@ionite/core 0.0.24-beta.20261020.41 → 0.0.24-beta.20261022.44

package/dist/index.d.ts

@@ -273,42 +273,6 @@ type ClaimsAsEntitlementsDescription = {
 	capable: boolean;
 };
 /**
-* Shared minimal identity fields used to build both the workforce user
-* record (`BaseUser`) and the CIAM customer record (`BaseCustomer`), as well
-* as the authenticated session types (`WorkforceUser`, `Customer`).
-*
-* This is an internal structural base and is intentionally not part of the
-* public API surface; consumers extend the `BaseUser` Zod/Valibot schema
-* instead.
-*/
-interface BaseUserFields {
-	/**
-	* Unique identifier for the user
-	*/
-	id?: string;
-	/**
-	* REQUIRED. Unique identifier for login
-	*/
-	userName: string;
-	/**
-	* REQUIRED. Simple display name
-	*/
-	name: string;
-	/**
-	* REQUIRED. Primary email address
-	*/
-	email: string;
-	/**
-	* URL to user's avatar/profile picture
-	*/
-	avatar?: string;
-	/**
-	* User type (e.g., "employee", "contractor", "customer").
-	* Shared by SSO/CIAM and enterprise/SCIM user representations.
-	*/
-	userType?: string;
-}
-/**
 * Shared types for paginated list operations across stores.
 *
 * List methods return a ListResult with total, count, items, size, page, and pages.
@@ -362,6 +326,97 @@ interface ListOptions {
 	/** Optional server-side filter applied before pagination. */
 	filter?: ListFilter;
 }
+type DelegateOwnerType = "user" | "customer" | "workload";
+type DelegateOwner = {
+	id: string;
+	type: DelegateOwnerType;
+};
+type DelegateContext = {
+	id: string;
+	owner: DelegateOwner;
+	label?: string;
+	clientId?: string;
+	expiresAt?: Date;
+};
+type BaseDelegateSdkFields = {
+	id: string;
+	externalId?: string;
+	owner: DelegateOwner;
+	label?: string;
+	clientId?: string;
+	active?: boolean;
+	expiresAt?: Date;
+	tokenHash: string;
+	previousTokenHash?: string;
+	previousTokenHashExpiresAt?: Date;
+	lastUsedAt?: Date;
+	providerId?: string;
+	requestUrl?: string;
+	createdAt?: Date;
+	updatedAt?: Date;
+};
+type BaseDelegateReservedKey = keyof BaseDelegateSdkFields;
+type BaseDelegate<TExtended = object> = BaseDelegateSdkFields & NoReserved<TExtended, BaseDelegateReservedKey, "id">;
+/**
+* Persistence for delegate principals. Only SHA-256 verifier hashes (`hashDelegateToken`) are stored;
+* the raw `ion_dlg_` token never reaches the App. `tokenHash`, `previousTokenHash`, and `externalId`
+* are unique across delegates: `upsert` MUST throw `StoreConflictError` on a collision.
+*/
+interface DelegateStore<TExtended = object> {
+	get(id: string): Promise<BaseDelegate<TExtended> | undefined>;
+	lookup(delegate: BaseDelegate<TExtended>): Promise<BaseDelegate<TExtended> | undefined>;
+	/**
+	* Match `tokenHash`, or `previousTokenHash` while `previousTokenHashExpiresAt` is in the future.
+	* Activity, expiry, and owner checks belong to the resolver, not the store.
+	*/
+	getByTokenHash(hash: string): Promise<BaseDelegate<TExtended> | undefined>;
+	getByExternalId?(externalId: string): Promise<BaseDelegate<TExtended> | undefined>;
+	listByOwner(ownerId: string, ownerType: DelegateOwnerType, options?: ListOptions): Promise<ListResult<BaseDelegate<TExtended>>>;
+	upsert(delegate: BaseDelegate<TExtended>): Promise<BaseDelegate<TExtended>>;
+	delete(id: string): Promise<number>;
+	list(options?: ListOptions): Promise<ListResult<BaseDelegate<TExtended>>>;
+	/**
+	* Record usage: set only `lastUsedAt` (not `updatedAt`) and never emit IAM delta. Called
+	* fire-and-forget at most once per `iam.delegates.lastUsedWindowSeconds` per process.
