@ionite/core 0.0.24-beta.20261003.17 → 0.0.24-beta.20261006.21

package/dist/index.d.ts

@@ -16,212 +16,6 @@ declare const KNOWN_WORKLOAD_KEYS: readonly ["id", "clientId", "displayName", "d
 declare function customAttributes(value: object, knownKeys: readonly PropertyKey[]): Record<string, unknown> | undefined;
 import { StandardSchemaV1 as StandardSchemaV19 } from "@standard-schema/spec";
 import { StandardSchemaV1 as StandardSchemaV18 } from "@standard-schema/spec";
-/**
-* Third-party CIAM provider presets and claim mapping.
-*
-* Defines the built-in provider adapters used by the CIAM module for customer
-* login. Each preset supplies default OIDC/OAuth2 endpoints, scope, branding,
-* and a claim mapper that normalizes provider claims into a candidate customer.
-* The application's `CustomerStore` remains the system of record: the SDK only
-* extracts standard claims and hands a candidate to `lookup`/`upsert`.
-*/
-/** Built-in provider types. `oidc` is a generic OIDC provider; `magic-link` is the passwordless flow. */
-type CIAMProviderType = "oidc" | "google" | "github" | "microsoft" | "apple" | "magic-link";
-/** Branding colors for rendering a provider button in light and dark themes. */
-type CIAMProviderColors = {
-	/** Background/brand color for light theme (hex or CSS color). */
-	light: string;
-	/** Background/brand color for dark theme (hex or CSS color). */
-	dark: string;
-	/** Optional secondary/accent color. */
-	secondary?: string;
-};
-/** Operator-supplied branding so the UI can render a provider list without hardcoding. */
-type CIAMProviderBranding = {
-	/** Human-readable name shown on the login button (e.g. "Google"). */
-	displayName: string;
-	/** External icon URL (typically an SVG/PNG hosted on a CDN). */
-	iconUrl?: string;
-	/** Light/dark brand colors. */
-	colors?: CIAMProviderColors;
-	/** Optional provider info/marketing URL. */
-	url?: string;
-};
-/**
-* A single CIAM provider declaration. OIDC/OAuth2 endpoint and credential
-* fields come from the ConfigSource (never application code).
-*/
-type CIAMProviderConfig = {
-	/** Provider adapter type. Selects defaults and claim mapping. */
-	type: CIAMProviderType;
-	/** Whether this provider is enabled. Defaults to true when omitted. */
-	enabled?: boolean;
-	/** Recommended display order (ascending). Ties broken by declaration order. */
-	order?: number;
-	/** UI branding metadata. */
-	branding?: CIAMProviderBranding;
-	/** OIDC issuer/authority (used for discovery when explicit endpoints are omitted). */
-	authority?: string;
-	/** Authorization endpoint (overrides preset). */
-	authorizationUrl?: string;
-	/** Token endpoint (overrides preset). */
-	tokenUrl?: string;
-	/** JWKS endpoint for ID token verification (overrides preset). */
-	jwksUri?: string;
-	/** OAuth2 UserInfo endpoint for providers without an ID token (e.g. GitHub). */
-	userInfoUrl?: string;
-	/** OAuth2 client id (ConfigSource-only). */
-	clientId?: string;
-	/** OAuth2 client secret (ConfigSource-only). */
-	clientSecret?: string;
-	/** Requested scope (overrides preset). */
-	scope?: string;
-	/** Apple: team id for client-secret generation. */
-	teamId?: string;
-	/** Apple: key id for client-secret generation. */
-	keyId?: string;
-	/** Apple: PKCS#8 PEM private key for client-secret generation. */
-	privateKey?: string;
-};
-/** Sanitized provider entry returned by the discovery endpoint for the UI. */
-type CIAMProviderDescriptor = {
-	/** Provider key (matches the RemoteConfig map key); used as `?provider=`. */
-	name: string;
-	type: CIAMProviderType;
-	displayName: string;
-	/** SDK-derived login URL to navigate to (begins the flow). */
-	loginUrl: string;
-	iconUrl?: string;
-	colors?: CIAMProviderColors;
-	url?: string;
-};
-/**
-* Light display cookies (`${cookiesPrefix}.profile`).
-*
-* The envelope is SDK-owned. App code supplies only `user`. The cookie is not an
-* authentication input: the server never reads it to resolve a session, and the browser
-* may forge it. `expiresAt` is display metadata so a client can order entries without a
-* round trip; authoritative expiry is the peer `${cookiesPrefix}.session` record.
-*/
-declare const DISPLAY_COOKIE_SUFFIX = ".profile";
-declare const DISPLAY_COOKIE_VERSION = 1;
-declare const DEFAULT_DISPLAY_COOKIE_MAX = 10;
-declare const DEFAULT_DISCOVERED_COOKIE_MAX = 10;
-declare const DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS: number;
-declare const DISCOVERED_COOKIE_PREFIX = "ion.discovered";
-type DisplayCookieConfig = {
-	/**
-	* When true, the SDK writes a non-HttpOnly display cookie beside the opaque session cookie.
-	* ConfigSource-only. Default false.
-	*/
-	enabled?: boolean;
-	/**
-	* How many display cookies a single response may leave on the browser, newest session window
-	* first. ConfigSource-only. Values below 1 fall back to {@link DEFAULT_DISPLAY_COOKIE_MAX}.
-	* @default 10
-	*/
-	max?: number;
-	/**
-	* Session-less tenant hints written by an App after an explicit directory lookup.
-	* ConfigSource-only and off unless `enabled` is true.
-	*/
-	discovered?: DiscoveredDisplayCookieConfig;
-};
-type DiscoveredDisplayCookieConfig = {
-	enabled?: boolean;
-	/** Browser hint lifetime. This is not a session expiry. @default 14400 */
-	ttlSeconds?: number;
-	/** Independent cap; discovered hints never displace live-session entries. @default 10 */
-	max?: number;
-};
-/** What `${basePath}/auth/user` and `${basePath}/auth/customer` return. ConfigSource-only. */
-type UserEndpointPolicy = "full" | "display" | "off";
-type DisplayUser = Record<string, string | number | boolean | null>;
-type DisplayAuthType = "sso" | "ciam";
-type DisplayCookieEnvelope = {
-	v: typeof DISPLAY_COOKIE_VERSION;
-	/**
-	* Session envelopes omit this field (absent means `'session'`) so the wire format stays identical
-	* to cookies written before discovered hints existed; only discovered hints set it explicitly.
-	* Readers must treat `undefined` as `'session'`.
-	*/
-	kind?: "session" | "discovered";
-	tenantId?: string;
-	authType: DisplayAuthType;
-	/** ISO timestamp copied from the session window at write time. Display only. */
-	expiresAt: string;
-	user: DisplayUser;
-	tenantName?: string;
-};
-type DisplayIdentity = {
-	name?: string;
-	email?: string;
-	avatar?: string;
-};
-declare function resolveDisplayCookieMax(max: number | undefined): number;
-declare function resolveDiscoveredCookieMax(max: number | undefined): number;
-declare function resolveDiscoveredCookieTtlSeconds(ttlSeconds: number | undefined): number;
-declare function defaultDisplayUser(identity: DisplayIdentity): DisplayUser;
-/** Drop non-primitives and auth-bearing keys. Display cookies carry UI fields only. */
-declare function sanitizeDisplayUser(value: unknown): DisplayUser;
-/**
-* AppDev projection runs on the full user (including custom attributes). When omitted, or when it
-* throws, the cookie carries name, email, and avatar only. Forbidden and non-primitive fields are
-* dropped either way — a projector cannot put a session id or token into the cookie.
-*/
-declare function projectDisplayUser<TUser extends object>(user: TUser, projector?: (user: TUser) => unknown): DisplayUser;
-declare function encodeDisplayCookie(envelope: DisplayCookieEnvelope): string;
-declare function decodeDisplayCookie(raw: string): DisplayCookieEnvelope | undefined;
-type ParsedDisplayCookie = {
-	name: string;
-	prefix: string;
-	envelope: DisplayCookieEnvelope;
-};
-declare function readDisplayCookies(cookieHeader: string | null | undefined): ParsedDisplayCookie[];
-/** Client ordering: newest session window first. Invalid timestamps sort last. */
-declare function compareDisplayExpiryDesc(a: string | undefined, b: string | undefined): number;
-declare function profileCookieName(cookiesPrefix: string): string;
-declare function discoveredProfileCookieName(tenantId: string): string;
-/**
-* Minimal logger interface compatible with common structured logging patterns.
-*/
-interface Logger {
-	trace(message?: unknown, ...optionalParams: unknown[]): void;
-	debug(message?: unknown, ...optionalParams: unknown[]): void;
-	info(message?: unknown, ...optionalParams: unknown[]): void;
-	warn(message?: unknown, ...optionalParams: unknown[]): void;
-	error(message?: unknown, ...optionalParams: unknown[]): void;
-}
-/**
-* Renders a structured logger call as one greppable line while leaving the source fields separate
-* for telemetry exporters.
-*/
-declare function formatLogLine(level: keyof Logger, message: unknown, optionalParams?: unknown[], timestamp?: Date): string;
-/**
-* No-op implementation — does nothing for any log level
-*/
-declare const silentLogger: Logger;
-/**
-* Default logger used until an ionite instance is configured with
-* an OpenTelemetry-backed logger or an application-provided logger.
-*/
-declare const defaultLogger: Logger;
-/**
-* Logger that logs messages debug, info, warn, and error to the console.
-*/
-declare const debugLogger: Logger;
-/**
-* Logger that logs messages info, warn, and error to the console.
-*/
-declare const infoLogger: Logger;
-/**
-* Logger that logs messages warn and error to the console.
-*/
-declare const warnLogger: Logger;
-/**
-* Human-readable single-line console logger for local application output.
-*/
-declare const prettyLogger: Logger;
 /** Synchronous, in-memory read surface for one code catalog entity kind. */
 type CodeCatalogNamespace<TEntity> = {
 	get(id: string): TEntity | undefined;
@@ -300,7 +94,6 @@ declare function deprecateRetiredCodeCatalogRows(code: CodeCatalog | undefined,
 * visible. Returns undefined when neither source is wired.
