@ionite/server 0.0.24-beta.20261005.20 → 0.0.24-beta.20261006.22

package/dist/index.d.ts

@@ -459,8 +459,14 @@ declare const ION_CAPABILITY_CATALOG: readonly [{
 	readonly key: "iam.groups";
 	readonly module: "iam";
 	readonly label: "SCIM Groups inbound";
-	readonly requires: "AccessCatalogStore";
-	readonly incapableReason: "SCIM Groups endpoint is enabled by RemoteConfig but no AccessCatalogStore capability is wired by the application.";
+	readonly requires: "AccessCatalogStore or authz.catalog";
+	readonly incapableReason: "SCIM Groups endpoint is enabled by RemoteConfig but no catalog capability is wired by the application.";
+}, {
+	readonly key: "iam.groups.create";
+	readonly module: "iam";
+	readonly label: "IAM-sourced entitlement creation";
+	readonly requires: "AccessCatalogStore + authz.onInboundEntitlement";
+	readonly incapableReason: "The application has not wired durable catalog storage and explicitly opted into IAM-sourced entitlements.";
 }, {
 	readonly key: "iam.workloads";
 	readonly module: "iam";
@@ -993,7 +999,7 @@ declare function closeAllVaultSockets(): void;
 *
 * Keep this synchronized with packages/server/package.json via publish.ts.
 */
-declare const ION_SDK_VERSION = "0.0.24-beta.20261005.20";
+declare const ION_SDK_VERSION = "0.0.24-beta.20261006.22";
 import { ClaimsAsEntitlements, Workload as CoreWorkload, DerivedEntitlement, FrameworkWorkloadConfig, Ionite as Ionite7, JWTAssertionClaims, Logger as Logger7, TokenValidationResult, TrustedIdp, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentityStore as WorkloadIdentityStore2, WorkloadIncomingOutgoing, WorkloadTokenResponse, WorkloadTokenStore } from "@ionite/core";
 import { CatalogView } from "@ionite/core/server";
 import { StandardSchemaV1 } from "@standard-schema/spec";
@@ -1138,10 +1144,23 @@ type ClientCredentialsWorkloadConfig = WorkloadConfigBase & {
 	*/
 	clientId: string;
 	/**
-	* OAuth2 client secret
-	* REQUIRED for Client Credentials mode
+	* OAuth2 client secret. Omit it to authenticate with a federated token instead
+	* (see `federatedTokenFile`). A client secret wins when both are present.
+	*/
+	clientSecret?: string;
+	/**
+	* Path to a projected federated token (e.g. AKS Workload Identity), sent as a jwt-bearer
+	* `client_assertion` in place of `client_secret`. Defaults to `AZURE_FEDERATED_TOKEN_FILE`.
+	* Read on every acquisition because the platform rotates it.
+	*/
+	federatedTokenFile?: string;
+	/**
+	* `managed_identity`: get the token from the platform's managed identity endpoint instead of an
+	* IdP token URL — `IDENTITY_ENDPOINT` + `IDENTITY_HEADER` (Container Apps, App Service) or IMDS
+	* (ACI, VMs). `clientId` is the managed identity's client ID and `scope` names the audience
+	* (`<appId>/.default` → resource `<appId>`). No secret, token file or `idpTokenUrl` is needed.
 	*/
-	clientSecret: string;
+	authMethod?: "managed_identity";
 };
 /**
 * Server-Only Workload Configuration
@@ -1175,7 +1194,7 @@ type ServerOnlyWorkloadConfig = WorkloadConfigBase & {
 * detected based on which fields are present:
 *
 * - **JWT Bearer Grant**: Requires `workload_id` + `private_key`
-* - **Client Credentials**: Requires `client_id` + `client_secret`
+* - **Client Credentials**: Requires `client_id` + `client_secret`, a federated token file, or `authMethod: "managed_identity"`
 * - **Server-Only**: Only `jwks_uri` (and optionally `issuer`) for token validation
 *
 * The developer uses the same API regardless of mode - the library handles the details.