@ionite/server 0.0.24-beta.20260907.3 → 0.0.24-beta.20260910.1

package/dist/index.d.ts

@@ -384,7 +384,7 @@ declare class InMemoryCustomerStore<TExtended = Record<string, never>> implement
 	delete(id: string): Promise<number>;
 	list(options?: ListOptions3): Promise<ListResult3<BaseCustomer<TExtended>>>;
 }
-import { AccessAssignmentStore as AccessAssignmentStore2, AccessCatalogStore as AccessCatalogStore2, BaseUser as BaseUser2, CodeCatalog, CustomerStore as CustomerStore2, IamDeltaEmitter, IamDeltaMode, Logger as Logger4, ScimUser, UserStore, Workload as Workload2, WorkloadIdentityStore } from "@ionite/core";
+import { AccessAssignmentStore as AccessAssignmentStore2, AccessCatalogStore as AccessCatalogStore2, BaseCustomer as BaseCustomer2, BaseUser as BaseUser2, BaseWorkloadIdentity, CodeCatalog, CustomerStore as CustomerStore2, IamDeltaEmitter, IamDeltaMode, Logger as Logger4, ScimCustomer, ScimUser, ScimWorkload, UserStore, Workload as Workload2, WorkloadIdentityStore } from "@ionite/core";
 type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
 /** RemoteConfig-derived destination descriptor for IAM delta egress. */
 type IamDeltaConfig = {
@@ -408,6 +408,10 @@ type IamDeltaDeps = {
 	codeCatalog?: CodeCatalog;
 	/** Optional app mapper shared with the inbound IAM Users read surface. */
 	mapUserToScim?: (stored: BaseUser2) => ScimUser | Promise<ScimUser>;
+	/** Optional app mapper shared with the inbound IAM Customers read surface. */
+	mapCustomerToScim?: (stored: BaseCustomer2) => ScimCustomer | Promise<ScimCustomer>;
+	/** Optional app mapper shared with the inbound IAM Workloads read surface. */
+	mapWorkloadToScim?: (stored: BaseWorkloadIdentity) => ScimWorkload | Promise<ScimWorkload>;
 	/** Injectable fetch (defaults to global fetch); enables testing the patch path in-process. */
 	fetchImpl?: FetchLike;
 };
@@ -518,13 +522,13 @@ declare const ION_CAPABILITY_CATALOG: readonly [{
 	readonly requires: "AccessAssignmentStore + AccessCatalogStore";
 	readonly incapableReason: "OAA projection is configured by RemoteConfig but no access/catalog store capability is wired by the application.";
 }];
-import { BaseCustomer as BaseCustomer2, MagicLink, MagicLinkStore } from "@ionite/core";
+import { BaseCustomer as BaseCustomer3, MagicLink, MagicLinkStore } from "@ionite/core";
 /**
 * In-memory implementation of MagicLinkStore from @ionite/core.
 */
 declare class InMemoryMagicLinkStore<TExtended = Record<string, never>> implements MagicLinkStore<TExtended> {
 	private magicLinks;
-	create(token: string, customer: BaseCustomer2, expiresAt: Date): Promise<void>;
+	create(token: string, customer: BaseCustomer3, expiresAt: Date): Promise<void>;
 	get(token: string): Promise<MagicLink<TExtended> | null>;
 	getAndDelete(token: string): Promise<MagicLink<TExtended> | null>;
 	delete(token: string): Promise<void>;
@@ -851,7 +855,7 @@ declare function closeAllVaultSockets(): void;
 *
 * Keep this synchronized with packages/server/package.json via publish.ts.
 */
-declare const ION_SDK_VERSION = "0.0.24-beta.20260907.3";
+declare const ION_SDK_VERSION = "0.0.24-beta.20260910.1";
 import { Workload as CoreWorkload, FrameworkWorkloadConfig, Ionite as Ionite5, JWTAssertionClaims, Logger as Logger7, TokenValidationResult, TrustedIdp, WorkloadConfigMap, WorkloadGetToken, WorkloadIdentityStore as WorkloadIdentityStore2, WorkloadIncomingOutgoing, WorkloadTokenResponse, WorkloadTokenStore } from "@ionite/core";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 /**
@@ -1114,7 +1118,7 @@ declare function revokeWorkloadToken(token: string, ion: Ionite5): Promise<void>
 * Framework-agnostic request handler for the Workload module (token, validate, jwks, refresh routes).
