@ionite/core 0.0.24-beta.20261006.21 → 0.0.24-beta.20261007.23

package/dist/index.d.ts

@@ -14,6 +14,122 @@ declare const KNOWN_BASE_CUSTOMER_KEYS: readonly ["id", "userName", "name", "ema
 declare const KNOWN_WORKLOAD_KEYS: readonly ["id", "clientId", "displayName", "description", "externalId", "providerId", "requestUrl", "ecid", "active", "scopes", "createdAt", "updatedAt", "metadata"];
 /** Return the AppDev-owned, enumerable attributes on an object, omitting SDK keys and undefined values. */
 declare function customAttributes(value: object, knownKeys: readonly PropertyKey[]): Record<string, unknown> | undefined;
+/**
+* Minimal logger interface compatible with common structured logging patterns.
+*/
+interface Logger {
+	trace(message?: unknown, ...optionalParams: unknown[]): void;
+	debug(message?: unknown, ...optionalParams: unknown[]): void;
+	info(message?: unknown, ...optionalParams: unknown[]): void;
+	warn(message?: unknown, ...optionalParams: unknown[]): void;
+	error(message?: unknown, ...optionalParams: unknown[]): void;
+}
+/**
+* Renders a structured logger call as one greppable line while leaving the source fields separate
+* for telemetry exporters.
+*/
+declare function formatLogLine(level: keyof Logger, message: unknown, optionalParams?: unknown[], timestamp?: Date): string;
+/**
+* No-op implementation — does nothing for any log level
+*/
+declare const silentLogger: Logger;
+/**
+* Default logger used until an ionite instance is configured with
+* an OpenTelemetry-backed logger or an application-provided logger.
+*/
+declare const defaultLogger: Logger;
+/**
+* Logger that logs messages debug, info, warn, and error to the console.
+*/
+declare const debugLogger: Logger;
+/**
+* Logger that logs messages info, warn, and error to the console.
+*/
+declare const infoLogger: Logger;
+/**
+* Logger that logs messages warn and error to the console.
+*/
+declare const warnLogger: Logger;
+/**
+* Human-readable single-line console logger for local application output.
+*/
+declare const prettyLogger: Logger;
+/** Runtime identity attached when an error leaves an ionite handle. */
+type IoniteErrorContext = {
+	/** `RemoteConfig.id` of the runtime that threw. On a tenant runtime this is the tenant id. */
+	ionId?: string;
+	/** Logger for that runtime. Non-enumerable on the error so serializers cannot reach a live handle. */
+	log?: Logger;
+};
+type IoniteErrorOptions = ErrorOptions & {
+	/**
+	* Client HTTP status. Always the status an App should send. Defaults to 500.
+	* Transport errors put the upstream status on {@link IoniteErrorOptions.upstreamStatus}.
+	*/
+	status?: number;
+	/** Upstream transport status. Server-side only: never returned by {@link IoniteError.response}. */
+	upstreamStatus?: number;
+	/** Client-safe reason code. When set, it is the `error` field of {@link IoniteError.response}. Never put `message` here. */
+	statusText?: string;
+	/** Client-safe explanation. Returned as `detail` only when `statusText` is set. */
+	detail?: string;
+	ionId?: string;
+	log?: Logger;
+};
+type IoniteErrorJson = {
+	name: string;
+	_tag: string;
+	status: number;
+	statusText?: string;
+	detail?: string;
+	ionId?: string;
+};
+type IoniteLogAttributes = Record<string, string | number | boolean | undefined>;
+/**
+* Base error for ionite runtimes.
+*
+* The runtime that throws stamps `ionId` and a non-enumerable `log` so an App error hook can log on
+* the right tenant without the SDK knowing the framework. `message` and `upstreamStatus` are
+* server-side. {@link IoniteError.response} returns `statusText`, `detail`, and
+* {@link IoniteError.safeBody}.
+*
+* `status` is always the client HTTP status. The App owns the hook that logs and returns a response;
+* the SDK decides only for the protocol routes it serves.
