@ionite/server 0.0.24-beta.20261006.22 → 0.0.24-beta.20261007.23

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { ConfigChangeCallback, ConfigSource as ConfigSource9, FrameworkConfigInput, FrameworkStores as FrameworkStores2, Ionite as Ionite8, ModifiableFrameworkConfig, RemoteConfig as RemoteConfig3, RemoteConfigRetryHook, RemoteConfigRetryOptions, RoutingOptions as RoutingOptions2 } from "@ionite/core";
 import { CapabilityKey as CapabilityKey2 } from "@ionite/core";
 export * from "@ionite/core";
-import { AccessCheckReason, AccessCheckResult, AssignmentPolicyError, CreateTenantRequest as CreateTenantRequest2, EnvironmentType, FrameworkOtelConfig, FrameworkStores as FrameworkStores3, generateULID, IamAssignmentPolicy, IoniteError, IoniteErrorOptions, listGenerator, Otel, OtelConfig, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProviderType, OtelSignalConfig, SubjectScope, SubjectType as SubjectType3, TenantResponse, TenantStatus, TenantValidators as TenantValidators2, TenantWebhookPayload, UpdateTenantRequest as UpdateTenantRequest2 } from "@ionite/core";
+import { AccessCheckReason, AccessCheckResult, AssignmentPolicyError, CreateTenantRequest as CreateTenantRequest2, EnvironmentType, FrameworkOtelConfig, FrameworkStores as FrameworkStores3, generateULID, IamAssignmentPolicy, IoniteError as IoniteError4, IoniteErrorOptions, listGenerator, Otel, OtelConfig, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProviderType, OtelSignalConfig, SubjectScope, SubjectType as SubjectType3, TenantResponse, TenantStatus, TenantValidators as TenantValidators2, TenantWebhookPayload, UpdateTenantRequest as UpdateTenantRequest2 } from "@ionite/core";
 import { AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CatalogView as CatalogView2, DiscoveredTenantCookie, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions, ResolveTenantOwnerOptions, ResolveTenantSessionOptions, TenantAccessDenial, TenantAccessDenialReason, TenantAccessLoginUrlOptions, TenantAccessResult, TenantAccessSession, TenantAccessSessionKind } from "@ionite/core/server";
 import { allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, blockDangerousUrls, CatalogAdjacencyCache, callback, captureRedirect, ciam, collectReferencedDefinitions, defaultRedirectPolicies, discoverSessionRecords, discoverSessions, expandRoot, getCustomer, getOwnedTenantIds, getUser, has, hasAll as hasAll2, hasAllScope, hasAny as hasAny2, hasAnyScope, hasGroup as hasGroup2, hasPermission as hasPermission2, hasRole as hasRole2, hasScope, InMemoryTenantStore, iam, initiateLogin, isRedirectAllowed, listSsoClientIdsFromCookies, planDiscoveredTenantCookies, reconcileSubjectAccess, resolveAfterRedirect, resolveCapturedRedirect, resolveRedirect, resolveTenantOwner, resolveTenantSession, SessionDiscoveryOptions as SessionDiscoveryOptions2, SessionResponse, sameOriginRedirectRules, sendTenantWebhook, sso, TENANT_OWNER_PERMISSION, tenantAccessLoginUrl, tenantOwnerEntitlementId, tenantOwnerPermission, tenantResourceId, VerifyUserOptions, verifyUser, withSetCookies } from "@ionite/core/server";
 import { AccessAssignmentStore, AccessChange, ListOptions, ListResult, OaaAccessTargetType, SubjectType } from "@ionite/core";
@@ -109,6 +109,22 @@ declare class InMemoryAccessIndex implements AccessIndex {
 	private dropEdge;
 	private removeFromSet;
 }
+import { ActionRequiredInput, ActionRequiredPlan } from "@ionite/core";
+/** Default lifetime of an `action_required` request token when RemoteConfig omits one. */
+declare const DEFAULT_REQUEST_TOKEN_TTL_SECONDS = 3600;
+type PlanActionRequiredInput = ActionRequiredInput & {
+	/** Token lifetime. Defaults to {@link DEFAULT_REQUEST_TOKEN_TTL_SECONDS}. */
+	ttlSeconds?: number;
+	now?: number;
+};
+/**
+* Mint the three fields Tenant Management requires for `action_required`. The App supplies the
+* completion path and public origin; the lifetime is the Ops default unless overridden.
+* Prefer `ion.tm.actionRequired(...)`, which applies `RemoteConfig.tm.requestTokenTtlSeconds`.
+*/
+declare function planActionRequired(input: PlanActionRequiredInput): ActionRequiredPlan;
+/** A missing or unparseable expiry is expired: an action link without a deadline must not stay valid. */
+declare function isRequestTokenExpired(expiresAt?: string, now?: number): boolean;
 import { CapabilityEndpointUrls, FrameworkStores } from "@ionite/core";
 /**
 * Deterministic set of ionite endpoint paths derived from a single `basePath`.
@@ -290,16 +306,16 @@ import { ConfigSource as ConfigSource7, SecretsSource as SecretsSource7 } from "
 */
 declare function secretConfigSource(source: SecretsSource7, path: string): ConfigSource7;
 import { ConfigSource as ConfigSource8, SecretsSource as SecretsSource8, VaultSecretsConfig } from "@ionite/core";
+import { IoniteError } from "@ionite/core";
 type VaultConfigSourceOptions = Omit<VaultSecretsConfig, "type"> & {
 	vault?: SecretsSource8;
 	path?: string;
 };
-declare class VaultConfigWaitingForSecretError extends Error {
+declare class VaultConfigWaitingForSecretError extends IoniteError {
 	readonly path: string;
-	constructor(path: string, message?: string);
 	readonly code = "not_found";
 	readonly sourceType = "vault";
-	readonly status = 404;
+	constructor(path: string, message?: string);
 }
 declare function isVaultConfigWaitingForSecretError(error: unknown): error is VaultConfigWaitingForSecretError;
 /**
@@ -307,11 +323,11 @@ declare function isVaultConfigWaitingForSecretError(error: unknown): error is Va
 * is a hard, non-recoverable error (unlike {@link VaultConfigWaitingForSecretError}): the initial
 * apply rejects rather than retries.
 */
-declare class VaultConfigInvalidPayloadError extends Error {
+declare class VaultConfigInvalidPayloadError extends IoniteError {
 	readonly path: string;
-	constructor(path: string, message: string);
 	readonly code = "invalid_payload";
 	readonly sourceType = "vault";
+	constructor(path: string, message: string);
 }
 declare function isVaultConfigInvalidPayloadError(error: unknown): error is VaultConfigInvalidPayloadError;
 /**
@@ -508,6 +524,13 @@ declare const ION_CAPABILITY_CATALOG: readonly [{
 	readonly requires: "TenantStore integration methods + onConnectRequest";
 	readonly incapableReason: "TM integration requires setIntegration/getByIntegrationHandleHash and an App-owned consent hook.";
 }];
+/** Stable JSON 404 for the ionite routing surface (replaces ad-hoc `new Response('Not Found', ...)`). */
+declare function notFoundResponse(): Response;
+/**
+* Stable JSON 405 for endpoints that only accept specific methods (health/discovery, tenant CRUD).
+* Sets the `Allow` header per RFC 7231 and echoes the allowed methods in the body.
+*/
+declare function methodNotAllowedResponse(allow?: string[]): Response;
 import { BaseCustomer as BaseCustomer3, MagicLink, MagicLinkStore } from "@ionite/core";
 /**
 * In-memory implementation of MagicLinkStore from @ionite/core.
@@ -565,7 +588,7 @@ declare function enforceEndpointAuthz(request: Request, ion: Ionite, required: N
 */
 declare function resolveDefaultRoute(request: Request, ion: Ionite, urls: UrlMap, pathname?: string): ResolvedRoute | undefined;
 declare function routeRequest(request: Request, ion: Ionite, routing?: RoutingOptions, urls?: UrlMap): Promise<Response>;
-import { DestinationReference, GroupResource, IamDeltaResourceType, Logger as Logger4, ScimUser as ScimUser2 } from "@ionite/core";
+import { DestinationReference, GroupResource, IamDeltaResourceType, Logger as Logger5, ScimUser as ScimUser2 } from "@ionite/core";
 type FetchLike2 = (input: string, init?: RequestInit) => Promise<Response>;
 /**
 * Outcome of an outbound IAM delta operation:
@@ -623,7 +646,7 @@ type ScimOutboundClientOptions = {
 	getToken: () => Promise<string>;
 	/** Reads and writes destination receipts on the source User/AccessCatalogStore rows. */
 	receipts: ScimOutboundReceiptCallbacks;
-	log: Logger4;
+	log: Logger5;
 	/** Injectable fetch (defaults to global fetch); enables testing against a mock SCIM server. */
 	fetchImpl?: FetchLike2;
 };
@@ -839,7 +862,7 @@ declare function purgeTenantEntitlements(ion: Ionite3, options: {
 	tenantId: string;
 }): Promise<PurgeTenantEntitlementsResult>;
 import { BaseTenant as BaseTenant2, CreateTenantRequest, FrameworkTmConfig, TenantValidators, UpdateTenantRequest, Workload as Workload2 } from "@ionite/core";
-import { BaseTenant, ConfigLocator as ConfigLocator4, Ionite as Ionite4, LfvCallbackKind as LfvCallbackKind2, Logger as Logger5, RemoteConfig as RemoteConfig2, Secret as Secret3, SecretsSource as SecretsSource10, TenantStore } from "@ionite/core";
+import { BaseTenant, ConfigLocator as ConfigLocator4, Ionite as Ionite4, LfvCallbackKind as LfvCallbackKind2, Logger as Logger6, RemoteConfig as RemoteConfig2, Secret as Secret3, SecretsSource as SecretsSource10, TenantStore } from "@ionite/core";
 type TenantMirrorHooks<TTenant extends BaseTenant = BaseTenant> = {
 	onRemoteConfigChange?(tenant: TTenant, config: RemoteConfig2, secret: Secret3<Record<string, unknown>>): void | Promise<void>;
 	onRemoteConfigRevoke?(tenant: TTenant): void | Promise<void>;
@@ -852,7 +875,7 @@ type TenantMirrorOptions<TTenant extends BaseTenant = BaseTenant> = {
 	path: (tenant: TTenant) => string;
 	hooks?: TenantMirrorHooks<TTenant>;
 	/** Overrides the root ion logger for tenant mirror operations. */
-	logger?: Logger5;
+	logger?: Logger6;
 	/** Optional source factory for non-LFV locators. */
 	sourceFromLocator?: (locator: ConfigLocator4, tenant: TTenant) => SecretsSource10;
 };
@@ -945,6 +968,11 @@ declare function rewriteRequestPath(request: Request, pathname: string): Request
 declare function rewriteRequestForTenantPath(request: Request, id: string, sourceNamespace: TenantPathNamespace, targetNamespace: TenantPathNamespace): Request;
 declare function rewriteRequestForDefaultTenantApi(request: Request, id: string, targetNamespace?: TenantPathNamespace): Request;
 declare function rewriteRequestForDefaultTenantUi(request: Request, id: string, targetNamespace?: TenantPathNamespace): Request;
+/**
+* Route a request to its tenant runtime's `ion.handler`, which catches its own failures. A throw
+* from `resolveTenant`, `getIon`, or `rewriteRequest` is App code and propagates to the App's
+* error hook.
+*/
 declare function createTenantIonHandler(options: CreateTenantIonHandlerOptions): (request: Request) => Promise<Response>;
 import { BaseUser as BaseUser3, ListOptions as ListOptions4, ListResult as ListResult4, UserStore as UserStore2 } from "@ionite/core";
 /**
@@ -962,7 +990,8 @@ declare class InMemoryUserStore<TExtended = Record<string, never>> implements Us
 	list(options?: ListOptions4): Promise<ListResult4<BaseUser3<TExtended>>>;
 }
 import { LfvCallbackTransport as LfvCallbackTransport2, Secret as Secret4, SecretsSource as SecretsSource11, SecretsSubscriptionOptions as SecretsSubscriptionOptions2, VaultSecretsConfig as VaultSecretsConfig2 } from "@ionite/core";
-declare class VaultSubscribeNotSupportedError extends Error {
+import { IoniteError as IoniteError3 } from "@ionite/core";
+declare class VaultSubscribeNotSupportedError extends IoniteError3 {
 	readonly sourceType: string;
 	readonly path: string;
 	constructor(sourceType: string, path: string, message?: string);
@@ -999,8 +1028,8 @@ declare function closeAllVaultSockets(): void;
 *
 * Keep this synchronized with packages/server/package.json via publish.ts.
 */
-declare const ION_SDK_VERSION = "0.0.24-beta.20261006.22";
-import { ClaimsAsEntitlements, Workload as CoreWorkload, DerivedEntitlement, FrameworkWorkloadConfig, Ionite as Ionite7, JWTAssertionClaims, Logger as Logger7, TokenValidationResult, TrustedIdp, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentityStore as WorkloadIdentityStore2, WorkloadIncomingOutgoing, WorkloadTokenResponse, WorkloadTokenStore } from "@ionite/core";
+declare const ION_SDK_VERSION = "0.0.24-beta.20261007.23";
+import { ClaimsAsEntitlements, Workload as CoreWorkload, DerivedEntitlement, FrameworkWorkloadConfig, Ionite as Ionite7, JWTAssertionClaims, Logger as Logger8, TokenValidationResult, TrustedIdp, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentityStore as WorkloadIdentityStore2, WorkloadIncomingOutgoing, WorkloadTokenResponse, WorkloadTokenStore } from "@ionite/core";
 import { CatalogView } from "@ionite/core/server";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 /**
@@ -1250,7 +1279,7 @@ type Workload3 = {
 	parseJWT: (token: string) => Promise<JWTAssertionClaims>;
 	handler: (request: Request) => Promise<Response>;
 };
-declare function workload(validators: WorkloadValidators, log: Logger7, fromVault?: Partial<WorkloadConfig> | WorkloadConfigMap | WorkloadIncomingOutgoing, fromCode?: FrameworkWorkloadConfig, incomingTrustOverride?: TrustedIdp[], catalogView?: () => CatalogView | undefined): Workload3 | undefined;
+declare function workload(validators: WorkloadValidators, log: Logger8, fromVault?: Partial<WorkloadConfig> | WorkloadConfigMap | WorkloadIncomingOutgoing, fromCode?: FrameworkWorkloadConfig, incomingTrustOverride?: TrustedIdp[], catalogView?: () => CatalogView | undefined): Workload3 | undefined;
 /**
 * Get the workload identity from an incoming request.
 */
@@ -1333,4 +1362,4 @@ type IoniteConfig<C extends FrameworkConfigInput = FrameworkConfigInput> = C & {
 	onConfigLoadError?: RemoteConfigRetryHook;
 };
 declare function ionite<const C extends FrameworkConfigInput = FrameworkConfigInput>(source: ConfigSource9, config: IoniteConfig<C> | FrameworkConfigInput): Ionite8;
-export { AccessCheckReason, AccessCheckResult, AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, AssignmentPolicyError, AwsConfigSourceOptions, AzureConfigSourceOptions, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CapabilityDescriptor, CapabilityKey2 as CapabilityKey, CatalogAdjacencyCache, CatalogView2 as CatalogView, ConfigFromSourceOptions, CreateTenantIonHandlerOptions, CreateTenantIonResolverOptions, CreateTenantRequest2 as CreateTenantRequest, DiscoveredTenantCookie, EnvConfigOptions, EnvironmentType, FrameworkOtelConfig, FrameworkStores3 as FrameworkStores, GcpConfigSourceOptions, GetSessionEntriesOptions, HttpPollingHooks, ION_CAPABILITY_CATALOG, ION_CAPABILITY_CATALOG_VERSION, ION_READY_DEFAULT_TIMEOUT_MS, ION_SDK_VERSION, IamAssignmentPolicy, IamDeltaConfig, IamDeltaDeps, InMemoryAccessAssignmentStore, InMemoryAccessCatalogStore, InMemoryAccessIndex, InMemoryAuthzStores, InMemoryCustomerStore, InMemoryMagicLinkStore, InMemoryResourceStore, InMemorySessionStore, InMemoryTenantStore, InMemoryUserStore, InMemoryWorkloadIdentityStore, InMemoryWorkloadTokenStore, IoniteConfig, IoniteError, IoniteErrorOptions, LfvSecretsSource, MaterializeTenantOwnerEntitlementOptions, MirrorSecretsOptions, MirroredConfigOptions, MirroredConfigSource, Otel, OtelConfig, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProviderType, OtelSignalConfig, PurgeTenantEntitlementsResult, ReadinessLatch, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions, ResolveTenantFromRequestOptions, ResolveTenantOwnerOptions, ResolveTenantSessionOptions, ScimOutboundClient, ScimOutboundClientOptions, ScimOutboundOutcome, ScimOutboundReceiptCallbacks, ScimOutboundResource, SecretsMirror, SessionDiscoveryOptions2 as SessionDiscoveryOptions, SessionIdentityGroup, SessionListEntry, SessionListSource, SessionReadCacheOptions, SessionResponse, SubjectScope, SubjectType3 as SubjectType, TENANT_OWNER_PERMISSION, TenantAccessDenial, TenantAccessDenialReason, TenantAccessLoginUrlOptions, TenantAccessResult, TenantAccessSession, TenantAccessSessionKind, TenantIonResolver, TenantIonUrls, TenantManagerOptions, TenantMirror, TenantMirrorHooks, TenantMirrorOptions, TenantResolutionContext, TenantResponse, TenantStatus, TenantValidators2 as TenantValidators, TenantWebhookPayload, UpdateTenantRequest2 as UpdateTenantRequest, UrlMap, VAULT_MIN_POLLING_TTL_MS, VaultConfigInvalidPayloadError, VaultConfigSourceOptions, VaultConfigWaitingForSecretError, VaultSubscribeNotSupportedError, VerifyUserOptions, allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, awsConfig, azureConfig, blockDangerousUrls, callback, captureRedirect, ciam, closeAllVaultSockets, collectReferencedDefinitions, configFromSource, configLocatorFromEnvValues, configSourceFromEnvValues, configSourceFromLocator, createManagedIamDelta, createReadinessLatch, createSessionReadCache, createTenantIonHandler, createTenantIonResolver, defaultRedirectPolicies, deriveIonUrls, devInMemoryStores, discoverSessionRecords, discoverSessions, enforceEndpointAuthz, envConfig, escapeScimFilterValue, expandRoot, gcpConfig, generateULID, getCustomer, getOwnedTenantIds, getSessionEntries, getUser, getWorkload, getWorkloadToken, has, hasAll2 as hasAll, hasAllScope, hasAny2 as hasAny, hasAnyScope, hasGroup2 as hasGroup, hasPermission2 as hasPermission, hasRole2 as hasRole, hasScope, hashIntegrationHandle, iam, inMemoryAuthzDomains, inMemoryAuthzStores, initiateLogin, ionite, isRedirectAllowed, isVaultConfigInvalidPayloadError, isVaultConfigWaitingForSecretError, lfvVault, listGenerator, listSsoClientIdsFromCookies, materializeTenantOwnerEntitlement, mirrorSecrets, mirroredConfig, planDiscoveredTenantCookies, purgeTenantEntitlements, reconcileSubjectAccess, resolveAfterRedirect, resolveCapturedRedirect, resolveDefaultRoute, resolveRedirect, resolveTenantFromRequest, resolveTenantOwner, resolveTenantSession, revokeWorkloadToken, rewriteRequestForDefaultTenantApi, rewriteRequestForDefaultTenantUi, rewriteRequestForTenantPath, rewriteRequestPath, routeRequest, sameOriginRedirectRules, secretConfigSource, sendTenantWebhook, setVaultWebSocketCommandTimeout, sso, subscribeSecretPathWithHttpPolling, tenantAccessLoginUrl, tenantMirror, tenantOwnerEntitlementId, tenantOwnerPermission, tenantResourceId, validateWorkloadToken, vault, vaultConfig, vaultSocketDiagnostics, verifyUser, withSetCookies, workload, workloadHandler };
+export { AccessCheckReason, AccessCheckResult, AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, AssignmentPolicyError, AwsConfigSourceOptions, AzureConfigSourceOptions, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CapabilityDescriptor, CapabilityKey2 as CapabilityKey, CatalogAdjacencyCache, CatalogView2 as CatalogView, ConfigFromSourceOptions, CreateTenantIonHandlerOptions, CreateTenantIonResolverOptions, CreateTenantRequest2 as CreateTenantRequest, DEFAULT_REQUEST_TOKEN_TTL_SECONDS, DiscoveredTenantCookie, EnvConfigOptions, EnvironmentType, FrameworkOtelConfig, FrameworkStores3 as FrameworkStores, GcpConfigSourceOptions, GetSessionEntriesOptions, HttpPollingHooks, ION_CAPABILITY_CATALOG, ION_CAPABILITY_CATALOG_VERSION, ION_READY_DEFAULT_TIMEOUT_MS, ION_SDK_VERSION, IamAssignmentPolicy, IamDeltaConfig, IamDeltaDeps, InMemoryAccessAssignmentStore, InMemoryAccessCatalogStore, InMemoryAccessIndex, InMemoryAuthzStores, InMemoryCustomerStore, InMemoryMagicLinkStore, InMemoryResourceStore, InMemorySessionStore, InMemoryTenantStore, InMemoryUserStore, InMemoryWorkloadIdentityStore, InMemoryWorkloadTokenStore, IoniteConfig, IoniteError4 as IoniteError, IoniteErrorOptions, LfvSecretsSource, MaterializeTenantOwnerEntitlementOptions, MirrorSecretsOptions, MirroredConfigOptions, MirroredConfigSource, Otel, OtelConfig, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProviderType, OtelSignalConfig, PlanActionRequiredInput, PurgeTenantEntitlementsResult, ReadinessLatch, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions, ResolveTenantFromRequestOptions, ResolveTenantOwnerOptions, ResolveTenantSessionOptions, ScimOutboundClient, ScimOutboundClientOptions, ScimOutboundOutcome, ScimOutboundReceiptCallbacks, ScimOutboundResource, SecretsMirror, SessionDiscoveryOptions2 as SessionDiscoveryOptions, SessionIdentityGroup, SessionListEntry, SessionListSource, SessionReadCacheOptions, SessionResponse, SubjectScope, SubjectType3 as SubjectType, TENANT_OWNER_PERMISSION, TenantAccessDenial, TenantAccessDenialReason, TenantAccessLoginUrlOptions, TenantAccessResult, TenantAccessSession, TenantAccessSessionKind, TenantIonResolver, TenantIonUrls, TenantManagerOptions, TenantMirror, TenantMirrorHooks, TenantMirrorOptions, TenantResolutionContext, TenantResponse, TenantStatus, TenantValidators2 as TenantValidators, TenantWebhookPayload, UpdateTenantRequest2 as UpdateTenantRequest, UrlMap, VAULT_MIN_POLLING_TTL_MS, VaultConfigInvalidPayloadError, VaultConfigSourceOptions, VaultConfigWaitingForSecretError, VaultSubscribeNotSupportedError, VerifyUserOptions, allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, awsConfig, azureConfig, blockDangerousUrls, callback, captureRedirect, ciam, closeAllVaultSockets, collectReferencedDefinitions, configFromSource, configLocatorFromEnvValues, configSourceFromEnvValues, configSourceFromLocator, createManagedIamDelta, createReadinessLatch, createSessionReadCache, createTenantIonHandler, createTenantIonResolver, defaultRedirectPolicies, deriveIonUrls, devInMemoryStores, discoverSessionRecords, discoverSessions, enforceEndpointAuthz, envConfig, escapeScimFilterValue, expandRoot, gcpConfig, generateULID, getCustomer, getOwnedTenantIds, getSessionEntries, getUser, getWorkload, getWorkloadToken, has, hasAll2 as hasAll, hasAllScope, hasAny2 as hasAny, hasAnyScope, hasGroup2 as hasGroup, hasPermission2 as hasPermission, hasRole2 as hasRole, hasScope, hashIntegrationHandle, iam, inMemoryAuthzDomains, inMemoryAuthzStores, initiateLogin, ionite, isRedirectAllowed, isRequestTokenExpired, isVaultConfigInvalidPayloadError, isVaultConfigWaitingForSecretError, lfvVault, listGenerator, listSsoClientIdsFromCookies, materializeTenantOwnerEntitlement, methodNotAllowedResponse, mirrorSecrets, mirroredConfig, notFoundResponse, planActionRequired, planDiscoveredTenantCookies, purgeTenantEntitlements, reconcileSubjectAccess, resolveAfterRedirect, resolveCapturedRedirect, resolveDefaultRoute, resolveRedirect, resolveTenantFromRequest, resolveTenantOwner, resolveTenantSession, revokeWorkloadToken, rewriteRequestForDefaultTenantApi, rewriteRequestForDefaultTenantUi, rewriteRequestForTenantPath, rewriteRequestPath, routeRequest, sameOriginRedirectRules, secretConfigSource, sendTenantWebhook, setVaultWebSocketCommandTimeout, sso, subscribeSecretPathWithHttpPolling, tenantAccessLoginUrl, tenantMirror, tenantOwnerEntitlementId, tenantOwnerPermission, tenantResourceId, validateWorkloadToken, vault, vaultConfig, vaultSocketDiagnostics, verifyUser, withSetCookies, workload, workloadHandler };