@ionite/server 0.0.24-beta.20261003.17 → 0.0.24-beta.20261006.21

package/dist/index.d.ts

@@ -2,7 +2,7 @@ import { ConfigChangeCallback, ConfigSource as ConfigSource9, FrameworkConfigInp
 import { CapabilityKey as CapabilityKey2 } from "@ionite/core";
 export * from "@ionite/core";
 import { AccessCheckReason, AccessCheckResult, AssignmentPolicyError, CreateTenantRequest as CreateTenantRequest2, EnvironmentType, FrameworkOtelConfig, FrameworkStores as FrameworkStores3, generateULID, IamAssignmentPolicy, IoniteError, IoniteErrorOptions, listGenerator, Otel, OtelConfig, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProviderType, OtelSignalConfig, SubjectScope, SubjectType as SubjectType3, TenantResponse, TenantStatus, TenantValidators as TenantValidators2, TenantWebhookPayload, UpdateTenantRequest as UpdateTenantRequest2 } from "@ionite/core";
-import { AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CatalogView, DiscoveredTenantCookie, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions, ResolveTenantOwnerOptions, ResolveTenantSessionOptions, TenantAccessDenial, TenantAccessDenialReason, TenantAccessLoginUrlOptions, TenantAccessResult, TenantAccessSession, TenantAccessSessionKind } from "@ionite/core/server";
+import { AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CatalogView as CatalogView2, DiscoveredTenantCookie, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions, ResolveTenantOwnerOptions, ResolveTenantSessionOptions, TenantAccessDenial, TenantAccessDenialReason, TenantAccessLoginUrlOptions, TenantAccessResult, TenantAccessSession, TenantAccessSessionKind } from "@ionite/core/server";
 import { allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, blockDangerousUrls, CatalogAdjacencyCache, callback, captureRedirect, ciam, collectReferencedDefinitions, defaultRedirectPolicies, discoverSessionRecords, discoverSessions, expandRoot, getCustomer, getOwnedTenantIds, getUser, has, hasAll as hasAll2, hasAllScope, hasAny as hasAny2, hasAnyScope, hasGroup as hasGroup2, hasPermission as hasPermission2, hasRole as hasRole2, hasScope, InMemoryTenantStore, iam, initiateLogin, isRedirectAllowed, listSsoClientIdsFromCookies, planDiscoveredTenantCookies, reconcileSubjectAccess, resolveAfterRedirect, resolveCapturedRedirect, resolveRedirect, resolveTenantOwner, resolveTenantSession, SessionDiscoveryOptions as SessionDiscoveryOptions2, SessionResponse, sameOriginRedirectRules, sendTenantWebhook, sso, TENANT_OWNER_PERMISSION, tenantAccessLoginUrl, tenantOwnerEntitlementId, tenantOwnerPermission, tenantResourceId, VerifyUserOptions, verifyUser, withSetCookies } from "@ionite/core/server";
 import { AccessAssignmentStore, AccessChange, ListOptions, ListResult, OaaAccessTargetType, SubjectType } from "@ionite/core";
 /**
@@ -388,7 +388,7 @@ import { CapabilityKey, ModuleName } from "@ionite/core";
 * Version of the stable capability vocabulary emitted by capabilitiez and used by ECV result IDs.
 * Increment only when capability/test-unit identity changes, not for ordinary SDK releases.
 */
-declare const ION_CAPABILITY_CATALOG_VERSION = 2;
+declare const ION_CAPABILITY_CATALOG_VERSION = 4;
 type CapabilityDescriptor = {
 	/**
 	* Stable machine key (also the catalog map key). This is the SAME key the runtime `capabilitiez`
@@ -421,6 +421,12 @@ declare const ION_CAPABILITY_CATALOG: readonly [{
 	readonly key: "sso.back_channel_logout";
 	readonly module: "sso";
 	readonly label: "SSO back-channel logout";
+}, {
+	readonly key: "sso.claims_authz";
+	readonly module: "sso";
+	readonly label: "SSO claim-derived entitlements";
+	readonly requires: "sessionStore.capabilities.derivedEntitlements";
+	readonly incapableReason: "The session store does not declare capabilities.derivedEntitlements, so claim-derived entitlements are not persisted.";
 }, {
 	readonly key: "ciam.magic_link";
 	readonly module: "ciam";
@@ -437,6 +443,12 @@ declare const ION_CAPABILITY_CATALOG: readonly [{
 	readonly key: "ciam.logout";
 	readonly module: "ciam";
 	readonly label: "CIAM logout";
+}, {
+	readonly key: "ciam.claims_authz";
+	readonly module: "ciam";
+	readonly label: "CIAM claim-derived entitlements";
+	readonly requires: "sessionStore.capabilities.derivedEntitlements";
+	readonly incapableReason: "The session store does not declare capabilities.derivedEntitlements, so claim-derived entitlements are not persisted.";
 }, {
 	readonly key: "iam.users";
 	readonly module: "iam";
@@ -447,8 +459,14 @@ declare const ION_CAPABILITY_CATALOG: readonly [{
 	readonly key: "iam.groups";
 	readonly module: "iam";
 	readonly label: "SCIM Groups inbound";
-	readonly requires: "AccessCatalogStore";
-	readonly incapableReason: "SCIM Groups endpoint is enabled by RemoteConfig but no AccessCatalogStore capability is wired by the application.";
+	readonly requires: "AccessCatalogStore or authz.catalog";
+	readonly incapableReason: "SCIM Groups endpoint is enabled by RemoteConfig but no catalog capability is wired by the application.";
+}, {
+	readonly key: "iam.groups.create";
+	readonly module: "iam";
+	readonly label: "IAM-sourced entitlement creation";
+	readonly requires: "AccessCatalogStore + authz.onInboundEntitlement";
+	readonly incapableReason: "The application has not wired durable catalog storage and explicitly opted into IAM-sourced entitlements.";
 }, {
 	readonly key: "iam.workloads";
 	readonly module: "iam";
@@ -469,12 +487,20 @@ declare const ION_CAPABILITY_CATALOG: readonly [{
 	readonly key: "workload.outgoing";
 	readonly module: "workload";
 	readonly label: "Workload outgoing token minting";
+}, {
+	readonly key: "workload.claims_authz";
+	readonly module: "workload";
+	readonly label: "Workload claim-derived entitlements";
 }, {
 	readonly key: "authz.oaa";
 	readonly module: "authz";
 	readonly label: "Authz OAA projection (Veza)";
 	readonly requires: "AccessAssignmentStore + AccessCatalogStore";
 	readonly incapableReason: "OAA projection is configured by RemoteConfig but no access/catalog store capability is wired by the application.";
+}, {
+	readonly key: "authz.access_requests";
+	readonly module: "authz";
+	readonly label: "IdP access-request lifecycle";
 }, {
 	readonly key: "tm.integration";
 	readonly module: "tm";
@@ -528,8 +554,8 @@ import { Ionite, ResolvedRoute, RoutingOptions } from "@ionite/core";
 /**
 * Deny-by-default authorization gate for a resolved SDK route. Returns the 401/403 `Response` to
 * short-circuit with when the caller is not authorized, or `undefined` to proceed. Enforcement reuses
-* the request-level `hasPermission` helper so a granted entitlement OR a matching OAuth scope (when
-* `RemoteConfig.authz.scopesAsEntitlements` is enabled) satisfies the gate; the `response()` already
+* the request-level `hasPermission` helper so a granted entitlement OR a claim-derived entitlement
+* (the issuing IdP's `claimsAsEntitlements` block) satisfies the gate; the `response()` already
 * logs the denial server-side without leaking the missing permission to the caller.
 */
 declare function enforceEndpointAuthz(request: Request, ion: Ionite, required: NonNullable<ResolvedRoute["requiredPermission"]>): Promise<Response | undefined>;
@@ -776,6 +802,9 @@ import { Session, SessionStore as SessionStore3 } from "@ionite/core";
 * prefer a TTL-backed store.
 */
 declare class InMemorySessionStore<TExtended = Record<string, never>> implements SessionStore3<TExtended> {
+	readonly capabilities: {
+		readonly derivedEntitlements: true;
+	};
 	private sessions;
 	create(session: Session<TExtended>): Promise<void>;
 	get(sid: string): Promise<Session<TExtended> | null>;
@@ -970,8 +999,9 @@ declare function closeAllVaultSockets(): void;
 *
 * Keep this synchronized with packages/server/package.json via publish.ts.
 */
-declare const ION_SDK_VERSION = "0.0.24-beta.20261003.17";
-import { Workload as CoreWorkload, FrameworkWorkloadConfig, Ionite as Ionite7, JWTAssertionClaims, Logger as Logger7, TokenValidationResult, TrustedIdp, WorkloadConfigMap, WorkloadGetToken, WorkloadIdentityStore as WorkloadIdentityStore2, WorkloadIncomingOutgoing, WorkloadTokenResponse, WorkloadTokenStore } from "@ionite/core";
+declare const ION_SDK_VERSION = "0.0.24-beta.20261006.21";
+import { ClaimsAsEntitlements, Workload as CoreWorkload, DerivedEntitlement, FrameworkWorkloadConfig, Ionite as Ionite7, JWTAssertionClaims, Logger as Logger7, TokenValidationResult, TrustedIdp, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentityStore as WorkloadIdentityStore2, WorkloadIncomingOutgoing, WorkloadTokenResponse, WorkloadTokenStore } from "@ionite/core";
+import { CatalogView } from "@ionite/core/server";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 /**
 * Common fields shared across all workload authentication modes
@@ -1002,9 +1032,9 @@ type WorkloadConfigBase = {
 	*/
 	audience?: string;
 	/**
-	* Per-IdP scopesAsEntitlements intent (incoming/server role only). See core `WorkloadConfigBase`.
+	* Per-IdP claims intent (incoming/server role only). See core `WorkloadConfigBase`.
 	*/
-	scopesAsEntitlements?: boolean;
+	claimsAsEntitlements?: ClaimsAsEntitlements;
 	/**
 	* Default OAuth2 scopes (space-delimited)
 	*/
@@ -1114,23 +1144,10 @@ type ClientCredentialsWorkloadConfig = WorkloadConfigBase & {
 	*/
 	clientId: string;
 	/**
-	* OAuth2 client secret. Omit it to authenticate with a federated token instead
-	* (see `federatedTokenFile`). A client secret wins when both are present.
-	*/
-	clientSecret?: string;
-	/**
-	* Path to a projected federated token (e.g. AKS Workload Identity), sent as a jwt-bearer
-	* `client_assertion` in place of `client_secret`. Defaults to `AZURE_FEDERATED_TOKEN_FILE`.
-	* Read on every acquisition because the platform rotates it.
-	*/
-	federatedTokenFile?: string;
-	/**
-	* `managed_identity`: get the token from the platform's managed identity endpoint instead of an
-	* IdP token URL — `IDENTITY_ENDPOINT` + `IDENTITY_HEADER` (Container Apps, App Service) or IMDS
-	* (ACI, VMs). `clientId` is the managed identity's client ID and `scope` names the audience
-	* (`<appId>/.default` → resource `<appId>`). No secret, token file or `idpTokenUrl` is needed.
+	* OAuth2 client secret
+	* REQUIRED for Client Credentials mode
 	*/
-	authMethod?: "managed_identity";
+	clientSecret: string;
 };
 /**
 * Server-Only Workload Configuration
@@ -1164,7 +1181,7 @@ type ServerOnlyWorkloadConfig = WorkloadConfigBase & {
 * detected based on which fields are present:
 *
 * - **JWT Bearer Grant**: Requires `workload_id` + `private_key`
-* - **Client Credentials**: Requires `client_id` + `client_secret`, a federated token file, or `authMethod: "managed_identity"`
+* - **Client Credentials**: Requires `client_id` + `client_secret`
 * - **Server-Only**: Only `jwks_uri` (and optionally `issuer`) for token validation
 *
 * The developer uses the same API regardless of mode - the library handles the details.
@@ -1187,10 +1204,9 @@ type WorkloadIdentity = {
 	*/
 	scope?: string;
 	/**
-	* Whether the trusted IdP that validated this token opts into honoring its OAuth `scope` claim as
-	* entitlements (per-IdP intent, resolved at validation time).
+	* Claim-derived entitlements for this request, when the matched IdP configured `claimsAsEntitlements`.
 	*/
-	scopesAsEntitlements?: boolean;
+	derivedEntitlements?: DerivedEntitlement[];
 	/**
 	* Enterprise Controlled ID for this workload (`ecid:<realm>:<opaque>`), when carried on the token
 	* `ecid` claim or enriched from a wired `WorkloadIdentityStore`. A workload is its own governance
@@ -1207,6 +1223,7 @@ type WorkloadIdentity = {
 */
 type Workload3 = {
 	config: WorkloadConfig;
+	describe: () => WorkloadDescription;
 	beforeChange?: (listener: () => void) => () => void;
 	afterChange?: (listener: () => void) => () => void;
 	isReady: () => boolean;
@@ -1220,7 +1237,7 @@ type Workload3 = {
 	parseJWT: (token: string) => Promise<JWTAssertionClaims>;
 	handler: (request: Request) => Promise<Response>;
 };
-declare function workload(validators: WorkloadValidators, log: Logger7, fromVault?: Partial<WorkloadConfig> | WorkloadConfigMap | WorkloadIncomingOutgoing, fromCode?: FrameworkWorkloadConfig, incomingTrustOverride?: TrustedIdp[]): Workload3 | undefined;
+declare function workload(validators: WorkloadValidators, log: Logger7, fromVault?: Partial<WorkloadConfig> | WorkloadConfigMap | WorkloadIncomingOutgoing, fromCode?: FrameworkWorkloadConfig, incomingTrustOverride?: TrustedIdp[], catalogView?: () => CatalogView | undefined): Workload3 | undefined;
 /**
 * Get the workload identity from an incoming request.
 */
@@ -1303,4 +1320,4 @@ type IoniteConfig<C extends FrameworkConfigInput = FrameworkConfigInput> = C & {
 	onConfigLoadError?: RemoteConfigRetryHook;
 };
 declare function ionite<const C extends FrameworkConfigInput = FrameworkConfigInput>(source: ConfigSource9, config: IoniteConfig<C> | FrameworkConfigInput): Ionite8;
-export { AccessCheckReason, AccessCheckResult, AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, AssignmentPolicyError, AwsConfigSourceOptions, AzureConfigSourceOptions, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CapabilityDescriptor, CapabilityKey2 as CapabilityKey, CatalogAdjacencyCache, CatalogView, ConfigFromSourceOptions, CreateTenantIonHandlerOptions, CreateTenantIonResolverOptions, CreateTenantRequest2 as CreateTenantRequest, DiscoveredTenantCookie, EnvConfigOptions, EnvironmentType, FrameworkOtelConfig, FrameworkStores3 as FrameworkStores, GcpConfigSourceOptions, GetSessionEntriesOptions, HttpPollingHooks, ION_CAPABILITY_CATALOG, ION_CAPABILITY_CATALOG_VERSION, ION_READY_DEFAULT_TIMEOUT_MS, ION_SDK_VERSION, IamAssignmentPolicy, IamDeltaConfig, IamDeltaDeps, InMemoryAccessAssignmentStore, InMemoryAccessCatalogStore, InMemoryAccessIndex, InMemoryAuthzStores, InMemoryCustomerStore, InMemoryMagicLinkStore, InMemoryResourceStore, InMemorySessionStore, InMemoryTenantStore, InMemoryUserStore, InMemoryWorkloadIdentityStore, InMemoryWorkloadTokenStore, IoniteConfig, IoniteError, IoniteErrorOptions, LfvSecretsSource, MaterializeTenantOwnerEntitlementOptions, MirrorSecretsOptions, MirroredConfigOptions, MirroredConfigSource, Otel, OtelConfig, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProviderType, OtelSignalConfig, PurgeTenantEntitlementsResult, ReadinessLatch, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions, ResolveTenantFromRequestOptions, ResolveTenantOwnerOptions, ResolveTenantSessionOptions, ScimOutboundClient, ScimOutboundClientOptions, ScimOutboundOutcome, ScimOutboundReceiptCallbacks, ScimOutboundResource, SecretsMirror, SessionDiscoveryOptions2 as SessionDiscoveryOptions, SessionIdentityGroup, SessionListEntry, SessionListSource, SessionReadCacheOptions, SessionResponse, SubjectScope, SubjectType3 as SubjectType, TENANT_OWNER_PERMISSION, TenantAccessDenial, TenantAccessDenialReason, TenantAccessLoginUrlOptions, TenantAccessResult, TenantAccessSession, TenantAccessSessionKind, TenantIonResolver, TenantIonUrls, TenantManagerOptions, TenantMirror, TenantMirrorHooks, TenantMirrorOptions, TenantResolutionContext, TenantResponse, TenantStatus, TenantValidators2 as TenantValidators, TenantWebhookPayload, UpdateTenantRequest2 as UpdateTenantRequest, UrlMap, VAULT_MIN_POLLING_TTL_MS, VaultConfigInvalidPayloadError, VaultConfigSourceOptions, VaultConfigWaitingForSecretError, VaultSubscribeNotSupportedError, VerifyUserOptions, allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, awsConfig, azureConfig, blockDangerousUrls, callback, captureRedirect, ciam, closeAllVaultSockets, collectReferencedDefinitions, configFromSource, configLocatorFromEnvValues, configSourceFromEnvValues, configSourceFromLocator, createManagedIamDelta, createReadinessLatch, createSessionReadCache, createTenantIonHandler, createTenantIonResolver, defaultRedirectPolicies, deriveIonUrls, devInMemoryStores, discoverSessionRecords, discoverSessions, enforceEndpointAuthz, envConfig, escapeScimFilterValue, expandRoot, gcpConfig, generateULID, getCustomer, getOwnedTenantIds, getSessionEntries, getUser, getWorkload, getWorkloadToken, has, hasAll2 as hasAll, hasAllScope, hasAny2 as hasAny, hasAnyScope, hasGroup2 as hasGroup, hasPermission2 as hasPermission, hasRole2 as hasRole, hasScope, hashIntegrationHandle, iam, inMemoryAuthzDomains, inMemoryAuthzStores, initiateLogin, ionite, isRedirectAllowed, isVaultConfigInvalidPayloadError, isVaultConfigWaitingForSecretError, lfvVault, listGenerator, listSsoClientIdsFromCookies, materializeTenantOwnerEntitlement, mirrorSecrets, mirroredConfig, planDiscoveredTenantCookies, purgeTenantEntitlements, reconcileSubjectAccess, resolveAfterRedirect, resolveCapturedRedirect, resolveDefaultRoute, resolveRedirect, resolveTenantFromRequest, resolveTenantOwner, resolveTenantSession, revokeWorkloadToken, rewriteRequestForDefaultTenantApi, rewriteRequestForDefaultTenantUi, rewriteRequestForTenantPath, rewriteRequestPath, routeRequest, sameOriginRedirectRules, secretConfigSource, sendTenantWebhook, setVaultWebSocketCommandTimeout, sso, subscribeSecretPathWithHttpPolling, tenantAccessLoginUrl, tenantMirror, tenantOwnerEntitlementId, tenantOwnerPermission, tenantResourceId, validateWorkloadToken, vault, vaultConfig, vaultSocketDiagnostics, verifyUser, withSetCookies, workload, workloadHandler };
+export { AccessCheckReason, AccessCheckResult, AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, AssignmentPolicyError, AwsConfigSourceOptions, AzureConfigSourceOptions, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CapabilityDescriptor, CapabilityKey2 as CapabilityKey, CatalogAdjacencyCache, CatalogView2 as CatalogView, ConfigFromSourceOptions, CreateTenantIonHandlerOptions, CreateTenantIonResolverOptions, CreateTenantRequest2 as CreateTenantRequest, DiscoveredTenantCookie, EnvConfigOptions, EnvironmentType, FrameworkOtelConfig, FrameworkStores3 as FrameworkStores, GcpConfigSourceOptions, GetSessionEntriesOptions, HttpPollingHooks, ION_CAPABILITY_CATALOG, ION_CAPABILITY_CATALOG_VERSION, ION_READY_DEFAULT_TIMEOUT_MS, ION_SDK_VERSION, IamAssignmentPolicy, IamDeltaConfig, IamDeltaDeps, InMemoryAccessAssignmentStore, InMemoryAccessCatalogStore, InMemoryAccessIndex, InMemoryAuthzStores, InMemoryCustomerStore, InMemoryMagicLinkStore, InMemoryResourceStore, InMemorySessionStore, InMemoryTenantStore, InMemoryUserStore, InMemoryWorkloadIdentityStore, InMemoryWorkloadTokenStore, IoniteConfig, IoniteError, IoniteErrorOptions, LfvSecretsSource, MaterializeTenantOwnerEntitlementOptions, MirrorSecretsOptions, MirroredConfigOptions, MirroredConfigSource, Otel, OtelConfig, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProviderType, OtelSignalConfig, PurgeTenantEntitlementsResult, ReadinessLatch, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions, ResolveTenantFromRequestOptions, ResolveTenantOwnerOptions, ResolveTenantSessionOptions, ScimOutboundClient, ScimOutboundClientOptions, ScimOutboundOutcome, ScimOutboundReceiptCallbacks, ScimOutboundResource, SecretsMirror, SessionDiscoveryOptions2 as SessionDiscoveryOptions, SessionIdentityGroup, SessionListEntry, SessionListSource, SessionReadCacheOptions, SessionResponse, SubjectScope, SubjectType3 as SubjectType, TENANT_OWNER_PERMISSION, TenantAccessDenial, TenantAccessDenialReason, TenantAccessLoginUrlOptions, TenantAccessResult, TenantAccessSession, TenantAccessSessionKind, TenantIonResolver, TenantIonUrls, TenantManagerOptions, TenantMirror, TenantMirrorHooks, TenantMirrorOptions, TenantResolutionContext, TenantResponse, TenantStatus, TenantValidators2 as TenantValidators, TenantWebhookPayload, UpdateTenantRequest2 as UpdateTenantRequest, UrlMap, VAULT_MIN_POLLING_TTL_MS, VaultConfigInvalidPayloadError, VaultConfigSourceOptions, VaultConfigWaitingForSecretError, VaultSubscribeNotSupportedError, VerifyUserOptions, allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, awsConfig, azureConfig, blockDangerousUrls, callback, captureRedirect, ciam, closeAllVaultSockets, collectReferencedDefinitions, configFromSource, configLocatorFromEnvValues, configSourceFromEnvValues, configSourceFromLocator, createManagedIamDelta, createReadinessLatch, createSessionReadCache, createTenantIonHandler, createTenantIonResolver, defaultRedirectPolicies, deriveIonUrls, devInMemoryStores, discoverSessionRecords, discoverSessions, enforceEndpointAuthz, envConfig, escapeScimFilterValue, expandRoot, gcpConfig, generateULID, getCustomer, getOwnedTenantIds, getSessionEntries, getUser, getWorkload, getWorkloadToken, has, hasAll2 as hasAll, hasAllScope, hasAny2 as hasAny, hasAnyScope, hasGroup2 as hasGroup, hasPermission2 as hasPermission, hasRole2 as hasRole, hasScope, hashIntegrationHandle, iam, inMemoryAuthzDomains, inMemoryAuthzStores, initiateLogin, ionite, isRedirectAllowed, isVaultConfigInvalidPayloadError, isVaultConfigWaitingForSecretError, lfvVault, listGenerator, listSsoClientIdsFromCookies, materializeTenantOwnerEntitlement, mirrorSecrets, mirroredConfig, planDiscoveredTenantCookies, purgeTenantEntitlements, reconcileSubjectAccess, resolveAfterRedirect, resolveCapturedRedirect, resolveDefaultRoute, resolveRedirect, resolveTenantFromRequest, resolveTenantOwner, resolveTenantSession, revokeWorkloadToken, rewriteRequestForDefaultTenantApi, rewriteRequestForDefaultTenantUi, rewriteRequestForTenantPath, rewriteRequestPath, routeRequest, sameOriginRedirectRules, secretConfigSource, sendTenantWebhook, setVaultWebSocketCommandTimeout, sso, subscribeSecretPathWithHttpPolling, tenantAccessLoginUrl, tenantMirror, tenantOwnerEntitlementId, tenantOwnerPermission, tenantResourceId, validateWorkloadToken, vault, vaultConfig, vaultSocketDiagnostics, verifyUser, withSetCookies, workload, workloadHandler };