+	*/
+	touch(id: string, at: Date): Promise<void>;
+}
+/**
+* Shared minimal identity fields used to build both the workforce user
+* record (`BaseUser`) and the CIAM customer record (`BaseCustomer`), as well
+* as the authenticated session types (`WorkforceUser`, `Customer`).
+*
+* This is an internal structural base and is intentionally not part of the
+* public API surface; consumers extend the `BaseUser` Zod/Valibot schema
+* instead.
+*/
+interface BaseUserFields {
+	/**
+	* Unique identifier for the user
+	*/
+	id?: string;
+	/**
+	* REQUIRED. Unique identifier for login
+	*/
+	userName: string;
+	/**
+	* REQUIRED. Simple display name
+	*/
+	name: string;
+	/**
+	* REQUIRED. Primary email address
+	*/
+	email: string;
+	/**
+	* URL to user's avatar/profile picture
+	*/
+	avatar?: string;
+	/**
+	* User type (e.g., "employee", "contractor", "customer").
+	* Shared by SSO/CIAM and enterprise/SCIM user representations.
+	*/
+	userType?: string;
+}
 import { StandardSchemaV1 } from "@standard-schema/spec";
 /**
 * SCIM 2.0 User Resource
@@ -534,7 +589,7 @@ interface GroupMember {
 	* config-declared trusted provisioning clients) and `"Customer"` a CIAM customer so SCIM consumers
 	* can distinguish them from a workforce `"User"` or a nested `"Group"`.
 	*/
-	type?: "User" | "Group" | "Workload" | "Customer";
+	type?: "User" | "Group" | "Workload" | "Customer" | "Delegate";
 }
 /**
 * SCIM 2.0 Group Resource
@@ -619,6 +674,36 @@ interface ScimCustomer {
 		version?: string;
 	};
 }
+/** SCIM Delegate resource — an IAM-governed personal token principal. */
+interface ScimDelegate {
+	[key: string]: unknown;
+	schemas?: string[];
+	id?: string;
+	externalId?: string;
+	userName?: string;
+	displayName?: string;
+	active?: boolean;
+	owner: {
+		value: string;
+		type: "User" | "Customer" | "Workload";
+	};
+	clientId?: string;
+	expiresAt?: string;
+	tokenHash?: string;
+	previousTokenHash?: string;
+	previousTokenHashExpiresAt?: string;
+	lastUsedAt?: string;
+	lastUsedWindowSeconds?: number;
+	providerId?: string;
+	requestUrl?: string;
+	meta?: {
+		resourceType?: string;
+		created?: string;
+		lastModified?: string;
+		location?: string;
+		version?: string;
+	};
+}
 /**
 * SCIM Role
 */
@@ -714,6 +799,8 @@ declare const ION_SCIM_USER_EXTENSION_URN = "urn:ionite:scim:schemas:extension:i
 declare const ION_SCIM_WORKLOAD_SCHEMA = "urn:ionite:scim:schemas:core:2.0:Workload";
 /** SCIM core schema for a Customer principal (distinct ResourceType from User). */
 declare const ION_SCIM_CUSTOMER_SCHEMA = "urn:ionite:scim:schemas:core:2.0:Customer";
+/** SCIM core schema for a Delegate principal. */
+declare const ION_SCIM_DELEGATE_SCHEMA = "urn:ionite:scim:schemas:core:2.0:Delegate";
 /**
 * ionite SCIM User extension. See https://ionite.com/docs/llms-ecid.txt.
 */
@@ -878,6 +965,8 @@ declare function groupResourceSchema(vendor: string): StandardSchemaV1<Record<st
 declare const workloadResourceSchema: StandardSchemaV1<unknown, ScimWorkload>;
 /** Validates a SCIM Customer resource. */
 declare const customerResourceSchema: StandardSchemaV1<unknown, ScimCustomer>;
+/** Validates a SCIM Delegate resource. */
+declare const delegateResourceSchema: StandardSchemaV1<unknown, ScimDelegate>;
 import { StandardSchemaV1 as StandardSchemaV12 } from "@standard-schema/spec";
 /**
 * OIDC Code Flow Callback URL Parameters
@@ -1080,6 +1169,7 @@ interface TokenValidationResult {
 * into a {@link WorkloadPrincipal} (which adds a stable `id`).
 */
 type WorkloadIdentity = {
+	delegate?: DelegateContext;
 	/** Workload identifier (for JWT Bearer Grant tokens). */
 	workloadId?: string;
 	/** Client identifier (for OAuth2 Client Credentials tokens). */
@@ -1115,6 +1205,7 @@ type WorkloadPrincipal = WorkloadIdentity & {
 * Carries the SSO/OIDC context used by server helpers and user stores.
 */
 interface WorkforceUser extends BaseUserFields {
+	delegate?: DelegateContext;
 	/**
 	* SSO/OIDC authentication data
 	*/
@@ -1153,6 +1244,7 @@ interface WorkforceUser extends BaseUserFields {
 * The persisted customer record is `BaseCustomer` (see customer-store.types).
 */
 interface Customer extends BaseUserFields {
+	delegate?: DelegateContext;
 	ciam: {
 		/**
 		* ID token-like claims for CIAM sessions.
@@ -1563,7 +1655,7 @@ type AccessRequestResult = {
 	trackingUrl: string;
 };
 /** SCIM resource types the delta patch adapter addresses. */
-type IamDeltaResourceType = "user" | "group" | "workload" | "customer";
+type IamDeltaResourceType = "user" | "group" | "workload" | "customer" | "delegate";
 /** Destination-owned reference captured from a SCIM User/Group response. */
 type DestinationReference = {
 	/** Service-provider-assigned SCIM resource id. */
@@ -1579,6 +1671,7 @@ type IamDeltaReconcileInput = {
 	users?: Iterable<BaseUser> | AsyncIterable<BaseUser>;
 	workloads?: Iterable<BaseWorkloadIdentity> | AsyncIterable<BaseWorkloadIdentity>;
 	customers?: Iterable<BaseCustomer> | AsyncIterable<BaseCustomer>;
+	delegates?: Iterable<BaseDelegate> | AsyncIterable<BaseDelegate>;
 	groups?: Iterable<Group> | AsyncIterable<Group>;
 	roles?: Iterable<Role> | AsyncIterable<Role>;
 	permissions?: Iterable<Permission> | AsyncIterable<Permission>;
@@ -1617,6 +1710,8 @@ interface IamDeltaEmitter {
 	onCustomerUpsert(customer: BaseCustomer): Promise<void>;
 	/** Delete a destination Customer identified by externalId (falling back to its App-owned id). */
 	onCustomerDelete(externalId: string): Promise<void>;
+	onDelegateUpsert(delegate: BaseDelegate): Promise<void>;
+	onDelegateDelete(externalId: string): Promise<void>;
 	/** Upsert a full SCIM Group representation for a group, role, or permission definition. */
 	onEntitlementUpsert(entity: Entitlement, type: EntitlementType): Promise<void>;
 	/** Delete a destination entitlement Group identified by the App-owned catalog id. */
@@ -1927,7 +2022,7 @@ type RequireReadyResult = {
 		reason?: string;
 	}>;
 };
-type CapabilityKey = "sso.login" | "sso.jit" | "sso.logout" | "sso.back_channel_logout" | "sso.claims_authz" | "ciam.magic_link" | "ciam.oidc_login" | "ciam.customer" | "ciam.logout" | "ciam.claims_authz" | "iam.users" | "iam.groups" | "iam.groups.create" | "iam.workloads" | "iam.customers" | "workload.incoming" | "workload.outgoing" | "workload.claims_authz" | "authz.oaa" | "authz.access_requests" | "tm.integration";
+type CapabilityKey = "sso.login" | "sso.jit" | "sso.logout" | "sso.back_channel_logout" | "sso.claims_authz" | "ciam.magic_link" | "ciam.oidc_login" | "ciam.customer" | "ciam.logout" | "ciam.claims_authz" | "iam.users" | "iam.groups" | "iam.groups.create" | "iam.workloads" | "iam.customers" | "iam.delegates" | "workload.incoming" | "workload.outgoing" | "workload.claims_authz" | "authz.oaa" | "authz.access_requests" | "tm.integration";
 type CapabilityEndpointUrls = {
 	readyzUrl: string;
 	capabilitiezUrl: string;
@@ -1949,6 +2044,7 @@ type CapabilityEndpointUrls = {
 		groupsUrl: string;
 		workloadsUrl: string;
 		customersUrl: string;
+		delegatesUrl: string;
 	};
 	ciam: {
 		magicLinkUrl: string;
@@ -2159,6 +2255,7 @@ type IamDescription = ModuleDescriptionBase<"iam"> & {
 	users: IamPrincipalDescription;
 	workloads: IamPrincipalDescription;
 	customers: IamPrincipalDescription;
+	delegates: IamPrincipalDescription;
 	groups: {
 		enabled: boolean;
 		catalogWired: boolean;
@@ -2792,6 +2889,8 @@ interface IAMHandlerConfig {
 	* Base path for the SCIM Customers endpoints (e.g., '/api/iam/Customers')
 	*/
 	customersUrl?: string;
+	/** Base path for the SCIM Delegates endpoints. */
+	delegatesUrl?: string;
 	/**
 	* Handler overrides for SCIM discovery endpoints (e.g., '/api/iam/ServiceProviderConfig')
 	*/
@@ -2824,6 +2923,10 @@ type IAMConfig = {
 	* Store for inbound customer provisioning. When configured, `/Customers` is served.