 */
 declare function unionCatalogRead(code: CodeCatalog | undefined, store: AccessCatalogStore | undefined): AccessCatalogStore | undefined;
-import { StandardSchemaV1 as StandardSchemaV15 } from "@standard-schema/spec";
 /**
 * Resolve an access subject/target/resource reference (a string id or an object carrying one) to its
 * canonical, trimmed string id. This is the single id-resolution rule shared across the authz stack
@@ -316,6 +109,54 @@ declare function accessRefId(value: unknown): string;
 */
 declare function accessRootId(change: AccessChange): string;
 /**
+* ConfigSource-only block that lets an issuing IdP's token claims satisfy `has*` checks.
+* Placed independently on `sso`, each CIAM provider, and each incoming workload IdP.
+* Absent means that issuer's claims never satisfy entitlements.
+*
+* Derived rows are session-scoped for users and customers (expanded onto the session at login
+* and refresh) and per-request for workloads. They are never written to the access stores.
+*/
+type ClaimsAsEntitlements = {
+	/**
+	* Claim names to read. A dotted path addresses a nested claim (`realm_access.roles`).
+	* `scope` is space-delimited; every other string claim is one value; arrays contribute each string.
+	* Required and non-empty.
+	*/
+	claims: string[];
+	/**
+	* Expand a matched catalog role or group into the permissions it confers.
+	* Default false: a claim value matches only the catalog id it names.
+	*/
+	expand?: boolean;
+	/**
+	* Let catalog-bound resources on expanded rows satisfy resource-scoped checks.
+	* Default false. Ignored unless `expand` is true: a claim string cannot name a resource.
+	*/
+	resources?: boolean;
+};
+/** One effective entitlement derived from a token claim. Not a stored grant. */
+type DerivedEntitlement = {
+	targetType: OaaAccessTargetType;
+	target: string;
+	/** Set only when the plane opted into `resources` and the catalog row binds this resource. */
+	resource?: string;
+	/** Claim name the value was read from. */
+	claim: string;
+	/** Expansion root id when the row came from catalog expansion. Absent for a direct id match. */
+	root?: string;
+};
+/** Secret-free projection of a configured claims block, including whether the App can persist it. */
+type ClaimsAsEntitlementsDescription = {
+	claims: string[];
+	expand: boolean;
+	resources: boolean;
+	/**
+	* User and customer planes: the session store declares it persists `Session.entitlements`.
+	* Workload plane: always true (nothing is stored).
+	*/
+	capable: boolean;
+};
+/**
 * Shared minimal identity fields used to build both the workforce user
 * record (`BaseUser`) and the CIAM customer record (`BaseCustomer`), as well
 * as the authenticated session types (`WorkforceUser`, `Customer`).
@@ -1130,11 +971,10 @@ type WorkloadIdentity = {
 	/** Granted OAuth scopes (space-delimited). */
 	scope?: string;
 	/**
-	* Whether the trusted IdP that validated this token opts into honoring its OAuth `scope` claim as
-	* entitlements (per-IdP intent, resolved at validation time). Consumed by the request-level `has*`
-	* helpers; `undefined` falls back to the global `RemoteConfig.authz.scopesAsEntitlements`.
+	* Claim-derived entitlements for this request. Present only when the matched incoming IdP
+	* configured `claimsAsEntitlements`. Never persisted.
 	*/
-	scopesAsEntitlements?: boolean;
+	derivedEntitlements?: DerivedEntitlement[];
 	/**
 	* Enterprise Controlled ID for this workload (`ecid:<realm>:<opaque>`), when carried on the token
 	* `ecid` claim or enriched from a wired `WorkloadIdentityStore`. A workload is its own governance
@@ -1580,6 +1420,12 @@ interface WorkloadIdentityStore<TExtended = object> {
 * policy (flag, auto-revoke + notify, or simply audit).
 */
 type IamDeltaMode = "patch";
+/** ConfigSource-owned authenticated destination for the AccessRequests protocol. */
+type AccessRequestsDestination = {
+	url: string;
+	/** Named outgoing workload client. Omit to use the default workload server identity. */
+	audience?: string;
+};
 type AccessRequestCreate = {
 	subject: string;
 	subjectType: SubjectType;
@@ -1660,13 +1506,6 @@ interface IamDeltaEmitter {
 	/** Re-push the complete IAM-visible snapshot to the destination (app-driven full reconcile). */
 	reconcile(input: IamDeltaReconcileInput): Promise<IamDeltaReconcileResult>;
 	/**
-	* Submit an on-behalf access request at `${iam.url}/AccessRequests`. Requires only the
-	* destination channel (`url` plus the `deltaAudience` workload client) — not `isReady()`, which
-	* additionally demands delta egress (a per-kind `'patch'` mode and its receipt stores). A tenant
-	* whose IAM aggregates by pull alone may still submit requests.
-	*/
-	requestAccess(input: AccessRequestCreate): Promise<AccessRequestResult>;
-	/**
 	* Read a previously captured destination reference without making a network request. Returns
 	* undefined until the resource has been resolved or pushed to the configured IAM destination.
 	* `correlationId` is a User's `externalId` or an entitlement's App-owned catalog `id`.
@@ -1675,18 +1514,222 @@ interface IamDeltaEmitter {
 	isReady(): boolean;
 	ready(timeout?: number): Promise<void>;
 }
-import { StandardSchemaV1 as StandardSchemaV14 } from "@standard-schema/spec";
-type ChangeListener = () => void;
-/**
-* Reactive source/adapter contract. Implemented by config-source-backed adapters
-* (for example `SecretsSource`) to advertise change subscription and source liveness.
-* `isAvailable()` here is an adapter liveness hook and is intentionally distinct from
-* module readiness (`ModuleReadiness.isReady()` / `ready()`).
-*/
-type ReactiveHandle = {
-	beforeChange?(listener: ChangeListener): () => void;
-	afterChange?(listener: ChangeListener): () => void;
-	isAvailable?(): boolean;
+/** Built-in provider types. `oidc` is a generic OIDC provider; `magic-link` is the passwordless flow. */
+type CIAMProviderType = "oidc" | "google" | "github" | "microsoft" | "apple" | "magic-link";
+/** Branding colors for rendering a provider button in light and dark themes. */
+type CIAMProviderColors = {
+	/** Background/brand color for light theme (hex or CSS color). */
+	light: string;
+	/** Background/brand color for dark theme (hex or CSS color). */
+	dark: string;
+	/** Optional secondary/accent color. */
+	secondary?: string;
+};
+/** Operator-supplied branding so the UI can render a provider list without hardcoding. */
+type CIAMProviderBranding = {
+	/** Human-readable name shown on the login button (e.g. "Google"). */
+	displayName: string;
+	/** External icon URL (typically an SVG/PNG hosted on a CDN). */
+	iconUrl?: string;
+	/** Light/dark brand colors. */
+	colors?: CIAMProviderColors;
+	/** Optional provider info/marketing URL. */
+	url?: string;
+};
+/**
+* A single CIAM provider declaration. OIDC/OAuth2 endpoint and credential
+* fields come from the ConfigSource (never application code).
+*/
+type CIAMProviderConfig = {
+	/** Provider adapter type. Selects defaults and claim mapping. */
+	type: CIAMProviderType;
+	/** Whether this provider is enabled. Defaults to true when omitted. */
+	enabled?: boolean;
+	/** Recommended display order (ascending). Ties broken by declaration order. */
+	order?: number;
+	/** UI branding metadata. */
+	branding?: CIAMProviderBranding;
+	/** OIDC issuer/authority (used for discovery when explicit endpoints are omitted). */
+	authority?: string;
+	/** Authorization endpoint (overrides preset). */
+	authorizationUrl?: string;
+	/** Token endpoint (overrides preset). */
+	tokenUrl?: string;
+	/** JWKS endpoint for ID token verification (overrides preset). */
+	jwksUri?: string;
+	/** OAuth2 UserInfo endpoint for providers without an ID token (e.g. GitHub). */
+	userInfoUrl?: string;
+	/** OAuth2 client id (ConfigSource-only). */
+	clientId?: string;
+	/** OAuth2 client secret (ConfigSource-only). */
+	clientSecret?: string;
+	/** Requested scope (overrides preset). */
+	scope?: string;
+	/** Apple: team id for client-secret generation. */
+	teamId?: string;
+	/** Apple: key id for client-secret generation. */
+	keyId?: string;
+	/** Apple: PKCS#8 PEM private key for client-secret generation. */
+	privateKey?: string;
+	/**
+	* ConfigSource-only. When set, this provider's token claims are derived into session-scoped
+	* customer entitlements at login. Magic link has no issuer and ignores this block.
+	*/
+	claimsAsEntitlements?: ClaimsAsEntitlements;
+	/** ConfigSource-only IdP assignment workflow used when IAM assignment is `'idp'`. */
+	accessRequests?: AccessRequestsDestination;
+};
+/** Sanitized provider entry returned by the discovery endpoint for the UI. */
+type CIAMProviderDescriptor = {
+	/** Provider key (matches the RemoteConfig map key); used as `?provider=`. */
+	name: string;
+	type: CIAMProviderType;
+	displayName: string;
+	/** SDK-derived login URL to navigate to (begins the flow). */
+	loginUrl: string;
+	iconUrl?: string;
+	colors?: CIAMProviderColors;
+	url?: string;
+};
+/**
+* Light display cookies (`${cookiesPrefix}.profile`).
+*
+* The envelope is SDK-owned. App code supplies only `user`. The cookie is not an
+* authentication input: the server never reads it to resolve a session, and the browser
+* may forge it. `expiresAt` is display metadata so a client can order entries without a
+* round trip; authoritative expiry is the peer `${cookiesPrefix}.session` record.
+*/
+declare const DISPLAY_COOKIE_SUFFIX = ".profile";
+declare const DISPLAY_COOKIE_VERSION = 1;
+declare const DEFAULT_DISPLAY_COOKIE_MAX = 10;
+declare const DEFAULT_DISCOVERED_COOKIE_MAX = 10;
+declare const DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS: number;
+declare const DISCOVERED_COOKIE_PREFIX = "ion.discovered";
+type DisplayCookieConfig = {
+	/**
+	* When true, the SDK writes a non-HttpOnly display cookie beside the opaque session cookie.
+	* ConfigSource-only. Default false.
+	*/
+	enabled?: boolean;
+	/**
+	* How many display cookies a single response may leave on the browser, newest session window
+	* first. ConfigSource-only. Values below 1 fall back to {@link DEFAULT_DISPLAY_COOKIE_MAX}.
+	* @default 10
+	*/
+	max?: number;
+	/**
+	* Session-less tenant hints written by an App after an explicit directory lookup.
+	* ConfigSource-only and off unless `enabled` is true.
+	*/
+	discovered?: DiscoveredDisplayCookieConfig;
+};
+type DiscoveredDisplayCookieConfig = {
+	enabled?: boolean;
+	/** Browser hint lifetime. This is not a session expiry. @default 14400 */
+	ttlSeconds?: number;
+	/** Independent cap; discovered hints never displace live-session entries. @default 10 */
+	max?: number;
+};
+/** What `${basePath}/auth/user` and `${basePath}/auth/customer` return. ConfigSource-only. */
+type UserEndpointPolicy = "full" | "display" | "off";
+type DisplayUser = Record<string, string | number | boolean | null>;
+type DisplayAuthType = "sso" | "ciam";
+type DisplayCookieEnvelope = {
+	v: typeof DISPLAY_COOKIE_VERSION;
+	/**
+	* Session envelopes omit this field (absent means `'session'`) so the wire format stays identical
+	* to cookies written before discovered hints existed; only discovered hints set it explicitly.
+	* Readers must treat `undefined` as `'session'`.
+	*/
+	kind?: "session" | "discovered";
+	tenantId?: string;
+	authType: DisplayAuthType;
+	/** ISO timestamp copied from the session window at write time. Display only. */
+	expiresAt: string;
+	user: DisplayUser;
+	tenantName?: string;
+};
+type DisplayIdentity = {
+	name?: string;
+	email?: string;
+	avatar?: string;
+};
+declare function resolveDisplayCookieMax(max: number | undefined): number;
+declare function resolveDiscoveredCookieMax(max: number | undefined): number;
+declare function resolveDiscoveredCookieTtlSeconds(ttlSeconds: number | undefined): number;
+declare function defaultDisplayUser(identity: DisplayIdentity): DisplayUser;
+/** Drop non-primitives and auth-bearing keys. Display cookies carry UI fields only. */
+declare function sanitizeDisplayUser(value: unknown): DisplayUser;
+/**
+* AppDev projection runs on the full user (including custom attributes). When omitted, or when it
+* throws, the cookie carries name, email, and avatar only. Forbidden and non-primitive fields are
+* dropped either way — a projector cannot put a session id or token into the cookie.
+*/
+declare function projectDisplayUser<TUser extends object>(user: TUser, projector?: (user: TUser) => unknown): DisplayUser;
+declare function encodeDisplayCookie(envelope: DisplayCookieEnvelope): string;
+declare function decodeDisplayCookie(raw: string): DisplayCookieEnvelope | undefined;
+type ParsedDisplayCookie = {
+	name: string;
+	prefix: string;
+	envelope: DisplayCookieEnvelope;
+};
+declare function readDisplayCookies(cookieHeader: string | null | undefined): ParsedDisplayCookie[];
+/** Client ordering: newest session window first. Invalid timestamps sort last. */
+declare function compareDisplayExpiryDesc(a: string | undefined, b: string | undefined): number;
+declare function profileCookieName(cookiesPrefix: string): string;
+declare function discoveredProfileCookieName(tenantId: string): string;
+/**
+* Minimal logger interface compatible with common structured logging patterns.
+*/
+interface Logger {
+	trace(message?: unknown, ...optionalParams: unknown[]): void;
+	debug(message?: unknown, ...optionalParams: unknown[]): void;
+	info(message?: unknown, ...optionalParams: unknown[]): void;
+	warn(message?: unknown, ...optionalParams: unknown[]): void;
+	error(message?: unknown, ...optionalParams: unknown[]): void;
+}
+/**
+* Renders a structured logger call as one greppable line while leaving the source fields separate
+* for telemetry exporters.
+*/
+declare function formatLogLine(level: keyof Logger, message: unknown, optionalParams?: unknown[], timestamp?: Date): string;
+/**
+* No-op implementation — does nothing for any log level
+*/
+declare const silentLogger: Logger;
+/**
+* Default logger used until an ionite instance is configured with
+* an OpenTelemetry-backed logger or an application-provided logger.
+*/
+declare const defaultLogger: Logger;
+/**
+* Logger that logs messages debug, info, warn, and error to the console.
+*/
+declare const debugLogger: Logger;
+/**
+* Logger that logs messages info, warn, and error to the console.
+*/
+declare const infoLogger: Logger;
+/**
+* Logger that logs messages warn and error to the console.
+*/
+declare const warnLogger: Logger;
+/**
+* Human-readable single-line console logger for local application output.
+*/
+declare const prettyLogger: Logger;
+import { StandardSchemaV1 as StandardSchemaV15 } from "@standard-schema/spec";
+type ChangeListener = () => void;
+/**
+* Reactive source/adapter contract. Implemented by config-source-backed adapters
+* (for example `SecretsSource`) to advertise change subscription and source liveness.
+* `isAvailable()` here is an adapter liveness hook and is intentionally distinct from
+* module readiness (`ModuleReadiness.isReady()` / `ready()`).
+*/
+type ReactiveHandle = {
+	beforeChange?(listener: ChangeListener): () => void;
+	afterChange?(listener: ChangeListener): () => void;
+	isAvailable?(): boolean;
 };
 /**
 * Readiness contract for reactive module/service handles whose usability depends on
@@ -1724,35 +1767,406 @@ type ModuleReadinessState = {
 	active: boolean;
 	/** Synchronous readiness of the module right now (mirrors the module's own `isReady()`). */
 	ready: boolean;
-	/** Human-readable explanation when the module is `active` but not `ready`. */
-	reason?: string;
+	/** Human-readable explanation when the module is `active` but not `ready`. */
+	reason?: string;
+};
+/**
+* Holistic, read-only readiness snapshot for an ionite instance. Returned by
+* `ion.readiness()` and used by the built-in `${basePath}/readyz` endpoint. This is composition
+* DATA, not a request gate: applications combine it (via `ion.requireReady([...])`) with their own
+* non-ionite dependency checks to build their health endpoints.
+*/
+type ReadinessReport = {
+	/** True when config has been applied (`applied`) and every ACTIVE module is ready. */
+	ok: boolean;
+	/** Whether RemoteConfig has been applied at least once (mirrors `ion.isReady()`). */
+	applied: boolean;
+	/** Per-module readiness keyed by {@link ModuleName}. */
+	modules: Record<ModuleName, ModuleReadinessState>;
+	/** Most recent config-application outcome (last applied time and last error, if any). */
+	config: ConfigApplyStatus;
+};
+/** Result of `ion.requireReady(names)`: a synchronous, declarative readiness gate over selected modules. */
+type RequireReadyResult = {
+	/** True when config is applied and every requested module is ready. */
+	ok: boolean;
+	/** The requested modules that are not ready, with reasons when available. */
+	notReady: Array<{
+		name: ModuleName;
+		reason?: string;
+	}>;
+};
+type CapabilityKey = "sso.login" | "sso.jit" | "sso.logout" | "sso.back_channel_logout" | "sso.claims_authz" | "ciam.magic_link" | "ciam.oidc_login" | "ciam.customer" | "ciam.logout" | "ciam.claims_authz" | "iam.users" | "iam.groups" | "iam.groups.create" | "iam.workloads" | "iam.customers" | "workload.incoming" | "workload.outgoing" | "workload.claims_authz" | "authz.oaa" | "authz.access_requests" | "tm.integration";
+type CapabilityEndpointUrls = {
+	readyzUrl: string;
+	capabilitiezUrl: string;
+	sso: {
+		loginUrl: string;
+		userUrl: string;
+		logoutUrl: string;
+		logoutBackChannelUrl: string;
+		refreshUrl: string;
+		callbackUrl: string;
+	};
+	workload: {
+		validateUrl: string;
+		jwksUrl: string;
+	};
+	iam: {
+		basePath: string;
+		usersUrl: string;
+		groupsUrl: string;
+		workloadsUrl: string;
+		customersUrl: string;
+	};
+	ciam: {
+		magicLinkUrl: string;
+		magicLinkLoginUrl: string;
+		customerUrl: string;
+		customerLoginUrl: string;
+		customerCallbackUrl: string;
+		customerProvidersUrl: string;
+		logoutUrl: string;
+	};
+};
+type CapabilityState = {
+	module: ModuleName;
+	active: boolean;
+	ready: boolean;
+	testable: boolean;
+	urls?: string[];
+	reason?: string;
+};
+type CapabilitiezManifest = {
+	sdk: {
+		/** Runtime @ionite/server version serving this manifest. */
+		version: string;
+		/** Version of the stable capability/test-unit vocabulary. */
+		catalogVersion: number;
+	};
+	basePath: string;
+	urls: CapabilityEndpointUrls;
+	modules: Record<ModuleName, ModuleReadinessState>;
+	capabilities: Record<CapabilityKey, CapabilityState>;
+	/**
+	* True when FrameworkConfig wired a live LFV callback transport. Boolean only — the transport
+	* object, Redis URL, and credentials are never exposed.
+	*/
+	lfvCallbackTransport: boolean;
+};
+type OtelSignalName = "traces" | "metrics" | "logs";
+type OtelProtocol = "http/protobuf" | "http/json";
+type OtelProviderType = "otlp" | "grafana-lgtm" | "datadog" | "splunk" | "elastic";
+type OtelLogLevel = "trace" | "debug" | "info" | "warn" | "error";
+type OtelLevels = Partial<Record<OtelLogLevel, boolean>>;
+/** Local console mirror policy: disable it or set its minimum emitted severity. */
+type OtelConsoleMode = "off" | OtelLogLevel;
+type OtelAttributeValue = string | number | boolean | string[] | number[] | boolean[];
+type OtelAttributes = Record<string, OtelAttributeValue>;
+type OtelSignalConfig = {
+	/** Per-signal OTLP endpoint. When omitted, the module appends /v1/{signal} to `endpoint`. */
+	endpoint?: string;
+	headers?: Record<string, string>;
+	timeoutMillis?: number;
+	concurrencyLimit?: number;
+};
+type OtelMetricsSignalConfig = OtelSignalConfig & {
+	exportIntervalMillis?: number;
+	exportTimeoutMillis?: number;
+};
+type OtelOAuthClientCredentialsConfig = {
+	tokenUrl: string;
+	clientId: string;
+	clientSecret: string;
+	scope?: string;
+	audience?: string;
+	headers?: Record<string, string>;
+};
+type OtelLogRecord = {
+	severityNumber?: number;
+	severityText?: string;
+	body?: unknown;
+	attributes?: Record<string, unknown>;
+};
+/**
+* OpenTelemetry config supplied by ConfigSource/RemoteConfig.
+* Keep environment-specific URLs and credentials here, not in FrameworkConfig.
+*/
+type OtelConfig = {
+	type?: OtelProviderType;
+	name: string;
+	endpoint?: string;
+	protocol?: OtelProtocol;
+	headers?: Record<string, string>;
+	apiKey?: string;
+	/** Name of a `RemoteConfig.kms` key pool used for exporter authentication. */
+	apiKeyPool?: string;
+	apiKeyHeader?: string;
+	oauth?: OtelOAuthClientCredentialsConfig;
+	version?: string;
+	deploymentEnvironment?: string;
+	resourceAttributes?: OtelAttributes;
+	levels?: OtelLevels;
+	/** `'off'` exports only to OTel; a level dual-emits at or above that severity. Defaults to `'info'`. */
+	console?: OtelConsoleMode;
+	traces?: boolean | OtelSignalConfig;
+	metrics?: boolean | OtelMetricsSignalConfig;
+	logs?: boolean | OtelSignalConfig;
+};
+/**
+* OpenTelemetry app/runtime wiring supplied by code.
+* Instrumentation instances and callbacks live here because they are framework-specific code.
+*/
+type FrameworkOtelConfig = {
+	levels?: OtelLevels;
+	instrument?: unknown[];
+	/** Optional app-owned destination/renderer for records admitted by `RemoteConfig.otel.console`. */
+	console?: (record: OtelLogRecord) => void;
+	spanProcessors?: unknown[];
+	metricReaders?: unknown[];
+	logRecordProcessors?: unknown[];
+	sampler?: unknown;
+	textMapPropagator?: unknown;
+	contextManager?: unknown;
+	configure?: (options: Record<string, unknown>) => Record<string, unknown> | void;
+};
+type Otel = {
+	/** Secret-free, JSON-serializable configuration and readiness summary. */
+	describe(): OtelDescription;
+	beforeChange(listener: ChangeListener): () => void;
+	afterChange(listener: ChangeListener): () => void;
+	isReady(): boolean;
+	ready(timeout?: number): Promise<void>;
+	logger: Logger;
+	forceFlush(): Promise<void>;
+	shutdown(): Promise<void>;
+};
+type ModuleDescriptionBase<TModule extends ModuleName> = {
+	module: TModule;
+	active: boolean;
+	ready: boolean;
+};
+type CookieDescription = {
+	prefix?: string;
+	path?: string;
+	secure?: boolean;
+	sameSite?: "Strict" | "Lax";
+	domain?: string;
+};
+type SsoDescription = ModuleDescriptionBase<"sso"> & {
+	authority?: string;
+	tokenUrl?: string;
+	authorizationUrl?: string;
+	clientId?: string;
+	redirectUri?: string;
+	responseType?: "code";
+	scope?: string;
+	silentRedirectUri?: string;
+	jwksUri?: string;
+	endSessionEndpoint?: string;
+	revocationEndpoint?: string;
+	cookies: CookieDescription;
+	loginStateTtl?: number;
+	rotationGraceSeconds?: number;
+	sessionWindowSeconds?: number;
+	displayCookie?: DisplayCookieConfig;
+	jit: {
+		enabled: boolean;
+		userStore: boolean;
+	};
+	sessionStore: boolean;
+	/** Present when RemoteConfig configured claim-derived entitlements for this workforce issuer. */
+	claimsAsEntitlements?: ClaimsAsEntitlementsDescription;
+	urls: Partial<CapabilityEndpointUrls["sso"]>;
+};
+type CiamProviderDescription = {
+	name: string;
+	type: CIAMProviderType;
+	enabled: boolean;
+	order?: number;
+	branding?: CIAMProviderBranding;
+	authority?: string;
+	authorizationUrl?: string;
+	tokenUrl?: string;
+	jwksUri?: string;
+	userInfoUrl?: string;
+	clientId?: string;
+	scope?: string;
+	claimsAsEntitlements?: ClaimsAsEntitlementsDescription;
+	loginUrl: string;
+};
+type CiamDescription = ModuleDescriptionBase<"ciam"> & {
+	magicLinkTtl?: number;
+	loginStateTtl?: number;
+	sessionTtl?: number;
+	cookies: CookieDescription;
+	displayCookie?: DisplayCookieConfig;
+	jit: {
+		enabled: boolean;
+		customerStore: boolean;
+	};
+	sessionStore: boolean;
+	magicLinkStore: boolean;
+	providers: CiamProviderDescription[];
+	urls: Partial<CapabilityEndpointUrls["ciam"]>;
+};
+type IamPrincipalDescription = {
+	enabled: boolean;
+	assignment: IamAssignmentPolicy;
+	delta?: "patch";
+	storeWired: boolean;
+};
+type AccessRequestsChannelsDescription = {
+	iam?: string;
+	sso?: string;
+	ciam: Record<string, string>;
+};
+type IamDescription = ModuleDescriptionBase<"iam"> & {
+	url?: string;
+	deltaAudience?: string;
+	accessRequests: AccessRequestsChannelsDescription;
+	users: IamPrincipalDescription;
+	workloads: IamPrincipalDescription;
+	customers: IamPrincipalDescription;
+	groups: {
+		enabled: boolean;
+		catalogWired: boolean;
+	};
+	urls: Partial<CapabilityEndpointUrls["iam"]>;
+};
+type WorkloadTrustedIdpDescription = {
+	issuer: string;
+	jwksUri: string;
+	audience: string | string[];
+	claimsAsEntitlements?: ClaimsAsEntitlementsDescription;
+};
+type WorkloadClientDescription = {
+	name: string;
+	ready: boolean;
+	clientId?: string;
+	workloadId?: string;
+	idpTokenUrl?: string;
+	scope?: string;
+	audience?: string;
+	authMethod: "client_secret" | "private_key_jwt" | "server_only";
+};
+type WorkloadDescription = ModuleDescriptionBase<"workload"> & {
+	incoming: {
+		trustedIdps: WorkloadTrustedIdpDescription[];
+	};
+	outgoing: WorkloadClientDescription[];
+	urls: Partial<CapabilityEndpointUrls["workload"]>;
+};
+type SecretsSourceDescription = {
+	name: string;
+	type: "dev" | "gcp" | "vault" | "aws" | "azure";
+	ready: boolean;
+	url?: string;
+	clientId?: string;
+	authMethod?: string;
+};
+type SecretsDescription = ModuleDescriptionBase<"secrets"> & {
+	sources: SecretsSourceDescription[];
+};
+type KmsPoolDescription = {
+	name: string;
+	source?: string;
+	path: string;
+	ready: boolean;
+};
+type KmsDescription = ModuleDescriptionBase<"kms"> & {
+	pools: KmsPoolDescription[];
+};
+type OtelSignalDescription = {
+	enabled: boolean;
+	endpoint?: string;
+	timeoutMillis?: number;
+	concurrencyLimit?: number;
+	exportIntervalMillis?: number;
+	exportTimeoutMillis?: number;
+};
+type OtelDescription = ModuleDescriptionBase<"otel"> & {
+	type?: OtelProviderType;
+	name?: string;
+	endpoint?: string;
+	protocol?: OtelProtocol;
+	apiKeyPool?: string;
+	apiKeyHeader?: string;
+	oauth?: {
+		tokenUrl: string;
+		clientId: string;
+		scope?: string;
+		audience?: string;
+	};
+	version?: string;
+	deploymentEnvironment?: string;
+	resourceAttributes?: OtelAttributes;
+	levels?: OtelLevels;
+	console?: OtelConsoleMode;
+	signals: {
+		traces: OtelSignalDescription;
+		metrics: OtelSignalDescription;
+		logs: OtelSignalDescription;
+	};
+};
+type OaaDescription = {
+	ready: boolean;
+	url?: string;
+	providerId?: string;
+	datasourceId?: string;
+	applicationName?: string;
+	applicationType?: string;
+	population?: Record<string, string>;
+	fullSync: boolean;
+};
+type AuthzDescription = ModuleDescriptionBase<"authz"> & {
+	trustedProvisioningClients: Array<{
+		issuer: string;
+		audience: string | string[];
+		clientId: string;
+		permissions: string[];
+	}>;
+	oaa?: OaaDescription;
+	/** True when the App explicitly accepts IAM-sourced entitlement creation. */
+	inboundEntitlements: boolean;
+	stores: {
+		accessStore: boolean;
+		accessIndex: boolean;
+		catalogStore: boolean;
+		resources: boolean;
+	};
 };
-/**
-* Holistic, read-only readiness snapshot for an ionite instance. Returned by
-* `ion.readiness()` and used by the built-in `${basePath}/readyz` endpoint. This is composition
-* DATA, not a request gate: applications combine it (via `ion.requireReady([...])`) with their own
-* non-ionite dependency checks to build their health endpoints.
-*/
-type ReadinessReport = {
-	/** True when config has been applied (`applied`) and every ACTIVE module is ready. */
+type TmDescription = ModuleDescriptionBase<"tm"> & {
+	enabled: boolean;
+	ionite?: {
+		id: string;
+		name?: string;
+		url: string;
+		issuer: string;
+		jwksUri: string;
+		audience: string;
+		clientId: string;
+	};
+	consentTtlSeconds?: number;
+	maxRedeemAttempts?: number;
+};
+type ModuleDescription = SsoDescription | CiamDescription | IamDescription | WorkloadDescription | SecretsDescription | KmsDescription | OtelDescription | AuthzDescription | TmDescription;
+type IoniteDescription = {
+	id?: string;
+	sdk: {
+		version: string;
+		catalogVersion: number;
+	};
+	basePath: string;
+	urls: CapabilityEndpointUrls;
 	ok: boolean;
-	/** Whether RemoteConfig has been applied at least once (mirrors `ion.isReady()`). */
 	applied: boolean;
-	/** Per-module readiness keyed by {@link ModuleName}. */
-	modules: Record<ModuleName, ModuleReadinessState>;
-	/** Most recent config-application outcome (last applied time and last error, if any). */
 	config: ConfigApplyStatus;
-};
-/** Result of `ion.requireReady(names)`: a synchronous, declarative readiness gate over selected modules. */
-type RequireReadyResult = {
-	/** True when config is applied and every requested module is ready. */
-	ok: boolean;
-	/** The requested modules that are not ready, with reasons when available. */
-	notReady: Array<{
-		name: ModuleName;
-		reason?: string;
+	modules: Record<ModuleName, ModuleReadinessState & {
+		description?: ModuleDescription;
 	}>;
 };
+import { StandardSchemaV1 as StandardSchemaV14 } from "@standard-schema/spec";
 /**
 * Token caching for workload identity authentication.
 *
@@ -1943,12 +2357,10 @@ type WorkloadConfigBase = {
 	*/
 	audience?: string;
 	/**
-	* Per-IdP intent (incoming/server role only): when `true`, tokens validated against THIS trust
-	* anchor have their OAuth `scope` claim auto-honored as entitlements by the request-level `has*`
-	* helpers (audience-bound). Mirrors `RemoteConfig.authz.scopesAsEntitlements` but scoped to a single
-	* trusted IdP so first-party scopes can be honored while federated/third-party ones are not.
+	* Per-IdP intent (incoming/server role only): token claims from THIS trust anchor may satisfy
+	* `has*` (audience-bound). ConfigSource-only. There is no global fallback.
 	*/
-	scopesAsEntitlements?: boolean;
+	claimsAsEntitlements?: ClaimsAsEntitlements;
 	/**
 	* Default OAuth2 scopes (space-delimited)
 	*/
@@ -2058,21 +2470,10 @@ type ClientCredentialsWorkloadConfig = WorkloadConfigBase & {
 	*/
 	clientId: string;
 	/**
-	* OAuth2 client secret. Omit it to authenticate with a federated token instead
-	* (see `federatedTokenFile`). A client secret wins when both are present.
-	*/
-	clientSecret?: string;
-	/**
-	* Path to a projected federated token (e.g. AKS Workload Identity), sent as a jwt-bearer
-	* `client_assertion` in place of `client_secret`. Defaults to `AZURE_FEDERATED_TOKEN_FILE`.
-	* Read on every acquisition because the platform rotates it.
-	*/
-	federatedTokenFile?: string;
-	/**
-	* `managed_identity`: get the token from the platform's managed identity endpoint instead of an
-	* IdP token URL. `clientId` is the managed identity's client ID; `scope` names the audience.
+	* OAuth2 client secret
+	* REQUIRED for Client Credentials mode
 	*/
-	authMethod?: "managed_identity";
+	clientSecret: string;
 };
 /**
 * Server-Only Workload Configuration
@@ -2106,7 +2507,7 @@ type ServerOnlyWorkloadConfig = WorkloadConfigBase & {
 * detected based on which fields are present:
 *
 * - **JWT Bearer Grant**: Requires `workload_id` + `private_key`
-* - **Client Credentials**: Requires `client_id` + `client_secret`, a federated token file, or `authMethod: "managed_identity"`
+* - **Client Credentials**: Requires `client_id` + `client_secret`
 * - **Server-Only**: Only `jwks_uri` (and optionally `issuer`) for token validation
 *
 * The developer uses the same API regardless of mode - the library handles the details.
@@ -2135,8 +2536,8 @@ type TrustedIdp = {
 	* one of these values (with `azp` fallback). REQUIRED: prevents cross-app token reuse.
 	*/
 	audience: string | string[];
-	/** Per-IdP scopesAsEntitlements intent (see {@link WorkloadConfigBase.scopesAsEntitlements}). */
-	scopesAsEntitlements?: boolean;
+	/** Per-IdP claims intent (see {@link WorkloadConfigBase.claimsAsEntitlements}). */
+	claimsAsEntitlements?: ClaimsAsEntitlements;
 };
 /**
 * Workload config with separate incoming (server) and outgoing (client) roles.
@@ -2179,6 +2580,8 @@ interface WorkloadGetToken {
 * Workload Identity Authentication Interface
 */
 type Workload = WorkloadConfig & ModuleReadiness & Required<Pick<ModuleReadiness, "isReady" | "ready">> & {
+	/** Secret-free, JSON-serializable configuration and readiness summary. */
+	describe: () => WorkloadDescription;
 	/**
 	* Returns a token for this workload configuration.
 	* The optional argument overrides the configured default scope.
@@ -2193,7 +2596,9 @@ type Workload = WorkloadConfig & ModuleReadiness & Required<Pick<ModuleReadiness
 	/** Framework-agnostic request handler for the Workload module (token, validate, jwks, refresh). */
 	handler: (request: Request) => Promise<Response>;
 };
-type WorkloadClient = Pick<Workload, "getToken" | "refreshToken" | "generateJWTAssertion" | "revokeToken" | "beforeChange" | "afterChange" | "isReady" | "ready">;
+type WorkloadClient = Pick<Workload, "getToken" | "refreshToken" | "generateJWTAssertion" | "revokeToken" | "beforeChange" | "afterChange" | "isReady" | "ready"> & {
+	describe(): WorkloadClientDescription;
+};
 /**
 * SCIM Error response structure
 */
@@ -2251,7 +2656,8 @@ interface IAMHandlerConfig {
 * IAM configuration
 *
 * - If `url` is provided, groups_outbound is enabled (app calls external IAM)
-* - If a `catalogStore` is provided, groups_inbound is enabled (external IAM calls app)
+* - If a catalog source is provided, groups_inbound is enabled (external IAM calls app);
+*   `POST /Groups` additionally requires `AuthzConfig.onInboundEntitlement`
 * - If `userStore` is provided, users_inbound is enabled (external IAM calls app)
 */
 type IAMConfig = {
@@ -2367,6 +2773,7 @@ type IAMAccessRequestsConfig = {
 		request: AccessRequestResult;
 		created: boolean;
 	}>;
+	get?: (id: string) => Promise<AccessRequestResult | undefined>;
 };
 type IAMEntitlementRequestUrlContext = {
 	request: Request;
@@ -2595,7 +3002,7 @@ type IAMGroupsOutbound = {
 };
 /**
 * Groups Inbound extension - for receiving group provisioning from external IAM providers.
-* Enabled when a `catalogStore` is configured.
+* Enabled when a catalog source is configured; IAM-sourced create remains AppDev opt-in.
 */
 type IAMGroupsInbound = {
 	/**
@@ -2620,10 +3027,12 @@ type IAMUsersInbound = {
 *
 * - Core functions are user-related (outbound to external IAM)
 * - `groups_outbound` is available when `url` is configured
-* - `groups_inbound` is available when a `catalogStore` is configured
+* - `groups_inbound` is available when a catalog source is configured
 * - `users_inbound` is available when `userStore` is configured
 */
 type IAM = Omit<IAMConfig, "users" | "workloads" | "customers" | "groups"> & {
+	/** Secret-free, JSON-serializable configuration and readiness summary. */
+	describe: () => IamDescription;
 	users: IamPrincipalKind;
 	workloads: IamPrincipalKind;
 	customers: IamPrincipalKind;
@@ -2646,7 +3055,8 @@ type IAM = Omit<IAMConfig, "users" | "workloads" | "customers" | "groups"> & {
 	groups_outbound?: IAMGroupsOutbound;
 	/**
 	* Groups Inbound extension - receive group provisioning from external IAM.
-	* Available when a `catalogStore` is configured.
+	* Available when a catalog source is configured. `POST /Groups` returns 501 unless the App
+	* implements `AuthzConfig.onInboundEntitlement` and wires an `AccessCatalogStore`.
 	*/
 	groups_inbound?: IAMGroupsInbound;
 	/**
@@ -2808,6 +3218,8 @@ type KmsPoolSlot = {
 	ready(timeout?: number): Promise<void>;
 };
 type KmsPool = {
+	/** Secret-free, JSON-serializable pool configuration and readiness summary. */
+	describe(): KmsPoolDescription;
 	/**
 	* Returns the current granted key for slot 0. Calls wait on one shared local subscription until a
 	* grant is available; repeated calls resolve from the local cache and never initiate a vault request.
@@ -2840,6 +3252,8 @@ type KmsPool = {
 * (`ion.kms.<name>`); use `getPool(name)` when the name is dynamic.
 */
 type Kms = ModuleReadiness & {
+	/** Secret-free, JSON-serializable configuration and readiness summary. */
+	describe(): KmsDescription;
 	readonly config: Readonly<KmsConfig>;
 	listPools(): string[];
 	getPool(name: string): KmsPool;
@@ -2850,91 +3264,6 @@ type Kms = ModuleReadiness & {
 declare function parseKmsPoolDocument(value: unknown): KmsPoolDocument;
 /** Parse and fail closed on a vault-stored KMS key-material document. */
 declare function parseKmsPoolControlDocument(value: unknown): KmsPoolControlDocument;
-type OtelSignalName = "traces" | "metrics" | "logs";
-type OtelProtocol = "http/protobuf" | "http/json";
-type OtelProviderType = "otlp" | "grafana-lgtm" | "datadog" | "splunk" | "elastic";
-type OtelLogLevel = "trace" | "debug" | "info" | "warn" | "error";
-type OtelLevels = Partial<Record<OtelLogLevel, boolean>>;
-/** Local console mirror policy: disable it or set its minimum emitted severity. */
-type OtelConsoleMode = "off" | OtelLogLevel;
-type OtelAttributeValue = string | number | boolean | string[] | number[] | boolean[];
-type OtelAttributes = Record<string, OtelAttributeValue>;
-type OtelSignalConfig = {
-	/** Per-signal OTLP endpoint. When omitted, the module appends /v1/{signal} to `endpoint`. */
-	endpoint?: string;
-	headers?: Record<string, string>;
-	timeoutMillis?: number;
-	concurrencyLimit?: number;
-};
-type OtelMetricsSignalConfig = OtelSignalConfig & {
-	exportIntervalMillis?: number;
-	exportTimeoutMillis?: number;
-};
-type OtelOAuthClientCredentialsConfig = {
-	tokenUrl: string;
-	clientId: string;
-	clientSecret: string;
-	scope?: string;
-	audience?: string;
-	headers?: Record<string, string>;
-};
-type OtelLogRecord = {
-	severityNumber?: number;
-	severityText?: string;
-	body?: unknown;
-	attributes?: Record<string, unknown>;
-};
-/**
-* OpenTelemetry config supplied by ConfigSource/RemoteConfig.
-* Keep environment-specific URLs and credentials here, not in FrameworkConfig.
-*/
-type OtelConfig = {
-	type?: OtelProviderType;
-	name: string;
-	endpoint?: string;
-	protocol?: OtelProtocol;
-	headers?: Record<string, string>;
-	apiKey?: string;
-	/** Name of a `RemoteConfig.kms` key pool used for exporter authentication. */
-	apiKeyPool?: string;
-	apiKeyHeader?: string;
-	oauth?: OtelOAuthClientCredentialsConfig;
-	version?: string;
-	deploymentEnvironment?: string;
-	resourceAttributes?: OtelAttributes;
-	levels?: OtelLevels;
-	/** `'off'` exports only to OTel; a level dual-emits at or above that severity. Defaults to `'info'`. */
-	console?: OtelConsoleMode;
-	traces?: boolean | OtelSignalConfig;
-	metrics?: boolean | OtelMetricsSignalConfig;
-	logs?: boolean | OtelSignalConfig;
-};
-/**
-* OpenTelemetry app/runtime wiring supplied by code.
-* Instrumentation instances and callbacks live here because they are framework-specific code.
-*/
-type FrameworkOtelConfig = {
-	levels?: OtelLevels;
-	instrument?: unknown[];
-	/** Optional app-owned destination/renderer for records admitted by `RemoteConfig.otel.console`. */
-	console?: (record: OtelLogRecord) => void;
-	spanProcessors?: unknown[];
-	metricReaders?: unknown[];
-	logRecordProcessors?: unknown[];
-	sampler?: unknown;
-	textMapPropagator?: unknown;
-	contextManager?: unknown;
-	configure?: (options: Record<string, unknown>) => Record<string, unknown> | void;
-};
-type Otel = {
-	beforeChange(listener: ChangeListener): () => void;
-	afterChange(listener: ChangeListener): () => void;
-	isReady(): boolean;
-	ready(timeout?: number): Promise<void>;
-	logger: Logger;
-	forceFlush(): Promise<void>;
-	shutdown(): Promise<void>;
-};
 /**
 * Session management for tracking user sessions and enabling backchannel logout.
 *
@@ -3027,6 +3356,12 @@ type Session<TExtended = object> = {
 	*/
 	claims?: Record<string, unknown>;
 	/**
+	* Entitlements derived from token claims at login and refresh. Session-scoped: they die with the
+	* record (TTL, rotation, back-channel logout) and are never written to the access stores.
+	* Only meaningful when the store declares {@link SessionStoreCapabilities.derivedEntitlements}.
+	*/
+	entitlements?: DerivedEntitlement[];
+	/**
 	* Optional access-token claims for modules that keep access/id claims separate.
 	*/
 	accessClaims?: Record<string, unknown>;
@@ -3063,7 +3398,21 @@ type Session<TExtended = object> = {
 * }
 * ```
 */
+/**
+* Store-declared capabilities. The SDK does not probe a custom store (a write at init is forbidden);
+* a store that omits the declaration is treated as incapable.
+*/
+type SessionStoreCapabilities = {
+	/**
+	* The store persists {@link Session.entitlements} round-trip. JSON-backed stores (the SDK Redis
+	* and in-memory implementations) declare this. A column-mapped SQL store declares it only after
+	* it has a column for the derived set.
+	*/
+	derivedEntitlements?: boolean;
+};
 interface SessionStore<TExtended = object> {
+	/** Declaration of what this store persists beyond the required session fields. */
+	readonly capabilities?: SessionStoreCapabilities;
 	/**
 	* Create a new session in the store.
 	*
@@ -3396,6 +3745,13 @@ type SSOConfig<
 	*/
 	userStore?: UserStore<TUserData>;
 	/**
+	* ConfigSource-only. When set, the named token claims are derived into session-scoped
+	* entitlements at login and refresh. Never set from application code.
+	*/
+	claimsAsEntitlements?: ClaimsAsEntitlements;
+	/** ConfigSource-only IdP assignment workflow used when IAM assignment is `'idp'`. */
+	accessRequests?: AccessRequestsDestination;
+	/**
 	* Enable Just-In-Time (JIT) user provisioning.
 	* When enabled, new users are automatically created in the userStore on their first login.
 	* When disabled (default), only existing users in the userStore are updated on login.
@@ -3495,6 +3851,8 @@ type SSO<
 	TSessionData = Record<string, never>,
 	TUserData = Record<string, never>
 > = SSOConfig<TSessionData, TUserData> & {
+	/** Secret-free, JSON-serializable configuration and readiness summary. */
+	describe: () => SsoDescription;
 	getUser: (request: Request) => Promise<WorkforceUser | undefined>;
 	/**
 	* Degraded-aware resolution: distinguishes a signed-out visitor (`unauthenticated`) from a failed
@@ -3842,7 +4200,12 @@ type SecretsValidators = {
 	*/
 	validateSourceConfig?(sourceName: string, config: SecretsSourceConfig): void;
 };
+type DescribedSecretsSource = SecretsSource & {
+	describe(): SecretsSourceDescription;
+};
 type Secrets = ModuleReadiness & {
+	/** Secret-free, JSON-serializable configuration and readiness summary. */
+	describe(): SecretsDescription;
 	/**
 	* Liveness across configured sources. Returns false when any ready source reports a degraded
 	* `isAvailable()` (e.g. an HTTP-poll source whose upstream is failing). Surfaced in
@@ -3854,7 +4217,7 @@ type Secrets = ModuleReadiness & {
 	/** Returns configured secrets source names/keys. */
 	listSecretsSources(): string[];
 	/** Gets a named secrets source client. Throws when missing. */
-	getSecretsSource(sourceName: string): SecretsSource;
+	getSecretsSource(sourceName: string): DescribedSecretsSource;
 	/** Creates a lazy handle for a secret in a named source. */
 	get(sourceName: string, path: string, options?: SecretsOperationOptions): SecretHandle;
 	/** Reads a secret from a named secrets source client. */
@@ -4304,17 +4667,6 @@ type TrustedProvisioningClient = {
 type AuthzConfig = {
 	oaa?: AuthzOaaConfig;
 	/**
-	* RemoteConfig/Ops-governed intent. When `true`, the request-level `has*` helpers auto-honor a
-	* principal's OAuth token `scope` claims as entitlements: an app-wide check (no `resource` arg)
-	* also allows when the target id matches a granted scope. Default `false` (secure): scopes never
-	* satisfy `has*` and authorization comes solely from the `AccessAssignmentStore`/`AccessIndex` (IAM/SCIM).
-	* Read at check time so it can be flipped live. This NEVER affects token validation, and the
-	* explicit `hasScope*` helpers are always available regardless of this flag. Resource-scoped
-	* checks (a `resource` arg supplied) are never satisfied by scopes. For workload principals this is
-	* a fallback only: a matched trusted IdP's per-entry `scopesAsEntitlements` takes precedence.
-	*/
-	scopesAsEntitlements?: boolean;
-	/**
 	* Config-declared trusted provisioning clients (read-path overlay; ConfigSource/ECI-owned). Each
 	* entry pre-authorizes a workload client to hold specific permissions without a stored grant. See
 	* {@link TrustedProvisioningClient}. Honored in the request-level `has*` helpers BEFORE the
@@ -4364,6 +4716,12 @@ type AuthzConfig = {
 	* have been updated. Best-effort and isolated — throwing here never affects the SCIM response.
 	*/
 	onAccessMutation?: (summary: ScimMutationSummary) => void;
+	/**
+	* Explicit AppDev opt-in for IAM-sourced entitlement definitions. Inbound SCIM `POST /Groups`
+	* returns 501 when omitted. The callback may reject the proposal or accept it while attaching
+	* App-owned catalog structure; IAM-owned presentation is persisted from the SCIM resource.
+	*/
+	onInboundEntitlement?: (input: InboundEntitlementRequest) => InboundEntitlementDecision | Promise<InboundEntitlementDecision>;
 };
 /**
 * Configuration supplied by the framework/application when creating an ionite instance.
@@ -4395,11 +4753,11 @@ type FrameworkConfig = {
 * `afterLogout` callbacks, which are code-only and therefore kept. RemoteConfig-only intent flags (e.g. IAM `users`/`groups`
 * enablement) are also stripped from code.
 */
-type SSOConfigFromCode = Omit<SSOConfig, "loginUrl" | "userUrl" | "logoutUrl" | "logoutBackChannelUrl" | "refreshUrl" | "redirectUri">;
+type SSOConfigFromCode = Omit<SSOConfig, "loginUrl" | "userUrl" | "logoutUrl" | "logoutBackChannelUrl" | "refreshUrl" | "redirectUri" | "claimsAsEntitlements" | "accessRequests">;
 type IAMConfigFromCode = Omit<IAMConfig, "usersUrl" | "groupsUrl" | "workloadsUrl" | "customersUrl" | "users" | "workloads" | "customers" | "groups" | "discovery" | "deltaAudience"> & {
 	discovery?: Omit<IAMDiscoveryConfig, "basePath">;
 };
-type WorkloadServerConfigFromCode = Omit<Partial<WorkloadConfig>, "tokenUrl" | "validateUrl" | "jwksUrl" | "refreshUrl">;
+type WorkloadServerConfigFromCode = Omit<Partial<WorkloadConfig>, "tokenUrl" | "validateUrl" | "jwksUrl" | "refreshUrl" | "claimsAsEntitlements">;
 type FrameworkWorkloadConfigFromCode = WorkloadServerConfigFromCode | {
 	incoming?: WorkloadServerConfigFromCode;
 	outgoing?: FrameworkWorkloadIncomingOutgoing["outgoing"];
@@ -4445,7 +4803,7 @@ type RemoteConfig = {
 	/** OpenTelemetry collector/exporter config loaded from ConfigSource. */
 	otel?: OtelConfig;
 	authz?: AuthzConfig;
-	/** ConfigSource-owned Tenant Management activation and trusted integrator identity. */
+	/** ConfigSource-owned Tenant Management activation and trusted ionite identity. */
 	tm?: RemoteTmConfig;
 	/**
 	* Built-in readiness endpoint intent (Ops/ECI). The SDK mounts `${basePath}/readyz` by default;
@@ -4818,6 +5176,8 @@ type CIAM<
 	TMagicLinkData = Record<string, never>,
 	TCustomerData = Record<string, never>
 > = CIAMConfig<TMagicLinkData, TCustomerData> & {
+	/** Secret-free, JSON-serializable configuration and readiness summary. */
+	describe: () => CiamDescription;
 	getCustomer: (request: Request) => Promise<Customer | undefined>;
 	/**
 	* Degraded-aware resolution: distinguishes a signed-out visitor (`unauthenticated`) from a failed
@@ -4961,6 +5321,15 @@ type IoniteBase = {
 	* module is ready; `notReady` lists the requested modules that are not ready, with reasons.
 	*/
 	requireReady(names: ModuleName[]): RequireReadyResult;
+	/**
+	* Returns an allow-listed, JSON-serializable snapshot for privileged App-owned diagnostics.
+	* Unlike `config`, this never contains credentials, secret values, stores, or callbacks.
+	*
+	* Diagnostics only: each call rebuilds the readiness report and every module projection. Call it
+	* from an admin loader, never per request; handlers and health probes use `isReady()` /
+	* `requireReady()`.
+	*/
+	describe(): IoniteDescription;
 	/** Most recent RemoteConfig application outcome (last applied time and last error, if any). */
 	configStatus: ConfigApplyStatus;
 	/** Release config subscriptions and background resources. */
@@ -4981,8 +5350,8 @@ type ResolvedRoute = {
 	/**
 	* Authorization required to invoke this route. When set, the router enforces it (deny-by-default)
 	* before the handler runs: the caller must hold the {@link EndpointPermission.permission} as a
-	* granted entitlement, or—when `RemoteConfig.authz.scopesAsEntitlements` is enabled—carry the
-	* matching OAuth scope. Login/public/discovery routes omit it.
+	* granted entitlement, or a claim-derived entitlement from the issuing IdP's `claimsAsEntitlements`
+	* block. Login/public/discovery routes omit it.
 	*
 	* Three states, chosen so a custom `resolve` cannot silently drop authorization by omission:
 	* - a permission object → enforce it;
@@ -5046,7 +5415,10 @@ type ConfigChangeOptions = {
 type EnvironmentType = "POC" | "DEV" | "QA" | "PROD";
 type TenantStatus = "pending" | "processing" | "completed" | "failed" | "action_required";
 type CreateTenantRequestBase = {
+	/** App-owned routing key. ionite may suggest it; the App may reject a collision. */
 	id: string;
+	/** Stable tenant id in the ionite domain. */
+	ioniteId: string;
 	companyId: string;
 	companyName: string;
 	environmentType: EnvironmentType;
@@ -5058,8 +5430,9 @@ type CreateTenantRequestBase = {
 };
 /**
 * Body for creating a tenant (`POST ${basePath}`). `configLocator` may be supplied immediately or
-* patched later after the tenant's ConfigSource has been provisioned. Idempotent by `id`:
-* re-submitting the same `id` re-applies the record (safe for provisioning retries).
+* patched later after the tenant's ConfigSource has been provisioned. Idempotent by
+* `ioniteId`: re-submitting that id re-applies the existing App tenant even when its
+* App-owned `id` differs from ionite's original suggestion.
 */
 type CreateTenantRequest<TExtended extends object = object> = CreateTenantRequestBase & TExtended;
 /**
@@ -5133,7 +5506,10 @@ type TenantValidators<
 };
 declare function isConfigLocator(value: unknown): value is ConfigLocator;
 type BaseTenant = {
+	/** App-owned routing key. */
 	id: string;
+	/** Stable tenant id in the ionite domain, once this tenant is known to ionite. */
+	ioniteId?: string;
 	companyId: string;
 	companyName: string;
 	environmentType: EnvironmentType;
@@ -5155,7 +5531,7 @@ type BaseTenant = {
 	*/
 	configLocator?: ConfigLocator;
 	/**
-	* App-internal state for an integrator-requested Tenant Management handover. Protocol-internal
+	* App-internal state for an ionite-requested Tenant Management handover. Protocol-internal
 	* fields are never serialized by the TM wire handlers.
 	*/
 	integration?: TenantIntegration;
@@ -5163,9 +5539,8 @@ type BaseTenant = {
 type TenantIntegrationStatus = "consent_requested" | "consented" | "declined";
 type TenantIntegration = {
 	version: number;
-	integrator: string;
-	integratorName?: string;
-	integratorTenantId: string;
+	ioniteName?: string;
+	ioniteId: string;
 	productId: string;
 	applicationId: string;
 	handleHash: string;
@@ -5189,26 +5564,36 @@ type SetTenantIntegrationOptions = {
 	/** Compare-and-set guard for transitions within the same handle. */
 	expectedVersion?: number;
 };
-type TmIntegratorConfig = {
+/**
+* ConfigSource-only trust for the ionite control plane that drives Tenant Management. Code never
+* sets these fields; do not duplicate them in `workload.incoming` or `authz.trustedProvisioningClients`.
+*/
+type TmIoniteConfig = {
+	/** Stable identifier of the trusted ionite control plane. */
 	id: string;
+	/** Optional human-readable name used in consent copy. */
 	name?: string;
+	/** Browser-facing ionite URL used to restart an integration. */
 	url: string;
+	/** Required `iss` claim on ionite-signed staged-request handles and ionite workload tokens. */
 	issuer: string;
+	/** ionite JWKS endpoint used to verify signed staged-request handles. */
 	jwksUri: string;
+	/** Required `aud` claim binding an ionite-staged request to this App. */
 	audience: string;
+	/** Required `azp`/client identity of the trusted ionite control plane. */
 	clientId: string;
 };
 type RemoteTmConfig = {
 	enabled: true;
-	integrator: TmIntegratorConfig;
+	ionite: TmIoniteConfig;
 	consentTtlSeconds?: number;
 	maxRedeemAttempts?: number;
 };
 type StagedIntegration = {
 	handle: string;
-	integrator: string;
-	integratorName?: string;
-	integratorTenantId: string;
+	ioniteName?: string;
+	ioniteId: string;
 	productId: string;
 	applicationId: string;
 	issuedAt: string;
@@ -5240,9 +5625,15 @@ type FrameworkTmConfig<TTenant extends BaseTenant = BaseTenant> = {
 	exportConfig?: (context: {
 		tenant: TTenant;
 	}) => ConfigExportEnvelope | Promise<ConfigExportEnvelope>;
+	/**
+	* Runs after a consented tenant runtime has successfully applied config through the newly
+	* persisted destination locator. Cleanup must be idempotent because another App replica may
+	* observe the same handover concurrently.
+	*/
 	onHandoverApplied?: (context: {
 		tenant: TTenant;
 		previousLocator?: ConfigLocator;
+		destinationLocator: ConfigLocator;
 	}) => void | Promise<void>;
 	/** Runs after a tenant POST has durably upserted its row. Awaited; the return value is ignored and failures are logged without rolling back the tenant. */
 	onTenantCreated?: (context: {
@@ -5272,6 +5663,8 @@ type TenantIntegrationView = {
 	integration: TenantIntegration;
 };
 type TenantManagement<TTenant extends BaseTenant = BaseTenant> = ModuleReadiness & {
+	/** Secret-free, JSON-serializable configuration and readiness summary. */
+	describe(): TmDescription;
 	handler(request: Request): Promise<Response>;
 	getTenant(id: string): Promise<TTenant | undefined>;
 	recordConsent(input: RecordTenantConsentInput): Promise<TTenant>;
@@ -5327,6 +5720,19 @@ interface TenantDirectory<TTenant extends BaseTenant = BaseTenant> {
 	findUserTenants?(identity: TenantDirectoryIdentity, options?: ListOptions): Promise<ListResult<TTenant>>;
 	findTenantsByEmailDomain?(domain: string, options?: ListOptions): Promise<ListResult<TTenant>>;
 }
+/**
+* App-owned tenant persistence for routing and Tenant Management.
+*
+* Tenants carry two ids: `id` is the App-owned routing key and `ioniteId` is ionite's stable id.
+* Implementations MUST keep `ioniteId` unique across tenants and MUST treat it as immutable once
+* set: `upsert` and `setIntegration` reject a different `ioniteId` for a bound tenant (the
+* built-in in-memory and Redis stores throw `ionite id cannot change`) and an `upsert` that omits
+* `ioniteId` keeps the stored value. The TM handler enforces the same rule at the HTTP layer; the
+* store rule protects App-owned write paths that bypass `ion.tm`.
+*
+* `setIntegration` and `getByIntegrationHandleHash` are required only for ionite consent. They are
+* metadata-only writes and MUST NOT evict the tenant runtime cache; ordinary `upsert`/`delete` do.
+*/
 interface TenantStore<TTenant extends BaseTenant = BaseTenant> {
 	get(id: string): Promise<TTenant | undefined>;
 	list(options?: ListOptions): Promise<ListResult<TTenant>>;
@@ -5335,6 +5741,8 @@ interface TenantStore<TTenant extends BaseTenant = BaseTenant> {
 	getIon(id: string): Promise<Ionite | undefined>;
 	setIntegration?(tenantId: string, integration: TenantIntegration | undefined, options?: SetTenantIntegrationOptions): Promise<TTenant | undefined>;
 	getByIntegrationHandleHash?(handleHash: string): Promise<TTenant | undefined>;
+	/** Looks up a tenant by ionite's stable id; TM create is idempotent by this key. */
+	getByIoniteId(ioniteId: string): Promise<TTenant | undefined>;
 }
 type InMemoryTenantStoreOptions = {
 	/**
@@ -5559,6 +5967,35 @@ type OaaAccessTargetType = "group" | "role" | "permission";
 type EntitlementType = OaaAccessTargetType;
 /** A catalog Entitlement: a group, role, or permission (see {@link EntitlementType}). */
 type Entitlement<TAttributes extends object = object> = Group<TAttributes> | Role<TAttributes> | Permission<TAttributes>;
+/** Validated IAM-authored presentation and membership proposed through inbound SCIM `POST /Groups`. */
+type InboundEntitlementRequest = {
+	type: EntitlementType;
+	displayName: string;
+	description?: string;
+	externalId?: string;
+	riskLevel?: RiskLevel;
+	attributes?: Record<string, unknown>;
+	resources?: string[];
+	members: GroupMember[];
+	request: Request;
+};
+/**
+* AppDev decision for an IAM-sourced entitlement. Accepting may attach only App-owned structure;
+* IAM-owned presentation remains sourced from the inbound SCIM resource.
+*/
+type InboundEntitlementDecision = {
+	accept: false;
+	reason?: string;
+} | {
+	accept: true;
+	id?: string;
+	assignableSubjectTypes?: SubjectType[];
+	recommendedSubjectTypes?: SubjectType[];
+	permissions?: string[];
+	roles?: string[];
+	groups?: string[];
+	resources?: string[];
+};
 declare const ION_AUTHZ_GROUP_SCHEMA = "urn:ionite:params:scim:schemas:extension:authz:2.0:Group";
 type AuthzScimGroupType = OaaAccessTargetType;
 type AuthzScimGroupExtension = {
@@ -5948,6 +6385,8 @@ interface OaaClient<
 	TCustomer = BaseCustomer,
 	TWorkload = BaseWorkloadIdentity
 > {
+	/** Secret-free, JSON-serializable OAA configuration and readiness summary. */
+	describe(): OaaDescription;
 	pushUser(user: TUser): Promise<void>;
 	pushCustomer(customer: TCustomer): Promise<void>;
 	pushWorkload(workload: TWorkload): Promise<void>;
@@ -6066,6 +6505,8 @@ type ReconcileReport = {
 * wired they deny by default (`{ allow: false }`, `metadata.reason = 'access_index_not_configured'`).
 */
 type Authz = {
+	/** Secret-free, JSON-serializable configuration and readiness summary. */
+	describe(): AuthzDescription;
 	oaa: OaaClient;
 	/** Read the effective catalog union (materialized rows plus unmaterialized code templates). */
 	entitlements: {
@@ -6117,9 +6558,9 @@ type Authz = {
 	*/
 	grant(change: AccessChange): Promise<AccessChange>;
 	/**
-	* Submit one grant or revoke request on a principal's behalf. Allowed only when that kind's
-	* assignment policy is `'iam-request'`. One operation maps to one approval decision, status,
-	* and tracking URL. Authenticated with the module-wide `deltaAudience` workload client.
+	* Submit one grant or revoke request on a principal's behalf. Under `'iam-request'`, targets the
+	* IAM destination; under `'idp'`, targets the claims-bearing SSO/CIAM provider. One operation
+	* maps to one approval decision, status, and tracking URL.
 	*/
 	requestAccess(change: {
 		subject: AccessChange["subject"];
@@ -6128,6 +6569,20 @@ type Authz = {
 		target: AccessChange["target"];
 		operation: "grant" | "revoke";
 		justification?: string;
+		/** CIAM provider key. Required only when multiple providers expose an AccessRequests channel. */
+		provider?: string;
+	}): Promise<{
+		id: string;
+		status: "pending" | "approved" | "denied";
+		operation: "grant" | "revoke";
+		trackingUrl: string;
+	}>;
+	/** Read the destination-owned state of an on-behalf access request. */
+	getAccessRequest(input: {
+		id: string;
+		subjectType: SubjectType;
+		/** CIAM provider key. Required only when multiple providers expose an AccessRequests channel. */
+		provider?: string;
 	}): Promise<{
 		id: string;
 		status: "pending" | "approved" | "denied";
@@ -6147,8 +6602,10 @@ type Authz = {
 * - `'iam'` — never assign in-app; show a request link (or a read-only entitlement table).
 * - `'iam-request'` — never assign in-app; the app submits a request on the principal's behalf via
 *   {@link Authz.requestAccess}.
+* - `'idp'` — the claims-bearing SSO/CIAM provider is assigner of record; requests use that
+*   provider's ConfigSource-owned AccessRequests channel.
 */
-type IamAssignmentPolicy = "app" | "iam" | "iam-request";
+type IamAssignmentPolicy = "app" | "iam" | "iam-request" | "idp";
 /**
 * Thrown by {@link Authz.grant} when the Ops-owned assignment policy forbids in-app assignment.
 * `requestUrl` is the IAM-written entitlement receipt when one exists, so the app can send the
@@ -6199,64 +6656,6 @@ declare function trustedClientPermissionsForPrincipal(authz: AuthzConfig | null
 * OAA full sync — they are NEVER written to a store or materialized into the AccessIndex.
 */
 declare function configTrustedClientGrants(authz: AuthzConfig | null | undefined): AccessChange[];
-type CapabilityKey = "sso.login" | "sso.jit" | "sso.logout" | "sso.back_channel_logout" | "ciam.magic_link" | "ciam.oidc_login" | "ciam.customer" | "ciam.logout" | "iam.users" | "iam.groups" | "iam.workloads" | "iam.customers" | "workload.incoming" | "workload.outgoing" | "authz.oaa" | "tm.integration";
-type CapabilityEndpointUrls = {
-	readyzUrl: string;
-	capabilitiezUrl: string;
-	sso: {
-		loginUrl: string;
-		userUrl: string;
-		logoutUrl: string;
-		logoutBackChannelUrl: string;
-		refreshUrl: string;
-		callbackUrl: string;
-	};
-	workload: {
-		validateUrl: string;
-		jwksUrl: string;
-	};
-	iam: {
-		basePath: string;
-		usersUrl: string;
-		groupsUrl: string;
-		workloadsUrl: string;
-		customersUrl: string;
-	};
-	ciam: {
-		magicLinkUrl: string;
-		magicLinkLoginUrl: string;
-		customerUrl: string;
-		customerLoginUrl: string;
-		customerCallbackUrl: string;
-		customerProvidersUrl: string;
-		logoutUrl: string;
-	};
-};
-type CapabilityState = {
-	module: ModuleName;
-	active: boolean;
-	ready: boolean;
-	testable: boolean;
-	urls?: string[];
-	reason?: string;
-};
-type CapabilitiezManifest = {
-	sdk: {
-		/** Runtime @ionite/server version serving this manifest. */
-		version: string;
-		/** Version of the stable capability/test-unit vocabulary. */
-		catalogVersion: number;
-	};
-	basePath: string;
-	urls: CapabilityEndpointUrls;
-	modules: Record<ModuleName, ModuleReadinessState>;
-	capabilities: Record<CapabilityKey, CapabilityState>;
-	/**
-	* True when FrameworkConfig wired a live LFV callback transport. Boolean only — the transport
-	* object, Redis URL, and credentials are never exposed.
-	*/
-	lfvCallbackTransport: boolean;
-};
 /**
 * Fields a {@link ConfigSource} may attach to a thrown error so the SDK can classify load/subscribe
 * failures structurally instead of by fragile message-substring matching (§2.1). All fields are
@@ -6625,4 +7024,4 @@ type LfvErrorResponse = {
 };
 /** Generates a ULID */
 declare function generateULID(prefix?: string): string;
-export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestResult, AccessStatus, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InferSecretType, Ionite, IoniteBase, IoniteError, IoniteErrorOptions, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceMap, SecretsSourceType, SecretsSubscriptionOptions, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmIntegratorConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWebSocketAuthHeader, VaultWebSocketSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadConfig, WorkloadConfigMap, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, discoveredProfileCookieName, encodeDisplayCookie, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };
+export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestResult, AccessRequestsDestination, AccessStatus, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzDescription, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, CiamDescription, CiamProviderDescription, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CookieDescription, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, DerivedEntitlement, DescribedSecretsSource, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamDescription, IamPrincipalDescription, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InboundEntitlementDecision, InboundEntitlementRequest, InferSecretType, Ionite, IoniteBase, IoniteDescription, IoniteError, IoniteErrorOptions, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsDescription, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDescription, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleDescription, ModuleDescriptionBase, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaDescription, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelDescription, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalDescription, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsDescription, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceDescription, SecretsSourceMap, SecretsSourceType, SecretsSubscriptionOptions, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, SsoDescription, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmDescription, TmIoniteConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWebSocketAuthHeader, VaultWebSocketSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadClientDescription, WorkloadConfig, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadTrustedIdpDescription, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, discoveredProfileCookieName, encodeDisplayCookie, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };