@ionite/ecv 0.0.23-beta.20260809.2 → 0.0.23-beta.20260812.1

package/dist/index.d.ts

@@ -231,13 +231,6 @@ interface SSOValidationConfig extends ValidationConfig {
 	*/
 	expectedAuthorizationUrlPattern?: RegExp;
 	/**
-	* Optional opt-in best-practice assertion: when set, a FAILED callback's `Location` header must
-	* match this pattern. Apps following the recommended pattern redirect login failures to an
-	* unauthenticated-reachable page carrying a generic error code (e.g. `/[?&]auth_error=login_failed/`).
-	* When unset, the failure path is only asserted to be a same-origin 302 (the SDK contract).
-	*/
-	expectedCallbackErrorPattern?: RegExp;
-	/**
 	* Test user credentials for end-to-end SSO testing
 	* If not provided, only structural tests will run
 	*/
@@ -584,91 +577,77 @@ declare function validateCapabilities(config: CapabilityValidationConfig): Promi
 * Creates a Vitest-compatible test suite for capability catalog validation.
 */
 declare function createCapabilityTests(config: CapabilityValidationConfig): Array<TestDef>;
-import { CapabilitiezManifest, CapabilityKey, Ionite as Ionite2 } from "@ionite/server";
-interface DiscoveredECVConfig extends ValidationConfig {
-	/**
-	* ionite basePath used by the application under test.
-	* @default "/api/ionite"
-	*/
-	basePath?: string;
-	/**
-	* Override the capabilitiez path when the endpoint is not mounted at `${basePath}/capabilitiez`.
-	*/
+import { CapabilitiezManifest as CapabilitiezManifest2, CapabilityKey as CapabilityKey2, Ionite as Ionite2 } from "@ionite/server";
+/** SDK versions whose runtime manifest is compatible with this ECV catalog. */
+declare const SUPPORTED_SDK_RANGE = ">=0.0.23-beta.20260809.2 <0.1.0";
+/**
+* Known-bad SDK releases rejected by the local validation handshake.
+*
+* This is fast-fail developer feedback only. The ECI remains authoritative for
+* business workflows based on the version facts uploaded with validation runs.
+*/
+declare const QUARANTINED_SDK_VERSIONS: readonly string[];
+interface EcvAnnotationContext {
+	annotate?: (message: string, type?: string) => void;
+}
+declare function satisfiesSdkRange(version: string, range?: string): boolean;
+interface ECVCatalogConfig extends ValidationConfig {
+	/** ionite basePath used by the application under test. @default "/api/ionite" */
+	basePath?: string | (() => string);
+	/** Override when capabilitiez is not mounted at `${basePath}/capabilitiez`. */
 	capabilitiezPath?: string;
-	/**
-	* Opt-in best-practice assertion threaded into the SSO suite: when set, a FAILED callback's
-	* `Location` must match this pattern (e.g. `/[?&]auth_error=login_failed/`). See
-	* {@link SSOValidationConfig.expectedCallbackErrorPattern}.
-	*/
-	expectedCallbackErrorPattern?: RegExp;
-	/**
-	* ECV mock server handle (from `startEcvServer`), or a getter returning it. Preferred over `ecvUrl`:
-	* the discovery and IAM token-minting URL is derived from `ecv.baseUrl`, so it can never drift from
-	* where the server started. A getter is supported because the handle is often created in `beforeAll`,
-	* after test collection.
-	*/
 	ecv?: EcvServerHandle | (() => EcvServerHandle);
-	/**
-	* Ionite instance used by IAM tests to obtain workload-authenticated SCIM tokens.
-	* Optional escape hatch for real-IdP / custom-scope runs; when omitted, tokens are minted from the
-	* ECV mock server.
-	*/
 	ion?: Ionite2 | (() => Ionite2 | null);
-	/**
-	* ECV mock server base URL used to mint workload tokens for authenticated discovery.
-	* Ignored when `ecv` is provided.
-	* @default "http://localhost:3515"
-	*/
+	/** ECV mock server URL. Ignored when `ecv` is provided. */
 	ecvUrl?: string;
 }
-declare function fetchCapabilitiezManifest(config: DiscoveredECVConfig): Promise<CapabilitiezManifest>;
-/**
-* A single discoverable ECV check. Entries are enumerated up front (so every possible check is
-* visible in the test reporter) and gated at run time against the capabilitiez manifest. `alwaysRun`
-* entries (in-process closure, config retry, manifest reachability) ignore capability gating.
-*/
+declare function fetchCapabilitiezManifest(config: ECVCatalogConfig): Promise<CapabilitiezManifest2>;
+type EcvCatalogUnit = CapabilityKey2 | "tenant.management" | `sdk.${string}` | `meta.${string}`;
 interface EcvCatalogEntry {
-	/** Stable machine id (suite + name slug). */
+	/** Stable machine ID parsed from the `ECV(...)` title marker. */
 	id: string;
-	/** Display group: 'SSO' | 'CIAM' | 'IAM' | 'Workload' | 'Authz/OAA' | 'Authz closure' | 'Discovery' | 'Config retry policy'. */
+	/** Compliance or SDK unit that owns this assertion. */
+	unit: EcvCatalogUnit;
+	/** Human-readable reporter group. */
 	suite: string;
-	/** Human-readable test name. */
+	/** Human-readable assertion name. */
 	name: string;
-	/** Capability gate; when omitted (or `alwaysRun`), the check is not gated. An array passes if ANY key is testable. */
-	capability?: CapabilityKey | CapabilityKey[];
-	/** Always run regardless of capabilitiez (in-process or infrastructure checks). */
-	alwaysRun?: boolean;
-	/** Execute the underlying assertion using the resolved manifest (present for capability-gated entries). */
-	run: (manifest?: CapabilitiezManifest) => Promise<void>;
+	/** Complete portable reporter title. */
+	title: string;
+	/** Execute the assertion. Manifest is required only for runtime/meta assertions. */
+	run: (manifest: CapabilitiezManifest2 | undefined, context?: EcvAnnotationContext) => Promise<void>;
 }
-/**
-* Compute a skip reason for an entry's capability gate, or `undefined` when it should run. Prefers the
-* manifest's own `reason` string so skips explain why a capability is not wired/testable.
-*/
-declare function capabilitySkipReason(manifest: CapabilitiezManifest, capability?: CapabilityKey | CapabilityKey[]): string | undefined;
-/**
-* Build the full catalog of discoverable ECV checks. Names are enumerated synchronously so the
-* complete list is visible at collection time; capability-gated entries resolve their shared factory
-* instance lazily from the manifest at run time (preserving cross-test state such as created user ids).
-*/
-declare function buildEcvCatalog(config: DiscoveredECVConfig, options?: {
-	configRetry?: boolean;
-}): EcvCatalogEntry[];
-/**
-* Build discovered ECV tests as a flat `TestDef[]` for manual wiring.
-*
-* @deprecated Plain `TestDef`s cannot signal a real skip to the test reporter, so a capability that
-* is not testable is reported as a pass — only mitigated here by a visible `console.warn` SKIP line.
-* Prefer {@link defineDiscoveredECVSuite}, which reports each skipped capability via `ctx.skip(reason)`
-* so the reporter distinguishes skipped from passed (AUDIT_HISTORY.md §4.10).
-*/
-declare function createDiscoveredECVTests(config: DiscoveredECVConfig): Array<TestDef>;
+/** Build the metadata tests that describe and validate an ECV run. */
+declare function buildEcvMetaCatalog(claims: () => readonly CapabilityKey2[]): EcvCatalogEntry[];
+/** Build the in-process SDK regression catalog registered by `ecv.sdk()`. */
+declare function buildEcvSdkCatalog(): EcvCatalogEntry[];
+interface EcvTenantCatalogOptions {
+	/** Root tenant-management application URL; defaults to the suite setup baseUrl. */
+	baseUrl?: ValidationConfig["baseUrl"];
+	tenantPath?: string;
+	profile?: TenantValidationProfile;
+	webhookPath?: string;
+}
+/** Build root tenant-management assertions registered by `ecv.tenants()`. */
+declare function buildEcvTenantCatalog(config: ECVCatalogConfig, options?: EcvTenantCatalogOptions): EcvCatalogEntry[];
+/** Options specific to one explicitly registered capability unit. */
+interface EcvUnitCatalogOptions {
+	expectedCallbackErrorPattern?: RegExp;
+}
+/** Build the static entries for one capability selected by the suite builder. */
+declare function buildEcvUnitCatalog(config: ECVCatalogConfig, unit: CapabilityKey2, options?: EcvUnitCatalogOptions): EcvCatalogEntry[];
 /**
 * Runs all CIAM validation tests
 */
 declare function validateCIAM(config: CIAMValidationConfig): Promise<ValidationSuiteResult>;
 declare function createCIAMTests(config: CIAMValidationConfig): {
 	tests: Array<TestDef>;
+	ext: {
+		createCustomerTests: () => Array<TestDef>;
+		createMagicLinkTests: () => Array<TestDef>;
+		createOidcLoginTests: () => Array<TestDef>;
+		createLogoutTests: () => Array<TestDef>;
+	};
 };
 /**
 * Lifecycle hardening coverage (AUDIT_HISTORY.md §5.1/§5.2/§5.4): module-readiness re-arm on de-configuration,
@@ -790,6 +769,41 @@ declare function validateProtocolSurface(): Promise<{
 	passed: boolean;
 	error?: string;
 }[]>;
+import { CreateTenantRequest } from "@ionite/server";
+interface ProvisionTenantOptions {
+	/** Running ECV mock used for workload credentials and the tenant config locator. */
+	ecv: EcvServerHandle;
+	/** Base URL of the root tenant-management application. */
+	baseUrl: string;
+	/** Tenant-management endpoint. @default "/api/tenants" */
+	tenantPath?: string;
+	/** Full manager contract or deployer-style creation-only contract. @default "tenantManager" */
+	profile?: TenantValidationProfile;
+	/** Tenant data. configLocator and webhookUrl default to ECV mock values. */
+	tenant: Omit<CreateTenantRequest, "configLocator"> & {
+		configLocator?: CreateTenantRequest["configLocator"];
+	};
+	/** Tenant ionite mount for creation-only deployers. @default "/api/ionite" */
+	basePath?: string;
+	/** Readiness polling overrides. */
+	readiness?: WaitForReadyOptions;
+}
+interface ProvisionedTenant {
+	id: string;
+	/** URL used as ValidationConfig.baseUrl for the tenant suite. */
+	baseUrl: string;
+	/** Tenant ionite mount used to locate capabilitiez and protocol routes. */
+	basePath: string;
+	/** Tenant URL reported by the tenant-management service. */
+	tenantUrl: string;
+}
+/**
+* Provision the fixture tenant that another ECV suite will run against.
+*
+* This helper performs the application's real tenant-management flow. It does not
+* register tenant-management assertions; use `ecv.tenants()` for that contract.
+*/
+declare function provisionTenant(options: ProvisionTenantOptions): Promise<ProvisionedTenant>;
 declare function createRedisStoreTests(): {
 	tests: TestDef[];
 };
@@ -798,37 +812,6 @@ declare function createSecretsHardeningTests(): {
 	tests: TestDef[];
 };
 declare function validateSecretsHardening(): Promise<ValidationSuiteResult>;
-/**
-* Runs all SSO validation tests
-*/
-declare function validateSSO(config: SSOValidationConfig): Promise<ValidationSuiteResult>;
-/**
-* Creates Vitest-compatible test suite for SSO validation
-*/
-declare function createSSOTests(config: SSOValidationConfig): {
-	tests: Array<TestDef>;
-	ext: {
-		createJITTests: () => Array<TestDef>;
-		createLogoutTests: () => Array<TestDef>;
-		createBackChannelLogoutTests: () => Array<TestDef>;
-	};
-};
-declare function createSsoIdTokenVerificationTests(): {
-	tests: TestDef[];
-};
-declare function validateSsoIdTokenVerification(): Promise<ValidationSuiteResult>;
-/**
-* Runs all Tenant validation tests
-*/
-declare function validateTenant(config: TenantValidationConfig): Promise<ValidationSuiteResult>;
-/**
-* Creates Vitest-compatible test suite for Tenant validation
-*/
-declare function createTenantTests(config: TenantValidationConfig): Array<TestDef>;
-declare function createTenantLifecycleTests(): {
-	tests: TestDef[];
-};
-declare function validateTenantLifecycle(): Promise<ValidationSuiteResult>;
 type StandardSchemaV1 = {
 	readonly "~standard": {
 		readonly validate: (value: unknown) => {
@@ -891,6 +874,77 @@ declare function assertEqual<T>(actual: T, expected: T, message?: string): void;
 * @throws Error if validation fails
 */
 declare function assertValid(data: unknown, validator: StandardSchemaV1, message?: string): void;
+/**
+* Drive a login from initiation through the callback (optionally tampering the auth code or carrying
+* a `?redirect` param) and return the callback Response plus the minted state. Mock OIDC must be
+* reachable (same wiring the JIT flow relies on).
+*/
+declare function runLoginToCallback(config: SSOValidationConfig, fetch: ReturnType<typeof createFetcher>, opts?: {
+	redirectParam?: string;
+	bogusCode?: boolean;
+}): Promise<{
+	callback: Response;
+	state: string | null;
+}>;
+/**
+* Helper: Complete a full SSO login flow through the mock server
+*
+* Returns the cookies set after successful authentication
+*/
+declare function completeLoginFlow(config: SSOValidationConfig, fetch: ReturnType<typeof createFetcher>): Promise<{
+	cookies: Map<string, string>;
+	success: boolean;
+	error?: string;
+}>;
+/**
+* Runs all SSO validation tests
+*/
+declare function validateSSO(config: SSOValidationConfig): Promise<ValidationSuiteResult>;
+/**
+* Creates Vitest-compatible test suite for SSO validation
+*/
+declare function createSSOTests(config: SSOValidationConfig): {
+	tests: Array<TestDef>;
+	ext: {
+		createJITTests: () => Array<TestDef>;
+		createLogoutTests: () => Array<TestDef>;
+		createBackChannelLogoutTests: () => Array<TestDef>;
+		createCallbackErrorSurfacedTests: (expectedPattern: RegExp) => Array<TestDef>;
+	};
+};
+declare function createSsoIdTokenVerificationTests(): {
+	tests: TestDef[];
+};
+declare function validateSsoIdTokenVerification(): Promise<ValidationSuiteResult>;
+/**
+* Runs all Tenant validation tests
+*/
+declare function validateTenant(config: TenantValidationConfig): Promise<ValidationSuiteResult>;
+/**
+* Creates Vitest-compatible test suite for Tenant validation
+*/
+declare function createTenantTests(config: TenantValidationConfig): Array<TestDef>;
+interface TenantManagementTestConfig extends ValidationConfig {
+	/** ECV mock used to mint tenant-management tokens and serve tenant config. */
+	ecv: EcvServerHandle | (() => EcvServerHandle);
+	/** Tenant-management endpoint. @default "/api/tenants" */
+	tenantPath?: string;
+	/** Full tenant manager or creation-only deployer contract. @default "tenantManager" */
+	profile?: TenantValidationProfile;
+	/** Optional app-owned webhook path retained for the lower-level contract tests. */
+	webhookPath?: string;
+}
+/**
+* Build the root tenant-management contract used by `ecv.tenants()`.
+*
+* These tests create their own ephemeral tenants and never mutate the fixture tenant
+* returned by the suite's setup function.
+*/
+declare function createTenantManagementTests(config: TenantManagementTestConfig): Array<TestDef>;
+declare function createTenantLifecycleTests(): {
+	tests: TestDef[];
+};
+declare function validateTenantLifecycle(): Promise<ValidationSuiteResult>;
 declare function createValidatorParityTests(): {
 	tests: TestDef[];
 };
@@ -904,6 +958,12 @@ declare function createVaultWebSocketTransportTests(): {
 };
 declare function validateVaultWebSocketTransport(): Promise<ValidationSuiteResult>;
 /**
+* Generated package version embedded in validation result metadata.
+*
+* Keep this synchronized with packages/ecv/package.json via publish.ts.
+*/
+declare const ECV_VERSION = "0.0.23-beta.20260812.1";
+/**
 * Runs all Workload validation tests
 */
 declare function validateWorkload(config: WorkloadValidationConfig): Promise<ValidationSuiteResult>;
@@ -912,135 +972,86 @@ declare function validateWorkload(config: WorkloadValidationConfig): Promise<Val
 */
 declare function createWorkloadTests(config: WorkloadValidationConfig): Array<TestDef>;
 import { Ionite as Ionite3 } from "@ionite/server";
-/**
-* Helper to create a complete Vitest test suite
-*
-* @example
-* ```typescript
-* import { describe, it } from 'vitest';
-* import { defineECVTests } from '@ionite/ecv';
-*
-* defineECVTests(describe, it, {
-*   baseUrl: 'http://localhost:3000',
-*   sso: true,
-*   workload: true,
-* });
-* ```
-*/
-declare function defineECVTests(describe: (name: string, fn: () => void) => void, it: (name: string, fn: () => Promise<void>) => void, config: {
-	baseUrl: string;
-	sso?: boolean | SSOValidationConfig;
-	ciam?: boolean | CIAMValidationConfig;
-	lfv?: boolean;
-	/**
-	* OpenTelemetry module validation. OPT-IN (`otel: true`): the suite starts a process-global
-	* `NodeSDK`, which registers global OTel providers/diagnostics for the whole test process, so it
-	* is off by default to avoid interfering with a consumer's own tracing/other suites. In-repo
-	* coverage still runs it via the discovered `capabilitiez` catalog (always-run).
-	*/
-	otel?: boolean;
-	/** KMS token-pool lifecycle validation. Enabled by default; set `false` to omit it. */
-	kms?: boolean;
-	protocolSurface?: boolean;
-	harness?: boolean;
-	secretsHardening?: boolean;
-	redisStores?: boolean;
-	tenantLifecycle?: boolean;
-	vaultWebsocket?: boolean;
-	vaultCoordination?: boolean;
-	idTokenVerification?: boolean;
-	performanceTuning?: boolean;
-	validatorParity?: boolean;
-	iam?: IAMValidationConfig;
-	workload?: boolean | WorkloadValidationConfig;
-	tenant?: boolean | TenantValidationConfig;
-	capabilities?: boolean | CapabilityValidationConfig;
-	authz?: boolean | AuthzValidationConfig;
-}): void;
-/**
-* Vitest-style lifecycle hooks passed into {@link defineDiscoveredECVSuite}.
-*
-* The helper takes hooks rather than importing `vitest` so the package stays framework-agnostic.
-*/
-/**
-* Minimal Vitest test-context shape used by discovered ECV tests. Vitest's real `TestContext`
-* structurally satisfies this (its `skip(note?)` dynamically marks the running test as skipped).
-*/
+/** Minimal test context used to emit portable JUnit testcase properties when supported. */
 interface EcvTestContext {
-	skip: (note?: string) => void;
+	annotate?: (message: string, type?: string) => void;
 }
-interface DiscoveredECVSuiteHooks {
+/** Test-framework hooks needed by {@link ecvSuite}. */
+interface EcvSuiteHooks {
 	describe: (name: string, fn: () => void) => void;
-	it: (name: string, fn: (ctx: EcvTestContext) => Promise<void> | void) => void;
+	it: (name: string, fn: (context: EcvTestContext) => Promise<void> | void) => void;
 	beforeAll: (fn: () => Promise<void> | void) => void;
-	afterAll: (fn: () => Promise<void> | void) => void;
 }
-/**
-* Configuration for {@link defineDiscoveredECVSuite}.
-*/
-interface DiscoveredECVSuiteConfig {
-	/**
-	* ECV mock server handle (or getter) from `startEcvServer`. The app's connection env is taken from
-	* `ecv.env`, and IAM/workload/capabilitiez token minting is derived from `ecv.baseUrl`.
-	*/
-	ecv: EcvServerHandle | (() => EcvServerHandle);
+interface EcvSuiteSetup {
+	/** Running ECV mock/control server used for workload token minting. */
+	ecv: EcvServerHandle;
+	/** URL of the already-running application under test. */
+	baseUrl: string;
+	/** Runtime ionite mount, useful when setup provisions a tenant dynamically. */
+	basePath?: string;
+}
+interface EcvSuiteOptions {
+	/** Hooks for the test framework that will own the generated suites. */
+	hooks: EcvSuiteHooks;
 	/**
-	* The application under test to spawn. `ecv.env` is merged in automatically (your `app.env` wins on
-	* conflicts), so you only specify app-specific variables here.
-	*/
-	app: StartAppOptions;
-	/**
-	* ionite basePath used by the application under test.
-	* @default "/api/ionite"
+	* Caller-owned setup. Start databases, indexes, the ECV mock, and the app in
+	* the order your system needs; return only after the app is ready.
 	*/
+	setup: () => Promise<EcvSuiteSetup>;
+	/** ionite handler mount. @default "/api/ionite" */
 	basePath?: string;
-	/** Timeout (ms) applied to discovered validation requests. */
+	/** Override `${basePath}/capabilitiez`. */
+	capabilitiezPath?: string;
+	/** Request timeout in milliseconds. @default 15000 */
 	timeout?: number;
-	/**
-	* Opt-in best-practice assertion: when set, a FAILED SSO callback's `Location` must match this
-	* pattern (e.g. `/[?&]auth_error=login_failed/`), proving the app surfaces login errors to the user.
-	*/
-	expectedCallbackErrorPattern?: RegExp;
-	/**
-	* Register the config-retry policy tests alongside discovered tests.
-	* @default false
-	*/
-	configRetry?: boolean;
-	/**
-	* Optional Ionite instance escape hatch for IAM token minting (real-IdP / custom scopes).
-	* When omitted, IAM tokens are minted from the ECV mock server.
-	*/
+	skipTlsVerify?: boolean;
+	headers?: ECVCatalogConfig["headers"];
+	/** Optional IAM token-minting escape hatch for real IdP/custom scope runs. */
 	ion?: Ionite3 | (() => Ionite3 | null);
 }
+interface EcvSsoLoginOptions {
+	/** Register a named assertion that failed callbacks expose this generic error marker. */
+	expectedCallbackErrorPattern?: RegExp;
+}
+type EcvTenantsOptions = EcvTenantCatalogOptions;
+/** Navigable ECV unit registrar returned by {@link ecvSuite}. */
+interface EcvSuite {
+	sso: {
+		login: (options?: EcvSsoLoginOptions) => void;
+		jit: () => void;
+		logout: () => void;
+		back_channel_logout: () => void;
+	};
+	ciam: {
+		customer: () => void;
+		magic_link: () => void;
+		oidc_login: () => void;
+		logout: () => void;
+	};
+	iam: {
+		users: () => void;
+		groups: () => void;
+	};
+	workload: {
+		incoming: () => void;
+		outgoing: () => void;
+	};
+	authz: {
+		oaa: () => void;
+	};
+	/** Register root tenant-management and cross-tenant isolation assertions. */
+	tenants: (options?: EcvTenantsOptions) => void;
+	/** Register in-process SDK lifecycle and regression assertions. */
+	sdk: () => void;
+}
 /**
-* Register a complete discovered-ECV suite: spawn the app under test, run config-retry (optional) and
-* capabilitiez-discovered module tests, and tear the app down afterwards.
+* Create an explicit ECV suite against caller-managed infrastructure.
 *
-* The ECV mock server (and any Redis) lifecycle stays with the caller, since not every project uses Redis.
-*
-* @example
-* ```ts
-* import { afterAll, beforeAll, describe, it } from 'vitest';
-* import { defineDiscoveredECVSuite, startEcvServer, stopEcvServer } from '@ionite/ecv';
-*
-* let ecv: Awaited<ReturnType<typeof startEcvServer>>;
-* beforeAll(async () => { ecv = await startEcvServer(); });
-* afterAll(async () => { await stopEcvServer(); });
-*
-* defineDiscoveredECVSuite(
-*   { describe, it, beforeAll, afterAll },
-*   {
-*     ecv: () => ecv,
-*     app: { command: 'bun', args: ['run', 'api'], baseUrl: 'http://localhost:3544' },
-*     basePath: '/api/ionite',
-*     configRetry: true,
-*   },
-* );
-* ```
-*/
-declare function defineDiscoveredECVSuite(hooks: DiscoveredECVSuiteHooks, config: DiscoveredECVSuiteConfig): void;
-/**
-* Print a validation report to console
+* Calling a unit method registers that unit's tests at collection time. Runtime
+* capabilitiez state resolves endpoint URLs and validates parity; it never
+* silently changes the selected test set.
 */
+declare function ecvSuite(config: EcvSuiteOptions): EcvSuite;
+/** Print the legacy structured report used by the deferred standalone runner. */
 declare function printReport(report: ValidationReport): void;
-export { waitForReady, validateWorkload, validateVaultWebSocketTransport, validateVaultCoordination, validateValidatorParity, validateTenantLifecycle, validateTenant, validateSsoIdTokenVerification, validateSecretsHardening, validateSSO, validateRedisStores, validateProtocolSurface, validatePerformanceTuning, validateOtel, validateLfvDelivery, validateKms, validateIamDelta, validateIAM, validateCapabilities, validateCIAM, validateAuthz, stopEcvServer, startEcvServer, startAppUnderTest, skipTest, setVaultRedisUrl, runTest, resolveBaseUrl, printReport, getVaultRedisUrl, getTenantAuthToken, fetchCapabilitiezManifest, defineECVTests, defineDiscoveredECVSuite, createWorkloadTests, createWorkloadScopeTests, createVaultWebSocketTransportTests, createVaultCoordinationTests, createValidatorParityTests, createTenantTests, createTenantLifecycleTests, createSsoIdTokenVerificationTests, createSecretsHardeningTests, createSSOTests, createRedisStoreTests, createProtocolSurfaceTests, createPerformanceTuningTests, createOtelTests, createOaaProjectionTests, createLfvCallbackTests, createKmsTests, createIamDeltaPatchTests, createIAMTests, createHarnessSelfTests, createFetcher, createDiscoveredECVTests, createConfigRetryTests, createConfigLifecycleTests, createConfigBoundaryTests, createCapabilityTests, createCIAMTests, createAuthzClosureTests, capabilitySkipReason, buildEcvCatalog, assertValid, assertEqual, assert, WorkloadValidationConfig, WaitForReadyOptions, ValidationSuiteResult, ValidationResult, ValidationReport, ValidationConfig, TestDef, TenantValidationProfile, TenantValidationConfig, StartAppOptions, SSOValidationConfig, ION_TENANT_SCOPE, ION_IAM_SCOPES, ION_CAPABILITIEZ_SCOPE, IAMValidationConfig, EcvTestContext, EcvServerHandle, EcvCatalogEntry, DiscoveredECVSuiteHooks, DiscoveredECVSuiteConfig, DiscoveredECVConfig, CapabilityValidationConfig, CIAMValidationConfig, AuthzValidationConfig, AppUnderTest };
+export { waitForReady, validateWorkload, validateVaultWebSocketTransport, validateVaultCoordination, validateValidatorParity, validateTenantLifecycle, validateTenant, validateSsoIdTokenVerification, validateSecretsHardening, validateSSO, validateRedisStores, validateProtocolSurface, validatePerformanceTuning, validateOtel, validateLfvDelivery, validateKms, validateIamDelta, validateIAM, validateCapabilities, validateCIAM, validateAuthz, stopEcvServer, startEcvServer, startAppUnderTest, skipTest, setVaultRedisUrl, satisfiesSdkRange, runTest, runLoginToCallback, resolveBaseUrl, provisionTenant, printReport, getVaultRedisUrl, getTenantAuthToken, fetchCapabilitiezManifest, ecvSuite, createWorkloadTests, createWorkloadScopeTests, createVaultWebSocketTransportTests, createVaultCoordinationTests, createValidatorParityTests, createTenantTests, createTenantManagementTests, createTenantLifecycleTests, createSsoIdTokenVerificationTests, createSecretsHardeningTests, createSSOTests, createRedisStoreTests, createProtocolSurfaceTests, createPerformanceTuningTests, createOtelTests, createOaaProjectionTests, createLfvCallbackTests, createKmsTests, createIamDeltaPatchTests, createIAMTests, createHarnessSelfTests, createFetcher, createConfigRetryTests, createConfigLifecycleTests, createConfigBoundaryTests, createCapabilityTests, createCIAMTests, createAuthzClosureTests, completeLoginFlow, buildEcvUnitCatalog, buildEcvTenantCatalog, buildEcvSdkCatalog, buildEcvMetaCatalog, assertValid, assertEqual, assert, WorkloadValidationConfig, WaitForReadyOptions, ValidationSuiteResult, ValidationResult, ValidationReport, ValidationConfig, TestDef, TenantValidationProfile, TenantValidationConfig, TenantManagementTestConfig, StartAppOptions, SUPPORTED_SDK_RANGE, SSOValidationConfig, QUARANTINED_SDK_VERSIONS, ProvisionedTenant, ProvisionTenantOptions, ION_TENANT_SCOPE, ION_IAM_SCOPES, ION_CAPABILITIEZ_SCOPE, IAMValidationConfig, EcvUnitCatalogOptions, EcvTestContext, EcvTenantsOptions, EcvTenantCatalogOptions, EcvSuiteSetup, EcvSuiteOptions, EcvSuiteHooks, EcvSuite, EcvSsoLoginOptions, EcvServerHandle, EcvCatalogUnit, EcvCatalogEntry, ECV_VERSION, ECVCatalogConfig, CapabilityValidationConfig, CIAMValidationConfig, AuthzValidationConfig, AppUnderTest };

package/dist/index.js

@@ -1 +1 @@
-import{$ as _,A as z,B as A,C as B,D as C,E as D,F as E,G as F,H as G,I as H,J as I,K as J,L as K,M as L,N as M,O as N,P as O,Q as P,R as Q,S as R,T as S,U as T,V as U,W as V,X as W,Y as X,Z as Y,_ as Z,aa as $,b as a,ba as aa,c as b,ca as ba,d as c,da as ca,e as d,ea as da,f as e,fa as ea,g as f,ga as fa,h as g,ha as ga,i as h,ia as ha,j as i,ja as ia,k as j,ka as ja,l as k,la as ka,m as l,ma as la,n as m,na as ma,o as n,oa as na,p as o,pa as oa,q as p,qa as pa,r as q,s as r,t as s,u as t,v as u,w as v,x as w,y as x,z as y}from"./shared/ecv-e6q7dq32.js";export{a as waitForReady,V as validateWorkload,ma as validateVaultWebSocketTransport,U as validateVaultCoordination,ka as validateValidatorParity,ia as validateTenantLifecycle,fa as validateTenant,S as validateSsoIdTokenVerification,ea as validateSecretsHardening,P as validateSSO,ca as validateRedisStores,O as validateProtocolSurface,aa as validatePerformanceTuning,M as validateOtel,K as validateLfvDelivery,I as validateKms,G as validateIamDelta,D as validateIAM,v as validateCapabilities,x as validateCIAM,q as validateAuthz,f as stopEcvServer,e as startEcvServer,b as startAppUnderTest,j as skipTest,c as setVaultRedisUrl,i as runTest,g as resolveBaseUrl,pa as printReport,d as getVaultRedisUrl,u as getTenantAuthToken,X as fetchCapabilitiezManifest,na as defineECVTests,oa as defineDiscoveredECVSuite,W as createWorkloadTests,p as createWorkloadScopeTests,la as createVaultWebSocketTransportTests,T as createVaultCoordinationTests,ja as createValidatorParityTests,ga as createTenantTests,ha as createTenantLifecycleTests,R as createSsoIdTokenVerificationTests,da as createSecretsHardeningTests,Q as createSSOTests,ba as createRedisStoreTests,N as createProtocolSurfaceTests,$ as createPerformanceTuningTests,L as createOtelTests,o as createOaaProjectionTests,J as createLfvCallbackTests,H as createKmsTests,F as createIamDeltaPatchTests,E as createIAMTests,C as createHarnessSelfTests,h as createFetcher,_ as createDiscoveredECVTests,B as createConfigRetryTests,z as createConfigLifecycleTests,A as createConfigBoundaryTests,w as createCapabilityTests,y as createCIAMTests,n as createAuthzClosureTests,Y as capabilitySkipReason,Z as buildEcvCatalog,m as assertValid,l as assertEqual,k as assert,t as ION_TENANT_SCOPE,r as ION_IAM_SCOPES,s as ION_CAPABILITIEZ_SCOPE};
+import{$ as _,A as z,B as A,C as B,D as C,E as D,F as E,G as F,H as G,I as H,J as I,K as J,L as K,M as L,N as M,O as N,P as O,Q as P,R as Q,S as R,T as S,U as T,V as U,W as V,X as W,Y as X,Z as Y,_ as Z,aa as $,b as a,ba as aa,c as b,ca as ba,d as c,da as ca,e as d,ea as da,f as e,fa as ea,g as f,ga as fa,h as g,ha as ga,i as h,ia as ha,j as i,ja as ia,k as j,ka as ja,l as k,la as ka,m as l,ma as la,n as m,na as ma,o as n,oa as na,p as o,pa as oa,q as p,qa as pa,r as q,ra as qa,s as r,sa as ra,t as s,ta as sa,u as t,ua as ta,v as u,va as ua,w as v,wa as va,x as w,xa as wa,y as x,ya as xa,z as y}from"./shared/ecv-0fhy6dss.js";export{a as waitForReady,da as validateWorkload,va as validateVaultWebSocketTransport,ca as validateVaultCoordination,ta as validateValidatorParity,ra as validateTenantLifecycle,_ as validateTenant,Y as validateSsoIdTokenVerification,pa as validateSecretsHardening,V as validateSSO,na as validateRedisStores,S as validateProtocolSurface,la as validatePerformanceTuning,Q as validateOtel,K as validateLfvDelivery,I as validateKms,G as validateIamDelta,D as validateIAM,v as validateCapabilities,x as validateCIAM,q as validateAuthz,f as stopEcvServer,e as startEcvServer,b as startAppUnderTest,j as skipTest,c as setVaultRedisUrl,O as satisfiesSdkRange,i as runTest,T as runLoginToCallback,g as resolveBaseUrl,Z as provisionTenant,xa as printReport,d as getVaultRedisUrl,u as getTenantAuthToken,fa as fetchCapabilitiezManifest,wa as ecvSuite,ea as createWorkloadTests,p as createWorkloadScopeTests,ua as createVaultWebSocketTransportTests,ba as createVaultCoordinationTests,sa as createValidatorParityTests,$ as createTenantTests,aa as createTenantManagementTests,qa as createTenantLifecycleTests,X as createSsoIdTokenVerificationTests,oa as createSecretsHardeningTests,W as createSSOTests,ma as createRedisStoreTests,R as createProtocolSurfaceTests,ka as createPerformanceTuningTests,P as createOtelTests,o as createOaaProjectionTests,J as createLfvCallbackTests,H as createKmsTests,F as createIamDeltaPatchTests,E as createIAMTests,C as createHarnessSelfTests,h as createFetcher,B as createConfigRetryTests,z as createConfigLifecycleTests,A as createConfigBoundaryTests,w as createCapabilityTests,y as createCIAMTests,n as createAuthzClosureTests,U as completeLoginFlow,ja as buildEcvUnitCatalog,ia as buildEcvTenantCatalog,ha as buildEcvSdkCatalog,ga as buildEcvMetaCatalog,m as assertValid,l as assertEqual,k as assert,M as SUPPORTED_SDK_RANGE,N as QUARANTINED_SDK_VERSIONS,t as ION_TENANT_SCOPE,r as ION_IAM_SCOPES,s as ION_CAPABILITIEZ_SCOPE,L as ECV_VERSION};

package/dist/runner.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
-import{E as V,H as W,J as y,L as D,Q as x,W as M,a as E,ba as _,ga as A,k as H,la as w,r as N,y as O}from"./shared/ecv-e6q7dq32.js";import{ionite as S,vault as P,vaultConfig as f}from"@ionite/server";import{createValidators as m}from"@ionite/valibot";function L(G,F,X){return{suite:G,passed:!0,tests:[H(F,X)],duration:0,summary:{total:1,passed:0,failed:0,skipped:1}}}async function Z(G,F,X){console.log(`\uD83D\uDCDD Running ${F} validation tests...`);try{let Q=await X();return console.log(`   ${Q.passed?"✅":"❌"} ${G}: ${Q.summary.passed}/${Q.summary.total} passed
+import{$ as M,E as V,H as W,J as y,L as D,W as x,a as E,ea as _,k as H,ma as A,r as N,ua as w,y as O}from"./shared/ecv-0fhy6dss.js";import{ionite as S,vault as P,vaultConfig as f}from"@ionite/server";import{createValidators as m}from"@ionite/valibot";function L(G,F,X){return{suite:G,passed:!0,tests:[H(F,X)],duration:0,summary:{total:1,passed:0,failed:0,skipped:1}}}async function Z(G,F,X){console.log(`\uD83D\uDCDD Running ${F} validation tests...`);try{let Q=await X();return console.log(`   ${Q.passed?"✅":"❌"} ${G}: ${Q.summary.passed}/${Q.summary.total} passed
 `),Q}catch(Q){return console.error(`   ❌ ${G} tests failed: ${Q instanceof Error?Q.message:String(Q)}
 `),{suite:G,passed:!1,tests:[{name:`${G} Test Execution`,passed:!1,error:Q instanceof Error?Q.message:String(Q),duration:0}],duration:0,summary:{total:1,passed:0,failed:1,skipped:0}}}}function k(G){let F=P({type:"vault",url:process.env.ION_VAULT_URL,token:process.env.ION_VAULT_TOKEN});return S(f({vault:F,path:G}),{validators:m()})}function p(){let G=process.env.TEST_BASE_URL,F=process.env.ION_VAULT_URL,X=process.env.ION_VAULT_TOKEN,Q=process.env.ION_VAULT_PATH,Y=process.env.RESULTS_CALLBACK_URL;if(!G)throw Error("TEST_BASE_URL environment variable is required");if(!F)throw Error("ION_VAULT_URL environment variable is required");if(!X)throw Error("ION_VAULT_TOKEN environment variable is required");if(!Q)throw Error("ION_VAULT_PATH environment variable is required");if(!Y)throw Error("RESULTS_CALLBACK_URL environment variable is required");return{baseUrl:G,vaultUrl:F,vaultToken:X,vaultPath:Q,callbackUrl:Y}}function R(G){return{baseUrl:G,loginPath:process.env.TEST_SSO_LOGIN_PATH,callbackPath:process.env.TEST_SSO_CALLBACK_PATH,userPath:process.env.TEST_SSO_USER_PATH,logoutPath:process.env.TEST_SSO_LOGOUT_PATH,backChannelLogoutPath:process.env.TEST_SSO_BACKCHANNEL_LOGOUT_PATH}}function U(G,F){return{baseUrl:G,ion:F,scimPath:process.env.TEST_IAM_SCIM_PATH,groupsInboundPath:process.env.TEST_IAM_GROUPS_INBOUND_PATH}}function c(G){return{baseUrl:G,validatePath:process.env.TEST_WORKLOAD_VALIDATE_PATH,jwksPath:process.env.TEST_WORKLOAD_JWKS_PATH}}function b(G){return{baseUrl:G,customerPath:process.env.TEST_CIAM_CUSTOMER_PATH,magicLinkPath:process.env.TEST_CIAM_MAGIC_LINK_PATH,magicLinkLoginPath:process.env.TEST_CIAM_MAGIC_LINK_LOGIN_PATH,logoutPath:process.env.TEST_CIAM_LOGOUT_PATH,backChannelLogoutPath:process.env.TEST_CIAM_BACKCHANNEL_LOGOUT_PATH}}function d(G){let F=process.env.TEST_TENANT_COMPANY_ID?{id:process.env.TEST_TENANT_APP_ID||process.env.TEST_TENANT_COMPANY_ID,companyId:process.env.TEST_TENANT_COMPANY_ID,companyName:process.env.TEST_TENANT_COMPANY_NAME||"Test Company",environmentType:process.env.TEST_TENANT_ENVIRONMENT_TYPE||"POC",email:process.env.TEST_TENANT_EMAIL||"test@example.com",callbackUrl:process.env.TEST_TENANT_CALLBACK_URL,configLocator:{path:process.env.TEST_TENANT_CONFIG_LOCATOR_PATH||"/ecv/test-config",...process.env.TEST_TENANT_CONFIG_LOCATOR_SOURCE?{source:process.env.TEST_TENANT_CONFIG_LOCATOR_SOURCE}:{},...process.env.TEST_TENANT_CONFIG_LOCATOR_TTL?{ttl:Number(process.env.TEST_TENANT_CONFIG_LOCATOR_TTL)}:{}}}:void 0;return{baseUrl:G,tenantPath:process.env.TEST_TENANT_PATH,testTenantData:F}}async function v(G,F){let X=await fetch(G,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({...F,timestamp:F.timestamp.toISOString()})});if(!X.ok){let Q=await X.text().catch(()=>"Unknown error");throw Error(`Failed to post results to callback URL: ${X.status} ${X.statusText} - ${Q}`)}}async function n(){let G=performance.now();try{console.log(`\uD83D\uDE80 Starting Enterprise Control Validation Test Runner...
 `);let{baseUrl:F,vaultUrl:X,vaultToken:Q,vaultPath:Y,callbackUrl:q}=p();console.log("\uD83D\uDCCB Configuration:"),console.log(`   Base URL: ${F}`),console.log(`   Vault URL: ${X}`),console.log(`   Vault Path: ${Y}`),console.log(`   Callback URL: ${q}
@@ -10,13 +10,13 @@ import{E as V,H as W,J as y,L as D,Q as x,W as M,a as E,ba as _,ga as A,k as H,l
 `)}catch(B){console.error(`   ❌ SSO tests failed: ${B instanceof Error?B.message:String(B)}
 `),J.push({suite:"SSO",passed:!1,tests:[{name:"SSO Test Execution",passed:!1,error:B instanceof Error?B.message:String(B),duration:0}],duration:0,summary:{total:1,passed:0,failed:1,skipped:0}})}console.log("\uD83D\uDCDD Running IAM validation tests...");try{let B=await V(T);J.push(B),console.log(`   ${B.passed?"✅":"❌"} IAM: ${B.summary.passed}/${B.summary.total} passed
 `)}catch(B){console.error(`   ❌ IAM tests failed: ${B instanceof Error?B.message:String(B)}
-`),J.push({suite:"IAM",passed:!1,tests:[{name:"IAM Test Execution",passed:!1,error:B instanceof Error?B.message:String(B),duration:0}],duration:0,summary:{total:1,passed:0,failed:1,skipped:0}})}console.log("\uD83D\uDCDD Running Workload validation tests...");try{let B=await M(I);J.push(B),console.log(`   ${B.passed?"✅":"❌"} Workload: ${B.summary.passed}/${B.summary.total} passed
+`),J.push({suite:"IAM",passed:!1,tests:[{name:"IAM Test Execution",passed:!1,error:B instanceof Error?B.message:String(B),duration:0}],duration:0,summary:{total:1,passed:0,failed:1,skipped:0}})}console.log("\uD83D\uDCDD Running Workload validation tests...");try{let B=await _(I);J.push(B),console.log(`   ${B.passed?"✅":"❌"} Workload: ${B.summary.passed}/${B.summary.total} passed
 `)}catch(B){console.error(`   ❌ Workload tests failed: ${B instanceof Error?B.message:String(B)}
-`),J.push({suite:"Workload",passed:!1,tests:[{name:"Workload Test Execution",passed:!1,error:B instanceof Error?B.message:String(B),duration:0}],duration:0,summary:{total:1,passed:0,failed:1,skipped:0}})}console.log("\uD83D\uDCDD Running Tenant validation tests...");try{let B=await A(g);J.push(B),console.log(`   ${B.passed?"✅":"❌"} Tenant: ${B.summary.passed}/${B.summary.total} passed
+`),J.push({suite:"Workload",passed:!1,tests:[{name:"Workload Test Execution",passed:!1,error:B instanceof Error?B.message:String(B),duration:0}],duration:0,summary:{total:1,passed:0,failed:1,skipped:0}})}console.log("\uD83D\uDCDD Running Tenant validation tests...");try{let B=await M(g);J.push(B),console.log(`   ${B.passed?"✅":"❌"} Tenant: ${B.summary.passed}/${B.summary.total} passed
 `)}catch(B){console.error(`   ❌ Tenant tests failed: ${B instanceof Error?B.message:String(B)}
 `),J.push({suite:"Tenant",passed:!1,tests:[{name:"Tenant Test Execution",passed:!1,error:B instanceof Error?B.message:String(B),duration:0}],duration:0,summary:{total:1,passed:0,failed:1,skipped:0}})}console.log("\uD83D\uDCDD Running CIAM validation tests...");try{let B=await O(C);J.push(B),console.log(`   ${B.passed?"✅":"❌"} CIAM: ${B.summary.passed}/${B.summary.total} passed
 `)}catch(B){console.error(`   ❌ CIAM tests failed: ${B instanceof Error?B.message:String(B)}
-`),J.push({suite:"CIAM",passed:!1,tests:[{name:"CIAM Test Execution",passed:!1,error:B instanceof Error?B.message:String(B),duration:0}],duration:0,summary:{total:1,passed:0,failed:1,skipped:0}})}J.push(await Z("Authz","Authz",()=>N())),J.push(await Z("IAM Delta","IAM Delta",()=>W())),J.push(await Z("LFV","LFV",()=>D())),J.push(await Z("KMS","KMS token pools",()=>y())),J.push(await Z("Validator parity","Validator parity",()=>w())),J.push(await Z("Performance tuning","Performance tuning",()=>_()));let z="requires the ECV mock-server harness (capabilitiez token broker / Veza receiver); run via defineDiscoveredECVSuite or defineECVTests";J.push(L("Capabilities","Capability catalog",z)),J.push(L("Workload scopes","Workload scope authorization",z));let K=performance.now()-G,j={timestamp:new Date,baseUrl:F,passed:J.every((B)=>B.passed),suites:J,duration:K};console.log("\uD83D\uDCCA Test Summary:"),console.log(`   Total Suites: ${J.length}`),console.log(`   Passed: ${J.filter((B)=>B.passed).length}`),console.log(`   Failed: ${J.filter((B)=>!B.passed).length}`),console.log(`   Duration: ${K.toFixed(2)}ms`),console.log(`   Overall: ${j.passed?"✅ PASSED":"❌ FAILED"}
+`),J.push({suite:"CIAM",passed:!1,tests:[{name:"CIAM Test Execution",passed:!1,error:B instanceof Error?B.message:String(B),duration:0}],duration:0,summary:{total:1,passed:0,failed:1,skipped:0}})}J.push(await Z("Authz","Authz",()=>N())),J.push(await Z("IAM Delta","IAM Delta",()=>W())),J.push(await Z("LFV","LFV",()=>D())),J.push(await Z("KMS","KMS token pools",()=>y())),J.push(await Z("Validator parity","Validator parity",()=>w())),J.push(await Z("Performance tuning","Performance tuning",()=>A()));let z="requires the ECV mock-server harness (capabilitiez token broker / Veza receiver); run via ecvSuite";J.push(L("Capabilities","Capability catalog",z)),J.push(L("Workload scopes","Workload scope authorization",z));let K=performance.now()-G,j={timestamp:new Date,baseUrl:F,passed:J.every((B)=>B.passed),suites:J,duration:K};console.log("\uD83D\uDCCA Test Summary:"),console.log(`   Total Suites: ${J.length}`),console.log(`   Passed: ${J.filter((B)=>B.passed).length}`),console.log(`   Failed: ${J.filter((B)=>!B.passed).length}`),console.log(`   Duration: ${K.toFixed(2)}ms`),console.log(`   Overall: ${j.passed?"✅ PASSED":"❌ FAILED"}
 `),console.log("\uD83D\uDCE4 Posting results to callback URL..."),await v(q,j),console.log(`✅ Results posted successfully
 `),process.exit(j.passed?0:1)}catch(F){if(console.error(`
 ❌ Fatal error:`,F instanceof Error?F.message:String(F)),F instanceof Error&&F.stack)console.error(F.stack);process.exit(1)}}if(E.main==E.module)n();