+*/
+declare class IoniteError extends Error {
+	/** Client HTTP status. Always set. */
+	readonly status: number;
+	/** Upstream transport status. Absent from {@link IoniteError.response} and {@link IoniteError.toJSON}. */
+	readonly upstreamStatus?: number;
+	readonly statusText?: string;
+	readonly detail?: string;
+	ionId?: string;
+	/** Effect `catchTag` discriminator. Equals the class name. */
+	readonly _tag: string;
+	/** Non-enumerable. Absent from `JSON.stringify` and `toJSON`. */
+	log?: Logger;
+	constructor(message: string, options?: IoniteErrorOptions);
+	/** Attach runtime context only where it is still unset. The innermost handle wins. */
+	attachContext(ctx: IoniteErrorContext): this;
+	/** Extra client-safe JSON fields. Included only when `statusText` is set. */
+	protected safeBody(): Record<string, unknown>;
+	toLogAttributes(): IoniteLogAttributes;
+	/**
+	* Default client response. JSON unless the request asks for HTML and not JSON, in which case the
+	* body is plain text of `detail`, else `statusText`, else `Internal Server Error`.
+	* `message` and `upstreamStatus` are never included.
+	*/
+	response(request?: Request): Response;
+	toJSON(): IoniteErrorJson;
+	/**
+	* Normalize any thrown value. An existing {@link IoniteError} is returned unchanged aside from
+	* filling unset context. Anything else is wrapped at status 500 with the original as `cause`.
+	* A foreign `status` is not copied: it is not App response policy.
+	*/
+	static from(error: unknown, ctx?: IoniteErrorContext): IoniteError;
+}
+/** Log attributes from an error that implements {@link IoniteError.toLogAttributes}, if any. */
+declare function errorLogAttributes(error: unknown): IoniteLogAttributes | undefined;
 import { StandardSchemaV1 as StandardSchemaV19 } from "@standard-schema/spec";
 import { StandardSchemaV1 as StandardSchemaV18 } from "@standard-schema/spec";
 /** Synchronous, in-memory read surface for one code catalog entity kind. */
@@ -1578,6 +1694,19 @@ type CIAMProviderConfig = {
 	claimsAsEntitlements?: ClaimsAsEntitlements;
 	/** ConfigSource-only IdP assignment workflow used when IAM assignment is `'idp'`. */
 	accessRequests?: AccessRequestsDestination;
+	/**
+	* Microsoft only. Which Entra tenants may sign in when the provider uses a
+	* multi-tenant authority (`/common`, `/organizations`, `/consumers`). Entra mints
+	* tenant-scoped issuers (`https://login.microsoftonline.com/{tid}/v2.0`), so no
+	* single `authority` can be compared by strict equality; this constrains the
+	* accepted `tid` instead.
+	*
+	* `'any'` (default) accepts any work/school tenant and personal accounts,
+	* `'consumers'` accepts only personal Microsoft accounts, and an array accepts
+	* only the listed tenant GUIDs. Ignored when `authority` names a single tenant —
+	* that keeps the strict-equality check.
+	*/
+	allowedTenants?: "any" | "consumers" | string[];
 };
 /** Sanitized provider entry returned by the discovery endpoint for the UI. */
 type CIAMProviderDescriptor = {
@@ -1678,46 +1807,6 @@ declare function readDisplayCookies(cookieHeader: string | null | undefined): Pa
 declare function compareDisplayExpiryDesc(a: string | undefined, b: string | undefined): number;
 declare function profileCookieName(cookiesPrefix: string): string;
 declare function discoveredProfileCookieName(tenantId: string): string;
-/**
-* Minimal logger interface compatible with common structured logging patterns.
-*/
-interface Logger {
-	trace(message?: unknown, ...optionalParams: unknown[]): void;
-	debug(message?: unknown, ...optionalParams: unknown[]): void;
-	info(message?: unknown, ...optionalParams: unknown[]): void;
-	warn(message?: unknown, ...optionalParams: unknown[]): void;
-	error(message?: unknown, ...optionalParams: unknown[]): void;
-}
-/**
-* Renders a structured logger call as one greppable line while leaving the source fields separate
-* for telemetry exporters.
-*/
-declare function formatLogLine(level: keyof Logger, message: unknown, optionalParams?: unknown[], timestamp?: Date): string;
-/**
-* No-op implementation — does nothing for any log level
-*/
-declare const silentLogger: Logger;
-/**
-* Default logger used until an ionite instance is configured with
-* an OpenTelemetry-backed logger or an application-provided logger.
-*/
-declare const defaultLogger: Logger;
-/**
-* Logger that logs messages debug, info, warn, and error to the console.
-*/
-declare const debugLogger: Logger;
-/**
-* Logger that logs messages info, warn, and error to the console.
-*/
-declare const infoLogger: Logger;
-/**
-* Logger that logs messages warn and error to the console.
-*/
-declare const warnLogger: Logger;
-/**
-* Human-readable single-line console logger for local application output.
-*/
-declare const prettyLogger: Logger;
 import { StandardSchemaV1 as StandardSchemaV15 } from "@standard-schema/spec";
 type ChangeListener = () => void;
 /**
@@ -2048,7 +2137,7 @@ type WorkloadClientDescription = {
 	idpTokenUrl?: string;
 	scope?: string;
 	audience?: string;
-	authMethod: "client_secret" | "private_key_jwt" | "server_only";
+	authMethod: "client_secret" | "federated_token" | "managed_identity" | "private_key_jwt" | "server_only";
 };
 type WorkloadDescription = ModuleDescriptionBase<"workload"> & {
 	incoming: {
@@ -2149,6 +2238,8 @@ type TmDescription = ModuleDescriptionBase<"tm"> & {
 	};
 	consentTtlSeconds?: number;
 	maxRedeemAttempts?: number;
+	/** Effective `action_required` request-token lifetime, including the one-hour default. */
+	requestTokenTtlSeconds: number;
 };
 type ModuleDescription = SsoDescription | CiamDescription | IamDescription | WorkloadDescription | SecretsDescription | KmsDescription | OtelDescription | AuthzDescription | TmDescription;
 type IoniteDescription = {
@@ -2470,10 +2561,21 @@ type ClientCredentialsWorkloadConfig = WorkloadConfigBase & {
 	*/
 	clientId: string;
 	/**
-	* OAuth2 client secret
-	* REQUIRED for Client Credentials mode
+	* OAuth2 client secret. Omit it to authenticate with a federated token instead
+	* (see `federatedTokenFile`). A client secret wins when both are present.
 	*/
-	clientSecret: string;
+	clientSecret?: string;
+	/**
+	* Path to a projected federated token (e.g. AKS Workload Identity), sent as a jwt-bearer
+	* `client_assertion` in place of `client_secret`. Defaults to `AZURE_FEDERATED_TOKEN_FILE`.
+	* Read on every acquisition because the platform rotates it.
+	*/
+	federatedTokenFile?: string;
+	/**
+	* `managed_identity`: get the token from the platform's managed identity endpoint instead of an
+	* IdP token URL. `clientId` is the managed identity's client ID; `scope` names the audience.
+	*/
+	authMethod?: "managed_identity";
 };
 /**
 * Server-Only Workload Configuration
@@ -2507,7 +2609,7 @@ type ServerOnlyWorkloadConfig = WorkloadConfigBase & {
 * detected based on which fields are present:
 *
 * - **JWT Bearer Grant**: Requires `workload_id` + `private_key`
-* - **Client Credentials**: Requires `client_id` + `client_secret`
+* - **Client Credentials**: Requires `client_id` + `client_secret`, a federated token file, or `authMethod: "managed_identity"`
 * - **Server-Only**: Only `jwks_uri` (and optionally `issuer`) for token validation
 *
 * The developer uses the same API regardless of mode - the library handles the details.
@@ -4008,12 +4110,23 @@ declare function defineSecretType<T>(input: SecretTypeInput<T>): SecretTypeDescr
 declare function defineSecretType(input: SecretTypeInput<unknown>): SecretTypeDescriptor<unknown>;
 declare function defaultSecretContentType(format?: SecretFormat): SecretContentType;
 /** Raised before decoding when a stored secret does not match the requested runtime contract. */
-declare class SecretContentTypeMismatchError extends Error {
+declare class SecretContentTypeMismatchError extends IoniteError {
 	readonly expected: SecretContentType;
 	readonly received: SecretContentType;
 	constructor(expected: SecretContentType, received: SecretContentType);
 }
 type SecretFormat = "jsonc" | "env" | "text" | "binary" | "yaml" | "toml" | "xml";
+/** How a vault-compatible source reads a secret: direct HTTP, the shared websocket, or LFV delivery. */
+type SecretsTransport = "http" | "websocket" | "lfv";
+/**
+* Log-safe locator of a secrets backend. Carries only the read transport and the server URL (with
+* userinfo, query, and fragment removed) — never tokens, client secrets, or trust material. Config
+* sources built over a client copy it into `ConfigSource.origin`.