 */
 declare function workloadHandler(request: Request, ion: Ionite5): Promise<Response>;
-import { BaseWorkloadIdentity, ListOptions as ListOptions5, ListResult as ListResult5, WorkloadIdentityStore as WorkloadIdentityStore3 } from "@ionite/core";
+import { BaseWorkloadIdentity as BaseWorkloadIdentity2, ListOptions as ListOptions5, ListResult as ListResult5, WorkloadIdentityStore as WorkloadIdentityStore3 } from "@ionite/core";
 /**
 * In-memory {@link WorkloadIdentityStore} implementation using Maps. Suitable for development and
 * testing; use a durable store (e.g. Redis/SQL) in production.
@@ -1123,12 +1127,12 @@ declare class InMemoryWorkloadIdentityStore<TExtended = Record<string, never>> i
 	private identities;
 	private clientIdIndex;
 	private externalIdIndex;
-	get(id: string): Promise<BaseWorkloadIdentity<TExtended> | undefined>;
-	lookup(identity: BaseWorkloadIdentity<TExtended>): Promise<BaseWorkloadIdentity<TExtended> | undefined>;
-	getByExternalId(externalId: string): Promise<BaseWorkloadIdentity<TExtended> | undefined>;
-	upsert(identity: BaseWorkloadIdentity<TExtended>): Promise<BaseWorkloadIdentity<TExtended>>;
+	get(id: string): Promise<BaseWorkloadIdentity2<TExtended> | undefined>;
+	lookup(identity: BaseWorkloadIdentity2<TExtended>): Promise<BaseWorkloadIdentity2<TExtended> | undefined>;
+	getByExternalId(externalId: string): Promise<BaseWorkloadIdentity2<TExtended> | undefined>;
+	upsert(identity: BaseWorkloadIdentity2<TExtended>): Promise<BaseWorkloadIdentity2<TExtended>>;
 	delete(id: string): Promise<number>;
-	list(options?: ListOptions5): Promise<ListResult5<BaseWorkloadIdentity<TExtended>>>;
+	list(options?: ListOptions5): Promise<ListResult5<BaseWorkloadIdentity2<TExtended>>>;
 }
 import { CachedWorkloadToken, WorkloadTokenStore as WorkloadTokenStore2 } from "@ionite/core";
 /**

package/dist/index.js

@@ -504,7 +504,12 @@ import {
 
 // packages/server/src/oaa.ts
 import { accessRefId, accessRootId, ION_AUTHZ_GROUP_SCHEMA, mergeCodeCatalogEntity } from "@ionite/core";
-import { collectReferencedDefinitions } from "@ionite/core/server";
+import {
+  baseCustomerToScim,
+  baseUserToScimUser,
+  baseWorkloadToScim,
+  collectReferencedDefinitions
+} from "@ionite/core/server";
 
 // packages/server/src/readiness-latch.ts
 function createReadinessLatch(name, isActive, makeTimeoutError = (timeout) => new Error(`${name} ready timed out after ${timeout}ms`)) {
@@ -589,7 +594,9 @@ function isOaaConfigured(getConfig) {
   const config = getConfig();
   return Boolean(config?.url && config.providerId && config.datasourceId);
 }
-function createOaaClient(log, getConfig, getTransforms, getTrustedClientGrants, getCatalog) {
+function createOaaClient(log, getConfig, getTransforms, getPrincipalMappers = () => ({}), getAccessStore = () => {
+  return;
+}, getTrustedClientGrants, getCatalog) {
   const pushIncremental = async (payload) => {
     await pushPayload(log, getRequiredConfig(getConfig), payload, { mode: "incremental" });
   };
@@ -598,9 +605,29 @@ function createOaaClient(log, getConfig, getTransforms, getTrustedClientGrants,
     isReady: latch.isReady,
     ready: latch.ready,
     refreshReadiness: latch.refresh,
+    population(kind) {
+      return principalPopulation(getConfig(), kind);
+    },
     async pushUser(user) {
       const config = getRequiredConfig(getConfig);
-      await pushIncremental(singleApplicationPayload(config, { local_users: [mapUser(user, "modify")] }, true));
+      if (!await shouldPushPrincipal(config, "user", accessRefId(user), getAccessStore()))
+        return;
+      const mapped = await projectUser(user, getPrincipalMappers());
+      await pushIncremental(singleApplicationPayload(config, { local_users: [mapScimPrincipal(mapped, "user", "modify")] }, true));
+    },
+    async pushCustomer(customer) {
+      const config = getRequiredConfig(getConfig);
+      if (!await shouldPushPrincipal(config, "customer", accessRefId(customer), getAccessStore()))
+        return;
+      const mapped = await projectCustomer(customer, getPrincipalMappers());
