@ionite/ecv 0.0.24-beta.20260930.19 → 0.0.24-beta.20261003.17

package/dist/index.d.ts

@@ -1,3 +1,6 @@
+import { AppUnderTest, StartAppOptions, WaitForReadyOptions } from "@ionite/devtools";
+import { startAppUnderTest, waitForReady } from "@ionite/devtools";
+import { ConfigLocator, EnterpriseExtension, Ionite } from "@ionite/server";
 /** Serializable connection details provided by the ECV server control API. */
 interface SerializedEcvServerHandle {
 	baseUrl: string;
@@ -8,7 +11,6 @@ interface SerializedEcvServerHandle {
 		ION_VAULT_URL: string;
 		ION_VAULT_TOKEN: string;
 		ION_VAULT_PATH: string;
-		ION_ECV_CONTROL_TOKEN: string;
 		REDIS_URL?: string;
 	};
 	configLocator: {
@@ -42,7 +44,6 @@ interface OaaPushRecord {
 }
 interface EcvServerHandle extends SerializedEcvServerHandle {
 	reset(): Promise<void>;
-	decideAccessRequest(id: string, status: "approved" | "denied"): Promise<void>;
 	setTestUser(user: TestUser): Promise<void>;
 	mintTmHandle(input: {
 		audience: string;
@@ -60,7 +61,6 @@ interface EcvServerHandle extends SerializedEcvServerHandle {
 /** Restore control methods after a handle crosses Vitest's serializable `provide` boundary. */
 declare function ecvHandleFrom(serialized: SerializedEcvServerHandle): EcvServerHandle;
 declare function connectEcvServer(baseUrl: string, token?: string): Promise<EcvServerHandle>;
-import { ConfigLocator, EnterpriseExtension, Ionite } from "@ionite/server";
 /**
 * ionite Validator Types
 *
@@ -435,26 +435,6 @@ interface ValidationReport {
 	*/
 	duration: number;
 }
-interface EcvAccessRequestVariantOptions {
-	/** App-owned ECV endpoint that submits and reads access requests for this principal kind. */
-	accessRequestsPath: string;
-	/** App-owned ECV endpoint that probes the requested permission with this principal's session. */
-	permissionProbePath: string;
-	/** Principal represented by the matching ECV mock IdP identity. */
-	subject: string;
-	/** Requestable catalog target whose approval should add an entitlement claim. */
-	target: string;
-	/** CIAM provider key when the App has multiple customer access-request destinations. */
-	provider?: string;
-}
-interface EcvAccessRequestsOptions {
-	/** Validate workforce/SSO IdP-governed assignment. */
-	users?: EcvAccessRequestVariantOptions;
-	/** Validate customer/CIAM IdP-governed assignment. */
-	customers?: EcvAccessRequestVariantOptions;
-}
-import { AppUnderTest, StartAppOptions, WaitForReadyOptions } from "@ionite/devtools";
-import { startAppUnderTest, waitForReady } from "@ionite/devtools";
 declare function createAuthzClosureTests(): {
 	tests: TestDef[];
 };
@@ -467,7 +447,7 @@ declare function createOaaProjectionTests(config: AuthzValidationConfig): TestDe
 /**
 * Workload OAuth-scope tests (require the ECV mock server for JWKS + token minting). They validate
 * the two authorization sources for a workload: explicit `hasScope*` (token claims) and the
-* config-gated `claimsAsEntitlements` derivation inside `has*`.
+* config-gated `scopesAsEntitlements` auto-honor inside `has*`.
 */
 declare function createWorkloadScopeTests(config: AuthzValidationConfig): TestDef[];
 /**
@@ -529,15 +509,6 @@ declare function buildEcvTenantCatalog(config: ECVCatalogConfig, options?: EcvTe
 /** Options specific to one explicitly registered capability unit. */
 interface EcvUnitCatalogOptions {
 	expectedCallbackErrorPattern?: RegExp;
-	ssoClaimsAuthz?: {
-		permissionProbePath: string;
-		group: string;
-	};
-	ciamClaimsAuthz?: {
-		permissionProbePath: string;
-		group: string;
-	};
-	accessRequests?: EcvAccessRequestsOptions;
 }
 /** Build the static entries for one capability selected by the suite builder. */
 declare function buildEcvUnitCatalog(config: ECVCatalogConfig, unit: CapabilityKey2, options?: EcvUnitCatalogOptions): EcvCatalogEntry[];
@@ -601,7 +572,7 @@ declare class EcvContainer {
 }
 /**
 * Canonical `ion:*` scope strings the ECV harness embeds in workload tokens so deny-by-default SDK
-* endpoints (AUDIT_HISTORY.md §1.32) authorize via `claimsAsEntitlements`. They mirror the SDK-owned Permission
+* endpoints (AUDIT_HISTORY.md §1.32) authorize via `scopesAsEntitlements`. They mirror the SDK-owned Permission
 * ids so they can never drift from the gate.
 */
 /** All three SCIM scopes (read + user/group writes) — the IAM suite reads and writes with one token. */
@@ -616,7 +587,7 @@ declare const ION_TENANT_SCOPE: string;
 * identity.
 *
 * The SDK gates its protected endpoints deny-by-default (AUDIT_HISTORY.md §1.32). When the app under test enables
-* `workload.incoming.claimsAsEntitlements` with `claims: ['scope']` (the ECV mock vault does), the requested `scope` is honored
+* `RemoteConfig.authz.scopesAsEntitlements` (the ECV mock vault does), the requested `scope` is honored
 * as the matching entitlement — so pass the `ion:*` permission id(s) the endpoint requires (e.g.
 * `ion:tenant:manage`, `ion:capabilitiez:read`, or the IAM scopes). Omit `scope` to mint an
 * authenticated-but-unauthorized token (useful for asserting 403 denial).
@@ -911,7 +882,7 @@ declare function validateVaultWebSocketTransport(): Promise<ValidationSuiteResul
 *
 * Keep this synchronized with packages/ecv/package.json via publish.ts.
 */
-declare const ECV_VERSION = "0.0.24-beta.20260930.19";
+declare const ECV_VERSION = "0.0.24-beta.20261003.17";
 /**
 * Runs all Workload validation tests
 */
@@ -962,12 +933,6 @@ interface EcvSsoLoginOptions {
 	/** Register a named assertion that failed callbacks expose this generic error marker. */
 	expectedCallbackErrorPattern?: RegExp;
 }
-interface EcvClaimsAuthzOptions {
-	/** App-owned endpoint that returns 200 when the principal holds the tested permission and 403 otherwise. */
-	permissionProbePath: string;
-	/** Catalog group id the configured issuer's `groups` claim expands. */
-	group: string;
-}
 type EcvTenantsOptions = EcvTenantCatalogOptions;
 /** Navigable ECV unit registrar returned by {@link ecvSuite}. */
 interface EcvSuite {
@@ -976,14 +941,12 @@ interface EcvSuite {
 		jit: () => void;
 		logout: () => void;
 		back_channel_logout: () => void;
-		claims_authz: (options: EcvClaimsAuthzOptions) => void;
 	};
 	ciam: {
 		customer: () => void;
 		magic_link: () => void;
 		oidc_login: () => void;
 		logout: () => void;
-		claims_authz: (options: EcvClaimsAuthzOptions) => void;
 	};
 	iam: {
 		users: () => void;
@@ -994,11 +957,9 @@ interface EcvSuite {
 	workload: {
 		incoming: () => void;
 		outgoing: () => void;
-		claims_authz: () => void;
 	};
 	authz: {
 		oaa: () => void;
-		access_requests: (options: EcvAccessRequestsOptions) => void;
 	};
 	/** Register root tenant-management and cross-tenant isolation assertions. */
 	tenants: (options?: EcvTenantsOptions) => void;
@@ -1015,4 +976,4 @@ interface EcvSuite {
 declare function ecvSuite(config: EcvSuiteOptions): EcvSuite;
 /** Print the legacy structured report used by the deferred standalone runner. */
 declare function printReport(report: ValidationReport): void;
-export { AppUnderTest, AuthzValidationConfig, CIAMValidationConfig, ECVCatalogConfig, ECV_VERSION, EcvAccessRequestVariantOptions, EcvAccessRequestsOptions, EcvCatalogEntry, EcvCatalogUnit, EcvClaimsAuthzOptions, EcvContainer, EcvContainerOptions, EcvPostgresOptions, EcvServerHandle, EcvSsoLoginOptions, EcvSuite, EcvSuiteHooks, EcvSuiteOptions, EcvSuiteSetup, EcvTenantCatalogOptions, EcvTenantsOptions, EcvTestContext, EcvTestEnvironmentOptions, EcvUnitCatalogOptions, IAMValidationConfig, ION_CAPABILITIEZ_SCOPE, ION_IAM_SCOPES, ION_TENANT_SCOPE, OaaPushRecord, ProvisionTenantOptions, ProvisionedTenant, QUARANTINED_SDK_VERSIONS, SSOValidationConfig, SUPPORTED_SDK_RANGE, SerializedEcvServerHandle, StartAppOptions, StartedEcvContainer, StartedEcvTestEnvironment, TenantManagementTestConfig, TenantValidationConfig, TenantValidationProfile, TestDef, TestUser, ValidationConfig, ValidationReport, ValidationResult, ValidationSuiteResult, WaitForReadyOptions, WorkloadValidationConfig, assert, assertEqual, assertValid, buildEcvMetaCatalog, buildEcvSdkCatalog, buildEcvTenantCatalog, buildEcvUnitCatalog, completeLoginFlow, connectEcvServer, createAuthzClosureTests, createCIAMTests, createConfigBoundaryTests, createConfigLifecycleTests, createConfigRetryTests, createDisplayCookieTests, createFetcher, createHarnessSelfTests, createIAMTests, createIamDeltaPatchTests, createIamPrincipalPullTests, createKmsTests, createLfvCallbackTests, createOaaProjectionTests, createOtelTests, createPerformanceTuningTests, createProtocolSurfaceTests, createRedisStoreTests, createSSOTests, createSecretsHardeningTests, createSessionEntriesTests, createSsoControlContractTests, createSsoIdTokenVerificationTests, createSsoSessionWindowTests, createSsoTokenClientAuthTests, createTenantAccessTests, createTenantLifecycleTests, createTenantManagementTests, createTenantTests, createValidatorParityTests, createVaultCoordinationTests, createVaultWebSocketTransportTests, createWorkloadScopeTests, createWorkloadTests, ecvHandleFrom, ecvSuite, fetchCapabilitiezManifest, getTenantAuthToken, printReport, provisionTenant, resolveBaseUrl, runLoginToCallback, runTest, satisfiesSdkRange, skipTest, startAppUnderTest, startEcvTestEnvironment, validateAuthz, validateCIAM, validateDisplayCookies, validateIAM, validateIamDelta, validateIamPrincipals, validateKms, validateLfvDelivery, validateOtel, validatePerformanceTuning, validateProtocolSurface, validateRedisStores, validateSSO, validateSecretsHardening, validateSessionEntries, validateSsoControlContract, validateSsoIdTokenVerification, validateSsoSessionWindow, validateSsoTokenClientAuth, validateTenant, validateTenantAccess, validateTenantLifecycle, validateValidatorParity, validateVaultCoordination, validateVaultWebSocketTransport, validateWorkload, waitForReady };
+export { AppUnderTest, AuthzValidationConfig, CIAMValidationConfig, ECVCatalogConfig, ECV_VERSION, EcvCatalogEntry, EcvCatalogUnit, EcvContainer, EcvContainerOptions, EcvPostgresOptions, EcvServerHandle, EcvSsoLoginOptions, EcvSuite, EcvSuiteHooks, EcvSuiteOptions, EcvSuiteSetup, EcvTenantCatalogOptions, EcvTenantsOptions, EcvTestContext, EcvTestEnvironmentOptions, EcvUnitCatalogOptions, IAMValidationConfig, ION_CAPABILITIEZ_SCOPE, ION_IAM_SCOPES, ION_TENANT_SCOPE, OaaPushRecord, ProvisionTenantOptions, ProvisionedTenant, QUARANTINED_SDK_VERSIONS, SSOValidationConfig, SUPPORTED_SDK_RANGE, SerializedEcvServerHandle, StartAppOptions, StartedEcvContainer, StartedEcvTestEnvironment, TenantManagementTestConfig, TenantValidationConfig, TenantValidationProfile, TestDef, TestUser, ValidationConfig, ValidationReport, ValidationResult, ValidationSuiteResult, WaitForReadyOptions, WorkloadValidationConfig, assert, assertEqual, assertValid, buildEcvMetaCatalog, buildEcvSdkCatalog, buildEcvTenantCatalog, buildEcvUnitCatalog, completeLoginFlow, connectEcvServer, createAuthzClosureTests, createCIAMTests, createConfigBoundaryTests, createConfigLifecycleTests, createConfigRetryTests, createDisplayCookieTests, createFetcher, createHarnessSelfTests, createIAMTests, createIamDeltaPatchTests, createIamPrincipalPullTests, createKmsTests, createLfvCallbackTests, createOaaProjectionTests, createOtelTests, createPerformanceTuningTests, createProtocolSurfaceTests, createRedisStoreTests, createSSOTests, createSecretsHardeningTests, createSessionEntriesTests, createSsoControlContractTests, createSsoIdTokenVerificationTests, createSsoSessionWindowTests, createSsoTokenClientAuthTests, createTenantAccessTests, createTenantLifecycleTests, createTenantManagementTests, createTenantTests, createValidatorParityTests, createVaultCoordinationTests, createVaultWebSocketTransportTests, createWorkloadScopeTests, createWorkloadTests, ecvHandleFrom, ecvSuite, fetchCapabilitiezManifest, getTenantAuthToken, printReport, provisionTenant, resolveBaseUrl, runLoginToCallback, runTest, satisfiesSdkRange, skipTest, startAppUnderTest, startEcvTestEnvironment, validateAuthz, validateCIAM, validateDisplayCookies, validateIAM, validateIamDelta, validateIamPrincipals, validateKms, validateLfvDelivery, validateOtel, validatePerformanceTuning, validateProtocolSurface, validateRedisStores, validateSSO, validateSecretsHardening, validateSessionEntries, validateSsoControlContract, validateSsoIdTokenVerification, validateSsoSessionWindow, validateSsoTokenClientAuth, validateTenant, validateTenantAccess, validateTenantLifecycle, validateValidatorParity, validateVaultCoordination, validateVaultWebSocketTransport, validateWorkload, waitForReady };

package/dist/index.js

@@ -1 +1 @@
-import{ie,ce,n,a,s,c,e,t,o,u,p,Z,de,le,m,O,q,l,r,h,ue,M,N,L,D,pe,g,f,me,y,he,w,ge,i,z,Q,ee,v,fe,b,ye,k,we,S,ve,be,T,V,ke,C,Se,R,Te,x,Ce,E,Re,A,xe,d,Ee,te,B,I,Ae,P,Ie,_,Pe,_e,j,J,G,W,K,F,se,H,Y,U,je,ae,Ue,ne,Oe,re,qe,oe,$e,X,Me}from"./shared/ecv-e1pn2rgg.js";export{i as ECV_VERSION,U as EcvContainer,q as ION_CAPABILITIEZ_SCOPE,O as ION_IAM_SCOPES,l as ION_TENANT_SCOPE,Q as QUARANTINED_SDK_VERSIONS,z as SUPPORTED_SDK_RANGE,Y as StartedEcvContainer,e as assert,t as assertEqual,o as assertValid,G as buildEcvMetaCatalog,W as buildEcvSdkCatalog,K as buildEcvTenantCatalog,F as buildEcvUnitCatalog,V as completeLoginFlow,H as connectEcvServer,u as createAuthzClosureTests,m as createCIAMTests,N as createConfigBoundaryTests,M as createConfigLifecycleTests,L as createConfigRetryTests,R as createDisplayCookieTests,a as createFetcher,D as createHarnessSelfTests,g as createIAMTests,f as createIamDeltaPatchTests,y as createIamPrincipalPullTests,w as createKmsTests,h as createLfvCallbackTests,p as createOaaProjectionTests,v as createOtelTests,ae as createPerformanceTuningTests,b as createProtocolSurfaceTests,ne as createRedisStoreTests,T as createSSOTests,k as createSecretsHardeningTests,S as createSessionEntriesTests,C as createSsoControlContractTests,x as createSsoIdTokenVerificationTests,E as createSsoSessionWindowTests,A as createSsoTokenClientAuthTests,I as createTenantAccessTests,re as createTenantLifecycleTests,B as createTenantManagementTests,te as createTenantTests,oe as createValidatorParityTests,P as createVaultCoordinationTests,_ as createVaultWebSocketTransportTests,Z as createWorkloadScopeTests,j as createWorkloadTests,se as ecvHandleFrom,X as ecvSuite,J as fetchCapabilitiezManifest,r as getTenantAuthToken,Me as printReport,d as provisionTenant,n as resolveBaseUrl,ke as runLoginToCallback,s as runTest,ee as satisfiesSdkRange,c as skipTest,ie as startAppUnderTest,je as startEcvTestEnvironment,de as validateAuthz,le as validateCIAM,Te as validateDisplayCookies,pe as validateIAM,me as validateIamDelta,he as validateIamPrincipals,ge as validateKms,ue as validateLfvDelivery,fe as validateOtel,Ue as validatePerformanceTuning,ye as validateProtocolSurface,Oe as validateRedisStores,be as validateSSO,we as validateSecretsHardening,ve as validateSessionEntries,Se as validateSsoControlContract,Ce as validateSsoIdTokenVerification,Re as validateSsoSessionWindow,xe as validateSsoTokenClientAuth,Ee as validateTenant,Ae as validateTenantAccess,qe as validateTenantLifecycle,$e as validateValidatorParity,Ie as validateVaultCoordination,Pe as validateVaultWebSocketTransport,_e as validateWorkload,ce as waitForReady};
+import{$ as aa,A,Aa as Ba,B,Ba as Ca,C,Ca as Da,D,Da as Ea,E,Ea as Fa,F,Fa as Ga,G,Ga as Ha,H,Ha as Ia,I,Ia as Ja,J,Ja as Ka,K,Ka as La,L,M,N,O,P,Q,R,S,T,U,V,W,X,Y,Z,_,a,aa as ba,b,ba as ca,c,ca as da,d,da as ea,e,ea as fa,f,fa as ga,g,ga as ha,h,ha as ia,i,ia as ja,j,ja as ka,k,ka as la,l,la as ma,m,ma as na,n,na as oa,o,oa as pa,p,pa as qa,q,qa as ra,r,ra as sa,s,sa as ta,t,ta as ua,u,ua as va,v,va as wa,w,wa as xa,x,xa as ya,y,ya as za,z,za as Aa}from"./shared/ecv-r8ezhss8.js";export{H as ECV_VERSION,Aa as EcvContainer,v as ION_CAPABILITIEZ_SCOPE,u as ION_IAM_SCOPES,w as ION_TENANT_SCOPE,J as QUARANTINED_SDK_VERSIONS,I as SUPPORTED_SDK_RANGE,za as StartedEcvContainer,g as assert,h as assertEqual,i as assertValid,ta as buildEcvMetaCatalog,ua as buildEcvSdkCatalog,va as buildEcvTenantCatalog,wa as buildEcvUnitCatalog,V as completeLoginFlow,ya as connectEcvServer,j as createAuthzClosureTests,o as createCIAMTests,s as createConfigBoundaryTests,r as createConfigLifecycleTests,t as createConfigRetryTests,Z as createDisplayCookieTests,d as createFetcher,y as createHarnessSelfTests,A as createIAMTests,B as createIamDeltaPatchTests,D as createIamPrincipalPullTests,F as createKmsTests,p as createLfvCallbackTests,k as createOaaProjectionTests,L as createOtelTests,Ca as createPerformanceTuningTests,N as createProtocolSurfaceTests,Ea as createRedisStoreTests,U as createSSOTests,P as createSecretsHardeningTests,R as createSessionEntriesTests,X as createSsoControlContractTests,aa as createSsoIdTokenVerificationTests,ca as createSsoSessionWindowTests,ea as createSsoTokenClientAuthTests,ka as createTenantAccessTests,Ga as createTenantLifecycleTests,ja as createTenantManagementTests,ia as createTenantTests,Ia as createValidatorParityTests,ma as createVaultCoordinationTests,oa as createVaultWebSocketTransportTests,l as createWorkloadScopeTests,ra as createWorkloadTests,xa as ecvHandleFrom,Ka as ecvSuite,sa as fetchCapabilitiezManifest,x as getTenantAuthToken,La as printReport,ga as provisionTenant,c as resolveBaseUrl,W as runLoginToCallback,e as runTest,K as satisfiesSdkRange,f as skipTest,a as startAppUnderTest,Ba as startEcvTestEnvironment,m as validateAuthz,n as validateCIAM,_ as validateDisplayCookies,z as validateIAM,C as validateIamDelta,E as validateIamPrincipals,G as validateKms,q as validateLfvDelivery,M as validateOtel,Da as validatePerformanceTuning,O as validateProtocolSurface,Fa as validateRedisStores,T as validateSSO,Q as validateSecretsHardening,S as validateSessionEntries,Y as validateSsoControlContract,ba as validateSsoIdTokenVerification,da as validateSsoSessionWindow,fa as validateSsoTokenClientAuth,ha as validateTenant,la as validateTenantAccess,Ha as validateTenantLifecycle,Ja as validateValidatorParity,na as validateVaultCoordination,pa as validateVaultWebSocketTransport,qa as validateWorkload,b as waitForReady};