@ionite/core 0.0.24-beta.20260930.19 → 0.0.24-beta.20261003.16

package/dist/index.d.ts

@@ -16,6 +16,212 @@ declare const KNOWN_WORKLOAD_KEYS: readonly ["id", "clientId", "displayName", "d
 declare function customAttributes(value: object, knownKeys: readonly PropertyKey[]): Record<string, unknown> | undefined;
 import { StandardSchemaV1 as StandardSchemaV19 } from "@standard-schema/spec";
 import { StandardSchemaV1 as StandardSchemaV18 } from "@standard-schema/spec";
+/**
+* Third-party CIAM provider presets and claim mapping.
+*
+* Defines the built-in provider adapters used by the CIAM module for customer
+* login. Each preset supplies default OIDC/OAuth2 endpoints, scope, branding,
+* and a claim mapper that normalizes provider claims into a candidate customer.
+* The application's `CustomerStore` remains the system of record: the SDK only
+* extracts standard claims and hands a candidate to `lookup`/`upsert`.
+*/
+/** Built-in provider types. `oidc` is a generic OIDC provider; `magic-link` is the passwordless flow. */
+type CIAMProviderType = "oidc" | "google" | "github" | "microsoft" | "apple" | "magic-link";
+/** Branding colors for rendering a provider button in light and dark themes. */
+type CIAMProviderColors = {
+	/** Background/brand color for light theme (hex or CSS color). */
+	light: string;
+	/** Background/brand color for dark theme (hex or CSS color). */
+	dark: string;
+	/** Optional secondary/accent color. */
+	secondary?: string;
+};
+/** Operator-supplied branding so the UI can render a provider list without hardcoding. */
+type CIAMProviderBranding = {
+	/** Human-readable name shown on the login button (e.g. "Google"). */
+	displayName: string;
+	/** External icon URL (typically an SVG/PNG hosted on a CDN). */
+	iconUrl?: string;
+	/** Light/dark brand colors. */
+	colors?: CIAMProviderColors;
+	/** Optional provider info/marketing URL. */
+	url?: string;
+};
+/**
+* A single CIAM provider declaration. OIDC/OAuth2 endpoint and credential
+* fields come from the ConfigSource (never application code).
+*/
+type CIAMProviderConfig = {
+	/** Provider adapter type. Selects defaults and claim mapping. */
+	type: CIAMProviderType;
+	/** Whether this provider is enabled. Defaults to true when omitted. */
+	enabled?: boolean;
+	/** Recommended display order (ascending). Ties broken by declaration order. */
+	order?: number;
+	/** UI branding metadata. */
+	branding?: CIAMProviderBranding;
+	/** OIDC issuer/authority (used for discovery when explicit endpoints are omitted). */
+	authority?: string;
+	/** Authorization endpoint (overrides preset). */
+	authorizationUrl?: string;
+	/** Token endpoint (overrides preset). */
+	tokenUrl?: string;
+	/** JWKS endpoint for ID token verification (overrides preset). */
+	jwksUri?: string;
+	/** OAuth2 UserInfo endpoint for providers without an ID token (e.g. GitHub). */
+	userInfoUrl?: string;
+	/** OAuth2 client id (ConfigSource-only). */
+	clientId?: string;
+	/** OAuth2 client secret (ConfigSource-only). */
+	clientSecret?: string;
+	/** Requested scope (overrides preset). */
+	scope?: string;
+	/** Apple: team id for client-secret generation. */
+	teamId?: string;
+	/** Apple: key id for client-secret generation. */
+	keyId?: string;
+	/** Apple: PKCS#8 PEM private key for client-secret generation. */
+	privateKey?: string;
+};
+/** Sanitized provider entry returned by the discovery endpoint for the UI. */
+type CIAMProviderDescriptor = {
+	/** Provider key (matches the RemoteConfig map key); used as `?provider=`. */
+	name: string;
+	type: CIAMProviderType;
+	displayName: string;
+	/** SDK-derived login URL to navigate to (begins the flow). */
+	loginUrl: string;
+	iconUrl?: string;
+	colors?: CIAMProviderColors;
+	url?: string;
+};
+/**
+* Light display cookies (`${cookiesPrefix}.profile`).
+*
+* The envelope is SDK-owned. App code supplies only `user`. The cookie is not an
+* authentication input: the server never reads it to resolve a session, and the browser
+* may forge it. `expiresAt` is display metadata so a client can order entries without a
+* round trip; authoritative expiry is the peer `${cookiesPrefix}.session` record.
+*/
+declare const DISPLAY_COOKIE_SUFFIX = ".profile";
+declare const DISPLAY_COOKIE_VERSION = 1;
+declare const DEFAULT_DISPLAY_COOKIE_MAX = 10;
+declare const DEFAULT_DISCOVERED_COOKIE_MAX = 10;
+declare const DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS: number;
+declare const DISCOVERED_COOKIE_PREFIX = "ion.discovered";
+type DisplayCookieConfig = {
+	/**
+	* When true, the SDK writes a non-HttpOnly display cookie beside the opaque session cookie.
+	* ConfigSource-only. Default false.
+	*/
+	enabled?: boolean;
+	/**
+	* How many display cookies a single response may leave on the browser, newest session window
+	* first. ConfigSource-only. Values below 1 fall back to {@link DEFAULT_DISPLAY_COOKIE_MAX}.
+	* @default 10
+	*/
+	max?: number;
+	/**
+	* Session-less tenant hints written by an App after an explicit directory lookup.
+	* ConfigSource-only and off unless `enabled` is true.
+	*/
+	discovered?: DiscoveredDisplayCookieConfig;
+};
+type DiscoveredDisplayCookieConfig = {
+	enabled?: boolean;
+	/** Browser hint lifetime. This is not a session expiry. @default 14400 */
+	ttlSeconds?: number;
+	/** Independent cap; discovered hints never displace live-session entries. @default 10 */
+	max?: number;
+};
+/** What `${basePath}/auth/user` and `${basePath}/auth/customer` return. ConfigSource-only. */
+type UserEndpointPolicy = "full" | "display" | "off";
+type DisplayUser = Record<string, string | number | boolean | null>;
+type DisplayAuthType = "sso" | "ciam";
+type DisplayCookieEnvelope = {
+	v: typeof DISPLAY_COOKIE_VERSION;
+	/**
+	* Session envelopes omit this field (absent means `'session'`) so the wire format stays identical
+	* to cookies written before discovered hints existed; only discovered hints set it explicitly.
+	* Readers must treat `undefined` as `'session'`.
+	*/
+	kind?: "session" | "discovered";
+	tenantId?: string;
+	authType: DisplayAuthType;
+	/** ISO timestamp copied from the session window at write time. Display only. */
+	expiresAt: string;
+	user: DisplayUser;
+	tenantName?: string;
+};
+type DisplayIdentity = {
+	name?: string;
+	email?: string;
+	avatar?: string;
+};
+declare function resolveDisplayCookieMax(max: number | undefined): number;
+declare function resolveDiscoveredCookieMax(max: number | undefined): number;
+declare function resolveDiscoveredCookieTtlSeconds(ttlSeconds: number | undefined): number;
+declare function defaultDisplayUser(identity: DisplayIdentity): DisplayUser;
+/** Drop non-primitives and auth-bearing keys. Display cookies carry UI fields only. */
+declare function sanitizeDisplayUser(value: unknown): DisplayUser;
+/**
+* AppDev projection runs on the full user (including custom attributes). When omitted, or when it
+* throws, the cookie carries name, email, and avatar only. Forbidden and non-primitive fields are
+* dropped either way — a projector cannot put a session id or token into the cookie.
+*/
+declare function projectDisplayUser<TUser extends object>(user: TUser, projector?: (user: TUser) => unknown): DisplayUser;
+declare function encodeDisplayCookie(envelope: DisplayCookieEnvelope): string;
+declare function decodeDisplayCookie(raw: string): DisplayCookieEnvelope | undefined;
+type ParsedDisplayCookie = {
+	name: string;
+	prefix: string;
+	envelope: DisplayCookieEnvelope;
+};
+declare function readDisplayCookies(cookieHeader: string | null | undefined): ParsedDisplayCookie[];
+/** Client ordering: newest session window first. Invalid timestamps sort last. */
+declare function compareDisplayExpiryDesc(a: string | undefined, b: string | undefined): number;
+declare function profileCookieName(cookiesPrefix: string): string;
+declare function discoveredProfileCookieName(tenantId: string): string;
+/**
+* Minimal logger interface compatible with common structured logging patterns.
+*/
+interface Logger {
+	trace(message?: unknown, ...optionalParams: unknown[]): void;
+	debug(message?: unknown, ...optionalParams: unknown[]): void;
+	info(message?: unknown, ...optionalParams: unknown[]): void;
+	warn(message?: unknown, ...optionalParams: unknown[]): void;
+	error(message?: unknown, ...optionalParams: unknown[]): void;
+}
+/**
+* Renders a structured logger call as one greppable line while leaving the source fields separate
+* for telemetry exporters.
+*/
+declare function formatLogLine(level: keyof Logger, message: unknown, optionalParams?: unknown[], timestamp?: Date): string;
+/**
+* No-op implementation — does nothing for any log level
+*/
+declare const silentLogger: Logger;
+/**
+* Default logger used until an ionite instance is configured with
+* an OpenTelemetry-backed logger or an application-provided logger.
+*/
+declare const defaultLogger: Logger;
+/**
+* Logger that logs messages debug, info, warn, and error to the console.
+*/
+declare const debugLogger: Logger;
+/**
+* Logger that logs messages info, warn, and error to the console.
+*/
+declare const infoLogger: Logger;
+/**
+* Logger that logs messages warn and error to the console.
+*/
+declare const warnLogger: Logger;
+/**
+* Human-readable single-line console logger for local application output.
+*/
+declare const prettyLogger: Logger;
 /** Synchronous, in-memory read surface for one code catalog entity kind. */
 type CodeCatalogNamespace<TEntity> = {
 	get(id: string): TEntity | undefined;
@@ -94,6 +300,7 @@ declare function deprecateRetiredCodeCatalogRows(code: CodeCatalog | undefined,
 * visible. Returns undefined when neither source is wired.
 */
 declare function unionCatalogRead(code: CodeCatalog | undefined, store: AccessCatalogStore | undefined): AccessCatalogStore | undefined;
+import { StandardSchemaV1 as StandardSchemaV15 } from "@standard-schema/spec";
 /**
 * Resolve an access subject/target/resource reference (a string id or an object carrying one) to its
 * canonical, trimmed string id. This is the single id-resolution rule shared across the authz stack
@@ -109,54 +316,6 @@ declare function accessRefId(value: unknown): string;
 */
 declare function accessRootId(change: AccessChange): string;
 /**
-* ConfigSource-only block that lets an issuing IdP's token claims satisfy `has*` checks.
-* Placed independently on `sso`, each CIAM provider, and each incoming workload IdP.
-* Absent means that issuer's claims never satisfy entitlements.
-*
-* Derived rows are session-scoped for users and customers (expanded onto the session at login
-* and refresh) and per-request for workloads. They are never written to the access stores.
-*/
-type ClaimsAsEntitlements = {
-	/**
-	* Claim names to read. A dotted path addresses a nested claim (`realm_access.roles`).
-	* `scope` is space-delimited; every other string claim is one value; arrays contribute each string.
-	* Required and non-empty.
-	*/
-	claims: string[];
-	/**
-	* Expand a matched catalog role or group into the permissions it confers.
-	* Default false: a claim value matches only the catalog id it names.
-	*/
-	expand?: boolean;
-	/**
-	* Let catalog-bound resources on expanded rows satisfy resource-scoped checks.
-	* Default false. Ignored unless `expand` is true: a claim string cannot name a resource.
-	*/
-	resources?: boolean;
-};
-/** One effective entitlement derived from a token claim. Not a stored grant. */
-type DerivedEntitlement = {
-	targetType: OaaAccessTargetType;
-	target: string;
-	/** Set only when the plane opted into `resources` and the catalog row binds this resource. */
-	resource?: string;
-	/** Claim name the value was read from. */
-	claim: string;
-	/** Expansion root id when the row came from catalog expansion. Absent for a direct id match. */
-	root?: string;
-};
-/** Secret-free projection of a configured claims block, including whether the App can persist it. */
-type ClaimsAsEntitlementsDescription = {
-	claims: string[];
-	expand: boolean;
-	resources: boolean;
-	/**
-	* User and customer planes: the session store declares it persists `Session.entitlements`.
-	* Workload plane: always true (nothing is stored).
-	*/
-	capable: boolean;
-};
-/**
 * Shared minimal identity fields used to build both the workforce user
 * record (`BaseUser`) and the CIAM customer record (`BaseCustomer`), as well
 * as the authenticated session types (`WorkforceUser`, `Customer`).
@@ -971,10 +1130,11 @@ type WorkloadIdentity = {
 	/** Granted OAuth scopes (space-delimited). */
 	scope?: string;
 	/**
-	* Claim-derived entitlements for this request. Present only when the matched incoming IdP
-	* configured `claimsAsEntitlements`. Never persisted.
+	* Whether the trusted IdP that validated this token opts into honoring its OAuth `scope` claim as
+	* entitlements (per-IdP intent, resolved at validation time). Consumed by the request-level `has*`
+	* helpers; `undefined` falls back to the global `RemoteConfig.authz.scopesAsEntitlements`.
 	*/
-	derivedEntitlements?: DerivedEntitlement[];
+	scopesAsEntitlements?: boolean;
 	/**
 	* Enterprise Controlled ID for this workload (`ecid:<realm>:<opaque>`), when carried on the token
 	* `ecid` claim or enriched from a wired `WorkloadIdentityStore`. A workload is its own governance
@@ -1420,12 +1580,6 @@ interface WorkloadIdentityStore<TExtended = object> {
 * policy (flag, auto-revoke + notify, or simply audit).
 */
 type IamDeltaMode = "patch";
-/** ConfigSource-owned authenticated destination for the AccessRequests protocol. */
-type AccessRequestsDestination = {
-	url: string;
-	/** Named outgoing workload client. Omit to use the default workload server identity. */
-	audience?: string;
-};
 type AccessRequestCreate = {
 	subject: string;
 	subjectType: SubjectType;
@@ -1512,8 +1666,6 @@ interface IamDeltaEmitter {
 	* whose IAM aggregates by pull alone may still submit requests.
 	*/
 	requestAccess(input: AccessRequestCreate): Promise<AccessRequestResult>;
-	/** Read the current state of a request previously submitted to this destination. */
-	getAccessRequest(id: string): Promise<AccessRequestResult>;
 	/**
 	* Read a previously captured destination reference without making a network request. Returns
 	* undefined until the resource has been resolved or pushed to the configured IAM destination.
@@ -1523,657 +1675,84 @@ interface IamDeltaEmitter {
 	isReady(): boolean;
 	ready(timeout?: number): Promise<void>;
 }
-/** Built-in provider types. `oidc` is a generic OIDC provider; `magic-link` is the passwordless flow. */
-type CIAMProviderType = "oidc" | "google" | "github" | "microsoft" | "apple" | "magic-link";
-/** Branding colors for rendering a provider button in light and dark themes. */
-type CIAMProviderColors = {
-	/** Background/brand color for light theme (hex or CSS color). */
-	light: string;
-	/** Background/brand color for dark theme (hex or CSS color). */
-	dark: string;
-	/** Optional secondary/accent color. */
-	secondary?: string;
-};
-/** Operator-supplied branding so the UI can render a provider list without hardcoding. */
-type CIAMProviderBranding = {
-	/** Human-readable name shown on the login button (e.g. "Google"). */
-	displayName: string;
-	/** External icon URL (typically an SVG/PNG hosted on a CDN). */
-	iconUrl?: string;
-	/** Light/dark brand colors. */
-	colors?: CIAMProviderColors;
-	/** Optional provider info/marketing URL. */
-	url?: string;
-};
-/**
-* A single CIAM provider declaration. OIDC/OAuth2 endpoint and credential
-* fields come from the ConfigSource (never application code).
-*/
-type CIAMProviderConfig = {
-	/** Provider adapter type. Selects defaults and claim mapping. */
-	type: CIAMProviderType;
-	/** Whether this provider is enabled. Defaults to true when omitted. */
-	enabled?: boolean;
-	/** Recommended display order (ascending). Ties broken by declaration order. */
-	order?: number;
-	/** UI branding metadata. */
-	branding?: CIAMProviderBranding;
-	/** OIDC issuer/authority (used for discovery when explicit endpoints are omitted). */
-	authority?: string;
-	/** Authorization endpoint (overrides preset). */
-	authorizationUrl?: string;
-	/** Token endpoint (overrides preset). */
-	tokenUrl?: string;
-	/** JWKS endpoint for ID token verification (overrides preset). */
-	jwksUri?: string;
-	/** OAuth2 UserInfo endpoint for providers without an ID token (e.g. GitHub). */
-	userInfoUrl?: string;
-	/** OAuth2 client id (ConfigSource-only). */
-	clientId?: string;
-	/** OAuth2 client secret (ConfigSource-only). */
-	clientSecret?: string;
-	/** Requested scope (overrides preset). */
-	scope?: string;
-	/** Apple: team id for client-secret generation. */
-	teamId?: string;
-	/** Apple: key id for client-secret generation. */
-	keyId?: string;
-	/** Apple: PKCS#8 PEM private key for client-secret generation. */
-	privateKey?: string;
-	/**
-	* ConfigSource-only. When set, this provider's token claims are derived into session-scoped
-	* customer entitlements at login. Magic link has no issuer and ignores this block.