+      await pushIncremental(singleApplicationPayload(config, { local_users: [mapScimPrincipal(mapped, "customer", "modify")] }, true));
+    },
+    async pushWorkload(workload) {
+      const config = getRequiredConfig(getConfig);
+      if (!await shouldPushPrincipal(config, "workload", accessRefId(workload), getAccessStore()))
+        return;
+      const mapped = await projectWorkload(workload, getPrincipalMappers());
+      await pushIncremental(singleApplicationPayload(config, { local_users: [mapScimPrincipal(mapped, "workload", "modify")] }, true));
     },
     async pushGroup(group) {
       const config = getRequiredConfig(getConfig);
@@ -654,6 +681,14 @@ function createOaaClient(log, getConfig, getTransforms, getTrustedClientGrants,
       const config = getRequiredConfig(getConfig);
       await pushIncremental(singleApplicationPayload(config, { local_users: [{ name: id, unique_id: id, operation: "delete" }] }, true));
     },
+    async deleteCustomer(id) {
+      const config = getRequiredConfig(getConfig);
+      await pushIncremental(singleApplicationPayload(config, { local_users: [deletedPrincipal(id, "customer")] }, true));
+    },
+    async deleteWorkload(id) {
+      const config = getRequiredConfig(getConfig);
+      await pushIncremental(singleApplicationPayload(config, { local_users: [deletedPrincipal(id, "workload")] }, true));
+    },
     async deleteGroup(id) {
       const config = getRequiredConfig(getConfig);
       await pushIncremental(singleApplicationPayload(config, { local_groups: [{ name: id, unique_id: id, operation: "delete" }] }, true));
@@ -674,7 +709,7 @@ function createOaaClient(log, getConfig, getTransforms, getTrustedClientGrants,
       const config = getRequiredConfig(getConfig);
       const incremental = options?.mode === "incremental";
       const extraAccess = incremental ? undefined : getTrustedClientGrants?.();
-      const payload = await buildSyncPayload(config, input, getTransforms(), incremental, extraAccess);
+      const payload = await buildSyncPayload(config, input, getTransforms(), getPrincipalMappers(), incremental, extraAccess);
       return pushPayload(log, config, payload, options);
     }
   };
@@ -686,7 +721,7 @@ function getRequiredConfig(getConfig) {
   }
   return config;
 }
-async function buildSyncPayload(config, input, transforms, incremental, extraAccess) {
+async function buildSyncPayload(config, input, transforms, principalMappers, incremental, extraAccess) {
   const localUsers = [];
   const localGroups = [];
   const resources = [];
@@ -695,9 +730,28 @@ async function buildSyncPayload(config, input, transforms, incremental, extraAcc
   const identityToPermissions = [];
   const op = incremental ? "modify" : undefined;
   const seenAccessKeys = new Set;
+  const accessChanges = [];
+  const accessSubjects = new Set;
   const accessKey = (change) => accessRootId(change);
+  for await (const edge of iterate(input.access)) {
+    accessChanges.push(edge);
+    accessSubjects.add(`${edge.subjectType}:${accessRefId(edge.subject)}`);
+  }
+  const includePrincipal = (kind, id) => principalPopulation(config, kind) === "all" || Boolean(id && accessSubjects.has(`${kind}:${id}`));
   for await (const user of iterate(input.users)) {
-    localUsers.push(mapUser(user, op));
+    if (includePrincipal("user", accessRefId(user))) {
+      localUsers.push(mapScimPrincipal(await projectUser(user, principalMappers), "user", op));
+    }
+  }
+  for await (const customer of iterate(input.customers)) {
+    if (includePrincipal("customer", accessRefId(customer))) {
+      localUsers.push(mapScimPrincipal(await projectCustomer(customer, principalMappers), "customer", op));
+    }
+  }
+  for await (const workload of iterate(input.workloads)) {
+    if (includePrincipal("workload", accessRefId(workload))) {
+      localUsers.push(mapScimPrincipal(await projectWorkload(workload, principalMappers), "workload", op));
+    }
   }
   for await (const group of iterate(input.groups)) {
     const source = transformGroup(group, transforms);
@@ -719,7 +773,7 @@ async function buildSyncPayload(config, input, transforms, incremental, extraAcc
     collectedResources.push(source);
   }
   resources.push(...buildNestedResourceTree(collectedResources, op));
-  for await (const edge of iterate(input.access)) {
+  for (const edge of accessChanges) {
     seenAccessKeys.add(accessKey(edge));
     applyAccessChange(edge, identityToPermissions, localUsers, applicationName(config), incremental ? "add" : undefined);
     if (typeof edge.target !== "string") {
@@ -933,17 +987,17 @@ function applyAccessChange(change, identityToPermissions, localUsers, applicatio
   const identity = accessRefId(change.subject);
   const target = accessRefId(change.target);
   let localUser = localUsers.find((user) => accessRefId(user.unique_id ?? user.name) === identity);
-  if (change.subjectType === "workload") {
+  if (change.subjectType !== "user") {
     if (localUser) {
       localUser.custom_properties = {
         ...localUser.custom_properties,
-        identity_type: "workload"
+        identity_type: change.subjectType
       };
     } else {
       localUser = {
         name: identity,
         unique_id: identity,
-        custom_properties: { identity_type: "workload" },
+        custom_properties: { identity_type: change.subjectType },
         operation
       };
       localUsers.push(localUser);
@@ -996,30 +1050,64 @@ function applyAccessChange(change, identityToPermissions, localUsers, applicatio
   }
   identityToPermissions.push(access);
 }
-function mapUser(user, operation) {
+async function projectUser(user, mappers) {
+  const mapped = await (mappers.mapUserToScim?.(user) ?? baseUserToScimUser(user));
+  return { ...mapped, id: mapped.id ?? user.id };
+}
+async function projectCustomer(customer, mappers) {
+  const mapped = await (mappers.mapCustomerToScim?.(customer) ?? baseCustomerToScim(customer));
+  return { ...mapped, id: mapped.id ?? customer.id };
+}
+async function projectWorkload(workload, mappers) {
+  const mapped = await (mappers.mapWorkloadToScim?.(workload) ?? baseWorkloadToScim(workload));
+  return { ...mapped, id: mapped.id ?? workload.id };
+}
+function mapScimPrincipal(principal, identityType, operation) {
+  const { schemas: _schemas, id, displayName, userName, active, emails, groups, meta, ...custom } = principal;
+  const uniqueId = stringValue(id) ?? stringValue(principal.externalId) ?? stringValue(userName) ?? "principal";
   return omitEmpty({
-    name: user.displayName ?? user.name ?? user.userName ?? user.id,
-    unique_id: user.id,
-    identities: buildOaaIdentities(user),
-    groups: user.groups?.map((group) => group.value),
-    is_active: user.active,
-    created_at: dateToIso(user.createdAt),
+    name: stringValue(displayName) ?? stringValue(userName) ?? uniqueId,
+    unique_id: uniqueId,
+    identities: identityType === "customer" ? undefined : buildProjectedIdentities(principal),
+    groups: identityType === "user" && Array.isArray(groups) ? groups.map((group) => typeof group === "string" ? group : stringField(group, "value")).filter((value) => Boolean(value)) : undefined,
+    is_active: typeof active === "boolean" ? active : undefined,
+    created_at: meta && typeof meta === "object" ? stringField(meta, "created") : undefined,
     custom_properties: omitEmpty({
-      ecid: user.ecid,
-      accountClass: user.accountClass,
-      externalId: user.externalId,
-      userName: user.userName,
-      tenantId: user.tenantId
+      ...custom,
+      ecid: identityType === "customer" ? undefined : projectedEcid(principal),
+      accountClass: projectedAccountClass(principal),
+      externalId: principal.externalId,
+      userName,
+      emails,
+      identity_type: identityType === "user" ? undefined : identityType
     }),
     tags: [],
     operation
   });
 }
-function buildOaaIdentities(user) {
-  const emails = user.email ? [user.email] : user.emails?.map((email) => email.value).filter(Boolean) ?? [];
-  const identities = [...user.ecid ? [user.ecid] : [], ...emails];
+function buildProjectedIdentities(principal) {
+  const ecid = projectedEcid(principal);
+  const projectedEmails = principal.emails;
+  const emails = Array.isArray(projectedEmails) ? projectedEmails.map((email) => email && typeof email === "object" ? stringField(email, "value") : undefined).filter((value) => Boolean(value)) : [];
+  const identities = [...ecid ? [ecid] : [], ...emails];
   return identities.length > 0 ? identities : undefined;
 }
+function projectedEcid(principal) {
+  const extension = principal["urn:ionite:scim:schemas:extension:ion:2.0:User"];
+  return stringValue(principal.ecid) ?? (extension && typeof extension === "object" ? stringField(extension, "ecid") : undefined);
+}
+function projectedAccountClass(principal) {
+  const extension = principal["urn:ionite:scim:schemas:extension:ion:2.0:User"];
+  return extension && typeof extension === "object" ? stringField(extension, "accountClass") : undefined;
+}
+function deletedPrincipal(id, identityType) {
+  return {
+    name: id,
+    unique_id: id,
+    custom_properties: { identity_type: identityType },
+    operation: "delete"
+  };
+}
 function mapGroup(group, operation) {
   const extension = authzGroupExtension(group);
   const id = stringField(group, "id") ?? stringField(group, "name") ?? stringField(group, "displayName");
@@ -1416,17 +1504,15 @@ function chunkString(value, size) {
 function byteLength(value) {
   return Buffer.byteLength(value, "utf8");
 }
-function dateToIso(value) {
-  if (!value)
-    return;
-  return value instanceof Date ? value.toISOString() : value;
-}
 function stringField(value, field) {
   if (!value || typeof value !== "object")
     return;
   const fieldValue = value[field];
   return typeof fieldValue === "string" && fieldValue.length > 0 ? fieldValue : undefined;
 }
+function stringValue(value) {
+  return typeof value === "string" && value.length > 0 ? value : undefined;
+}
 function booleanField(value, field) {
   if (!value || typeof value !== "object")
     return;
@@ -1476,6 +1562,21 @@ function trimTrailingSlash2(value) {
 function applicationName(config) {
   return config.applicationName ?? DEFAULT_APPLICATION_NAME;
 }
+function principalPopulation(config, kind) {
+  if (kind === "user")
+    return config?.users?.population ?? "all";
+  if (kind === "customer")
+    return config?.customers?.population ?? "access";
+  return config?.workloads?.population ?? "access";
+}
+async function shouldPushPrincipal(config, kind, id, accessStore) {
+  if (principalPopulation(config, kind) === "all")
+    return true;
+  if (!accessStore || !id)
+    return false;
+  const result = await accessStore.listBySubject(id, kind, { start: 0, limit: 1 });
+  return result.items.length > 0;
+}
 function delay(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -1494,7 +1595,7 @@ function createManagedAuthz(log, getIamDelta = () => {
   return;
 }, getIam = () => {
   return;
-}) {
+}, getPrincipalMappers = () => ({})) {
   let current;
   let closed = false;
   let codeCatalog;
@@ -1504,7 +1605,7 @@ function createManagedAuthz(log, getIamDelta = () => {
     mapGroup: current?.mapGroup,
     mapRole: current?.mapRole,
     mapResource: current?.mapResource
-  }), () => configTrustedClientGrants(current), () => {
+  }), getPrincipalMappers, () => current?.accessStore, () => configTrustedClientGrants(current), () => {
     const catalog = current?.catalogStore;
     return catalog || codeCatalog ? { catalog, code: codeCatalog, resources: current?.resources, cache: adjacencyCache } : undefined;
   });
@@ -3444,9 +3545,9 @@ import {
   unionCatalogRead as unionCatalogRead2
 } from "@ionite/core";
 import {
-  baseCustomerToScim,
-  baseUserToScimUser,
-  baseWorkloadToScim,
+  baseCustomerToScim as baseCustomerToScim2,
+  baseUserToScimUser as baseUserToScimUser2,
+  baseWorkloadToScim as baseWorkloadToScim2,
   entitlementToScimGroup
 } from "@ionite/core/server";
 
@@ -4099,7 +4200,7 @@ function createManagedIamDelta(log) {
       return {
         externalId: externalId2,
         resourceType: "workload",
-        create: baseWorkloadToScim({ ...workload, externalId: externalId2 })
+        create: await (deps.mapWorkloadToScim?.({ ...workload, externalId: externalId2 }) ?? baseWorkloadToScim2({ ...workload, externalId: externalId2 }))
       };
     }
     if (change.subjectType === "customer") {
@@ -4110,7 +4211,7 @@ function createManagedIamDelta(log) {
       const externalId2 = customer?.externalId ?? customer?.id ?? id;
       if (!externalId2)
         return;
-      const body = customer ? baseCustomerToScim({ ...customer, externalId: externalId2 }) : {
+      const body = customer ? await (deps.mapCustomerToScim?.({ ...customer, externalId: externalId2 }) ?? baseCustomerToScim2({ ...customer, externalId: externalId2 })) : {
         schemas: ["urn:ionite:scim:schemas:core:2.0:Customer"],
         externalId: externalId2,
         displayName: externalId2,
@@ -4119,12 +4220,7 @@ function createManagedIamDelta(log) {
       return {
         externalId: externalId2,
         resourceType: "customer",
-        create: {
-          schemas: body.schemas ?? ["urn:ionite:scim:schemas:core:2.0:Customer"],
-          externalId: externalId2,
-          displayName: body.displayName,
-          active: body.active ?? true
-        }
+        create: body
       };
     }
     const inline = refObject(change.subject);
@@ -4137,7 +4233,7 @@ function createManagedIamDelta(log) {
     const externalId = user?.externalId;
     if (!user || !externalId)
       return;
-    return { externalId, resourceType: "user", create: await (deps.mapUserToScim?.(user) ?? baseUserToScimUser(user)) };
+    return { externalId, resourceType: "user", create: await (deps.mapUserToScim?.(user) ?? baseUserToScimUser2(user)) };
   };
   const resolveTarget = async (change) => {
     const inline = refObject(change.target);
@@ -4255,7 +4351,7 @@ function createManagedIamDelta(log) {
     }
     return members.length > 0 ? members : undefined;
   };
-  const projectUser = async (user) => {
+  const projectUser2 = async (user) => {
     if (!isReady() || !kindDeltaOn("user"))
       return "skipped";
     const externalId = user.externalId;
@@ -4271,10 +4367,10 @@ function createManagedIamDelta(log) {
     const scim = ensureClient();
     if (!scim)
       return "skipped";
-    const body = await (deps.mapUserToScim?.(user) ?? baseUserToScimUser(user));
+    const body = await (deps.mapUserToScim?.(user) ?? baseUserToScimUser2(user));
     return scim.upsertResource("user", externalId, body);
   };
-  const projectWorkload = async (workload) => {
+  const projectWorkload2 = async (workload) => {
     if (!isReady() || !kindDeltaOn("workload"))
       return "skipped";
     const externalId = workload.externalId ?? workload.id;
@@ -4283,9 +4379,10 @@ function createManagedIamDelta(log) {
     const scim = ensureClient();
     if (!scim)
       return "skipped";
-    return scim.upsertResource("workload", externalId, baseWorkloadToScim({ ...workload, externalId }));
+    const projected = await (deps.mapWorkloadToScim?.({ ...workload, externalId }) ?? baseWorkloadToScim2({ ...workload, externalId }));
+    return scim.upsertResource("workload", externalId, projected);
   };
-  const projectCustomer = async (customer) => {
+  const projectCustomer2 = async (customer) => {
     if (!isReady() || !kindDeltaOn("customer"))
       return "skipped";
     const externalId = customer.externalId ?? customer.id;
@@ -4294,13 +4391,8 @@ function createManagedIamDelta(log) {
     const scim = ensureClient();
     if (!scim)
       return "skipped";
-    const projected = baseCustomerToScim({ ...customer, externalId });
-    return scim.upsertResource("customer", externalId, {
-      schemas: projected.schemas,
-      externalId,
-      displayName: projected.displayName,
-      active: projected.active
-    });
+    const projected = await (deps.mapCustomerToScim?.({ ...customer, externalId }) ?? baseCustomerToScim2({ ...customer, externalId }));
+    return scim.upsertResource("customer", externalId, projected);
   };
   const projectEntitlement = async (entity, type, restoreRoots = true) => {
     if (!isReady() || !anyDeltaPatch())
@@ -4336,7 +4428,7 @@ function createManagedIamDelta(log) {
   };
   const emitter = {
     async onUserUpsert(user) {
-      requirePushed(await projectUser(user), "user upsert");
+      requirePushed(await projectUser2(user), "user upsert");
     },
     async onUserDelete(externalId) {
       if (!isReady() || !kindDeltaOn("user"))
@@ -4346,6 +4438,28 @@ function createManagedIamDelta(log) {
         return;
       requirePushed(await scim.deleteResource("user", externalId), "user delete");
     },
+    async onWorkloadUpsert(workload) {
+      requirePushed(await projectWorkload2(workload), "workload upsert");
+    },
+    async onWorkloadDelete(externalId) {
+      if (!isReady() || !kindDeltaOn("workload"))
+        return;
+      const scim = ensureClient();
+      if (!scim)
+        return;
+      requirePushed(await scim.deleteResource("workload", externalId), "workload delete");
+    },
+    async onCustomerUpsert(customer) {
+      requirePushed(await projectCustomer2(customer), "customer upsert");
+    },
+    async onCustomerDelete(externalId) {
+      if (!isReady() || !kindDeltaOn("customer"))
+        return;
+      const scim = ensureClient();
+      if (!scim)
+        return;
+      requirePushed(await scim.deleteResource("customer", externalId), "customer delete");
+    },
     async onEntitlementUpsert(entity, type) {
       requirePushed(await projectEntitlement(entity, type), `${type} upsert`);
     },
@@ -4417,13 +4531,13 @@ function createManagedIamDelta(log) {
       await run(input.permissions, (value) => projectEntitlement(value, "permission", false), (value) => {
         return `permission upsert for ${value.id}`;
       });
-      await run(input.users, (value) => projectUser(value), (value) => {
+      await run(input.users, (value) => projectUser2(value), (value) => {
         return `user upsert for ${value.id ?? "unknown"}`;
       });
-      await run(input.workloads, (value) => projectWorkload(value), (value) => {
+      await run(input.workloads, (value) => projectWorkload2(value), (value) => {
         return `workload upsert for ${value.id}`;
       });
-      await run(input.customers, (value) => projectCustomer(value), (value) => {
+      await run(input.customers, (value) => projectCustomer2(value), (value) => {
         return `customer upsert for ${value.id ?? "unknown"}`;
       });
       await run(input.access, (value) => project(value, "add"), (value) => {
@@ -9901,7 +10015,7 @@ function tenantManager(ion, options) {
 }
 
 // packages/server/src/version.ts
-var ION_SDK_VERSION = "0.0.24-beta.20260907.3";
+var ION_SDK_VERSION = "0.0.24-beta.20260910.1";
 
 // packages/server/src/index.ts
 export * from "@ionite/core";
@@ -12464,6 +12578,34 @@ async function buildCapabilitiezResponse(request, ion, capabilitiez) {
     return denied;
   return Response.json(capabilitiez.build(), { status: 200 });
 }
+async function collectOaaAccess(accessStore) {
+  if (!accessStore)
+    return [];
+  const roots = [];
+  for await (const root of listGenerator3((start, limit) => accessStore.list({ start, limit }))) {
+    roots.push(root);
+  }
+  return roots;
+}
+function oaaPrincipalIds(access, kind) {
+  return [
+    ...new Set(access.filter((root) => root.subjectType === kind).map((root) => typeof root.subject === "string" ? root.subject : root.subject.id).filter((id) => Boolean(id)))
+  ];
+}
+function oaaPrincipalIterable(store, population, accessIds) {
+  if (!store)
+    return;
+  if (population === "all") {
+    return listGenerator3((start, limit) => store.list({ start, limit }));
+  }
+  return async function* accessPrincipals() {
+    for (const id of accessIds) {
+      const principal = await store.get(id);
+      if (principal)
+        yield principal;
+    }
+  }();
+}
 async function buildAuthzOaaSyncResponse(request, ion, frameworkConfig) {
   if (!ion.isReady()) {
     return createNotReadyResponse();
@@ -12480,16 +12622,22 @@ async function buildAuthzOaaSyncResponse(request, ion, frameworkConfig) {
   }
   const reconcile = ion.authz ? await ion.authz.reconcile() : undefined;
   const userStore = frameworkConfig.iam?.userStore;
+  const customerStore = frameworkConfig.iam?.customerStore ?? frameworkConfig.ciam?.customerStore;
+  const configuredWorkload = frameworkConfig.workload;
+  const workloadIdentityStore = frameworkConfig.iam?.workloadIdentityStore ?? (configuredWorkload && "workloadIdentityStore" in configuredWorkload ? configuredWorkload.workloadIdentityStore : configuredWorkload && ("incoming" in configuredWorkload) && configuredWorkload.incoming && !Array.isArray(configuredWorkload.incoming) && ("workloadIdentityStore" in configuredWorkload.incoming) ? configuredWorkload.incoming.workloadIdentityStore : undefined);
   const catalogStore = unionCatalogRead3(frameworkConfig.authz?.catalog ? toCodeCatalog2(frameworkConfig.authz.catalog) : undefined, frameworkConfig.authz?.catalogStore);
   const accessStore = frameworkConfig.authz?.accessStore;
   const resourceProvider = frameworkConfig.authz?.resources;
+  const access = await collectOaaAccess(accessStore);
   const result = await oaa.sync({
-    users: userStore ? listGenerator3((start, limit) => userStore.list({ start, limit })) : undefined,
+    users: oaaPrincipalIterable(userStore, oaa.population("user"), oaaPrincipalIds(access, "user")),
+    customers: oaaPrincipalIterable(customerStore, oaa.population("customer"), oaaPrincipalIds(access, "customer")),
+    workloads: oaaPrincipalIterable(workloadIdentityStore, oaa.population("workload"), oaaPrincipalIds(access, "workload")),
     groups: catalogStore ? listGenerator3((start, limit) => catalogStore.groups.list({ start, limit })) : undefined,
     roles: catalogStore ? listGenerator3((start, limit) => catalogStore.roles.list({ start, limit })) : undefined,
     permissions: catalogStore ? listGenerator3((start, limit) => catalogStore.permissions.list({ start, limit })) : undefined,
     resources: resourceProvider ? listGenerator3((start, limit) => resourceProvider.list({ start, limit })) : undefined,
-    access: accessStore ? listGenerator3((start, limit) => accessStore.list({ start, limit })) : undefined
+    access
   }, { mode: "snapshot", compression: "gzip", multipart: "auto" });
   return Response.json({ ...result, reconcile });
 }
@@ -12691,7 +12839,9 @@ function buildModules(remoteConfig, frameworkConfig, log, defaultSecret, kms, au
     accessStore: frameworkConfig.authz?.accessStore,
     catalogStore: frameworkConfig.authz?.catalogStore,
     codeCatalog: authzCodeCatalog,
-    mapUserToScim: mergedIamConfig.inboundUsers?.mapBaseUserToScim
+    mapUserToScim: mergedIamConfig.inboundUsers?.mapBaseUserToScim,
+    mapCustomerToScim: mergedIamConfig.inboundCustomers?.mapBaseCustomerToScim,
+    mapWorkloadToScim: mergedIamConfig.inboundWorkloads?.mapBaseWorkloadToScim
   });
   let iamHandle;
   if (requiresIamWorkload && !workloadHandle) {
@@ -12800,7 +12950,11 @@ function ionite(source, config) {
     kms: createManagedKms(defaultLog),
     workload: createManagedWorkload(defaultLog),
     otel: createManagedOtel(defaultLog),
-    authz: createManagedAuthz(defaultLog, () => iamDeltaModule.handle(), () => resultRef?.iam),
+    authz: createManagedAuthz(defaultLog, () => iamDeltaModule.handle(), () => resultRef?.iam, () => ({
+      mapUserToScim: state.frameworkConfig.iam?.inboundUsers?.mapBaseUserToScim,
+      mapCustomerToScim: state.frameworkConfig.iam?.inboundCustomers?.mapBaseCustomerToScim,
+      mapWorkloadToScim: state.frameworkConfig.iam?.inboundWorkloads?.mapBaseWorkloadToScim
+    })),
     iamDelta: iamDeltaModule,
     sso: createManagedReadiness("sso"),
     iam: createManagedReadiness("iam"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ionite/server",
-  "version": "0.0.24-beta.20260907.3",
+  "version": "0.0.24-beta.20260910.1",
   "description": "ionite Server (Node/server-only)",
   "private": false,
   "author": "ionite",
@@ -24,7 +24,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@ionite/core": "0.0.24-beta.20260907.3",
+    "@ionite/core": "0.0.24-beta.20260910.1",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/api-logs": "^0.220.0",
     "@opentelemetry/exporter-logs-otlp-http": "^0.220.0",