@ionite/server 0.0.24-beta.20260905.1 → 0.0.24-beta.20260907.2

package/dist/index.d.ts

@@ -91,7 +91,7 @@ declare function tenantManager<
 >(ion: Ionite2, options: TenantManagerOptions<TCreateTenantRequest, TUpdateTenantRequest, TTenant>): TenantManager<TTenant>;
 import { CapabilityKey as CapabilityKey2 } from "@ionite/core";
 export * from "@ionite/core";
-import { AccessCheckReason, AccessCheckResult, CreateTenantRequest as CreateTenantRequest2, EnvironmentType, FrameworkOtelConfig, FrameworkStores as FrameworkStores3, generateULID, IoniteError, IoniteErrorOptions, listGenerator, Otel, OtelConfig, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProviderType, OtelSignalConfig, SubjectScope, SubjectType as SubjectType3, TenantResponse, TenantStatus, TenantValidators as TenantValidators2, TenantWebhookPayload, UpdateTenantRequest as UpdateTenantRequest2 } from "@ionite/core";
+import { AccessCheckReason, AccessCheckResult, AssignmentPolicyError, CreateTenantRequest as CreateTenantRequest2, EnvironmentType, FrameworkOtelConfig, FrameworkStores as FrameworkStores3, generateULID, IamAssignmentPolicy, IoniteError, IoniteErrorOptions, listGenerator, Otel, OtelConfig, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProviderType, OtelSignalConfig, SubjectScope, SubjectType as SubjectType3, TenantResponse, TenantStatus, TenantValidators as TenantValidators2, TenantWebhookPayload, UpdateTenantRequest as UpdateTenantRequest2 } from "@ionite/core";
 import { AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CatalogView, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions } from "@ionite/core/server";
 import { allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, blockDangerousUrls, CatalogAdjacencyCache, callback, captureRedirect, ciam, collectReferencedDefinitions, defaultRedirectPolicies, discoverSessionRecords, discoverSessions, expandRoot, getCustomer, getUser, has, hasAll as hasAll2, hasAllScope, hasAny as hasAny2, hasAnyScope, hasGroup as hasGroup2, hasPermission as hasPermission2, hasRole as hasRole2, hasScope, InMemoryTenantStore, iam, initiateLogin, isRedirectAllowed, listSsoClientIdsFromCookies, reconcileSubjectAccess, resolveAfterRedirect, resolveCapturedRedirect, resolveRedirect, SessionDiscoveryOptions, SessionResponse, sameOriginRedirectRules, sendTenantWebhook, sso, VerifyUserOptions, verifyUser, withSetCookies } from "@ionite/core/server";
 import { AccessAssignmentStore, AccessChange, ListOptions, ListResult, OaaAccessTargetType, SubjectType } from "@ionite/core";
@@ -376,17 +376,21 @@ import { BaseCustomer, CustomerStore, ListOptions as ListOptions3, ListResult as
 declare class InMemoryCustomerStore<TExtended = Record<string, never>> implements CustomerStore<TExtended> {
 	private customers;
 	private userNameIndex;
+	private externalIdIndex;
 	get(id: string): Promise<BaseCustomer<TExtended> | undefined>;
 	lookup(customer: BaseCustomer<TExtended>): Promise<BaseCustomer<TExtended> | undefined>;
+	getByExternalId(externalId: string): Promise<BaseCustomer<TExtended> | undefined>;
 	upsert(customer: BaseCustomer<TExtended>): Promise<BaseCustomer<TExtended>>;
 	delete(id: string): Promise<number>;
 	list(options?: ListOptions3): Promise<ListResult3<BaseCustomer<TExtended>>>;
 }
-import { AccessAssignmentStore as AccessAssignmentStore2, AccessCatalogStore as AccessCatalogStore2, BaseUser as BaseUser2, CodeCatalog, IamDeltaEmitter, IamDeltaMode, Logger as Logger4, ScimUser, UserStore, Workload as Workload2, WorkloadIdentityStore } from "@ionite/core";
+import { AccessAssignmentStore as AccessAssignmentStore2, AccessCatalogStore as AccessCatalogStore2, BaseUser as BaseUser2, CodeCatalog, CustomerStore as CustomerStore2, IamDeltaEmitter, IamDeltaMode, Logger as Logger4, ScimUser, UserStore, Workload as Workload2, WorkloadIdentityStore } from "@ionite/core";
 type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
 /** RemoteConfig-derived destination descriptor for IAM delta egress. */
 type IamDeltaConfig = {
-	mode?: IamDeltaMode;
+	users?: IamDeltaMode;
+	workloads?: IamDeltaMode;
+	customers?: IamDeltaMode;
 	/** Destination SCIM base URL of the IAM tool. */
 	url?: string;
 	/** Outgoing workload client name used to authenticate pushes (`IAMConfig.deltaAudience`). */
@@ -397,6 +401,7 @@ type IamDeltaDeps = {
 	workload?: Workload2;
 	workloadIdentityStore?: WorkloadIdentityStore;
 	userStore?: UserStore;
+	customerStore?: CustomerStore2;
 	accessStore?: AccessAssignmentStore2;
 	catalogStore?: AccessCatalogStore2;
 	/** Normalized code templates merged over persisted rows for outbound definitions. */
@@ -425,7 +430,7 @@ import { CapabilityKey, ModuleName } from "@ionite/core";
 * Version of the stable capability vocabulary emitted by capabilitiez and used by ECV result IDs.
 * Increment only when capability/test-unit identity changes, not for ordinary SDK releases.
 */
-declare const ION_CAPABILITY_CATALOG_VERSION = 1;
+declare const ION_CAPABILITY_CATALOG_VERSION = 2;
 type CapabilityDescriptor = {
 	/**
 	* Stable machine key (also the catalog map key). This is the SAME key the runtime `capabilitiez`
@@ -486,6 +491,18 @@ declare const ION_CAPABILITY_CATALOG: readonly [{
 	readonly label: "SCIM Groups inbound";
 	readonly requires: "AccessCatalogStore";
 	readonly incapableReason: "SCIM Groups endpoint is enabled by RemoteConfig but no AccessCatalogStore capability is wired by the application.";
+}, {
+	readonly key: "iam.workloads";
+	readonly module: "iam";
+	readonly label: "SCIM Workloads inbound";
+	readonly requires: "workloadIdentityStore";
+	readonly incapableReason: "SCIM Workloads endpoint is enabled by RemoteConfig but no workload identity store capability is wired by the application.";
+}, {
+	readonly key: "iam.customers";
+	readonly module: "iam";
+	readonly label: "SCIM Customers inbound";
+	readonly requires: "customerStore";
+	readonly incapableReason: "SCIM Customers endpoint is enabled by RemoteConfig but no customer store capability is wired by the application.";
 }, {
 	readonly key: "workload.incoming";
 	readonly module: "workload";
@@ -563,8 +580,10 @@ type ScimGroupMembershipPatch = {
 	op: "add" | "remove";
 	groupCreate?: ScimOutboundResource;
 	userCreate?: ScimOutboundResource;
-	/** SCIM member kind; Workload is the ionite extension used by full IAM aggregation. */
-	memberType?: "User" | "Workload";
+	/** SCIM member kind; Workload/Customer are ionite extensions used by full IAM aggregation. */
+	memberType?: "User" | "Workload" | "Customer";
+	/** Destination principal resource for lookup/create. Defaults to `'user'`. */
+	subjectResourceType?: IamDeltaResourceType;
 };
 /**
 * Row-backed receipt callbacks supplied by IAM delta. Group receipts are persisted on
@@ -832,7 +851,7 @@ declare function closeAllVaultSockets(): void;
 *
 * Keep this synchronized with packages/server/package.json via publish.ts.
 */
-declare const ION_SDK_VERSION = "0.0.24-beta.20260905.1";
+declare const ION_SDK_VERSION = "0.0.24-beta.20260907.2";
 import { Workload as CoreWorkload, FrameworkWorkloadConfig, Ionite as Ionite5, JWTAssertionClaims, Logger as Logger7, TokenValidationResult, TrustedIdp, WorkloadConfigMap, WorkloadGetToken, WorkloadIdentityStore as WorkloadIdentityStore2, WorkloadIncomingOutgoing, WorkloadTokenResponse, WorkloadTokenStore } from "@ionite/core";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 /**
@@ -1103,8 +1122,10 @@ import { BaseWorkloadIdentity, ListOptions as ListOptions5, ListResult as ListRe
 declare class InMemoryWorkloadIdentityStore<TExtended = Record<string, never>> implements WorkloadIdentityStore3<TExtended> {
 	private identities;
 	private clientIdIndex;
+	private externalIdIndex;
 	get(id: string): Promise<BaseWorkloadIdentity<TExtended> | undefined>;
 	lookup(identity: BaseWorkloadIdentity<TExtended>): Promise<BaseWorkloadIdentity<TExtended> | undefined>;
+	getByExternalId(externalId: string): Promise<BaseWorkloadIdentity<TExtended> | undefined>;
 	upsert(identity: BaseWorkloadIdentity<TExtended>): Promise<BaseWorkloadIdentity<TExtended>>;
 	delete(id: string): Promise<number>;
 	list(options?: ListOptions5): Promise<ListResult5<BaseWorkloadIdentity<TExtended>>>;
@@ -1150,4 +1171,4 @@ type IoniteConfig<C extends FrameworkConfigInput = FrameworkConfigInput> = C & {
 	onConfigLoadError?: RemoteConfigRetryHook;
 };
 declare function ionite<const C extends FrameworkConfigInput = FrameworkConfigInput>(source: ConfigSource9, config: IoniteConfig<C> | FrameworkConfigInput): Ionite6;
-export { workloadHandler, workload, withSetCookies, verifyUser, vaultSocketDiagnostics, vaultConfig, vault, validateWorkloadToken, tenantMirror, tenantManager, subscribeSecretPathWithHttpPolling, sso, setVaultWebSocketCommandTimeout, sendTenantWebhook, secretConfigSource, sameOriginRedirectRules, routeRequest, rewriteRequestPath, rewriteRequestForTenantPath, rewriteRequestForDefaultTenantUi, rewriteRequestForDefaultTenantApi, revokeWorkloadToken, resolveTenantFromRequest, resolveRedirect, resolveDefaultRoute, resolveCapturedRedirect, resolveAfterRedirect, reconcileSubjectAccess, mirroredConfig, mirrorSecrets, listSsoClientIdsFromCookies, listGenerator, lfvVault, isVaultConfigWaitingForSecretError, isVaultConfigInvalidPayloadError, isRedirectAllowed, ionite, initiateLogin, iam, hasScope, hasRole2 as hasRole, hasPermission2 as hasPermission, hasGroup2 as hasGroup, hasAnyScope, hasAny2 as hasAny, hasAllScope, hasAll2 as hasAll, has, getWorkloadToken, getWorkload, getUser, getCustomer, generateULID, gcpConfig, expandRoot, escapeScimFilterValue, envConfig, enforceEndpointAuthz, discoverSessions, discoverSessionRecords, devInMemoryStores, deriveIonUrls, defaultRedirectPolicies, createTenantIonResolver, createTenantIonHandler, createSessionReadCache, createManagedIamDelta, configSourceFromLocator, configSourceFromEnvValues, configLocatorFromEnvValues, configFromSource, collectReferencedDefinitions, closeAllVaultSockets, ciam, captureRedirect, callback, blockDangerousUrls, azureConfig, awsConfig, allowSameOrigin, allowRelativePaths, allowOrigins, allowHosts, VerifyUserOptions, VaultSubscribeNotSupportedError, VaultConfigWaitingForSecretError, VaultConfigSourceOptions, VaultConfigInvalidPayloadError, VAULT_MIN_POLLING_TTL_MS, UrlMap, UpdateTenantRequest2 as UpdateTenantRequest, TenantWebhookPayload, TenantValidators2 as TenantValidators, TenantStatus, TenantResponse, TenantResolutionContext, TenantMirrorOptions, TenantMirrorHooks, TenantMirror, TenantManagerOptions, TenantManager, TenantIonUrls, TenantIonResolver, SubjectType3 as SubjectType, SubjectScope, SessionResponse, SessionReadCacheOptions, SessionDiscoveryOptions, SecretsMirror, ScimOutboundResource, ScimOutboundReceiptCallbacks, ScimOutboundOutcome, ScimOutboundClientOptions, ScimOutboundClient, ResolveTenantFromRequestOptions, ReferencedDefinitions, RedirectVerdict, RedirectRuleContext, RedirectRule, RedirectResult, RedirectPolicy, RedirectContext, ReconcileStores, OtelSignalConfig, OtelProviderType, OtelOAuthClientCredentialsConfig, OtelMetricsSignalConfig, OtelLogRecord, OtelLogLevel, OtelLevels, OtelConfig, Otel, MirroredConfigSource, MirroredConfigOptions, MirrorSecretsOptions, LfvSecretsSource, IoniteErrorOptions, IoniteError, IoniteConfig, InMemoryWorkloadTokenStore, InMemoryWorkloadIdentityStore, InMemoryUserStore, InMemoryTenantStore, InMemorySessionStore, InMemoryResourceStore, InMemoryMagicLinkStore, InMemoryCustomerStore, InMemoryAccessIndex, InMemoryAccessCatalogStore, InMemoryAccessAssignmentStore, IamDeltaDeps, IamDeltaConfig, ION_SDK_VERSION, ION_READY_DEFAULT_TIMEOUT_MS, ION_CAPABILITY_CATALOG_VERSION, ION_CAPABILITY_CATALOG, HttpPollingHooks, GcpConfigSourceOptions, FrameworkStores3 as FrameworkStores, FrameworkOtelConfig, EnvironmentType, EnvConfigOptions, CreateTenantRequest2 as CreateTenantRequest, CreateTenantIonResolverOptions, CreateTenantIonHandlerOptions, ConfigFromSourceOptions, CatalogView, CatalogAdjacencyCache, CapabilityKey2 as CapabilityKey, CapabilityDescriptor, BeforeLogoutHook, BeforeLogoutContext, BeforeLoginHook, BeforeLoginContext, AzureConfigSourceOptions, AwsConfigSourceOptions, AfterLogoutHook, AfterLogoutContext, AfterLoginHook, AfterLoginContext, AccessCheckResult, AccessCheckReason };
+export { workloadHandler, workload, withSetCookies, verifyUser, vaultSocketDiagnostics, vaultConfig, vault, validateWorkloadToken, tenantMirror, tenantManager, subscribeSecretPathWithHttpPolling, sso, setVaultWebSocketCommandTimeout, sendTenantWebhook, secretConfigSource, sameOriginRedirectRules, routeRequest, rewriteRequestPath, rewriteRequestForTenantPath, rewriteRequestForDefaultTenantUi, rewriteRequestForDefaultTenantApi, revokeWorkloadToken, resolveTenantFromRequest, resolveRedirect, resolveDefaultRoute, resolveCapturedRedirect, resolveAfterRedirect, reconcileSubjectAccess, mirroredConfig, mirrorSecrets, listSsoClientIdsFromCookies, listGenerator, lfvVault, isVaultConfigWaitingForSecretError, isVaultConfigInvalidPayloadError, isRedirectAllowed, ionite, initiateLogin, iam, hasScope, hasRole2 as hasRole, hasPermission2 as hasPermission, hasGroup2 as hasGroup, hasAnyScope, hasAny2 as hasAny, hasAllScope, hasAll2 as hasAll, has, getWorkloadToken, getWorkload, getUser, getCustomer, generateULID, gcpConfig, expandRoot, escapeScimFilterValue, envConfig, enforceEndpointAuthz, discoverSessions, discoverSessionRecords, devInMemoryStores, deriveIonUrls, defaultRedirectPolicies, createTenantIonResolver, createTenantIonHandler, createSessionReadCache, createManagedIamDelta, configSourceFromLocator, configSourceFromEnvValues, configLocatorFromEnvValues, configFromSource, collectReferencedDefinitions, closeAllVaultSockets, ciam, captureRedirect, callback, blockDangerousUrls, azureConfig, awsConfig, allowSameOrigin, allowRelativePaths, allowOrigins, allowHosts, VerifyUserOptions, VaultSubscribeNotSupportedError, VaultConfigWaitingForSecretError, VaultConfigSourceOptions, VaultConfigInvalidPayloadError, VAULT_MIN_POLLING_TTL_MS, UrlMap, UpdateTenantRequest2 as UpdateTenantRequest, TenantWebhookPayload, TenantValidators2 as TenantValidators, TenantStatus, TenantResponse, TenantResolutionContext, TenantMirrorOptions, TenantMirrorHooks, TenantMirror, TenantManagerOptions, TenantManager, TenantIonUrls, TenantIonResolver, SubjectType3 as SubjectType, SubjectScope, SessionResponse, SessionReadCacheOptions, SessionDiscoveryOptions, SecretsMirror, ScimOutboundResource, ScimOutboundReceiptCallbacks, ScimOutboundOutcome, ScimOutboundClientOptions, ScimOutboundClient, ResolveTenantFromRequestOptions, ReferencedDefinitions, RedirectVerdict, RedirectRuleContext, RedirectRule, RedirectResult, RedirectPolicy, RedirectContext, ReconcileStores, OtelSignalConfig, OtelProviderType, OtelOAuthClientCredentialsConfig, OtelMetricsSignalConfig, OtelLogRecord, OtelLogLevel, OtelLevels, OtelConfig, Otel, MirroredConfigSource, MirroredConfigOptions, MirrorSecretsOptions, LfvSecretsSource, IoniteErrorOptions, IoniteError, IoniteConfig, InMemoryWorkloadTokenStore, InMemoryWorkloadIdentityStore, InMemoryUserStore, InMemoryTenantStore, InMemorySessionStore, InMemoryResourceStore, InMemoryMagicLinkStore, InMemoryCustomerStore, InMemoryAccessIndex, InMemoryAccessCatalogStore, InMemoryAccessAssignmentStore, IamDeltaDeps, IamDeltaConfig, IamAssignmentPolicy, ION_SDK_VERSION, ION_READY_DEFAULT_TIMEOUT_MS, ION_CAPABILITY_CATALOG_VERSION, ION_CAPABILITY_CATALOG, HttpPollingHooks, GcpConfigSourceOptions, FrameworkStores3 as FrameworkStores, FrameworkOtelConfig, EnvironmentType, EnvConfigOptions, CreateTenantRequest2 as CreateTenantRequest, CreateTenantIonResolverOptions, CreateTenantIonHandlerOptions, ConfigFromSourceOptions, CatalogView, CatalogAdjacencyCache, CapabilityKey2 as CapabilityKey, CapabilityDescriptor, BeforeLogoutHook, BeforeLogoutContext, BeforeLoginHook, BeforeLoginContext, AzureConfigSourceOptions, AwsConfigSourceOptions, AssignmentPolicyError, AfterLogoutHook, AfterLogoutContext, AfterLoginHook, AfterLoginContext, AccessCheckResult, AccessCheckReason };