@ionite/server 0.0.23-beta.20260812.6 → 0.0.23-beta.20260820.2

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { ConfigChangeCallback, ConfigSource as ConfigSource9, FrameworkConfigInput, FrameworkStores as FrameworkStores2, Ionite as Ionite5, ModifiableFrameworkConfig, RemoteConfig as RemoteConfig2, RemoteConfigRetryHook, RemoteConfigRetryOptions, RoutingOptions as RoutingOptions2 } from "@ionite/core";
-import { ApplicationValidators, BaseTenant, CreateTenantRequest, Ionite, TenantStore, TenantValidators, UpdateTenantRequest, Workload } from "@ionite/core";
+import { ConfigChangeCallback, ConfigSource as ConfigSource9, FrameworkConfigInput, FrameworkStores as FrameworkStores2, Ionite as Ionite6, ModifiableFrameworkConfig, RemoteConfig as RemoteConfig3, RemoteConfigRetryHook, RemoteConfigRetryOptions, RoutingOptions as RoutingOptions2 } from "@ionite/core";
+import { ApplicationValidators, BaseTenant as BaseTenant2, CreateTenantRequest, Ionite as Ionite2, TenantStore as TenantStore2, TenantValidators, UpdateTenantRequest, Workload } from "@ionite/core";
 import { CapabilityEndpointUrls } from "@ionite/core";
 /**
 * Deterministic set of ionite endpoint paths derived from a single `basePath`.
@@ -13,14 +13,47 @@ type UrlMap = CapabilityEndpointUrls;
 * by module construction, the router, the readiness endpoint, and tenant-manager responses.
 */
 declare function deriveIonUrls(basePath: string): UrlMap;
+import { BaseTenant, ConfigLocator, Ionite, LfvCallbackKind, Logger, RemoteConfig as RemoteConfig2, Secret, SecretsSource, TenantStore } from "@ionite/core";
+type TenantMirrorHooks<TTenant extends BaseTenant = BaseTenant> = {
+	onRemoteConfigChange?(tenant: TTenant, config: RemoteConfig2, secret: Secret<Record<string, unknown>>): void | Promise<void>;
+	onRemoteConfigRevoke?(tenant: TTenant): void | Promise<void>;
+};
+type TenantMirrorOptions<TTenant extends BaseTenant = BaseTenant> = {
+	store: TenantStore<TTenant>;
+	/** App-owned durable mirror destination. */
+	to: SecretsSource;
+	/** Resolve a unique destination path for each tenant. */
+	path: (tenant: TTenant) => string;
+	hooks?: TenantMirrorHooks<TTenant>;
+	/** Overrides the root ion logger for tenant mirror operations. */
+	logger?: Logger;
+	/** Optional source factory for non-LFV locators. */
+	sourceFromLocator?: (locator: ConfigLocator, tenant: TTenant) => SecretsSource;
+};
+type TenantMirror = {
+	/**
+	* Blocks until the first mirror for this tenant lands. With no timeout it waits indefinitely;
+	* pass `timeout > 0` to reject after that many milliseconds.
+	*/
+	ensure(tenantId: string, timeout?: number): Promise<void>;
+	handleCallback(tenantId: string, kind: LfvCallbackKind, request: Request): Promise<Response>;
+	purge(tenantId: string): Promise<void>;
+	close(): Promise<void>;
+};
+/**
+* Maintains per-tenant RemoteConfig mirrors. Tenant records own the upstream locators; app code owns
+* the destination source and path mapping.
+*/
+declare function tenantMirror<TTenant extends BaseTenant = BaseTenant>(ion: Ionite, options: TenantMirrorOptions<TTenant>): TenantMirror;
 type TenantManagerOptions<
 	TCreateTenantRequest extends CreateTenantRequest = CreateTenantRequest,
 	TUpdateTenantRequest extends UpdateTenantRequest = UpdateTenantRequest,
-	TTenant extends BaseTenant = BaseTenant
+	TTenant extends BaseTenant2 = BaseTenant2
 > = {
 	validators: ApplicationValidators<TenantValidators<TCreateTenantRequest, TUpdateTenantRequest>>;
 	basePath: string;
-	store: TenantStore<TTenant>;
+	store: TenantStore2<TTenant>;
+	mirror?: Pick<TenantMirror, "purge">;
 	workloadAuth?: Workload;
 	/**
 	* Resolve the ionite `basePath` for a given tenant (e.g. `/api/${tenant.id}/ionite`).
@@ -35,20 +68,20 @@ type TenantIonUrls = {
 	callbackUrl: string;
 	ionUrls: UrlMap;
 };
-type TenantManager<TTenant extends BaseTenant = BaseTenant> = {
+type TenantManager<TTenant extends BaseTenant2 = BaseTenant2> = {
 	handler(request: Request): Promise<Response>;
 	getTenant(id: string): Promise<TTenant | undefined>;
 };
 declare function tenantManager<
 	TCreateTenantRequest extends CreateTenantRequest = CreateTenantRequest,
 	TUpdateTenantRequest extends UpdateTenantRequest = UpdateTenantRequest,
-	TTenant extends BaseTenant = BaseTenant
->(ion: Ionite, options: TenantManagerOptions<TCreateTenantRequest, TUpdateTenantRequest, TTenant>): TenantManager<TTenant>;
+	TTenant extends BaseTenant2 = BaseTenant2
+>(ion: Ionite2, options: TenantManagerOptions<TCreateTenantRequest, TUpdateTenantRequest, TTenant>): TenantManager<TTenant>;
 import { CapabilityKey as CapabilityKey2 } from "@ionite/core";
 export * from "@ionite/core";
 import { AccessCheckReason, AccessCheckResult, CreateTenantRequest as CreateTenantRequest2, EnvironmentType, FrameworkOtelConfig, FrameworkStores as FrameworkStores3, generateULID, IoniteError, IoniteErrorOptions, listGenerator, Otel, OtelConfig, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProviderType, OtelSignalConfig, SubjectScope, SubjectType as SubjectType3, TenantResponse, TenantStatus, TenantValidators as TenantValidators2, TenantWebhookPayload, UpdateTenantRequest as UpdateTenantRequest2 } from "@ionite/core";
 import { AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CatalogView, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions } from "@ionite/core/server";
-import { allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, blockDangerousUrls, CatalogAdjacencyCache, callback, captureRedirect, ciam, collectReferencedDefinitions, defaultRedirectPolicies, discoverSessionRecords, discoverSessions, expandRoot, getCustomer, getUser, has, hasAll as hasAll2, hasAllScope, hasAny as hasAny2, hasAnyScope, hasGroup as hasGroup2, hasPermission as hasPermission2, hasRole as hasRole2, hasScope, InMemoryTenantStore, iam, initiateLogin, isRedirectAllowed, listSsoClientIdsFromCookies, reconcileSubjectAccess, resolveAfterRedirect, resolveCapturedRedirect, resolveRedirect, SessionDiscoveryOptions, SessionResponse, sameOriginRedirectRules, sendTenantWebhook, sso, VerifyUserOptions, verifyUser, withDefaultExternalId, withSetCookies } from "@ionite/core/server";
+import { allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, blockDangerousUrls, CatalogAdjacencyCache, callback, captureRedirect, ciam, collectReferencedDefinitions, defaultRedirectPolicies, discoverSessionRecords, discoverSessions, expandRoot, getCustomer, getUser, has, hasAll as hasAll2, hasAllScope, hasAny as hasAny2, hasAnyScope, hasGroup as hasGroup2, hasPermission as hasPermission2, hasRole as hasRole2, hasScope, InMemoryTenantStore, iam, initiateLogin, isRedirectAllowed, listSsoClientIdsFromCookies, reconcileSubjectAccess, resolveAfterRedirect, resolveCapturedRedirect, resolveRedirect, SessionDiscoveryOptions, SessionResponse, sameOriginRedirectRules, sendTenantWebhook, sso, VerifyUserOptions, verifyUser, withSetCookies } from "@ionite/core/server";
 import { AccessAssignmentStore as AccessAssignmentStore2, AccessChange, ListOptions, ListResult, OaaAccessTargetType, SubjectType } from "@ionite/core";
 /**
 * In-memory store of granted access **roots** (source of truth). Roots are keyed by their
@@ -90,23 +123,14 @@ declare class InMemoryAccessCatalogStore implements AccessCatalogStore2 {
 * Writable, in-memory {@link ResourceProvider} for zero-DB quickstarts, dev tools, and validation.
 * Real applications should implement `ResourceProvider` directly over their own database/ORM (the
 * resources already live there) — this store exists so an app with no database yet can still model
-* resources and resource-derived entitlements without one.
+* resources without one.
 *
 * `set`/`delete` emit the `changed` signal the SDK subscribes to (adjacency-cache invalidation,
-* targeted reconcile, incremental OAA projection). Provide `deriveEntitlements` (plus its reverse
-* resolver `resolveEntitlement`) to expose resource-derived entitlement Groups through this provider.
+* targeted reconcile, incremental OAA projection).
 */
 declare class InMemoryResourceStore implements ResourceProvider2 {
 	private readonly items;
 	private readonly listeners;
-	constructor(options?: {
-		/** Pure derivation of a resource's requestable entitlement Groups (see {@link ResourceProvider.entitlements}). */
-		deriveEntitlements?: (resource: Resource) => Group[];
-		/** Reverse resolution of a resource-derived entitlement id (see {@link ResourceProvider.entitlement}). */
-		resolveEntitlement?: (id: string, get: (resourceId: string) => Resource | undefined) => Group | undefined;
-	});
-	entitlements?: (resource: Resource) => Group[];
-	entitlement?: (id: string) => Promise<Group | undefined>;
 	get(id: string): Promise<Resource | undefined>;
 	list(options?: ListOptions2): Promise<ListResult2<Resource>>;
 	children(id: string): Promise<Resource[]>;
@@ -163,9 +187,9 @@ declare class InMemoryAccessIndex implements AccessIndex2 {
 	private dropEdge;
 	private removeFromSet;
 }
-import { AwsSecretsConfig, ConfigSource, SecretsSource } from "@ionite/core";
+import { AwsSecretsConfig, ConfigSource, SecretsSource as SecretsSource2 } from "@ionite/core";
 type AwsConfigSourceOptions = Omit<AwsSecretsConfig, "type"> & {
-	vault?: SecretsSource;
+	vault?: SecretsSource2;
 	ttl?: number;
 };
 /**
@@ -176,9 +200,9 @@ type AwsConfigSourceOptions = Omit<AwsSecretsConfig, "type"> & {
 * then throwing at first config access.
 */
 declare function awsConfig(_config: AwsConfigSourceOptions): ConfigSource;
-import { AzureSecretsConfig, ConfigSource as ConfigSource2, SecretsSource as SecretsSource2 } from "@ionite/core";
+import { AzureSecretsConfig, ConfigSource as ConfigSource2, SecretsSource as SecretsSource3 } from "@ionite/core";
 type AzureConfigSourceOptions = Omit<AzureSecretsConfig, "type"> & {
-	vault?: SecretsSource2;
+	vault?: SecretsSource3;
 	path?: string;
 };
 /**
@@ -187,22 +211,51 @@ type AzureConfigSourceOptions = Omit<AzureSecretsConfig, "type"> & {
 * If ttl is set, the vault is polled every ttl milliseconds (minimum 10 minutes) and onConfig is called when config changes.
 */
 declare function azureConfig(config: AzureConfigSourceOptions): ConfigSource2;
-import { ConfigLocator, ConfigSource as ConfigSource3, ConfigSourceEnv, ConfigSourceType } from "@ionite/core";
+import { ConfigLocator as ConfigLocator2, ConfigSource as ConfigSource3, SecretsSource as SecretsSource4 } from "@ionite/core";
+/**
+* Materialize a runtime {@link ConfigSource} from a full, self-contained {@link ConfigLocator}. This
+* is the ROOT/bootstrap path (env vars via `envConfig()`, or a bootstrap secret via
+* `secretConfigSource()`): the locator carries the connection details/credentials needed to build a
+* fresh source. To reuse a source already connected on an Ionite instance, see
+* {@link configFromSource}.
+*/
+declare function configSourceFromLocator(locator: ConfigLocator2): ConfigSource3;
+/** Optional knobs for {@link configFromSource}. */
+type ConfigFromSourceOptions = {
+	/** Polling interval fallback when the source has no native subscription support. */
+	ttl?: number;
+};
+/**
+* Materialize a ConfigSource for the RemoteConfig document at `path`, read through an
+* already-connected {@link SecretsSource} — typically the root default client (`ion.secret`) or a
+* named source (`ion.secrets.getSecretsSource('name')`), which may point at a completely different
+* vault than the one serving the root config. Unlike {@link configSourceFromLocator}, this carries
+* no connection details or credentials, and every caller shares the source's live client (one
+* vault socket for N tenants). The document at `path` is the RemoteConfig itself; for a path that
+* stores a `ConfigLocator` pointer instead, use `secretConfigSource`.
+*
+* Canonical tenant-runtime constructor: direct/internal apps map the stored vault locator's
+* `vaultPath`/`vaultTtl`; OEM mirror apps pass their app-derived mirror path. INVARIANT: each tenant
+* MUST resolve to a distinct backing path — two tenants sharing a path would cross-load each
+* other's RemoteConfig.
+*/
+declare function configFromSource(source: SecretsSource4, path: string, options?: ConfigFromSourceOptions): ConfigSource3;
+import { ConfigLocator as ConfigLocator3, ConfigSource as ConfigSource4, ConfigSourceEnv, ConfigSourceType } from "@ionite/core";
 type EnvConfigOptions = {
 	/** Override config source type (default: ION_CONFIG_TYPE from env). */
 	type?: ConfigSourceType;
 };
-declare function configLocatorFromEnvValues(env: Partial<ConfigSourceEnv>, options?: EnvConfigOptions): ConfigLocator;
+declare function configLocatorFromEnvValues(env: Partial<ConfigSourceEnv>, options?: EnvConfigOptions): ConfigLocator3;
 /**
 * Creates a ConfigSource from environment variables.
 * Reads ION_CONFIG_TYPE to choose the source.
 * For each supported type, it merges the options with available environment variables.
 */
-declare function configSourceFromEnvValues(env: Partial<ConfigSourceEnv>, options?: EnvConfigOptions): ConfigSource3;
-declare function envConfig(options?: EnvConfigOptions): ConfigSource3;
-import { ConfigSource as ConfigSource4, GcpSecretsConfig, SecretsSource as SecretsSource3 } from "@ionite/core";
+declare function configSourceFromEnvValues(env: Partial<ConfigSourceEnv>, options?: EnvConfigOptions): ConfigSource4;
+declare function envConfig(options?: EnvConfigOptions): ConfigSource4;
+import { ConfigSource as ConfigSource5, GcpSecretsConfig, SecretsSource as SecretsSource5 } from "@ionite/core";
 type GcpConfigSourceOptions = Omit<GcpSecretsConfig, "type"> & {
-	vault?: SecretsSource3;
+	vault?: SecretsSource5;
 	ttl?: number;
 };
 /**
@@ -212,8 +265,53 @@ type GcpConfigSourceOptions = Omit<GcpSecretsConfig, "type"> & {
 * startup) so a `type: 'gcp'` locator fails fast with a clear error rather than type-checking and
 * then throwing at first config access.
 */
-declare function gcpConfig(_config: GcpConfigSourceOptions): ConfigSource4;
-import { ConfigSource as ConfigSource5, SecretsSource as SecretsSource4 } from "@ionite/core";
+declare function gcpConfig(_config: GcpConfigSourceOptions): ConfigSource5;
+import { ConfigLocator as ConfigLocator4, ConfigSource as ConfigSource6, LfvCallbackKind as LfvCallbackKind2, Logger as Logger3, SecretsSource as SecretsSource7 } from "@ionite/core";
+import { Logger as Logger2, Secret as Secret2, SecretEvent, SecretsSource as SecretsSource6, SecretsSubscriptionOptions } from "@ionite/core";
+type MirrorSecretsOptions = {
+	from: SecretsSource6;
+	to: SecretsSource6;
+	paths: readonly string[];
+	mapPath: (path: string) => string;
+	/** Optional admission check. Rejected values are ignored without changing the current mirror. */
+	accept?: (secret: Secret2<Record<string, unknown>>, sourcePath: string) => boolean;
+	subscription?: SecretsSubscriptionOptions;
+	logger?: Logger2;
+	/** Receives every source lifecycle event after the mirror schedules its required state change. */
+	onEvent?: (event: SecretEvent) => void;
+};
+type SecretsMirror = {
+	isReady(): boolean;
+	ready(timeout?: number): Promise<void>;
+	isAvailable(): boolean;
+	/** Delete all configured target values. Explicit tenant-offboarding action. */
+	purge(): Promise<void>;
+	close(): Promise<void>;
+};
+/**
+* Mirrors explicit secret paths from a source into a receiver-owned vault. Designed for OEM
+* topologies: customer values arrive over LFV, then are durably re-stored under tenant-isolated
+* paths before the receiver fans them out internally.
+*/
+declare function mirrorSecrets(options: MirrorSecretsOptions): SecretsMirror;
+type MirroredConfigOptions = {
+	from: ConfigLocator4 | SecretsSource7;
+	fromPath?: string;
+	to: ConfigLocator4 | SecretsSource7;
+	path: string;
+	logger?: Logger3;
+	ttl?: number;
+};
+type MirroredConfigSource = ConfigSource6 & {
+	handleCallback(kind: LfvCallbackKind2, request: Request): Promise<Response>;
+	mirror: SecretsMirror;
+};
+/**
+* Mirrors one authoritative RemoteConfig into an App-owned secrets source, then exposes a
+* ConfigSource which reads only that durable mirror.
+*/
+declare function mirroredConfig(options: MirroredConfigOptions): MirroredConfigSource;
+import { ConfigSource as ConfigSource7, SecretsSource as SecretsSource8 } from "@ionite/core";
 /**
 * Creates a ConfigSource from a SecretsSource path that stores a ConfigLocator.
 * The returned source rebinds subscriptions when the bootstrap secret changes.
@@ -224,10 +322,10 @@ import { ConfigSource as ConfigSource5, SecretsSource as SecretsSource4 } from "
 * bootstrap actually changes, the superseded inner source is disposed (its `secret.close()` is
 * invoked) before the new one is built, so config churn cannot leak duplicate connections.
 */
-declare function secretConfigSource(source: SecretsSource4, path: string): ConfigSource5;
-import { ConfigSource as ConfigSource6, SecretsSource as SecretsSource5, VaultSecretsConfig } from "@ionite/core";
+declare function secretConfigSource(source: SecretsSource8, path: string): ConfigSource7;
+import { ConfigSource as ConfigSource8, SecretsSource as SecretsSource9, VaultSecretsConfig } from "@ionite/core";
 type VaultConfigSourceOptions = Omit<VaultSecretsConfig, "type"> & {
-	vault?: SecretsSource5;
+	vault?: SecretsSource9;
 	path?: string;
 };
 declare class VaultConfigWaitingForSecretError extends Error {
@@ -256,7 +354,7 @@ declare function isVaultConfigInvalidPayloadError(error: unknown): error is Vaul
 * If ttl is set, the vault will be polled every ttl milliseconds (minimum 10 minutes) and onConfig will be called when the config changes.
 * When a custom vault client is provided, ttl is still honored for config subscription polling if the client does not support native subscribe().
 */
-declare function vaultConfig(config: VaultConfigSourceOptions): ConfigSource6;
+declare function vaultConfig(config: VaultConfigSourceOptions): ConfigSource8;
 import { BaseCustomer, CustomerStore, ListOptions as ListOptions3, ListResult as ListResult3 } from "@ionite/core";
 /**
 * In-memory customer store implementation using Maps.
@@ -272,7 +370,7 @@ declare class InMemoryCustomerStore<TExtended = Record<string, never>> implement
 	delete(id: string): Promise<number>;
 	list(options?: ListOptions3): Promise<ListResult3<BaseCustomer<TExtended>>>;
 }
-import { AccessCatalogStore as AccessCatalogStore3, IamDeltaEmitter, IamDeltaIdMapStore as IamDeltaIdMapStore2, IamDeltaMode, Logger, ResourceProvider as ResourceProvider3, UserStore, Workload as Workload2 } from "@ionite/core";
+import { AccessAssignmentStore as AccessAssignmentStore3, AccessCatalogStore as AccessCatalogStore3, BaseUser as BaseUser2, CodeCatalog as CodeCatalog2, IamDeltaEmitter, IamDeltaMode, Logger as Logger4, ScimUser, UserStore, Workload as Workload2, WorkloadIdentityStore as WorkloadIdentityStore2 } from "@ionite/core";
 type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
 /** RemoteConfig-derived destination descriptor for IAM delta egress. */
 type IamDeltaConfig = {
@@ -281,18 +379,18 @@ type IamDeltaConfig = {
 	url?: string;
 	/** Outgoing workload client name used to authenticate pushes (`IAMConfig.deltaAudience`). */
 	audience?: string;
-	/** Tenant scope for the mapping cache. */
-	tenantId?: string;
 };
 /** Runtime capabilities the emitter binds to (resolved from the merged config/stores in buildES). */
 type IamDeltaDeps = {
 	workload?: Workload2;
+	workloadIdentityStore?: WorkloadIdentityStore2;
 	userStore?: UserStore;
+	accessStore?: AccessAssignmentStore3;
 	catalogStore?: AccessCatalogStore3;
-	/** Read-through provider for derived-entitlement resolution (externalId lookup on delta egress). */
-	resources?: ResourceProvider3;
-	/** `externalId -> provider id` mapping cache for outbound SCIM (defaults to in-memory). */
-	idMapStore?: IamDeltaIdMapStore2;
+	/** Normalized code templates merged over persisted rows for outbound definitions. */
+	codeCatalog?: CodeCatalog2;
+	/** Optional app mapper shared with the inbound IAM Users read surface. */
+	mapUserToScim?: (stored: BaseUser2) => ScimUser | Promise<ScimUser>;
 	/** Injectable fetch (defaults to global fetch); enables testing the patch path in-process. */
 	fetchImpl?: FetchLike;
 };
@@ -301,32 +399,15 @@ type IamDeltaDeps = {
 * {@link IamDeltaEmitter} whose readiness promise is stable across RemoteConfig applies;
 * `update(config, deps)` reconfigures the destination/capabilities in place.
 *
-* `'patch'` emits externalId-only outbound SCIM into the IAM tool at the access-mutation
-* chokepoint (needs `url` + workload + an `idMapStore`, which defaults to in-memory). Every push is
+* `'patch'` emits outbound SCIM into the IAM tool at the access-mutation
+* chokepoint. Destination receipts are persisted directly on UserStore/AccessCatalogStore rows. Every push is
 * authenticated with the outgoing workload client, which the destination treats as the verified
 * origin. See the README "IAM delta egress" section.
 */
-declare function createManagedIamDelta(log: Logger): {
+declare function createManagedIamDelta(log: Logger4): {
 	update(config: IamDeltaConfig, deps: IamDeltaDeps): IamDeltaEmitter;
+	handle(): IamDeltaEmitter;
 };
-import { IamDeltaIdMapKey, IamDeltaIdMapStore as IamDeltaIdMapStore3 } from "@ionite/core";
-/**
-* Stable string key for an {@link IamDeltaIdMapKey}. Scoped by tenant + destination so the same
-* `externalId` can map to different provider ids across IAM tools and tenants. Shared by the
-* in-memory and Redis implementations to keep keying identical.
-*/
-declare function iamDeltaIdMapKey(key: IamDeltaIdMapKey): string;
-/**
-* In-memory {@link IamDeltaIdMapStore}. Suitable for single-process apps and tests. Production
-* deployments should use a durable implementation (e.g. `RedisIamDeltaIdMapStore` or a SQL-backed
-* store) so the externalId -> provider-id cache survives restarts and is shared across instances.
-*/
-declare class InMemoryIamDeltaIdMapStore implements IamDeltaIdMapStore3 {
-	private readonly map;
-	get(key: IamDeltaIdMapKey): Promise<string | undefined>;
-	set(key: IamDeltaIdMapKey, providerId: string): Promise<void>;
-	delete(key: IamDeltaIdMapKey): Promise<void>;
-}
 import { CapabilityKey, ModuleName } from "@ionite/core";
 /**
 * Version of the stable capability vocabulary emitted by capabilitiez and used by ECV result IDs.
@@ -419,7 +500,7 @@ declare class InMemoryMagicLinkStore<TExtended = Record<string, never>> implemen
 	getAndDelete(token: string): Promise<MagicLink<TExtended> | null>;
 	delete(token: string): Promise<void>;
 }
-import { Ionite as Ionite2, ResolvedRoute, RoutingOptions } from "@ionite/core";
+import { Ionite as Ionite3, ResolvedRoute, RoutingOptions } from "@ionite/core";
 /**
 * Deny-by-default authorization gate for a resolved SDK route. Returns the 401/403 `Response` to
 * short-circuit with when the caller is not authorized, or `undefined` to proceed. Enforcement reuses
@@ -427,23 +508,23 @@ import { Ionite as Ionite2, ResolvedRoute, RoutingOptions } from "@ionite/core";
 * `RemoteConfig.authz.scopesAsEntitlements` is enabled) satisfies the gate; the `response()` already
 * logs the denial server-side without leaking the missing permission to the caller.
 */
-declare function enforceEndpointAuthz(request: Request, ion: Ionite2, required: NonNullable<ResolvedRoute["requiredPermission"]>): Promise<Response | undefined>;
+declare function enforceEndpointAuthz(request: Request, ion: Ionite3, required: NonNullable<ResolvedRoute["requiredPermission"]>): Promise<Response | undefined>;
 /**
 * Resolve the default route for a request using the deterministic, basePath-derived endpoint paths.
 * Endpoint URLs are no longer read from per-module config; they are computed from `basePath`.
 */
-declare function resolveDefaultRoute(request: Request, ion: Ionite2, urls: UrlMap, pathname?: string): ResolvedRoute | undefined;
-declare function routeRequest(request: Request, ion: Ionite2, routing?: RoutingOptions, urls?: UrlMap): Promise<Response>;
-import { IamDeltaIdMapStore as IamDeltaIdMapStore4, IamDeltaResourceType, Logger as Logger2 } from "@ionite/core";
+declare function resolveDefaultRoute(request: Request, ion: Ionite3, urls: UrlMap, pathname?: string): ResolvedRoute | undefined;
+declare function routeRequest(request: Request, ion: Ionite3, routing?: RoutingOptions, urls?: UrlMap): Promise<Response>;
+import { DestinationReference, GroupResource, IamDeltaResourceType, Logger as Logger5, ScimUser as ScimUser2 } from "@ionite/core";
 type FetchLike2 = (input: string, init?: RequestInit) => Promise<Response>;
 /**
-* Outcome of an outbound membership patch:
+* Outcome of an outbound IAM delta operation:
 * - `'pushed'`  — the destination accepted the mutation (2xx).
 * - `'skipped'` — the mutation was not attempted (subject/target not resolvable at the destination).
 * - `'error'`   — the destination rejected the mutation (non-2xx); the caller surfaces this as a
 *   degraded egress / reconcile error so it is never mistaken for success (§4.8/§19.1).
 */
-type ScimPatchOutcome = "pushed" | "skipped" | "error";
+type ScimOutboundOutcome = "pushed" | "skipped" | "error";
 /**
 * Result of resolving a destination provider id. A lookup/create HTTP failure is `'error'`, NOT
 * `'absent'`: conflating the two would let a transient 401/500 masquerade as "no such resource",
@@ -454,24 +535,43 @@ type ScimPatchOutcome = "pushed" | "skipped" | "error";
 */
 type ProviderIdResolution = {
 	found: string;
+	requestUrl?: string;
+	created?: true;
 } | "absent" | "error";
-/** Minimal create payload used only when the destination has no resource for an `externalId`. */
-type ScimOutboundCreate = {
-	/** SCIM `userName` (required for Users) or unused for Groups. */
-	userName?: string;
-	/** SCIM `displayName` (required for Groups; optional for Users). */
-	displayName?: string;
+/** Full IAM-visible SCIM body used for create-on-empty and entity upsert. */
+type ScimOutboundResource = ScimUser2 | GroupResource | (Record<string, unknown> & {
+	schemas?: string[];
+	id?: string;
+	externalId?: string;
+	meta?: unknown;
+});
+type ScimGroupMembershipPatch = {
+	groupExternalId: string;
+	userExternalId: string;
+	op: "add" | "remove";
+	groupCreate?: ScimOutboundResource;
+	userCreate?: ScimOutboundResource;
+	/** SCIM member kind; Workload is the ionite extension used by full IAM aggregation. */
+	memberType?: "User" | "Workload";
+};
+/**
+* Row-backed receipt callbacks supplied by IAM delta. Group receipts are persisted on
+* AccessCatalogStore rows and User receipts on UserStore rows; the outbound client has no separate
+* destination-qualified mapping store.
+*/
+type ScimOutboundReceiptCallbacks = {
+	read(resourceType: IamDeltaResourceType, externalId: string): Promise<DestinationReference | undefined>;
+	write(resourceType: IamDeltaResourceType, externalId: string, reference: DestinationReference): Promise<void>;
+	clear(resourceType: IamDeltaResourceType, externalId: string): Promise<void>;
 };
 type ScimOutboundClientOptions = {
 	/** Destination SCIM base URL (e.g. https://iam.example.com/scim/v2). */
 	baseUrl: string;
 	/** Mints a bearer token for the destination audience (workload outgoing client). */
 	getToken: () => Promise<string>;
-	/** Durable externalId -> provider-id cache (required). */
-	idMapStore: IamDeltaIdMapStore4;
-	/** Tenant scope for the mapping cache. */
-	tenantId?: string;
-	log: Logger2;
+	/** Reads and writes destination receipts on the source User/AccessCatalogStore rows. */
+	receipts: ScimOutboundReceiptCallbacks;
+	log: Logger5;
 	/** Injectable fetch (defaults to global fetch); enables testing against a mock SCIM server. */
 	fetchImpl?: FetchLike2;
 };
@@ -484,54 +584,72 @@ type ScimOutboundClientOptions = {
 */
 declare function escapeScimFilterValue(value: string): string;
 /**
-* externalId-only outbound SCIM client for IAM delta `'patch'` egress.
+* Outbound SCIM client for IAM delta `'patch'` egress. Its correlation argument is always written
+* to SCIM `externalId` (a catalog `id` for entitlements or a User `externalId` for users).
 *
 * Resolves a destination provider id for a resource STRICTLY by `externalId` (never email,
-* employeeId, samAccountName, or any custom attribute), backed by a durable mapping cache:
+* employeeId, samAccountName, or any custom attribute), backed by row receipts plus a process memo:
 *
 * - cache hit -> use the stored provider id
 * - miss -> `GET /{Resource}?filter=externalId eq "..."` -> store + use the returned id
-* - empty -> `POST /{Resource}` (create) -> store + use the returned id
+* - empty -> `POST /{Resource}` with the full body -> store + use the returned id
+* - known -> `PUT`, membership `PATCH`, or `DELETE`
 * - stale (404/410 on a subsequent write) -> drop the mapping, re-resolve, retry once
 *
-* Concurrent resolutions for the same `(destination, resourceType, externalId)` are single-flighted.
+* Concurrent resolutions for the same `(resourceType, externalId)` are single-flighted.
 */
 declare class ScimOutboundClient {
 	private readonly baseUrl;
 	private readonly getToken;
-	private readonly idMapStore;
-	private readonly tenantId?;
+	private readonly receipts;
 	private readonly log;
 	private readonly fetchImpl;
 	private readonly inflight;
+	private readonly memo;
+	private readonly writes;
 	constructor(options: ScimOutboundClientOptions);
 	private headers;
 	private inflightKey;
+	private receiptKey;
+	private serializeWrite;
 	/**
 	* Resolve (or create) the destination provider id for a resource identified by `externalId`.
 	* Returns a discriminated {@link ProviderIdResolution}: a confirmed id, `'absent'` (destination has
 	* no such resource and no `create` was supplied/succeeded), or `'error'` (lookup/create failed).
 	*/
-	resolveProviderId(resourceType: IamDeltaResourceType, externalId: string, create?: ScimOutboundCreate): Promise<ProviderIdResolution>;
+	resolveProviderId(resourceType: IamDeltaResourceType, externalId: string, create?: ScimOutboundResource): Promise<ProviderIdResolution>;
 	private resolveUncached;
 	private filterByExternalId;
 	private create;
+	private requestUrl;
+	private captureResponseReference;
 	/** Drop a possibly-stale mapping so the next resolve re-filters the destination. */
 	private invalidate;
+	/** Remove provider-owned fields and force the externalId-only correlation key into a write body. */
+	private writeBody;
+	/**
+	* Create or replace one full SCIM User/Group strictly by externalId. A stale cached provider id is
+	* invalidated and resolved once; a confirmed absence creates the resource with the full body.
+	*/
+	upsertResource(resourceType: IamDeltaResourceType, externalId: string, resource: ScimOutboundResource): Promise<ScimOutboundOutcome>;
+	private upsertResourceNow;
+	/**
+	* Delete one destination SCIM resource strictly by externalId. Confirmed absence and destination
+	* 404/410 are idempotent success; lookup/auth failures remain degraded egress.
+	*/
+	deleteResource(resourceType: IamDeltaResourceType, externalId: string): Promise<ScimOutboundOutcome>;
+	private deleteResourceNow;
 	/**
 	* Add or remove a user (by `userExternalId`) from a group (by `groupExternalId`) at the destination.
 	* Resolves both ids by externalId, issues a SCIM PATCH, and self-heals once on a stale group id.
 	*/
-	patchGroupMembership(args: {
-		groupExternalId: string;
-		userExternalId: string;
-		op: "add" | "remove";
-		groupCreate?: ScimOutboundCreate;
-		userCreate?: ScimOutboundCreate;
-	}): Promise<ScimPatchOutcome>;
+	patchGroupMembership(args: ScimGroupMembershipPatch): Promise<ScimOutboundOutcome>;
+	private patchGroupMembershipNow;
 }
-import { LfvCallbackTransport, SecretsSource as SecretsSource6, VaultLfvSecretsConfig } from "@ionite/core";
-type LfvSecretsSource = SecretsSource6 & {
+import { LfvCallbackTransport, Secret as Secret3, SecretsSource as SecretsSource10, VaultLfvSecretsConfig } from "@ionite/core";
+type LfvSecretsSource = SecretsSource10 & {
+	/** Register for callback-delivered values without issuing an initial read request. */
+	subscribePassive<T>(path: string, onChange: (fullSecret: Secret3<T>) => void): Promise<() => void>;
 	isDeliveryRequest(request: Request): boolean;
 	isEventsRequest(request: Request): boolean;
 	handleDelivery(request: Request): Promise<Response>;
@@ -545,33 +663,9 @@ type LfvSecretsSource = SecretsSource6 & {
 	/** Stable identity of this source's verify JWKS trust material (undefined when unconfigured). */
 	readonly trustId?: string;
 };
-declare function lfvVault(config: VaultLfvSecretsConfig, callbackTransport?: LfvCallbackTransport): LfvSecretsSource;
-import { Logger as Logger3, SecretEvent, SecretsSource as SecretsSource7, SecretsSubscriptionOptions } from "@ionite/core";
-type MirrorSecretsOptions = {
-	from: SecretsSource7;
-	to: SecretsSource7;
-	paths: readonly string[];
-	mapPath: (path: string) => string;
-	sourceId?: string;
-	subscription?: SecretsSubscriptionOptions;
-	logger?: Logger3;
-	/** Receives every source lifecycle event after the mirror schedules its required state change. */
-	onEvent?: (event: SecretEvent) => void;
-};
-type SecretsMirror = {
-	isReady(): boolean;
-	ready(timeout?: number): Promise<void>;
-	isAvailable(): boolean;
-	/** Delete all configured target values and provenance sidecars. Explicit tenant-offboarding action. */
-	purge(): Promise<void>;
-	close(): Promise<void>;
-};
-/**
-* Mirrors explicit secret paths from a source into a receiver-owned vault. Designed for OEM
-* topologies: customer values arrive over LFV, then are durably re-stored under tenant-isolated
-* paths before the receiver fans them out internally.
-*/
-declare function mirrorSecrets(options: MirrorSecretsOptions): SecretsMirror;
+declare function lfvVault(config: VaultLfvSecretsConfig, callbackTransport?: LfvCallbackTransport, options?: {
+	selfRedeemReads?: boolean;
+}): LfvSecretsSource;
 import { SessionStore } from "@ionite/core";
 /**
 * Options for {@link createSessionReadCache}. Values are the already-clamped internal (ms/count)
@@ -622,42 +716,7 @@ declare class InMemorySessionStore<TExtended = Record<string, never>> implements
 	update(sid: string, data: Partial<Session<TExtended>>): Promise<void>;
 	delete(sid: string): Promise<void>;
 }
-import { ConfigSource as ConfigSource8, ConfigSourceResolver as ConfigSourceResolver2, TenantConfigLocator as TenantConfigLocator2 } from "@ionite/core";
-import { ConfigLocator as ConfigLocator2, ConfigSource as ConfigSource7 } from "@ionite/core";
-/**
-* Materialize a runtime {@link ConfigSource} from a full, self-contained {@link ConfigLocator}. This
-* is the ROOT/bootstrap path (env vars via `envConfig()`, or a bootstrap secret via
-* `secretConfigSource()`): the locator carries the connection details/credentials needed to build a
-* fresh source. Tenants do NOT use this path — see {@link tenantConfigSourceFromResolver}.
-*/
-declare function configSourceFromLocator(locator: ConfigLocator2): ConfigSource7;
-/**
-* Context threaded into tenant config-source validation so a locator can be checked against the tenant
-* that owns it. INVARIANT: each tenant MUST resolve to a DISTINCT backing config path (e.g. a unique
-* vault path). Two tenants sharing a config path would cross-load each other's RemoteConfig.
-*/
-type ConfigLocatorContext = {
-	tenantId?: string;
-};
-/**
-* Optional validation hook invoked before a tenant's locator is materialized. Implementations should
-* throw when a locator is not valid (e.g. a shared/duplicate config path). The shared source client
-* may still be reused across tenants; only the resolved path must differ per tenant.
-*/
-type ConfigLocatorAssert = (input: {
-	locator: TenantConfigLocator2;
-}) => void;
-declare function registerConfigLocatorAssert(assert: ConfigLocatorAssert | undefined): void;
-/**
-* Materialize a tenant's {@link ConfigSource} from its {@link TenantConfigLocator}, resolving against
-* the root Ionite (`ion.secret` / `ion.secrets`). Pass the root `ion` (or any {@link ConfigSourceResolver}).
-*
-* This lives in `@ionite/server` (not core) so the materialization can reference the
-* server-only source implementations directly, with no import-time registration side effect — keeping
-* every published package truthfully `sideEffects: false`.
-*/
-declare function tenantConfigSource(locator: TenantConfigLocator2, ion: ConfigSourceResolver2): ConfigSource8;
-import { Ionite as Ionite3, TenantPathNamespace, TenantRoutingStrategy } from "@ionite/core";
+import { Ionite as Ionite4, TenantPathNamespace, TenantRoutingStrategy } from "@ionite/core";
 type MaybePromise<T> = Promise<T> | T;
 type TenantResolutionContext = {
 	namespace: "api" | "ui";
@@ -676,23 +735,23 @@ type ResolveTenantFromRequestOptions = {
 };
 type CreateTenantIonResolverOptions = {
 	store: {
-		getIon(id: string): Promise<Ionite3 | undefined>;
+		getIon(id: string): Promise<Ionite4 | undefined>;
 	};
 	getIon?: never;
 } | {
 	store?: never;
-	getIon: (id: string) => Promise<Ionite3 | null | undefined>;
+	getIon: (id: string) => Promise<Ionite4 | null | undefined>;
 };
-type TenantIonResolver = (id: string) => Promise<Ionite3 | undefined>;
+type TenantIonResolver = (id: string) => Promise<Ionite4 | undefined>;
 type CreateTenantIonHandlerOptions = {
-	getIon: (id: string, request: Request) => MaybePromise<Ionite3 | null | undefined>;
+	getIon: (id: string, request: Request) => MaybePromise<Ionite4 | null | undefined>;
 	resolveTenant?: (request: Request) => MaybePromise<{
 		id: string;
 		context?: TenantResolutionContext;
 	} | string | null | undefined>;
 	rewriteRequest?: (request: Request, details: {
 		id: string;
-		ion: Ionite3;
+		ion: Ionite4;
 		context?: TenantResolutionContext;
 	}) => MaybePromise<Request>;
 	onMissingTenant?: (request: Request) => MaybePromise<Response>;
@@ -708,20 +767,22 @@ declare function rewriteRequestForTenantPath(request: Request, id: string, sourc
 declare function rewriteRequestForDefaultTenantApi(request: Request, id: string, targetNamespace?: TenantPathNamespace): Request;
 declare function rewriteRequestForDefaultTenantUi(request: Request, id: string, targetNamespace?: TenantPathNamespace): Request;
 declare function createTenantIonHandler(options: CreateTenantIonHandlerOptions): (request: Request) => Promise<Response>;
-import { BaseUser as BaseUser2, ListOptions as ListOptions4, ListResult as ListResult4, UserStore as UserStore2 } from "@ionite/core";
+import { BaseUser as BaseUser3, ListOptions as ListOptions4, ListResult as ListResult4, UserStore as UserStore2 } from "@ionite/core";
 /**
 * In-memory user store implementation using Maps.
 */
 declare class InMemoryUserStore<TExtended = Record<string, never>> implements UserStore2<TExtended> {
 	private users;
 	private userNameIndex;
-	get(id: string): Promise<BaseUser2<TExtended> | undefined>;
-	lookup(user: BaseUser2<TExtended>): Promise<BaseUser2<TExtended> | undefined>;
-	upsert(user: BaseUser2<TExtended>): Promise<BaseUser2<TExtended>>;
+	private externalIdIndex;
+	get(id: string): Promise<BaseUser3<TExtended> | undefined>;
+	getByExternalId(externalId: string): Promise<BaseUser3<TExtended> | undefined>;
+	lookup(user: BaseUser3<TExtended>): Promise<BaseUser3<TExtended> | undefined>;
+	upsert(user: BaseUser3<TExtended>): Promise<BaseUser3<TExtended>>;
 	delete(sub: string): Promise<number>;
-	list(options?: ListOptions4): Promise<ListResult4<BaseUser2<TExtended>>>;
+	list(options?: ListOptions4): Promise<ListResult4<BaseUser3<TExtended>>>;
 }
-import { LfvCallbackTransport as LfvCallbackTransport2, Secret, SecretsSource as SecretsSource8, SecretsSubscriptionOptions as SecretsSubscriptionOptions2, VaultSecretsConfig as VaultSecretsConfig2 } from "@ionite/core";
+import { LfvCallbackTransport as LfvCallbackTransport2, Secret as Secret4, SecretsSource as SecretsSource11, SecretsSubscriptionOptions as SecretsSubscriptionOptions2, VaultSecretsConfig as VaultSecretsConfig2 } from "@ionite/core";
 declare class VaultSubscribeNotSupportedError extends Error {
 	readonly sourceType: string;
 	readonly path: string;
@@ -739,8 +800,8 @@ type HttpPollingHooks = {
 * a slow/failing upstream (no `setInterval` storm). The returned unsubscribe sets a `closed` flag and
 * cancels any pending timer/sleep, so teardown halts all activity immediately even mid-outage.
 */
-declare function subscribeSecretPathWithHttpPolling<T>(source: Pick<SecretsSource8, "getFullSecret">, path: string, onChange: (fullSecret: Secret<T>) => void, ttl: number, log?: VaultSecretsConfig2["log"], options?: SecretsSubscriptionOptions2, hooks?: HttpPollingHooks): Promise<() => void>;
-declare function vault(config: VaultSecretsConfig2, callbackTransport?: LfvCallbackTransport2): SecretsSource8;
+declare function subscribeSecretPathWithHttpPolling<T>(source: Pick<SecretsSource11, "getFullSecret">, path: string, onChange: (fullSecret: Secret4<T>) => void, ttl: number, log?: VaultSecretsConfig2["log"], options?: SecretsSubscriptionOptions2, hooks?: HttpPollingHooks): Promise<() => void>;
+declare function vault(config: VaultSecretsConfig2, callbackTransport?: LfvCallbackTransport2): SecretsSource11;
 /**
 * Override the per-command websocket timeout (ms). Primarily a diagnostic/test knob; production code
 * should leave the 30s default in place.
@@ -759,8 +820,8 @@ declare function closeAllVaultSockets(): void;
 *
 * Keep this synchronized with packages/server/package.json via publish.ts.
 */
-declare const ION_SDK_VERSION = "0.0.23-beta.20260812.6";
-import { Workload as CoreWorkload, FrameworkWorkloadConfig, Ionite as Ionite4, JWTAssertionClaims, Logger as Logger5, TokenValidationResult, TrustedIdp, WorkloadConfigMap, WorkloadGetToken, WorkloadIdentityStore as WorkloadIdentityStore2, WorkloadIncomingOutgoing, WorkloadTokenResponse, WorkloadTokenStore } from "@ionite/core";
+declare const ION_SDK_VERSION = "0.0.23-beta.20260820.2";
+import { Workload as CoreWorkload, FrameworkWorkloadConfig, Ionite as Ionite5, JWTAssertionClaims, Logger as Logger7, TokenValidationResult, TrustedIdp, WorkloadConfigMap, WorkloadGetToken, WorkloadIdentityStore as WorkloadIdentityStore3, WorkloadIncomingOutgoing, WorkloadTokenResponse, WorkloadTokenStore } from "@ionite/core";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 /**
 * Common fields shared across all workload authentication modes
@@ -817,7 +878,7 @@ type WorkloadConfigBase = {
 	* merges stored attributes (e.g. `displayName`, `active`, default `scopes`) onto the validated
 	* token identity. Authorization works without it; see {@link WorkloadIdentityStore}.
 	*/
-	workloadIdentityStore?: WorkloadIdentityStore2;
+	workloadIdentityStore?: WorkloadIdentityStore3;
 	/**
 	* Automatically refresh tokens before expiration
 	* @default true
@@ -985,8 +1046,8 @@ type Workload3 = {
 	config: WorkloadConfig;
 	beforeChange?: (listener: () => void) => () => void;
 	afterChange?: (listener: () => void) => () => void;
-	isReady?: () => boolean;
-	ready?: (timeout?: number) => Promise<void>;
+	isReady: () => boolean;
+	ready: (timeout?: number) => Promise<void>;
 	getToken: WorkloadGetToken;
 	refreshToken: (scope?: string) => Promise<WorkloadTokenResponse>;
 	generateJWTAssertion: (scope?: string) => Promise<string>;
@@ -996,38 +1057,38 @@ type Workload3 = {
 	parseJWT: (token: string) => Promise<JWTAssertionClaims>;
 	handler: (request: Request) => Promise<Response>;
 };
-declare function workload(validators: WorkloadValidators, log: Logger5, fromVault?: Partial<WorkloadConfig> | WorkloadConfigMap | WorkloadIncomingOutgoing, fromCode?: FrameworkWorkloadConfig, incomingTrustOverride?: TrustedIdp[]): Workload3 | undefined;
+declare function workload(validators: WorkloadValidators, log: Logger7, fromVault?: Partial<WorkloadConfig> | WorkloadConfigMap | WorkloadIncomingOutgoing, fromCode?: FrameworkWorkloadConfig, incomingTrustOverride?: TrustedIdp[]): Workload3 | undefined;
 /**
 * Get the workload identity from an incoming request.
 */
-declare function getWorkload(request: Request, ion: Ionite4): Promise<WorkloadIdentity | undefined>;
+declare function getWorkload(request: Request, ion: Ionite5): Promise<WorkloadIdentity | undefined>;
 /**
 * Get an access token for the configured workload identity.
 * Client is required and must be one of the configured outgoing workload clients.
 * Throws when no outgoing clients are configured on this Ionite instance.
 * Scope defaults to the config for the chosen client (e.g. workload.outgoing.<name>.scope); pass scope to override.
 */
-declare function getWorkloadToken(client: string, ion: Ionite4, scope?: string): Promise<string>;
+declare function getWorkloadToken(client: string, ion: Ionite5, scope?: string): Promise<string>;
 /**
 * Validate a workload token from an incoming request.
 * Accepts either an Ionite instance (uses its workload) or a Workload instance directly
 * (e.g. a server-only Workload used for tenant creation auth).
 */
-declare function validateWorkloadToken(request: Request, ionOrWorkload: Ionite4 | CoreWorkload): Promise<TokenValidationResult>;
+declare function validateWorkloadToken(request: Request, ionOrWorkload: Ionite5 | CoreWorkload): Promise<TokenValidationResult>;
 /**
 * Revoke a workload access token.
 */
-declare function revokeWorkloadToken(token: string, ion: Ionite4): Promise<void>;
+declare function revokeWorkloadToken(token: string, ion: Ionite5): Promise<void>;
 /**
 * Framework-agnostic request handler for the Workload module (token, validate, jwks, refresh routes).
 */
-declare function workloadHandler(request: Request, ion: Ionite4): Promise<Response>;
-import { BaseWorkloadIdentity, ListOptions as ListOptions5, ListResult as ListResult5, WorkloadIdentityStore as WorkloadIdentityStore3 } from "@ionite/core";
+declare function workloadHandler(request: Request, ion: Ionite5): Promise<Response>;
+import { BaseWorkloadIdentity, ListOptions as ListOptions5, ListResult as ListResult5, WorkloadIdentityStore as WorkloadIdentityStore4 } from "@ionite/core";
 /**
 * In-memory {@link WorkloadIdentityStore} implementation using Maps. Suitable for development and
 * testing; use a durable store (e.g. Redis/SQL) in production.
 */
-declare class InMemoryWorkloadIdentityStore<TExtended = Record<string, never>> implements WorkloadIdentityStore3<TExtended> {
+declare class InMemoryWorkloadIdentityStore<TExtended = Record<string, never>> implements WorkloadIdentityStore4<TExtended> {
 	private identities;
 	private clientIdIndex;
 	get(id: string): Promise<BaseWorkloadIdentity<TExtended> | undefined>;
@@ -1056,10 +1117,10 @@ type IoniteConfig<C extends FrameworkConfigInput = FrameworkConfigInput> = C & {
 	basePath?: string;
 	stores?: FrameworkStores2;
 	beforeChange?: ConfigChangeCallback;
-	afterChange?: (ion: Ionite5, config: RemoteConfig2, frameworkConfig: ModifiableFrameworkConfig, oldConfig: RemoteConfig2 | undefined) => void;
+	afterChange?: (ion: Ionite6, config: RemoteConfig3, frameworkConfig: ModifiableFrameworkConfig, oldConfig: RemoteConfig3 | undefined) => void;
 	routing?: RoutingOptions2;
 	configRetry?: RemoteConfigRetryOptions;
 	onConfigLoadError?: RemoteConfigRetryHook;
 };
-declare function ionite<const C extends FrameworkConfigInput = FrameworkConfigInput>(source: ConfigSource9, config: IoniteConfig<C> | FrameworkConfigInput): Ionite5;
-export { workloadHandler, workload, withSetCookies, withDefaultExternalId, verifyUser, vaultSocketDiagnostics, vaultConfig, vault, validateWorkloadToken, tenantManager, tenantConfigSource, subscribeSecretPathWithHttpPolling, sso, setVaultWebSocketCommandTimeout, sendTenantWebhook, secretConfigSource, sameOriginRedirectRules, routeRequest, rewriteRequestPath, rewriteRequestForTenantPath, rewriteRequestForDefaultTenantUi, rewriteRequestForDefaultTenantApi, revokeWorkloadToken, resolveTenantFromRequest, resolveRedirect, resolveDefaultRoute, resolveCapturedRedirect, resolveAfterRedirect, registerConfigLocatorAssert, reconcileSubjectAccess, mirrorSecrets, listSsoClientIdsFromCookies, listGenerator, lfvVault, isVaultConfigWaitingForSecretError, isVaultConfigInvalidPayloadError, isRedirectAllowed, ionite, initiateLogin, iamDeltaIdMapKey, iam, hasScope, hasRole2 as hasRole, hasPermission2 as hasPermission, hasGroup2 as hasGroup, hasAnyScope, hasAny2 as hasAny, hasAllScope, hasAll2 as hasAll, has, getWorkloadToken, getWorkload, getUser, getCustomer, generateULID, gcpConfig, expandRoot, escapeScimFilterValue, envConfig, enforceEndpointAuthz, discoverSessions, discoverSessionRecords, deriveIonUrls, defaultRedirectPolicies, createTenantIonResolver, createTenantIonHandler, createSessionReadCache, createManagedIamDelta, configSourceFromLocator, configSourceFromEnvValues, configLocatorFromEnvValues, collectReferencedDefinitions, closeAllVaultSockets, ciam, captureRedirect, callback, blockDangerousUrls, azureConfig, awsConfig, allowSameOrigin, allowRelativePaths, allowOrigins, allowHosts, VerifyUserOptions, VaultSubscribeNotSupportedError, VaultConfigWaitingForSecretError, VaultConfigSourceOptions, VaultConfigInvalidPayloadError, VAULT_MIN_POLLING_TTL_MS, UrlMap, UpdateTenantRequest2 as UpdateTenantRequest, TenantWebhookPayload, TenantValidators2 as TenantValidators, TenantStatus, TenantResponse, TenantResolutionContext, TenantManagerOptions, TenantManager, TenantIonUrls, TenantIonResolver, SubjectType3 as SubjectType, SubjectScope, SessionResponse, SessionReadCacheOptions, SessionDiscoveryOptions, SecretsMirror, ScimOutboundCreate, ScimOutboundClientOptions, ScimOutboundClient, ResolveTenantFromRequestOptions, ReferencedDefinitions, RedirectVerdict, RedirectRuleContext, RedirectRule, RedirectResult, RedirectPolicy, RedirectContext, ReconcileStores, OtelSignalConfig, OtelProviderType, OtelOAuthClientCredentialsConfig, OtelMetricsSignalConfig, OtelLogRecord, OtelLogLevel, OtelLevels, OtelConfig, Otel, MirrorSecretsOptions, LfvSecretsSource, IoniteErrorOptions, IoniteError, IoniteConfig, InMemoryWorkloadTokenStore, InMemoryWorkloadIdentityStore, InMemoryUserStore, InMemoryTenantStore, InMemorySessionStore, InMemoryResourceStore, InMemoryMagicLinkStore, InMemoryIamDeltaIdMapStore, InMemoryCustomerStore, InMemoryAccessIndex, InMemoryAccessCatalogStore, InMemoryAccessAssignmentStore, IamDeltaDeps, IamDeltaConfig, ION_SDK_VERSION, ION_CAPABILITY_CATALOG_VERSION, ION_CAPABILITY_CATALOG, HttpPollingHooks, GcpConfigSourceOptions, FrameworkStores3 as FrameworkStores, FrameworkOtelConfig, EnvironmentType, EnvConfigOptions, CreateTenantRequest2 as CreateTenantRequest, CreateTenantIonResolverOptions, CreateTenantIonHandlerOptions, ConfigLocatorContext, ConfigLocatorAssert, CatalogView, CatalogAdjacencyCache, CapabilityKey2 as CapabilityKey, CapabilityDescriptor, BeforeLogoutHook, BeforeLogoutContext, BeforeLoginHook, BeforeLoginContext, AzureConfigSourceOptions, AwsConfigSourceOptions, AfterLogoutHook, AfterLogoutContext, AfterLoginHook, AfterLoginContext, AccessCheckResult, AccessCheckReason };
+declare function ionite<const C extends FrameworkConfigInput = FrameworkConfigInput>(source: ConfigSource9, config: IoniteConfig<C> | FrameworkConfigInput): Ionite6;
+export { workloadHandler, workload, withSetCookies, verifyUser, vaultSocketDiagnostics, vaultConfig, vault, validateWorkloadToken, tenantMirror, tenantManager, subscribeSecretPathWithHttpPolling, sso, setVaultWebSocketCommandTimeout, sendTenantWebhook, secretConfigSource, sameOriginRedirectRules, routeRequest, rewriteRequestPath, rewriteRequestForTenantPath, rewriteRequestForDefaultTenantUi, rewriteRequestForDefaultTenantApi, revokeWorkloadToken, resolveTenantFromRequest, resolveRedirect, resolveDefaultRoute, resolveCapturedRedirect, resolveAfterRedirect, reconcileSubjectAccess, mirroredConfig, mirrorSecrets, listSsoClientIdsFromCookies, listGenerator, lfvVault, isVaultConfigWaitingForSecretError, isVaultConfigInvalidPayloadError, isRedirectAllowed, ionite, initiateLogin, iam, hasScope, hasRole2 as hasRole, hasPermission2 as hasPermission, hasGroup2 as hasGroup, hasAnyScope, hasAny2 as hasAny, hasAllScope, hasAll2 as hasAll, has, getWorkloadToken, getWorkload, getUser, getCustomer, generateULID, gcpConfig, expandRoot, escapeScimFilterValue, envConfig, enforceEndpointAuthz, discoverSessions, discoverSessionRecords, deriveIonUrls, defaultRedirectPolicies, createTenantIonResolver, createTenantIonHandler, createSessionReadCache, createManagedIamDelta, configSourceFromLocator, configSourceFromEnvValues, configLocatorFromEnvValues, configFromSource, collectReferencedDefinitions, closeAllVaultSockets, ciam, captureRedirect, callback, blockDangerousUrls, azureConfig, awsConfig, allowSameOrigin, allowRelativePaths, allowOrigins, allowHosts, VerifyUserOptions, VaultSubscribeNotSupportedError, VaultConfigWaitingForSecretError, VaultConfigSourceOptions, VaultConfigInvalidPayloadError, VAULT_MIN_POLLING_TTL_MS, UrlMap, UpdateTenantRequest2 as UpdateTenantRequest, TenantWebhookPayload, TenantValidators2 as TenantValidators, TenantStatus, TenantResponse, TenantResolutionContext, TenantMirrorOptions, TenantMirrorHooks, TenantMirror, TenantManagerOptions, TenantManager, TenantIonUrls, TenantIonResolver, SubjectType3 as SubjectType, SubjectScope, SessionResponse, SessionReadCacheOptions, SessionDiscoveryOptions, SecretsMirror, ScimOutboundResource, ScimOutboundReceiptCallbacks, ScimOutboundOutcome, ScimOutboundClientOptions, ScimOutboundClient, ResolveTenantFromRequestOptions, ReferencedDefinitions, RedirectVerdict, RedirectRuleContext, RedirectRule, RedirectResult, RedirectPolicy, RedirectContext, ReconcileStores, OtelSignalConfig, OtelProviderType, OtelOAuthClientCredentialsConfig, OtelMetricsSignalConfig, OtelLogRecord, OtelLogLevel, OtelLevels, OtelConfig, Otel, MirroredConfigSource, MirroredConfigOptions, MirrorSecretsOptions, LfvSecretsSource, IoniteErrorOptions, IoniteError, IoniteConfig, InMemoryWorkloadTokenStore, InMemoryWorkloadIdentityStore, InMemoryUserStore, InMemoryTenantStore, InMemorySessionStore, InMemoryResourceStore, InMemoryMagicLinkStore, InMemoryCustomerStore, InMemoryAccessIndex, InMemoryAccessCatalogStore, InMemoryAccessAssignmentStore, IamDeltaDeps, IamDeltaConfig, ION_SDK_VERSION, ION_CAPABILITY_CATALOG_VERSION, ION_CAPABILITY_CATALOG, HttpPollingHooks, GcpConfigSourceOptions, FrameworkStores3 as FrameworkStores, FrameworkOtelConfig, EnvironmentType, EnvConfigOptions, CreateTenantRequest2 as CreateTenantRequest, CreateTenantIonResolverOptions, CreateTenantIonHandlerOptions, ConfigFromSourceOptions, CatalogView, CatalogAdjacencyCache, CapabilityKey2 as CapabilityKey, CapabilityDescriptor, BeforeLogoutHook, BeforeLogoutContext, BeforeLoginHook, BeforeLoginContext, AzureConfigSourceOptions, AwsConfigSourceOptions, AfterLogoutHook, AfterLogoutContext, AfterLoginHook, AfterLoginContext, AccessCheckResult, AccessCheckReason };