 	*/
 	customerStore?: CustomerStore;
+	/** Store for IAM-governed delegate principals. When configured, `/Delegates` is served. */
+	delegateStore?: DelegateStore;
+	/** FrameworkConfig-only header carrying delegate credentials. Defaults to `authorization`. */
+	delegateHeader?: string;
 	/**
 	* Destination-only hook for `POST /AccessRequests`. Apps that are not IAM destinations omit this
 	* and the endpoint returns 404.
@@ -2839,6 +2942,8 @@ type IAMConfig = {
 	inboundCustomers?: IAMInboundCustomersConfig;
 	/** AppDev-owned SCIM projection and persistence hooks for workload principals. */
 	inboundWorkloads?: IAMInboundWorkloadsConfig;
+	/** AppDev-owned SCIM projection and persistence hooks for delegate principals. */
+	inboundDelegates?: IAMInboundDelegatesConfig;
 	/**
 	* FrameworkConfig-only fallback that mints an IAM-owned deep link where access to an entitlement
 	* can be requested. A `requestUrl` written back into the catalog row by IAM takes precedence.
@@ -2852,6 +2957,7 @@ type IAMConfig = {
 	groupsUrl?: string;
 	workloadsUrl?: string;
 	customersUrl?: string;
+	delegatesUrl?: string;
 	discovery?: IAMDiscoveryConfig;
 	/**
 	* RemoteConfig intent for workforce principals. Set by Ops/ECI via the ConfigSource; not
@@ -2872,6 +2978,11 @@ type IAMConfig = {
 	* consumed by {@link Authz.grant}. `delta` is the Ops-owned per-kind egress mode.
 	*/
 	customers?: IamPrincipalKindFlag;
+	/** RemoteConfig intent for delegate principals. */
+	delegates?: IamPrincipalKindFlag & {
+		/** Coarse minimum interval between usage timestamp writes. Defaults to one hour. */
+		lastUsedWindowSeconds?: number;
+	};
 	/**
 	* RemoteConfig intent flag for the inbound SCIM Groups endpoint. Set by Ops/ECI via the
 	* ConfigSource; not configurable from application code. Effective availability also requires an
@@ -2935,6 +3046,7 @@ type IAMValidators = {
 	group: StandardSchemaV15<unknown, GroupResource>;
 	workload?: StandardSchemaV15<unknown, ScimWorkload>;
 	customer?: StandardSchemaV15<unknown, ScimCustomer>;
+	delegate?: StandardSchemaV15<unknown, ScimDelegate>;
 };
 interface IAMInboundUserContext {
 	/**
@@ -2970,6 +3082,10 @@ interface IAMInboundWorkloadsConfig {
 	mapValidatedScimToBaseWorkload?: (validated: ScimWorkload, context: IAMInboundPrincipalContext<BaseWorkloadIdentity>) => BaseWorkloadIdentity | Promise<BaseWorkloadIdentity>;
 	mapBaseWorkloadToScim?: (stored: BaseWorkloadIdentity) => ScimWorkload | Promise<ScimWorkload>;
 }
+interface IAMInboundDelegatesConfig {
+	mapValidatedScimToBaseDelegate?: (validated: ScimDelegate, context: IAMInboundPrincipalContext<BaseDelegate>) => BaseDelegate | Promise<BaseDelegate>;
+	mapBaseDelegateToScim?: (stored: BaseDelegate) => ScimDelegate | Promise<ScimDelegate>;
+}
 interface ScimAuthenticationScheme {
 	type: string;
 	name: string;
@@ -3027,7 +3143,7 @@ interface ScimResourceType {
 }
 interface ScimSchemaAttributeDefinition {
 	name: string;
-	type: "string" | "boolean" | "complex" | "reference" | "dateTime";
+	type: "string" | "boolean" | "complex" | "reference" | "dateTime" | "integer";
 	multiValued: boolean;
 	description?: string;
 	required?: boolean;
@@ -3058,10 +3174,12 @@ interface IAMDiscoveryContext {
 	groupsUrl: string;
 	workloadsUrl: string;
 	customersUrl: string;
+	delegatesUrl: string;
 	supportsUsers: boolean;
 	supportsGroups: boolean;
 	supportsWorkloads: boolean;
 	supportsCustomers: boolean;
+	supportsDelegates: boolean;
 }
 interface IAMDiscoveryConfig {
 	/**
@@ -3181,12 +3299,15 @@ type IAMUsersInbound = {
 * - `groups_inbound` is available when a catalog source is configured
 * - `users_inbound` is available when `userStore` is configured
 */
-type IAM = Omit<IAMConfig, "users" | "workloads" | "customers" | "groups"> & {
+type IAM = Omit<IAMConfig, "users" | "workloads" | "customers" | "delegates" | "groups"> & {
 	/** Secret-free, JSON-serializable configuration and readiness summary. */
 	describe: () => IamDescription;
 	users: IamPrincipalKind;
 	workloads: IamPrincipalKind;
 	customers: IamPrincipalKind;
+	delegates: IamPrincipalKind & {
+		lastUsedWindowSeconds: number;
+	};
 	groups: {
 		enabled: boolean;
 	};
@@ -3217,6 +3338,15 @@ type IAM = Omit<IAMConfig, "users" | "workloads" | "customers" | "groups"> & {
 	users_inbound?: IAMUsersInbound;
 	workloads_inbound?: IAMPrincipalsInbound;
 	customers_inbound?: IAMPrincipalsInbound;
+	delegates_inbound?: IAMPrincipalsInbound;
+	/**
+	* True when the request presents a delegate credential (`ion_dlg_` on `delegateHeader`), valid or
+	* not. Present only when delegates are enabled and a `delegateStore` is wired. A request that
+	* presents one never falls back to a session or workload token.
+	*/
+	hasDelegateCredential?: (request: Request) => boolean;
+	/** Resolve a delegate credential to its owner principal, with delegate context attached. */
+	resolveDelegate?: (request: Request) => Promise<AuthenticatedPrincipal | undefined>;
 	/**
 	* Framework-agnostic request handler for the IAM module.
 	* Routes to discovery, users_inbound, groups_inbound, or principal-kind inbound based on path.
@@ -4798,6 +4928,8 @@ type AuthzOaaConfig = {
 	customers?: AuthzOaaPrincipalConfig;
 	/** Workload population. Defaults to `'access'`. */
 	workloads?: AuthzOaaPrincipalConfig;
+	/** Delegate population. Defaults to `'access'`. */
+	delegates?: AuthzOaaPrincipalConfig;
 	compression?: "gzip" | "none";
 	multipart?: "auto" | "always" | "never";
 	maxPayloadBytes?: number;
@@ -4928,7 +5060,7 @@ type FrameworkConfig = {
 * enablement) are also stripped from code.
