@ionite/core 0.0.24-beta.20261003.17 → 0.0.24-beta.20261006.21

package/dist/server.d.ts

@@ -9,205 +9,54 @@ type NoReserved<
 > = TAttributes extends object ? [TFullShapeKeys] extends [never] ? TAttributes & { [TKey in Extract<keyof TAttributes, TReserved>]? : never } : [TFullShapeKeys] extends [keyof TAttributes] ? Omit<TAttributes, TReserved> : TAttributes & { [TKey in Extract<keyof TAttributes, TReserved>]? : never } : TAttributes;
 import { StandardSchemaV1 as StandardSchemaV18 } from "@standard-schema/spec";
 /**
-* Third-party CIAM provider presets and claim mapping.
+* ConfigSource-only block that lets an issuing IdP's token claims satisfy `has*` checks.
+* Placed independently on `sso`, each CIAM provider, and each incoming workload IdP.
+* Absent means that issuer's claims never satisfy entitlements.
 *
-* Defines the built-in provider adapters used by the CIAM module for customer
-* login. Each preset supplies default OIDC/OAuth2 endpoints, scope, branding,
-* and a claim mapper that normalizes provider claims into a candidate customer.
-* The application's `CustomerStore` remains the system of record: the SDK only
-* extracts standard claims and hands a candidate to `lookup`/`upsert`.
+* Derived rows are session-scoped for users and customers (expanded onto the session at login
+* and refresh) and per-request for workloads. They are never written to the access stores.
 */
-/** Built-in provider types. `oidc` is a generic OIDC provider; `magic-link` is the passwordless flow. */
-type CIAMProviderType = "oidc" | "google" | "github" | "microsoft" | "apple" | "magic-link";
-/** Branding colors for rendering a provider button in light and dark themes. */
-type CIAMProviderColors = {
-	/** Background/brand color for light theme (hex or CSS color). */
-	light: string;
-	/** Background/brand color for dark theme (hex or CSS color). */
-	dark: string;
-	/** Optional secondary/accent color. */
-	secondary?: string;
-};
-/** Operator-supplied branding so the UI can render a provider list without hardcoding. */
-type CIAMProviderBranding = {
-	/** Human-readable name shown on the login button (e.g. "Google"). */
-	displayName: string;
-	/** External icon URL (typically an SVG/PNG hosted on a CDN). */
-	iconUrl?: string;
-	/** Light/dark brand colors. */
-	colors?: CIAMProviderColors;
-	/** Optional provider info/marketing URL. */
-	url?: string;
-};
-/**
-* A single CIAM provider declaration. OIDC/OAuth2 endpoint and credential
-* fields come from the ConfigSource (never application code).
-*/
-type CIAMProviderConfig = {
-	/** Provider adapter type. Selects defaults and claim mapping. */
-	type: CIAMProviderType;
-	/** Whether this provider is enabled. Defaults to true when omitted. */
-	enabled?: boolean;
-	/** Recommended display order (ascending). Ties broken by declaration order. */
-	order?: number;
-	/** UI branding metadata. */
-	branding?: CIAMProviderBranding;
-	/** OIDC issuer/authority (used for discovery when explicit endpoints are omitted). */
-	authority?: string;
-	/** Authorization endpoint (overrides preset). */
-	authorizationUrl?: string;
-	/** Token endpoint (overrides preset). */
-	tokenUrl?: string;
-	/** JWKS endpoint for ID token verification (overrides preset). */
-	jwksUri?: string;
-	/** OAuth2 UserInfo endpoint for providers without an ID token (e.g. GitHub). */
-	userInfoUrl?: string;
-	/** OAuth2 client id (ConfigSource-only). */
-	clientId?: string;
-	/** OAuth2 client secret (ConfigSource-only). */
-	clientSecret?: string;
-	/** Requested scope (overrides preset). */
-	scope?: string;
-	/** Apple: team id for client-secret generation. */
-	teamId?: string;
-	/** Apple: key id for client-secret generation. */
-	keyId?: string;
-	/** Apple: PKCS#8 PEM private key for client-secret generation. */
-	privateKey?: string;
-};
-/** Sanitized provider entry returned by the discovery endpoint for the UI. */
-type CIAMProviderDescriptor = {
-	/** Provider key (matches the RemoteConfig map key); used as `?provider=`. */
-	name: string;
-	type: CIAMProviderType;
-	displayName: string;
-	/** SDK-derived login URL to navigate to (begins the flow). */
-	loginUrl: string;
-	iconUrl?: string;
-	colors?: CIAMProviderColors;
-	url?: string;
-};
-/** Normalized claim candidate produced by a provider claim mapper. */
-type CiamClaimCandidate = {
-	/** Provider-native subject identifier. */
-	sub: string;
-	email?: string;
-	name?: string;
-	userName?: string;
-	avatar?: string;
-};
-/** How a provider conveys identity after token exchange. */
-type CIAMProviderFlow = "id_token" | "userinfo";
-type CIAMProviderPreset = {
-	flow: CIAMProviderFlow;
-	authorizationUrl?: string;
-	tokenUrl?: string;
-	jwksUri?: string;
-	userInfoUrl?: string;
-	scope: string;
-	branding: CIAMProviderBranding;
-	/** Extra authorization query parameters (e.g. Apple `response_mode`). */
-	extraAuthParams?: Record<string, string>;
-	mapClaims: (claims: Record<string, unknown>) => CiamClaimCandidate;
-};
-declare const CIAM_PROVIDER_PRESETS: Record<Exclude<CIAMProviderType, "magic-link">, CIAMProviderPreset>;
-/** Returns the preset for a provider type, or undefined for `magic-link`. */
-declare function getProviderPreset(type: CIAMProviderType): CIAMProviderPreset | undefined;
-/** Effective provider settings after merging preset defaults with config overrides. */
-type ResolvedCiamProvider = {
-	name: string;
-	type: CIAMProviderType;
-	flow: CIAMProviderFlow;
-	authorizationUrl?: string;
-	tokenUrl?: string;
-	jwksUri?: string;
-	userInfoUrl?: string;
-	scope: string;
-	clientId?: string;
-	clientSecret?: string;
-	extraAuthParams?: Record<string, string>;
-	branding: CIAMProviderBranding;
-	mapClaims: (claims: Record<string, unknown>) => CiamClaimCandidate;
-	config: CIAMProviderConfig;
-};
-/**
-* Merge a provider config with its preset to produce effective OIDC/OAuth2
-* settings and branding. Returns undefined for `magic-link` (handled separately).
-*/
-declare function resolveCiamProvider(name: string, config: CIAMProviderConfig): ResolvedCiamProvider | undefined;
-/** Effective branding for a provider (preset defaults merged with config overrides). */
-declare function resolveProviderBranding(config: CIAMProviderConfig): CIAMProviderBranding;
-/**
-* Order and filter providers for display. Enabled providers only, sorted by
-* `order` (ascending), with declaration order as the tie-breaker. This is the
-* recommended presentation order returned by the discovery endpoint.
-*/
-declare function orderedEnabledProviders(providers: Record<string, CIAMProviderConfig> | undefined): Array<{
-	name: string;
-	config: CIAMProviderConfig;
-}>;
-declare const DISPLAY_COOKIE_VERSION = 1;
-type DisplayCookieConfig = {
+type ClaimsAsEntitlements = {
 	/**
-	* When true, the SDK writes a non-HttpOnly display cookie beside the opaque session cookie.
-	* ConfigSource-only. Default false.
+	* Claim names to read. A dotted path addresses a nested claim (`realm_access.roles`).
+	* `scope` is space-delimited; every other string claim is one value; arrays contribute each string.
+	* Required and non-empty.
 	*/
-	enabled?: boolean;
+	claims: string[];
 	/**
-	* How many display cookies a single response may leave on the browser, newest session window
-	* first. ConfigSource-only. Values below 1 fall back to {@link DEFAULT_DISPLAY_COOKIE_MAX}.
-	* @default 10
+	* Expand a matched catalog role or group into the permissions it confers.
+	* Default false: a claim value matches only the catalog id it names.
 	*/
-	max?: number;
+	expand?: boolean;
 	/**
-	* Session-less tenant hints written by an App after an explicit directory lookup.
-	* ConfigSource-only and off unless `enabled` is true.
+	* Let catalog-bound resources on expanded rows satisfy resource-scoped checks.
+	* Default false. Ignored unless `expand` is true: a claim string cannot name a resource.
 	*/
-	discovered?: DiscoveredDisplayCookieConfig;
+	resources?: boolean;
 };
-type DiscoveredDisplayCookieConfig = {
-	enabled?: boolean;
-	/** Browser hint lifetime. This is not a session expiry. @default 14400 */
-	ttlSeconds?: number;
-	/** Independent cap; discovered hints never displace live-session entries. @default 10 */
-	max?: number;
+/** One effective entitlement derived from a token claim. Not a stored grant. */
+type DerivedEntitlement = {
+	targetType: OaaAccessTargetType;
+	target: string;
+	/** Set only when the plane opted into `resources` and the catalog row binds this resource. */
+	resource?: string;
+	/** Claim name the value was read from. */
+	claim: string;
+	/** Expansion root id when the row came from catalog expansion. Absent for a direct id match. */
+	root?: string;
 };
-/** What `${basePath}/auth/user` and `${basePath}/auth/customer` return. ConfigSource-only. */
-type UserEndpointPolicy = "full" | "display" | "off";
-type DisplayUser = Record<string, string | number | boolean | null>;
-type DisplayAuthType = "sso" | "ciam";
-type DisplayCookieEnvelope = {
-	v: typeof DISPLAY_COOKIE_VERSION;
+/** Secret-free projection of a configured claims block, including whether the App can persist it. */
+type ClaimsAsEntitlementsDescription = {
+	claims: string[];
+	expand: boolean;
+	resources: boolean;
 	/**
-	* Session envelopes omit this field (absent means `'session'`) so the wire format stays identical
-	* to cookies written before discovered hints existed; only discovered hints set it explicitly.
-	* Readers must treat `undefined` as `'session'`.
+	* User and customer planes: the session store declares it persists `Session.entitlements`.
+	* Workload plane: always true (nothing is stored).
 	*/
-	kind?: "session" | "discovered";
-	tenantId?: string;
-	authType: DisplayAuthType;
-	/** ISO timestamp copied from the session window at write time. Display only. */
-	expiresAt: string;
-	user: DisplayUser;
-	tenantName?: string;
-};
-type ParsedDisplayCookie = {
-	name: string;
-	prefix: string;
-	envelope: DisplayCookieEnvelope;
+	capable: boolean;
 };
 /**
-* Minimal logger interface compatible with common structured logging patterns.
-*/
-interface Logger {
-	trace(message?: unknown, ...optionalParams: unknown[]): void;
-	debug(message?: unknown, ...optionalParams: unknown[]): void;
-	info(message?: unknown, ...optionalParams: unknown[]): void;
-	warn(message?: unknown, ...optionalParams: unknown[]): void;
-	error(message?: unknown, ...optionalParams: unknown[]): void;
-}
-import { StandardSchemaV1 as StandardSchemaV15 } from "@standard-schema/spec";
-/**
 * Shared minimal identity fields used to build both the workforce user
 * record (`BaseUser`) and the CIAM customer record (`BaseCustomer`), as well
 * as the authenticated session types (`WorkforceUser`, `Customer`).
@@ -963,11 +812,10 @@ type WorkloadIdentity = {
 	/** Granted OAuth scopes (space-delimited). */
 	scope?: string;
 	/**
-	* Whether the trusted IdP that validated this token opts into honoring its OAuth `scope` claim as
-	* entitlements (per-IdP intent, resolved at validation time). Consumed by the request-level `has*`
-	* helpers; `undefined` falls back to the global `RemoteConfig.authz.scopesAsEntitlements`.
+	* Claim-derived entitlements for this request. Present only when the matched incoming IdP
+	* configured `claimsAsEntitlements`. Never persisted.
 	*/
-	scopesAsEntitlements?: boolean;
+	derivedEntitlements?: DerivedEntitlement[];
 	/**
 	* Enterprise Controlled ID for this workload (`ecid:<realm>:<opaque>`), when carried on the token
 	* `ecid` claim or enriched from a wired `WorkloadIdentityStore`. A workload is its own governance
@@ -1409,6 +1257,12 @@ interface WorkloadIdentityStore<TExtended = object> {
 * policy (flag, auto-revoke + notify, or simply audit).
 */
 type IamDeltaMode = "patch";
+/** ConfigSource-owned authenticated destination for the AccessRequests protocol. */
+type AccessRequestsDestination = {
+	url: string;
+	/** Named outgoing workload client. Omit to use the default workload server identity. */
+	audience?: string;
+};
 type AccessRequestCreate = {
 	subject: string;
 	subjectType: SubjectType;
@@ -1489,13 +1343,6 @@ interface IamDeltaEmitter {
 	/** Re-push the complete IAM-visible snapshot to the destination (app-driven full reconcile). */
 	reconcile(input: IamDeltaReconcileInput): Promise<IamDeltaReconcileResult>;
 	/**
-	* Submit an on-behalf access request at `${iam.url}/AccessRequests`. Requires only the
-	* destination channel (`url` plus the `deltaAudience` workload client) — not `isReady()`, which
-	* additionally demands delta egress (a per-kind `'patch'` mode and its receipt stores). A tenant
-	* whose IAM aggregates by pull alone may still submit requests.
-	*/
-	requestAccess(input: AccessRequestCreate): Promise<AccessRequestResult>;
-	/**
 	* Read a previously captured destination reference without making a network request. Returns
 	* undefined until the resource has been resolved or pushed to the configured IAM destination.
 	* `correlationId` is a User's `externalId` or an entitlement's App-owned catalog `id`.
@@ -1504,84 +1351,601 @@ interface IamDeltaEmitter {
 	isReady(): boolean;
 	ready(timeout?: number): Promise<void>;
 }
-import { StandardSchemaV1 as StandardSchemaV14 } from "@standard-schema/spec";
-type ChangeListener = () => void;
+/** Built-in provider types. `oidc` is a generic OIDC provider; `magic-link` is the passwordless flow. */
+type CIAMProviderType = "oidc" | "google" | "github" | "microsoft" | "apple" | "magic-link";
+/** Branding colors for rendering a provider button in light and dark themes. */
+type CIAMProviderColors = {
+	/** Background/brand color for light theme (hex or CSS color). */
+	light: string;
+	/** Background/brand color for dark theme (hex or CSS color). */
+	dark: string;
+	/** Optional secondary/accent color. */
+	secondary?: string;
+};
+/** Operator-supplied branding so the UI can render a provider list without hardcoding. */
+type CIAMProviderBranding = {
+	/** Human-readable name shown on the login button (e.g. "Google"). */
+	displayName: string;
+	/** External icon URL (typically an SVG/PNG hosted on a CDN). */
+	iconUrl?: string;
+	/** Light/dark brand colors. */
+	colors?: CIAMProviderColors;
+	/** Optional provider info/marketing URL. */
+	url?: string;
+};
 /**
-* Reactive source/adapter contract. Implemented by config-source-backed adapters
-* (for example `SecretsSource`) to advertise change subscription and source liveness.
-* `isAvailable()` here is an adapter liveness hook and is intentionally distinct from
-* module readiness (`ModuleReadiness.isReady()` / `ready()`).
+* A single CIAM provider declaration. OIDC/OAuth2 endpoint and credential
+* fields come from the ConfigSource (never application code).
 */
-type ReactiveHandle = {
-	beforeChange?(listener: ChangeListener): () => void;
-	afterChange?(listener: ChangeListener): () => void;
-	isAvailable?(): boolean;
+type CIAMProviderConfig = {
+	/** Provider adapter type. Selects defaults and claim mapping. */
+	type: CIAMProviderType;
+	/** Whether this provider is enabled. Defaults to true when omitted. */
+	enabled?: boolean;
+	/** Recommended display order (ascending). Ties broken by declaration order. */
+	order?: number;
+	/** UI branding metadata. */
+	branding?: CIAMProviderBranding;
+	/** OIDC issuer/authority (used for discovery when explicit endpoints are omitted). */
+	authority?: string;
+	/** Authorization endpoint (overrides preset). */
+	authorizationUrl?: string;
+	/** Token endpoint (overrides preset). */
+	tokenUrl?: string;
+	/** JWKS endpoint for ID token verification (overrides preset). */
+	jwksUri?: string;
+	/** OAuth2 UserInfo endpoint for providers without an ID token (e.g. GitHub). */
+	userInfoUrl?: string;
+	/** OAuth2 client id (ConfigSource-only). */
+	clientId?: string;
+	/** OAuth2 client secret (ConfigSource-only). */
+	clientSecret?: string;
+	/** Requested scope (overrides preset). */
+	scope?: string;
+	/** Apple: team id for client-secret generation. */
+	teamId?: string;
+	/** Apple: key id for client-secret generation. */
+	keyId?: string;
+	/** Apple: PKCS#8 PEM private key for client-secret generation. */
+	privateKey?: string;
+	/**
+	* ConfigSource-only. When set, this provider's token claims are derived into session-scoped
+	* customer entitlements at login. Magic link has no issuer and ignores this block.
+	*/
+	claimsAsEntitlements?: ClaimsAsEntitlements;
+	/** ConfigSource-only IdP assignment workflow used when IAM assignment is `'idp'`. */
+	accessRequests?: AccessRequestsDestination;
+};
+/** Sanitized provider entry returned by the discovery endpoint for the UI. */
+type CIAMProviderDescriptor = {
+	/** Provider key (matches the RemoteConfig map key); used as `?provider=`. */
+	name: string;
+	type: CIAMProviderType;
+	displayName: string;
+	/** SDK-derived login URL to navigate to (begins the flow). */
+	loginUrl: string;
+	iconUrl?: string;
+	colors?: CIAMProviderColors;
+	url?: string;
+};
+/** Normalized claim candidate produced by a provider claim mapper. */
+type CiamClaimCandidate = {
+	/** Provider-native subject identifier. */
+	sub: string;
+	email?: string;
+	name?: string;
+	userName?: string;
+	avatar?: string;
+};
+/** How a provider conveys identity after token exchange. */
+type CIAMProviderFlow = "id_token" | "userinfo";
+type CIAMProviderPreset = {
+	flow: CIAMProviderFlow;
+	authorizationUrl?: string;
+	tokenUrl?: string;
+	jwksUri?: string;
+	userInfoUrl?: string;
+	scope: string;
+	branding: CIAMProviderBranding;
+	/** Extra authorization query parameters (e.g. Apple `response_mode`). */
+	extraAuthParams?: Record<string, string>;
+	mapClaims: (claims: Record<string, unknown>) => CiamClaimCandidate;
+};
+declare const CIAM_PROVIDER_PRESETS: Record<Exclude<CIAMProviderType, "magic-link">, CIAMProviderPreset>;
+/** Returns the preset for a provider type, or undefined for `magic-link`. */
+declare function getProviderPreset(type: CIAMProviderType): CIAMProviderPreset | undefined;
+/** Effective provider settings after merging preset defaults with config overrides. */
+type ResolvedCiamProvider = {
+	name: string;
+	type: CIAMProviderType;
+	flow: CIAMProviderFlow;
+	authorizationUrl?: string;
+	tokenUrl?: string;
+	jwksUri?: string;
+	userInfoUrl?: string;
+	scope: string;
+	clientId?: string;
+	clientSecret?: string;
+	extraAuthParams?: Record<string, string>;
+	branding: CIAMProviderBranding;
+	mapClaims: (claims: Record<string, unknown>) => CiamClaimCandidate;
+	config: CIAMProviderConfig;
+};
+/**
+* Merge a provider config with its preset to produce effective OIDC/OAuth2
+* settings and branding. Returns undefined for `magic-link` (handled separately).
+*/
+declare function resolveCiamProvider(name: string, config: CIAMProviderConfig): ResolvedCiamProvider | undefined;
+/** Effective branding for a provider (preset defaults merged with config overrides). */
+declare function resolveProviderBranding(config: CIAMProviderConfig): CIAMProviderBranding;
+/**
+* Order and filter providers for display. Enabled providers only, sorted by
+* `order` (ascending), with declaration order as the tie-breaker. This is the
+* recommended presentation order returned by the discovery endpoint.
+*/
+declare function orderedEnabledProviders(providers: Record<string, CIAMProviderConfig> | undefined): Array<{
+	name: string;
+	config: CIAMProviderConfig;
+}>;
+declare const DISPLAY_COOKIE_VERSION = 1;
+type DisplayCookieConfig = {
+	/**
+	* When true, the SDK writes a non-HttpOnly display cookie beside the opaque session cookie.
+	* ConfigSource-only. Default false.