-	*/
-	claimsAsEntitlements?: ClaimsAsEntitlements;
-	/** ConfigSource-only IdP assignment workflow used when IAM assignment is `'idp'`. */
-	accessRequests?: AccessRequestsDestination;
-};
-/** Sanitized provider entry returned by the discovery endpoint for the UI. */
-type CIAMProviderDescriptor = {
-	/** Provider key (matches the RemoteConfig map key); used as `?provider=`. */
-	name: string;
-	type: CIAMProviderType;
-	displayName: string;
-	/** SDK-derived login URL to navigate to (begins the flow). */
-	loginUrl: string;
-	iconUrl?: string;
-	colors?: CIAMProviderColors;
-	url?: string;
-};
-/**
-* Light display cookies (`${cookiesPrefix}.profile`).
-*
-* The envelope is SDK-owned. App code supplies only `user`. The cookie is not an
-* authentication input: the server never reads it to resolve a session, and the browser
-* may forge it. `expiresAt` is display metadata so a client can order entries without a
-* round trip; authoritative expiry is the peer `${cookiesPrefix}.session` record.
-*/
-declare const DISPLAY_COOKIE_SUFFIX = ".profile";
-declare const DISPLAY_COOKIE_VERSION = 1;
-declare const DEFAULT_DISPLAY_COOKIE_MAX = 10;
-declare const DEFAULT_DISCOVERED_COOKIE_MAX = 10;
-declare const DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS: number;
-declare const DISCOVERED_COOKIE_PREFIX = "ion.discovered";
-type DisplayCookieConfig = {
-	/**
-	* When true, the SDK writes a non-HttpOnly display cookie beside the opaque session cookie.
-	* ConfigSource-only. Default false.
-	*/
-	enabled?: boolean;
-	/**
-	* How many display cookies a single response may leave on the browser, newest session window
-	* first. ConfigSource-only. Values below 1 fall back to {@link DEFAULT_DISPLAY_COOKIE_MAX}.
-	* @default 10
-	*/
-	max?: number;
-	/**
-	* Session-less tenant hints written by an App after an explicit directory lookup.
-	* ConfigSource-only and off unless `enabled` is true.
-	*/
-	discovered?: DiscoveredDisplayCookieConfig;
-};
-type DiscoveredDisplayCookieConfig = {
-	enabled?: boolean;
-	/** Browser hint lifetime. This is not a session expiry. @default 14400 */
-	ttlSeconds?: number;
-	/** Independent cap; discovered hints never displace live-session entries. @default 10 */
-	max?: number;
-};
-/** What `${basePath}/auth/user` and `${basePath}/auth/customer` return. ConfigSource-only. */
-type UserEndpointPolicy = "full" | "display" | "off";
-type DisplayUser = Record<string, string | number | boolean | null>;
-type DisplayAuthType = "sso" | "ciam";
-type DisplayCookieEnvelope = {
-	v: typeof DISPLAY_COOKIE_VERSION;
-	/**
-	* Session envelopes omit this field (absent means `'session'`) so the wire format stays identical
-	* to cookies written before discovered hints existed; only discovered hints set it explicitly.
-	* Readers must treat `undefined` as `'session'`.
-	*/
-	kind?: "session" | "discovered";
-	tenantId?: string;
-	authType: DisplayAuthType;
-	/** ISO timestamp copied from the session window at write time. Display only. */
-	expiresAt: string;
-	user: DisplayUser;
-	tenantName?: string;
-};
-type DisplayIdentity = {
-	name?: string;
-	email?: string;
-	avatar?: string;
-};
-declare function resolveDisplayCookieMax(max: number | undefined): number;
-declare function resolveDiscoveredCookieMax(max: number | undefined): number;
-declare function resolveDiscoveredCookieTtlSeconds(ttlSeconds: number | undefined): number;
-declare function defaultDisplayUser(identity: DisplayIdentity): DisplayUser;
-/** Drop non-primitives and auth-bearing keys. Display cookies carry UI fields only. */
-declare function sanitizeDisplayUser(value: unknown): DisplayUser;
-/**
-* AppDev projection runs on the full user (including custom attributes). When omitted, or when it
-* throws, the cookie carries name, email, and avatar only. Forbidden and non-primitive fields are
-* dropped either way — a projector cannot put a session id or token into the cookie.
-*/
-declare function projectDisplayUser<TUser extends object>(user: TUser, projector?: (user: TUser) => unknown): DisplayUser;
-declare function encodeDisplayCookie(envelope: DisplayCookieEnvelope): string;
-declare function decodeDisplayCookie(raw: string): DisplayCookieEnvelope | undefined;
-type ParsedDisplayCookie = {
-	name: string;
-	prefix: string;
-	envelope: DisplayCookieEnvelope;
-};
-declare function readDisplayCookies(cookieHeader: string | null | undefined): ParsedDisplayCookie[];
-/** Client ordering: newest session window first. Invalid timestamps sort last. */
-declare function compareDisplayExpiryDesc(a: string | undefined, b: string | undefined): number;
-declare function profileCookieName(cookiesPrefix: string): string;
-declare function discoveredProfileCookieName(tenantId: string): string;
-/**
-* Minimal logger interface compatible with common structured logging patterns.
-*/
-interface Logger {
-	trace(message?: unknown, ...optionalParams: unknown[]): void;
-	debug(message?: unknown, ...optionalParams: unknown[]): void;
-	info(message?: unknown, ...optionalParams: unknown[]): void;
-	warn(message?: unknown, ...optionalParams: unknown[]): void;
-	error(message?: unknown, ...optionalParams: unknown[]): void;
-}
-/**
-* Renders a structured logger call as one greppable line while leaving the source fields separate
-* for telemetry exporters.
-*/
-declare function formatLogLine(level: keyof Logger, message: unknown, optionalParams?: unknown[], timestamp?: Date): string;
-/**
-* No-op implementation — does nothing for any log level
-*/
-declare const silentLogger: Logger;
-/**
-* Default logger used until an ionite instance is configured with
-* an OpenTelemetry-backed logger or an application-provided logger.
-*/
-declare const defaultLogger: Logger;
-/**
-* Logger that logs messages debug, info, warn, and error to the console.
-*/
-declare const debugLogger: Logger;
-/**
-* Logger that logs messages info, warn, and error to the console.
-*/
-declare const infoLogger: Logger;
-/**
-* Logger that logs messages warn and error to the console.
-*/
-declare const warnLogger: Logger;
-/**
-* Human-readable single-line console logger for local application output.
-*/
-declare const prettyLogger: Logger;
-import { StandardSchemaV1 as StandardSchemaV15 } from "@standard-schema/spec";
-type ChangeListener = () => void;
+import { StandardSchemaV1 as StandardSchemaV14 } from "@standard-schema/spec";
+type ChangeListener = () => void;
 /**
 * Reactive source/adapter contract. Implemented by config-source-backed adapters
 * (for example `SecretsSource`) to advertise change subscription and source liveness.
 * `isAvailable()` here is an adapter liveness hook and is intentionally distinct from
 * module readiness (`ModuleReadiness.isReady()` / `ready()`).
-*/
-type ReactiveHandle = {
-	beforeChange?(listener: ChangeListener): () => void;
-	afterChange?(listener: ChangeListener): () => void;
-	isAvailable?(): boolean;
-};
-/**
-* Readiness contract for reactive module/service handles whose usability depends on
-* RemoteConfig that can arrive or change at runtime (for example `ion.secrets`,
-* `ion.workload`, `ion.otel`, `ion.authz.oaa`).
-*
-* - `isReady()` is a synchronous check; use it in request handlers and health probes and
-*   return 503 (or branch) when false instead of blocking.
-* - `ready(timeout?)` resolves once the handle first becomes usable; use it at startup or
-*   as a feature gate. With no timeout it waits indefinitely; with `timeout > 0` it rejects
-*   after that many milliseconds.
-*/
-type ModuleReadiness = {
-	beforeChange?(listener: ChangeListener): () => void;
-	afterChange?(listener: ChangeListener): () => void;
-	isReady?(): boolean;
-	ready?(timeout?: number): Promise<void>;
-};
-/**
-* Canonical ionite module names used by the holistic readiness report and the
-* `requireReady([...])` helper. These are the config-driven module handles whose readiness can be
-* composed; `ion.isReady()` itself stays the narrow "config applied" signal and is NOT one of these.
-*
-* IAM-delta egress is intentionally NOT a member. Delta patch-back is best-effort and non-fatal (a
-* failed push only logs `degraded` and is reconciled by a later full sync — the Batch 7 drift-signal
-* contract), so folding it into `iam` readiness would let a delta-target outage make
-* `requireReady(['iam'])` false and take the app out of rotation for a signal that is designed not to
-* block. Apps that DO treat delta as a hard dependency can gate on `ion.iam.delta.isReady()` /
-* `ion.iam.delta.ready()` explicitly instead.
-*/
-type ModuleName = "sso" | "ciam" | "iam" | "workload" | "otel" | "secrets" | "kms" | "authz" | "tm";
-/** Per-module readiness snapshot in {@link ReadinessReport}. */
-type ModuleReadinessState = {
-	/** Whether the module is active (present/requested) in the effective config. Inactive modules never block readiness. */
-	active: boolean;
-	/** Synchronous readiness of the module right now (mirrors the module's own `isReady()`). */
-	ready: boolean;
-	/** Human-readable explanation when the module is `active` but not `ready`. */
-	reason?: string;
-};
-/**
-* Holistic, read-only readiness snapshot for an ionite instance. Returned by
-* `ion.readiness()` and used by the built-in `${basePath}/readyz` endpoint. This is composition
-* DATA, not a request gate: applications combine it (via `ion.requireReady([...])`) with their own
-* non-ionite dependency checks to build their health endpoints.
-*/
-type ReadinessReport = {
-	/** True when config has been applied (`applied`) and every ACTIVE module is ready. */
-	ok: boolean;
-	/** Whether RemoteConfig has been applied at least once (mirrors `ion.isReady()`). */
-	applied: boolean;
-	/** Per-module readiness keyed by {@link ModuleName}. */
-	modules: Record<ModuleName, ModuleReadinessState>;
-	/** Most recent config-application outcome (last applied time and last error, if any). */
-	config: ConfigApplyStatus;
-};
-/** Result of `ion.requireReady(names)`: a synchronous, declarative readiness gate over selected modules. */
-type RequireReadyResult = {
-	/** True when config is applied and every requested module is ready. */
-	ok: boolean;
-	/** The requested modules that are not ready, with reasons when available. */
-	notReady: Array<{
-		name: ModuleName;
-		reason?: string;
-	}>;
-};
-type CapabilityKey = "sso.login" | "sso.jit" | "sso.logout" | "sso.back_channel_logout" | "sso.claims_authz" | "ciam.magic_link" | "ciam.oidc_login" | "ciam.customer" | "ciam.logout" | "ciam.claims_authz" | "iam.users" | "iam.groups" | "iam.workloads" | "iam.customers" | "workload.incoming" | "workload.outgoing" | "workload.claims_authz" | "authz.oaa" | "authz.access_requests" | "tm.integration";
-type CapabilityEndpointUrls = {
-	readyzUrl: string;
-	capabilitiezUrl: string;
-	sso: {
-		loginUrl: string;
-		userUrl: string;
-		logoutUrl: string;
-		logoutBackChannelUrl: string;
-		refreshUrl: string;
-		callbackUrl: string;
-	};
-	workload: {
-		validateUrl: string;
-		jwksUrl: string;
-	};
-	iam: {
-		basePath: string;
-		usersUrl: string;
-		groupsUrl: string;
-		workloadsUrl: string;
-		customersUrl: string;
-	};
-	ciam: {
-		magicLinkUrl: string;
-		magicLinkLoginUrl: string;
-		customerUrl: string;
-		customerLoginUrl: string;
-		customerCallbackUrl: string;
-		customerProvidersUrl: string;
-		logoutUrl: string;
-	};
-};
-type CapabilityState = {
-	module: ModuleName;
-	active: boolean;
-	ready: boolean;
-	testable: boolean;
-	urls?: string[];
-	reason?: string;
-};
-type CapabilitiezManifest = {
-	sdk: {
-		/** Runtime @ionite/server version serving this manifest. */
-		version: string;
-		/** Version of the stable capability/test-unit vocabulary. */
-		catalogVersion: number;
-	};
-	basePath: string;
-	urls: CapabilityEndpointUrls;
-	modules: Record<ModuleName, ModuleReadinessState>;
-	capabilities: Record<CapabilityKey, CapabilityState>;
-	/**
-	* True when FrameworkConfig wired a live LFV callback transport. Boolean only — the transport
-	* object, Redis URL, and credentials are never exposed.
-	*/
-	lfvCallbackTransport: boolean;
-};
-type OtelSignalName = "traces" | "metrics" | "logs";
-type OtelProtocol = "http/protobuf" | "http/json";
-type OtelProviderType = "otlp" | "grafana-lgtm" | "datadog" | "splunk" | "elastic";
-type OtelLogLevel = "trace" | "debug" | "info" | "warn" | "error";
-type OtelLevels = Partial<Record<OtelLogLevel, boolean>>;
-/** Local console mirror policy: disable it or set its minimum emitted severity. */
-type OtelConsoleMode = "off" | OtelLogLevel;
-type OtelAttributeValue = string | number | boolean | string[] | number[] | boolean[];
-type OtelAttributes = Record<string, OtelAttributeValue>;
-type OtelSignalConfig = {
-	/** Per-signal OTLP endpoint. When omitted, the module appends /v1/{signal} to `endpoint`. */
-	endpoint?: string;
-	headers?: Record<string, string>;
-	timeoutMillis?: number;
-	concurrencyLimit?: number;
-};
-type OtelMetricsSignalConfig = OtelSignalConfig & {
-	exportIntervalMillis?: number;
-	exportTimeoutMillis?: number;
-};
-type OtelOAuthClientCredentialsConfig = {
-	tokenUrl: string;
-	clientId: string;
-	clientSecret: string;
-	scope?: string;
-	audience?: string;
-	headers?: Record<string, string>;
-};
-type OtelLogRecord = {
-	severityNumber?: number;
-	severityText?: string;
-	body?: unknown;
-	attributes?: Record<string, unknown>;
-};
-/**
-* OpenTelemetry config supplied by ConfigSource/RemoteConfig.
-* Keep environment-specific URLs and credentials here, not in FrameworkConfig.
-*/
-type OtelConfig = {
-	type?: OtelProviderType;
-	name: string;
-	endpoint?: string;
-	protocol?: OtelProtocol;
-	headers?: Record<string, string>;
-	apiKey?: string;
-	/** Name of a `RemoteConfig.kms` key pool used for exporter authentication. */
-	apiKeyPool?: string;
-	apiKeyHeader?: string;
-	oauth?: OtelOAuthClientCredentialsConfig;
-	version?: string;
-	deploymentEnvironment?: string;
-	resourceAttributes?: OtelAttributes;
-	levels?: OtelLevels;
-	/** `'off'` exports only to OTel; a level dual-emits at or above that severity. Defaults to `'info'`. */
-	console?: OtelConsoleMode;
-	traces?: boolean | OtelSignalConfig;
-	metrics?: boolean | OtelMetricsSignalConfig;
-	logs?: boolean | OtelSignalConfig;
-};
-/**
-* OpenTelemetry app/runtime wiring supplied by code.
-* Instrumentation instances and callbacks live here because they are framework-specific code.
-*/
-type FrameworkOtelConfig = {
-	levels?: OtelLevels;
-	instrument?: unknown[];
-	/** Optional app-owned destination/renderer for records admitted by `RemoteConfig.otel.console`. */
-	console?: (record: OtelLogRecord) => void;
-	spanProcessors?: unknown[];
-	metricReaders?: unknown[];
-	logRecordProcessors?: unknown[];
-	sampler?: unknown;
-	textMapPropagator?: unknown;
-	contextManager?: unknown;
-	configure?: (options: Record<string, unknown>) => Record<string, unknown> | void;
-};
-type Otel = {
-	/** Secret-free, JSON-serializable configuration and readiness summary. */
-	describe(): OtelDescription;
-	beforeChange(listener: ChangeListener): () => void;
-	afterChange(listener: ChangeListener): () => void;
-	isReady(): boolean;
-	ready(timeout?: number): Promise<void>;
-	logger: Logger;
-	forceFlush(): Promise<void>;
-	shutdown(): Promise<void>;
-};
-type ModuleDescriptionBase<TModule extends ModuleName> = {
-	module: TModule;
-	active: boolean;
-	ready: boolean;
-};
-type CookieDescription = {
-	prefix?: string;
-	path?: string;
-	secure?: boolean;
-	sameSite?: "Strict" | "Lax";
-	domain?: string;
-};
-type SsoDescription = ModuleDescriptionBase<"sso"> & {
-	authority?: string;
-	tokenUrl?: string;
-	authorizationUrl?: string;
-	clientId?: string;
-	redirectUri?: string;
-	responseType?: "code";
-	scope?: string;
-	silentRedirectUri?: string;
-	jwksUri?: string;
-	endSessionEndpoint?: string;
-	revocationEndpoint?: string;
-	cookies: CookieDescription;
-	loginStateTtl?: number;
-	rotationGraceSeconds?: number;
-	sessionWindowSeconds?: number;
-	displayCookie?: DisplayCookieConfig;
-	jit: {
-		enabled: boolean;
-		userStore: boolean;
-	};
-	sessionStore: boolean;
-	/** Present when RemoteConfig configured claim-derived entitlements for this workforce issuer. */
-	claimsAsEntitlements?: ClaimsAsEntitlementsDescription;
-	urls: Partial<CapabilityEndpointUrls["sso"]>;
-};
-type CiamProviderDescription = {
-	name: string;
-	type: CIAMProviderType;
-	enabled: boolean;
-	order?: number;
-	branding?: CIAMProviderBranding;
-	authority?: string;
-	authorizationUrl?: string;
-	tokenUrl?: string;
-	jwksUri?: string;
-	userInfoUrl?: string;
-	clientId?: string;
-	scope?: string;
-	claimsAsEntitlements?: ClaimsAsEntitlementsDescription;
-	loginUrl: string;
-};
-type CiamDescription = ModuleDescriptionBase<"ciam"> & {
-	magicLinkTtl?: number;
-	loginStateTtl?: number;
-	sessionTtl?: number;
-	cookies: CookieDescription;
-	displayCookie?: DisplayCookieConfig;
-	jit: {
-		enabled: boolean;
-		customerStore: boolean;
-	};
-	sessionStore: boolean;
-	magicLinkStore: boolean;
-	providers: CiamProviderDescription[];
-	urls: Partial<CapabilityEndpointUrls["ciam"]>;
-};
-type IamPrincipalDescription = {
-	enabled: boolean;
-	assignment: IamAssignmentPolicy;
-	delta?: "patch";
-	storeWired: boolean;
-};
-type AccessRequestsChannelsDescription = {
-	iam?: string;
-	sso?: string;
-	ciam: Record<string, string>;
-};
-type IamDescription = ModuleDescriptionBase<"iam"> & {
-	url?: string;
-	deltaAudience?: string;
-	accessRequests: AccessRequestsChannelsDescription;
-	users: IamPrincipalDescription;
-	workloads: IamPrincipalDescription;
-	customers: IamPrincipalDescription;
-	groups: {
-		enabled: boolean;
-		catalogWired: boolean;
-	};
-	urls: Partial<CapabilityEndpointUrls["iam"]>;
-};
-type WorkloadTrustedIdpDescription = {
-	issuer: string;
-	jwksUri: string;
-	audience: string | string[];
-	claimsAsEntitlements?: ClaimsAsEntitlementsDescription;
-};
-type WorkloadClientDescription = {
-	name: string;
-	ready: boolean;
-	clientId?: string;
-	workloadId?: string;
-	idpTokenUrl?: string;
-	scope?: string;
-	audience?: string;
-	authMethod: "client_secret" | "private_key_jwt" | "server_only";
-};
-type WorkloadDescription = ModuleDescriptionBase<"workload"> & {
-	incoming: {
-		trustedIdps: WorkloadTrustedIdpDescription[];
-	};
-	outgoing: WorkloadClientDescription[];
-	urls: Partial<CapabilityEndpointUrls["workload"]>;
-};
-type SecretsSourceDescription = {
-	name: string;
-	type: "dev" | "gcp" | "vault" | "aws" | "azure";
-	ready: boolean;
-	url?: string;
-	clientId?: string;
-	authMethod?: string;
-};
-type SecretsDescription = ModuleDescriptionBase<"secrets"> & {
-	sources: SecretsSourceDescription[];
-};
-type KmsPoolDescription = {
-	name: string;
-	source?: string;
-	path: string;
-	ready: boolean;
-};
-type KmsDescription = ModuleDescriptionBase<"kms"> & {
-	pools: KmsPoolDescription[];
-};
-type OtelSignalDescription = {
-	enabled: boolean;
-	endpoint?: string;
-	timeoutMillis?: number;
-	concurrencyLimit?: number;
-	exportIntervalMillis?: number;
-	exportTimeoutMillis?: number;
-};
-type OtelDescription = ModuleDescriptionBase<"otel"> & {
-	type?: OtelProviderType;
-	name?: string;
-	endpoint?: string;
-	protocol?: OtelProtocol;
-	apiKeyPool?: string;
-	apiKeyHeader?: string;
-	oauth?: {
-		tokenUrl: string;
-		clientId: string;
-		scope?: string;
-		audience?: string;
-	};
-	version?: string;
-	deploymentEnvironment?: string;
-	resourceAttributes?: OtelAttributes;
-	levels?: OtelLevels;
-	console?: OtelConsoleMode;
-	signals: {
-		traces: OtelSignalDescription;
-		metrics: OtelSignalDescription;
-		logs: OtelSignalDescription;
-	};
+*/
+type ReactiveHandle = {
+	beforeChange?(listener: ChangeListener): () => void;
+	afterChange?(listener: ChangeListener): () => void;
+	isAvailable?(): boolean;
 };
-type OaaDescription = {
-	ready: boolean;
-	url?: string;
-	providerId?: string;
-	datasourceId?: string;
-	applicationName?: string;
-	applicationType?: string;
-	population?: Record<string, string>;
-	fullSync: boolean;
-};
-type AuthzDescription = ModuleDescriptionBase<"authz"> & {
-	trustedProvisioningClients: Array<{
-		issuer: string;
-		audience: string | string[];
-		clientId: string;
-		permissions: string[];
-	}>;
-	oaa?: OaaDescription;
-	stores: {
-		accessStore: boolean;
-		accessIndex: boolean;
-		catalogStore: boolean;
-		resources: boolean;
-	};
+/**
+* Readiness contract for reactive module/service handles whose usability depends on
+* RemoteConfig that can arrive or change at runtime (for example `ion.secrets`,
+* `ion.workload`, `ion.otel`, `ion.authz.oaa`).
+*
+* - `isReady()` is a synchronous check; use it in request handlers and health probes and
+*   return 503 (or branch) when false instead of blocking.
+* - `ready(timeout?)` resolves once the handle first becomes usable; use it at startup or
+*   as a feature gate. With no timeout it waits indefinitely; with `timeout > 0` it rejects
+*   after that many milliseconds.
+*/
+type ModuleReadiness = {
+	beforeChange?(listener: ChangeListener): () => void;
+	afterChange?(listener: ChangeListener): () => void;
+	isReady?(): boolean;
+	ready?(timeout?: number): Promise<void>;
 };
-type TmDescription = ModuleDescriptionBase<"tm"> & {
-	enabled: boolean;
-	integrator?: {
-		id: string;
-		name?: string;
-		url: string;
-		issuer: string;
-		jwksUri: string;
-		audience: string;
-		clientId: string;
-	};
-	consentTtlSeconds?: number;
-	maxRedeemAttempts?: number;
+/**
+* Canonical ionite module names used by the holistic readiness report and the
+* `requireReady([...])` helper. These are the config-driven module handles whose readiness can be
+* composed; `ion.isReady()` itself stays the narrow "config applied" signal and is NOT one of these.
+*
+* IAM-delta egress is intentionally NOT a member. Delta patch-back is best-effort and non-fatal (a
+* failed push only logs `degraded` and is reconciled by a later full sync — the Batch 7 drift-signal
+* contract), so folding it into `iam` readiness would let a delta-target outage make
+* `requireReady(['iam'])` false and take the app out of rotation for a signal that is designed not to
+* block. Apps that DO treat delta as a hard dependency can gate on `ion.iam.delta.isReady()` /
+* `ion.iam.delta.ready()` explicitly instead.
+*/
+type ModuleName = "sso" | "ciam" | "iam" | "workload" | "otel" | "secrets" | "kms" | "authz" | "tm";
+/** Per-module readiness snapshot in {@link ReadinessReport}. */
+type ModuleReadinessState = {
+	/** Whether the module is active (present/requested) in the effective config. Inactive modules never block readiness. */
+	active: boolean;
+	/** Synchronous readiness of the module right now (mirrors the module's own `isReady()`). */
+	ready: boolean;
+	/** Human-readable explanation when the module is `active` but not `ready`. */
+	reason?: string;
 };
-type ModuleDescription = SsoDescription | CiamDescription | IamDescription | WorkloadDescription | SecretsDescription | KmsDescription | OtelDescription | AuthzDescription | TmDescription;
-type IoniteDescription = {
-	id?: string;
-	sdk: {
-		version: string;
-		catalogVersion: number;
-	};
-	basePath: string;
-	urls: CapabilityEndpointUrls;
+/**
+* Holistic, read-only readiness snapshot for an ionite instance. Returned by
+* `ion.readiness()` and used by the built-in `${basePath}/readyz` endpoint. This is composition
+* DATA, not a request gate: applications combine it (via `ion.requireReady([...])`) with their own
+* non-ionite dependency checks to build their health endpoints.
+*/
+type ReadinessReport = {
+	/** True when config has been applied (`applied`) and every ACTIVE module is ready. */
 	ok: boolean;
+	/** Whether RemoteConfig has been applied at least once (mirrors `ion.isReady()`). */
 	applied: boolean;
+	/** Per-module readiness keyed by {@link ModuleName}. */
+	modules: Record<ModuleName, ModuleReadinessState>;
+	/** Most recent config-application outcome (last applied time and last error, if any). */
 	config: ConfigApplyStatus;
-	modules: Record<ModuleName, ModuleReadinessState & {
-		description?: ModuleDescription;
+};
+/** Result of `ion.requireReady(names)`: a synchronous, declarative readiness gate over selected modules. */
+type RequireReadyResult = {
+	/** True when config is applied and every requested module is ready. */
+	ok: boolean;
+	/** The requested modules that are not ready, with reasons when available. */
+	notReady: Array<{
+		name: ModuleName;
+		reason?: string;
 	}>;
 };
-import { StandardSchemaV1 as StandardSchemaV14 } from "@standard-schema/spec";
 /**
 * Token caching for workload identity authentication.
 *
@@ -2364,10 +1943,12 @@ type WorkloadConfigBase = {
 	*/
 	audience?: string;
 	/**
-	* Per-IdP intent (incoming/server role only): token claims from THIS trust anchor may satisfy
-	* `has*` (audience-bound). ConfigSource-only. There is no global fallback.
+	* Per-IdP intent (incoming/server role only): when `true`, tokens validated against THIS trust
+	* anchor have their OAuth `scope` claim auto-honored as entitlements by the request-level `has*`
+	* helpers (audience-bound). Mirrors `RemoteConfig.authz.scopesAsEntitlements` but scoped to a single
+	* trusted IdP so first-party scopes can be honored while federated/third-party ones are not.
 	*/
-	claimsAsEntitlements?: ClaimsAsEntitlements;
+	scopesAsEntitlements?: boolean;
 	/**
 	* Default OAuth2 scopes (space-delimited)
 	*/
@@ -2477,10 +2058,16 @@ type ClientCredentialsWorkloadConfig = WorkloadConfigBase & {
 	*/
 	clientId: string;
 	/**
-	* OAuth2 client secret
-	* REQUIRED for Client Credentials mode
+	* OAuth2 client secret. Omit it to authenticate with a federated token instead
+	* (see `federatedTokenFile`). A client secret wins when both are present.
 	*/
-	clientSecret: string;
+	clientSecret?: string;
+	/**
+	* Path to a projected federated token (e.g. AKS Workload Identity), sent as a jwt-bearer
+	* `client_assertion` in place of `client_secret`. Defaults to `AZURE_FEDERATED_TOKEN_FILE`.
+	* Read on every acquisition because the platform rotates it.
+	*/
+	federatedTokenFile?: string;
 };
 /**
 * Server-Only Workload Configuration
@@ -2543,8 +2130,8 @@ type TrustedIdp = {
 	* one of these values (with `azp` fallback). REQUIRED: prevents cross-app token reuse.
 	*/
 	audience: string | string[];
-	/** Per-IdP claims intent (see {@link WorkloadConfigBase.claimsAsEntitlements}). */
-	claimsAsEntitlements?: ClaimsAsEntitlements;
+	/** Per-IdP scopesAsEntitlements intent (see {@link WorkloadConfigBase.scopesAsEntitlements}). */
+	scopesAsEntitlements?: boolean;
 };
 /**
 * Workload config with separate incoming (server) and outgoing (client) roles.
@@ -2587,8 +2174,6 @@ interface WorkloadGetToken {
 * Workload Identity Authentication Interface
 */
 type Workload = WorkloadConfig & ModuleReadiness & Required<Pick<ModuleReadiness, "isReady" | "ready">> & {
-	/** Secret-free, JSON-serializable configuration and readiness summary. */
-	describe: () => WorkloadDescription;
 	/**
 	* Returns a token for this workload configuration.
 	* The optional argument overrides the configured default scope.
@@ -2603,9 +2188,7 @@ type Workload = WorkloadConfig & ModuleReadiness & Required<Pick<ModuleReadiness
 	/** Framework-agnostic request handler for the Workload module (token, validate, jwks, refresh). */
 	handler: (request: Request) => Promise<Response>;
 };
-type WorkloadClient = Pick<Workload, "getToken" | "refreshToken" | "generateJWTAssertion" | "revokeToken" | "beforeChange" | "afterChange" | "isReady" | "ready"> & {
-	describe(): WorkloadClientDescription;
-};
+type WorkloadClient = Pick<Workload, "getToken" | "refreshToken" | "generateJWTAssertion" | "revokeToken" | "beforeChange" | "afterChange" | "isReady" | "ready">;
 /**
 * SCIM Error response structure
 */
@@ -2779,7 +2362,6 @@ type IAMAccessRequestsConfig = {
 		request: AccessRequestResult;
 		created: boolean;
 	}>;
-	get?: (id: string) => Promise<AccessRequestResult | undefined>;
 };
 type IAMEntitlementRequestUrlContext = {
 	request: Request;
@@ -3037,8 +2619,6 @@ type IAMUsersInbound = {
 * - `users_inbound` is available when `userStore` is configured
 */
 type IAM = Omit<IAMConfig, "users" | "workloads" | "customers" | "groups"> & {
-	/** Secret-free, JSON-serializable configuration and readiness summary. */
-	describe: () => IamDescription;
 	users: IamPrincipalKind;
 	workloads: IamPrincipalKind;
 	customers: IamPrincipalKind;
@@ -3223,8 +2803,6 @@ type KmsPoolSlot = {
 	ready(timeout?: number): Promise<void>;
 };
 type KmsPool = {
-	/** Secret-free, JSON-serializable pool configuration and readiness summary. */
-	describe(): KmsPoolDescription;
 	/**
 	* Returns the current granted key for slot 0. Calls wait on one shared local subscription until a
 	* grant is available; repeated calls resolve from the local cache and never initiate a vault request.
@@ -3257,8 +2835,6 @@ type KmsPool = {
 * (`ion.kms.<name>`); use `getPool(name)` when the name is dynamic.
 */
 type Kms = ModuleReadiness & {
-	/** Secret-free, JSON-serializable configuration and readiness summary. */
-	describe(): KmsDescription;
 	readonly config: Readonly<KmsConfig>;
 	listPools(): string[];
 	getPool(name: string): KmsPool;
@@ -3269,6 +2845,91 @@ type Kms = ModuleReadiness & {
 declare function parseKmsPoolDocument(value: unknown): KmsPoolDocument;
 /** Parse and fail closed on a vault-stored KMS key-material document. */
 declare function parseKmsPoolControlDocument(value: unknown): KmsPoolControlDocument;
+type OtelSignalName = "traces" | "metrics" | "logs";
+type OtelProtocol = "http/protobuf" | "http/json";
+type OtelProviderType = "otlp" | "grafana-lgtm" | "datadog" | "splunk" | "elastic";
+type OtelLogLevel = "trace" | "debug" | "info" | "warn" | "error";
+type OtelLevels = Partial<Record<OtelLogLevel, boolean>>;
+/** Local console mirror policy: disable it or set its minimum emitted severity. */
+type OtelConsoleMode = "off" | OtelLogLevel;
+type OtelAttributeValue = string | number | boolean | string[] | number[] | boolean[];
+type OtelAttributes = Record<string, OtelAttributeValue>;
+type OtelSignalConfig = {
+	/** Per-signal OTLP endpoint. When omitted, the module appends /v1/{signal} to `endpoint`. */
+	endpoint?: string;
+	headers?: Record<string, string>;
+	timeoutMillis?: number;
+	concurrencyLimit?: number;
+};
+type OtelMetricsSignalConfig = OtelSignalConfig & {
+	exportIntervalMillis?: number;
+	exportTimeoutMillis?: number;
+};
+type OtelOAuthClientCredentialsConfig = {
+	tokenUrl: string;
+	clientId: string;
+	clientSecret: string;
+	scope?: string;
+	audience?: string;
+	headers?: Record<string, string>;
+};
+type OtelLogRecord = {
+	severityNumber?: number;
+	severityText?: string;
+	body?: unknown;
+	attributes?: Record<string, unknown>;
+};
+/**
+* OpenTelemetry config supplied by ConfigSource/RemoteConfig.
+* Keep environment-specific URLs and credentials here, not in FrameworkConfig.
+*/
+type OtelConfig = {
+	type?: OtelProviderType;
+	name: string;
+	endpoint?: string;
+	protocol?: OtelProtocol;
+	headers?: Record<string, string>;
+	apiKey?: string;
+	/** Name of a `RemoteConfig.kms` key pool used for exporter authentication. */
+	apiKeyPool?: string;
+	apiKeyHeader?: string;
+	oauth?: OtelOAuthClientCredentialsConfig;
+	version?: string;
+	deploymentEnvironment?: string;
+	resourceAttributes?: OtelAttributes;
+	levels?: OtelLevels;
+	/** `'off'` exports only to OTel; a level dual-emits at or above that severity. Defaults to `'info'`. */
+	console?: OtelConsoleMode;
+	traces?: boolean | OtelSignalConfig;
+	metrics?: boolean | OtelMetricsSignalConfig;
+	logs?: boolean | OtelSignalConfig;
+};
+/**
+* OpenTelemetry app/runtime wiring supplied by code.
+* Instrumentation instances and callbacks live here because they are framework-specific code.
+*/
+type FrameworkOtelConfig = {
+	levels?: OtelLevels;
+	instrument?: unknown[];
+	/** Optional app-owned destination/renderer for records admitted by `RemoteConfig.otel.console`. */
+	console?: (record: OtelLogRecord) => void;
+	spanProcessors?: unknown[];
+	metricReaders?: unknown[];
+	logRecordProcessors?: unknown[];
+	sampler?: unknown;
+	textMapPropagator?: unknown;
+	contextManager?: unknown;
+	configure?: (options: Record<string, unknown>) => Record<string, unknown> | void;
+};
+type Otel = {
+	beforeChange(listener: ChangeListener): () => void;
+	afterChange(listener: ChangeListener): () => void;
+	isReady(): boolean;
+	ready(timeout?: number): Promise<void>;
+	logger: Logger;
+	forceFlush(): Promise<void>;
+	shutdown(): Promise<void>;
+};
 /**
 * Session management for tracking user sessions and enabling backchannel logout.
 *
@@ -3361,12 +3022,6 @@ type Session<TExtended = object> = {
 	*/
 	claims?: Record<string, unknown>;
 	/**
-	* Entitlements derived from token claims at login and refresh. Session-scoped: they die with the
-	* record (TTL, rotation, back-channel logout) and are never written to the access stores.
-	* Only meaningful when the store declares {@link SessionStoreCapabilities.derivedEntitlements}.
-	*/
-	entitlements?: DerivedEntitlement[];
-	/**
 	* Optional access-token claims for modules that keep access/id claims separate.
 	*/
 	accessClaims?: Record<string, unknown>;
@@ -3403,21 +3058,7 @@ type Session<TExtended = object> = {
 * }
 * ```
 */
-/**
-* Store-declared capabilities. The SDK does not probe a custom store (a write at init is forbidden);
-* a store that omits the declaration is treated as incapable.
-*/
-type SessionStoreCapabilities = {
-	/**
-	* The store persists {@link Session.entitlements} round-trip. JSON-backed stores (the SDK Redis
-	* and in-memory implementations) declare this. A column-mapped SQL store declares it only after
-	* it has a column for the derived set.
-	*/
-	derivedEntitlements?: boolean;
-};
 interface SessionStore<TExtended = object> {
-	/** Declaration of what this store persists beyond the required session fields. */
-	readonly capabilities?: SessionStoreCapabilities;
 	/**
 	* Create a new session in the store.
 	*
@@ -3750,13 +3391,6 @@ type SSOConfig<
 	*/
 	userStore?: UserStore<TUserData>;
 	/**
-	* ConfigSource-only. When set, the named token claims are derived into session-scoped
-	* entitlements at login and refresh. Never set from application code.
-	*/
-	claimsAsEntitlements?: ClaimsAsEntitlements;
-	/** ConfigSource-only IdP assignment workflow used when IAM assignment is `'idp'`. */
-	accessRequests?: AccessRequestsDestination;
-	/**
 	* Enable Just-In-Time (JIT) user provisioning.
 	* When enabled, new users are automatically created in the userStore on their first login.
 	* When disabled (default), only existing users in the userStore are updated on login.
@@ -3856,8 +3490,6 @@ type SSO<
 	TSessionData = Record<string, never>,
 	TUserData = Record<string, never>
 > = SSOConfig<TSessionData, TUserData> & {
-	/** Secret-free, JSON-serializable configuration and readiness summary. */
-	describe: () => SsoDescription;
 	getUser: (request: Request) => Promise<WorkforceUser | undefined>;
 	/**
 	* Degraded-aware resolution: distinguishes a signed-out visitor (`unauthenticated`) from a failed
@@ -4205,12 +3837,7 @@ type SecretsValidators = {
 	*/
 	validateSourceConfig?(sourceName: string, config: SecretsSourceConfig): void;
 };
-type DescribedSecretsSource = SecretsSource & {
-	describe(): SecretsSourceDescription;
-};
 type Secrets = ModuleReadiness & {
-	/** Secret-free, JSON-serializable configuration and readiness summary. */
-	describe(): SecretsDescription;
 	/**
 	* Liveness across configured sources. Returns false when any ready source reports a degraded
 	* `isAvailable()` (e.g. an HTTP-poll source whose upstream is failing). Surfaced in
@@ -4222,7 +3849,7 @@ type Secrets = ModuleReadiness & {
 	/** Returns configured secrets source names/keys. */
 	listSecretsSources(): string[];
 	/** Gets a named secrets source client. Throws when missing. */
-	getSecretsSource(sourceName: string): DescribedSecretsSource;
+	getSecretsSource(sourceName: string): SecretsSource;
 	/** Creates a lazy handle for a secret in a named source. */
 	get(sourceName: string, path: string, options?: SecretsOperationOptions): SecretHandle;
 	/** Reads a secret from a named secrets source client. */
@@ -4672,6 +4299,17 @@ type TrustedProvisioningClient = {
 type AuthzConfig = {
 	oaa?: AuthzOaaConfig;
 	/**
+	* RemoteConfig/Ops-governed intent. When `true`, the request-level `has*` helpers auto-honor a
+	* principal's OAuth token `scope` claims as entitlements: an app-wide check (no `resource` arg)
+	* also allows when the target id matches a granted scope. Default `false` (secure): scopes never
+	* satisfy `has*` and authorization comes solely from the `AccessAssignmentStore`/`AccessIndex` (IAM/SCIM).
+	* Read at check time so it can be flipped live. This NEVER affects token validation, and the
+	* explicit `hasScope*` helpers are always available regardless of this flag. Resource-scoped
+	* checks (a `resource` arg supplied) are never satisfied by scopes. For workload principals this is
+	* a fallback only: a matched trusted IdP's per-entry `scopesAsEntitlements` takes precedence.
+	*/
+	scopesAsEntitlements?: boolean;
+	/**
 	* Config-declared trusted provisioning clients (read-path overlay; ConfigSource/ECI-owned). Each
 	* entry pre-authorizes a workload client to hold specific permissions without a stored grant. See
 	* {@link TrustedProvisioningClient}. Honored in the request-level `has*` helpers BEFORE the
@@ -4752,11 +4390,11 @@ type FrameworkConfig = {
 * `afterLogout` callbacks, which are code-only and therefore kept. RemoteConfig-only intent flags (e.g. IAM `users`/`groups`
 * enablement) are also stripped from code.
 */
-type SSOConfigFromCode = Omit<SSOConfig, "loginUrl" | "userUrl" | "logoutUrl" | "logoutBackChannelUrl" | "refreshUrl" | "redirectUri" | "claimsAsEntitlements" | "accessRequests">;
+type SSOConfigFromCode = Omit<SSOConfig, "loginUrl" | "userUrl" | "logoutUrl" | "logoutBackChannelUrl" | "refreshUrl" | "redirectUri">;
 type IAMConfigFromCode = Omit<IAMConfig, "usersUrl" | "groupsUrl" | "workloadsUrl" | "customersUrl" | "users" | "workloads" | "customers" | "groups" | "discovery" | "deltaAudience"> & {
 	discovery?: Omit<IAMDiscoveryConfig, "basePath">;
 };
-type WorkloadServerConfigFromCode = Omit<Partial<WorkloadConfig>, "tokenUrl" | "validateUrl" | "jwksUrl" | "refreshUrl" | "claimsAsEntitlements">;
+type WorkloadServerConfigFromCode = Omit<Partial<WorkloadConfig>, "tokenUrl" | "validateUrl" | "jwksUrl" | "refreshUrl">;
 type FrameworkWorkloadConfigFromCode = WorkloadServerConfigFromCode | {
 	incoming?: WorkloadServerConfigFromCode;
 	outgoing?: FrameworkWorkloadIncomingOutgoing["outgoing"];
@@ -5175,8 +4813,6 @@ type CIAM<
 	TMagicLinkData = Record<string, never>,
 	TCustomerData = Record<string, never>
 > = CIAMConfig<TMagicLinkData, TCustomerData> & {
-	/** Secret-free, JSON-serializable configuration and readiness summary. */
-	describe: () => CiamDescription;
 	getCustomer: (request: Request) => Promise<Customer | undefined>;
 	/**
 	* Degraded-aware resolution: distinguishes a signed-out visitor (`unauthenticated`) from a failed
@@ -5320,15 +4956,6 @@ type IoniteBase = {
 	* module is ready; `notReady` lists the requested modules that are not ready, with reasons.
 	*/
 	requireReady(names: ModuleName[]): RequireReadyResult;
-	/**
-	* Returns an allow-listed, JSON-serializable snapshot for privileged App-owned diagnostics.
-	* Unlike `config`, this never contains credentials, secret values, stores, or callbacks.
-	*
-	* Diagnostics only: each call rebuilds the readiness report and every module projection. Call it
-	* from an admin loader, never per request; handlers and health probes use `isReady()` /
-	* `requireReady()`.
-	*/
-	describe(): IoniteDescription;
 	/** Most recent RemoteConfig application outcome (last applied time and last error, if any). */
 	configStatus: ConfigApplyStatus;
 	/** Release config subscriptions and background resources. */
@@ -5349,8 +4976,8 @@ type ResolvedRoute = {
 	/**
 	* Authorization required to invoke this route. When set, the router enforces it (deny-by-default)
 	* before the handler runs: the caller must hold the {@link EndpointPermission.permission} as a
-	* granted entitlement, or a claim-derived entitlement from the issuing IdP's `claimsAsEntitlements`
-	* block. Login/public/discovery routes omit it.
+	* granted entitlement, or—when `RemoteConfig.authz.scopesAsEntitlements` is enabled—carry the
+	* matching OAuth scope. Login/public/discovery routes omit it.
 	*
 	* Three states, chosen so a custom `resolve` cannot silently drop authorization by omission:
 	* - a permission object → enforce it;
@@ -5640,8 +5267,6 @@ type TenantIntegrationView = {
 	integration: TenantIntegration;
 };
 type TenantManagement<TTenant extends BaseTenant = BaseTenant> = ModuleReadiness & {
-	/** Secret-free, JSON-serializable configuration and readiness summary. */
-	describe(): TmDescription;
 	handler(request: Request): Promise<Response>;
 	getTenant(id: string): Promise<TTenant | undefined>;
 	recordConsent(input: RecordTenantConsentInput): Promise<TTenant>;
@@ -6318,8 +5943,6 @@ interface OaaClient<
 	TCustomer = BaseCustomer,
 	TWorkload = BaseWorkloadIdentity
 > {
-	/** Secret-free, JSON-serializable OAA configuration and readiness summary. */
-	describe(): OaaDescription;
 	pushUser(user: TUser): Promise<void>;
 	pushCustomer(customer: TCustomer): Promise<void>;
 	pushWorkload(workload: TWorkload): Promise<void>;
@@ -6438,8 +6061,6 @@ type ReconcileReport = {
 * wired they deny by default (`{ allow: false }`, `metadata.reason = 'access_index_not_configured'`).
 */
 type Authz = {
-	/** Secret-free, JSON-serializable configuration and readiness summary. */
-	describe(): AuthzDescription;
 	oaa: OaaClient;
 	/** Read the effective catalog union (materialized rows plus unmaterialized code templates). */
 	entitlements: {
@@ -6491,9 +6112,9 @@ type Authz = {
 	*/
 	grant(change: AccessChange): Promise<AccessChange>;
 	/**
-	* Submit one grant or revoke request on a principal's behalf. Under `'iam-request'`, targets the
-	* IAM destination; under `'idp'`, targets the claims-bearing SSO/CIAM provider. One operation
-	* maps to one approval decision, status, and tracking URL.
+	* Submit one grant or revoke request on a principal's behalf. Allowed only when that kind's
+	* assignment policy is `'iam-request'`. One operation maps to one approval decision, status,
+	* and tracking URL. Authenticated with the module-wide `deltaAudience` workload client.
 	*/
 	requestAccess(change: {
 		subject: AccessChange["subject"];
@@ -6502,20 +6123,6 @@ type Authz = {
 		target: AccessChange["target"];
 		operation: "grant" | "revoke";
 		justification?: string;
-		/** CIAM provider key. Required only when multiple providers expose an AccessRequests channel. */
-		provider?: string;
-	}): Promise<{
-		id: string;
-		status: "pending" | "approved" | "denied";
-		operation: "grant" | "revoke";
-		trackingUrl: string;
-	}>;
-	/** Read the destination-owned state of an on-behalf access request. */
-	getAccessRequest(input: {
-		id: string;
-		subjectType: SubjectType;
-		/** CIAM provider key. Required only when multiple providers expose an AccessRequests channel. */
-		provider?: string;
 	}): Promise<{
 		id: string;
 		status: "pending" | "approved" | "denied";
@@ -6535,10 +6142,8 @@ type Authz = {
 * - `'iam'` — never assign in-app; show a request link (or a read-only entitlement table).
 * - `'iam-request'` — never assign in-app; the app submits a request on the principal's behalf via
 *   {@link Authz.requestAccess}.
-* - `'idp'` — the claims-bearing SSO/CIAM provider is assigner of record; requests use that
-*   provider's ConfigSource-owned AccessRequests channel.
 */
-type IamAssignmentPolicy = "app" | "iam" | "iam-request" | "idp";
+type IamAssignmentPolicy = "app" | "iam" | "iam-request";
 /**
 * Thrown by {@link Authz.grant} when the Ops-owned assignment policy forbids in-app assignment.
 * `requestUrl` is the IAM-written entitlement receipt when one exists, so the app can send the
@@ -6589,6 +6194,64 @@ declare function trustedClientPermissionsForPrincipal(authz: AuthzConfig | null
 * OAA full sync — they are NEVER written to a store or materialized into the AccessIndex.
 */
 declare function configTrustedClientGrants(authz: AuthzConfig | null | undefined): AccessChange[];
+type CapabilityKey = "sso.login" | "sso.jit" | "sso.logout" | "sso.back_channel_logout" | "ciam.magic_link" | "ciam.oidc_login" | "ciam.customer" | "ciam.logout" | "iam.users" | "iam.groups" | "iam.workloads" | "iam.customers" | "workload.incoming" | "workload.outgoing" | "authz.oaa" | "tm.integration";
+type CapabilityEndpointUrls = {
+	readyzUrl: string;
+	capabilitiezUrl: string;
+	sso: {
+		loginUrl: string;
+		userUrl: string;
+		logoutUrl: string;
+		logoutBackChannelUrl: string;
+		refreshUrl: string;
+		callbackUrl: string;
+	};
+	workload: {
+		validateUrl: string;
+		jwksUrl: string;
+	};
+	iam: {
+		basePath: string;
+		usersUrl: string;
+		groupsUrl: string;
+		workloadsUrl: string;
+		customersUrl: string;
+	};
+	ciam: {
+		magicLinkUrl: string;
+		magicLinkLoginUrl: string;
+		customerUrl: string;
+		customerLoginUrl: string;
+		customerCallbackUrl: string;
+		customerProvidersUrl: string;
+		logoutUrl: string;
+	};
+};
+type CapabilityState = {
+	module: ModuleName;
+	active: boolean;
+	ready: boolean;
+	testable: boolean;
+	urls?: string[];
+	reason?: string;
+};
+type CapabilitiezManifest = {
+	sdk: {
+		/** Runtime @ionite/server version serving this manifest. */
+		version: string;
+		/** Version of the stable capability/test-unit vocabulary. */
+		catalogVersion: number;
+	};
+	basePath: string;
+	urls: CapabilityEndpointUrls;
+	modules: Record<ModuleName, ModuleReadinessState>;
+	capabilities: Record<CapabilityKey, CapabilityState>;
+	/**
+	* True when FrameworkConfig wired a live LFV callback transport. Boolean only — the transport
+	* object, Redis URL, and credentials are never exposed.
+	*/
+	lfvCallbackTransport: boolean;
+};
 /**
 * Fields a {@link ConfigSource} may attach to a thrown error so the SDK can classify load/subscribe
 * failures structurally instead of by fragile message-substring matching (§2.1). All fields are
@@ -6957,4 +6620,4 @@ type LfvErrorResponse = {
 };
 /** Generates a ULID */
 declare function generateULID(prefix?: string): string;
-export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestResult, AccessRequestsDestination, AccessStatus, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzDescription, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, CiamDescription, CiamProviderDescription, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CookieDescription, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, DerivedEntitlement, DescribedSecretsSource, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamDescription, IamPrincipalDescription, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InferSecretType, Ionite, IoniteBase, IoniteDescription, IoniteError, IoniteErrorOptions, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsDescription, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDescription, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleDescription, ModuleDescriptionBase, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaDescription, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelDescription, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalDescription, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsDescription, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceDescription, SecretsSourceMap, SecretsSourceType, SecretsSubscriptionOptions, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, SsoDescription, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmDescription, TmIntegratorConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWebSocketAuthHeader, VaultWebSocketSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadClientDescription, WorkloadConfig, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadTrustedIdpDescription, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, discoveredProfileCookieName, encodeDisplayCookie, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };
+export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestResult, AccessStatus, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InferSecretType, Ionite, IoniteBase, IoniteError, IoniteErrorOptions, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceMap, SecretsSourceType, SecretsSubscriptionOptions, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmIntegratorConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWebSocketAuthHeader, VaultWebSocketSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadConfig, WorkloadConfigMap, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, discoveredProfileCookieName, encodeDisplayCookie, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };