@ionite/server 0.0.23 → 0.0.24-beta.20260907.2

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { ConfigChangeCallback, ConfigSource as ConfigSource9, FrameworkConfigInput, FrameworkStores as FrameworkStores2, Ionite as Ionite6, ModifiableFrameworkConfig, RemoteConfig as RemoteConfig3, RemoteConfigRetryHook, RemoteConfigRetryOptions, RoutingOptions as RoutingOptions2 } from "@ionite/core";
 import { ApplicationValidators, BaseTenant as BaseTenant2, CreateTenantRequest, Ionite as Ionite2, TenantStore as TenantStore2, TenantValidators, UpdateTenantRequest, Workload } from "@ionite/core";
-import { CapabilityEndpointUrls } from "@ionite/core";
+import { CapabilityEndpointUrls, FrameworkStores } from "@ionite/core";
 /**
 * Deterministic set of ionite endpoint paths derived from a single `basePath`.
 * These are the only URLs the SDK mounts; application code cannot customize individual paths
@@ -13,6 +13,18 @@ type UrlMap = CapabilityEndpointUrls;
 * by module construction, the router, the readiness endpoint, and tenant-manager responses.
 */
 declare function deriveIonUrls(basePath: string): UrlMap;
+/**
+* Prototype-only in-memory store set — the explicit replacement for the silent defaults the SDK
+* used to apply. Everything here lives in one process `Map`: sessions, users, customers, magic
+* links, and cached workload tokens vanish on restart and are never shared across replicas.
+*
+* Anything beyond a prototype needs durability: `@ionite/redis` / `@ionite/ioredis` stores, or
+* app-owned SQL stores. Authz stores (`catalogStore`, `accessStore`, `accessIndex`, `resources`)
+* are intentionally NOT included — they gate IAM/authz capabilities and must be chosen
+* deliberately (in-memory variants exist for prototypes: `InMemoryAccessCatalogStore`,
+* `InMemoryAccessAssignmentStore`, `InMemoryAccessIndex`, `InMemoryResourceStore`).
+*/
+declare function devInMemoryStores(): FrameworkStores;
 import { BaseTenant, ConfigLocator, Ionite, LfvCallbackKind, Logger, RemoteConfig as RemoteConfig2, Secret, SecretsSource, TenantStore } from "@ionite/core";
 type TenantMirrorHooks<TTenant extends BaseTenant = BaseTenant> = {
 	onRemoteConfigChange?(tenant: TTenant, config: RemoteConfig2, secret: Secret<Record<string, unknown>>): void | Promise<void>;
@@ -79,16 +91,16 @@ declare function tenantManager<
 >(ion: Ionite2, options: TenantManagerOptions<TCreateTenantRequest, TUpdateTenantRequest, TTenant>): TenantManager<TTenant>;
 import { CapabilityKey as CapabilityKey2 } from "@ionite/core";
 export * from "@ionite/core";
-import { AccessCheckReason, AccessCheckResult, CreateTenantRequest as CreateTenantRequest2, EnvironmentType, FrameworkOtelConfig, FrameworkStores as FrameworkStores3, generateULID, IoniteError, IoniteErrorOptions, listGenerator, Otel, OtelConfig, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProviderType, OtelSignalConfig, SubjectScope, SubjectType as SubjectType3, TenantResponse, TenantStatus, TenantValidators as TenantValidators2, TenantWebhookPayload, UpdateTenantRequest as UpdateTenantRequest2 } from "@ionite/core";
+import { AccessCheckReason, AccessCheckResult, AssignmentPolicyError, CreateTenantRequest as CreateTenantRequest2, EnvironmentType, FrameworkOtelConfig, FrameworkStores as FrameworkStores3, generateULID, IamAssignmentPolicy, IoniteError, IoniteErrorOptions, listGenerator, Otel, OtelConfig, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProviderType, OtelSignalConfig, SubjectScope, SubjectType as SubjectType3, TenantResponse, TenantStatus, TenantValidators as TenantValidators2, TenantWebhookPayload, UpdateTenantRequest as UpdateTenantRequest2 } from "@ionite/core";
 import { AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CatalogView, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions } from "@ionite/core/server";
 import { allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, blockDangerousUrls, CatalogAdjacencyCache, callback, captureRedirect, ciam, collectReferencedDefinitions, defaultRedirectPolicies, discoverSessionRecords, discoverSessions, expandRoot, getCustomer, getUser, has, hasAll as hasAll2, hasAllScope, hasAny as hasAny2, hasAnyScope, hasGroup as hasGroup2, hasPermission as hasPermission2, hasRole as hasRole2, hasScope, InMemoryTenantStore, iam, initiateLogin, isRedirectAllowed, listSsoClientIdsFromCookies, reconcileSubjectAccess, resolveAfterRedirect, resolveCapturedRedirect, resolveRedirect, SessionDiscoveryOptions, SessionResponse, sameOriginRedirectRules, sendTenantWebhook, sso, VerifyUserOptions, verifyUser, withSetCookies } from "@ionite/core/server";
-import { AccessAssignmentStore as AccessAssignmentStore2, AccessChange, ListOptions, ListResult, OaaAccessTargetType, SubjectType } from "@ionite/core";
+import { AccessAssignmentStore, AccessChange, ListOptions, ListResult, OaaAccessTargetType, SubjectType } from "@ionite/core";
 /**
 * In-memory store of granted access **roots** (source of truth). Roots are keyed by their
 * deterministic id (`accessRootId`) and carry provenance + status. All stored roots are `active`
 * (the SDK uses a transactional fail-fast model with no `pendingRemoval` sweep).
 */
-declare class InMemoryAccessAssignmentStore implements AccessAssignmentStore2<AccessChange> {
+declare class InMemoryAccessAssignmentStore implements AccessAssignmentStore<AccessChange> {
 	private readonly roots;
 	private readonly byTarget;
 	private readonly bySubject;
@@ -110,8 +122,8 @@ declare class InMemoryAccessAssignmentStore implements AccessAssignmentStore2<Ac
 	}>): Promise<Map<string, AccessChange[]>>;
 	listBySubject(subject: string, subjectType: SubjectType, options?: ListOptions): Promise<ListResult<AccessChange>>;
 }
-import { AccessCatalogStore as AccessCatalogStore2, CatalogChangeListener, EntityStore, Group, ListOptions as ListOptions2, ListResult as ListResult2, Permission, Resource, ResourceChangeListener, ResourceProvider as ResourceProvider2, Role } from "@ionite/core";
-declare class InMemoryAccessCatalogStore implements AccessCatalogStore2 {
+import { AccessCatalogStore, CatalogChangeListener, EntityStore, Group, ListOptions as ListOptions2, ListResult as ListResult2, Permission, Resource, ResourceChangeListener, ResourceProvider, Role } from "@ionite/core";
+declare class InMemoryAccessCatalogStore implements AccessCatalogStore {
 	private readonly listeners;
 	private readonly emit;
 	readonly groups: EntityStore<Group>;
@@ -128,7 +140,7 @@ declare class InMemoryAccessCatalogStore implements AccessCatalogStore2 {
 * `set`/`delete` emit the `changed` signal the SDK subscribes to (adjacency-cache invalidation,
 * targeted reconcile, incremental OAA projection).
 */
-declare class InMemoryResourceStore implements ResourceProvider2 {
+declare class InMemoryResourceStore implements ResourceProvider {
 	private readonly items;
 	private readonly listeners;
 	get(id: string): Promise<Resource | undefined>;
@@ -141,14 +153,14 @@ declare class InMemoryResourceStore implements ResourceProvider2 {
 	delete(id: string): void;
 	private emitChange;
 }
-import { AccessCheckTarget, AccessIndex as AccessIndex2, AccessRef, AuthzDecision, BaseUser, EffectiveEdge, Group as Group2, OaaAccessTargetType as OaaAccessTargetType2, Permission as Permission2, Resource as Resource2, Role as Role2, SubjectRef, SubjectType as SubjectType2 } from "@ionite/core";
+import { AccessCheckTarget, AccessIndex, AccessRef, AuthzDecision, BaseUser, EffectiveEdge, Group as Group2, OaaAccessTargetType as OaaAccessTargetType2, Permission as Permission2, Resource as Resource2, Role as Role2, SubjectRef, SubjectType as SubjectType2 } from "@ionite/core";
 /**
 * In-memory derived closure index. Rows are root-attributed: a single
 * `(subject, targetType, target, resource)` edge may be justified by multiple roots, so revoking
 * one root via {@link removeByRoot} leaves edges still backed by other roots. Rebuildable from
 * AccessAssignmentStore roots + the catalog.
 */
-declare class InMemoryAccessIndex implements AccessIndex2 {
+declare class InMemoryAccessIndex implements AccessIndex {
 	/** edgeKey -> set of rootIds that justify it. */
 	private readonly rows;
 	/** tripleKey -> set of edgeKeys (for resource-agnostic "any" checks). */
@@ -364,17 +376,21 @@ import { BaseCustomer, CustomerStore, ListOptions as ListOptions3, ListResult as
 declare class InMemoryCustomerStore<TExtended = Record<string, never>> implements CustomerStore<TExtended> {
 	private customers;
 	private userNameIndex;
+	private externalIdIndex;
 	get(id: string): Promise<BaseCustomer<TExtended> | undefined>;
 	lookup(customer: BaseCustomer<TExtended>): Promise<BaseCustomer<TExtended> | undefined>;
+	getByExternalId(externalId: string): Promise<BaseCustomer<TExtended> | undefined>;
 	upsert(customer: BaseCustomer<TExtended>): Promise<BaseCustomer<TExtended>>;
 	delete(id: string): Promise<number>;
 	list(options?: ListOptions3): Promise<ListResult3<BaseCustomer<TExtended>>>;
 }
-import { AccessAssignmentStore as AccessAssignmentStore3, AccessCatalogStore as AccessCatalogStore3, BaseUser as BaseUser2, CodeCatalog as CodeCatalog2, IamDeltaEmitter, IamDeltaMode, Logger as Logger4, ScimUser, UserStore, Workload as Workload2, WorkloadIdentityStore as WorkloadIdentityStore2 } from "@ionite/core";
+import { AccessAssignmentStore as AccessAssignmentStore2, AccessCatalogStore as AccessCatalogStore2, BaseUser as BaseUser2, CodeCatalog, CustomerStore as CustomerStore2, IamDeltaEmitter, IamDeltaMode, Logger as Logger4, ScimUser, UserStore, Workload as Workload2, WorkloadIdentityStore } from "@ionite/core";
 type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
 /** RemoteConfig-derived destination descriptor for IAM delta egress. */
 type IamDeltaConfig = {
-	mode?: IamDeltaMode;
+	users?: IamDeltaMode;
+	workloads?: IamDeltaMode;
+	customers?: IamDeltaMode;
 	/** Destination SCIM base URL of the IAM tool. */
 	url?: string;
 	/** Outgoing workload client name used to authenticate pushes (`IAMConfig.deltaAudience`). */
@@ -383,12 +399,13 @@ type IamDeltaConfig = {
 /** Runtime capabilities the emitter binds to (resolved from the merged config/stores in buildES). */
 type IamDeltaDeps = {
 	workload?: Workload2;
-	workloadIdentityStore?: WorkloadIdentityStore2;
+	workloadIdentityStore?: WorkloadIdentityStore;
 	userStore?: UserStore;
-	accessStore?: AccessAssignmentStore3;
-	catalogStore?: AccessCatalogStore3;
+	customerStore?: CustomerStore2;
+	accessStore?: AccessAssignmentStore2;
+	catalogStore?: AccessCatalogStore2;
 	/** Normalized code templates merged over persisted rows for outbound definitions. */
-	codeCatalog?: CodeCatalog2;
+	codeCatalog?: CodeCatalog;
 	/** Optional app mapper shared with the inbound IAM Users read surface. */
 	mapUserToScim?: (stored: BaseUser2) => ScimUser | Promise<ScimUser>;
 	/** Injectable fetch (defaults to global fetch); enables testing the patch path in-process. */
@@ -413,7 +430,7 @@ import { CapabilityKey, ModuleName } from "@ionite/core";
 * Version of the stable capability vocabulary emitted by capabilitiez and used by ECV result IDs.
 * Increment only when capability/test-unit identity changes, not for ordinary SDK releases.
 */
-declare const ION_CAPABILITY_CATALOG_VERSION = 1;
+declare const ION_CAPABILITY_CATALOG_VERSION = 2;
 type CapabilityDescriptor = {
 	/**
 	* Stable machine key (also the catalog map key). This is the SAME key the runtime `capabilitiez`
@@ -474,6 +491,18 @@ declare const ION_CAPABILITY_CATALOG: readonly [{
 	readonly label: "SCIM Groups inbound";
 	readonly requires: "AccessCatalogStore";
 	readonly incapableReason: "SCIM Groups endpoint is enabled by RemoteConfig but no AccessCatalogStore capability is wired by the application.";
+}, {
+	readonly key: "iam.workloads";
+	readonly module: "iam";
+	readonly label: "SCIM Workloads inbound";
+	readonly requires: "workloadIdentityStore";
+	readonly incapableReason: "SCIM Workloads endpoint is enabled by RemoteConfig but no workload identity store capability is wired by the application.";
+}, {
+	readonly key: "iam.customers";
+	readonly module: "iam";
+	readonly label: "SCIM Customers inbound";
+	readonly requires: "customerStore";
+	readonly incapableReason: "SCIM Customers endpoint is enabled by RemoteConfig but no customer store capability is wired by the application.";
 }, {
 	readonly key: "workload.incoming";
 	readonly module: "workload";
@@ -551,8 +580,10 @@ type ScimGroupMembershipPatch = {
 	op: "add" | "remove";
 	groupCreate?: ScimOutboundResource;
 	userCreate?: ScimOutboundResource;
-	/** SCIM member kind; Workload is the ionite extension used by full IAM aggregation. */
-	memberType?: "User" | "Workload";
+	/** SCIM member kind; Workload/Customer are ionite extensions used by full IAM aggregation. */
+	memberType?: "User" | "Workload" | "Customer";
+	/** Destination principal resource for lookup/create. Defaults to `'user'`. */
+	subjectResourceType?: IamDeltaResourceType;
 };
 /**
 * Row-backed receipt callbacks supplied by IAM delta. Group receipts are persisted on
@@ -820,8 +851,8 @@ declare function closeAllVaultSockets(): void;
 *
 * Keep this synchronized with packages/server/package.json via publish.ts.
 */
-declare const ION_SDK_VERSION = "0.0.23";
-import { Workload as CoreWorkload, FrameworkWorkloadConfig, Ionite as Ionite5, JWTAssertionClaims, Logger as Logger7, TokenValidationResult, TrustedIdp, WorkloadConfigMap, WorkloadGetToken, WorkloadIdentityStore as WorkloadIdentityStore3, WorkloadIncomingOutgoing, WorkloadTokenResponse, WorkloadTokenStore } from "@ionite/core";
+declare const ION_SDK_VERSION = "0.0.24-beta.20260907.2";
+import { Workload as CoreWorkload, FrameworkWorkloadConfig, Ionite as Ionite5, JWTAssertionClaims, Logger as Logger7, TokenValidationResult, TrustedIdp, WorkloadConfigMap, WorkloadGetToken, WorkloadIdentityStore as WorkloadIdentityStore2, WorkloadIncomingOutgoing, WorkloadTokenResponse, WorkloadTokenStore } from "@ionite/core";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 /**
 * Common fields shared across all workload authentication modes
@@ -878,7 +909,7 @@ type WorkloadConfigBase = {
 	* merges stored attributes (e.g. `displayName`, `active`, default `scopes`) onto the validated
 	* token identity. Authorization works without it; see {@link WorkloadIdentityStore}.
 	*/
-	workloadIdentityStore?: WorkloadIdentityStore3;
+	workloadIdentityStore?: WorkloadIdentityStore2;
 	/**
 	* Automatically refresh tokens before expiration
 	* @default true
@@ -1083,16 +1114,18 @@ declare function revokeWorkloadToken(token: string, ion: Ionite5): Promise<void>
 * Framework-agnostic request handler for the Workload module (token, validate, jwks, refresh routes).
 */
 declare function workloadHandler(request: Request, ion: Ionite5): Promise<Response>;
-import { BaseWorkloadIdentity, ListOptions as ListOptions5, ListResult as ListResult5, WorkloadIdentityStore as WorkloadIdentityStore4 } from "@ionite/core";
+import { BaseWorkloadIdentity, ListOptions as ListOptions5, ListResult as ListResult5, WorkloadIdentityStore as WorkloadIdentityStore3 } from "@ionite/core";
 /**
 * In-memory {@link WorkloadIdentityStore} implementation using Maps. Suitable for development and
 * testing; use a durable store (e.g. Redis/SQL) in production.
 */
-declare class InMemoryWorkloadIdentityStore<TExtended = Record<string, never>> implements WorkloadIdentityStore4<TExtended> {
+declare class InMemoryWorkloadIdentityStore<TExtended = Record<string, never>> implements WorkloadIdentityStore3<TExtended> {
 	private identities;
 	private clientIdIndex;
+	private externalIdIndex;
 	get(id: string): Promise<BaseWorkloadIdentity<TExtended> | undefined>;
 	lookup(identity: BaseWorkloadIdentity<TExtended>): Promise<BaseWorkloadIdentity<TExtended> | undefined>;
+	getByExternalId(externalId: string): Promise<BaseWorkloadIdentity<TExtended> | undefined>;
 	upsert(identity: BaseWorkloadIdentity<TExtended>): Promise<BaseWorkloadIdentity<TExtended>>;
 	delete(id: string): Promise<number>;
 	list(options?: ListOptions5): Promise<ListResult5<BaseWorkloadIdentity<TExtended>>>;
@@ -1138,4 +1171,4 @@ type IoniteConfig<C extends FrameworkConfigInput = FrameworkConfigInput> = C & {
 	onConfigLoadError?: RemoteConfigRetryHook;
 };
 declare function ionite<const C extends FrameworkConfigInput = FrameworkConfigInput>(source: ConfigSource9, config: IoniteConfig<C> | FrameworkConfigInput): Ionite6;
-export { workloadHandler, workload, withSetCookies, verifyUser, vaultSocketDiagnostics, vaultConfig, vault, validateWorkloadToken, tenantMirror, tenantManager, subscribeSecretPathWithHttpPolling, sso, setVaultWebSocketCommandTimeout, sendTenantWebhook, secretConfigSource, sameOriginRedirectRules, routeRequest, rewriteRequestPath, rewriteRequestForTenantPath, rewriteRequestForDefaultTenantUi, rewriteRequestForDefaultTenantApi, revokeWorkloadToken, resolveTenantFromRequest, resolveRedirect, resolveDefaultRoute, resolveCapturedRedirect, resolveAfterRedirect, reconcileSubjectAccess, mirroredConfig, mirrorSecrets, listSsoClientIdsFromCookies, listGenerator, lfvVault, isVaultConfigWaitingForSecretError, isVaultConfigInvalidPayloadError, isRedirectAllowed, ionite, initiateLogin, iam, hasScope, hasRole2 as hasRole, hasPermission2 as hasPermission, hasGroup2 as hasGroup, hasAnyScope, hasAny2 as hasAny, hasAllScope, hasAll2 as hasAll, has, getWorkloadToken, getWorkload, getUser, getCustomer, generateULID, gcpConfig, expandRoot, escapeScimFilterValue, envConfig, enforceEndpointAuthz, discoverSessions, discoverSessionRecords, deriveIonUrls, defaultRedirectPolicies, createTenantIonResolver, createTenantIonHandler, createSessionReadCache, createManagedIamDelta, configSourceFromLocator, configSourceFromEnvValues, configLocatorFromEnvValues, configFromSource, collectReferencedDefinitions, closeAllVaultSockets, ciam, captureRedirect, callback, blockDangerousUrls, azureConfig, awsConfig, allowSameOrigin, allowRelativePaths, allowOrigins, allowHosts, VerifyUserOptions, VaultSubscribeNotSupportedError, VaultConfigWaitingForSecretError, VaultConfigSourceOptions, VaultConfigInvalidPayloadError, VAULT_MIN_POLLING_TTL_MS, UrlMap, UpdateTenantRequest2 as UpdateTenantRequest, TenantWebhookPayload, TenantValidators2 as TenantValidators, TenantStatus, TenantResponse, TenantResolutionContext, TenantMirrorOptions, TenantMirrorHooks, TenantMirror, TenantManagerOptions, TenantManager, TenantIonUrls, TenantIonResolver, SubjectType3 as SubjectType, SubjectScope, SessionResponse, SessionReadCacheOptions, SessionDiscoveryOptions, SecretsMirror, ScimOutboundResource, ScimOutboundReceiptCallbacks, ScimOutboundOutcome, ScimOutboundClientOptions, ScimOutboundClient, ResolveTenantFromRequestOptions, ReferencedDefinitions, RedirectVerdict, RedirectRuleContext, RedirectRule, RedirectResult, RedirectPolicy, RedirectContext, ReconcileStores, OtelSignalConfig, OtelProviderType, OtelOAuthClientCredentialsConfig, OtelMetricsSignalConfig, OtelLogRecord, OtelLogLevel, OtelLevels, OtelConfig, Otel, MirroredConfigSource, MirroredConfigOptions, MirrorSecretsOptions, LfvSecretsSource, IoniteErrorOptions, IoniteError, IoniteConfig, InMemoryWorkloadTokenStore, InMemoryWorkloadIdentityStore, InMemoryUserStore, InMemoryTenantStore, InMemorySessionStore, InMemoryResourceStore, InMemoryMagicLinkStore, InMemoryCustomerStore, InMemoryAccessIndex, InMemoryAccessCatalogStore, InMemoryAccessAssignmentStore, IamDeltaDeps, IamDeltaConfig, ION_SDK_VERSION, ION_READY_DEFAULT_TIMEOUT_MS, ION_CAPABILITY_CATALOG_VERSION, ION_CAPABILITY_CATALOG, HttpPollingHooks, GcpConfigSourceOptions, FrameworkStores3 as FrameworkStores, FrameworkOtelConfig, EnvironmentType, EnvConfigOptions, CreateTenantRequest2 as CreateTenantRequest, CreateTenantIonResolverOptions, CreateTenantIonHandlerOptions, ConfigFromSourceOptions, CatalogView, CatalogAdjacencyCache, CapabilityKey2 as CapabilityKey, CapabilityDescriptor, BeforeLogoutHook, BeforeLogoutContext, BeforeLoginHook, BeforeLoginContext, AzureConfigSourceOptions, AwsConfigSourceOptions, AfterLogoutHook, AfterLogoutContext, AfterLoginHook, AfterLoginContext, AccessCheckResult, AccessCheckReason };
+export { workloadHandler, workload, withSetCookies, verifyUser, vaultSocketDiagnostics, vaultConfig, vault, validateWorkloadToken, tenantMirror, tenantManager, subscribeSecretPathWithHttpPolling, sso, setVaultWebSocketCommandTimeout, sendTenantWebhook, secretConfigSource, sameOriginRedirectRules, routeRequest, rewriteRequestPath, rewriteRequestForTenantPath, rewriteRequestForDefaultTenantUi, rewriteRequestForDefaultTenantApi, revokeWorkloadToken, resolveTenantFromRequest, resolveRedirect, resolveDefaultRoute, resolveCapturedRedirect, resolveAfterRedirect, reconcileSubjectAccess, mirroredConfig, mirrorSecrets, listSsoClientIdsFromCookies, listGenerator, lfvVault, isVaultConfigWaitingForSecretError, isVaultConfigInvalidPayloadError, isRedirectAllowed, ionite, initiateLogin, iam, hasScope, hasRole2 as hasRole, hasPermission2 as hasPermission, hasGroup2 as hasGroup, hasAnyScope, hasAny2 as hasAny, hasAllScope, hasAll2 as hasAll, has, getWorkloadToken, getWorkload, getUser, getCustomer, generateULID, gcpConfig, expandRoot, escapeScimFilterValue, envConfig, enforceEndpointAuthz, discoverSessions, discoverSessionRecords, devInMemoryStores, deriveIonUrls, defaultRedirectPolicies, createTenantIonResolver, createTenantIonHandler, createSessionReadCache, createManagedIamDelta, configSourceFromLocator, configSourceFromEnvValues, configLocatorFromEnvValues, configFromSource, collectReferencedDefinitions, closeAllVaultSockets, ciam, captureRedirect, callback, blockDangerousUrls, azureConfig, awsConfig, allowSameOrigin, allowRelativePaths, allowOrigins, allowHosts, VerifyUserOptions, VaultSubscribeNotSupportedError, VaultConfigWaitingForSecretError, VaultConfigSourceOptions, VaultConfigInvalidPayloadError, VAULT_MIN_POLLING_TTL_MS, UrlMap, UpdateTenantRequest2 as UpdateTenantRequest, TenantWebhookPayload, TenantValidators2 as TenantValidators, TenantStatus, TenantResponse, TenantResolutionContext, TenantMirrorOptions, TenantMirrorHooks, TenantMirror, TenantManagerOptions, TenantManager, TenantIonUrls, TenantIonResolver, SubjectType3 as SubjectType, SubjectScope, SessionResponse, SessionReadCacheOptions, SessionDiscoveryOptions, SecretsMirror, ScimOutboundResource, ScimOutboundReceiptCallbacks, ScimOutboundOutcome, ScimOutboundClientOptions, ScimOutboundClient, ResolveTenantFromRequestOptions, ReferencedDefinitions, RedirectVerdict, RedirectRuleContext, RedirectRule, RedirectResult, RedirectPolicy, RedirectContext, ReconcileStores, OtelSignalConfig, OtelProviderType, OtelOAuthClientCredentialsConfig, OtelMetricsSignalConfig, OtelLogRecord, OtelLogLevel, OtelLevels, OtelConfig, Otel, MirroredConfigSource, MirroredConfigOptions, MirrorSecretsOptions, LfvSecretsSource, IoniteErrorOptions, IoniteError, IoniteConfig, InMemoryWorkloadTokenStore, InMemoryWorkloadIdentityStore, InMemoryUserStore, InMemoryTenantStore, InMemorySessionStore, InMemoryResourceStore, InMemoryMagicLinkStore, InMemoryCustomerStore, InMemoryAccessIndex, InMemoryAccessCatalogStore, InMemoryAccessAssignmentStore, IamDeltaDeps, IamDeltaConfig, IamAssignmentPolicy, ION_SDK_VERSION, ION_READY_DEFAULT_TIMEOUT_MS, ION_CAPABILITY_CATALOG_VERSION, ION_CAPABILITY_CATALOG, HttpPollingHooks, GcpConfigSourceOptions, FrameworkStores3 as FrameworkStores, FrameworkOtelConfig, EnvironmentType, EnvConfigOptions, CreateTenantRequest2 as CreateTenantRequest, CreateTenantIonResolverOptions, CreateTenantIonHandlerOptions, ConfigFromSourceOptions, CatalogView, CatalogAdjacencyCache, CapabilityKey2 as CapabilityKey, CapabilityDescriptor, BeforeLogoutHook, BeforeLogoutContext, BeforeLoginHook, BeforeLoginContext, AzureConfigSourceOptions, AwsConfigSourceOptions, AssignmentPolicyError, AfterLogoutHook, AfterLogoutContext, AfterLoginHook, AfterLoginContext, AccessCheckResult, AccessCheckReason };