@ionite/core 0.0.24-beta.20260928.18 → 0.0.24-beta.20261003.16

package/dist/index.d.ts

@@ -315,443 +315,6 @@ declare function accessRefId(value: unknown): string;
 * default, or `applyToApplication`) collapses to the `app` scope key.
 */
 declare function accessRootId(change: AccessChange): string;
-type ChangeListener = () => void;
-/**
-* Reactive source/adapter contract. Implemented by config-source-backed adapters
-* (for example `SecretsSource`) to advertise change subscription and source liveness.
-* `isAvailable()` here is an adapter liveness hook and is intentionally distinct from
-* module readiness (`ModuleReadiness.isReady()` / `ready()`).
-*/
-type ReactiveHandle = {
-	beforeChange?(listener: ChangeListener): () => void;
-	afterChange?(listener: ChangeListener): () => void;
-	isAvailable?(): boolean;
-};
-/**
-* Readiness contract for reactive module/service handles whose usability depends on
-* RemoteConfig that can arrive or change at runtime (for example `ion.secrets`,
-* `ion.workload`, `ion.otel`, `ion.authz.oaa`).
-*
-* - `isReady()` is a synchronous check; use it in request handlers and health probes and
-*   return 503 (or branch) when false instead of blocking.
-* - `ready(timeout?)` resolves once the handle first becomes usable; use it at startup or
-*   as a feature gate. With no timeout it waits indefinitely; with `timeout > 0` it rejects
-*   after that many milliseconds.
-*/
-type ModuleReadiness = {
-	beforeChange?(listener: ChangeListener): () => void;
-	afterChange?(listener: ChangeListener): () => void;
-	isReady?(): boolean;
-	ready?(timeout?: number): Promise<void>;
-};
-/**
-* Canonical ionite module names used by the holistic readiness report and the
-* `requireReady([...])` helper. These are the config-driven module handles whose readiness can be
-* composed; `ion.isReady()` itself stays the narrow "config applied" signal and is NOT one of these.
-*
-* IAM-delta egress is intentionally NOT a member. Delta patch-back is best-effort and non-fatal (a
-* failed push only logs `degraded` and is reconciled by a later full sync — the Batch 7 drift-signal
-* contract), so folding it into `iam` readiness would let a delta-target outage make
-* `requireReady(['iam'])` false and take the app out of rotation for a signal that is designed not to
-* block. Apps that DO treat delta as a hard dependency can gate on `ion.iam.delta.isReady()` /
-* `ion.iam.delta.ready()` explicitly instead.
-*/
-type ModuleName = "sso" | "ciam" | "iam" | "workload" | "otel" | "secrets" | "kms" | "authz" | "tm";
-/** Per-module readiness snapshot in {@link ReadinessReport}. */
-type ModuleReadinessState = {
-	/** Whether the module is active (present/requested) in the effective config. Inactive modules never block readiness. */
-	active: boolean;
-	/** Synchronous readiness of the module right now (mirrors the module's own `isReady()`). */
-	ready: boolean;
-	/** Human-readable explanation when the module is `active` but not `ready`. */
-	reason?: string;
-};
-/**
-* Holistic, read-only readiness snapshot for an ionite instance. Returned by
-* `ion.readiness()` and used by the built-in `${basePath}/readyz` endpoint. This is composition
-* DATA, not a request gate: applications combine it (via `ion.requireReady([...])`) with their own
-* non-ionite dependency checks to build their health endpoints.
-*/
-type ReadinessReport = {
-	/** True when config has been applied (`applied`) and every ACTIVE module is ready. */
-	ok: boolean;
-	/** Whether RemoteConfig has been applied at least once (mirrors `ion.isReady()`). */
-	applied: boolean;
-	/** Per-module readiness keyed by {@link ModuleName}. */
-	modules: Record<ModuleName, ModuleReadinessState>;
-	/** Most recent config-application outcome (last applied time and last error, if any). */
-	config: ConfigApplyStatus;
-};
-/** Result of `ion.requireReady(names)`: a synchronous, declarative readiness gate over selected modules. */
-type RequireReadyResult = {
-	/** True when config is applied and every requested module is ready. */
-	ok: boolean;
-	/** The requested modules that are not ready, with reasons when available. */
-	notReady: Array<{
-		name: ModuleName;
-		reason?: string;
-	}>;
-};
-type CapabilityKey = "sso.login" | "sso.jit" | "sso.logout" | "sso.back_channel_logout" | "ciam.magic_link" | "ciam.oidc_login" | "ciam.customer" | "ciam.logout" | "iam.users" | "iam.groups" | "iam.workloads" | "iam.customers" | "workload.incoming" | "workload.outgoing" | "authz.oaa" | "tm.integration";
-type CapabilityEndpointUrls = {
-	readyzUrl: string;
-	capabilitiezUrl: string;
-	sso: {
-		loginUrl: string;
-		userUrl: string;
-		logoutUrl: string;
-		logoutBackChannelUrl: string;
-		refreshUrl: string;
-		callbackUrl: string;
-	};
-	workload: {
-		validateUrl: string;
-		jwksUrl: string;
-	};
-	iam: {
-		basePath: string;
-		usersUrl: string;
-		groupsUrl: string;
-		workloadsUrl: string;
-		customersUrl: string;
-	};
-	ciam: {
-		magicLinkUrl: string;
-		magicLinkLoginUrl: string;
-		customerUrl: string;
-		customerLoginUrl: string;
-		customerCallbackUrl: string;
-		customerProvidersUrl: string;
-		logoutUrl: string;
-	};
-};
-type CapabilityState = {
-	module: ModuleName;
-	active: boolean;
-	ready: boolean;
-	testable: boolean;
-	urls?: string[];
-	reason?: string;
-};
-type CapabilitiezManifest = {
-	sdk: {
-		/** Runtime @ionite/server version serving this manifest. */
-		version: string;
-		/** Version of the stable capability/test-unit vocabulary. */
-		catalogVersion: number;
-	};
-	basePath: string;
-	urls: CapabilityEndpointUrls;
-	modules: Record<ModuleName, ModuleReadinessState>;
-	capabilities: Record<CapabilityKey, CapabilityState>;
-	/**
-	* True when FrameworkConfig wired a live LFV callback transport. Boolean only — the transport
-	* object, Redis URL, and credentials are never exposed.
-	*/
-	lfvCallbackTransport: boolean;
-};
-type OtelSignalName = "traces" | "metrics" | "logs";
-type OtelProtocol = "http/protobuf" | "http/json";
-type OtelProviderType = "otlp" | "grafana-lgtm" | "datadog" | "splunk" | "elastic";
-type OtelLogLevel = "trace" | "debug" | "info" | "warn" | "error";
-type OtelLevels = Partial<Record<OtelLogLevel, boolean>>;
-/** Local console mirror policy: disable it or set its minimum emitted severity. */
-type OtelConsoleMode = "off" | OtelLogLevel;
-type OtelAttributeValue = string | number | boolean | string[] | number[] | boolean[];
-type OtelAttributes = Record<string, OtelAttributeValue>;
-type OtelSignalConfig = {
-	/** Per-signal OTLP endpoint. When omitted, the module appends /v1/{signal} to `endpoint`. */
-	endpoint?: string;
-	headers?: Record<string, string>;
-	timeoutMillis?: number;
-	concurrencyLimit?: number;
-};
-type OtelMetricsSignalConfig = OtelSignalConfig & {
-	exportIntervalMillis?: number;
-	exportTimeoutMillis?: number;
-};
-type OtelOAuthClientCredentialsConfig = {
-	tokenUrl: string;
-	clientId: string;
-	clientSecret: string;
-	scope?: string;
-	audience?: string;
-	headers?: Record<string, string>;
-};
-type OtelLogRecord = {
-	severityNumber?: number;
-	severityText?: string;
-	body?: unknown;
-	attributes?: Record<string, unknown>;
-};
-/**
-* OpenTelemetry config supplied by ConfigSource/RemoteConfig.
-* Keep environment-specific URLs and credentials here, not in FrameworkConfig.
-*/
-type OtelConfig = {
-	type?: OtelProviderType;
-	name: string;
-	endpoint?: string;
-	protocol?: OtelProtocol;
-	headers?: Record<string, string>;
-	apiKey?: string;
-	/** Name of a `RemoteConfig.kms` key pool used for exporter authentication. */
-	apiKeyPool?: string;
-	apiKeyHeader?: string;
-	oauth?: OtelOAuthClientCredentialsConfig;
-	version?: string;
-	deploymentEnvironment?: string;
-	resourceAttributes?: OtelAttributes;
-	levels?: OtelLevels;
-	/** `'off'` exports only to OTel; a level dual-emits at or above that severity. Defaults to `'info'`. */
-	console?: OtelConsoleMode;
-	traces?: boolean | OtelSignalConfig;
-	metrics?: boolean | OtelMetricsSignalConfig;
-	logs?: boolean | OtelSignalConfig;
-};
-/**
-* OpenTelemetry app/runtime wiring supplied by code.
-* Instrumentation instances and callbacks live here because they are framework-specific code.
-*/
-type FrameworkOtelConfig = {
-	levels?: OtelLevels;
-	instrument?: unknown[];
-	/** Optional app-owned destination/renderer for records admitted by `RemoteConfig.otel.console`. */
-	console?: (record: OtelLogRecord) => void;
-	spanProcessors?: unknown[];
-	metricReaders?: unknown[];
-	logRecordProcessors?: unknown[];
-	sampler?: unknown;
-	textMapPropagator?: unknown;
-	contextManager?: unknown;
-	configure?: (options: Record<string, unknown>) => Record<string, unknown> | void;
-};
-type Otel = {
-	/** Secret-free, JSON-serializable configuration and readiness summary. */
-	describe(): OtelDescription;
-	beforeChange(listener: ChangeListener): () => void;
-	afterChange(listener: ChangeListener): () => void;
-	isReady(): boolean;
-	ready(timeout?: number): Promise<void>;
-	logger: Logger;
-	forceFlush(): Promise<void>;
-	shutdown(): Promise<void>;
-};
-type ModuleDescriptionBase<TModule extends ModuleName> = {
-	module: TModule;
-	active: boolean;
-	ready: boolean;
-};
-type CookieDescription = {
-	prefix?: string;
-	path?: string;
-	secure?: boolean;
-	sameSite?: "Strict" | "Lax";
-	domain?: string;
-};
-type SsoDescription = ModuleDescriptionBase<"sso"> & {
-	authority?: string;
-	tokenUrl?: string;
-	authorizationUrl?: string;
-	clientId?: string;
-	redirectUri?: string;
-	responseType?: "code";
-	scope?: string;
-	silentRedirectUri?: string;
-	jwksUri?: string;
-	endSessionEndpoint?: string;
-	revocationEndpoint?: string;
-	cookies: CookieDescription;
-	loginStateTtl?: number;
-	rotationGraceSeconds?: number;
-	sessionWindowSeconds?: number;
-	displayCookie?: DisplayCookieConfig;
-	jit: {
-		enabled: boolean;
-		userStore: boolean;
-	};
-	sessionStore: boolean;
-	urls: Partial<CapabilityEndpointUrls["sso"]>;
-};
-type CiamProviderDescription = {
-	name: string;
-	type: CIAMProviderType;
-	enabled: boolean;
-	order?: number;
-	branding?: CIAMProviderBranding;
-	authority?: string;
-	authorizationUrl?: string;
-	tokenUrl?: string;
-	jwksUri?: string;
-	userInfoUrl?: string;
-	clientId?: string;
-	scope?: string;
-	loginUrl: string;
-};
-type CiamDescription = ModuleDescriptionBase<"ciam"> & {
-	magicLinkTtl?: number;
-	loginStateTtl?: number;
-	sessionTtl?: number;
-	cookies: CookieDescription;
-	displayCookie?: DisplayCookieConfig;
-	jit: {
-		enabled: boolean;
-		customerStore: boolean;
-	};
-	sessionStore: boolean;
-	magicLinkStore: boolean;
-	providers: CiamProviderDescription[];
-	urls: Partial<CapabilityEndpointUrls["ciam"]>;
-};
-type IamPrincipalDescription = {
-	enabled: boolean;
-	assignment: "app" | "iam" | "iam-request";
-	delta?: "patch";
-	storeWired: boolean;
-};
-type IamDescription = ModuleDescriptionBase<"iam"> & {
-	url?: string;
-	deltaAudience?: string;
-	users: IamPrincipalDescription;
-	workloads: IamPrincipalDescription;
-	customers: IamPrincipalDescription;
-	groups: {
-		enabled: boolean;
-		catalogWired: boolean;
-	};
-	urls: Partial<CapabilityEndpointUrls["iam"]>;
-};
-type WorkloadTrustedIdpDescription = {
-	issuer: string;
-	jwksUri: string;
-	audience: string | string[];
-	scopesAsEntitlements?: boolean;
-};
-type WorkloadClientDescription = {
-	name: string;
-	ready: boolean;
-	clientId?: string;
-	workloadId?: string;
-	idpTokenUrl?: string;
-	scope?: string;
-	audience?: string;
-	authMethod: "client_secret" | "private_key_jwt" | "server_only";
-};
-type WorkloadDescription = ModuleDescriptionBase<"workload"> & {
-	incoming: {
-		trustedIdps: WorkloadTrustedIdpDescription[];
-	};
-	outgoing: WorkloadClientDescription[];
-	urls: Partial<CapabilityEndpointUrls["workload"]>;
-};
-type SecretsSourceDescription = {
-	name: string;
-	type: "dev" | "gcp" | "vault" | "aws" | "azure";
-	ready: boolean;
-	url?: string;
-	clientId?: string;
-	authMethod?: string;
-};
-type SecretsDescription = ModuleDescriptionBase<"secrets"> & {
-	sources: SecretsSourceDescription[];
-};
-type KmsPoolDescription = {
-	name: string;
-	source?: string;
-	path: string;
-	ready: boolean;
-};
-type KmsDescription = ModuleDescriptionBase<"kms"> & {
-	pools: KmsPoolDescription[];
-};
-type OtelSignalDescription = {
-	enabled: boolean;
-	endpoint?: string;
-	timeoutMillis?: number;
-	concurrencyLimit?: number;
-	exportIntervalMillis?: number;
-	exportTimeoutMillis?: number;
-};
-type OtelDescription = ModuleDescriptionBase<"otel"> & {
-	type?: OtelProviderType;
-	name?: string;
-	endpoint?: string;
-	protocol?: OtelProtocol;
-	apiKeyPool?: string;
-	apiKeyHeader?: string;
-	oauth?: {
-		tokenUrl: string;
-		clientId: string;
-		scope?: string;
-		audience?: string;
-	};
-	version?: string;
-	deploymentEnvironment?: string;
-	resourceAttributes?: OtelAttributes;
-	levels?: OtelLevels;
-	console?: OtelConsoleMode;
-	signals: {
-		traces: OtelSignalDescription;
-		metrics: OtelSignalDescription;
-		logs: OtelSignalDescription;
-	};
-};
-type OaaDescription = {
-	ready: boolean;
-	url?: string;
-	providerId?: string;
-	datasourceId?: string;
-	applicationName?: string;
-	applicationType?: string;
-	population?: Record<string, string>;
-	fullSync: boolean;
-};
-type AuthzDescription = ModuleDescriptionBase<"authz"> & {
-	scopesAsEntitlements: boolean;
-	trustedProvisioningClients: Array<{
-		issuer: string;
-		audience: string | string[];
-		clientId: string;
-		permissions: string[];
-	}>;
-	oaa?: OaaDescription;
-	stores: {
-		accessStore: boolean;
-		accessIndex: boolean;
-		catalogStore: boolean;
-		resources: boolean;
-	};
-};
-type TmDescription = ModuleDescriptionBase<"tm"> & {
-	enabled: boolean;
-	integrator?: {
-		id: string;
-		name?: string;
-		url: string;
-		issuer: string;
-		jwksUri: string;
-		audience: string;
-		clientId: string;
-	};
-	consentTtlSeconds?: number;
-	maxRedeemAttempts?: number;
-};
-type ModuleDescription = SsoDescription | CiamDescription | IamDescription | WorkloadDescription | SecretsDescription | KmsDescription | OtelDescription | AuthzDescription | TmDescription;
-type IoniteDescription = {
-	id?: string;
-	sdk: {
-		version: string;
-		catalogVersion: number;
-	};
-	basePath: string;
-	urls: CapabilityEndpointUrls;
-	ok: boolean;
-	applied: boolean;
-	config: ConfigApplyStatus;
-	modules: Record<ModuleName, ModuleReadinessState & {
-		description?: ModuleDescription;
-	}>;
-};
 /**
 * Shared minimal identity fields used to build both the workforce user
 * record (`BaseUser`) and the CIAM customer record (`BaseCustomer`), as well
@@ -2113,6 +1676,83 @@ interface IamDeltaEmitter {
 	ready(timeout?: number): Promise<void>;
 }
 import { StandardSchemaV1 as StandardSchemaV14 } from "@standard-schema/spec";
+type ChangeListener = () => void;
+/**
+* Reactive source/adapter contract. Implemented by config-source-backed adapters
+* (for example `SecretsSource`) to advertise change subscription and source liveness.
+* `isAvailable()` here is an adapter liveness hook and is intentionally distinct from
+* module readiness (`ModuleReadiness.isReady()` / `ready()`).
+*/
+type ReactiveHandle = {
+	beforeChange?(listener: ChangeListener): () => void;
+	afterChange?(listener: ChangeListener): () => void;
+	isAvailable?(): boolean;
+};
+/**
+* Readiness contract for reactive module/service handles whose usability depends on
+* RemoteConfig that can arrive or change at runtime (for example `ion.secrets`,
+* `ion.workload`, `ion.otel`, `ion.authz.oaa`).
+*
+* - `isReady()` is a synchronous check; use it in request handlers and health probes and
+*   return 503 (or branch) when false instead of blocking.
+* - `ready(timeout?)` resolves once the handle first becomes usable; use it at startup or
+*   as a feature gate. With no timeout it waits indefinitely; with `timeout > 0` it rejects
+*   after that many milliseconds.
+*/
+type ModuleReadiness = {
+	beforeChange?(listener: ChangeListener): () => void;
+	afterChange?(listener: ChangeListener): () => void;
+	isReady?(): boolean;
+	ready?(timeout?: number): Promise<void>;
+};
+/**
+* Canonical ionite module names used by the holistic readiness report and the
+* `requireReady([...])` helper. These are the config-driven module handles whose readiness can be
+* composed; `ion.isReady()` itself stays the narrow "config applied" signal and is NOT one of these.
+*
+* IAM-delta egress is intentionally NOT a member. Delta patch-back is best-effort and non-fatal (a
+* failed push only logs `degraded` and is reconciled by a later full sync — the Batch 7 drift-signal
+* contract), so folding it into `iam` readiness would let a delta-target outage make
+* `requireReady(['iam'])` false and take the app out of rotation for a signal that is designed not to
+* block. Apps that DO treat delta as a hard dependency can gate on `ion.iam.delta.isReady()` /
+* `ion.iam.delta.ready()` explicitly instead.
+*/
+type ModuleName = "sso" | "ciam" | "iam" | "workload" | "otel" | "secrets" | "kms" | "authz" | "tm";
+/** Per-module readiness snapshot in {@link ReadinessReport}. */
+type ModuleReadinessState = {
+	/** Whether the module is active (present/requested) in the effective config. Inactive modules never block readiness. */
+	active: boolean;
+	/** Synchronous readiness of the module right now (mirrors the module's own `isReady()`). */
+	ready: boolean;
+	/** Human-readable explanation when the module is `active` but not `ready`. */
+	reason?: string;
+};
+/**
+* Holistic, read-only readiness snapshot for an ionite instance. Returned by
+* `ion.readiness()` and used by the built-in `${basePath}/readyz` endpoint. This is composition
+* DATA, not a request gate: applications combine it (via `ion.requireReady([...])`) with their own
+* non-ionite dependency checks to build their health endpoints.
+*/
+type ReadinessReport = {
+	/** True when config has been applied (`applied`) and every ACTIVE module is ready. */
+	ok: boolean;
+	/** Whether RemoteConfig has been applied at least once (mirrors `ion.isReady()`). */
+	applied: boolean;
+	/** Per-module readiness keyed by {@link ModuleName}. */
+	modules: Record<ModuleName, ModuleReadinessState>;
+	/** Most recent config-application outcome (last applied time and last error, if any). */
+	config: ConfigApplyStatus;
+};
+/** Result of `ion.requireReady(names)`: a synchronous, declarative readiness gate over selected modules. */
+type RequireReadyResult = {
+	/** True when config is applied and every requested module is ready. */
+	ok: boolean;
+	/** The requested modules that are not ready, with reasons when available. */
+	notReady: Array<{
+		name: ModuleName;
+		reason?: string;
+	}>;
+};
 /**
 * Token caching for workload identity authentication.
 *
@@ -2418,10 +2058,16 @@ type ClientCredentialsWorkloadConfig = WorkloadConfigBase & {
 	*/
 	clientId: string;
 	/**
-	* OAuth2 client secret
-	* REQUIRED for Client Credentials mode
+	* OAuth2 client secret. Omit it to authenticate with a federated token instead
+	* (see `federatedTokenFile`). A client secret wins when both are present.
 	*/
-	clientSecret: string;
+	clientSecret?: string;
+	/**
+	* Path to a projected federated token (e.g. AKS Workload Identity), sent as a jwt-bearer
+	* `client_assertion` in place of `client_secret`. Defaults to `AZURE_FEDERATED_TOKEN_FILE`.
+	* Read on every acquisition because the platform rotates it.
+	*/
+	federatedTokenFile?: string;
 };
 /**
 * Server-Only Workload Configuration
@@ -2528,8 +2174,6 @@ interface WorkloadGetToken {
 * Workload Identity Authentication Interface
 */
 type Workload = WorkloadConfig & ModuleReadiness & Required<Pick<ModuleReadiness, "isReady" | "ready">> & {
-	/** Secret-free, JSON-serializable configuration and readiness summary. */
-	describe: () => WorkloadDescription;
 	/**
 	* Returns a token for this workload configuration.
 	* The optional argument overrides the configured default scope.
@@ -2544,9 +2188,7 @@ type Workload = WorkloadConfig & ModuleReadiness & Required<Pick<ModuleReadiness
 	/** Framework-agnostic request handler for the Workload module (token, validate, jwks, refresh). */
 	handler: (request: Request) => Promise<Response>;
 };
-type WorkloadClient = Pick<Workload, "getToken" | "refreshToken" | "generateJWTAssertion" | "revokeToken" | "beforeChange" | "afterChange" | "isReady" | "ready"> & {
-	describe(): WorkloadClientDescription;
-};
+type WorkloadClient = Pick<Workload, "getToken" | "refreshToken" | "generateJWTAssertion" | "revokeToken" | "beforeChange" | "afterChange" | "isReady" | "ready">;
 /**
 * SCIM Error response structure
 */
@@ -2977,8 +2619,6 @@ type IAMUsersInbound = {
 * - `users_inbound` is available when `userStore` is configured
 */
 type IAM = Omit<IAMConfig, "users" | "workloads" | "customers" | "groups"> & {
-	/** Secret-free, JSON-serializable configuration and readiness summary. */
-	describe: () => IamDescription;
 	users: IamPrincipalKind;
 	workloads: IamPrincipalKind;
 	customers: IamPrincipalKind;
@@ -3163,8 +2803,6 @@ type KmsPoolSlot = {
 	ready(timeout?: number): Promise<void>;
 };
 type KmsPool = {
-	/** Secret-free, JSON-serializable pool configuration and readiness summary. */
-	describe(): KmsPoolDescription;
 	/**
 	* Returns the current granted key for slot 0. Calls wait on one shared local subscription until a
 	* grant is available; repeated calls resolve from the local cache and never initiate a vault request.
@@ -3197,8 +2835,6 @@ type KmsPool = {
 * (`ion.kms.<name>`); use `getPool(name)` when the name is dynamic.
 */
 type Kms = ModuleReadiness & {
-	/** Secret-free, JSON-serializable configuration and readiness summary. */
-	describe(): KmsDescription;
 	readonly config: Readonly<KmsConfig>;
 	listPools(): string[];
 	getPool(name: string): KmsPool;
@@ -3209,6 +2845,91 @@ type Kms = ModuleReadiness & {
 declare function parseKmsPoolDocument(value: unknown): KmsPoolDocument;
 /** Parse and fail closed on a vault-stored KMS key-material document. */
 declare function parseKmsPoolControlDocument(value: unknown): KmsPoolControlDocument;
+type OtelSignalName = "traces" | "metrics" | "logs";
+type OtelProtocol = "http/protobuf" | "http/json";
+type OtelProviderType = "otlp" | "grafana-lgtm" | "datadog" | "splunk" | "elastic";
+type OtelLogLevel = "trace" | "debug" | "info" | "warn" | "error";
+type OtelLevels = Partial<Record<OtelLogLevel, boolean>>;
+/** Local console mirror policy: disable it or set its minimum emitted severity. */
+type OtelConsoleMode = "off" | OtelLogLevel;
+type OtelAttributeValue = string | number | boolean | string[] | number[] | boolean[];
+type OtelAttributes = Record<string, OtelAttributeValue>;
+type OtelSignalConfig = {
+	/** Per-signal OTLP endpoint. When omitted, the module appends /v1/{signal} to `endpoint`. */
+	endpoint?: string;
+	headers?: Record<string, string>;
+	timeoutMillis?: number;
+	concurrencyLimit?: number;
+};
+type OtelMetricsSignalConfig = OtelSignalConfig & {
+	exportIntervalMillis?: number;
+	exportTimeoutMillis?: number;
+};
+type OtelOAuthClientCredentialsConfig = {
+	tokenUrl: string;
+	clientId: string;
+	clientSecret: string;
+	scope?: string;
+	audience?: string;
+	headers?: Record<string, string>;
+};
+type OtelLogRecord = {
+	severityNumber?: number;
+	severityText?: string;
+	body?: unknown;
+	attributes?: Record<string, unknown>;
+};
+/**
+* OpenTelemetry config supplied by ConfigSource/RemoteConfig.
+* Keep environment-specific URLs and credentials here, not in FrameworkConfig.
+*/
+type OtelConfig = {
+	type?: OtelProviderType;
+	name: string;
+	endpoint?: string;
+	protocol?: OtelProtocol;
+	headers?: Record<string, string>;
+	apiKey?: string;
+	/** Name of a `RemoteConfig.kms` key pool used for exporter authentication. */
+	apiKeyPool?: string;
+	apiKeyHeader?: string;
+	oauth?: OtelOAuthClientCredentialsConfig;
+	version?: string;
+	deploymentEnvironment?: string;
+	resourceAttributes?: OtelAttributes;
+	levels?: OtelLevels;
+	/** `'off'` exports only to OTel; a level dual-emits at or above that severity. Defaults to `'info'`. */
+	console?: OtelConsoleMode;
+	traces?: boolean | OtelSignalConfig;
+	metrics?: boolean | OtelMetricsSignalConfig;
+	logs?: boolean | OtelSignalConfig;
+};
+/**
+* OpenTelemetry app/runtime wiring supplied by code.
+* Instrumentation instances and callbacks live here because they are framework-specific code.
+*/
+type FrameworkOtelConfig = {
+	levels?: OtelLevels;
+	instrument?: unknown[];
+	/** Optional app-owned destination/renderer for records admitted by `RemoteConfig.otel.console`. */
+	console?: (record: OtelLogRecord) => void;
+	spanProcessors?: unknown[];
+	metricReaders?: unknown[];
+	logRecordProcessors?: unknown[];
+	sampler?: unknown;
+	textMapPropagator?: unknown;
+	contextManager?: unknown;
+	configure?: (options: Record<string, unknown>) => Record<string, unknown> | void;
+};
+type Otel = {
+	beforeChange(listener: ChangeListener): () => void;
+	afterChange(listener: ChangeListener): () => void;
+	isReady(): boolean;
+	ready(timeout?: number): Promise<void>;
+	logger: Logger;
+	forceFlush(): Promise<void>;
+	shutdown(): Promise<void>;
+};
 /**
 * Session management for tracking user sessions and enabling backchannel logout.
 *
@@ -3769,8 +3490,6 @@ type SSO<
 	TSessionData = Record<string, never>,
 	TUserData = Record<string, never>
 > = SSOConfig<TSessionData, TUserData> & {
-	/** Secret-free, JSON-serializable configuration and readiness summary. */
-	describe: () => SsoDescription;
 	getUser: (request: Request) => Promise<WorkforceUser | undefined>;
 	/**
 	* Degraded-aware resolution: distinguishes a signed-out visitor (`unauthenticated`) from a failed
@@ -4118,12 +3837,7 @@ type SecretsValidators = {
 	*/
 	validateSourceConfig?(sourceName: string, config: SecretsSourceConfig): void;
 };
-type DescribedSecretsSource = SecretsSource & {
-	describe(): SecretsSourceDescription;
-};
 type Secrets = ModuleReadiness & {
-	/** Secret-free, JSON-serializable configuration and readiness summary. */
-	describe(): SecretsDescription;
 	/**
 	* Liveness across configured sources. Returns false when any ready source reports a degraded
 	* `isAvailable()` (e.g. an HTTP-poll source whose upstream is failing). Surfaced in
@@ -4135,7 +3849,7 @@ type Secrets = ModuleReadiness & {
 	/** Returns configured secrets source names/keys. */
 	listSecretsSources(): string[];
 	/** Gets a named secrets source client. Throws when missing. */
-	getSecretsSource(sourceName: string): DescribedSecretsSource;
+	getSecretsSource(sourceName: string): SecretsSource;
 	/** Creates a lazy handle for a secret in a named source. */
 	get(sourceName: string, path: string, options?: SecretsOperationOptions): SecretHandle;
 	/** Reads a secret from a named secrets source client. */
@@ -5099,8 +4813,6 @@ type CIAM<
 	TMagicLinkData = Record<string, never>,
 	TCustomerData = Record<string, never>
 > = CIAMConfig<TMagicLinkData, TCustomerData> & {
-	/** Secret-free, JSON-serializable configuration and readiness summary. */
-	describe: () => CiamDescription;
 	getCustomer: (request: Request) => Promise<Customer | undefined>;
 	/**
 	* Degraded-aware resolution: distinguishes a signed-out visitor (`unauthenticated`) from a failed
@@ -5244,15 +4956,6 @@ type IoniteBase = {
 	* module is ready; `notReady` lists the requested modules that are not ready, with reasons.
 	*/
 	requireReady(names: ModuleName[]): RequireReadyResult;
-	/**
-	* Returns an allow-listed, JSON-serializable snapshot for privileged App-owned diagnostics.
-	* Unlike `config`, this never contains credentials, secret values, stores, or callbacks.
-	*
-	* Diagnostics only: each call rebuilds the readiness report and every module projection. Call it
-	* from an admin loader, never per request; handlers and health probes use `isReady()` /
-	* `requireReady()`.
-	*/
-	describe(): IoniteDescription;
 	/** Most recent RemoteConfig application outcome (last applied time and last error, if any). */
 	configStatus: ConfigApplyStatus;
 	/** Release config subscriptions and background resources. */
@@ -5564,8 +5267,6 @@ type TenantIntegrationView = {
 	integration: TenantIntegration;
 };
 type TenantManagement<TTenant extends BaseTenant = BaseTenant> = ModuleReadiness & {
-	/** Secret-free, JSON-serializable configuration and readiness summary. */
-	describe(): TmDescription;
 	handler(request: Request): Promise<Response>;
 	getTenant(id: string): Promise<TTenant | undefined>;
 	recordConsent(input: RecordTenantConsentInput): Promise<TTenant>;
@@ -6242,8 +5943,6 @@ interface OaaClient<
 	TCustomer = BaseCustomer,
 	TWorkload = BaseWorkloadIdentity
 > {
-	/** Secret-free, JSON-serializable OAA configuration and readiness summary. */
-	describe(): OaaDescription;
 	pushUser(user: TUser): Promise<void>;
 	pushCustomer(customer: TCustomer): Promise<void>;
 	pushWorkload(workload: TWorkload): Promise<void>;
@@ -6362,8 +6061,6 @@ type ReconcileReport = {
 * wired they deny by default (`{ allow: false }`, `metadata.reason = 'access_index_not_configured'`).
 */
 type Authz = {
-	/** Secret-free, JSON-serializable configuration and readiness summary. */
-	describe(): AuthzDescription;
 	oaa: OaaClient;
 	/** Read the effective catalog union (materialized rows plus unmaterialized code templates). */
 	entitlements: {
@@ -6497,6 +6194,64 @@ declare function trustedClientPermissionsForPrincipal(authz: AuthzConfig | null
 * OAA full sync — they are NEVER written to a store or materialized into the AccessIndex.
 */
 declare function configTrustedClientGrants(authz: AuthzConfig | null | undefined): AccessChange[];
+type CapabilityKey = "sso.login" | "sso.jit" | "sso.logout" | "sso.back_channel_logout" | "ciam.magic_link" | "ciam.oidc_login" | "ciam.customer" | "ciam.logout" | "iam.users" | "iam.groups" | "iam.workloads" | "iam.customers" | "workload.incoming" | "workload.outgoing" | "authz.oaa" | "tm.integration";
+type CapabilityEndpointUrls = {
+	readyzUrl: string;
+	capabilitiezUrl: string;
+	sso: {
+		loginUrl: string;
+		userUrl: string;
+		logoutUrl: string;
+		logoutBackChannelUrl: string;
+		refreshUrl: string;
+		callbackUrl: string;
+	};
+	workload: {
+		validateUrl: string;
+		jwksUrl: string;
+	};
+	iam: {
+		basePath: string;
+		usersUrl: string;
+		groupsUrl: string;
+		workloadsUrl: string;
+		customersUrl: string;
+	};
+	ciam: {
+		magicLinkUrl: string;
+		magicLinkLoginUrl: string;
+		customerUrl: string;
+		customerLoginUrl: string;
+		customerCallbackUrl: string;
+		customerProvidersUrl: string;
+		logoutUrl: string;
+	};
+};
+type CapabilityState = {
+	module: ModuleName;
+	active: boolean;
+	ready: boolean;
+	testable: boolean;
+	urls?: string[];
+	reason?: string;
+};
+type CapabilitiezManifest = {
+	sdk: {
+		/** Runtime @ionite/server version serving this manifest. */
+		version: string;
+		/** Version of the stable capability/test-unit vocabulary. */
+		catalogVersion: number;
+	};
+	basePath: string;
+	urls: CapabilityEndpointUrls;
+	modules: Record<ModuleName, ModuleReadinessState>;
+	capabilities: Record<CapabilityKey, CapabilityState>;
+	/**
+	* True when FrameworkConfig wired a live LFV callback transport. Boolean only — the transport
+	* object, Redis URL, and credentials are never exposed.
+	*/
+	lfvCallbackTransport: boolean;
+};
 /**
 * Fields a {@link ConfigSource} may attach to a thrown error so the SDK can classify load/subscribe
 * failures structurally instead of by fragile message-substring matching (§2.1). All fields are
@@ -6865,4 +6620,4 @@ type LfvErrorResponse = {
 };
 /** Generates a ULID */
 declare function generateULID(prefix?: string): string;
-export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestResult, AccessStatus, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzDescription, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, CiamDescription, CiamProviderDescription, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CookieDescription, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, DescribedSecretsSource, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamDescription, IamPrincipalDescription, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InferSecretType, Ionite, IoniteBase, IoniteDescription, IoniteError, IoniteErrorOptions, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsDescription, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDescription, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleDescription, ModuleDescriptionBase, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaDescription, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelDescription, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalDescription, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsDescription, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceDescription, SecretsSourceMap, SecretsSourceType, SecretsSubscriptionOptions, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, SsoDescription, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmDescription, TmIntegratorConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWebSocketAuthHeader, VaultWebSocketSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadClientDescription, WorkloadConfig, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadTrustedIdpDescription, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, discoveredProfileCookieName, encodeDisplayCookie, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };
+export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestResult, AccessStatus, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InferSecretType, Ionite, IoniteBase, IoniteError, IoniteErrorOptions, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceMap, SecretsSourceType, SecretsSubscriptionOptions, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmIntegratorConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWebSocketAuthHeader, VaultWebSocketSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadConfig, WorkloadConfigMap, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, discoveredProfileCookieName, encodeDisplayCookie, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };