@ionite/server 0.0.24-beta.20260921.7 → 0.0.24-beta.20260921.8

package/dist/index.d.ts

@@ -1,94 +1,4 @@
 import { ConfigChangeCallback, ConfigSource as ConfigSource9, FrameworkConfigInput, FrameworkStores as FrameworkStores2, Ionite as Ionite6, ModifiableFrameworkConfig, RemoteConfig as RemoteConfig3, RemoteConfigRetryHook, RemoteConfigRetryOptions, RoutingOptions as RoutingOptions2 } from "@ionite/core";
-import { ApplicationValidators, BaseTenant as BaseTenant2, CreateTenantRequest, Ionite as Ionite2, TenantStore as TenantStore2, TenantValidators, UpdateTenantRequest, Workload } from "@ionite/core";
-import { CapabilityEndpointUrls, FrameworkStores } from "@ionite/core";
-/**
-* Deterministic set of ionite endpoint paths derived from a single `basePath`.
-* These are the only URLs the SDK mounts; application code cannot customize individual paths
-* (only `basePath`). Post-login/logout destinations are NOT here: they are decided by the appdev's
-* `beforeLogin`/`afterLogin`/`beforeLogout`/`afterLogout` hooks (application UI routes), not ionite endpoints derivable from `basePath`.
-*/
-type UrlMap = CapabilityEndpointUrls;
-/**
-* Derive every ionite endpoint path from `basePath`. Single source of truth consumed
-* by module construction, the router, the readiness endpoint, and tenant-manager responses.
-*/
-declare function deriveIonUrls(basePath: string): UrlMap;
-/**
-* Prototype-only in-memory store set — the explicit replacement for the silent defaults the SDK
-* used to apply. Everything here lives in one process `Map`: sessions, users, customers, magic
-* links, and cached workload tokens vanish on restart and are never shared across replicas.
-*
-* Anything beyond a prototype needs durability: `@ionite/redis` / `@ionite/ioredis` stores, or
-* app-owned SQL stores. Authz stores (`catalogStore`, `accessStore`, `accessIndex`, `resources`)
-* are intentionally NOT included — they gate IAM/authz capabilities and must be chosen
-* deliberately (in-memory variants exist for prototypes: `InMemoryAccessCatalogStore`,
-* `InMemoryAccessAssignmentStore`, `InMemoryAccessIndex`, `InMemoryResourceStore`).
-*/
-declare function devInMemoryStores(): FrameworkStores;
-import { BaseTenant, ConfigLocator, Ionite, LfvCallbackKind, Logger, RemoteConfig as RemoteConfig2, Secret, SecretsSource, TenantStore } from "@ionite/core";
-type TenantMirrorHooks<TTenant extends BaseTenant = BaseTenant> = {
-	onRemoteConfigChange?(tenant: TTenant, config: RemoteConfig2, secret: Secret<Record<string, unknown>>): void | Promise<void>;
-	onRemoteConfigRevoke?(tenant: TTenant): void | Promise<void>;
-};
-type TenantMirrorOptions<TTenant extends BaseTenant = BaseTenant> = {
-	store: TenantStore<TTenant>;
-	/** App-owned durable mirror destination. */
-	to: SecretsSource;
-	/** Resolve a unique destination path for each tenant. */
-	path: (tenant: TTenant) => string;
-	hooks?: TenantMirrorHooks<TTenant>;
-	/** Overrides the root ion logger for tenant mirror operations. */
-	logger?: Logger;
-	/** Optional source factory for non-LFV locators. */
-	sourceFromLocator?: (locator: ConfigLocator, tenant: TTenant) => SecretsSource;
-};
-type TenantMirror = {
-	/**
-	* Blocks until the first mirror for this tenant lands. With no timeout it waits indefinitely;
-	* pass `timeout > 0` to reject after that many milliseconds.
-	*/
-	ensure(tenantId: string, timeout?: number): Promise<void>;
-	handleCallback(tenantId: string, kind: LfvCallbackKind, request: Request): Promise<Response>;
-	purge(tenantId: string): Promise<void>;
-	close(): Promise<void>;
-};
-/**
-* Maintains per-tenant RemoteConfig mirrors. Tenant records own the upstream locators; app code owns
-* the destination source and path mapping.
-*/
-declare function tenantMirror<TTenant extends BaseTenant = BaseTenant>(ion: Ionite, options: TenantMirrorOptions<TTenant>): TenantMirror;
-type TenantManagerOptions<
-	TCreateTenantRequest extends CreateTenantRequest = CreateTenantRequest,
-	TUpdateTenantRequest extends UpdateTenantRequest = UpdateTenantRequest,
-	TTenant extends BaseTenant2 = BaseTenant2
-> = {
-	validators: ApplicationValidators<TenantValidators<TCreateTenantRequest, TUpdateTenantRequest>>;
-	basePath: string;
-	store: TenantStore2<TTenant>;
-	mirror?: Pick<TenantMirror, "purge">;
-	workloadAuth?: Workload;
-	/**
-	* Resolve the ionite `basePath` for a given tenant (e.g. `/api/${tenant.id}/ionite`).
-	* When provided, tenant responses include the derived absolute SSO `callbackUrl` and full `ionUrls`
-	* so the ECI/ConfigSource can register the matching callback path at the IdP. ionite endpoint URLs are
-	* deterministic from this basePath; they are not configurable per-URL.
-	*/
-	tenantIonBasePath?: (tenant: TTenant) => string | undefined;
-};
-/** Absolute ionite URL set for a tenant, derived from its basePath and request origin. */
-type TenantIonUrls = {
-	callbackUrl: string;
-	ionUrls: UrlMap;
-};
-type TenantManager<TTenant extends BaseTenant2 = BaseTenant2> = {
-	handler(request: Request): Promise<Response>;
-	getTenant(id: string): Promise<TTenant | undefined>;
-};
-declare function tenantManager<
-	TCreateTenantRequest extends CreateTenantRequest = CreateTenantRequest,
-	TUpdateTenantRequest extends UpdateTenantRequest = UpdateTenantRequest,
-	TTenant extends BaseTenant2 = BaseTenant2
->(ion: Ionite2, options: TenantManagerOptions<TCreateTenantRequest, TUpdateTenantRequest, TTenant>): TenantManager<TTenant>;
 import { CapabilityKey as CapabilityKey2 } from "@ionite/core";
 export * from "@ionite/core";
 import { AccessCheckReason, AccessCheckResult, AssignmentPolicyError, CreateTenantRequest as CreateTenantRequest2, EnvironmentType, FrameworkOtelConfig, FrameworkStores as FrameworkStores3, generateULID, IamAssignmentPolicy, IoniteError, IoniteErrorOptions, listGenerator, Otel, OtelConfig, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProviderType, OtelSignalConfig, SubjectScope, SubjectType as SubjectType3, TenantResponse, TenantStatus, TenantValidators as TenantValidators2, TenantWebhookPayload, UpdateTenantRequest as UpdateTenantRequest2 } from "@ionite/core";
@@ -199,9 +109,34 @@ declare class InMemoryAccessIndex implements AccessIndex {
 	private dropEdge;
 	private removeFromSet;
 }
-import { AwsSecretsConfig, ConfigSource, SecretsSource as SecretsSource2 } from "@ionite/core";
+import { CapabilityEndpointUrls, FrameworkStores } from "@ionite/core";
+/**
+* Deterministic set of ionite endpoint paths derived from a single `basePath`.
+* These are the only URLs the SDK mounts; application code cannot customize individual paths
+* (only `basePath`). Post-login/logout destinations are NOT here: they are decided by the appdev's
+* `beforeLogin`/`afterLogin`/`beforeLogout`/`afterLogout` hooks (application UI routes), not ionite endpoints derivable from `basePath`.
+*/
+type UrlMap = CapabilityEndpointUrls;
+/**
+* Derive every ionite endpoint path from `basePath`. Single source of truth consumed
+* by module construction, the router, the readiness endpoint, and tenant-manager responses.
+*/
+declare function deriveIonUrls(basePath: string): UrlMap;
+/**
+* Prototype-only in-memory store set — the explicit replacement for the silent defaults the SDK
+* used to apply. Everything here lives in one process `Map`: sessions, users, customers, magic
+* links, and cached workload tokens vanish on restart and are never shared across replicas.
+*
+* Anything beyond a prototype needs durability: `@ionite/redis` / `@ionite/ioredis` stores, or
+* app-owned SQL stores. Authz stores (`catalogStore`, `accessStore`, `accessIndex`, `resources`)
+* are intentionally NOT included — they gate IAM/authz capabilities and must be chosen
+* deliberately (in-memory variants exist for prototypes: `InMemoryAccessCatalogStore`,
+* `InMemoryAccessAssignmentStore`, `InMemoryAccessIndex`, `InMemoryResourceStore`).
+*/
+declare function devInMemoryStores(): FrameworkStores;
+import { AwsSecretsConfig, ConfigSource, SecretsSource } from "@ionite/core";
 type AwsConfigSourceOptions = Omit<AwsSecretsConfig, "type"> & {
-	vault?: SecretsSource2;
+	vault?: SecretsSource;
 	ttl?: number;
 };
 /**
@@ -212,9 +147,9 @@ type AwsConfigSourceOptions = Omit<AwsSecretsConfig, "type"> & {
 * then throwing at first config access.
 */
 declare function awsConfig(_config: AwsConfigSourceOptions): ConfigSource;
-import { AzureSecretsConfig, ConfigSource as ConfigSource2, SecretsSource as SecretsSource3 } from "@ionite/core";
+import { AzureSecretsConfig, ConfigSource as ConfigSource2, SecretsSource as SecretsSource2 } from "@ionite/core";
 type AzureConfigSourceOptions = Omit<AzureSecretsConfig, "type"> & {
-	vault?: SecretsSource3;
+	vault?: SecretsSource2;
 	path?: string;
 };
 /**
@@ -223,7 +158,7 @@ type AzureConfigSourceOptions = Omit<AzureSecretsConfig, "type"> & {
 * If ttl is set, the vault is polled every ttl milliseconds (minimum 10 minutes) and onConfig is called when config changes.
 */
 declare function azureConfig(config: AzureConfigSourceOptions): ConfigSource2;
-import { ConfigLocator as ConfigLocator2, ConfigSource as ConfigSource3, SecretsSource as SecretsSource4 } from "@ionite/core";
+import { ConfigLocator, ConfigSource as ConfigSource3, SecretsSource as SecretsSource3 } from "@ionite/core";
 /**
 * Materialize a runtime {@link ConfigSource} from a full, self-contained {@link ConfigLocator}. This
 * is the ROOT/bootstrap path (env vars via `envConfig()`, or a bootstrap secret via
@@ -231,7 +166,7 @@ import { ConfigLocator as ConfigLocator2, ConfigSource as ConfigSource3, Secrets
 * fresh source. To reuse a source already connected on an Ionite instance, see
 * {@link configFromSource}.
 */
-declare function configSourceFromLocator(locator: ConfigLocator2): ConfigSource3;
+declare function configSourceFromLocator(locator: ConfigLocator): ConfigSource3;
 /** Optional knobs for {@link configFromSource}. */
 type ConfigFromSourceOptions = {
 	/** Polling interval fallback when the source has no native subscription support. */
@@ -251,13 +186,13 @@ type ConfigFromSourceOptions = {
 * MUST resolve to a distinct backing path — two tenants sharing a path would cross-load each
 * other's RemoteConfig.
 */
-declare function configFromSource(source: SecretsSource4, path: string, options?: ConfigFromSourceOptions): ConfigSource3;
-import { ConfigLocator as ConfigLocator3, ConfigSource as ConfigSource4, ConfigSourceEnv, ConfigSourceType } from "@ionite/core";
+declare function configFromSource(source: SecretsSource3, path: string, options?: ConfigFromSourceOptions): ConfigSource3;
+import { ConfigLocator as ConfigLocator2, ConfigSource as ConfigSource4, ConfigSourceEnv, ConfigSourceType } from "@ionite/core";
 type EnvConfigOptions = {
 	/** Override config source type (default: ION_CONFIG_TYPE from env). */
 	type?: ConfigSourceType;
 };
-declare function configLocatorFromEnvValues(env: Partial<ConfigSourceEnv>, options?: EnvConfigOptions): ConfigLocator3;
+declare function configLocatorFromEnvValues(env: Partial<ConfigSourceEnv>, options?: EnvConfigOptions): ConfigLocator2;
 /**
 * Creates a ConfigSource from environment variables.
 * Reads ION_CONFIG_TYPE to choose the source.
@@ -265,9 +200,9 @@ declare function configLocatorFromEnvValues(env: Partial<ConfigSourceEnv>, optio
 */
 declare function configSourceFromEnvValues(env: Partial<ConfigSourceEnv>, options?: EnvConfigOptions): ConfigSource4;
 declare function envConfig(options?: EnvConfigOptions): ConfigSource4;
-import { ConfigSource as ConfigSource5, GcpSecretsConfig, SecretsSource as SecretsSource5 } from "@ionite/core";
+import { ConfigSource as ConfigSource5, GcpSecretsConfig, SecretsSource as SecretsSource4 } from "@ionite/core";
 type GcpConfigSourceOptions = Omit<GcpSecretsConfig, "type"> & {
-	vault?: SecretsSource5;
+	vault?: SecretsSource4;
 	ttl?: number;
 };
 /**
@@ -278,17 +213,17 @@ type GcpConfigSourceOptions = Omit<GcpSecretsConfig, "type"> & {
 * then throwing at first config access.
 */
 declare function gcpConfig(_config: GcpConfigSourceOptions): ConfigSource5;
-import { ConfigLocator as ConfigLocator4, ConfigSource as ConfigSource6, LfvCallbackKind as LfvCallbackKind2, Logger as Logger3, SecretsSource as SecretsSource7 } from "@ionite/core";
-import { Logger as Logger2, Secret as Secret2, SecretEvent, SecretsSource as SecretsSource6, SecretsSubscriptionOptions } from "@ionite/core";
+import { ConfigLocator as ConfigLocator3, ConfigSource as ConfigSource6, LfvCallbackKind, Logger as Logger2, SecretsSource as SecretsSource6 } from "@ionite/core";
+import { Logger, Secret, SecretEvent, SecretsSource as SecretsSource5, SecretsSubscriptionOptions } from "@ionite/core";
 type MirrorSecretsOptions = {
-	from: SecretsSource6;
-	to: SecretsSource6;
+	from: SecretsSource5;
+	to: SecretsSource5;
 	paths: readonly string[];
 	mapPath: (path: string) => string;
 	/** Optional admission check. Rejected values are ignored without changing the current mirror. */
-	accept?: (secret: Secret2<Record<string, unknown>>, sourcePath: string) => boolean;
+	accept?: (secret: Secret<Record<string, unknown>>, sourcePath: string) => boolean;
 	subscription?: SecretsSubscriptionOptions;
-	logger?: Logger2;
+	logger?: Logger;
 	/** Receives every source lifecycle event after the mirror schedules its required state change. */
 	onEvent?: (event: SecretEvent) => void;
 };
@@ -307,15 +242,15 @@ type SecretsMirror = {
 */
 declare function mirrorSecrets(options: MirrorSecretsOptions): SecretsMirror;
 type MirroredConfigOptions = {
-	from: ConfigLocator4 | SecretsSource7;
+	from: ConfigLocator3 | SecretsSource6;
 	fromPath?: string;
-	to: ConfigLocator4 | SecretsSource7;
+	to: ConfigLocator3 | SecretsSource6;
 	path: string;
-	logger?: Logger3;
+	logger?: Logger2;
 	ttl?: number;
 };
 type MirroredConfigSource = ConfigSource6 & {
-	handleCallback(kind: LfvCallbackKind2, request: Request): Promise<Response>;
+	handleCallback(kind: LfvCallbackKind, request: Request): Promise<Response>;
 	mirror: SecretsMirror;
 };
 /**
@@ -323,7 +258,7 @@ type MirroredConfigSource = ConfigSource6 & {
 * ConfigSource which reads only that durable mirror.
 */
 declare function mirroredConfig(options: MirroredConfigOptions): MirroredConfigSource;
-import { ConfigSource as ConfigSource7, SecretsSource as SecretsSource8 } from "@ionite/core";
+import { ConfigSource as ConfigSource7, SecretsSource as SecretsSource7 } from "@ionite/core";
 /**
 * Creates a ConfigSource from a SecretsSource path that stores a ConfigLocator.
 * The returned source rebinds subscriptions when the bootstrap secret changes.
@@ -334,10 +269,10 @@ import { ConfigSource as ConfigSource7, SecretsSource as SecretsSource8 } from "
 * bootstrap actually changes, the superseded inner source is disposed (its `secret.close()` is
 * invoked) before the new one is built, so config churn cannot leak duplicate connections.
 */
-declare function secretConfigSource(source: SecretsSource8, path: string): ConfigSource7;
-import { ConfigSource as ConfigSource8, SecretsSource as SecretsSource9, VaultSecretsConfig } from "@ionite/core";
+declare function secretConfigSource(source: SecretsSource7, path: string): ConfigSource7;
+import { ConfigSource as ConfigSource8, SecretsSource as SecretsSource8, VaultSecretsConfig } from "@ionite/core";
 type VaultConfigSourceOptions = Omit<VaultSecretsConfig, "type"> & {
-	vault?: SecretsSource9;
+	vault?: SecretsSource8;
 	path?: string;
 };
 declare class VaultConfigWaitingForSecretError extends Error {
@@ -384,7 +319,7 @@ declare class InMemoryCustomerStore<TExtended = Record<string, never>> implement
 	delete(id: string): Promise<number>;
 	list(options?: ListOptions3): Promise<ListResult3<BaseCustomer<TExtended>>>;
 }
-import { AccessAssignmentStore as AccessAssignmentStore2, AccessCatalogStore as AccessCatalogStore2, BaseCustomer as BaseCustomer2, BaseUser as BaseUser2, BaseWorkloadIdentity, CodeCatalog, CustomerStore as CustomerStore2, IamDeltaEmitter, IamDeltaMode, Logger as Logger4, ScimCustomer, ScimUser, ScimWorkload, UserStore, Workload as Workload2, WorkloadIdentityStore } from "@ionite/core";
+import { AccessAssignmentStore as AccessAssignmentStore2, AccessCatalogStore as AccessCatalogStore2, BaseCustomer as BaseCustomer2, BaseUser as BaseUser2, BaseWorkloadIdentity, CodeCatalog, CustomerStore as CustomerStore2, IamDeltaEmitter, IamDeltaMode, Logger as Logger3, ScimCustomer, ScimUser, ScimWorkload, UserStore, Workload, WorkloadIdentityStore } from "@ionite/core";
 type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
 /** RemoteConfig-derived destination descriptor for IAM delta egress. */
 type IamDeltaConfig = {
@@ -398,7 +333,7 @@ type IamDeltaConfig = {
 };
 /** Runtime capabilities the emitter binds to (resolved from the merged config/stores in buildES). */
 type IamDeltaDeps = {
-	workload?: Workload2;
+	workload?: Workload;
 	workloadIdentityStore?: WorkloadIdentityStore;
 	userStore?: UserStore;
 	customerStore?: CustomerStore2;
@@ -425,7 +360,7 @@ type IamDeltaDeps = {
 * authenticated with the outgoing workload client, which the destination treats as the verified
 * origin. See the README "IAM delta egress" section.
 */
-declare function createManagedIamDelta(log: Logger4): {
+declare function createManagedIamDelta(log: Logger3): {
 	update(config: IamDeltaConfig, deps: IamDeltaDeps): IamDeltaEmitter;
 	handle(): IamDeltaEmitter;
 };
@@ -521,6 +456,12 @@ declare const ION_CAPABILITY_CATALOG: readonly [{
 	readonly label: "Authz OAA projection (Veza)";
 	readonly requires: "AccessAssignmentStore + AccessCatalogStore";
 	readonly incapableReason: "OAA projection is configured by RemoteConfig but no access/catalog store capability is wired by the application.";
+}, {
+	readonly key: "tm.integration";
+	readonly module: "tm";
+	readonly label: "Tenant Management staged integration and consent";
+	readonly requires: "TenantStore integration methods + onConnectRequest";
+	readonly incapableReason: "TM integration requires setIntegration/getByIntegrationHandleHash and an App-owned consent hook.";
 }];
 import { BaseCustomer as BaseCustomer3, MagicLink, MagicLinkStore } from "@ionite/core";
 /**
@@ -533,7 +474,7 @@ declare class InMemoryMagicLinkStore<TExtended = Record<string, never>> implemen
 	getAndDelete(token: string): Promise<MagicLink<TExtended> | null>;
 	delete(token: string): Promise<void>;
 }
-import { Ionite as Ionite3, ResolvedRoute, RoutingOptions } from "@ionite/core";
+import { Ionite, ResolvedRoute, RoutingOptions } from "@ionite/core";
 /**
 * Deny-by-default authorization gate for a resolved SDK route. Returns the 401/403 `Response` to
 * short-circuit with when the caller is not authorized, or `undefined` to proceed. Enforcement reuses
@@ -541,14 +482,14 @@ import { Ionite as Ionite3, ResolvedRoute, RoutingOptions } from "@ionite/core";
 * `RemoteConfig.authz.scopesAsEntitlements` is enabled) satisfies the gate; the `response()` already
 * logs the denial server-side without leaking the missing permission to the caller.
 */
-declare function enforceEndpointAuthz(request: Request, ion: Ionite3, required: NonNullable<ResolvedRoute["requiredPermission"]>): Promise<Response | undefined>;
+declare function enforceEndpointAuthz(request: Request, ion: Ionite, required: NonNullable<ResolvedRoute["requiredPermission"]>): Promise<Response | undefined>;
 /**
 * Resolve the default route for a request using the deterministic, basePath-derived endpoint paths.
 * Endpoint URLs are no longer read from per-module config; they are computed from `basePath`.
 */
-declare function resolveDefaultRoute(request: Request, ion: Ionite3, urls: UrlMap, pathname?: string): ResolvedRoute | undefined;
-declare function routeRequest(request: Request, ion: Ionite3, routing?: RoutingOptions, urls?: UrlMap): Promise<Response>;
-import { DestinationReference, GroupResource, IamDeltaResourceType, Logger as Logger5, ScimUser as ScimUser2 } from "@ionite/core";
+declare function resolveDefaultRoute(request: Request, ion: Ionite, urls: UrlMap, pathname?: string): ResolvedRoute | undefined;
+declare function routeRequest(request: Request, ion: Ionite, routing?: RoutingOptions, urls?: UrlMap): Promise<Response>;
+import { DestinationReference, GroupResource, IamDeltaResourceType, Logger as Logger4, ScimUser as ScimUser2 } from "@ionite/core";
 type FetchLike2 = (input: string, init?: RequestInit) => Promise<Response>;
 /**
 * Outcome of an outbound IAM delta operation:
@@ -606,7 +547,7 @@ type ScimOutboundClientOptions = {
 	getToken: () => Promise<string>;
 	/** Reads and writes destination receipts on the source User/AccessCatalogStore rows. */
 	receipts: ScimOutboundReceiptCallbacks;
-	log: Logger5;
+	log: Logger4;
 	/** Injectable fetch (defaults to global fetch); enables testing against a mock SCIM server. */
 	fetchImpl?: FetchLike2;
 };
@@ -681,10 +622,10 @@ declare class ScimOutboundClient {
 	patchGroupMembership(args: ScimGroupMembershipPatch): Promise<ScimOutboundOutcome>;
 	private patchGroupMembershipNow;
 }
-import { LfvCallbackTransport, Secret as Secret3, SecretsSource as SecretsSource10, VaultLfvSecretsConfig } from "@ionite/core";
-type LfvSecretsSource = SecretsSource10 & {
+import { LfvCallbackTransport, Secret as Secret2, SecretsSource as SecretsSource9, VaultLfvSecretsConfig } from "@ionite/core";
+type LfvSecretsSource = SecretsSource9 & {
 	/** Register for callback-delivered values without issuing an initial read request. */
-	subscribePassive<T>(path: string, onChange: (fullSecret: Secret3<T>) => void): Promise<() => void>;
+	subscribePassive<T>(path: string, onChange: (fullSecret: Secret2<T>) => void): Promise<() => void>;
 	isDeliveryRequest(request: Request): boolean;
 	isEventsRequest(request: Request): boolean;
 	handleDelivery(request: Request): Promise<Response>;
@@ -751,6 +692,63 @@ declare class InMemorySessionStore<TExtended = Record<string, never>> implements
 	update(sid: string, data: Partial<Session<TExtended>>): Promise<void>;
 	delete(sid: string): Promise<void>;
 }
+import { BaseTenant as BaseTenant2, CreateTenantRequest, FrameworkTmConfig, TenantValidators, UpdateTenantRequest, Workload as Workload2 } from "@ionite/core";
+import { BaseTenant, ConfigLocator as ConfigLocator4, Ionite as Ionite2, LfvCallbackKind as LfvCallbackKind2, Logger as Logger5, RemoteConfig as RemoteConfig2, Secret as Secret3, SecretsSource as SecretsSource10, TenantStore } from "@ionite/core";
+type TenantMirrorHooks<TTenant extends BaseTenant = BaseTenant> = {
+	onRemoteConfigChange?(tenant: TTenant, config: RemoteConfig2, secret: Secret3<Record<string, unknown>>): void | Promise<void>;
+	onRemoteConfigRevoke?(tenant: TTenant): void | Promise<void>;
+};
+type TenantMirrorOptions<TTenant extends BaseTenant = BaseTenant> = {
+	store: TenantStore<TTenant>;
+	/** App-owned durable mirror destination. */
+	to: SecretsSource10;
+	/** Resolve a unique destination path for each tenant. */
+	path: (tenant: TTenant) => string;
+	hooks?: TenantMirrorHooks<TTenant>;
+	/** Overrides the root ion logger for tenant mirror operations. */
+	logger?: Logger5;
+	/** Optional source factory for non-LFV locators. */
+	sourceFromLocator?: (locator: ConfigLocator4, tenant: TTenant) => SecretsSource10;
+};
+type TenantMirror = {
+	/**
+	* Blocks until the first mirror for this tenant lands. With no timeout it waits indefinitely;
+	* pass `timeout > 0` to reject after that many milliseconds.
+	*/
+	ensure(tenantId: string, timeout?: number): Promise<void>;
+	handleCallback(tenantId: string, kind: LfvCallbackKind2, request: Request): Promise<Response>;
+	purge(tenantId: string): Promise<void>;
+	close(): Promise<void>;
+};
+/**
+* Maintains per-tenant RemoteConfig mirrors. Tenant records own the upstream locators; app code owns
+* the destination source and path mapping.
+*/
+declare function tenantMirror<TTenant extends BaseTenant = BaseTenant>(ion: Ionite2, options: TenantMirrorOptions<TTenant>): TenantMirror;
+type TenantManagerOptions<
+	TCreateTenantRequest extends CreateTenantRequest = CreateTenantRequest,
+	TUpdateTenantRequest extends UpdateTenantRequest = UpdateTenantRequest,
+	TTenant extends BaseTenant2 = BaseTenant2
+> = Omit<FrameworkTmConfig<TTenant>, "validators" | "mirror"> & {
+	validators: {
+		tenant: TenantValidators<TCreateTenantRequest, TUpdateTenantRequest>;
+	};
+	mirror?: Pick<TenantMirror, "purge">;
+	workloadAuth?: Workload2;
+	/**
+	* Resolve the ionite `basePath` for a given tenant (e.g. `/api/${tenant.id}/ionite`).
+	* When provided, tenant responses include the derived absolute SSO `callbackUrl` and full `ionUrls`
+	* so the ECI/ConfigSource can register the matching callback path at the IdP. ionite endpoint URLs are
+	* deterministic from this basePath; they are not configurable per-URL.
+	*/
+	tenantIonBasePath?: (tenant: TTenant) => string | undefined;
+};
+/** Absolute ionite URL set for a tenant, derived from its basePath and request origin. */
+type TenantIonUrls = {
+	callbackUrl: string;
+	ionUrls: UrlMap;
+};
+declare function hashIntegrationHandle(handle: string): Promise<string>;
 import { Ionite as Ionite4, TenantPathNamespace, TenantRoutingStrategy } from "@ionite/core";
 type MaybePromise<T> = Promise<T> | T;
 type TenantResolutionContext = {
@@ -855,7 +853,7 @@ declare function closeAllVaultSockets(): void;
 *
 * Keep this synchronized with packages/server/package.json via publish.ts.
 */
-declare const ION_SDK_VERSION = "0.0.24-beta.20260921.7";
+declare const ION_SDK_VERSION = "0.0.24-beta.20260921.8";
 import { Workload as CoreWorkload, FrameworkWorkloadConfig, Ionite as Ionite5, JWTAssertionClaims, Logger as Logger7, TokenValidationResult, TrustedIdp, WorkloadConfigMap, WorkloadGetToken, WorkloadIdentityStore as WorkloadIdentityStore2, WorkloadIncomingOutgoing, WorkloadTokenResponse, WorkloadTokenStore } from "@ionite/core";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 /**
@@ -1175,4 +1173,4 @@ type IoniteConfig<C extends FrameworkConfigInput = FrameworkConfigInput> = C & {
 	onConfigLoadError?: RemoteConfigRetryHook;
 };
 declare function ionite<const C extends FrameworkConfigInput = FrameworkConfigInput>(source: ConfigSource9, config: IoniteConfig<C> | FrameworkConfigInput): Ionite6;
-export { AccessCheckReason, AccessCheckResult, AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, AssignmentPolicyError, AwsConfigSourceOptions, AzureConfigSourceOptions, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CapabilityDescriptor, CapabilityKey2 as CapabilityKey, CatalogAdjacencyCache, CatalogView, ConfigFromSourceOptions, CreateTenantIonHandlerOptions, CreateTenantIonResolverOptions, CreateTenantRequest2 as CreateTenantRequest, EnvConfigOptions, EnvironmentType, FrameworkOtelConfig, FrameworkStores3 as FrameworkStores, GcpConfigSourceOptions, HttpPollingHooks, ION_CAPABILITY_CATALOG, ION_CAPABILITY_CATALOG_VERSION, ION_READY_DEFAULT_TIMEOUT_MS, ION_SDK_VERSION, IamAssignmentPolicy, IamDeltaConfig, IamDeltaDeps, InMemoryAccessAssignmentStore, InMemoryAccessCatalogStore, InMemoryAccessIndex, InMemoryCustomerStore, InMemoryMagicLinkStore, InMemoryResourceStore, InMemorySessionStore, InMemoryTenantStore, InMemoryUserStore, InMemoryWorkloadIdentityStore, InMemoryWorkloadTokenStore, IoniteConfig, IoniteError, IoniteErrorOptions, LfvSecretsSource, MirrorSecretsOptions, MirroredConfigOptions, MirroredConfigSource, Otel, OtelConfig, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProviderType, OtelSignalConfig, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions, ResolveTenantFromRequestOptions, ScimOutboundClient, ScimOutboundClientOptions, ScimOutboundOutcome, ScimOutboundReceiptCallbacks, ScimOutboundResource, SecretsMirror, SessionDiscoveryOptions, SessionReadCacheOptions, SessionResponse, SubjectScope, SubjectType3 as SubjectType, TenantIonResolver, TenantIonUrls, TenantManager, TenantManagerOptions, TenantMirror, TenantMirrorHooks, TenantMirrorOptions, TenantResolutionContext, TenantResponse, TenantStatus, TenantValidators2 as TenantValidators, TenantWebhookPayload, UpdateTenantRequest2 as UpdateTenantRequest, UrlMap, VAULT_MIN_POLLING_TTL_MS, VaultConfigInvalidPayloadError, VaultConfigSourceOptions, VaultConfigWaitingForSecretError, VaultSubscribeNotSupportedError, VerifyUserOptions, allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, awsConfig, azureConfig, blockDangerousUrls, callback, captureRedirect, ciam, closeAllVaultSockets, collectReferencedDefinitions, configFromSource, configLocatorFromEnvValues, configSourceFromEnvValues, configSourceFromLocator, createManagedIamDelta, createSessionReadCache, createTenantIonHandler, createTenantIonResolver, defaultRedirectPolicies, deriveIonUrls, devInMemoryStores, discoverSessionRecords, discoverSessions, enforceEndpointAuthz, envConfig, escapeScimFilterValue, expandRoot, gcpConfig, generateULID, getCustomer, getUser, getWorkload, getWorkloadToken, has, hasAll2 as hasAll, hasAllScope, hasAny2 as hasAny, hasAnyScope, hasGroup2 as hasGroup, hasPermission2 as hasPermission, hasRole2 as hasRole, hasScope, iam, initiateLogin, ionite, isRedirectAllowed, isVaultConfigInvalidPayloadError, isVaultConfigWaitingForSecretError, lfvVault, listGenerator, listSsoClientIdsFromCookies, mirrorSecrets, mirroredConfig, reconcileSubjectAccess, resolveAfterRedirect, resolveCapturedRedirect, resolveDefaultRoute, resolveRedirect, resolveTenantFromRequest, revokeWorkloadToken, rewriteRequestForDefaultTenantApi, rewriteRequestForDefaultTenantUi, rewriteRequestForTenantPath, rewriteRequestPath, routeRequest, sameOriginRedirectRules, secretConfigSource, sendTenantWebhook, setVaultWebSocketCommandTimeout, sso, subscribeSecretPathWithHttpPolling, tenantManager, tenantMirror, validateWorkloadToken, vault, vaultConfig, vaultSocketDiagnostics, verifyUser, withSetCookies, workload, workloadHandler };
+export { AccessCheckReason, AccessCheckResult, AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, AssignmentPolicyError, AwsConfigSourceOptions, AzureConfigSourceOptions, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CapabilityDescriptor, CapabilityKey2 as CapabilityKey, CatalogAdjacencyCache, CatalogView, ConfigFromSourceOptions, CreateTenantIonHandlerOptions, CreateTenantIonResolverOptions, CreateTenantRequest2 as CreateTenantRequest, EnvConfigOptions, EnvironmentType, FrameworkOtelConfig, FrameworkStores3 as FrameworkStores, GcpConfigSourceOptions, HttpPollingHooks, ION_CAPABILITY_CATALOG, ION_CAPABILITY_CATALOG_VERSION, ION_READY_DEFAULT_TIMEOUT_MS, ION_SDK_VERSION, IamAssignmentPolicy, IamDeltaConfig, IamDeltaDeps, InMemoryAccessAssignmentStore, InMemoryAccessCatalogStore, InMemoryAccessIndex, InMemoryCustomerStore, InMemoryMagicLinkStore, InMemoryResourceStore, InMemorySessionStore, InMemoryTenantStore, InMemoryUserStore, InMemoryWorkloadIdentityStore, InMemoryWorkloadTokenStore, IoniteConfig, IoniteError, IoniteErrorOptions, LfvSecretsSource, MirrorSecretsOptions, MirroredConfigOptions, MirroredConfigSource, Otel, OtelConfig, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProviderType, OtelSignalConfig, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions, ResolveTenantFromRequestOptions, ScimOutboundClient, ScimOutboundClientOptions, ScimOutboundOutcome, ScimOutboundReceiptCallbacks, ScimOutboundResource, SecretsMirror, SessionDiscoveryOptions, SessionReadCacheOptions, SessionResponse, SubjectScope, SubjectType3 as SubjectType, TenantIonResolver, TenantIonUrls, TenantManagerOptions, TenantMirror, TenantMirrorHooks, TenantMirrorOptions, TenantResolutionContext, TenantResponse, TenantStatus, TenantValidators2 as TenantValidators, TenantWebhookPayload, UpdateTenantRequest2 as UpdateTenantRequest, UrlMap, VAULT_MIN_POLLING_TTL_MS, VaultConfigInvalidPayloadError, VaultConfigSourceOptions, VaultConfigWaitingForSecretError, VaultSubscribeNotSupportedError, VerifyUserOptions, allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, awsConfig, azureConfig, blockDangerousUrls, callback, captureRedirect, ciam, closeAllVaultSockets, collectReferencedDefinitions, configFromSource, configLocatorFromEnvValues, configSourceFromEnvValues, configSourceFromLocator, createManagedIamDelta, createSessionReadCache, createTenantIonHandler, createTenantIonResolver, defaultRedirectPolicies, deriveIonUrls, devInMemoryStores, discoverSessionRecords, discoverSessions, enforceEndpointAuthz, envConfig, escapeScimFilterValue, expandRoot, gcpConfig, generateULID, getCustomer, getUser, getWorkload, getWorkloadToken, has, hasAll2 as hasAll, hasAllScope, hasAny2 as hasAny, hasAnyScope, hasGroup2 as hasGroup, hasPermission2 as hasPermission, hasRole2 as hasRole, hasScope, hashIntegrationHandle, iam, initiateLogin, ionite, isRedirectAllowed, isVaultConfigInvalidPayloadError, isVaultConfigWaitingForSecretError, lfvVault, listGenerator, listSsoClientIdsFromCookies, mirrorSecrets, mirroredConfig, reconcileSubjectAccess, resolveAfterRedirect, resolveCapturedRedirect, resolveDefaultRoute, resolveRedirect, resolveTenantFromRequest, revokeWorkloadToken, rewriteRequestForDefaultTenantApi, rewriteRequestForDefaultTenantUi, rewriteRequestForTenantPath, rewriteRequestPath, routeRequest, sameOriginRedirectRules, secretConfigSource, sendTenantWebhook, setVaultWebSocketCommandTimeout, sso, subscribeSecretPathWithHttpPolling, tenantMirror, validateWorkloadToken, vault, vaultConfig, vaultSocketDiagnostics, verifyUser, withSetCookies, workload, workloadHandler };