@ionite/server 0.0.24-beta.20260907.3 → 0.0.24-beta.20260915.2

package/dist/index.d.ts

@@ -384,7 +384,7 @@ declare class InMemoryCustomerStore<TExtended = Record<string, never>> implement
 	delete(id: string): Promise<number>;
 	list(options?: ListOptions3): Promise<ListResult3<BaseCustomer<TExtended>>>;
 }
-import { AccessAssignmentStore as AccessAssignmentStore2, AccessCatalogStore as AccessCatalogStore2, BaseUser as BaseUser2, CodeCatalog, CustomerStore as CustomerStore2, IamDeltaEmitter, IamDeltaMode, Logger as Logger4, ScimUser, UserStore, Workload as Workload2, WorkloadIdentityStore } from "@ionite/core";
+import { AccessAssignmentStore as AccessAssignmentStore2, AccessCatalogStore as AccessCatalogStore2, BaseCustomer as BaseCustomer2, BaseUser as BaseUser2, BaseWorkloadIdentity, CodeCatalog, CustomerStore as CustomerStore2, IamDeltaEmitter, IamDeltaMode, Logger as Logger4, ScimCustomer, ScimUser, ScimWorkload, UserStore, Workload as Workload2, WorkloadIdentityStore } from "@ionite/core";
 type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
 /** RemoteConfig-derived destination descriptor for IAM delta egress. */
 type IamDeltaConfig = {
@@ -408,6 +408,10 @@ type IamDeltaDeps = {
 	codeCatalog?: CodeCatalog;
 	/** Optional app mapper shared with the inbound IAM Users read surface. */
 	mapUserToScim?: (stored: BaseUser2) => ScimUser | Promise<ScimUser>;
+	/** Optional app mapper shared with the inbound IAM Customers read surface. */
+	mapCustomerToScim?: (stored: BaseCustomer2) => ScimCustomer | Promise<ScimCustomer>;
+	/** Optional app mapper shared with the inbound IAM Workloads read surface. */
+	mapWorkloadToScim?: (stored: BaseWorkloadIdentity) => ScimWorkload | Promise<ScimWorkload>;
 	/** Injectable fetch (defaults to global fetch); enables testing the patch path in-process. */
 	fetchImpl?: FetchLike;
 };
@@ -518,13 +522,13 @@ declare const ION_CAPABILITY_CATALOG: readonly [{
 	readonly requires: "AccessAssignmentStore + AccessCatalogStore";
 	readonly incapableReason: "OAA projection is configured by RemoteConfig but no access/catalog store capability is wired by the application.";
 }];
-import { BaseCustomer as BaseCustomer2, MagicLink, MagicLinkStore } from "@ionite/core";
+import { BaseCustomer as BaseCustomer3, MagicLink, MagicLinkStore } from "@ionite/core";
 /**
 * In-memory implementation of MagicLinkStore from @ionite/core.
 */
 declare class InMemoryMagicLinkStore<TExtended = Record<string, never>> implements MagicLinkStore<TExtended> {
 	private magicLinks;
-	create(token: string, customer: BaseCustomer2, expiresAt: Date): Promise<void>;
+	create(token: string, customer: BaseCustomer3, expiresAt: Date): Promise<void>;
 	get(token: string): Promise<MagicLink<TExtended> | null>;
 	getAndDelete(token: string): Promise<MagicLink<TExtended> | null>;
 	delete(token: string): Promise<void>;
@@ -851,7 +855,7 @@ declare function closeAllVaultSockets(): void;
 *
 * Keep this synchronized with packages/server/package.json via publish.ts.
 */
-declare const ION_SDK_VERSION = "0.0.24-beta.20260907.3";
+declare const ION_SDK_VERSION = "0.0.24-beta.20260915.2";
 import { Workload as CoreWorkload, FrameworkWorkloadConfig, Ionite as Ionite5, JWTAssertionClaims, Logger as Logger7, TokenValidationResult, TrustedIdp, WorkloadConfigMap, WorkloadGetToken, WorkloadIdentityStore as WorkloadIdentityStore2, WorkloadIncomingOutgoing, WorkloadTokenResponse, WorkloadTokenStore } from "@ionite/core";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 /**
@@ -1114,7 +1118,7 @@ declare function revokeWorkloadToken(token: string, ion: Ionite5): Promise<void>
 * Framework-agnostic request handler for the Workload module (token, validate, jwks, refresh routes).
 */
 declare function workloadHandler(request: Request, ion: Ionite5): Promise<Response>;
-import { BaseWorkloadIdentity, ListOptions as ListOptions5, ListResult as ListResult5, WorkloadIdentityStore as WorkloadIdentityStore3 } from "@ionite/core";
+import { BaseWorkloadIdentity as BaseWorkloadIdentity2, ListOptions as ListOptions5, ListResult as ListResult5, WorkloadIdentityStore as WorkloadIdentityStore3 } from "@ionite/core";
 /**
 * In-memory {@link WorkloadIdentityStore} implementation using Maps. Suitable for development and
 * testing; use a durable store (e.g. Redis/SQL) in production.
@@ -1123,12 +1127,12 @@ declare class InMemoryWorkloadIdentityStore<TExtended = Record<string, never>> i
 	private identities;
 	private clientIdIndex;
 	private externalIdIndex;
-	get(id: string): Promise<BaseWorkloadIdentity<TExtended> | undefined>;
-	lookup(identity: BaseWorkloadIdentity<TExtended>): Promise<BaseWorkloadIdentity<TExtended> | undefined>;
-	getByExternalId(externalId: string): Promise<BaseWorkloadIdentity<TExtended> | undefined>;
-	upsert(identity: BaseWorkloadIdentity<TExtended>): Promise<BaseWorkloadIdentity<TExtended>>;
+	get(id: string): Promise<BaseWorkloadIdentity2<TExtended> | undefined>;
+	lookup(identity: BaseWorkloadIdentity2<TExtended>): Promise<BaseWorkloadIdentity2<TExtended> | undefined>;
+	getByExternalId(externalId: string): Promise<BaseWorkloadIdentity2<TExtended> | undefined>;
+	upsert(identity: BaseWorkloadIdentity2<TExtended>): Promise<BaseWorkloadIdentity2<TExtended>>;
 	delete(id: string): Promise<number>;
-	list(options?: ListOptions5): Promise<ListResult5<BaseWorkloadIdentity<TExtended>>>;
+	list(options?: ListOptions5): Promise<ListResult5<BaseWorkloadIdentity2<TExtended>>>;
 }
 import { CachedWorkloadToken, WorkloadTokenStore as WorkloadTokenStore2 } from "@ionite/core";
 /**
@@ -1171,4 +1175,4 @@ type IoniteConfig<C extends FrameworkConfigInput = FrameworkConfigInput> = C & {
 	onConfigLoadError?: RemoteConfigRetryHook;
 };
 declare function ionite<const C extends FrameworkConfigInput = FrameworkConfigInput>(source: ConfigSource9, config: IoniteConfig<C> | FrameworkConfigInput): Ionite6;
-export { workloadHandler, workload, withSetCookies, verifyUser, vaultSocketDiagnostics, vaultConfig, vault, validateWorkloadToken, tenantMirror, tenantManager, subscribeSecretPathWithHttpPolling, sso, setVaultWebSocketCommandTimeout, sendTenantWebhook, secretConfigSource, sameOriginRedirectRules, routeRequest, rewriteRequestPath, rewriteRequestForTenantPath, rewriteRequestForDefaultTenantUi, rewriteRequestForDefaultTenantApi, revokeWorkloadToken, resolveTenantFromRequest, resolveRedirect, resolveDefaultRoute, resolveCapturedRedirect, resolveAfterRedirect, reconcileSubjectAccess, mirroredConfig, mirrorSecrets, listSsoClientIdsFromCookies, listGenerator, lfvVault, isVaultConfigWaitingForSecretError, isVaultConfigInvalidPayloadError, isRedirectAllowed, ionite, initiateLogin, iam, hasScope, hasRole2 as hasRole, hasPermission2 as hasPermission, hasGroup2 as hasGroup, hasAnyScope, hasAny2 as hasAny, hasAllScope, hasAll2 as hasAll, has, getWorkloadToken, getWorkload, getUser, getCustomer, generateULID, gcpConfig, expandRoot, escapeScimFilterValue, envConfig, enforceEndpointAuthz, discoverSessions, discoverSessionRecords, devInMemoryStores, deriveIonUrls, defaultRedirectPolicies, createTenantIonResolver, createTenantIonHandler, createSessionReadCache, createManagedIamDelta, configSourceFromLocator, configSourceFromEnvValues, configLocatorFromEnvValues, configFromSource, collectReferencedDefinitions, closeAllVaultSockets, ciam, captureRedirect, callback, blockDangerousUrls, azureConfig, awsConfig, allowSameOrigin, allowRelativePaths, allowOrigins, allowHosts, VerifyUserOptions, VaultSubscribeNotSupportedError, VaultConfigWaitingForSecretError, VaultConfigSourceOptions, VaultConfigInvalidPayloadError, VAULT_MIN_POLLING_TTL_MS, UrlMap, UpdateTenantRequest2 as UpdateTenantRequest, TenantWebhookPayload, TenantValidators2 as TenantValidators, TenantStatus, TenantResponse, TenantResolutionContext, TenantMirrorOptions, TenantMirrorHooks, TenantMirror, TenantManagerOptions, TenantManager, TenantIonUrls, TenantIonResolver, SubjectType3 as SubjectType, SubjectScope, SessionResponse, SessionReadCacheOptions, SessionDiscoveryOptions, SecretsMirror, ScimOutboundResource, ScimOutboundReceiptCallbacks, ScimOutboundOutcome, ScimOutboundClientOptions, ScimOutboundClient, ResolveTenantFromRequestOptions, ReferencedDefinitions, RedirectVerdict, RedirectRuleContext, RedirectRule, RedirectResult, RedirectPolicy, RedirectContext, ReconcileStores, OtelSignalConfig, OtelProviderType, OtelOAuthClientCredentialsConfig, OtelMetricsSignalConfig, OtelLogRecord, OtelLogLevel, OtelLevels, OtelConfig, Otel, MirroredConfigSource, MirroredConfigOptions, MirrorSecretsOptions, LfvSecretsSource, IoniteErrorOptions, IoniteError, IoniteConfig, InMemoryWorkloadTokenStore, InMemoryWorkloadIdentityStore, InMemoryUserStore, InMemoryTenantStore, InMemorySessionStore, InMemoryResourceStore, InMemoryMagicLinkStore, InMemoryCustomerStore, InMemoryAccessIndex, InMemoryAccessCatalogStore, InMemoryAccessAssignmentStore, IamDeltaDeps, IamDeltaConfig, IamAssignmentPolicy, ION_SDK_VERSION, ION_READY_DEFAULT_TIMEOUT_MS, ION_CAPABILITY_CATALOG_VERSION, ION_CAPABILITY_CATALOG, HttpPollingHooks, GcpConfigSourceOptions, FrameworkStores3 as FrameworkStores, FrameworkOtelConfig, EnvironmentType, EnvConfigOptions, CreateTenantRequest2 as CreateTenantRequest, CreateTenantIonResolverOptions, CreateTenantIonHandlerOptions, ConfigFromSourceOptions, CatalogView, CatalogAdjacencyCache, CapabilityKey2 as CapabilityKey, CapabilityDescriptor, BeforeLogoutHook, BeforeLogoutContext, BeforeLoginHook, BeforeLoginContext, AzureConfigSourceOptions, AwsConfigSourceOptions, AssignmentPolicyError, AfterLogoutHook, AfterLogoutContext, AfterLoginHook, AfterLoginContext, AccessCheckResult, AccessCheckReason };
+export { AccessCheckReason, AccessCheckResult, AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, AssignmentPolicyError, AwsConfigSourceOptions, AzureConfigSourceOptions, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CapabilityDescriptor, CapabilityKey2 as CapabilityKey, CatalogAdjacencyCache, CatalogView, ConfigFromSourceOptions, CreateTenantIonHandlerOptions, CreateTenantIonResolverOptions, CreateTenantRequest2 as CreateTenantRequest, EnvConfigOptions, EnvironmentType, FrameworkOtelConfig, FrameworkStores3 as FrameworkStores, GcpConfigSourceOptions, HttpPollingHooks, ION_CAPABILITY_CATALOG, ION_CAPABILITY_CATALOG_VERSION, ION_READY_DEFAULT_TIMEOUT_MS, ION_SDK_VERSION, IamAssignmentPolicy, IamDeltaConfig, IamDeltaDeps, InMemoryAccessAssignmentStore, InMemoryAccessCatalogStore, InMemoryAccessIndex, InMemoryCustomerStore, InMemoryMagicLinkStore, InMemoryResourceStore, InMemorySessionStore, InMemoryTenantStore, InMemoryUserStore, InMemoryWorkloadIdentityStore, InMemoryWorkloadTokenStore, IoniteConfig, IoniteError, IoniteErrorOptions, LfvSecretsSource, MirrorSecretsOptions, MirroredConfigOptions, MirroredConfigSource, Otel, OtelConfig, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProviderType, OtelSignalConfig, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions, ResolveTenantFromRequestOptions, ScimOutboundClient, ScimOutboundClientOptions, ScimOutboundOutcome, ScimOutboundReceiptCallbacks, ScimOutboundResource, SecretsMirror, SessionDiscoveryOptions, SessionReadCacheOptions, SessionResponse, SubjectScope, SubjectType3 as SubjectType, TenantIonResolver, TenantIonUrls, TenantManager, TenantManagerOptions, TenantMirror, TenantMirrorHooks, TenantMirrorOptions, TenantResolutionContext, TenantResponse, TenantStatus, TenantValidators2 as TenantValidators, TenantWebhookPayload, UpdateTenantRequest2 as UpdateTenantRequest, UrlMap, VAULT_MIN_POLLING_TTL_MS, VaultConfigInvalidPayloadError, VaultConfigSourceOptions, VaultConfigWaitingForSecretError, VaultSubscribeNotSupportedError, VerifyUserOptions, allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, awsConfig, azureConfig, blockDangerousUrls, callback, captureRedirect, ciam, closeAllVaultSockets, collectReferencedDefinitions, configFromSource, configLocatorFromEnvValues, configSourceFromEnvValues, configSourceFromLocator, createManagedIamDelta, createSessionReadCache, createTenantIonHandler, createTenantIonResolver, defaultRedirectPolicies, deriveIonUrls, devInMemoryStores, discoverSessionRecords, discoverSessions, enforceEndpointAuthz, envConfig, escapeScimFilterValue, expandRoot, gcpConfig, generateULID, getCustomer, getUser, getWorkload, getWorkloadToken, has, hasAll2 as hasAll, hasAllScope, hasAny2 as hasAny, hasAnyScope, hasGroup2 as hasGroup, hasPermission2 as hasPermission, hasRole2 as hasRole, hasScope, iam, initiateLogin, ionite, isRedirectAllowed, isVaultConfigInvalidPayloadError, isVaultConfigWaitingForSecretError, lfvVault, listGenerator, listSsoClientIdsFromCookies, mirrorSecrets, mirroredConfig, reconcileSubjectAccess, resolveAfterRedirect, resolveCapturedRedirect, resolveDefaultRoute, resolveRedirect, resolveTenantFromRequest, revokeWorkloadToken, rewriteRequestForDefaultTenantApi, rewriteRequestForDefaultTenantUi, rewriteRequestForTenantPath, rewriteRequestPath, routeRequest, sameOriginRedirectRules, secretConfigSource, sendTenantWebhook, setVaultWebSocketCommandTimeout, sso, subscribeSecretPathWithHttpPolling, tenantManager, tenantMirror, validateWorkloadToken, vault, vaultConfig, vaultSocketDiagnostics, verifyUser, withSetCookies, workload, workloadHandler };