@ionite/server 0.0.21

package/dist/index.d.ts

@@ -0,0 +1,1032 @@
+import { ConfigChangeCallback, ConfigSource as ConfigSource9, FrameworkConfigInput, FrameworkStores as FrameworkStores2, Ionite as Ionite5, ModifiableFrameworkConfig, RemoteConfig as RemoteConfig2, RemoteConfigRetryHook, RemoteConfigRetryOptions, RoutingOptions as RoutingOptions2 } from "@ionite/core";
+import { ApplicationValidators, BaseTenant, CreateTenantRequest, Ionite, TenantStore, TenantValidators, UpdateTenantRequest, Workload } from "@ionite/core";
+import { CapabilityEndpointUrls } from "@ionite/core";
+/**
+* Deterministic set of ionite endpoint paths derived from a single `basePath`.
+* These are the only URLs the SDK mounts; application code cannot customize individual paths
+* (only `basePath`). Post-login/logout destinations are NOT here: they are decided by the appdev's
+* `beforeLogin`/`afterLogin`/`beforeLogout`/`afterLogout` hooks (application UI routes), not ES endpoints derivable from `basePath`.
+*/
+type UrlMap = CapabilityEndpointUrls;
+/**
+* Derive every ionite endpoint path from `basePath`. Single source of truth consumed
+* by module construction, the router, the readiness endpoint, and tenant-manager responses.
+*/
+declare function deriveIonUrls(basePath: string): UrlMap;
+type TenantManagerOptions<
+	TCreateTenantRequest extends CreateTenantRequest = CreateTenantRequest,
+	TUpdateTenantRequest extends UpdateTenantRequest = UpdateTenantRequest,
+	TTenant extends BaseTenant = BaseTenant
+> = {
+	validators: ApplicationValidators<TenantValidators<TCreateTenantRequest, TUpdateTenantRequest>>;
+	basePath: string;
+	store: TenantStore<TTenant>;
+	workloadAuth?: Workload;
+	/**
+	* Resolve the ionite `basePath` for a given tenant (e.g. `/api/${tenant.id}/es`).
+	* When provided, tenant responses include the derived absolute SSO `callbackUrl` and full `ionUrls`
+	* so the ECI/ConfigSource can register the matching callback path at the IdP. ES endpoint URLs are
+	* deterministic from this basePath; they are not configurable per-URL.
+	*/
+	tenantEsBasePath?: (tenant: TTenant) => string | undefined;
+};
+/** Absolute ionite URL set for a tenant, derived from its basePath and request origin. */
+type TenantIonUrls = {
+	callbackUrl: string;
+	ionUrls: UrlMap;
+};
+type TenantManager<TTenant extends BaseTenant = BaseTenant> = {
+	handler(request: Request): Promise<Response>;
+	getTenant(id: string): Promise<TTenant | undefined>;
+};
+declare function tenantManager<
+	TCreateTenantRequest extends CreateTenantRequest = CreateTenantRequest,
+	TUpdateTenantRequest extends UpdateTenantRequest = UpdateTenantRequest,
+	TTenant extends BaseTenant = BaseTenant
+>(ion: Ionite, options: TenantManagerOptions<TCreateTenantRequest, TUpdateTenantRequest, TTenant>): TenantManager<TTenant>;
+import { CapabilityKey as CapabilityKey2 } from "@ionite/core";
+export * from "@ionite/core";
+import { AccessCheckReason, AccessCheckResult, CreateTenantRequest as CreateTenantRequest2, EnvironmentType, FrameworkOtelConfig, FrameworkStores as FrameworkStores3, generateULID, IoniteError, IoniteErrorOptions, listGenerator, Otel, OtelConfig, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProviderType, OtelSignalConfig, SubjectScope, SubjectType as SubjectType3, TenantResponse, TenantStatus, TenantValidators as TenantValidators2, TenantWebhookPayload, UpdateTenantRequest as UpdateTenantRequest2 } from "@ionite/core";
+import { AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CatalogView, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions } from "@ionite/core/server";
+import { allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, blockDangerousUrls, CatalogAdjacencyCache, callback, captureRedirect, ciam, collectReferencedDefinitions, defaultRedirectPolicies, discoverSessionRecords, discoverSessions, expandRoot, getCustomer, getUser, has, hasAll as hasAll2, hasAllScope, hasAny as hasAny2, hasAnyScope, hasGroup as hasGroup2, hasPermission as hasPermission2, hasRole as hasRole2, hasScope, InMemoryTenantStore, iam, initiateLogin, isRedirectAllowed, listSsoClientIdsFromCookies, reconcileSubjectAccess, resolveAfterRedirect, resolveCapturedRedirect, resolveRedirect, SessionDiscoveryOptions, SessionResponse, sameOriginRedirectRules, sendTenantWebhook, sso, VerifyUserOptions, verifyUser, withDefaultExternalId, withSetCookies } from "@ionite/core/server";
+import { AccessAssignmentStore as AccessAssignmentStore2, AccessChange, ListOptions, ListResult, OaaAccessTargetType, SubjectType } from "@ionite/core";
+/**
+* In-memory store of granted access **roots** (source of truth). Roots are keyed by their
+* deterministic id (`accessRootId`) and carry provenance + status. All stored roots are `active`
+* (the SDK uses a transactional fail-fast model with no `pendingRemoval` sweep).
+*/
+declare class InMemoryAccessAssignmentStore implements AccessAssignmentStore2<AccessChange> {
+	private readonly roots;
+	private readonly byTarget;
+	private readonly bySubject;
+	private static targetKey;
+	private static subjectKey;
+	private indexAdd;
+	private indexRemove;
+	private deindex;
+	private index;
+	private resolve;
+	grant(change: AccessChange): Promise<void>;
+	revoke(change: AccessChange): Promise<void>;
+	get(id: string): Promise<AccessChange | undefined>;
+	list(options?: ListOptions): Promise<ListResult<AccessChange>>;
+	listByTarget(targetType: OaaAccessTargetType, target: string, options?: ListOptions): Promise<ListResult<AccessChange>>;
+	listByTargets(targets: Array<{
+		targetType: OaaAccessTargetType;
+		target: string;
+	}>): Promise<Map<string, AccessChange[]>>;
+	listBySubject(subject: string, subjectType?: SubjectType, options?: ListOptions): Promise<ListResult<AccessChange>>;
+}
+import { AccessCatalogStore as AccessCatalogStore2, CatalogChangeListener, EntityStore, Group, ListOptions as ListOptions2, ListResult as ListResult2, Permission, Resource, ResourceChangeListener, ResourceProvider as ResourceProvider2, Role } from "@ionite/core";
+declare class InMemoryAccessCatalogStore implements AccessCatalogStore2 {
+	private readonly listeners;
+	private readonly emit;
+	readonly groups: EntityStore<Group>;
+	readonly roles: EntityStore<Role>;
+	readonly permissions: EntityStore<Permission>;
+	afterChange(listener: CatalogChangeListener): () => void;
+}
+/**
+* Writable, in-memory {@link ResourceProvider} for zero-DB quickstarts, dev tools, and validation.
+* Real applications should implement `ResourceProvider` directly over their own database/ORM (the
+* resources already live there) — this store exists so an app with no database yet can still model
+* resources and resource-derived entitlements without one.
+*
+* `set`/`delete` emit the `changed` signal the SDK subscribes to (adjacency-cache invalidation,
+* targeted reconcile, incremental OAA projection). Provide `deriveEntitlements` (plus its reverse
+* resolver `resolveEntitlement`) to expose resource-derived entitlement Groups through this provider.
+*/
+declare class InMemoryResourceStore implements ResourceProvider2 {
+	private readonly items;
+	private readonly listeners;
+	constructor(options?: {
+		/** Pure derivation of a resource's requestable entitlement Groups (see {@link ResourceProvider.entitlements}). */
+		deriveEntitlements?: (resource: Resource) => Group[];
+		/** Reverse resolution of a resource-derived entitlement id (see {@link ResourceProvider.entitlement}). */
+		resolveEntitlement?: (id: string, get: (resourceId: string) => Resource | undefined) => Group | undefined;
+	});
+	entitlements?: (resource: Resource) => Group[];
+	entitlement?: (id: string) => Promise<Group | undefined>;
+	get(id: string): Promise<Resource | undefined>;
+	list(options?: ListOptions2): Promise<ListResult2<Resource>>;
+	children(id: string): Promise<Resource[]>;
+	changed(listener: ResourceChangeListener): () => void;
+	/** Upsert a resource and signal `changed`. */
+	set(resource: Resource): void;
+	/** Delete a resource and signal `changed` with `deleted: true`. */
+	delete(id: string): void;
+	private emitChange;
+}
+import { AccessCheckTarget, AccessIndex as AccessIndex2, AccessRef, AuthzDecision, BaseUser, EffectiveEdge, Group as Group2, OaaAccessTargetType as OaaAccessTargetType2, Permission as Permission2, Resource as Resource2, Role as Role2, SubjectRef, SubjectType as SubjectType2 } from "@ionite/core";
+/**
+* In-memory derived closure index. Rows are root-attributed: a single
+* `(subject, targetType, target, resource)` edge may be justified by multiple roots, so revoking
+* one root via {@link removeByRoot} leaves edges still backed by other roots. Rebuildable from
+* AccessAssignmentStore roots + the catalog.
+*/
+declare class InMemoryAccessIndex implements AccessIndex2 {
+	/** edgeKey -> set of rootIds that justify it. */
+	private readonly rows;
+	/** tripleKey -> set of edgeKeys (for resource-agnostic "any" checks). */
+	private readonly byTriple;
+	/** rootId -> set of edgeKeys it materialized (for removeByRoot). */
+	private readonly byRoot;
+	/** subjectId -> set of edgeKeys (for clear(subject)). */
+	private readonly bySubject;
+	/** edgeKey -> structural metadata (avoids fragile key parsing on cleanup). */
+	private readonly edgeMeta;
+	/**
+	* Subject-disabled markers (subjectKey set). Deliberately independent of edge materialization:
+	* `materialize`/`removeByRoot`/`clear` never touch it, so reconcile cannot silently re-enable a
+	* SCIM-deactivated subject. Grants stay intact; re-enabling restores prior decisions unchanged.
+	*/
+	private readonly disabledSubjects;
+	has(subject: AccessRef<BaseUser>, targetType: OaaAccessTargetType2, target: AccessRef<Group2 | Role2 | Permission2>, resource?: AccessRef<Resource2>, subjectType?: SubjectType2): Promise<AuthzDecision>;
+	hasGroup(subject: AccessRef<BaseUser>, group: AccessRef<Group2>, resource?: AccessRef<Resource2>, subjectType?: SubjectType2): Promise<AuthzDecision>;
+	hasRole(subject: AccessRef<BaseUser>, role: AccessRef<Role2>, resource?: AccessRef<Resource2>, subjectType?: SubjectType2): Promise<AuthzDecision>;
+	hasPermission(subject: AccessRef<BaseUser>, permission: AccessRef<Permission2>, resource?: AccessRef<Resource2>, subjectType?: SubjectType2): Promise<AuthzDecision>;
+	hasAny(subject: AccessRef<BaseUser>, targets: AccessCheckTarget[], subjectType?: SubjectType2): Promise<AuthzDecision>;
+	hasAll(subject: AccessRef<BaseUser>, targets: AccessCheckTarget[], subjectType?: SubjectType2): Promise<AuthzDecision>;
+	materialize(rootId: string, edges: EffectiveEdge[]): Promise<void>;
+	removeByRoot(rootId: string): Promise<void>;
+	listSubjects(): Promise<SubjectRef[]>;
+	setSubjectDisabled(subject: string, subjectType: SubjectType2, disabled: boolean): Promise<void>;
+	isSubjectDisabled(subject: string, subjectType?: SubjectType2): Promise<boolean>;
+	clear(subject?: string, subjectType?: SubjectType2): Promise<void>;
+	private allow;
+	private addToSet;
+	/** Fully remove an edge key from every secondary index (used when no roots justify it anymore). */
+	private dropEdge;
+	private removeFromSet;
+}
+import { AwsSecretsConfig, ConfigSource, SecretsSource } from "@ionite/core";
+type AwsConfigSourceOptions = Omit<AwsSecretsConfig, "type"> & {
+	vault?: SecretsSource;
+	ttl?: number;
+};
+/**
+* Creates a ConfigSource which reads from AWS Secrets Manager.
+*
+* Not implemented in this build. Throws synchronously at construction (config-source resolution /
+* startup) so a `type: 'aws'` locator fails fast with a clear error rather than type-checking and
+* then throwing at first config access.
+*/
+declare function awsConfig(_config: AwsConfigSourceOptions): ConfigSource;
+import { AzureSecretsConfig, ConfigSource as ConfigSource2, SecretsSource as SecretsSource2 } from "@ionite/core";
+type AzureConfigSourceOptions = Omit<AzureSecretsConfig, "type"> & {
+	vault?: SecretsSource2;
+	path?: string;
+};
+/**
+* Creates a ConfigSource which reads from Azure Key Vault.
+* The path is mapped to a Key Vault secret name via secretNameTransform (default: `/` → `-`).
+* If ttl is set, the vault is polled every ttl milliseconds (minimum 10 minutes) and onConfig is called when config changes.
+*/
+declare function azureConfig(config: AzureConfigSourceOptions): ConfigSource2;
+import { ConfigLocator, ConfigSource as ConfigSource3, ConfigSourceEnv, ConfigSourceType } from "@ionite/core";
+type EnvConfigOptions = {
+	/** Override config source type (default: ION_CONFIG_TYPE from env). */
+	type?: ConfigSourceType;
+};
+declare function configLocatorFromEnvValues(env: Partial<ConfigSourceEnv>, options?: EnvConfigOptions): ConfigLocator;
+/**
+* Creates a ConfigSource from environment variables.
+* Reads ION_CONFIG_TYPE to choose the source.
+* For each supported type, it merges the options with available environment variables.
+*/
+declare function configSourceFromEnvValues(env: Partial<ConfigSourceEnv>, options?: EnvConfigOptions): ConfigSource3;
+declare function envConfig(options?: EnvConfigOptions): ConfigSource3;
+import { ConfigSource as ConfigSource4, GcpSecretsConfig, SecretsSource as SecretsSource3 } from "@ionite/core";
+type GcpConfigSourceOptions = Omit<GcpSecretsConfig, "type"> & {
+	vault?: SecretsSource3;
+	ttl?: number;
+};
+/**
+* Creates a ConfigSource which reads from GCP Secrets Manager.
+*
+* Not implemented in this build. Throws synchronously at construction (config-source resolution /
+* startup) so a `type: 'gcp'` locator fails fast with a clear error rather than type-checking and
+* then throwing at first config access.
+*/
+declare function gcpConfig(_config: GcpConfigSourceOptions): ConfigSource4;
+import { ConfigSource as ConfigSource5, SecretsSource as SecretsSource4 } from "@ionite/core";
+/**
+* Creates a ConfigSource from a SecretsSource path that stores a ConfigLocator.
+* The returned source rebinds subscriptions when the bootstrap secret changes.
+*
+* The resolved inner ConfigSource is cached by a hash of the bootstrap locator so repeated `load()`
+* calls and unchanged bootstrap refreshes reuse the same inner source (and, for vault-backed inner
+* sources, the same websocket/poll) instead of constructing a fresh one every time. When the
+* bootstrap actually changes, the superseded inner source is disposed (its `secret.close()` is
+* invoked) before the new one is built, so config churn cannot leak duplicate connections.
+*/
+declare function secretConfigSource(source: SecretsSource4, path: string): ConfigSource5;
+import { ConfigSource as ConfigSource6, SecretsSource as SecretsSource5, VaultSecretsConfig } from "@ionite/core";
+type VaultConfigSourceOptions = Omit<VaultSecretsConfig, "type"> & {
+	vault?: SecretsSource5;
+	path?: string;
+};
+declare class VaultConfigWaitingForSecretError extends Error {
+	readonly path: string;
+	constructor(path: string, message?: string);
+	readonly code = "not_found";
+	readonly sourceType = "vault";
+	readonly status = 404;
+}
+declare function isVaultConfigWaitingForSecretError(error: unknown): error is VaultConfigWaitingForSecretError;
+/**
+* The vault config secret exists but is not a usable RemoteConfig (wrong shape / unknown keys). This
+* is a hard, non-recoverable error (unlike {@link VaultConfigWaitingForSecretError}): the initial
+* apply rejects rather than retries.
+*/
+declare class VaultConfigInvalidPayloadError extends Error {
+	readonly path: string;
+	constructor(path: string, message: string);
+	readonly code = "invalid_payload";
+	readonly sourceType = "vault";
+}
+declare function isVaultConfigInvalidPayloadError(error: unknown): error is VaultConfigInvalidPayloadError;
+/**
+* Creates a ConfigSource that reads config from a vault instance.
+* Uses the given vault client to fetch secrets at the specified path.
+* If ttl is set, the vault will be polled every ttl milliseconds (minimum 10 minutes) and onConfig will be called when the config changes.
+* When a custom vault client is provided, ttl is still honored for config subscription polling if the client does not support native subscribe().
+*/
+declare function vaultConfig(config: VaultConfigSourceOptions): ConfigSource6;
+import { BaseCustomer, CustomerStore, ListOptions as ListOptions3, ListResult as ListResult3 } from "@ionite/core";
+/**
+* In-memory customer store implementation using Maps.
+*
+* The CIAM customer domain counterpart to `InMemoryUserStore`.
+*/
+declare class InMemoryCustomerStore<TExtended = Record<string, never>> implements CustomerStore<TExtended> {
+	private customers;
+	private userNameIndex;
+	get(id: string): Promise<BaseCustomer<TExtended> | undefined>;
+	lookup(customer: BaseCustomer<TExtended>): Promise<BaseCustomer<TExtended> | undefined>;
+	upsert(customer: BaseCustomer<TExtended>): Promise<BaseCustomer<TExtended>>;
+	delete(id: string): Promise<number>;
+	list(options?: ListOptions3): Promise<ListResult3<BaseCustomer<TExtended>>>;
+}
+import { AccessCatalogStore as AccessCatalogStore3, IamDeltaEmitter, IamDeltaIdMapStore as IamDeltaIdMapStore2, IamDeltaMode, Logger, ResourceProvider as ResourceProvider3, UserStore, Workload as Workload2 } from "@ionite/core";
+type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
+/** RemoteConfig-derived destination descriptor for IAM delta egress. */
+type IamDeltaConfig = {
+	mode?: IamDeltaMode;
+	/** Destination SCIM base URL of the IAM tool. */
+	url?: string;
+	/** Outgoing workload client name used to authenticate pushes (`IAMConfig.deltaAudience`). */
+	audience?: string;
+	/** Tenant scope for the mapping cache. */
+	tenantId?: string;
+};
+/** Runtime capabilities the emitter binds to (resolved from the merged config/stores in buildES). */
+type IamDeltaDeps = {
+	workload?: Workload2;
+	userStore?: UserStore;
+	catalogStore?: AccessCatalogStore3;
+	/** Read-through provider for derived-entitlement resolution (externalId lookup on delta egress). */
+	resources?: ResourceProvider3;
+	/** `externalId -> provider id` mapping cache for outbound SCIM (defaults to in-memory). */
+	idMapStore?: IamDeltaIdMapStore2;
+	/** Injectable fetch (defaults to global fetch); enables testing the patch path in-process. */
+	fetchImpl?: FetchLike;
+};
+/**
+* Managed IAM delta module (mirrors `createManagedAuthz`). Creates ONE persistent
+* {@link IamDeltaEmitter} whose readiness promise is stable across RemoteConfig applies;
+* `update(config, deps)` reconfigures the destination/capabilities in place.
+*
+* `'patch'` emits externalId-only outbound SCIM into the IAM tool at the access-mutation
+* chokepoint (needs `url` + workload + an `idMapStore`, which defaults to in-memory). Every push is
+* authenticated with the outgoing workload client, which the destination treats as the verified
+* origin. See the README "IAM delta egress" section.
+*/
+declare function createManagedIamDelta(log: Logger): {
+	update(config: IamDeltaConfig, deps: IamDeltaDeps): IamDeltaEmitter;
+};
+import { IamDeltaIdMapKey, IamDeltaIdMapStore as IamDeltaIdMapStore3 } from "@ionite/core";
+/**
+* Stable string key for an {@link IamDeltaIdMapKey}. Scoped by tenant + destination so the same
+* `externalId` can map to different provider ids across IAM tools and tenants. Shared by the
+* in-memory and Redis implementations to keep keying identical.
+*/
+declare function iamDeltaIdMapKey(key: IamDeltaIdMapKey): string;
+/**
+* In-memory {@link IamDeltaIdMapStore}. Suitable for single-process apps and tests. Production
+* deployments should use a durable implementation (e.g. `RedisIamDeltaIdMapStore` or a SQL-backed
+* store) so the externalId -> provider-id cache survives restarts and is shared across instances.
+*/
+declare class InMemoryIamDeltaIdMapStore implements IamDeltaIdMapStore3 {
+	private readonly map;
+	get(key: IamDeltaIdMapKey): Promise<string | undefined>;
+	set(key: IamDeltaIdMapKey, providerId: string): Promise<void>;
+	delete(key: IamDeltaIdMapKey): Promise<void>;
+}
+import { CapabilityKey, ModuleName } from "@ionite/core";
+type CapabilityDescriptor = {
+	/**
+	* Stable machine key (also the catalog map key). This is the SAME key the runtime `capabilitiez`
+	* manifest uses ({@link CapabilityKey}); the catalog is generated from that enum (AUDIT_HISTORY.md §11.3) so
+	* the two cannot drift and no manual key bridge is required.
+	*/
+	key: CapabilityKey;
+	/** Owning module. */
+	module: ModuleName;
+	/** Human-readable label for ECI catalog UIs. */
+	label: string;
+	/** Capability the application must wire for this feature to be `capable` (informational). */
+	requires?: string;
+	/** Reason surfaced when `requested` but not `capable`. */
+	incapableReason?: string;
+};
+declare const ION_CAPABILITY_CATALOG: readonly [{
+	readonly key: "sso.login";
+	readonly module: "sso";
+	readonly label: "SSO login (workforce single sign-on)";
+}, {
+	readonly key: "sso.jit";
+	readonly module: "sso";
+	readonly label: "SSO just-in-time user provisioning";
+}, {
+	readonly key: "sso.logout";
+	readonly module: "sso";
+	readonly label: "SSO logout";
+}, {
+	readonly key: "sso.back_channel_logout";
+	readonly module: "sso";
+	readonly label: "SSO back-channel logout";
+}, {
+	readonly key: "ciam.magic_link";
+	readonly module: "ciam";
+	readonly label: "CIAM magic-link login";
+}, {
+	readonly key: "ciam.oidc_login";
+	readonly module: "ciam";
+	readonly label: "CIAM third-party OIDC login";
+}, {
+	readonly key: "ciam.customer";
+	readonly module: "ciam";
+	readonly label: "CIAM customer profile resolution";
+}, {
+	readonly key: "ciam.logout";
+	readonly module: "ciam";
+	readonly label: "CIAM logout";
+}, {
+	readonly key: "iam.users";
+	readonly module: "iam";
+	readonly label: "SCIM Users inbound";
+	readonly requires: "userStore";
+	readonly incapableReason: "SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application.";
+}, {
+	readonly key: "iam.groups";
+	readonly module: "iam";
+	readonly label: "SCIM Groups inbound";
+	readonly requires: "AccessCatalogStore";
+	readonly incapableReason: "SCIM Groups endpoint is enabled by RemoteConfig but no AccessCatalogStore capability is wired by the application.";
+}, {
+	readonly key: "workload.incoming";
+	readonly module: "workload";
+	readonly label: "Workload incoming token validation";
+}, {
+	readonly key: "workload.outgoing";
+	readonly module: "workload";
+	readonly label: "Workload outgoing token minting";
+}, {
+	readonly key: "authz.oaa";
+	readonly module: "authz";
+	readonly label: "Authz OAA projection (Veza)";
+	readonly requires: "AccessAssignmentStore + AccessCatalogStore";
+	readonly incapableReason: "OAA projection is configured by RemoteConfig but no access/catalog store capability is wired by the application.";
+}];
+import { BaseCustomer as BaseCustomer2, MagicLink, MagicLinkStore } from "@ionite/core";
+/**
+* In-memory implementation of MagicLinkStore from @ionite/core.
+*/
+declare class InMemoryMagicLinkStore<TExtended = Record<string, never>> implements MagicLinkStore<TExtended> {
+	private magicLinks;
+	create(token: string, customer: BaseCustomer2, expiresAt: Date): Promise<void>;
+	get(token: string): Promise<MagicLink<TExtended> | null>;
+	getAndDelete(token: string): Promise<MagicLink<TExtended> | null>;
+	delete(token: string): Promise<void>;
+}
+import { Ionite as Ionite2, ResolvedRoute, RoutingOptions } from "@ionite/core";
+/**
+* Deny-by-default authorization gate for a resolved SDK route. Returns the 401/403 `Response` to
+* short-circuit with when the caller is not authorized, or `undefined` to proceed. Enforcement reuses
+* the request-level `hasPermission` helper so a granted entitlement OR a matching OAuth scope (when
+* `RemoteConfig.authz.scopesAsEntitlements` is enabled) satisfies the gate; the `response()` already
+* logs the denial server-side without leaking the missing permission to the caller.
+*/
+declare function enforceEndpointAuthz(request: Request, ion: Ionite2, required: NonNullable<ResolvedRoute["requiredPermission"]>): Promise<Response | undefined>;
+/**
+* Resolve the default route for a request using the deterministic, basePath-derived endpoint paths.
+* Endpoint URLs are no longer read from per-module config; they are computed from `basePath`.
+*/
+declare function resolveDefaultRoute(request: Request, ion: Ionite2, urls: UrlMap, pathname?: string): ResolvedRoute | undefined;
+declare function routeRequest(request: Request, ion: Ionite2, routing?: RoutingOptions, urls?: UrlMap): Promise<Response>;
+import { IamDeltaIdMapStore as IamDeltaIdMapStore4, IamDeltaResourceType, Logger as Logger2 } from "@ionite/core";
+type FetchLike2 = (input: string, init?: RequestInit) => Promise<Response>;
+/**
+* Outcome of an outbound membership patch:
+* - `'pushed'`  — the destination accepted the mutation (2xx).
+* - `'skipped'` — the mutation was not attempted (subject/target not resolvable at the destination).
+* - `'error'`   — the destination rejected the mutation (non-2xx); the caller surfaces this as a
+*   degraded egress / reconcile error so it is never mistaken for success (§4.8/§19.1).
+*/
+type ScimPatchOutcome = "pushed" | "skipped" | "error";
+/**
+* Result of resolving a destination provider id. A lookup/create HTTP failure is `'error'`, NOT
+* `'absent'`: conflating the two would let a transient 401/500 masquerade as "no such resource",
+* which either triggers a spurious create (duplicate resources) or a misleading `'skipped'` outcome.
+* - `{ found }` — a confirmed provider id (from cache, filter match, or create).
+* - `'absent'`  — the destination confirmed no resource exists for this `externalId` (2xx, empty).
+* - `'error'`   — the lookup/create could not be completed (non-2xx); treat as degraded egress.
+*/
+type ProviderIdResolution = {
+	found: string;
+} | "absent" | "error";
+/** Minimal create payload used only when the destination has no resource for an `externalId`. */
+type ScimOutboundCreate = {
+	/** SCIM `userName` (required for Users) or unused for Groups. */
+	userName?: string;
+	/** SCIM `displayName` (required for Groups; optional for Users). */
+	displayName?: string;
+};
+type ScimOutboundClientOptions = {
+	/** Destination SCIM base URL (e.g. https://iam.example.com/scim/v2). */
+	baseUrl: string;
+	/** Mints a bearer token for the destination audience (workload outgoing client). */
+	getToken: () => Promise<string>;
+	/** Durable externalId -> provider-id cache (required). */
+	idMapStore: IamDeltaIdMapStore4;
+	/** Tenant scope for the mapping cache. */
+	tenantId?: string;
+	log: Logger2;
+	/** Injectable fetch (defaults to global fetch); enables testing against a mock SCIM server. */
+	fetchImpl?: FetchLike2;
+};
+/**
+* Escape a value interpolated into a SCIM filter string literal (RFC 7644 §3.4.2.2). Filter string
+* comparison values are JSON strings, so a literal backslash and double-quote must be escaped
+* (backslash first, then quote) — otherwise an id containing `"` would break out of the literal and
+* corrupt the filter (or the remove path), silently matching the wrong resource. IDs are SDK-managed
+* externalIds/provider ids, but this closes the injection/corruption vector regardless of source.
+*/
+declare function escapeScimFilterValue(value: string): string;
+/**
+* externalId-only outbound SCIM client for IAM delta `'patch'` egress.
+*
+* Resolves a destination provider id for a resource STRICTLY by `externalId` (never email,
+* employeeId, samAccountName, or any custom attribute), backed by a durable mapping cache:
+*
+* - cache hit -> use the stored provider id
+* - miss -> `GET /{Resource}?filter=externalId eq "..."` -> store + use the returned id
+* - empty -> `POST /{Resource}` (create) -> store + use the returned id
+* - stale (404/410 on a subsequent write) -> drop the mapping, re-resolve, retry once
+*
+* Concurrent resolutions for the same `(destination, resourceType, externalId)` are single-flighted.
+*/
+declare class ScimOutboundClient {
+	private readonly baseUrl;
+	private readonly getToken;
+	private readonly idMapStore;
+	private readonly tenantId?;
+	private readonly log;
+	private readonly fetchImpl;
+	private readonly inflight;
+	constructor(options: ScimOutboundClientOptions);
+	private headers;
+	private inflightKey;
+	/**
+	* Resolve (or create) the destination provider id for a resource identified by `externalId`.
+	* Returns a discriminated {@link ProviderIdResolution}: a confirmed id, `'absent'` (destination has
+	* no such resource and no `create` was supplied/succeeded), or `'error'` (lookup/create failed).
+	*/
+	resolveProviderId(resourceType: IamDeltaResourceType, externalId: string, create?: ScimOutboundCreate): Promise<ProviderIdResolution>;
+	private resolveUncached;
+	private filterByExternalId;
+	private create;
+	/** Drop a possibly-stale mapping so the next resolve re-filters the destination. */
+	private invalidate;
+	/**
+	* Add or remove a user (by `userExternalId`) from a group (by `groupExternalId`) at the destination.
+	* Resolves both ids by externalId, issues a SCIM PATCH, and self-heals once on a stale group id.
+	*/
+	patchGroupMembership(args: {
+		groupExternalId: string;
+		userExternalId: string;
+		op: "add" | "remove";
+		groupCreate?: ScimOutboundCreate;
+		userCreate?: ScimOutboundCreate;
+	}): Promise<ScimPatchOutcome>;
+}
+import { SecretsSource as SecretsSource6, VaultLfvSecretsConfig } from "@ionite/core";
+type LfvSecretsSource = SecretsSource6 & {
+	isDeliveryRequest(request: Request): boolean;
+	isEventsRequest(request: Request): boolean;
+	handleDelivery(request: Request): Promise<Response>;
+	handleEvents(request: Request): Promise<Response>;
+	/** Normalized inbound delivery path this source claims (used to enforce global uniqueness at apply time). */
+	readonly deliveryPath: string;
+	/** Normalized inbound events path this source claims (used to enforce global uniqueness at apply time). */
+	readonly eventsPath: string;
+	/** Normalized `serverUrl|path` callback-hub key this source registers under. */
+	readonly callbackKey: string;
+	/** Stable identity of this source's verify JWKS trust material (undefined when unconfigured). */
+	readonly trustId?: string;
+};
+declare function lfvVault(config: VaultLfvSecretsConfig): LfvSecretsSource;
+import { SessionStore } from "@ionite/core";
+/**
+* Options for {@link createSessionReadCache}. Values are the already-clamped internal (ms/count)
+* form produced by the core `resolveSessionCacheConfig` from the portable
+* `RemoteConfig.cache.session.read` block.
+*/
+type SessionReadCacheOptions = {
+	/** Max time a cached `get(sid)` result may be served, in ms. */
+	ttlMs: number;
+	/** Max distinct session ids held at once (bounded LRU). */
+	maxEntries: number;
+};
+/**
+* Instance-local read-through cache decorator for a {@link SessionStore}. DEFAULT-OFF: only wired
+* when `RemoteConfig.cache.session.read.enabled === true`. It is the "monolith knob" — it trades a
+* bounded amount of cross-instance staleness (a logout/refresh on another node is visible after at
+* most `ttlMs`) for eliminating repeated `get(sid)` round-trips to a Redis/DB session store on
+* hot paths.
+*
+* Semantics (portable contract):
+* - `get(sid)` is served from a bounded LRU for up to `ttlMs`; on miss it reads through and caches.
+* - **Misses are NOT cached** (a null result never populates the cache), which avoids a login race
+*   (a session created moments later would otherwise be masked) and an unauthenticated-flood memory
+*   vector (only valid sids ever become keys).
+* - `update`/`delete` write through to the underlying store AND invalidate the local entry, so a
+*   same-process logout/refresh is immediately visible.
+* - `create` writes through; it does not pre-populate the cache (kept lazy; the first `get` caches).
+* - Lazy TTL expiry only (no timers/sweepers — safe in serverless): an expired entry is dropped on
+*   the next access.
+*
+* A fresh instance is created on every RemoteConfig apply (the caller drops the previous one) so a
+* live re-tune never leaks the old cache.
+*/
+declare function createSessionReadCache<TExtended = Record<string, never>>(store: SessionStore<TExtended>, options: SessionReadCacheOptions): SessionStore<TExtended>;
+import { Session, SessionStore as SessionStore2 } from "@ionite/core";
+/**
+* In-memory session store implementation using Maps.
+*
+* Lazily purges records whose `expiresAt` has passed on `get`, mirroring the physical expiry a
+* TTL-backed store (Redis `EX`) gives for free (AUDIT_HISTORY.md §1.3). There is no background sweep, so an
+* abandoned session lingers in the Map until it is next looked up; for unbounded-lifetime deployments
+* prefer a TTL-backed store.
+*/
+declare class InMemorySessionStore<TExtended = Record<string, never>> implements SessionStore2<TExtended> {
+	private sessions;
+	create(session: Session<TExtended>): Promise<void>;
+	get(sid: string): Promise<Session<TExtended> | null>;
+	update(sid: string, data: Partial<Session<TExtended>>): Promise<void>;
+	delete(sid: string): Promise<void>;
+}
+import { ConfigSource as ConfigSource8, ConfigSourceResolver as ConfigSourceResolver2, TenantConfigLocator as TenantConfigLocator2 } from "@ionite/core";
+import { ConfigLocator as ConfigLocator2, ConfigSource as ConfigSource7 } from "@ionite/core";
+/**
+* Materialize a runtime {@link ConfigSource} from a full, self-contained {@link ConfigLocator}. This
+* is the ROOT/bootstrap path (env vars via `envConfig()`, or a bootstrap secret via
+* `secretConfigSource()`): the locator carries the connection details/credentials needed to build a
+* fresh source. Tenants do NOT use this path — see {@link tenantConfigSourceFromResolver}.
+*/
+declare function configSourceFromLocator(locator: ConfigLocator2): ConfigSource7;
+/**
+* Context threaded into tenant config-source validation so a locator can be checked against the tenant
+* that owns it. INVARIANT: each tenant MUST resolve to a DISTINCT backing config path (e.g. a unique
+* vault path). Two tenants sharing a config path would cross-load each other's RemoteConfig.
+*/
+type ConfigLocatorContext = {
+	tenantId?: string;
+};
+/**
+* Optional validation hook invoked before a tenant's locator is materialized. Implementations should
+* throw when a locator is not valid (e.g. a shared/duplicate config path). The shared source client
+* may still be reused across tenants; only the resolved path must differ per tenant.
+*/
+type ConfigLocatorAssert = (input: {
+	locator: TenantConfigLocator2;
+}) => void;
+declare function registerConfigLocatorAssert(assert: ConfigLocatorAssert | undefined): void;
+/**
+* Materialize a tenant's {@link ConfigSource} from its {@link TenantConfigLocator}, resolving against
+* the root ES (`ion.secret` / `ion.secrets`). Pass the root `es` (or any {@link ConfigSourceResolver}).
+*
+* This lives in `@ionite/server` (not core) so the materialization can reference the
+* server-only source implementations directly, with no import-time registration side effect — keeping
+* every published package truthfully `sideEffects: false`.
+*/
+declare function tenantConfigSource(locator: TenantConfigLocator2, ion: ConfigSourceResolver2): ConfigSource8;
+import { Ionite as Ionite3, TenantPathNamespace, TenantRoutingStrategy } from "@ionite/core";
+type MaybePromise<T> = Promise<T> | T;
+type TenantResolutionContext = {
+	namespace: "api" | "ui";
+	restPath: string;
+	restSegments: string[];
+};
+type ResolveTenantFromRequestOptions = {
+	strategy?: TenantRoutingStrategy;
+	namespace?: "api" | "ui";
+	/**
+	* App-owned resolver for tenants that are not encoded in the URL path. The SDK does not infer a
+	* tenant from unverified input (JWT/header/host/cookie); if you need that, implement it here and
+	* verify it yourself before returning an id.
+	*/
+	custom?: (request: Request) => MaybePromise<string | null | undefined>;
+};
+type CreateTenantIonResolverOptions = {
+	store: {
+		getIon(id: string): Promise<Ionite3 | undefined>;
+	};
+	getIon?: never;
+} | {
+	store?: never;
+	getIon: (id: string) => Promise<Ionite3 | null | undefined>;
+};
+type TenantIonResolver = (id: string) => Promise<Ionite3 | undefined>;
+type CreateTenantIonHandlerOptions = {
+	getIon: (id: string, request: Request) => MaybePromise<Ionite3 | null | undefined>;
+	resolveTenant?: (request: Request) => MaybePromise<{
+		id: string;
+		context?: TenantResolutionContext;
+	} | string | null | undefined>;
+	rewriteRequest?: (request: Request, details: {
+		id: string;
+		ion: Ionite3;
+		context?: TenantResolutionContext;
+	}) => MaybePromise<Request>;
+	onMissingTenant?: (request: Request) => MaybePromise<Response>;
+	onMissingIonite?: (request: Request, id: string) => MaybePromise<Response>;
+};
+declare function createTenantIonResolver(options: CreateTenantIonResolverOptions): TenantIonResolver;
+declare function resolveTenantFromRequest(request: Request, options?: ResolveTenantFromRequestOptions): Promise<{
+	id: string;
+	context?: TenantResolutionContext;
+} | null>;
+declare function rewriteRequestPath(request: Request, pathname: string): Request;
+declare function rewriteRequestForTenantPath(request: Request, id: string, sourceNamespace: TenantPathNamespace, targetNamespace: TenantPathNamespace): Request;
+declare function rewriteRequestForDefaultTenantApi(request: Request, id: string, targetNamespace?: TenantPathNamespace): Request;
+declare function rewriteRequestForDefaultTenantUi(request: Request, id: string, targetNamespace?: TenantPathNamespace): Request;
+declare function createTenantIonHandler(options: CreateTenantIonHandlerOptions): (request: Request) => Promise<Response>;
+import { BaseUser as BaseUser2, ListOptions as ListOptions4, ListResult as ListResult4, UserStore as UserStore2 } from "@ionite/core";
+/**
+* In-memory user store implementation using Maps.
+*/
+declare class InMemoryUserStore<TExtended = Record<string, never>> implements UserStore2<TExtended> {
+	private users;
+	private userNameIndex;
+	get(id: string): Promise<BaseUser2<TExtended> | undefined>;
+	lookup(user: BaseUser2<TExtended>): Promise<BaseUser2<TExtended> | undefined>;
+	upsert(user: BaseUser2<TExtended>): Promise<BaseUser2<TExtended>>;
+	delete(sub: string): Promise<number>;
+	list(options?: ListOptions4): Promise<ListResult4<BaseUser2<TExtended>>>;
+}
+import { SecretsSource as SecretsSource8, VaultSecretsConfig as VaultSecretsConfig3 } from "@ionite/core";
+import { Secret, SecretsSource as SecretsSource7, SecretsSubscriptionOptions, VaultSecretsConfig as VaultSecretsConfig2 } from "@ionite/core";
+declare class VaultSubscribeNotSupportedError extends Error {
+	readonly sourceType: string;
+	readonly path: string;
+	constructor(sourceType: string, path: string, message?: string);
+}
+declare const VAULT_MIN_POLLING_TTL_MS = 6e5;
+/** Optional health hooks so a polling source can flip its degraded `isAvailable()` state. */
+type HttpPollingHooks = {
+	/** Invoked after every poll attempt (initial read + each tick) with the observed health. */
+	onHealth?: (healthy: boolean) => void;
+};
+/**
+* Subscribe to a secret path via HTTP polling using a self-scheduling `setTimeout` chain. The next
+* poll is scheduled only after the current one settles, so polls can never overlap or pile up during
+* a slow/failing upstream (no `setInterval` storm). The returned unsubscribe sets a `closed` flag and
+* cancels any pending timer/sleep, so teardown halts all activity immediately even mid-outage.
+*/
+declare function subscribeSecretPathWithHttpPolling<T>(source: Pick<SecretsSource7, "getFullSecret">, path: string, onChange: (fullSecret: Secret<T>) => void, ttl: number, log?: VaultSecretsConfig2["log"], options?: SecretsSubscriptionOptions, hooks?: HttpPollingHooks): Promise<() => void>;
+/**
+* Override the per-command websocket timeout (ms). Primarily a diagnostic/test knob; production code
+* should leave the 30s default in place.
+*/
+declare function setVaultWebSocketCommandTimeout(ms: number): void;
+/** Test/diagnostic helper: number of live sockets and total registered subscriptions. */
+declare function vaultSocketDiagnostics(): {
+	urls: string[];
+	sockets: number;
+	subscriptions: number;
+};
+/** Test helper: force-close every vault socket in the process. */
+declare function closeAllVaultSockets(): void;
+type OpenbaoVaultOptions = Omit<VaultSecretsConfig3, "type"> & {
+	type?: "openbao" | "vault";
+};
+/**
+* Compatibility helper for OpenBao/Hashicorp-compatible vault endpoints.
+* Internally uses the standard vault secrets source implementation.
+*/
+declare function openbaoVault(options: OpenbaoVaultOptions): SecretsSource8;
+import { Workload as CoreWorkload, FrameworkWorkloadConfig, Ionite as Ionite4, JWTAssertionClaims, Logger as Logger4, TokenValidationResult, TrustedIdp, WorkloadConfigMap, WorkloadGetToken, WorkloadIdentityStore as WorkloadIdentityStore2, WorkloadIncomingOutgoing, WorkloadTokenResponse, WorkloadTokenStore } from "@ionite/core";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+/**
+* Common fields shared across all workload authentication modes
+*/
+type WorkloadConfigBase = {
+	/**
+	* App workload token endpoint path (e.g. /api/ionite/tenant/workload/token).
+	* Used for routing; set in code.
+	*/
+	tokenUrl?: string;
+	/**
+	* IdP OAuth2 token endpoint URL (e.g. https://sso.example.com/.../token).
+	* REQUIRED for client role (token acquisition); typically set in vault.
+	*/
+	idpTokenUrl?: string;
+	/**
+	* JWKS endpoint URL for public key retrieval
+	* REQUIRED for server role (token validation)
+	*/
+	jwksUri?: string;
+	/**
+	* Expected token issuer URL for validation
+	* RECOMMENDED for server role (token validation)
+	*/
+	issuer?: string;
+	/**
+	* Target audience for tokens
+	*/
+	audience?: string;
+	/**
+	* Per-IdP scopesAsEntitlements intent (incoming/server role only). See core `WorkloadConfigBase`.
+	*/
+	scopesAsEntitlements?: boolean;
+	/**
+	* Default OAuth2 scopes (space-delimited)
+	*/
+	scope?: string;
+	/**
+	* JWT assertion/token lifetime in seconds
+	* @default 300 (5 minutes)
+	*/
+	tokenLifetime?: number;
+	/**
+	* Refresh threshold in seconds (refresh token this many seconds before expiry)
+	* @default 60
+	*/
+	refreshThreshold?: number;
+	/**
+	* Optional token store for caching access tokens
+	*/
+	tokenStore?: WorkloadTokenStore;
+	/**
+	* Optional registry/enrichment store for workload principals. When set, `getWorkloadIdentity`
+	* merges stored attributes (e.g. `displayName`, `active`, default `scopes`) onto the validated
+	* token identity. Authorization works without it; see {@link WorkloadIdentityStore}.
+	*/
+	workloadIdentityStore?: WorkloadIdentityStore2;
+	/**
+	* Automatically refresh tokens before expiration
+	* @default true
+	*/
+	autoRefresh?: boolean;
+	/**
+	* Optional RFC 7009 token revocation endpoint
+	*/
+	revocationEndpoint?: string;
+	/**
+	* Optional handler defaults (merged with per-call overrides in `handler`)
+	*/
+	validateUrl?: string;
+	jwksUrl?: string;
+	refreshUrl?: string;
+	validators?: WorkloadValidators;
+};
+type WorkloadValidators = {
+	jwtAssertionClaims: StandardSchemaV1<unknown, JWTAssertionClaims>;
+	tokenResponse: StandardSchemaV1<unknown, WorkloadTokenResponse>;
+};
+/**
+* JWT Bearer Grant (RFC 7523) Configuration
+*
+* Used for SPIFFE-style workload identities where services have their own
+* cryptographic identity and sign their own JWT assertions.
+*
+* @example
+* ```json
+* {
+*   "token_url": "https://auth.example.com/oauth/token",
+*   "jwks_uri": "https://auth.example.com/.well-known/jwks.json",
+*   "workload_id": "spiffe://trust-domain/ns/service",
+*   "audience": "https://auth.example.com/oauth/token",
+*   "private_key": "-----BEGIN PRIVATE KEY-----...",
+*   "algorithm": "RS256"
+* }
+* ```
+*/
+type JwtBearerWorkloadConfig = WorkloadConfigBase & {
+	/**
+	* Workload identifier (e.g., SPIFFE ID: spiffe://trust-domain/namespace/service)
+	* REQUIRED for JWT Bearer Grant mode
+	*/
+	workloadId: string;
+	/**
+	* PEM-encoded private key for signing JWT assertions
+	* REQUIRED for client role in JWT Bearer Grant mode
+	*/
+	privateKey: string;
+	/**
+	* Key ID (kid) to include in JWT header for key rotation support
+	*/
+	keyId?: string;
+	/**
+	* JWT signing algorithm
+	* @default 'RS256'
+	*/
+	algorithm?: "RS256" | "RS384" | "RS512" | "ES256" | "ES384" | "ES512";
+};
+/**
+* OAuth2 Client Credentials Configuration
+*
+* Standard OAuth2 Client Credentials Grant (RFC 6749 Section 4.4).
+* Used with identity providers like Keycloak for service-to-service authentication.
+*
+* @example
+* ```json
+* {
+*   "token_url": "https://sso.example.com/realms/myrealm/protocol/openid-connect/token",
+*   "jwks_uri": "https://sso.example.com/realms/myrealm/protocol/openid-connect/certs",
+*   "client_id": "my-service",
+*   "client_secret": "secret-from-idp",
+*   "issuer": "https://sso.example.com/realms/myrealm",
+*   "scope": "api:read api:write"
+* }
+* ```
+*/
+type ClientCredentialsWorkloadConfig = WorkloadConfigBase & {
+	/**
+	* OAuth2 client identifier registered with the authorization server
+	* REQUIRED for Client Credentials mode
+	*/
+	clientId: string;
+	/**
+	* OAuth2 client secret
+	* REQUIRED for Client Credentials mode
+	*/
+	clientSecret: string;
+};
+/**
+* Server-Only Workload Configuration
+*
+* Used when a service only needs to validate incoming workload tokens,
+* not acquire tokens for outbound calls. Requires only jwks_uri for
+* public key retrieval.
+*
+* Note: jwksUri and issuer are optional in TypeScript (since they come from vault)
+* but are required at runtime and validated by standardSchema validators.
+*
+* @example
+* ```json
+* {
+*   "jwks_uri": "https://sso.example.com/realms/myrealm/protocol/openid-connect/certs",
+*   "issuer": "https://sso.example.com/realms/myrealm"
+* }
+* ```
+*/
+type ServerOnlyWorkloadConfig = WorkloadConfigBase & {
+	/**
+	* JWKS endpoint URL for public key retrieval
+	* REQUIRED at runtime (validated by standardSchema), optional in TypeScript (comes from vault)
+	*/
+	jwksUri?: string;
+};
+/**
+* Workload Identity Authentication Configuration
+*
+* Union type supporting multiple authentication modes. The mode is automatically
+* detected based on which fields are present:
+*
+* - **JWT Bearer Grant**: Requires `workload_id` + `private_key`
+* - **Client Credentials**: Requires `client_id` + `client_secret`
+* - **Server-Only**: Only `jwks_uri` (and optionally `issuer`) for token validation
+*
+* The developer uses the same API regardless of mode - the library handles the details.
+*/
+type WorkloadConfig = JwtBearerWorkloadConfig | ClientCredentialsWorkloadConfig | ServerOnlyWorkloadConfig;
+/**
+* Workload Identity extracted from validated tokens
+*/
+type WorkloadIdentity = {
+	/**
+	* Workload identifier (for JWT Bearer Grant tokens)
+	*/
+	workloadId?: string;
+	/**
+	* Client identifier (for OAuth2 Client Credentials tokens)
+	*/
+	clientId?: string;
+	/**
+	* Granted scopes
+	*/
+	scope?: string;
+	/**
+	* Whether the trusted IdP that validated this token opts into honoring its OAuth `scope` claim as
+	* entitlements (per-IdP intent, resolved at validation time).
+	*/
+	scopesAsEntitlements?: boolean;
+	/**
+	* Enterprise Controlled ID for this workload (`ecid:<realm>:<opaque>`), when carried on the token
+	* `ecid` claim or enriched from a wired `WorkloadIdentityStore`. A workload is its own governance
+	* root. See https://ionite.com/docs/llms-ecid.txt.
+	*/
+	ecid?: string;
+	/**
+	* Full JWT claims from the token
+	*/
+	claims: JWTAssertionClaims;
+};
+/**
+* Workload Identity Authentication Interface
+*/
+type Workload3 = {
+	config: WorkloadConfig;
+	beforeChange?: (listener: () => void) => () => void;
+	afterChange?: (listener: () => void) => () => void;
+	isReady?: () => boolean;
+	ready?: (timeout?: number) => Promise<void>;
+	getToken: WorkloadGetToken;
+	refreshToken: (scope?: string) => Promise<WorkloadTokenResponse>;
+	generateJWTAssertion: (scope?: string) => Promise<string>;
+	revokeToken: (token: string) => Promise<void>;
+	validateToken: (token: string) => Promise<TokenValidationResult>;
+	getWorkloadIdentity: (request: Request) => Promise<WorkloadIdentity | undefined>;
+	parseJWT: (token: string) => Promise<JWTAssertionClaims>;
+	handler: (request: Request) => Promise<Response>;
+};
+declare function workload(validators: WorkloadValidators, log: Logger4, fromVault?: Partial<WorkloadConfig> | WorkloadConfigMap | WorkloadIncomingOutgoing, fromCode?: FrameworkWorkloadConfig, incomingTrustOverride?: TrustedIdp[]): Workload3 | undefined;
+/**
+* Get the workload identity from an incoming request.
+*/
+declare function getWorkload(request: Request, ion: Ionite4): Promise<WorkloadIdentity | undefined>;
+/**
+* Get an access token for the configured workload identity.
+* Client is required and must be one of the configured outgoing workload clients.
+* Throws when no outgoing clients are configured on this Ionite instance.
+* Scope defaults to the config for the chosen client (e.g. workload.outgoing.<name>.scope); pass scope to override.
+*/
+declare function getWorkloadToken(client: string, ion: Ionite4, scope?: string): Promise<string>;
+/**
+* Validate a workload token from an incoming request.
+* Accepts either an Ionite instance (uses its workload) or a Workload instance directly
+* (e.g. a server-only Workload used for tenant creation auth).
+*/
+declare function validateWorkloadToken(request: Request, ionOrWorkload: Ionite4 | CoreWorkload): Promise<TokenValidationResult>;
+/**
+* Revoke a workload access token.
+*/
+declare function revokeWorkloadToken(token: string, ion: Ionite4): Promise<void>;
+/**
+* Framework-agnostic request handler for the Workload module (token, validate, jwks, refresh routes).
+*/
+declare function workloadHandler(request: Request, ion: Ionite4): Promise<Response>;
+import { BaseWorkloadIdentity, ListOptions as ListOptions5, ListResult as ListResult5, WorkloadIdentityStore as WorkloadIdentityStore3 } from "@ionite/core";
+/**
+* In-memory {@link WorkloadIdentityStore} implementation using Maps. Suitable for development and
+* testing; use a durable store (e.g. Redis/SQL) in production.
+*/
+declare class InMemoryWorkloadIdentityStore<TExtended = Record<string, never>> implements WorkloadIdentityStore3<TExtended> {
+	private identities;
+	private clientIdIndex;
+	get(id: string): Promise<BaseWorkloadIdentity<TExtended> | undefined>;
+	lookup(identity: BaseWorkloadIdentity<TExtended>): Promise<BaseWorkloadIdentity<TExtended> | undefined>;
+	upsert(identity: BaseWorkloadIdentity<TExtended>): Promise<BaseWorkloadIdentity<TExtended>>;
+	delete(id: string): Promise<number>;
+	list(options?: ListOptions5): Promise<ListResult5<BaseWorkloadIdentity<TExtended>>>;
+}
+import { CachedWorkloadToken, WorkloadTokenStore as WorkloadTokenStore2 } from "@ionite/core";
+/**
+* In-memory workload token store implementation using Maps.
+*/
+declare class InMemoryWorkloadTokenStore<TExtended = object> implements WorkloadTokenStore2<TExtended> {
+	private tokens;
+	set(token: CachedWorkloadToken<TExtended>): Promise<void>;
+	get(workload_id: string): Promise<CachedWorkloadToken<TExtended> | null>;
+	delete(workload_id: string): Promise<void>;
+	isValid(workload_id: string): Promise<boolean>;
+	cleanup(): Promise<void>;
+}
+/**
+* Config object for ionite(source, config). Includes FrameworkConfig plus
+* server-only builder hints and lifecycle/routing (stripped before passing to module constructors).
+*/
+type IoniteConfig<C extends FrameworkConfigInput = FrameworkConfigInput> = C & {
+	basePath?: string;
+	stores?: FrameworkStores2;
+	beforeChange?: ConfigChangeCallback;
+	afterChange?: (ion: Ionite5, config: RemoteConfig2, frameworkConfig: ModifiableFrameworkConfig, oldConfig: RemoteConfig2 | undefined) => void;
+	routing?: RoutingOptions2;
+	configRetry?: RemoteConfigRetryOptions;
+	onConfigLoadError?: RemoteConfigRetryHook;
+};
+declare function ionite<const C extends FrameworkConfigInput = FrameworkConfigInput>(source: ConfigSource9, config: IoniteConfig<C> | FrameworkConfigInput): Ionite5;
+export { workloadHandler, workload, withSetCookies, withDefaultExternalId, verifyUser, vaultSocketDiagnostics, vaultConfig, validateWorkloadToken, tenantManager, tenantConfigSource, subscribeSecretPathWithHttpPolling, sso, setVaultWebSocketCommandTimeout, sendTenantWebhook, secretConfigSource, sameOriginRedirectRules, routeRequest, rewriteRequestPath, rewriteRequestForTenantPath, rewriteRequestForDefaultTenantUi, rewriteRequestForDefaultTenantApi, revokeWorkloadToken, resolveTenantFromRequest, resolveRedirect, resolveDefaultRoute, resolveCapturedRedirect, resolveAfterRedirect, registerConfigLocatorAssert, reconcileSubjectAccess, openbaoVault, listSsoClientIdsFromCookies, listGenerator, lfvVault, isVaultConfigWaitingForSecretError, isVaultConfigInvalidPayloadError, isRedirectAllowed, ionite, initiateLogin, iamDeltaIdMapKey, iam, hasScope, hasRole2 as hasRole, hasPermission2 as hasPermission, hasGroup2 as hasGroup, hasAnyScope, hasAny2 as hasAny, hasAllScope, hasAll2 as hasAll, has, getWorkloadToken, getWorkload, getUser, getCustomer, generateULID, gcpConfig, expandRoot, escapeScimFilterValue, envConfig, enforceEndpointAuthz, discoverSessions, discoverSessionRecords, deriveIonUrls, defaultRedirectPolicies, createTenantIonResolver, createTenantIonHandler, createSessionReadCache, createManagedIamDelta, configSourceFromLocator, configSourceFromEnvValues, configLocatorFromEnvValues, collectReferencedDefinitions, closeAllVaultSockets, ciam, captureRedirect, callback, blockDangerousUrls, azureConfig, awsConfig, allowSameOrigin, allowRelativePaths, allowOrigins, allowHosts, VerifyUserOptions, VaultSubscribeNotSupportedError, VaultConfigWaitingForSecretError, VaultConfigSourceOptions, VaultConfigInvalidPayloadError, VAULT_MIN_POLLING_TTL_MS, UrlMap, UpdateTenantRequest2 as UpdateTenantRequest, TenantWebhookPayload, TenantValidators2 as TenantValidators, TenantStatus, TenantResponse, TenantResolutionContext, TenantManagerOptions, TenantManager, TenantIonUrls, TenantIonResolver, SubjectType3 as SubjectType, SubjectScope, SessionResponse, SessionReadCacheOptions, SessionDiscoveryOptions, ScimOutboundCreate, ScimOutboundClientOptions, ScimOutboundClient, ResolveTenantFromRequestOptions, ReferencedDefinitions, RedirectVerdict, RedirectRuleContext, RedirectRule, RedirectResult, RedirectPolicy, RedirectContext, ReconcileStores, OtelSignalConfig, OtelProviderType, OtelOAuthClientCredentialsConfig, OtelMetricsSignalConfig, OtelLogRecord, OtelLogLevel, OtelLevels, OtelConfig, Otel, OpenbaoVaultOptions, LfvSecretsSource, IoniteErrorOptions, IoniteError, IoniteConfig, InMemoryWorkloadTokenStore, InMemoryWorkloadIdentityStore, InMemoryUserStore, InMemoryTenantStore, InMemorySessionStore, InMemoryResourceStore, InMemoryMagicLinkStore, InMemoryIamDeltaIdMapStore, InMemoryCustomerStore, InMemoryAccessIndex, InMemoryAccessCatalogStore, InMemoryAccessAssignmentStore, IamDeltaDeps, IamDeltaConfig, ION_CAPABILITY_CATALOG, HttpPollingHooks, GcpConfigSourceOptions, FrameworkStores3 as FrameworkStores, FrameworkOtelConfig, EnvironmentType, EnvConfigOptions, CreateTenantRequest2 as CreateTenantRequest, CreateTenantIonResolverOptions, CreateTenantIonHandlerOptions, ConfigLocatorContext, ConfigLocatorAssert, CatalogView, CatalogAdjacencyCache, CapabilityKey2 as CapabilityKey, CapabilityDescriptor, BeforeLogoutHook, BeforeLogoutContext, BeforeLoginHook, BeforeLoginContext, AzureConfigSourceOptions, AwsConfigSourceOptions, AfterLogoutHook, AfterLogoutContext, AfterLoginHook, AfterLoginContext, AccessCheckResult, AccessCheckReason };