+*/
+type SecretsSourceOrigin = {
+	transport?: SecretsTransport;
+	url?: string;
+};
 /**
 * Self-describing content metadata persisted with a secret. `typeId` identifies an authoring preset;
 * decoding never depends on the preset registry because the resolved format/mime/schema travel with
@@ -4130,6 +4243,8 @@ type FrameworkLfvConfig = {
 };
 type SecretsSource = ReactiveHandle & ModuleReadiness & {
 	type: SecretsSourceType;
+	/** Optional log-safe backend locator. Built-in sources set it; it must never carry credentials. */
+	origin?: SecretsSourceOrigin;
 	/** Creates a lazy, Bun.file-style handle. No I/O occurs until an accessor is awaited. */
 	get(path: string, options?: SecretsOperationOptions): SecretHandle;
 	getFullSecret: <T>(path: string, options?: SecretsOperationOptions) => Promise<Secret<T>>;
@@ -4483,6 +4598,28 @@ type AzureSecretsConfig = {
 	ttl?: number;
 };
 type ConfigSourceType = "vault" | "azure" | "aws" | "gcp" | "mirror";
+/**
+* Log-safe description of where a `ConfigSource` reads RemoteConfig from. It carries locators only:
+* the source kind, the read transport, the server URL (userinfo, query, and fragment removed), and
+* the document path. It never carries tokens, client secrets, or trust material. The SDK emits it
+* as `ion.config.source.*` attributes on `RemoteConfig applied.` and on config load/apply failure
+* lines so operators can tell which backend and document produced the running configuration.
+*/
+type ConfigSourceOrigin = {
+	type: ConfigSourceType;
+	/**
+	* Transport a vault-backed source reads the document through. When a direct `url` and a
+	* `websocket.url` are both configured, reads use HTTP and the websocket carries live updates;
+	* this field reports the read path.
+	*/
+	transport?: SecretsTransport;
+	/** Server URL without userinfo, query, or fragment. */
+	url?: string;
+	/** Document path (vault path or Key Vault secret name) holding the RemoteConfig. */
+	path?: string;
+	/** `mirror` only: the authoritative upstream the destination document is mirrored from. */
+	from?: ConfigSourceOrigin;
+};
 type ConfigSourceEnv = {
 	ION_CONFIG_TYPE?: ConfigSourceType;
 	ION_VAULT_URL?: string;
@@ -4942,7 +5079,7 @@ type RemoteConfigRetryContext = {
 	maxDelayMs: number;
 	/** Best-effort source error code when known. */
 	code?: string;
-	/** Best-effort source status when known. */
+	/** Best-effort upstream transport status when known. Not a client HTTP status. */
 	status?: number;
 	/** Config source transport when known, such as "vault", "azure", or "aws". */
 	sourceType?: ConfigSourceType | string;
@@ -4982,6 +5119,11 @@ type ConfigSubscriptionOptions = {
 */
 type ConfigChangeCallback = (config: RemoteConfig, frameworkConfig: ModifiableFrameworkConfig, oldConfig: RemoteConfig | undefined) => ConfigChangeResult | void | Promise<ConfigChangeResult | void>;
 type ConfigSource = {
+	/**
+	* Optional log-safe locator of this source (see {@link ConfigSourceOrigin}). Built-in sources set
+	* it; custom sources MAY. Never include credentials.
+	*/
+	origin?: ConfigSourceOrigin;
 	load(): Promise<RemoteConfig>;
 	/**
 	* Called when the config changes.
@@ -5486,15 +5628,6 @@ interface TenantWebhookPayload {
 	expiresAt?: string;
 	error?: string;
 }
-type IoniteErrorOptions = ErrorOptions & {
-	status?: number;
-	statusText?: string;
-};
-declare class IoniteError extends Error {
-	readonly status?: number;
-	readonly statusText?: string;
-	constructor(message: string, options?: IoniteErrorOptions);
-}
 type TenantValidators<
 	TCreateTenantRequest extends CreateTenantRequest = CreateTenantRequest,
 	TUpdateTenantRequest extends UpdateTenantRequest = UpdateTenantRequest,
@@ -5589,6 +5722,11 @@ type RemoteTmConfig = {
 	ionite: TmIoniteConfig;
 	consentTtlSeconds?: number;
 	maxRedeemAttempts?: number;
+	/**
+	* Lifetime, in seconds, of an App-minted `action_required` request token. Minimum 60; omitted
+	* means {@link DEFAULT_REQUEST_TOKEN_TTL_SECONDS} (one hour). ConfigSource-only.
+	*/
+	requestTokenTtlSeconds?: number;
 };
 type StagedIntegration = {
 	handle: string;
@@ -5662,12 +5800,28 @@ type TenantIntegrationView = {
 	state: TenantIntegrationStatus;
 	integration: TenantIntegration;
 };
+type ActionRequiredPlan = {
+	requestToken: string;
+	actionUrl: string;
+	expiresAt: string;
+};
+type ActionRequiredInput = {
+	/** App-owned completion path, for example `/onboard`. */
+	path: string;
+	/** Public origin the browser uses to open the action URL. */
+	origin: string;
+};
 type TenantManagement<TTenant extends BaseTenant = BaseTenant> = ModuleReadiness & {
 	/** Secret-free, JSON-serializable configuration and readiness summary. */
 	describe(): TmDescription;
 	handler(request: Request): Promise<Response>;
 	getTenant(id: string): Promise<TTenant | undefined>;
 	recordConsent(input: RecordTenantConsentInput): Promise<TTenant>;
+	/**
+	* Mint the `action_required` fields TM requires: a request token, a browser action URL, and an
+	* expiry. The lifetime comes from `RemoteConfig.tm.requestTokenTtlSeconds` (default one hour).
+	*/
+	actionRequired(input: ActionRequiredInput): ActionRequiredPlan;
 };
 declare function tmIntegrationState(tenant: BaseTenant | undefined, now?: number): TenantIntegrationView;
 /**
@@ -6200,18 +6354,21 @@ declare function assertRequiredSubjectType(value: unknown, label?: string): asse
 * A granted "root" relationship between a principal and a catalog target. Roots are the source of
 * truth in the AccessAssignmentStore; the AccessIndex is materialized from roots + the catalog.
 */
-type AccessChange<
+/**
+* App-facing input to {@link Authz.grant} and {@link Authz.revoke}. Named so a request body can be
+* declared once (`satisfies GrantRequest`) and reused. The durable record is {@link AccessChange},
+* which adds the store-assigned `id`.
+*/
+type GrantRequest<
 	TUser = BaseUser,
 	TGroup = Group,
 	TRole = Role,
 	TPermission = Permission
 > = {
-	/** Deterministic id derived from `subjectType:subject:targetType:target[:scope]`; assigned by stores/orchestration. */
-	id?: string;
 	subject: AccessRef<TUser>;
 	/** The principal kind this grant is for. Required; never inferred or defaulted. */
 	subjectType: SubjectType;
-	targetType: OaaAccessTargetType;
+	targetType: EntitlementType;
 	target: AccessRef<TGroup | TRole | TPermission>;
 	/** Specific resource ids this grant is scoped to (maps to OAA assignment `resources`). */
 	resources?: string[];
@@ -6223,6 +6380,33 @@ type AccessChange<
 	status?: AccessStatus;
 	metadata?: Record<string, unknown>;
 };
+type AccessChange<
+	TUser = BaseUser,
+	TGroup = Group,
+	TRole = Role,
+	TPermission = Permission
+> = GrantRequest<TUser, TGroup, TRole, TPermission> & {
+	/** Deterministic id derived from `subjectType:subject:targetType:target[:scope]`; assigned by stores/orchestration. */
+	id?: string;
+};
+/** One grant or revoke submitted through {@link Authz.requestAccess}. */
+type AccessRequestInput = {
+	subject: GrantRequest["subject"];
+	subjectType: SubjectType;
+	targetType: EntitlementType;
+	target: GrantRequest["target"];
+	operation: "grant" | "revoke";
+	justification?: string;
+	/** CIAM provider key. Required only when multiple providers expose an AccessRequests channel. */
+	provider?: string;
+};
+/** Lookup for {@link Authz.getAccessRequest}. */
+type AccessRequestLookup = {
+	id: string;
+	subjectType: SubjectType;
+	/** CIAM provider key. Required only when multiple providers expose an AccessRequests channel. */
+	provider?: string;
+};
 /**
 * Granted access **roots** — the durable source of truth for direct assignments
 * (`subject → group | role | permission`). Each root is one explicit grant (for example
@@ -6556,44 +6740,20 @@ type Authz = {
 	* index. IAM SCIM ingress does **not** use this path (it stays policy-exempt). Throws
 	* {@link AssignmentPolicyError} when Ops forbids in-app assignment for the principal kind.
 	*/
-	grant(change: AccessChange): Promise<AccessChange>;
+	grant(change: GrantRequest): Promise<AccessChange>;
 	/**
 	* Submit one grant or revoke request on a principal's behalf. Under `'iam-request'`, targets the
 	* IAM destination; under `'idp'`, targets the claims-bearing SSO/CIAM provider. One operation
 	* maps to one approval decision, status, and tracking URL.
 	*/
-	requestAccess(change: {
-		subject: AccessChange["subject"];
-		subjectType: SubjectType;
-		targetType: EntitlementType;
-		target: AccessChange["target"];
-		operation: "grant" | "revoke";
-		justification?: string;
-		/** CIAM provider key. Required only when multiple providers expose an AccessRequests channel. */
-		provider?: string;
-	}): Promise<{
-		id: string;
-		status: "pending" | "approved" | "denied";
-		operation: "grant" | "revoke";
-		trackingUrl: string;
-	}>;
+	requestAccess(change: AccessRequestInput): Promise<AccessRequestResult>;
 	/** Read the destination-owned state of an on-behalf access request. */
-	getAccessRequest(input: {
-		id: string;
-		subjectType: SubjectType;
-		/** CIAM provider key. Required only when multiple providers expose an AccessRequests channel. */
-		provider?: string;
-	}): Promise<{
-		id: string;
-		status: "pending" | "approved" | "denied";
-		operation: "grant" | "revoke";
-		trackingUrl: string;
-	}>;
+	getAccessRequest(input: AccessRequestLookup): Promise<AccessRequestResult>;
 	/**
 	* App-facing revoke of a granted root. Does not re-check assignment policy (removing access is
 	* always allowed from the app once the root exists).
 	*/
-	revoke(change: AccessChange): Promise<void>;
+	revoke(change: GrantRequest): Promise<void>;
 };
 /**
 * Ops-owned assignment policy for one principal kind (`RemoteConfig.iam.{users,workloads,customers}.assignment`).
@@ -6611,10 +6771,12 @@ type IamAssignmentPolicy = "app" | "iam" | "iam-request" | "idp";
 * `requestUrl` is the IAM-written entitlement receipt when one exists, so the app can send the
 * caller to the request page without catching a generic error.
 */
-declare class AssignmentPolicyError extends Error {
+declare class AssignmentPolicyError extends IoniteError {
 	readonly policy: IamAssignmentPolicy;
 	readonly requestUrl?: string;
 	constructor(message: string, policy: IamAssignmentPolicy, requestUrl?: string);
+	protected safeBody(): Record<string, unknown>;
+	toLogAttributes(): IoniteLogAttributes;
 }
 /** Why an {@link AccessCheckResult} resolved the way it did. */
 type AccessCheckReason = "ok" | "unauthenticated" | "forbidden" | "not_configured";
@@ -6688,38 +6850,32 @@ type ConfigSourceErrorInit = {
 * the same fields) for the initial-load retry policy to make the right call. See
 * https://ionite.com/docs/llms-configuration.txt.
 */
-declare class ConfigSourceError extends Error {
+declare class ConfigSourceError extends IoniteError {
 	readonly kind: RemoteConfigLoadErrorKind;
 	readonly recoverable?: boolean;
 	readonly code?: string;
-	readonly status?: number;
 	readonly path?: string;
 	readonly sourceType?: ConfigSourceType | string;
 	constructor(message: string, init: ConfigSourceErrorInit);
 }
 declare function isConfigSourceError(value: unknown): value is ConfigSourceError;
 /**
-* Enterprise Controlled ID (ECID) helpers.
-*
-* The ECID is a stable, system-of-record-owned identifier for a single identity (a person or a
-* non-human governance root), used to correlate that identity's many accounts across systems. It is
-* minted and owned by the enterprise SOR (via an ECI such as ionite), never by the application.
-*
-* Format: `ecid:<realm>:<opaque>`
-*  - `ecid`     fixed, self-describing scheme prefix.
-*  - `<realm>`  the MINTING AUTHORITY's id (its `RemoteConfig.id`) — the SOR/ECI tenant, NOT each
-*               App's own id. Using each App's id would give one person a different ECID per app.
-*  - `<opaque>` an opaque, non-semantic token (ULID / UUIDv7 class). No PII.
-*
-* This module is data-only and client-safe (no server imports), so it can be re-exported from the
-* main `@ionite/core` entry without pulling server code into client bundles.
-*
-* See https://ionite.com/docs/llms-ecid.txt for the full contract.
+* Reduce a backend URL to the part that is safe to log: scheme, host, port, and pathname. Userinfo
+* (`user:pass@`), the query string, and the fragment are dropped because tokens and client ids are
+* commonly carried there. A value that does not parse as an absolute URL is withheld entirely rather
+* than risk logging credential-bearing text.
+*/
+declare function describeOriginUrl(url: string | undefined): string | undefined;
+/**
+* Flatten a {@link ConfigSourceOrigin} into stable log attributes under `prefix` (default
+* `ion.config.source`). A mirror's upstream lands under `${prefix}.from.*`. Undefined fields are
+* omitted so the resulting record only ever names what the source actually knows.
 */
+declare function configSourceOriginLogFields(origin: ConfigSourceOrigin | undefined, prefix?: string): Record<string, string>;
 /** The fixed ECID scheme prefix. */
 declare const ECID_SCHEME = "ecid";
 /** Thrown when an ECID string (or a segment) is malformed. */
-declare class EcidFormatError extends Error {
+declare class EcidFormatError extends IoniteError {
 	constructor(message: string);
 }
 /** Parsed ECID segments. */
@@ -6836,13 +6992,14 @@ declare const remoteConfigSecretType: SecretTypeDescriptor<RemoteConfig>;
 * whole push can be replayed over a partial push and converge.
 */
 type StoreConflictKind = "already_exists" | "unique_violation";
-declare class StoreConflictError extends Error {
+declare class StoreConflictError extends IoniteError {
 	/** Stable discriminator so callers can branch without an `instanceof` across package boundaries. */
 	readonly code: "conflict";
 	readonly kind: StoreConflictKind;
 	/** The conflicting field/index name, when applicable (e.g. `'userName'`). */
 	readonly field?: string;
 	constructor(message: string, kind: StoreConflictKind, field?: string);
+	protected safeBody(): Record<string, unknown>;
 }
 declare function isStoreConflictError(value: unknown): value is StoreConflictError;
 type TenantPathNamespace = {
@@ -7024,4 +7181,4 @@ type LfvErrorResponse = {
 };
 /** Generates a ULID */
 declare function generateULID(prefix?: string): string;
-export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestResult, AccessRequestsDestination, AccessStatus, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzDescription, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, CiamDescription, CiamProviderDescription, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CookieDescription, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, DerivedEntitlement, DescribedSecretsSource, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamDescription, IamPrincipalDescription, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InboundEntitlementDecision, InboundEntitlementRequest, InferSecretType, Ionite, IoniteBase, IoniteDescription, IoniteError, IoniteErrorOptions, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsDescription, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDescription, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleDescription, ModuleDescriptionBase, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaDescription, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelDescription, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalDescription, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsDescription, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceDescription, SecretsSourceMap, SecretsSourceType, SecretsSubscriptionOptions, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, SsoDescription, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmDescription, TmIoniteConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWebSocketAuthHeader, VaultWebSocketSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadClientDescription, WorkloadConfig, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadTrustedIdpDescription, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, discoveredProfileCookieName, encodeDisplayCookie, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };
+export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestInput, AccessRequestLookup, AccessRequestResult, AccessRequestsDestination, AccessStatus, ActionRequiredInput, ActionRequiredPlan, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzDescription, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, CiamDescription, CiamProviderDescription, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceOrigin, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CookieDescription, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, DerivedEntitlement, DescribedSecretsSource, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, GrantRequest, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamDescription, IamPrincipalDescription, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InboundEntitlementDecision, InboundEntitlementRequest, InferSecretType, Ionite, IoniteBase, IoniteDescription, IoniteError, IoniteErrorContext, IoniteErrorJson, IoniteErrorOptions, IoniteLogAttributes, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsDescription, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDescription, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleDescription, ModuleDescriptionBase, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaDescription, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelDescription, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalDescription, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsDescription, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceDescription, SecretsSourceMap, SecretsSourceOrigin, SecretsSourceType, SecretsSubscriptionOptions, SecretsTransport, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, SsoDescription, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmDescription, TmIoniteConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWebSocketAuthHeader, VaultWebSocketSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadClientDescription, WorkloadConfig, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadTrustedIdpDescription, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configSourceOriginLogFields, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, describeOriginUrl, discoveredProfileCookieName, encodeDisplayCookie, errorLogAttributes, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };