IBeam 2.16.0 — Enterprise tenant and customer management

IBeam 2.16.0 adds tenant and customer user management for enterprise onboarding through the Management API. Support users can administer their assigned applications while customer authentication, invitation acceptance and tenant data remain owned by each application backend.

Highlights

• Two new optional packages: IBeam.Management.Identity.Target.Api and IBeam.Management.Identity.Target.Services.
• Scoped tenant, customer membership and invitation directories, with bounded queries and protected continuation tokens.
• Enterprise onboarding with a first administrator invitation, target-owned role and onboarding policy discovery, durable progress and optional consumer initialization.
• Tenant creation, conditional rename and enable/disable; invitation-based customer provisioning, resend and revoke; membership status and role administration with last-administrator protection.
• Durable idempotency receipts, conditional versions, reconciliation of uncertain outcomes and metadata-only audit records. Invitations are accepted by verified customer accounts through native Identity.
• Live tenant and membership access enforcement for customer requests and refreshes, and trusted self-service/support-provisioned tenant provenance.
• A portable, NuGet-only Management API bootstrap with three synthetic customer backends, real support/customer MFA, startup scripts and a frontend agent handoff prompt.

Upgrade and integration

• Keep related IBeam packages aligned at 2.16.0. Packages target .NET 10.
• Register the optional target packages in each customer Identity backend and the corresponding portal services/endpoints in the management host. Configure separate support and customer identity realms, target trust, machine capabilities and support app assignments before enabling customer operations.
• Install native customer tenant/membership access enforcement before advertising status or membership management capabilities. Custom stores must implement the required conditional administration contracts; unsupported capabilities remain unavailable.
• Customer onboarding uses invitations and customer-owned acceptance. It does not give support users customer sessions or access to business tables. Billing, Licensing and Credits remain optional.
• Existing AddIBeamIdentityApi registration remains available. Hosts providing their own IIdentityCommunicationSender may register it first and use AddIBeamIdentityApiWithCommunicationSender.
• The bootstrap pins 2.16.0 and can restore published packages from NuGet.org. A local package feed remains optional for validation. The frontend connects to the running Management API.
• See the bootstrap, frontend handoff, and management guides.

Validation

• Completed IBM-0098 through IBM-0117: 20 cards across eight features, 104 points.
• Feature-completion validation passed 1,076 NuGet-only regression checks, seven temporary-host checks, and live support/customer MFA and enterprise onboarding smoke tests, including restart and access-revocation checks.
• Release package validation results and package checksums are supplied with the release artifacts.

Production NuGet publication of all 56 packages succeeded. Stable package-only validation passed 1,076 tests, with zero failures/skips, and the real support/customer MFA enterprise bootstrap smoke passed. All 56 packages passed content/version inspection; the fresh transitive audit found zero vulnerable package occurrences. Production validation passed.

All 56/56 stable packages were verified in the public NuGet.org feed. A fresh-cache NuGet.org-only bootstrap restore and build passed, resolving all 30 IBeam dependencies at 2.16.0.