@ionite/server 0.0.24-beta.20260922.10 → 0.0.24-beta.20260922.11

package/dist/index.d.ts

@@ -1,9 +1,9 @@
-import { ConfigChangeCallback, ConfigSource as ConfigSource9, FrameworkConfigInput, FrameworkStores as FrameworkStores2, Ionite as Ionite6, ModifiableFrameworkConfig, RemoteConfig as RemoteConfig3, RemoteConfigRetryHook, RemoteConfigRetryOptions, RoutingOptions as RoutingOptions2 } from "@ionite/core";
+import { ConfigChangeCallback, ConfigSource as ConfigSource9, FrameworkConfigInput, FrameworkStores as FrameworkStores2, Ionite as Ionite7, ModifiableFrameworkConfig, RemoteConfig as RemoteConfig3, RemoteConfigRetryHook, RemoteConfigRetryOptions, RoutingOptions as RoutingOptions2 } from "@ionite/core";
 import { CapabilityKey as CapabilityKey2 } from "@ionite/core";
 export * from "@ionite/core";
 import { AccessCheckReason, AccessCheckResult, AssignmentPolicyError, CreateTenantRequest as CreateTenantRequest2, EnvironmentType, FrameworkOtelConfig, FrameworkStores as FrameworkStores3, generateULID, IamAssignmentPolicy, IoniteError, IoniteErrorOptions, listGenerator, Otel, OtelConfig, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProviderType, OtelSignalConfig, SubjectScope, SubjectType as SubjectType3, TenantResponse, TenantStatus, TenantValidators as TenantValidators2, TenantWebhookPayload, UpdateTenantRequest as UpdateTenantRequest2 } from "@ionite/core";
-import { AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CatalogView, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions } from "@ionite/core/server";
-import { allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, blockDangerousUrls, CatalogAdjacencyCache, callback, captureRedirect, ciam, collectReferencedDefinitions, defaultRedirectPolicies, discoverSessionRecords, discoverSessions, expandRoot, getCustomer, getUser, has, hasAll as hasAll2, hasAllScope, hasAny as hasAny2, hasAnyScope, hasGroup as hasGroup2, hasPermission as hasPermission2, hasRole as hasRole2, hasScope, InMemoryTenantStore, iam, initiateLogin, isRedirectAllowed, listSsoClientIdsFromCookies, reconcileSubjectAccess, resolveAfterRedirect, resolveCapturedRedirect, resolveRedirect, SessionDiscoveryOptions, SessionResponse, sameOriginRedirectRules, sendTenantWebhook, sso, VerifyUserOptions, verifyUser, withSetCookies } from "@ionite/core/server";
+import { AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CatalogView, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions, ResolveTenantOwnerOptions, ResolveTenantSessionOptions, TenantAccessDenial, TenantAccessDenialReason, TenantAccessLoginUrlOptions, TenantAccessResult, TenantAccessSession, TenantAccessSessionKind } from "@ionite/core/server";
+import { allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, blockDangerousUrls, CatalogAdjacencyCache, callback, captureRedirect, ciam, collectReferencedDefinitions, defaultRedirectPolicies, discoverSessionRecords, discoverSessions, expandRoot, getCustomer, getOwnedTenantIds, getUser, has, hasAll as hasAll2, hasAllScope, hasAny as hasAny2, hasAnyScope, hasGroup as hasGroup2, hasPermission as hasPermission2, hasRole as hasRole2, hasScope, InMemoryTenantStore, iam, initiateLogin, isRedirectAllowed, listSsoClientIdsFromCookies, reconcileSubjectAccess, resolveAfterRedirect, resolveCapturedRedirect, resolveRedirect, resolveTenantOwner, resolveTenantSession, SessionDiscoveryOptions, SessionResponse, sameOriginRedirectRules, sendTenantWebhook, sso, TENANT_OWNER_PERMISSION, tenantAccessLoginUrl, tenantOwnerEntitlementId, tenantOwnerPermission, tenantResourceId, VerifyUserOptions, verifyUser, withSetCookies } from "@ionite/core/server";
 import { AccessAssignmentStore, AccessChange, ListOptions, ListResult, OaaAccessTargetType, SubjectType } from "@ionite/core";
 /**
 * In-memory store of granted access **roots** (source of truth). Roots are keyed by their
@@ -130,10 +130,29 @@ declare function deriveIonUrls(basePath: string): UrlMap;
 * Anything beyond a prototype needs durability: `@ionite/redis` / `@ionite/ioredis` stores, or
 * app-owned SQL stores. Authz stores (`catalogStore`, `accessStore`, `accessIndex`, `resources`)
 * are intentionally NOT included — they gate IAM/authz capabilities and must be chosen
-* deliberately (in-memory variants exist for prototypes: `InMemoryAccessCatalogStore`,
-* `InMemoryAccessAssignmentStore`, `InMemoryAccessIndex`, `InMemoryResourceStore`).
+* deliberately; {@link inMemoryAuthzStores} / {@link inMemoryAuthzDomains} are the explicit
+* prototype opt-in for those.
 */
 declare function devInMemoryStores(): FrameworkStores;
+type InMemoryAuthzStores = {
+	catalogStore: InMemoryAccessCatalogStore;
+	accessStore: InMemoryAccessAssignmentStore;
+	accessIndex: InMemoryAccessIndex;
+	resources: InMemoryResourceStore;
+};
+/**
+* Prototype-only authz store bundle — the deliberate opt-in that `devInMemoryStores` excludes.
+* Grants and catalog rows vanish on restart and are never shared across replicas; anything beyond
+* a prototype needs durable authz stores.
+*/
+declare function inMemoryAuthzStores(): InMemoryAuthzStores;
+/**
+* Lazily-created, isolated {@link inMemoryAuthzStores} bundles per authz domain: call with no
+* tenant id for the root domain, or with a tenant id for that tenant's domain. Isolation is the
+* point — grants in one tenant's domain must never be readable from another's, matching the
+* root-vs-tenant store split a durable deployment would use.
+*/
+declare function inMemoryAuthzDomains(): (tenantId?: string) => InMemoryAuthzStores;
 import { AwsSecretsConfig, ConfigSource, SecretsSource } from "@ionite/core";
 type AwsConfigSourceOptions = Omit<AwsSecretsConfig, "type"> & {
 	vault?: SecretsSource;
@@ -692,8 +711,35 @@ declare class InMemorySessionStore<TExtended = Record<string, never>> implements
 	update(sid: string, data: Partial<Session<TExtended>>): Promise<void>;
 	delete(sid: string): Promise<void>;
 }
+import { Group as Group3, Ionite as Ionite2 } from "@ionite/core";
+type MaterializeTenantOwnerEntitlementOptions = {
+	tenantId: string;
+	displayName?: string;
+};
+type PurgeTenantEntitlementsResult = {
+	revoked: number;
+	deleted: number;
+};
+/**
+* Publish the requestable owner entitlement for one tenant resource. This is an explicit
+* request-path lifecycle operation; it never runs during config apply. Pair with
+* {@link purgeTenantEntitlements} on tenant delete so the entitlement's grants cannot outlive
+* the tenant.
+*/
+declare function materializeTenantOwnerEntitlement(ion: Ionite2, options: MaterializeTenantOwnerEntitlementOptions): Promise<Group3>;
+/**
+* Security teardown for a deleted tenant: revokes every grant rooted at the tenant's requestable
+* owner entitlement (`tenant.owner.<tenantId>`) and then deletes that entitlement from the
+* catalog. Revocation must come first so a reused tenant id/slug can never resurrect a previous
+* customer's owner access. The shared non-requestable `tenant.owner` permission stays in the
+* catalog (every tenant's entitlement references it), and tenant resources are untouched
+* (`ResourceProvider` is read-only). Idempotent: a second call revokes and deletes nothing.
+*/
+declare function purgeTenantEntitlements(ion: Ionite2, options: {
+	tenantId: string;
+}): Promise<PurgeTenantEntitlementsResult>;
 import { BaseTenant as BaseTenant2, CreateTenantRequest, FrameworkTmConfig, TenantValidators, UpdateTenantRequest, Workload as Workload2 } from "@ionite/core";
-import { BaseTenant, ConfigLocator as ConfigLocator4, Ionite as Ionite2, LfvCallbackKind as LfvCallbackKind2, Logger as Logger5, RemoteConfig as RemoteConfig2, Secret as Secret3, SecretsSource as SecretsSource10, TenantStore } from "@ionite/core";
+import { BaseTenant, ConfigLocator as ConfigLocator4, Ionite as Ionite3, LfvCallbackKind as LfvCallbackKind2, Logger as Logger5, RemoteConfig as RemoteConfig2, Secret as Secret3, SecretsSource as SecretsSource10, TenantStore } from "@ionite/core";
 type TenantMirrorHooks<TTenant extends BaseTenant = BaseTenant> = {
 	onRemoteConfigChange?(tenant: TTenant, config: RemoteConfig2, secret: Secret3<Record<string, unknown>>): void | Promise<void>;
 	onRemoteConfigRevoke?(tenant: TTenant): void | Promise<void>;
@@ -724,7 +770,7 @@ type TenantMirror = {
 * Maintains per-tenant RemoteConfig mirrors. Tenant records own the upstream locators; app code owns
 * the destination source and path mapping.
 */
-declare function tenantMirror<TTenant extends BaseTenant = BaseTenant>(ion: Ionite2, options: TenantMirrorOptions<TTenant>): TenantMirror;
+declare function tenantMirror<TTenant extends BaseTenant = BaseTenant>(ion: Ionite3, options: TenantMirrorOptions<TTenant>): TenantMirror;
 type TenantManagerOptions<
 	TCreateTenantRequest extends CreateTenantRequest = CreateTenantRequest,
 	TUpdateTenantRequest extends UpdateTenantRequest = UpdateTenantRequest,
@@ -749,7 +795,7 @@ type TenantIonUrls = {
 	ionUrls: UrlMap;
 };
 declare function hashIntegrationHandle(handle: string): Promise<string>;
-import { Ionite as Ionite4, TenantPathNamespace, TenantRoutingStrategy } from "@ionite/core";
+import { Ionite as Ionite5, TenantPathNamespace, TenantRoutingStrategy } from "@ionite/core";
 type MaybePromise<T> = Promise<T> | T;
 type TenantResolutionContext = {
 	namespace: "api" | "ui";
@@ -768,23 +814,23 @@ type ResolveTenantFromRequestOptions = {
 };
 type CreateTenantIonResolverOptions = {
 	store: {
-		getIon(id: string): Promise<Ionite4 | undefined>;
+		getIon(id: string): Promise<Ionite5 | undefined>;
 	};
 	getIon?: never;
 } | {
 	store?: never;
-	getIon: (id: string) => Promise<Ionite4 | null | undefined>;
+	getIon: (id: string) => Promise<Ionite5 | null | undefined>;
 };
-type TenantIonResolver = (id: string) => Promise<Ionite4 | undefined>;
+type TenantIonResolver = (id: string) => Promise<Ionite5 | undefined>;
 type CreateTenantIonHandlerOptions = {
-	getIon: (id: string, request: Request) => MaybePromise<Ionite4 | null | undefined>;
+	getIon: (id: string, request: Request) => MaybePromise<Ionite5 | null | undefined>;
 	resolveTenant?: (request: Request) => MaybePromise<{
 		id: string;
 		context?: TenantResolutionContext;
 	} | string | null | undefined>;
 	rewriteRequest?: (request: Request, details: {
 		id: string;
-		ion: Ionite4;
+		ion: Ionite5;
 		context?: TenantResolutionContext;
 	}) => MaybePromise<Request>;
 	onMissingTenant?: (request: Request) => MaybePromise<Response>;
@@ -853,8 +899,8 @@ declare function closeAllVaultSockets(): void;
 *
 * Keep this synchronized with packages/server/package.json via publish.ts.
 */
-declare const ION_SDK_VERSION = "0.0.24-beta.20260922.10";
-import { Workload as CoreWorkload, FrameworkWorkloadConfig, Ionite as Ionite5, JWTAssertionClaims, Logger as Logger7, TokenValidationResult, TrustedIdp, WorkloadConfigMap, WorkloadGetToken, WorkloadIdentityStore as WorkloadIdentityStore2, WorkloadIncomingOutgoing, WorkloadTokenResponse, WorkloadTokenStore } from "@ionite/core";
+declare const ION_SDK_VERSION = "0.0.24-beta.20260922.11";
+import { Workload as CoreWorkload, FrameworkWorkloadConfig, Ionite as Ionite6, JWTAssertionClaims, Logger as Logger7, TokenValidationResult, TrustedIdp, WorkloadConfigMap, WorkloadGetToken, WorkloadIdentityStore as WorkloadIdentityStore2, WorkloadIncomingOutgoing, WorkloadTokenResponse, WorkloadTokenStore } from "@ionite/core";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 /**
 * Common fields shared across all workload authentication modes
@@ -1094,28 +1140,28 @@ declare function workload(validators: WorkloadValidators, log: Logger7, fromVaul
 /**
 * Get the workload identity from an incoming request.
 */
-declare function getWorkload(request: Request, ion: Ionite5): Promise<WorkloadIdentity | undefined>;
+declare function getWorkload(request: Request, ion: Ionite6): Promise<WorkloadIdentity | undefined>;
 /**
 * Get an access token for the configured workload identity.
 * Client is required and must be one of the configured outgoing workload clients.
 * Throws when no outgoing clients are configured on this Ionite instance.
 * Scope defaults to the config for the chosen client (e.g. workload.outgoing.<name>.scope); pass scope to override.
 */
-declare function getWorkloadToken(client: string, ion: Ionite5, scope?: string): Promise<string>;
+declare function getWorkloadToken(client: string, ion: Ionite6, scope?: string): Promise<string>;
 /**
 * Validate a workload token from an incoming request.
 * Accepts either an Ionite instance (uses its workload) or a Workload instance directly
 * (e.g. a server-only Workload used for tenant creation auth).
 */
-declare function validateWorkloadToken(request: Request, ionOrWorkload: Ionite5 | CoreWorkload): Promise<TokenValidationResult>;
+declare function validateWorkloadToken(request: Request, ionOrWorkload: Ionite6 | CoreWorkload): Promise<TokenValidationResult>;
 /**
 * Revoke a workload access token.
 */
-declare function revokeWorkloadToken(token: string, ion: Ionite5): Promise<void>;
+declare function revokeWorkloadToken(token: string, ion: Ionite6): Promise<void>;
 /**
 * Framework-agnostic request handler for the Workload module (token, validate, jwks, refresh routes).
 */
-declare function workloadHandler(request: Request, ion: Ionite5): Promise<Response>;
+declare function workloadHandler(request: Request, ion: Ionite6): Promise<Response>;
 import { BaseWorkloadIdentity as BaseWorkloadIdentity2, ListOptions as ListOptions5, ListResult as ListResult5, WorkloadIdentityStore as WorkloadIdentityStore3 } from "@ionite/core";
 /**
 * In-memory {@link WorkloadIdentityStore} implementation using Maps. Suitable for development and
@@ -1167,10 +1213,10 @@ type IoniteConfig<C extends FrameworkConfigInput = FrameworkConfigInput> = C & {
 	*/
 	readyTimeoutMs?: number;
 	beforeChange?: ConfigChangeCallback;
-	afterChange?: (ion: Ionite6, config: RemoteConfig3, frameworkConfig: ModifiableFrameworkConfig, oldConfig: RemoteConfig3 | undefined) => void;
+	afterChange?: (ion: Ionite7, config: RemoteConfig3, frameworkConfig: ModifiableFrameworkConfig, oldConfig: RemoteConfig3 | undefined) => void;
 	routing?: RoutingOptions2;
 	configRetry?: RemoteConfigRetryOptions;
 	onConfigLoadError?: RemoteConfigRetryHook;
 };
-declare function ionite<const C extends FrameworkConfigInput = FrameworkConfigInput>(source: ConfigSource9, config: IoniteConfig<C> | FrameworkConfigInput): Ionite6;
-export { AccessCheckReason, AccessCheckResult, AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, AssignmentPolicyError, AwsConfigSourceOptions, AzureConfigSourceOptions, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CapabilityDescriptor, CapabilityKey2 as CapabilityKey, CatalogAdjacencyCache, CatalogView, ConfigFromSourceOptions, CreateTenantIonHandlerOptions, CreateTenantIonResolverOptions, CreateTenantRequest2 as CreateTenantRequest, EnvConfigOptions, EnvironmentType, FrameworkOtelConfig, FrameworkStores3 as FrameworkStores, GcpConfigSourceOptions, HttpPollingHooks, ION_CAPABILITY_CATALOG, ION_CAPABILITY_CATALOG_VERSION, ION_READY_DEFAULT_TIMEOUT_MS, ION_SDK_VERSION, IamAssignmentPolicy, IamDeltaConfig, IamDeltaDeps, InMemoryAccessAssignmentStore, InMemoryAccessCatalogStore, InMemoryAccessIndex, InMemoryCustomerStore, InMemoryMagicLinkStore, InMemoryResourceStore, InMemorySessionStore, InMemoryTenantStore, InMemoryUserStore, InMemoryWorkloadIdentityStore, InMemoryWorkloadTokenStore, IoniteConfig, IoniteError, IoniteErrorOptions, LfvSecretsSource, MirrorSecretsOptions, MirroredConfigOptions, MirroredConfigSource, Otel, OtelConfig, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProviderType, OtelSignalConfig, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions, ResolveTenantFromRequestOptions, ScimOutboundClient, ScimOutboundClientOptions, ScimOutboundOutcome, ScimOutboundReceiptCallbacks, ScimOutboundResource, SecretsMirror, SessionDiscoveryOptions, SessionReadCacheOptions, SessionResponse, SubjectScope, SubjectType3 as SubjectType, TenantIonResolver, TenantIonUrls, TenantManagerOptions, TenantMirror, TenantMirrorHooks, TenantMirrorOptions, TenantResolutionContext, TenantResponse, TenantStatus, TenantValidators2 as TenantValidators, TenantWebhookPayload, UpdateTenantRequest2 as UpdateTenantRequest, UrlMap, VAULT_MIN_POLLING_TTL_MS, VaultConfigInvalidPayloadError, VaultConfigSourceOptions, VaultConfigWaitingForSecretError, VaultSubscribeNotSupportedError, VerifyUserOptions, allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, awsConfig, azureConfig, blockDangerousUrls, callback, captureRedirect, ciam, closeAllVaultSockets, collectReferencedDefinitions, configFromSource, configLocatorFromEnvValues, configSourceFromEnvValues, configSourceFromLocator, createManagedIamDelta, createSessionReadCache, createTenantIonHandler, createTenantIonResolver, defaultRedirectPolicies, deriveIonUrls, devInMemoryStores, discoverSessionRecords, discoverSessions, enforceEndpointAuthz, envConfig, escapeScimFilterValue, expandRoot, gcpConfig, generateULID, getCustomer, getUser, getWorkload, getWorkloadToken, has, hasAll2 as hasAll, hasAllScope, hasAny2 as hasAny, hasAnyScope, hasGroup2 as hasGroup, hasPermission2 as hasPermission, hasRole2 as hasRole, hasScope, hashIntegrationHandle, iam, initiateLogin, ionite, isRedirectAllowed, isVaultConfigInvalidPayloadError, isVaultConfigWaitingForSecretError, lfvVault, listGenerator, listSsoClientIdsFromCookies, mirrorSecrets, mirroredConfig, reconcileSubjectAccess, resolveAfterRedirect, resolveCapturedRedirect, resolveDefaultRoute, resolveRedirect, resolveTenantFromRequest, revokeWorkloadToken, rewriteRequestForDefaultTenantApi, rewriteRequestForDefaultTenantUi, rewriteRequestForTenantPath, rewriteRequestPath, routeRequest, sameOriginRedirectRules, secretConfigSource, sendTenantWebhook, setVaultWebSocketCommandTimeout, sso, subscribeSecretPathWithHttpPolling, tenantMirror, validateWorkloadToken, vault, vaultConfig, vaultSocketDiagnostics, verifyUser, withSetCookies, workload, workloadHandler };
+declare function ionite<const C extends FrameworkConfigInput = FrameworkConfigInput>(source: ConfigSource9, config: IoniteConfig<C> | FrameworkConfigInput): Ionite7;
+export { AccessCheckReason, AccessCheckResult, AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, AssignmentPolicyError, AwsConfigSourceOptions, AzureConfigSourceOptions, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CapabilityDescriptor, CapabilityKey2 as CapabilityKey, CatalogAdjacencyCache, CatalogView, ConfigFromSourceOptions, CreateTenantIonHandlerOptions, CreateTenantIonResolverOptions, CreateTenantRequest2 as CreateTenantRequest, EnvConfigOptions, EnvironmentType, FrameworkOtelConfig, FrameworkStores3 as FrameworkStores, GcpConfigSourceOptions, HttpPollingHooks, ION_CAPABILITY_CATALOG, ION_CAPABILITY_CATALOG_VERSION, ION_READY_DEFAULT_TIMEOUT_MS, ION_SDK_VERSION, IamAssignmentPolicy, IamDeltaConfig, IamDeltaDeps, InMemoryAccessAssignmentStore, InMemoryAccessCatalogStore, InMemoryAccessIndex, InMemoryAuthzStores, InMemoryCustomerStore, InMemoryMagicLinkStore, InMemoryResourceStore, InMemorySessionStore, InMemoryTenantStore, InMemoryUserStore, InMemoryWorkloadIdentityStore, InMemoryWorkloadTokenStore, IoniteConfig, IoniteError, IoniteErrorOptions, LfvSecretsSource, MaterializeTenantOwnerEntitlementOptions, MirrorSecretsOptions, MirroredConfigOptions, MirroredConfigSource, Otel, OtelConfig, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProviderType, OtelSignalConfig, PurgeTenantEntitlementsResult, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions, ResolveTenantFromRequestOptions, ResolveTenantOwnerOptions, ResolveTenantSessionOptions, ScimOutboundClient, ScimOutboundClientOptions, ScimOutboundOutcome, ScimOutboundReceiptCallbacks, ScimOutboundResource, SecretsMirror, SessionDiscoveryOptions, SessionReadCacheOptions, SessionResponse, SubjectScope, SubjectType3 as SubjectType, TENANT_OWNER_PERMISSION, TenantAccessDenial, TenantAccessDenialReason, TenantAccessLoginUrlOptions, TenantAccessResult, TenantAccessSession, TenantAccessSessionKind, TenantIonResolver, TenantIonUrls, TenantManagerOptions, TenantMirror, TenantMirrorHooks, TenantMirrorOptions, TenantResolutionContext, TenantResponse, TenantStatus, TenantValidators2 as TenantValidators, TenantWebhookPayload, UpdateTenantRequest2 as UpdateTenantRequest, UrlMap, VAULT_MIN_POLLING_TTL_MS, VaultConfigInvalidPayloadError, VaultConfigSourceOptions, VaultConfigWaitingForSecretError, VaultSubscribeNotSupportedError, VerifyUserOptions, allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, awsConfig, azureConfig, blockDangerousUrls, callback, captureRedirect, ciam, closeAllVaultSockets, collectReferencedDefinitions, configFromSource, configLocatorFromEnvValues, configSourceFromEnvValues, configSourceFromLocator, createManagedIamDelta, createSessionReadCache, createTenantIonHandler, createTenantIonResolver, defaultRedirectPolicies, deriveIonUrls, devInMemoryStores, discoverSessionRecords, discoverSessions, enforceEndpointAuthz, envConfig, escapeScimFilterValue, expandRoot, gcpConfig, generateULID, getCustomer, getOwnedTenantIds, getUser, getWorkload, getWorkloadToken, has, hasAll2 as hasAll, hasAllScope, hasAny2 as hasAny, hasAnyScope, hasGroup2 as hasGroup, hasPermission2 as hasPermission, hasRole2 as hasRole, hasScope, hashIntegrationHandle, iam, inMemoryAuthzDomains, inMemoryAuthzStores, initiateLogin, ionite, isRedirectAllowed, isVaultConfigInvalidPayloadError, isVaultConfigWaitingForSecretError, lfvVault, listGenerator, listSsoClientIdsFromCookies, materializeTenantOwnerEntitlement, mirrorSecrets, mirroredConfig, purgeTenantEntitlements, reconcileSubjectAccess, resolveAfterRedirect, resolveCapturedRedirect, resolveDefaultRoute, resolveRedirect, resolveTenantFromRequest, resolveTenantOwner, resolveTenantSession, revokeWorkloadToken, rewriteRequestForDefaultTenantApi, rewriteRequestForDefaultTenantUi, rewriteRequestForTenantPath, rewriteRequestPath, routeRequest, sameOriginRedirectRules, secretConfigSource, sendTenantWebhook, setVaultWebSocketCommandTimeout, sso, subscribeSecretPathWithHttpPolling, tenantAccessLoginUrl, tenantMirror, tenantOwnerEntitlementId, tenantOwnerPermission, tenantResourceId, validateWorkloadToken, vault, vaultConfig, vaultSocketDiagnostics, verifyUser, withSetCookies, workload, workloadHandler };