+	*/
+	enabled?: boolean;
+	/**
+	* How many display cookies a single response may leave on the browser, newest session window
+	* first. ConfigSource-only. Values below 1 fall back to {@link DEFAULT_DISPLAY_COOKIE_MAX}.
+	* @default 10
+	*/
+	max?: number;
+	/**
+	* Session-less tenant hints written by an App after an explicit directory lookup.
+	* ConfigSource-only and off unless `enabled` is true.
+	*/
+	discovered?: DiscoveredDisplayCookieConfig;
+};
+type DiscoveredDisplayCookieConfig = {
+	enabled?: boolean;
+	/** Browser hint lifetime. This is not a session expiry. @default 14400 */
+	ttlSeconds?: number;
+	/** Independent cap; discovered hints never displace live-session entries. @default 10 */
+	max?: number;
+};
+/** What `${basePath}/auth/user` and `${basePath}/auth/customer` return. ConfigSource-only. */
+type UserEndpointPolicy = "full" | "display" | "off";
+type DisplayUser = Record<string, string | number | boolean | null>;
+type DisplayAuthType = "sso" | "ciam";
+type DisplayCookieEnvelope = {
+	v: typeof DISPLAY_COOKIE_VERSION;
+	/**
+	* Session envelopes omit this field (absent means `'session'`) so the wire format stays identical
+	* to cookies written before discovered hints existed; only discovered hints set it explicitly.
+	* Readers must treat `undefined` as `'session'`.
+	*/
+	kind?: "session" | "discovered";
+	tenantId?: string;
+	authType: DisplayAuthType;
+	/** ISO timestamp copied from the session window at write time. Display only. */
+	expiresAt: string;
+	user: DisplayUser;
+	tenantName?: string;
+};
+type ParsedDisplayCookie = {
+	name: string;
+	prefix: string;
+	envelope: DisplayCookieEnvelope;
+};
+/**
+* Minimal logger interface compatible with common structured logging patterns.
+*/
+interface Logger {
+	trace(message?: unknown, ...optionalParams: unknown[]): void;
+	debug(message?: unknown, ...optionalParams: unknown[]): void;
+	info(message?: unknown, ...optionalParams: unknown[]): void;
+	warn(message?: unknown, ...optionalParams: unknown[]): void;
+	error(message?: unknown, ...optionalParams: unknown[]): void;
+}
+import { StandardSchemaV1 as StandardSchemaV15 } from "@standard-schema/spec";
+type ChangeListener = () => void;
+/**
+* Reactive source/adapter contract. Implemented by config-source-backed adapters
+* (for example `SecretsSource`) to advertise change subscription and source liveness.
+* `isAvailable()` here is an adapter liveness hook and is intentionally distinct from
+* module readiness (`ModuleReadiness.isReady()` / `ready()`).
+*/
+type ReactiveHandle = {
+	beforeChange?(listener: ChangeListener): () => void;
+	afterChange?(listener: ChangeListener): () => void;
+	isAvailable?(): boolean;
+};
+/**
+* Readiness contract for reactive module/service handles whose usability depends on
+* RemoteConfig that can arrive or change at runtime (for example `ion.secrets`,
+* `ion.workload`, `ion.otel`, `ion.authz.oaa`).
+*
+* - `isReady()` is a synchronous check; use it in request handlers and health probes and
+*   return 503 (or branch) when false instead of blocking.
+* - `ready(timeout?)` resolves once the handle first becomes usable; use it at startup or
+*   as a feature gate. With no timeout it waits indefinitely; with `timeout > 0` it rejects
+*   after that many milliseconds.
+*/
+type ModuleReadiness = {
+	beforeChange?(listener: ChangeListener): () => void;
+	afterChange?(listener: ChangeListener): () => void;
+	isReady?(): boolean;
+	ready?(timeout?: number): Promise<void>;
+};
+/**
+* Canonical ionite module names used by the holistic readiness report and the
+* `requireReady([...])` helper. These are the config-driven module handles whose readiness can be
+* composed; `ion.isReady()` itself stays the narrow "config applied" signal and is NOT one of these.
+*
+* IAM-delta egress is intentionally NOT a member. Delta patch-back is best-effort and non-fatal (a
+* failed push only logs `degraded` and is reconciled by a later full sync — the Batch 7 drift-signal
+* contract), so folding it into `iam` readiness would let a delta-target outage make
+* `requireReady(['iam'])` false and take the app out of rotation for a signal that is designed not to
+* block. Apps that DO treat delta as a hard dependency can gate on `ion.iam.delta.isReady()` /
+* `ion.iam.delta.ready()` explicitly instead.
+*/
+type ModuleName = "sso" | "ciam" | "iam" | "workload" | "otel" | "secrets" | "kms" | "authz" | "tm";
+/** Per-module readiness snapshot in {@link ReadinessReport}. */
+type ModuleReadinessState = {
+	/** Whether the module is active (present/requested) in the effective config. Inactive modules never block readiness. */
+	active: boolean;
+	/** Synchronous readiness of the module right now (mirrors the module's own `isReady()`). */
+	ready: boolean;
+	/** Human-readable explanation when the module is `active` but not `ready`. */
+	reason?: string;
+};
+/**
+* Holistic, read-only readiness snapshot for an ionite instance. Returned by
+* `ion.readiness()` and used by the built-in `${basePath}/readyz` endpoint. This is composition
+* DATA, not a request gate: applications combine it (via `ion.requireReady([...])`) with their own
+* non-ionite dependency checks to build their health endpoints.
+*/
+type ReadinessReport = {
+	/** True when config has been applied (`applied`) and every ACTIVE module is ready. */
+	ok: boolean;
+	/** Whether RemoteConfig has been applied at least once (mirrors `ion.isReady()`). */
+	applied: boolean;
+	/** Per-module readiness keyed by {@link ModuleName}. */
+	modules: Record<ModuleName, ModuleReadinessState>;
+	/** Most recent config-application outcome (last applied time and last error, if any). */
+	config: ConfigApplyStatus;
+};
+/** Result of `ion.requireReady(names)`: a synchronous, declarative readiness gate over selected modules. */
+type RequireReadyResult = {
+	/** True when config is applied and every requested module is ready. */
+	ok: boolean;
+	/** The requested modules that are not ready, with reasons when available. */
+	notReady: Array<{
+		name: ModuleName;
+		reason?: string;
+	}>;
+};
+type CapabilityEndpointUrls = {
+	readyzUrl: string;
+	capabilitiezUrl: string;
+	sso: {
+		loginUrl: string;
+		userUrl: string;
+		logoutUrl: string;
+		logoutBackChannelUrl: string;
+		refreshUrl: string;
+		callbackUrl: string;
+	};
+	workload: {
+		validateUrl: string;
+		jwksUrl: string;
+	};
+	iam: {
+		basePath: string;
+		usersUrl: string;
+		groupsUrl: string;
+		workloadsUrl: string;
+		customersUrl: string;
+	};
+	ciam: {
+		magicLinkUrl: string;
+		magicLinkLoginUrl: string;
+		customerUrl: string;
+		customerLoginUrl: string;
+		customerCallbackUrl: string;
+		customerProvidersUrl: string;
+		logoutUrl: string;
+	};
+};
+type OtelProtocol = "http/protobuf" | "http/json";
+type OtelProviderType = "otlp" | "grafana-lgtm" | "datadog" | "splunk" | "elastic";
+type OtelLogLevel = "trace" | "debug" | "info" | "warn" | "error";
+type OtelLevels = Partial<Record<OtelLogLevel, boolean>>;
+/** Local console mirror policy: disable it or set its minimum emitted severity. */
+type OtelConsoleMode = "off" | OtelLogLevel;
+type OtelAttributeValue = string | number | boolean | string[] | number[] | boolean[];
+type OtelAttributes = Record<string, OtelAttributeValue>;
+type OtelSignalConfig = {
+	/** Per-signal OTLP endpoint. When omitted, the module appends /v1/{signal} to `endpoint`. */
+	endpoint?: string;
+	headers?: Record<string, string>;
+	timeoutMillis?: number;
+	concurrencyLimit?: number;
+};
+type OtelMetricsSignalConfig = OtelSignalConfig & {
+	exportIntervalMillis?: number;
+	exportTimeoutMillis?: number;
+};
+type OtelOAuthClientCredentialsConfig = {
+	tokenUrl: string;
+	clientId: string;
+	clientSecret: string;
+	scope?: string;
+	audience?: string;
+	headers?: Record<string, string>;
+};
+/**
+* OpenTelemetry config supplied by ConfigSource/RemoteConfig.
+* Keep environment-specific URLs and credentials here, not in FrameworkConfig.
+*/
+type OtelConfig = {
+	type?: OtelProviderType;
+	name: string;
+	endpoint?: string;
+	protocol?: OtelProtocol;
+	headers?: Record<string, string>;
+	apiKey?: string;
+	/** Name of a `RemoteConfig.kms` key pool used for exporter authentication. */
+	apiKeyPool?: string;
+	apiKeyHeader?: string;
+	oauth?: OtelOAuthClientCredentialsConfig;
+	version?: string;
+	deploymentEnvironment?: string;
+	resourceAttributes?: OtelAttributes;
+	levels?: OtelLevels;
+	/** `'off'` exports only to OTel; a level dual-emits at or above that severity. Defaults to `'info'`. */
+	console?: OtelConsoleMode;
+	traces?: boolean | OtelSignalConfig;
+	metrics?: boolean | OtelMetricsSignalConfig;
+	logs?: boolean | OtelSignalConfig;
+};
+type Otel = {
+	/** Secret-free, JSON-serializable configuration and readiness summary. */
+	describe(): OtelDescription;
+	beforeChange(listener: ChangeListener): () => void;
+	afterChange(listener: ChangeListener): () => void;
+	isReady(): boolean;
+	ready(timeout?: number): Promise<void>;
+	logger: Logger;
+	forceFlush(): Promise<void>;
+	shutdown(): Promise<void>;
+};
+type ModuleDescriptionBase<TModule extends ModuleName> = {
+	module: TModule;
+	active: boolean;
+	ready: boolean;
+};
+type CookieDescription = {
+	prefix?: string;
+	path?: string;
+	secure?: boolean;
+	sameSite?: "Strict" | "Lax";
+	domain?: string;
+};
+type SsoDescription = ModuleDescriptionBase<"sso"> & {
+	authority?: string;
+	tokenUrl?: string;
+	authorizationUrl?: string;
+	clientId?: string;
+	redirectUri?: string;
+	responseType?: "code";
+	scope?: string;
+	silentRedirectUri?: string;
+	jwksUri?: string;
+	endSessionEndpoint?: string;
+	revocationEndpoint?: string;
+	cookies: CookieDescription;
+	loginStateTtl?: number;
+	rotationGraceSeconds?: number;
+	sessionWindowSeconds?: number;
+	displayCookie?: DisplayCookieConfig;
+	jit: {
+		enabled: boolean;
+		userStore: boolean;
+	};
+	sessionStore: boolean;
+	/** Present when RemoteConfig configured claim-derived entitlements for this workforce issuer. */
+	claimsAsEntitlements?: ClaimsAsEntitlementsDescription;
+	urls: Partial<CapabilityEndpointUrls["sso"]>;
+};
+type CiamProviderDescription = {
+	name: string;
+	type: CIAMProviderType;
+	enabled: boolean;
+	order?: number;
+	branding?: CIAMProviderBranding;
+	authority?: string;
+	authorizationUrl?: string;
+	tokenUrl?: string;
+	jwksUri?: string;
+	userInfoUrl?: string;
+	clientId?: string;
+	scope?: string;
+	claimsAsEntitlements?: ClaimsAsEntitlementsDescription;
+	loginUrl: string;
+};
+type CiamDescription = ModuleDescriptionBase<"ciam"> & {
+	magicLinkTtl?: number;
+	loginStateTtl?: number;
+	sessionTtl?: number;
+	cookies: CookieDescription;
+	displayCookie?: DisplayCookieConfig;
+	jit: {
+		enabled: boolean;
+		customerStore: boolean;
+	};
+	sessionStore: boolean;
+	magicLinkStore: boolean;
+	providers: CiamProviderDescription[];
+	urls: Partial<CapabilityEndpointUrls["ciam"]>;
+};
+type IamPrincipalDescription = {
+	enabled: boolean;
+	assignment: IamAssignmentPolicy;
+	delta?: "patch";
+	storeWired: boolean;
 };
-/**
-* Readiness contract for reactive module/service handles whose usability depends on
-* RemoteConfig that can arrive or change at runtime (for example `ion.secrets`,
-* `ion.workload`, `ion.otel`, `ion.authz.oaa`).
-*
-* - `isReady()` is a synchronous check; use it in request handlers and health probes and
-*   return 503 (or branch) when false instead of blocking.
-* - `ready(timeout?)` resolves once the handle first becomes usable; use it at startup or
-*   as a feature gate. With no timeout it waits indefinitely; with `timeout > 0` it rejects
-*   after that many milliseconds.
-*/
-type ModuleReadiness = {
-	beforeChange?(listener: ChangeListener): () => void;
-	afterChange?(listener: ChangeListener): () => void;
-	isReady?(): boolean;
-	ready?(timeout?: number): Promise<void>;
+type AccessRequestsChannelsDescription = {
+	iam?: string;
+	sso?: string;
+	ciam: Record<string, string>;
 };
-/**
-* Canonical ionite module names used by the holistic readiness report and the
-* `requireReady([...])` helper. These are the config-driven module handles whose readiness can be
-* composed; `ion.isReady()` itself stays the narrow "config applied" signal and is NOT one of these.
-*
-* IAM-delta egress is intentionally NOT a member. Delta patch-back is best-effort and non-fatal (a
-* failed push only logs `degraded` and is reconciled by a later full sync — the Batch 7 drift-signal
-* contract), so folding it into `iam` readiness would let a delta-target outage make
-* `requireReady(['iam'])` false and take the app out of rotation for a signal that is designed not to
-* block. Apps that DO treat delta as a hard dependency can gate on `ion.iam.delta.isReady()` /
-* `ion.iam.delta.ready()` explicitly instead.
-*/
-type ModuleName = "sso" | "ciam" | "iam" | "workload" | "otel" | "secrets" | "kms" | "authz" | "tm";
-/** Per-module readiness snapshot in {@link ReadinessReport}. */
-type ModuleReadinessState = {
-	/** Whether the module is active (present/requested) in the effective config. Inactive modules never block readiness. */
-	active: boolean;
-	/** Synchronous readiness of the module right now (mirrors the module's own `isReady()`). */
+type IamDescription = ModuleDescriptionBase<"iam"> & {
+	url?: string;
+	deltaAudience?: string;
+	accessRequests: AccessRequestsChannelsDescription;
+	users: IamPrincipalDescription;
+	workloads: IamPrincipalDescription;
+	customers: IamPrincipalDescription;
+	groups: {
+		enabled: boolean;
+		catalogWired: boolean;
+	};
+	urls: Partial<CapabilityEndpointUrls["iam"]>;
+};
+type WorkloadTrustedIdpDescription = {
+	issuer: string;
+	jwksUri: string;
+	audience: string | string[];
+	claimsAsEntitlements?: ClaimsAsEntitlementsDescription;
+};
+type WorkloadClientDescription = {
+	name: string;
 	ready: boolean;
-	/** Human-readable explanation when the module is `active` but not `ready`. */
-	reason?: string;
+	clientId?: string;
+	workloadId?: string;
+	idpTokenUrl?: string;
+	scope?: string;
+	audience?: string;
+	authMethod: "client_secret" | "private_key_jwt" | "server_only";
 };
-/**
-* Holistic, read-only readiness snapshot for an ionite instance. Returned by
-* `ion.readiness()` and used by the built-in `${basePath}/readyz` endpoint. This is composition
-* DATA, not a request gate: applications combine it (via `ion.requireReady([...])`) with their own
-* non-ionite dependency checks to build their health endpoints.
-*/
-type ReadinessReport = {
-	/** True when config has been applied (`applied`) and every ACTIVE module is ready. */
+type WorkloadDescription = ModuleDescriptionBase<"workload"> & {
+	incoming: {
+		trustedIdps: WorkloadTrustedIdpDescription[];
+	};
+	outgoing: WorkloadClientDescription[];
+	urls: Partial<CapabilityEndpointUrls["workload"]>;
+};
+type SecretsSourceDescription = {
+	name: string;
+	type: "dev" | "gcp" | "vault" | "aws" | "azure";
+	ready: boolean;
+	url?: string;
+	clientId?: string;
+	authMethod?: string;
+};
+type SecretsDescription = ModuleDescriptionBase<"secrets"> & {
+	sources: SecretsSourceDescription[];
+};
+type KmsPoolDescription = {
+	name: string;
+	source?: string;
+	path: string;
+	ready: boolean;
+};
+type KmsDescription = ModuleDescriptionBase<"kms"> & {
+	pools: KmsPoolDescription[];
+};
+type OtelSignalDescription = {
+	enabled: boolean;
+	endpoint?: string;
+	timeoutMillis?: number;
+	concurrencyLimit?: number;
+	exportIntervalMillis?: number;
+	exportTimeoutMillis?: number;
+};
+type OtelDescription = ModuleDescriptionBase<"otel"> & {
+	type?: OtelProviderType;
+	name?: string;
+	endpoint?: string;
+	protocol?: OtelProtocol;
+	apiKeyPool?: string;
+	apiKeyHeader?: string;
+	oauth?: {
+		tokenUrl: string;
+		clientId: string;
+		scope?: string;
+		audience?: string;
+	};
+	version?: string;
+	deploymentEnvironment?: string;
+	resourceAttributes?: OtelAttributes;
+	levels?: OtelLevels;
+	console?: OtelConsoleMode;
+	signals: {
+		traces: OtelSignalDescription;
+		metrics: OtelSignalDescription;
+		logs: OtelSignalDescription;
+	};
+};
+type OaaDescription = {
+	ready: boolean;
+	url?: string;
+	providerId?: string;
+	datasourceId?: string;
+	applicationName?: string;
+	applicationType?: string;
+	population?: Record<string, string>;
+	fullSync: boolean;
+};
+type AuthzDescription = ModuleDescriptionBase<"authz"> & {
+	trustedProvisioningClients: Array<{
+		issuer: string;
+		audience: string | string[];
+		clientId: string;
+		permissions: string[];
+	}>;
+	oaa?: OaaDescription;
+	/** True when the App explicitly accepts IAM-sourced entitlement creation. */
+	inboundEntitlements: boolean;
+	stores: {
+		accessStore: boolean;
+		accessIndex: boolean;
+		catalogStore: boolean;
+		resources: boolean;
+	};
+};
+type TmDescription = ModuleDescriptionBase<"tm"> & {
+	enabled: boolean;
+	ionite?: {
+		id: string;
+		name?: string;
+		url: string;
+		issuer: string;
+		jwksUri: string;
+		audience: string;
+		clientId: string;
+	};
+	consentTtlSeconds?: number;
+	maxRedeemAttempts?: number;
+};
+type ModuleDescription = SsoDescription | CiamDescription | IamDescription | WorkloadDescription | SecretsDescription | KmsDescription | OtelDescription | AuthzDescription | TmDescription;
+type IoniteDescription = {
+	id?: string;
+	sdk: {
+		version: string;
+		catalogVersion: number;
+	};
+	basePath: string;
+	urls: CapabilityEndpointUrls;
 	ok: boolean;
-	/** Whether RemoteConfig has been applied at least once (mirrors `ion.isReady()`). */
 	applied: boolean;
-	/** Per-module readiness keyed by {@link ModuleName}. */
-	modules: Record<ModuleName, ModuleReadinessState>;
-	/** Most recent config-application outcome (last applied time and last error, if any). */
 	config: ConfigApplyStatus;
-};
-/** Result of `ion.requireReady(names)`: a synchronous, declarative readiness gate over selected modules. */
-type RequireReadyResult = {
-	/** True when config is applied and every requested module is ready. */
-	ok: boolean;
-	/** The requested modules that are not ready, with reasons when available. */
-	notReady: Array<{
-		name: ModuleName;
-		reason?: string;
+	modules: Record<ModuleName, ModuleReadinessState & {
+		description?: ModuleDescription;
 	}>;
 };
+import { StandardSchemaV1 as StandardSchemaV14 } from "@standard-schema/spec";
 /**
 * Token caching for workload identity authentication.
 *
@@ -1772,12 +2136,10 @@ type WorkloadConfigBase = {
 	*/
 	audience?: string;
 	/**
-	* Per-IdP intent (incoming/server role only): when `true`, tokens validated against THIS trust
-	* anchor have their OAuth `scope` claim auto-honored as entitlements by the request-level `has*`
-	* helpers (audience-bound). Mirrors `RemoteConfig.authz.scopesAsEntitlements` but scoped to a single
-	* trusted IdP so first-party scopes can be honored while federated/third-party ones are not.
+	* Per-IdP intent (incoming/server role only): token claims from THIS trust anchor may satisfy
+	* `has*` (audience-bound). ConfigSource-only. There is no global fallback.
 	*/
-	scopesAsEntitlements?: boolean;
+	claimsAsEntitlements?: ClaimsAsEntitlements;
 	/**
 	* Default OAuth2 scopes (space-delimited)
 	*/
@@ -1887,21 +2249,10 @@ type ClientCredentialsWorkloadConfig = WorkloadConfigBase & {
 	*/
 	clientId: string;
 	/**
-	* OAuth2 client secret. Omit it to authenticate with a federated token instead
-	* (see `federatedTokenFile`). A client secret wins when both are present.
-	*/
-	clientSecret?: string;
-	/**
-	* Path to a projected federated token (e.g. AKS Workload Identity), sent as a jwt-bearer
-	* `client_assertion` in place of `client_secret`. Defaults to `AZURE_FEDERATED_TOKEN_FILE`.
-	* Read on every acquisition because the platform rotates it.
-	*/
-	federatedTokenFile?: string;
-	/**
-	* `managed_identity`: get the token from the platform's managed identity endpoint instead of an
-	* IdP token URL. `clientId` is the managed identity's client ID; `scope` names the audience.
+	* OAuth2 client secret
+	* REQUIRED for Client Credentials mode
 	*/
-	authMethod?: "managed_identity";
+	clientSecret: string;
 };
 /**
 * Server-Only Workload Configuration
@@ -1935,7 +2286,7 @@ type ServerOnlyWorkloadConfig = WorkloadConfigBase & {
 * detected based on which fields are present:
 *
 * - **JWT Bearer Grant**: Requires `workload_id` + `private_key`
-* - **Client Credentials**: Requires `client_id` + `client_secret`, a federated token file, or `authMethod: "managed_identity"`
+* - **Client Credentials**: Requires `client_id` + `client_secret`
 * - **Server-Only**: Only `jwks_uri` (and optionally `issuer`) for token validation
 *
 * The developer uses the same API regardless of mode - the library handles the details.
@@ -1964,8 +2315,8 @@ type TrustedIdp = {
 	* one of these values (with `azp` fallback). REQUIRED: prevents cross-app token reuse.
 	*/
 	audience: string | string[];
-	/** Per-IdP scopesAsEntitlements intent (see {@link WorkloadConfigBase.scopesAsEntitlements}). */
-	scopesAsEntitlements?: boolean;
+	/** Per-IdP claims intent (see {@link WorkloadConfigBase.claimsAsEntitlements}). */
+	claimsAsEntitlements?: ClaimsAsEntitlements;
 };
 /**
 * Workload config with separate incoming (server) and outgoing (client) roles.
@@ -1994,6 +2345,8 @@ interface WorkloadGetToken {
 * Workload Identity Authentication Interface
 */
 type Workload = WorkloadConfig & ModuleReadiness & Required<Pick<ModuleReadiness, "isReady" | "ready">> & {
+	/** Secret-free, JSON-serializable configuration and readiness summary. */
+	describe: () => WorkloadDescription;
 	/**
 	* Returns a token for this workload configuration.
 	* The optional argument overrides the configured default scope.
@@ -2065,7 +2418,8 @@ interface IAMHandlerConfig {
 * IAM configuration
 *
 * - If `url` is provided, groups_outbound is enabled (app calls external IAM)
-* - If a `catalogStore` is provided, groups_inbound is enabled (external IAM calls app)
+* - If a catalog source is provided, groups_inbound is enabled (external IAM calls app);
+*   `POST /Groups` additionally requires `AuthzConfig.onInboundEntitlement`
 * - If `userStore` is provided, users_inbound is enabled (external IAM calls app)
 */
 type IAMConfig = {
@@ -2181,6 +2535,7 @@ type IAMAccessRequestsConfig = {
 		request: AccessRequestResult;
 		created: boolean;
 	}>;
+	get?: (id: string) => Promise<AccessRequestResult | undefined>;
 };
 type IAMEntitlementRequestUrlContext = {
 	request: Request;
@@ -2409,7 +2764,7 @@ type IAMGroupsOutbound = {
 };
 /**
 * Groups Inbound extension - for receiving group provisioning from external IAM providers.
-* Enabled when a `catalogStore` is configured.
+* Enabled when a catalog source is configured; IAM-sourced create remains AppDev opt-in.
 */
 type IAMGroupsInbound = {
 	/**
@@ -2434,10 +2789,12 @@ type IAMUsersInbound = {
 *
 * - Core functions are user-related (outbound to external IAM)
 * - `groups_outbound` is available when `url` is configured
-* - `groups_inbound` is available when a `catalogStore` is configured
+* - `groups_inbound` is available when a catalog source is configured
 * - `users_inbound` is available when `userStore` is configured
 */
 type IAM = Omit<IAMConfig, "users" | "workloads" | "customers" | "groups"> & {
+	/** Secret-free, JSON-serializable configuration and readiness summary. */
+	describe: () => IamDescription;
 	users: IamPrincipalKind;
 	workloads: IamPrincipalKind;
 	customers: IamPrincipalKind;
@@ -2460,7 +2817,8 @@ type IAM = Omit<IAMConfig, "users" | "workloads" | "customers" | "groups"> & {
 	groups_outbound?: IAMGroupsOutbound;
 	/**
 	* Groups Inbound extension - receive group provisioning from external IAM.
-	* Available when a `catalogStore` is configured.
+	* Available when a catalog source is configured. `POST /Groups` returns 501 unless the App
+	* implements `AuthzConfig.onInboundEntitlement` and wires an `AccessCatalogStore`.
 	*/
 	groups_inbound?: IAMGroupsInbound;
 	/**
@@ -2505,7 +2863,7 @@ declare function assertSubjectTypeAssignable(catalogStore: AccessCatalogStore |
 * @param workload - Workload instance for authentication
 * @returns IAM service instance
 */
-declare function iam(validators: IAMValidators, log: Logger, workload: Workload | undefined, authz: Authz, accessStore?: AccessAssignmentStore, accessIndex?: AccessIndex, catalogStore?: AccessCatalogStore, codeCatalog?: CodeCatalog, resources?: ResourceProvider, fromVault?: Partial<IAMConfig>, fromCode?: Partial<IAMConfig>, iamDelta?: IamDeltaEmitter, onAccessMutation?: (summary: ScimMutationSummary) => void, trustedClientGrants?: AccessChange[], authzQueueSettle?: () => Promise<void>): IAM | undefined;
+declare function iam(validators: IAMValidators, log: Logger, workload: Workload | undefined, authz: Authz, accessStore?: AccessAssignmentStore, accessIndex?: AccessIndex, catalogStore?: AccessCatalogStore, codeCatalog?: CodeCatalog, resources?: ResourceProvider, fromVault?: Partial<IAMConfig>, fromCode?: Partial<IAMConfig>, iamDelta?: IamDeltaEmitter, onAccessMutation?: (summary: ScimMutationSummary) => void, onInboundEntitlement?: (input: InboundEntitlementRequest) => InboundEntitlementDecision | Promise<InboundEntitlementDecision>, trustedClientGrants?: AccessChange[], authzQueueSettle?: () => Promise<void>): IAM | undefined;
 type KmsKeyState = "pending" | "active" | "deprecated" | "rotated" | "revoked";
 type KmsKey = {
 	id: string;
@@ -2614,6 +2972,8 @@ type KmsPoolSlot = {
 	ready(timeout?: number): Promise<void>;
 };
 type KmsPool = {
+	/** Secret-free, JSON-serializable pool configuration and readiness summary. */
+	describe(): KmsPoolDescription;
 	/**
 	* Returns the current granted key for slot 0. Calls wait on one shared local subscription until a
 	* grant is available; repeated calls resolve from the local cache and never initiate a vault request.
@@ -2646,73 +3006,14 @@ type KmsPool = {
 * (`ion.kms.<name>`); use `getPool(name)` when the name is dynamic.
 */
 type Kms = ModuleReadiness & {
+	/** Secret-free, JSON-serializable configuration and readiness summary. */
+	describe(): KmsDescription;
 	readonly config: Readonly<KmsConfig>;
 	listPools(): string[];
 	getPool(name: string): KmsPool;
 	/** Issuer handle for a named pool. Independent of consumer slot grants. */
 	issuer(name: string): KmsPoolIssuer;
 };
-type OtelProtocol = "http/protobuf" | "http/json";
-type OtelProviderType = "otlp" | "grafana-lgtm" | "datadog" | "splunk" | "elastic";
-type OtelLogLevel = "trace" | "debug" | "info" | "warn" | "error";
-type OtelLevels = Partial<Record<OtelLogLevel, boolean>>;
-/** Local console mirror policy: disable it or set its minimum emitted severity. */
-type OtelConsoleMode = "off" | OtelLogLevel;
-type OtelAttributeValue = string | number | boolean | string[] | number[] | boolean[];
-type OtelAttributes = Record<string, OtelAttributeValue>;
-type OtelSignalConfig = {
-	/** Per-signal OTLP endpoint. When omitted, the module appends /v1/{signal} to `endpoint`. */
-	endpoint?: string;
-	headers?: Record<string, string>;
-	timeoutMillis?: number;
-	concurrencyLimit?: number;
-};
-type OtelMetricsSignalConfig = OtelSignalConfig & {
-	exportIntervalMillis?: number;
-	exportTimeoutMillis?: number;
-};
-type OtelOAuthClientCredentialsConfig = {
-	tokenUrl: string;
-	clientId: string;
-	clientSecret: string;
-	scope?: string;
-	audience?: string;
-	headers?: Record<string, string>;
-};
-/**
-* OpenTelemetry config supplied by ConfigSource/RemoteConfig.
-* Keep environment-specific URLs and credentials here, not in FrameworkConfig.
-*/
-type OtelConfig = {
-	type?: OtelProviderType;
-	name: string;
-	endpoint?: string;
-	protocol?: OtelProtocol;
-	headers?: Record<string, string>;
-	apiKey?: string;
-	/** Name of a `RemoteConfig.kms` key pool used for exporter authentication. */
-	apiKeyPool?: string;
-	apiKeyHeader?: string;
-	oauth?: OtelOAuthClientCredentialsConfig;
-	version?: string;
-	deploymentEnvironment?: string;
-	resourceAttributes?: OtelAttributes;
-	levels?: OtelLevels;
-	/** `'off'` exports only to OTel; a level dual-emits at or above that severity. Defaults to `'info'`. */
-	console?: OtelConsoleMode;
-	traces?: boolean | OtelSignalConfig;
-	metrics?: boolean | OtelMetricsSignalConfig;
-	logs?: boolean | OtelSignalConfig;
-};
-type Otel = {
-	beforeChange(listener: ChangeListener): () => void;
-	afterChange(listener: ChangeListener): () => void;
-	isReady(): boolean;
-	ready(timeout?: number): Promise<void>;
-	logger: Logger;
-	forceFlush(): Promise<void>;
-	shutdown(): Promise<void>;
-};
 /**
 * Session management for tracking user sessions and enabling backchannel logout.
 *
@@ -2805,6 +3106,12 @@ type Session<TExtended = object> = {
 	*/
 	claims?: Record<string, unknown>;
 	/**
+	* Entitlements derived from token claims at login and refresh. Session-scoped: they die with the
+	* record (TTL, rotation, back-channel logout) and are never written to the access stores.
+	* Only meaningful when the store declares {@link SessionStoreCapabilities.derivedEntitlements}.
+	*/
+	entitlements?: DerivedEntitlement[];
+	/**
 	* Optional access-token claims for modules that keep access/id claims separate.
 	*/
 	accessClaims?: Record<string, unknown>;
@@ -2841,7 +3148,21 @@ type Session<TExtended = object> = {
 * }
 * ```
 */
+/**
+* Store-declared capabilities. The SDK does not probe a custom store (a write at init is forbidden);
+* a store that omits the declaration is treated as incapable.
+*/
+type SessionStoreCapabilities = {
+	/**
+	* The store persists {@link Session.entitlements} round-trip. JSON-backed stores (the SDK Redis
+	* and in-memory implementations) declare this. A column-mapped SQL store declares it only after
+	* it has a column for the derived set.
+	*/
+	derivedEntitlements?: boolean;
+};
 interface SessionStore<TExtended = object> {
+	/** Declaration of what this store persists beyond the required session fields. */
+	readonly capabilities?: SessionStoreCapabilities;
 	/**
 	* Create a new session in the store.
 	*
@@ -3199,6 +3520,13 @@ type SSOConfig<
 	*/
 	userStore?: UserStore<TUserData>;
 	/**
+	* ConfigSource-only. When set, the named token claims are derived into session-scoped
+	* entitlements at login and refresh. Never set from application code.
+	*/
+	claimsAsEntitlements?: ClaimsAsEntitlements;
+	/** ConfigSource-only IdP assignment workflow used when IAM assignment is `'idp'`. */
+	accessRequests?: AccessRequestsDestination;
+	/**
 	* Enable Just-In-Time (JIT) user provisioning.
 	* When enabled, new users are automatically created in the userStore on their first login.
 	* When disabled (default), only existing users in the userStore are updated on login.
@@ -3301,6 +3629,8 @@ type SSO<
 	TSessionData = Record<string, never>,
 	TUserData = Record<string, never>
 > = SSOConfig<TSessionData, TUserData> & {
+	/** Secret-free, JSON-serializable configuration and readiness summary. */
+	describe: () => SsoDescription;
 	getUser: (request: Request) => Promise<WorkforceUser | undefined>;
 	/**
 	* Degraded-aware resolution: distinguishes a signed-out visitor (`unauthenticated`) from a failed
@@ -3322,8 +3652,9 @@ type SSO<
 declare function sso<
 	TSessionData = Record<string, never>,
 	TUserData = Record<string, never>
->(validators: SSOValidators, log: Logger, fromVault?: Partial<SSOConfig<TSessionData, TUserData>>, fromCode?: Partial<SSOConfig<TSessionData, TUserData>>, _options?: {
+>(validators: SSOValidators, log: Logger, fromVault?: Partial<SSOConfig<TSessionData, TUserData>>, fromCode?: Partial<SSOConfig<TSessionData, TUserData>>, options?: {
 	sessionCache?: ResolvedSessionCacheConfig;
+	catalogView?: () => CatalogView | undefined;
 }): SSO<TSessionData, TUserData> | undefined;
 /**
 * Helper gets the workforce (SSO) user from the Request using the supplied
@@ -3601,7 +3932,12 @@ type SecretsSource = ReactiveHandle & ModuleReadiness & {
 	*/
 	close?(): void | Promise<void>;
 };
+type DescribedSecretsSource = SecretsSource & {
+	describe(): SecretsSourceDescription;
+};
 type Secrets = ModuleReadiness & {
+	/** Secret-free, JSON-serializable configuration and readiness summary. */
+	describe(): SecretsDescription;
 	/**
 	* Liveness across configured sources. Returns false when any ready source reports a degraded
 	* `isAvailable()` (e.g. an HTTP-poll source whose upstream is failing). Surfaced in
@@ -3613,7 +3949,7 @@ type Secrets = ModuleReadiness & {
 	/** Returns configured secrets source names/keys. */
 	listSecretsSources(): string[];
 	/** Gets a named secrets source client. Throws when missing. */
-	getSecretsSource(sourceName: string): SecretsSource;
+	getSecretsSource(sourceName: string): DescribedSecretsSource;
 	/** Creates a lazy handle for a secret in a named source. */
 	get(sourceName: string, path: string, options?: SecretsOperationOptions): SecretHandle;
 	/** Reads a secret from a named secrets source client. */
@@ -3964,17 +4300,6 @@ type TrustedProvisioningClient = {
 type AuthzConfig = {
 	oaa?: AuthzOaaConfig;
 	/**
-	* RemoteConfig/Ops-governed intent. When `true`, the request-level `has*` helpers auto-honor a
-	* principal's OAuth token `scope` claims as entitlements: an app-wide check (no `resource` arg)
-	* also allows when the target id matches a granted scope. Default `false` (secure): scopes never
-	* satisfy `has*` and authorization comes solely from the `AccessAssignmentStore`/`AccessIndex` (IAM/SCIM).
-	* Read at check time so it can be flipped live. This NEVER affects token validation, and the
-	* explicit `hasScope*` helpers are always available regardless of this flag. Resource-scoped
-	* checks (a `resource` arg supplied) are never satisfied by scopes. For workload principals this is
-	* a fallback only: a matched trusted IdP's per-entry `scopesAsEntitlements` takes precedence.
-	*/
-	scopesAsEntitlements?: boolean;
-	/**
 	* Config-declared trusted provisioning clients (read-path overlay; ConfigSource/ECI-owned). Each
 	* entry pre-authorizes a workload client to hold specific permissions without a stored grant. See
 	* {@link TrustedProvisioningClient}. Honored in the request-level `has*` helpers BEFORE the
@@ -4024,6 +4349,12 @@ type AuthzConfig = {
 	* have been updated. Best-effort and isolated — throwing here never affects the SCIM response.
 	*/
 	onAccessMutation?: (summary: ScimMutationSummary) => void;
+	/**
+	* Explicit AppDev opt-in for IAM-sourced entitlement definitions. Inbound SCIM `POST /Groups`
+	* returns 501 when omitted. The callback may reject the proposal or accept it while attaching
+	* App-owned catalog structure; IAM-owned presentation is persisted from the SCIM resource.
+	*/
+	onInboundEntitlement?: (input: InboundEntitlementRequest) => InboundEntitlementDecision | Promise<InboundEntitlementDecision>;
 };
 /**
 * Remote config read from a config source (vault, lfv, etc.).
@@ -4053,7 +4384,7 @@ type RemoteConfig = {
 	/** OpenTelemetry collector/exporter config loaded from ConfigSource. */
 	otel?: OtelConfig;
 	authz?: AuthzConfig;
-	/** ConfigSource-owned Tenant Management activation and trusted integrator identity. */
+	/** ConfigSource-owned Tenant Management activation and trusted ionite identity. */
 	tm?: RemoteTmConfig;
 	/**
 	* Built-in readiness endpoint intent (Ops/ECI). The SDK mounts `${basePath}/readyz` by default;
@@ -4394,6 +4725,8 @@ type CIAM<
 	TMagicLinkData = Record<string, never>,
 	TCustomerData = Record<string, never>
 > = CIAMConfig<TMagicLinkData, TCustomerData> & {
+	/** Secret-free, JSON-serializable configuration and readiness summary. */
+	describe: () => CiamDescription;
 	getCustomer: (request: Request) => Promise<Customer | undefined>;
 	/**
 	* Degraded-aware resolution: distinguishes a signed-out visitor (`unauthenticated`) from a failed
@@ -4428,8 +4761,9 @@ declare function ciam<
 	TCustomerData = Record<string, never>
 >(validators: CIAMValidators, log: Logger, fromVault?: Partial<CIAMConfig<TMagicLinkData, TCustomerData>>, fromCode?: Partial<CIAMConfigFromCode<TMagicLinkData, TCustomerData>>, workload?: {
 	getWorkloadIdentity: (request: Request) => Promise<WorkloadIdentity | undefined>;
-}, _options?: {
+}, options?: {
 	sessionCache?: ResolvedSessionCacheConfig;
+	catalogView?: () => CatalogView | undefined;
 }): CIAM<TMagicLinkData, TCustomerData> | undefined;
 /**
 * Helper gets the CIAM customer from the Request using the supplied Ionite.
@@ -4504,6 +4838,15 @@ type IoniteBase = {
 	* module is ready; `notReady` lists the requested modules that are not ready, with reasons.
 	*/
 	requireReady(names: ModuleName[]): RequireReadyResult;
+	/**
+	* Returns an allow-listed, JSON-serializable snapshot for privileged App-owned diagnostics.
+	* Unlike `config`, this never contains credentials, secret values, stores, or callbacks.
+	*
+	* Diagnostics only: each call rebuilds the readiness report and every module projection. Call it
+	* from an admin loader, never per request; handlers and health probes use `isReady()` /
+	* `requireReady()`.
+	*/
+	describe(): IoniteDescription;
 	/** Most recent RemoteConfig application outcome (last applied time and last error, if any). */
 	configStatus: ConfigApplyStatus;
 	/** Release config subscriptions and background resources. */
@@ -4529,7 +4872,10 @@ interface TenantWebhookPayload {
 	error?: string;
 }
 type BaseTenant = {
+	/** App-owned routing key. */
 	id: string;
+	/** Stable tenant id in the ionite domain, once this tenant is known to ionite. */
+	ioniteId?: string;
 	companyId: string;
 	companyName: string;
 	environmentType: EnvironmentType;
@@ -4551,7 +4897,7 @@ type BaseTenant = {
 	*/
 	configLocator?: ConfigLocator;
 	/**
-	* App-internal state for an integrator-requested Tenant Management handover. Protocol-internal
+	* App-internal state for an ionite-requested Tenant Management handover. Protocol-internal
 	* fields are never serialized by the TM wire handlers.
 	*/
 	integration?: TenantIntegration;
@@ -4559,9 +4905,8 @@ type BaseTenant = {
 type TenantIntegrationStatus = "consent_requested" | "consented" | "declined";
 type TenantIntegration = {
 	version: number;
-	integrator: string;
-	integratorName?: string;
-	integratorTenantId: string;
+	ioniteName?: string;
+	ioniteId: string;
 	productId: string;
 	applicationId: string;
 	handleHash: string;
@@ -4585,18 +4930,29 @@ type SetTenantIntegrationOptions = {
 	/** Compare-and-set guard for transitions within the same handle. */
 	expectedVersion?: number;
 };
-type TmIntegratorConfig = {
+/**
+* ConfigSource-only trust for the ionite control plane that drives Tenant Management. Code never
+* sets these fields; do not duplicate them in `workload.incoming` or `authz.trustedProvisioningClients`.
+*/
+type TmIoniteConfig = {
+	/** Stable identifier of the trusted ionite control plane. */
 	id: string;
+	/** Optional human-readable name used in consent copy. */
 	name?: string;
+	/** Browser-facing ionite URL used to restart an integration. */
 	url: string;
+	/** Required `iss` claim on ionite-signed staged-request handles and ionite workload tokens. */
 	issuer: string;
+	/** ionite JWKS endpoint used to verify signed staged-request handles. */
 	jwksUri: string;
+	/** Required `aud` claim binding an ionite-staged request to this App. */
 	audience: string;
+	/** Required `azp`/client identity of the trusted ionite control plane. */
 	clientId: string;
 };
 type RemoteTmConfig = {
 	enabled: true;
-	integrator: TmIntegratorConfig;
+	ionite: TmIoniteConfig;
 	consentTtlSeconds?: number;
 	maxRedeemAttempts?: number;
 };
@@ -4607,6 +4963,8 @@ type RecordTenantConsentInput = {
 	decidedBy?: string;
 };
 type TenantManagement<TTenant extends BaseTenant = BaseTenant> = ModuleReadiness & {
+	/** Secret-free, JSON-serializable configuration and readiness summary. */
+	describe(): TmDescription;
 	handler(request: Request): Promise<Response>;
 	getTenant(id: string): Promise<TTenant | undefined>;
 	recordConsent(input: RecordTenantConsentInput): Promise<TTenant>;
@@ -4642,6 +5000,19 @@ type TenantIonCache = {
 	fetch(id: string): Promise<Ionite | undefined>;
 	delete(id: string): unknown;
 };
+/**
+* App-owned tenant persistence for routing and Tenant Management.
+*
+* Tenants carry two ids: `id` is the App-owned routing key and `ioniteId` is ionite's stable id.
+* Implementations MUST keep `ioniteId` unique across tenants and MUST treat it as immutable once
+* set: `upsert` and `setIntegration` reject a different `ioniteId` for a bound tenant (the
+* built-in in-memory and Redis stores throw `ionite id cannot change`) and an `upsert` that omits
+* `ioniteId` keeps the stored value. The TM handler enforces the same rule at the HTTP layer; the
+* store rule protects App-owned write paths that bypass `ion.tm`.
+*
+* `setIntegration` and `getByIntegrationHandleHash` are required only for ionite consent. They are
+* metadata-only writes and MUST NOT evict the tenant runtime cache; ordinary `upsert`/`delete` do.
+*/
 interface TenantStore<TTenant extends BaseTenant = BaseTenant> {
 	get(id: string): Promise<TTenant | undefined>;
 	list(options?: ListOptions): Promise<ListResult<TTenant>>;
@@ -4650,6 +5021,8 @@ interface TenantStore<TTenant extends BaseTenant = BaseTenant> {
 	getIon(id: string): Promise<Ionite | undefined>;
 	setIntegration?(tenantId: string, integration: TenantIntegration | undefined, options?: SetTenantIntegrationOptions): Promise<TTenant | undefined>;
 	getByIntegrationHandleHash?(handleHash: string): Promise<TTenant | undefined>;
+	/** Looks up a tenant by ionite's stable id; TM create is idempotent by this key. */
+	getByIoniteId(ioniteId: string): Promise<TTenant | undefined>;
 }
 type InMemoryTenantStoreOptions = {
 	/**
@@ -4669,6 +5042,7 @@ declare class InMemoryTenantStore<TTenant extends BaseTenant = BaseTenant> imple
 	getIon(id: string): Promise<Ionite | undefined>;
 	setIntegration(tenantId: string, integration: TenantIntegration | undefined, options?: SetTenantIntegrationOptions): Promise<TTenant | undefined>;
 	getByIntegrationHandleHash(handleHash: string): Promise<TTenant | undefined>;
+	getByIoniteId(ioniteId: string): Promise<TTenant | undefined>;
 }
 declare function sendTenantWebhook(webhookUrl: string, payload: TenantWebhookPayload, log: Logger): Promise<void>;
 /**
@@ -4881,6 +5255,35 @@ type OaaAccessTargetType = "group" | "role" | "permission";
 type EntitlementType = OaaAccessTargetType;
 /** A catalog Entitlement: a group, role, or permission (see {@link EntitlementType}). */
 type Entitlement<TAttributes extends object = object> = Group2<TAttributes> | Role2<TAttributes> | Permission<TAttributes>;
+/** Validated IAM-authored presentation and membership proposed through inbound SCIM `POST /Groups`. */
+type InboundEntitlementRequest = {
+	type: EntitlementType;
+	displayName: string;
+	description?: string;
+	externalId?: string;
+	riskLevel?: RiskLevel;
+	attributes?: Record<string, unknown>;
+	resources?: string[];
+	members: GroupMember[];
+	request: Request;
+};
+/**
+* AppDev decision for an IAM-sourced entitlement. Accepting may attach only App-owned structure;
+* IAM-owned presentation remains sourced from the inbound SCIM resource.
+*/
+type InboundEntitlementDecision = {
+	accept: false;
+	reason?: string;
+} | {
+	accept: true;
+	id?: string;
+	assignableSubjectTypes?: SubjectType[];
+	recommendedSubjectTypes?: SubjectType[];
+	permissions?: string[];
+	roles?: string[];
+	groups?: string[];
+	resources?: string[];
+};
 type AccessRef<T> = string | T;
 /**
 * A catalog entry returned synchronously by {@link EntityStore.set}. It is the entity itself,
@@ -5212,6 +5615,8 @@ interface OaaClient<
 	TCustomer = BaseCustomer,
 	TWorkload = BaseWorkloadIdentity
 > {
+	/** Secret-free, JSON-serializable OAA configuration and readiness summary. */
+	describe(): OaaDescription;
 	pushUser(user: TUser): Promise<void>;
 	pushCustomer(customer: TCustomer): Promise<void>;
 	pushWorkload(workload: TWorkload): Promise<void>;
@@ -5330,6 +5735,8 @@ type ReconcileReport = {
 * wired they deny by default (`{ allow: false }`, `metadata.reason = 'access_index_not_configured'`).
 */
 type Authz = {
+	/** Secret-free, JSON-serializable configuration and readiness summary. */
+	describe(): AuthzDescription;
 	oaa: OaaClient;
 	/** Read the effective catalog union (materialized rows plus unmaterialized code templates). */
 	entitlements: {
@@ -5381,9 +5788,9 @@ type Authz = {
 	*/
 	grant(change: AccessChange): Promise<AccessChange>;
 	/**
-	* Submit one grant or revoke request on a principal's behalf. Allowed only when that kind's
-	* assignment policy is `'iam-request'`. One operation maps to one approval decision, status,
-	* and tracking URL. Authenticated with the module-wide `deltaAudience` workload client.
+	* Submit one grant or revoke request on a principal's behalf. Under `'iam-request'`, targets the
+	* IAM destination; under `'idp'`, targets the claims-bearing SSO/CIAM provider. One operation
+	* maps to one approval decision, status, and tracking URL.
 	*/
 	requestAccess(change: {
 		subject: AccessChange["subject"];
@@ -5392,6 +5799,20 @@ type Authz = {
 		target: AccessChange["target"];
 		operation: "grant" | "revoke";
 		justification?: string;
+		/** CIAM provider key. Required only when multiple providers expose an AccessRequests channel. */
+		provider?: string;
+	}): Promise<{
+		id: string;
+		status: "pending" | "approved" | "denied";
+		operation: "grant" | "revoke";
+		trackingUrl: string;
+	}>;
+	/** Read the destination-owned state of an on-behalf access request. */
+	getAccessRequest(input: {
+		id: string;
+		subjectType: SubjectType;
+		/** CIAM provider key. Required only when multiple providers expose an AccessRequests channel. */
+		provider?: string;
 	}): Promise<{
 		id: string;
 		status: "pending" | "approved" | "denied";
@@ -5411,8 +5832,10 @@ type Authz = {
 * - `'iam'` — never assign in-app; show a request link (or a read-only entitlement table).
 * - `'iam-request'` — never assign in-app; the app submits a request on the principal's behalf via
 *   {@link Authz.requestAccess}.
+* - `'idp'` — the claims-bearing SSO/CIAM provider is assigner of record; requests use that
+*   provider's ConfigSource-owned AccessRequests channel.
 */
-type IamAssignmentPolicy = "app" | "iam" | "iam-request";
+type IamAssignmentPolicy = "app" | "iam" | "iam-request" | "idp";
 /** Why an {@link AccessCheckResult} resolved the way it did. */
 type AccessCheckReason = "ok" | "unauthenticated" | "forbidden" | "not_configured";
 /**
@@ -5593,8 +6016,7 @@ declare function hasAny2(request: Request, ion: Ionite, targets: AccessCheckTarg
 declare function hasAll2(request: Request, ion: Ionite, targets: AccessCheckTarget[], subjectType?: SubjectScope): Promise<AccessCheckResult>;
 /**
 * Request-level check that a resolved principal's OAuth token carries a given `scope` claim. This is
-* the explicit OAuth-claims authorization path (always available, independent of
-* `RemoteConfig.authz.scopesAsEntitlements`). It is orthogonal to {@link has} / {@link hasPermission}
+* the explicit OAuth-claims authorization path (always available). It is orthogonal to {@link has} / {@link hasPermission}
 * which authorize against IAM/SCIM entitlements in the AccessIndex.
 *
 * Resolves the principal(s) per `subjectType` (default `'any'`), reads each principal's token scopes
@@ -5607,6 +6029,36 @@ declare function hasScope(request: Request, ion: Ionite, scope: string, subjectT
 declare function hasAnyScope(request: Request, ion: Ionite, scopes: string[], subjectType?: SubjectScope): Promise<AccessCheckResult>;
 /** Request-level check that a resolved principal's token carries ALL of `scopes`. See {@link hasScope}. */
 declare function hasAllScope(request: Request, ion: Ionite, scopes: string[], subjectType?: SubjectScope): Promise<AccessCheckResult>;
+type DeriveClaimsInput = {
+	block: ClaimsAsEntitlements;
+	/** ID-token claims (user/customer) or the validated workload token claims. First source wins. */
+	claims: Record<string, unknown>;
+	/** Access-token claims, when the token is a JWT. ID-token claims win on name collisions. */
+	accessClaims?: Record<string, unknown>;
+	/** Token-response `scope`, used when neither claim set carries `scope`. */
+	scope?: string;
+	subjectType: SubjectType;
+	subjectId: string;
+	catalog?: CatalogView;
+	log?: Logger;
+};
+/**
+* Resolve configured claims to catalog ids and, when `expand` is set, to the closure `expandRoot`
+* would materialize for a grant of that id. Unknown values are dropped. SDK-owned `ion:*`
+* permission ids resolve as permissions even when the App catalog does not list them, because they
+* are the platform's own endpoint gates.
+*/
+declare function deriveClaimsEntitlements(input: DeriveClaimsInput): Promise<DerivedEntitlement[]>;
+/**
+* Decode supplemental access-token claims without treating that payload as an authentication
+* authority. SSO/CIAM call this only for the access token returned by their client-authenticated
+* token exchange, alongside a verified ID token whose claims win on collision. Opaque tokens and
+* malformed payloads return undefined.
+*/
+declare function decodeUnverifiedJwtPayload(token: string | undefined): Record<string, unknown> | undefined;
+/** Remember the session's derived rows for this request so `has*` can see them without a public user field. */
+declare function rememberDerivedEntitlements(request: Request, subjectType: "user" | "customer", rows: DerivedEntitlement[] | undefined): void;
+declare function derivedEntitlementsFor(request: Request, subjectType: "user" | "customer"): DerivedEntitlement[] | undefined;
 /**
 * LFV callback signature helpers (Ed25519).
 *
@@ -6025,4 +6477,4 @@ type TenantAccessLoginUrlOptions = {
 	tenantIonBasePath?: (tenantId: string) => string;
 };
 declare function tenantAccessLoginUrl(tenantId: string, options: TenantAccessLoginUrlOptions): string;
-export { AccessRequestCreate, AccessRequestResult, AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, AssertTrustedIdTokenClaimsOptions, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CACHE_BOUNDS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CIAM_PROVIDER_PRESETS, CatalogAdjacencyCache, CatalogView, CreateGroupOptions, CreateUserOptions, DiscoveredTenantCookie, DisplayCookieAttributes, DisplayCookieCandidate, DisplayCookieTrim, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMConfig, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundUserContext, IAMInboundUsersConfig, IAMUsersInbound, IAMValidators, InMemoryTenantStore, JWKS, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions, ResolveTenantOwnerOptions, ResolveTenantSessionOptions, ResolvedCacheConfig, ResolvedJwksCacheConfig, ResolvedSessionCacheConfig, ResolvedSessionReadCacheConfig, SSO, SSOConfig, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimError, ScimListResponse, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, SessionDiscoveryOptions, SessionResponse, SigningKey, SigningKeyRing, StateCookie, StaticSigningKeyRingDocument, TENANT_OWNER_PERMISSION, TenantAccessDenial, TenantAccessDenialReason, TenantAccessLoginUrlOptions, TenantAccessResult, TenantAccessSession, TenantAccessSessionKind, UsersInboundHandlerConfig, VerifyIdTokenOptions, VerifyLogoutTokenOptions, VerifyUserOptions, allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, assertSubjectTypeAssignable, assertTrustedIdTokenClaims, baseCustomerToScim, baseUserToScimUser, baseWorkloadToScim, blockDangerousUrls, buildAuthorizationUrl, buildLfvSigningInput, callback, captureRedirect, ciam, clearDiscoveryCache, clearJwksCache, collectReferencedDefinitions, configureJwksCache, defaultRedirectPolicies, discoverOidcEndpoints, discoverSessionRecords, discoverSessions, entitlementToScimGroup, exchangeAuthorizationCode, expandRoot, fetchUserInfo, formatDisplayClearCookie, formatDisplaySetCookie, generateAppleClientSecret, generateLfvEd25519KeyPair, getCachedVerificationKey, getCustomer, getDiscoveredSessionUsers, getJwks, getOwnedTenantIds, getProviderPreset, getPublicKeyForKid, getPublicKeyFromJwks, getUser, getVerificationKeyForKid, has, hasAll2 as hasAll, hasAllScope, hasAny2 as hasAny, hasAnyScope, hasGroup2 as hasGroup, hasPermission2 as hasPermission, hasRole2 as hasRole, hasScope, iam, initiateLogin, isRedirectAllowed, listSsoClientIdsFromCookies, normalizeOidcIssuer, orderedEnabledProviders, parseLfvJwks, pkceChallengeFromVerifier, planDiscoveredTenantCookies, planDisplayCookieClear, planDisplayCookieHeaders, reconcileSubjectAccess, resolveAfterRedirect, resolveCacheConfig, resolveCapturedRedirect, resolveCiamProvider, resolveCustomer, resolveJwkForKid, resolveJwksCacheConfig, resolveProviderBranding, resolveRedirect, resolveSessionCacheConfig, resolveTenantOwner, resolveTenantSession, resolveUser, sameOriginRedirectRules, selectDisplayCookies, sendTenantWebhook, setDiscoveryClock, setJwksClock, setJwksRetry, signCompactJwt, signLfvPayload, sso, staticSigningKeyRing, stringifyLfvJwks, tenantAccessLoginUrl, tenantOwnerEntitlementId, tenantOwnerPermission, tenantResourceId, verifyCompactJwt, verifyIdToken, verifyLfvSignature, verifyLogoutToken, verifyUser, withSetCookies };
+export { AccessRequestCreate, AccessRequestResult, AccessRequestsDestination, AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, AssertTrustedIdTokenClaimsOptions, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CACHE_BOUNDS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CIAM_PROVIDER_PRESETS, CatalogAdjacencyCache, CatalogView, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, CreateGroupOptions, CreateUserOptions, DeriveClaimsInput, DerivedEntitlement, DiscoveredTenantCookie, DisplayCookieAttributes, DisplayCookieCandidate, DisplayCookieTrim, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMConfig, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundUserContext, IAMInboundUsersConfig, IAMUsersInbound, IAMValidators, InMemoryTenantStore, JWKS, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions, ResolveTenantOwnerOptions, ResolveTenantSessionOptions, ResolvedCacheConfig, ResolvedJwksCacheConfig, ResolvedSessionCacheConfig, ResolvedSessionReadCacheConfig, SSO, SSOConfig, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimError, ScimListResponse, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, SessionDiscoveryOptions, SessionResponse, SigningKey, SigningKeyRing, StateCookie, StaticSigningKeyRingDocument, TENANT_OWNER_PERMISSION, TenantAccessDenial, TenantAccessDenialReason, TenantAccessLoginUrlOptions, TenantAccessResult, TenantAccessSession, TenantAccessSessionKind, UsersInboundHandlerConfig, VerifyIdTokenOptions, VerifyLogoutTokenOptions, VerifyUserOptions, allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, assertSubjectTypeAssignable, assertTrustedIdTokenClaims, baseCustomerToScim, baseUserToScimUser, baseWorkloadToScim, blockDangerousUrls, buildAuthorizationUrl, buildLfvSigningInput, callback, captureRedirect, ciam, clearDiscoveryCache, clearJwksCache, collectReferencedDefinitions, configureJwksCache, decodeUnverifiedJwtPayload, defaultRedirectPolicies, deriveClaimsEntitlements, derivedEntitlementsFor, discoverOidcEndpoints, discoverSessionRecords, discoverSessions, entitlementToScimGroup, exchangeAuthorizationCode, expandRoot, fetchUserInfo, formatDisplayClearCookie, formatDisplaySetCookie, generateAppleClientSecret, generateLfvEd25519KeyPair, getCachedVerificationKey, getCustomer, getDiscoveredSessionUsers, getJwks, getOwnedTenantIds, getProviderPreset, getPublicKeyForKid, getPublicKeyFromJwks, getUser, getVerificationKeyForKid, has, hasAll2 as hasAll, hasAllScope, hasAny2 as hasAny, hasAnyScope, hasGroup2 as hasGroup, hasPermission2 as hasPermission, hasRole2 as hasRole, hasScope, iam, initiateLogin, isRedirectAllowed, listSsoClientIdsFromCookies, normalizeOidcIssuer, orderedEnabledProviders, parseLfvJwks, pkceChallengeFromVerifier, planDiscoveredTenantCookies, planDisplayCookieClear, planDisplayCookieHeaders, reconcileSubjectAccess, rememberDerivedEntitlements, resolveAfterRedirect, resolveCacheConfig, resolveCapturedRedirect, resolveCiamProvider, resolveCustomer, resolveJwkForKid, resolveJwksCacheConfig, resolveProviderBranding, resolveRedirect, resolveSessionCacheConfig, resolveTenantOwner, resolveTenantSession, resolveUser, sameOriginRedirectRules, selectDisplayCookies, sendTenantWebhook, setDiscoveryClock, setJwksClock, setJwksRetry, signCompactJwt, signLfvPayload, sso, staticSigningKeyRing, stringifyLfvJwks, tenantAccessLoginUrl, tenantOwnerEntitlementId, tenantOwnerPermission, tenantResourceId, verifyCompactJwt, verifyIdToken, verifyLfvSignature, verifyLogoutToken, verifyUser, withSetCookies };