 */
 type SSOConfigFromCode = Omit<SSOConfig, "loginUrl" | "userUrl" | "logoutUrl" | "logoutBackChannelUrl" | "refreshUrl" | "redirectUri" | "claimsAsEntitlements" | "accessRequests">;
-type IAMConfigFromCode = Omit<IAMConfig, "usersUrl" | "groupsUrl" | "workloadsUrl" | "customersUrl" | "users" | "workloads" | "customers" | "groups" | "discovery" | "deltaAudience" | "providers"> & {
+type IAMConfigFromCode = Omit<IAMConfig, "usersUrl" | "groupsUrl" | "workloadsUrl" | "customersUrl" | "delegatesUrl" | "users" | "workloads" | "customers" | "delegates" | "groups" | "discovery" | "deltaAudience" | "providers"> & {
 	discovery?: Omit<IAMDiscoveryConfig, "basePath">;
 };
 type WorkloadServerConfigFromCode = Omit<Partial<WorkloadConfig>, "tokenUrl" | "validateUrl" | "jwksUrl" | "refreshUrl" | "claimsAsEntitlements">;
@@ -5051,6 +5183,7 @@ type FrameworkStores = {
 	sessionStore?: SessionStore<unknown>;
 	userStore?: UserStore<unknown>;
 	customerStore?: CustomerStore<unknown>;
+	delegateStore?: DelegateStore<unknown>;
 	accessStore?: AccessAssignmentStore<unknown>;
 	accessIndex?: AccessIndex;
 	/** Code-declared structural catalog templates. See `AuthzConfig.catalog`. */
@@ -5407,6 +5540,7 @@ declare const ION_IAM_WORKLOADS_WRITE: Permission;
 * Create, replace, modify, and delete Customers via SCIM. Gates write methods on `/iam/Customers`.
 */
 declare const ION_IAM_CUSTOMERS_WRITE: Permission;
+declare const ION_IAM_DELEGATES_WRITE: Permission;
 /**
 * Submit an on-behalf access request via `POST /iam/AccessRequests`. Gates the iam-request protocol.
 */
@@ -5429,10 +5563,11 @@ declare const ION_SDK_PERMISSIONS: readonly Permission[];
 * principal scope to check. This is the single source of truth the router/guards consult so the
 * enforcement contract lives in one place rather than scattered per route (AUDIT_HISTORY.md §1.32). The IAM
 * permission for a SCIM request is chosen from `iam.read` / `iam.users.write` / `iam.groups.write` /
-* `iam.workloads.write` / `iam.customers.write` / `iam.access-requests.write` by resource + HTTP
+* `iam.workloads.write` / `iam.customers.write` / `iam.delegates.write` /
+* `iam.access-requests.write` by resource + HTTP
 * method (no request-body introspection).
 */
-type EndpointOperation = "iam.read" | "iam.users.write" | "iam.groups.write" | "iam.workloads.write" | "iam.customers.write" | "iam.access-requests.write" | "capabilitiez.read" | "ciam.magic-link.create" | "authz.oaa.sync" | "tenant.manage";
+type EndpointOperation = "iam.read" | "iam.users.write" | "iam.groups.write" | "iam.workloads.write" | "iam.customers.write" | "iam.delegates.write" | "iam.access-requests.write" | "capabilitiez.read" | "ciam.magic-link.create" | "authz.oaa.sync" | "tenant.manage";
 type EndpointPermission = {
 	permission: Permission;
 	subjectType: SubjectScope;
@@ -6253,6 +6388,21 @@ type AuthzScimGroupExtension = {
 };
 type AccessRef<T> = string | T;
 /**
+* Subject of an instance `ion.authz.has*` check: a resolved principal (`getUser`, `getCustomer`,
+* `getWorkload`) or a stored principal record. Bare id strings are deliberately not accepted: a
+* resolved principal may carry `delegate` context, and the object is what retargets the check to the
+* delegate's own grants. A subject without a resolvable id is denied (`reason: 'subject_missing'`).
+*/
+type AccessSubject = {
+	id?: string;
+	delegate?: DelegateContext;
+} | WorkloadIdentity;
+/**
+* The AccessIndex subject id of an {@link AccessSubject}, or `undefined` when it has none. Workloads
+* without an `id` use `clientId ?? workloadId ?? claims.sub`.
+*/
+declare function accessSubjectId(subject: AccessSubject): string | undefined;
+/**
 * A catalog entry returned synchronously by {@link EntityStore.set}. It is the entity itself,
 * augmented with readiness observers so callers can hold a stable reference while persistence
 * to the backing store completes in the background.
@@ -6386,7 +6536,7 @@ type AccessStatus = "active";
 * Stored grants always carry a single concrete `SubjectType`; `'any'` (see {@link SubjectScope})
 * exists only at the request-helper check layer.
 */
-type SubjectType = "user" | "customer" | "workload";
+type SubjectType = "user" | "customer" | "workload" | "delegate";
 /**
 * Which principal kind(s) a request-level `has*` check should consider. `'any'` (the default for the
 * standalone helpers) resolves every available principal from the request in parallel and allows on
@@ -6621,6 +6771,7 @@ type OaaSyncInput<
 	users?: Iterable<TUser> | AsyncIterable<TUser>;
 	customers?: Iterable<TCustomer> | AsyncIterable<TCustomer>;
 	workloads?: Iterable<TWorkload> | AsyncIterable<TWorkload>;
+	delegates?: Iterable<BaseDelegate> | AsyncIterable<BaseDelegate>;
 	groups?: Iterable<TGroup | Group> | AsyncIterable<TGroup | Group>;
 	roles?: Iterable<Role> | AsyncIterable<Role>;
 	permissions?: Iterable<Permission> | AsyncIterable<Permission>;
@@ -6646,6 +6797,7 @@ interface OaaClient<
 	pushUser(user: TUser): Promise<void>;
 	pushCustomer(customer: TCustomer): Promise<void>;
 	pushWorkload(workload: TWorkload): Promise<void>;
+	pushDelegate(delegate: BaseDelegate): Promise<void>;
 	pushGroup(group: TGroup | Group): Promise<void>;
 	pushRole(role: TRole): Promise<void>;
 	pushPermission(permission: TPermission): Promise<void>;
@@ -6660,6 +6812,7 @@ interface OaaClient<
 	deleteUser(id: string): Promise<void>;
 	deleteCustomer(id: string): Promise<void>;
 	deleteWorkload(id: string): Promise<void>;
+	deleteDelegate(id: string): Promise<void>;
 	deleteGroup(id: string): Promise<void>;
 	deleteRole(id: string): Promise<void>;
 	deletePermission(id: string): Promise<void>;
@@ -6774,12 +6927,12 @@ type Authz = {
 	readonly accessStore?: AccessAssignmentStore;
 	/** The wired closure index powering `has*`, when the app provided one via stores. */
 	accessIndex?: AccessIndex;
-	has(subject: AccessRef<BaseUser>, targetType: OaaAccessTargetType, target: AccessRef<Group | Role | Permission>, resource: AccessRef<Resource> | undefined, subjectType: SubjectType): Promise<AuthzDecision>;
-	hasGroup(subject: AccessRef<BaseUser>, group: AccessRef<Group>, resource: AccessRef<Resource> | undefined, subjectType: SubjectType): Promise<AuthzDecision>;
-	hasRole(subject: AccessRef<BaseUser>, role: AccessRef<Role>, resource: AccessRef<Resource> | undefined, subjectType: SubjectType): Promise<AuthzDecision>;
-	hasPermission(subject: AccessRef<BaseUser>, permission: AccessRef<Permission>, resource: AccessRef<Resource> | undefined, subjectType: SubjectType): Promise<AuthzDecision>;
-	hasAny(subject: AccessRef<BaseUser>, targets: AccessCheckTarget[], subjectType: SubjectType): Promise<AuthzDecision>;
-	hasAll(subject: AccessRef<BaseUser>, targets: AccessCheckTarget[], subjectType: SubjectType): Promise<AuthzDecision>;
+	has(subject: AccessSubject, targetType: OaaAccessTargetType, target: AccessRef<Group | Role | Permission>, resource: AccessRef<Resource> | undefined, subjectType: SubjectType): Promise<AuthzDecision>;
+	hasGroup(subject: AccessSubject, group: AccessRef<Group>, resource: AccessRef<Resource> | undefined, subjectType: SubjectType): Promise<AuthzDecision>;
+	hasRole(subject: AccessSubject, role: AccessRef<Role>, resource: AccessRef<Resource> | undefined, subjectType: SubjectType): Promise<AuthzDecision>;
+	hasPermission(subject: AccessSubject, permission: AccessRef<Permission>, resource: AccessRef<Resource> | undefined, subjectType: SubjectType): Promise<AuthzDecision>;
+	hasAny(subject: AccessSubject, targets: AccessCheckTarget[], subjectType: SubjectType): Promise<AuthzDecision>;
+	hasAll(subject: AccessSubject, targets: AccessCheckTarget[], subjectType: SubjectType): Promise<AuthzDecision>;
 	/**
 	* Run a **full reconciliation**: re-derive the entire `AccessIndex` from `AccessAssignmentStore`
 	* roots + `AccessCatalogStore`. It enumerates the union of every assignment-store subject and every
@@ -6865,7 +7018,7 @@ type AccessCheckReason = "ok" | "unauthenticated" | "forbidden" | "not_configure
 */
 type AccessCheckResult = {
 	allow: boolean;
-	/** The authenticated principal that was resolved/matched (workforce user, customer, or workload). */
+	/** The resolved owner principal; delegate-authenticated owners carry `subject.delegate`. */
 	subject?: AuthenticatedPrincipal;
 	/** The kind of the resolved `subject` (which principal the decision applies to). */
 	subjectType?: SubjectType;
@@ -7265,4 +7418,4 @@ declare function generateULID(prefix?: string): string;
 * `vaultTtl` is HTTP-only.
 */
 declare function vaultConfigLocatorTransportError(locator: Record<string, unknown>): string | undefined;
-export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestInput, AccessRequestLookup, AccessRequestResult, AccessRequestsDestination, AccessStatus, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzDescription, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, CiamDescription, CiamProviderDescription, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceOrigin, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CookieDescription, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, DerivedEntitlement, DescribedSecretsSource, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, ENTRA_ION_EXTENSION_URN, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, GrantRequest, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMProviderConfig, IAMProviderType, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamDescription, IamPrincipalDescription, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InboundEntitlementDecision, InboundEntitlementRequest, InferSecretType, Ionite, IoniteBase, IoniteDescription, IoniteError, IoniteErrorContext, IoniteErrorJson, IoniteErrorOptions, IoniteLogAttributes, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsDescription, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDescription, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleDescription, ModuleDescriptionBase, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaDescription, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelDescription, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalDescription, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimPatchErrorType, ScimPatchOperation, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsDescription, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceDescription, SecretsSourceMap, SecretsSourceOrigin, SecretsSourceType, SecretsSubscriptionOptions, SecretsTransport, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, SsoDescription, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantCreatePlan, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmDescription, TmIoniteConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultAuthHeader, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadClientDescription, WorkloadConfig, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadTrustedIdpDescription, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configSourceOriginLogFields, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, describeOriginUrl, discoveredProfileCookieName, encodeDisplayCookie, errorLogAttributes, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, vaultConfigLocatorTransportError, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };
+export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestInput, AccessRequestLookup, AccessRequestResult, AccessRequestsDestination, AccessStatus, AccessSubject, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzDescription, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseDelegate, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, CiamDescription, CiamProviderDescription, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceOrigin, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CookieDescription, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, DelegateContext, DelegateOwner, DelegateOwnerType, DelegateStore, DerivedEntitlement, DescribedSecretsSource, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, ENTRA_ION_EXTENSION_URN, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, GrantRequest, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundDelegatesConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMProviderConfig, IAMProviderType, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_DELEGATES_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_DELEGATE_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamDescription, IamPrincipalDescription, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InboundEntitlementDecision, InboundEntitlementRequest, InferSecretType, Ionite, IoniteBase, IoniteDescription, IoniteError, IoniteErrorContext, IoniteErrorJson, IoniteErrorOptions, IoniteLogAttributes, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsDescription, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDescription, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleDescription, ModuleDescriptionBase, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaDescription, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelDescription, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalDescription, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimDelegate, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimPatchErrorType, ScimPatchOperation, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsDescription, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceDescription, SecretsSourceMap, SecretsSourceOrigin, SecretsSourceType, SecretsSubscriptionOptions, SecretsTransport, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, SsoDescription, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantCreatePlan, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmDescription, TmIoniteConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultAuthHeader, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadClientDescription, WorkloadConfig, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadTrustedIdpDescription, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, accessSubjectId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configSourceOriginLogFields, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, delegateResourceSchema, deprecateRetiredCodeCatalogRows, describeOriginUrl, discoveredProfileCookieName, encodeDisplayCookie, errorLogAttributes, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, vaultConfigLocatorTransportError, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };