists beyond the required session fields. */
+	readonly capabilities?: SessionStoreCapabilities;
 	/**
 	* Create a new session in the store.
 	*
@@ -3670,6 +3750,13 @@ type SSOConfig<
 	*/
 	userStore?: UserStore<TUserData>;
 	/**
+	* ConfigSource-only. When set, the named token claims are derived into session-scoped
+	* entitlements at login and refresh. Never set from application code.
+	*/
+	claimsAsEntitlements?: ClaimsAsEntitlements;
+	/** ConfigSource-only IdP assignment workflow used when IAM assignment is `'idp'`. */
+	accessRequests?: AccessRequestsDestination;
+	/**
 	* Enable Just-In-Time (JIT) user provisioning.
 	* When enabled, new users are automatically created in the userStore on their first login.
 	* When disabled (default), only existing users in the userStore are updated on login.
@@ -4585,17 +4672,6 @@ type TrustedProvisioningClient = {
 type AuthzConfig = {
 	oaa?: AuthzOaaConfig;
 	/**
-	* RemoteConfig/Ops-governed intent. When `true`, the request-level `has*` helpers auto-honor a
-	* principal's OAuth token `scope` claims as entitlements: an app-wide check (no `resource` arg)
-	* also allows when the target id matches a granted scope. Default `false` (secure): scopes never
-	* satisfy `has*` and authorization comes solely from the `AccessAssignmentStore`/`AccessIndex` (IAM/SCIM).
-	* Read at check time so it can be flipped live. This NEVER affects token validation, and the
-	* explicit `hasScope*` helpers are always available regardless of this flag. Resource-scoped
-	* checks (a `resource` arg supplied) are never satisfied by scopes. For workload principals this is
-	* a fallback only: a matched trusted IdP's per-entry `scopesAsEntitlements` takes precedence.
-	*/
-	scopesAsEntitlements?: boolean;
-	/**
 	* Config-declared trusted provisioning clients (read-path overlay; ConfigSource/ECI-owned). Each
 	* entry pre-authorizes a workload client to hold specific permissions without a stored grant. See
 	* {@link TrustedProvisioningClient}. Honored in the request-level `has*` helpers BEFORE the
@@ -4676,11 +4752,11 @@ type FrameworkConfig = {
 * `afterLogout` callbacks, which are code-only and therefore kept. RemoteConfig-only intent flags (e.g. IAM `users`/`groups`
 * enablement) are also stripped from code.
 */
-type SSOConfigFromCode = Omit<SSOConfig, "loginUrl" | "userUrl" | "logoutUrl" | "logoutBackChannelUrl" | "refreshUrl" | "redirectUri">;
+type SSOConfigFromCode = Omit<SSOConfig, "loginUrl" | "userUrl" | "logoutUrl" | "logoutBackChannelUrl" | "refreshUrl" | "redirectUri" | "claimsAsEntitlements" | "accessRequests">;
 type IAMConfigFromCode = Omit<IAMConfig, "usersUrl" | "groupsUrl" | "workloadsUrl" | "customersUrl" | "users" | "workloads" | "customers" | "groups" | "discovery" | "deltaAudience"> & {
 	discovery?: Omit<IAMDiscoveryConfig, "basePath">;
 };
-type WorkloadServerConfigFromCode = Omit<Partial<WorkloadConfig>, "tokenUrl" | "validateUrl" | "jwksUrl" | "refreshUrl">;
+type WorkloadServerConfigFromCode = Omit<Partial<WorkloadConfig>, "tokenUrl" | "validateUrl" | "jwksUrl" | "refreshUrl" | "claimsAsEntitlements">;
 type FrameworkWorkloadConfigFromCode = WorkloadServerConfigFromCode | {
 	incoming?: WorkloadServerConfigFromCode;
 	outgoing?: FrameworkWorkloadIncomingOutgoing["outgoing"];
@@ -5273,8 +5349,8 @@ type ResolvedRoute = {
 	/**
 	* Authorization required to invoke this route. When set, the router enforces it (deny-by-default)
 	* before the handler runs: the caller must hold the {@link EndpointPermission.permission} as a
-	* granted entitlement, or—when `RemoteConfig.authz.scopesAsEntitlements` is enabled—carry the
-	* matching OAuth scope. Login/public/discovery routes omit it.
+	* granted entitlement, or a claim-derived entitlement from the issuing IdP's `claimsAsEntitlements`
+	* block. Login/public/discovery routes omit it.
 	*
 	* Three states, chosen so a custom `resolve` cannot silently drop authorization by omission:
 	* - a permission object → enforce it;
@@ -6415,9 +6491,9 @@ type Authz = {
 	*/
 	grant(change: AccessChange): Promise<AccessChange>;
 	/**
-	* Submit one grant or revoke request on a principal's behalf. Allowed only when that kind's
-	* assignment policy is `'iam-request'`. One operation maps to one approval decision, status,
-	* and tracking URL. Authenticated with the module-wide `deltaAudience` workload client.
+	* Submit one grant or revoke request on a principal's behalf. Under `'iam-request'`, targets the
+	* IAM destination; under `'idp'`, targets the claims-bearing SSO/CIAM provider. One operation
+	* maps to one approval decision, status, and tracking URL.
 	*/
 	requestAccess(change: {
 		subject: AccessChange["subject"];
@@ -6426,6 +6502,20 @@ type Authz = {
 		target: AccessChange["target"];
 		operation: "grant" | "revoke";
 		justification?: string;
+		/** CIAM provider key. Required only when multiple providers expose an AccessRequests channel. */
+		provider?: string;
+	}): Promise<{
+		id: string;
+		status: "pending" | "approved" | "denied";
+		operation: "grant" | "revoke";
+		trackingUrl: string;
+	}>;
+	/** Read the destination-owned state of an on-behalf access request. */
+	getAccessRequest(input: {
+		id: string;
+		subjectType: SubjectType;
+		/** CIAM provider key. Required only when multiple providers expose an AccessRequests channel. */
+		provider?: string;
 	}): Promise<{
 		id: string;
 		status: "pending" | "approved" | "denied";
@@ -6445,8 +6535,10 @@ type Authz = {
 * - `'iam'` — never assign in-app; show a request link (or a read-only entitlement table).
 * - `'iam-request'` — never assign in-app; the app submits a request on the principal's behalf via
 *   {@link Authz.requestAccess}.
+* - `'idp'` — the claims-bearing SSO/CIAM provider is assigner of record; requests use that
+*   provider's ConfigSource-owned AccessRequests channel.
 */
-type IamAssignmentPolicy = "app" | "iam" | "iam-request";
+type IamAssignmentPolicy = "app" | "iam" | "iam-request" | "idp";
 /**
 * Thrown by {@link Authz.grant} when the Ops-owned assignment policy forbids in-app assignment.
 * `requestUrl` is the IAM-written entitlement receipt when one exists, so the app can send the
@@ -6865,4 +6957,4 @@ type LfvErrorResponse = {
 };
 /** Generates a ULID */
 declare function generateULID(prefix?: string): string;
-export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestResult, AccessStatus, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzDescription, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, CiamDescription, CiamProviderDescription, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CookieDescription, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, DescribedSecretsSource, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamDescription, IamPrincipalDescription, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InferSecretType, Ionite, IoniteBase, IoniteDescription, IoniteError, IoniteErrorOptions, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsDescription, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDescription, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleDescription, ModuleDescriptionBase, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaDescription, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelDescription, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalDescription, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsDescription, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceDescription, SecretsSourceMap, SecretsSourceType, SecretsSubscriptionOptions, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, SsoDescription, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmDescription, TmIntegratorConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWebSocketAuthHeader, VaultWebSocketSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadClientDescription, WorkloadConfig, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadTrustedIdpDescription, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, discoveredProfileCookieName, encodeDisplayCookie, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };
+export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestResult, AccessRequestsDestination, AccessStatus, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzDescription, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, CiamDescription, CiamProviderDescription, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CookieDescription, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, DerivedEntitlement, DescribedSecretsSource, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamDescription, IamPrincipalDescription, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InferSecretType, Ionite, IoniteBase, IoniteDescription, IoniteError, IoniteErrorOptions, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsDescription, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDescription, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleDescription, ModuleDescriptionBase, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaDescription, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelDescription, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalDescription, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsDescription, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceDescription, SecretsSourceMap, SecretsSourceType, SecretsSubscriptionOptions, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, SsoDescription, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmDescription, TmIntegratorConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWebSocketAuthHeader, VaultWebSocketSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadClientDescription, WorkloadConfig, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadTrustedIdpDescription, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, discoveredProfileCookieName, encodeDisplayCookie, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };