@ionite/valibot 0.0.24-beta.20260907.2 → 0.0.24-beta.20260907.3

package/dist/index.js

@@ -1 +1,478 @@
-import{ION_SCIM_USER_EXTENSION_URN as z,isEcid as M,withValidate as H}from"@ionite/core";import*as j from"valibot";var T='must be a valid ECID formatted as "ecid:<realm>:<opaque>"',q=()=>j.optional(j.pipe(j.string(),j.check((k)=>M(k),T)));function Z(k){for(let K=0;K<k.length;K++){let Q=k.charCodeAt(K);if(Q<=31||Q===127)return!1}let P;try{P=new URL(k)}catch{return!1}if(P.protocol==="https:")return!0;if(P.protocol==="http:"){let K=P.hostname.toLowerCase();return K==="localhost"||K==="127.0.0.1"||K==="[::1]"||K==="::1"}return!1}var $="must be an absolute https URL (http is allowed only for localhost)",x=j.object({userName:j.string(),name:j.string(),email:j.pipe(j.string(),j.email()),id:j.optional(j.string()),avatar:j.optional(j.union([j.pipe(j.string(),j.url()),j.literal("")])),userType:j.optional(j.string()),ecid:q(),accountClass:j.optional(j.string())}),A=j.object({userName:j.string(),name:j.string(),email:j.pipe(j.string(),j.email()),id:j.optional(j.string()),avatar:j.optional(j.union([j.pipe(j.string(),j.url()),j.literal("")])),userType:j.optional(j.string())}),W=j.object({id:j.string(),name:j.string(),displayName:j.optional(j.string()),description:j.string(),metadata:j.optional(j.record(j.string(),j.unknown()))}),G=j.strictObject({type:j.literal("vault"),vaultUrl:j.optional(j.string()),vaultPath:j.string(),vaultTtl:j.optional(j.number()),vaultWorkloadTokenUrl:j.optional(j.string()),vaultWorkloadClientId:j.optional(j.string()),vaultWorkloadScope:j.optional(j.string()),vaultLfvServerUrl:j.optional(j.string()),vaultLfvClientId:j.optional(j.string()),vaultLfvDeliveryEndpoint:j.optional(j.string()),vaultLfvVerifyJwks:j.optional(j.string()),vaultLfvEventsEndpoint:j.optional(j.string()),vaultLfvPath:j.optional(j.string()),vaultLfvDeliveryTimeout:j.optional(j.number()),vaultLfvRetryInterval:j.optional(j.number()),vaultLfvWarnInterval:j.optional(j.number()),vaultWebsocketUrl:j.optional(j.string()),vaultWebsocketClientId:j.optional(j.string()),vaultWebsocketHeader:j.optional(j.picklist(["X-Vault-Token","Authorization"]))}),I=j.strictObject({type:j.literal("aws"),awsWebhookUrl:j.string(),awsTtl:j.optional(j.number())}),L=j.strictObject({type:j.literal("azure"),azureAuthMethod:j.optional(j.picklist(["client_secret","workload_identity","managed_identity"])),azureEntraTenantId:j.optional(j.string()),azureClientId:j.optional(j.string()),azureManagedIdentityClientId:j.optional(j.string()),azureImdsApiVersion:j.optional(j.string()),azurePath:j.optional(j.string()),azureVaultUrl:j.optional(j.string()),azureVaultName:j.optional(j.string()),azureApiVersion:j.optional(j.string()),azureScope:j.optional(j.string()),azureSecretNamePrefix:j.optional(j.string()),azureTtl:j.optional(j.number())}),B=j.strictObject({type:j.literal("gcp"),gcpTtl:j.optional(j.number())}),X=j.variant("type",[G,I,L,B]),Y=j.union([X,j.strictObject({type:j.literal("mirror"),from:X,to:G})]),_=j.object({id:j.pipe(j.string(),j.minLength(1)),companyId:j.string(),companyName:j.string(),environmentType:j.picklist(["POC","DEV","QA","PROD"]),status:j.picklist(["pending","processing","completed","failed","action_required"]),createdAt:j.date(),updatedAt:j.date(),configLocator:j.optional(Y),email:j.optional(j.string()),webhookUrl:j.optional(j.string()),callbackUrl:j.optional(j.string()),tenantUrl:j.optional(j.string()),error:j.optional(j.string()),actionUrl:j.optional(j.string()),requestToken:j.optional(j.string()),expiresAt:j.optional(j.string())}),F=j.object({id:j.string(),companyId:j.string(),companyName:j.string(),environmentType:j.picklist(["POC","DEV","QA","PROD"]),configLocator:j.optional(Y),email:j.optional(j.pipe(j.string(),j.email())),webhookUrl:j.optional(j.pipe(j.string(),j.url())),callbackUrl:j.optional(j.pipe(j.string(),j.url()))}),O=j.object({id:j.optional(j.string()),companyId:j.optional(j.string()),companyName:j.optional(j.string()),environmentType:j.optional(j.picklist(["POC","DEV","QA","PROD"])),configLocator:j.optional(Y),email:j.optional(j.pipe(j.string(),j.email())),webhookUrl:j.optional(j.pipe(j.string(),j.url())),callbackUrl:j.optional(j.pipe(j.string(),j.url()))}),J={authzEntityBase:()=>H(W),authzResource:()=>{let k=j.object({...W.entries,type:j.string(),parent:j.optional(j.lazy(()=>j.union([j.string(),k])))});return H(k)},authzPermission:()=>{let k=j.object({...W.entries,requestable:j.optional(j.boolean()),action:j.optional(j.string()),permissionTypes:j.optional(j.array(j.string())),resourceTypes:j.optional(j.array(j.string())),applyToSubResources:j.optional(j.boolean()),assignableSubjectTypes:j.pipe(j.array(j.picklist(["user","customer","workload"])),j.minLength(1)),recommendedSubjectTypes:j.optional(j.array(j.picklist(["user","customer","workload"])))});return H(k)},authzRole:()=>{let k=J.authzPermission(),P=j.object({...W.entries,requestable:j.optional(j.boolean()),roles:j.optional(j.array(j.union([j.string(),j.lazy(()=>P)]))),permissions:j.optional(j.array(j.union([j.string(),k]))),assignableSubjectTypes:j.pipe(j.array(j.picklist(["user","customer","workload"])),j.minLength(1)),recommendedSubjectTypes:j.optional(j.array(j.picklist(["user","customer","workload"])))});return H(P)},authzGroup:()=>{let k=J.authzRole(),P=J.authzPermission(),K=J.authzResource(),Q=j.object({...W.entries,requestable:j.optional(j.boolean()),groups:j.optional(j.array(j.union([j.string(),j.lazy(()=>Q)]))),roles:j.optional(j.array(j.union([j.string(),k]))),permissions:j.optional(j.array(j.union([j.string(),P]))),resources:j.optional(j.array(j.union([j.string(),K]))),assignableSubjectTypes:j.pipe(j.array(j.picklist(["user","customer","workload"])),j.minLength(1)),recommendedSubjectTypes:j.optional(j.array(j.picklist(["user","customer","workload"])))});return H(Q)},oidcCallbackParams:()=>j.object({code:j.string(),state:j.optional(j.string()),session_state:j.optional(j.string()),error:j.optional(j.string()),error_description:j.optional(j.string()),error_uri:j.optional(j.string()),iss:j.optional(j.string())}),idTokenClaims:()=>j.looseObject({sub:j.string(),iss:j.string(),aud:j.union([j.string(),j.pipe(j.array(j.string()),j.minLength(1))]),exp:j.number(),iat:j.optional(j.number()),sid:j.optional(j.string()),name:j.optional(j.string()),email:j.optional(j.union([j.pipe(j.string(),j.email()),j.pipe(j.string(),j.regex(/^[^@]+@localhost$/i))])),preferred_username:j.optional(j.string()),picture:j.optional(j.pipe(j.string(),j.url()))}),tokenResponse:()=>j.object({access_token:j.string(),id_token:j.string(),refresh_token:j.optional(j.string()),token_type:j.string(),expires_in:j.optional(j.number()),scope:j.optional(j.string()),refresh_expires_in:j.optional(j.number()),session_state:j.optional(j.string()),expires:j.optional(j.string())}),scimUser:()=>{let k=j.object({formatted:j.optional(j.string()),familyName:j.optional(j.string()),givenName:j.optional(j.string()),middleName:j.optional(j.string()),honorificPrefix:j.optional(j.string()),honorificSuffix:j.optional(j.string())}),P=j.object({value:j.pipe(j.string(),j.email()),display:j.optional(j.string()),type:j.optional(j.string()),primary:j.optional(j.boolean())}),K=j.object({value:j.string(),display:j.optional(j.string()),type:j.optional(j.string()),primary:j.optional(j.boolean())}),Q=j.object({formatted:j.optional(j.string()),streetAddress:j.optional(j.string()),locality:j.optional(j.string()),region:j.optional(j.string()),postalCode:j.optional(j.string()),country:j.optional(j.string()),type:j.optional(j.string()),primary:j.optional(j.boolean())}),D=j.object({value:j.string(),$ref:j.optional(j.string()),display:j.optional(j.string()),type:j.optional(j.string())}),N=j.object({value:j.string(),display:j.optional(j.string()),type:j.optional(j.string()),primary:j.optional(j.boolean())}),y=j.object({employeeNumber:j.optional(j.string()),costCenter:j.optional(j.string()),organization:j.optional(j.string()),division:j.optional(j.string()),department:j.optional(j.string()),manager:j.optional(j.object({value:j.optional(j.string()),$ref:j.optional(j.string()),displayName:j.optional(j.string())}))});return j.object({id:j.optional(j.string()),externalId:j.optional(j.string()),meta:j.optional(j.object({resourceType:j.optional(j.string()),created:j.optional(j.string()),lastModified:j.optional(j.string()),location:j.optional(j.string()),version:j.optional(j.string())})),userName:j.string(),name:j.optional(k),displayName:j.optional(j.string()),nickName:j.optional(j.string()),profileUrl:j.optional(j.pipe(j.string(),j.url())),title:j.optional(j.string()),userType:j.optional(j.string()),preferredLanguage:j.optional(j.string()),locale:j.optional(j.string()),timezone:j.optional(j.string()),active:j.optional(j.boolean()),password:j.optional(j.never()),emails:j.optional(j.array(P)),phoneNumbers:j.optional(j.array(K)),ims:j.optional(j.array(j.object({value:j.string(),display:j.optional(j.string()),type:j.optional(j.string()),primary:j.optional(j.boolean())}))),photos:j.optional(j.array(j.object({value:j.string(),display:j.optional(j.string()),type:j.optional(j.string()),primary:j.optional(j.boolean())}))),addresses:j.optional(j.array(Q)),groups:j.optional(j.array(D)),entitlements:j.optional(j.array(j.object({value:j.string(),display:j.optional(j.string()),type:j.optional(j.string()),primary:j.optional(j.boolean())}))),roles:j.optional(j.array(N)),x509Certificates:j.optional(j.array(j.object({value:j.string(),display:j.optional(j.string()),type:j.optional(j.string()),primary:j.optional(j.boolean())}))),"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User":j.optional(y),[z]:j.optional(j.object({ecid:q(),accountClass:j.optional(j.string())})),schemas:j.optional(j.array(j.string()))})},scimGroup:()=>{let k=j.object({value:j.string(),$ref:j.optional(j.string()),display:j.optional(j.string()),type:j.optional(j.picklist(["User","Group","Workload","Customer"]))});return j.object({id:j.optional(j.string()),externalId:j.optional(j.string()),meta:j.optional(j.object({resourceType:j.optional(j.string()),created:j.optional(j.string()),lastModified:j.optional(j.string()),location:j.optional(j.string()),version:j.optional(j.string())})),displayName:j.string(),members:j.optional(j.array(k)),"urn:ionite:params:scim:schemas:extension:authz:2.0:Group":j.optional(j.object({type:j.optional(j.picklist(["group","role","permission"])),requestable:j.optional(j.boolean()),description:j.optional(j.string()),resources:j.optional(j.array(j.string()))})),schemas:j.optional(j.array(j.string()))})},jwtAssertionClaims:()=>j.looseObject({iss:j.string(),sub:j.string(),aud:j.optional(j.union([j.string(),j.array(j.string())])),exp:j.number(),iat:j.number(),jti:j.optional(j.string()),scope:j.optional(j.string())}),workloadTokenResponse:()=>j.object({access_token:j.string(),token_type:j.string(),expires_in:j.optional(j.number()),scope:j.optional(j.string()),refresh_token:j.optional(j.string()),expires:j.optional(j.string())}),createTenantRequest:(k)=>k?j.object({...F.entries,...k}):F,updateTenantRequest:(k)=>k?j.object({...O.entries,...k}):O,baseUser:()=>x,customer:()=>A,tenantResponse:()=>j.union([j.object({tenantUrl:j.optional(j.pipe(j.string(),j.url())),status:j.picklist(["pending","processing","completed","failed"]),error:j.optional(j.string())}),j.object({status:j.literal("action_required"),actionUrl:j.pipe(j.string(),j.url()),requestToken:j.string(),expiresAt:j.string()})]),registerIAMAppPayload:()=>j.object({id:j.pipe(j.string(),j.minLength(1)),companyId:j.pipe(j.string(),j.minLength(1)),companyName:j.pipe(j.string(),j.minLength(1)),environmentType:j.picklist(["POC","DEV","QA","PROD"]),tenantUrl:j.optional(j.pipe(j.string(),j.url())),displayName:j.optional(j.string()),productId:j.optional(j.string()),applicationId:j.optional(j.string()),scimBaseUrl:j.optional(j.pipe(j.string(),j.url())),workload:j.optional(j.record(j.string(),j.unknown()))}),registerSSOAppPayload:()=>j.object({redirectUris:j.pipe(j.array(j.pipe(j.string(),j.check(Z,`redirectUri ${$}`))),j.minLength(1)),backchannelLogoutUri:j.optional(j.pipe(j.string(),j.check(Z,`backchannelLogoutUri ${$}`))),displayName:j.optional(j.string()),defaultScope:j.optional(j.string()),issuerTenant:j.optional(j.string()),applicationId:j.optional(j.string())})};function f(){return{sso:{callbackParams:H(J.oidcCallbackParams()),idTokenClaims:H(J.idTokenClaims()),tokenResponse:H(J.tokenResponse())},iam:{user:H(J.scimUser()),group:H(J.scimGroup())},workload:{jwtAssertionClaims:H(J.jwtAssertionClaims()),tokenResponse:H(J.workloadTokenResponse())},tenant:{createTenantRequest:H(J.createTenantRequest()),updateTenantRequest:H(J.updateTenantRequest()),tenantResponse:H(J.tenantResponse())},ciam:{customer:H(J.customer()),callbackParams:H(J.oidcCallbackParams()),idTokenClaims:H(J.idTokenClaims()),tokenResponse:H(J.tokenResponse())}}}function R(){return{iam:{registerIAMAppPayload:H(J.registerIAMAppPayload())},sso:{registerSSOAppPayload:H(J.registerSSOAppPayload())}}}export{J as valibotValidators,Z as isSafeRedirectUri,f as createValidators,R as createControlValidators,Y as ConfigLocatorSchema,x as BaseUser,O as BaseTenantUpdateRequestSchema,F as BaseTenantCreateRequestSchema,_ as BaseTenant,A as BaseCustomer};
+// packages/valibot/src/index.ts
+import { ION_SCIM_USER_EXTENSION_URN, isEcid, withValidate } from "@ionite/core";
+import * as v from "valibot";
+var ECID_MESSAGE = 'must be a valid ECID formatted as "ecid:<realm>:<opaque>"';
+var ecidSchema = () => v.optional(v.pipe(v.string(), v.check((value) => isEcid(value), ECID_MESSAGE)));
+function isSafeRedirectUri(value) {
+  for (let i = 0;i < value.length; i++) {
+    const code = value.charCodeAt(i);
+    if (code <= 31 || code === 127)
+      return false;
+  }
+  let url2;
+  try {
+    url2 = new URL(value);
+  } catch {
+    return false;
+  }
+  if (url2.protocol === "https:")
+    return true;
+  if (url2.protocol === "http:") {
+    const host = url2.hostname.toLowerCase();
+    return host === "localhost" || host === "127.0.0.1" || host === "[::1]" || host === "::1";
+  }
+  return false;
+}
+var SAFE_REDIRECT_URI_MESSAGE = "must be an absolute https URL (http is allowed only for localhost)";
+var BaseUser = v.object({
+  userName: v.string(),
+  name: v.string(),
+  email: v.pipe(v.string(), v.email()),
+  id: v.optional(v.string()),
+  avatar: v.optional(v.union([v.pipe(v.string(), v.url()), v.literal("")])),
+  userType: v.optional(v.string()),
+  ecid: ecidSchema(),
+  accountClass: v.optional(v.string())
+});
+var BaseCustomer = v.object({
+  userName: v.string(),
+  name: v.string(),
+  email: v.pipe(v.string(), v.email()),
+  id: v.optional(v.string()),
+  avatar: v.optional(v.union([v.pipe(v.string(), v.url()), v.literal("")])),
+  userType: v.optional(v.string())
+});
+var authzEntityBaseSchema = v.object({
+  id: v.string(),
+  name: v.string(),
+  displayName: v.optional(v.string()),
+  description: v.string(),
+  metadata: v.optional(v.record(v.string(), v.unknown()))
+});
+var VaultConfigLocatorSchema = v.strictObject({
+  type: v.literal("vault"),
+  vaultUrl: v.optional(v.string()),
+  vaultPath: v.string(),
+  vaultTtl: v.optional(v.number()),
+  vaultWorkloadTokenUrl: v.optional(v.string()),
+  vaultWorkloadClientId: v.optional(v.string()),
+  vaultWorkloadScope: v.optional(v.string()),
+  vaultLfvServerUrl: v.optional(v.string()),
+  vaultLfvClientId: v.optional(v.string()),
+  vaultLfvDeliveryEndpoint: v.optional(v.string()),
+  vaultLfvVerifyJwks: v.optional(v.string()),
+  vaultLfvEventsEndpoint: v.optional(v.string()),
+  vaultLfvPath: v.optional(v.string()),
+  vaultLfvDeliveryTimeout: v.optional(v.number()),
+  vaultLfvRetryInterval: v.optional(v.number()),
+  vaultLfvWarnInterval: v.optional(v.number()),
+  vaultWebsocketUrl: v.optional(v.string()),
+  vaultWebsocketClientId: v.optional(v.string()),
+  vaultWebsocketHeader: v.optional(v.picklist(["X-Vault-Token", "Authorization"]))
+});
+var AwsConfigLocatorSchema = v.strictObject({
+  type: v.literal("aws"),
+  awsWebhookUrl: v.string(),
+  awsTtl: v.optional(v.number())
+});
+var AzureConfigLocatorSchema = v.strictObject({
+  type: v.literal("azure"),
+  azureAuthMethod: v.optional(v.picklist(["client_secret", "workload_identity", "managed_identity"])),
+  azureEntraTenantId: v.optional(v.string()),
+  azureClientId: v.optional(v.string()),
+  azureManagedIdentityClientId: v.optional(v.string()),
+  azureImdsApiVersion: v.optional(v.string()),
+  azurePath: v.optional(v.string()),
+  azureVaultUrl: v.optional(v.string()),
+  azureVaultName: v.optional(v.string()),
+  azureApiVersion: v.optional(v.string()),
+  azureScope: v.optional(v.string()),
+  azureSecretNamePrefix: v.optional(v.string()),
+  azureTtl: v.optional(v.number())
+});
+var GcpConfigLocatorSchema = v.strictObject({
+  type: v.literal("gcp"),
+  gcpTtl: v.optional(v.number())
+});
+var DirectConfigLocatorSchema = v.variant("type", [
+  VaultConfigLocatorSchema,
+  AwsConfigLocatorSchema,
+  AzureConfigLocatorSchema,
+  GcpConfigLocatorSchema
+]);
+var ConfigLocatorSchema = v.union([
+  DirectConfigLocatorSchema,
+  v.strictObject({
+    type: v.literal("mirror"),
+    from: DirectConfigLocatorSchema,
+    to: VaultConfigLocatorSchema
+  })
+]);
+var BaseTenant = v.object({
+  id: v.pipe(v.string(), v.minLength(1)),
+  companyId: v.string(),
+  companyName: v.string(),
+  environmentType: v.picklist(["POC", "DEV", "QA", "PROD"]),
+  status: v.picklist(["pending", "processing", "completed", "failed", "action_required"]),
+  createdAt: v.date(),
+  updatedAt: v.date(),
+  configLocator: v.optional(ConfigLocatorSchema),
+  email: v.optional(v.string()),
+  webhookUrl: v.optional(v.string()),
+  callbackUrl: v.optional(v.string()),
+  tenantUrl: v.optional(v.string()),
+  error: v.optional(v.string()),
+  actionUrl: v.optional(v.string()),
+  requestToken: v.optional(v.string()),
+  expiresAt: v.optional(v.string())
+});
+var BaseTenantCreateRequestSchema = v.object({
+  id: v.string(),
+  companyId: v.string(),
+  companyName: v.string(),
+  environmentType: v.picklist(["POC", "DEV", "QA", "PROD"]),
+  configLocator: v.optional(ConfigLocatorSchema),
+  email: v.optional(v.pipe(v.string(), v.email())),
+  webhookUrl: v.optional(v.pipe(v.string(), v.url())),
+  callbackUrl: v.optional(v.pipe(v.string(), v.url()))
+});
+var BaseTenantUpdateRequestSchema = v.object({
+  id: v.optional(v.string()),
+  companyId: v.optional(v.string()),
+  companyName: v.optional(v.string()),
+  environmentType: v.optional(v.picklist(["POC", "DEV", "QA", "PROD"])),
+  configLocator: v.optional(ConfigLocatorSchema),
+  email: v.optional(v.pipe(v.string(), v.email())),
+  webhookUrl: v.optional(v.pipe(v.string(), v.url())),
+  callbackUrl: v.optional(v.pipe(v.string(), v.url()))
+});
+var valibotValidators = {
+  authzEntityBase: () => withValidate(authzEntityBaseSchema),
+  authzResource: () => {
+    const resourceSchema = v.object({
+      ...authzEntityBaseSchema.entries,
+      type: v.string(),
+      parent: v.optional(v.lazy(() => v.union([v.string(), resourceSchema])))
+    });
+    return withValidate(resourceSchema);
+  },
+  authzPermission: () => {
+    const permissionSchema = v.object({
+      ...authzEntityBaseSchema.entries,
+      requestable: v.optional(v.boolean()),
+      action: v.optional(v.string()),
+      permissionTypes: v.optional(v.array(v.string())),
+      resourceTypes: v.optional(v.array(v.string())),
+      applyToSubResources: v.optional(v.boolean()),
+      assignableSubjectTypes: v.pipe(v.array(v.picklist(["user", "customer", "workload"])), v.minLength(1)),
+      recommendedSubjectTypes: v.optional(v.array(v.picklist(["user", "customer", "workload"])))
+    });
+    return withValidate(permissionSchema);
+  },
+  authzRole: () => {
+    const permissionSchema = valibotValidators.authzPermission();
+    const roleSchema = v.object({
+      ...authzEntityBaseSchema.entries,
+      requestable: v.optional(v.boolean()),
+      roles: v.optional(v.array(v.union([v.string(), v.lazy(() => roleSchema)]))),
+      permissions: v.optional(v.array(v.union([v.string(), permissionSchema]))),
+      assignableSubjectTypes: v.pipe(v.array(v.picklist(["user", "customer", "workload"])), v.minLength(1)),
+      recommendedSubjectTypes: v.optional(v.array(v.picklist(["user", "customer", "workload"])))
+    });
+    return withValidate(roleSchema);
+  },
+  authzGroup: () => {
+    const roleSchema = valibotValidators.authzRole();
+    const permissionSchema = valibotValidators.authzPermission();
+    const resourceSchema = valibotValidators.authzResource();
+    const groupSchema = v.object({
+      ...authzEntityBaseSchema.entries,
+      requestable: v.optional(v.boolean()),
+      groups: v.optional(v.array(v.union([v.string(), v.lazy(() => groupSchema)]))),
+      roles: v.optional(v.array(v.union([v.string(), roleSchema]))),
+      permissions: v.optional(v.array(v.union([v.string(), permissionSchema]))),
+      resources: v.optional(v.array(v.union([v.string(), resourceSchema]))),
+      assignableSubjectTypes: v.pipe(v.array(v.picklist(["user", "customer", "workload"])), v.minLength(1)),
+      recommendedSubjectTypes: v.optional(v.array(v.picklist(["user", "customer", "workload"])))
+    });
+    return withValidate(groupSchema);
+  },
+  oidcCallbackParams: () => v.object({
+    code: v.string(),
+    state: v.optional(v.string()),
+    session_state: v.optional(v.string()),
+    error: v.optional(v.string()),
+    error_description: v.optional(v.string()),
+    error_uri: v.optional(v.string()),
+    iss: v.optional(v.string())
+  }),
+  idTokenClaims: () => v.looseObject({
+    sub: v.string(),
+    iss: v.string(),
+    aud: v.union([v.string(), v.pipe(v.array(v.string()), v.minLength(1))]),
+    exp: v.number(),
+    iat: v.optional(v.number()),
+    sid: v.optional(v.string()),
+    name: v.optional(v.string()),
+    email: v.optional(v.union([v.pipe(v.string(), v.email()), v.pipe(v.string(), v.regex(/^[^@]+@localhost$/i))])),
+    preferred_username: v.optional(v.string()),
+    picture: v.optional(v.pipe(v.string(), v.url()))
+  }),
+  tokenResponse: () => v.object({
+    access_token: v.string(),
+    id_token: v.string(),
+    refresh_token: v.optional(v.string()),
+    token_type: v.string(),
+    expires_in: v.optional(v.number()),
+    scope: v.optional(v.string()),
+    refresh_expires_in: v.optional(v.number()),
+    session_state: v.optional(v.string()),
+    expires: v.optional(v.string())
+  }),
+  scimUser: () => {
+    const nameSchema = v.object({
+      formatted: v.optional(v.string()),
+      familyName: v.optional(v.string()),
+      givenName: v.optional(v.string()),
+      middleName: v.optional(v.string()),
+      honorificPrefix: v.optional(v.string()),
+      honorificSuffix: v.optional(v.string())
+    });
+    const emailSchema = v.object({
+      value: v.pipe(v.string(), v.email()),
+      display: v.optional(v.string()),
+      type: v.optional(v.string()),
+      primary: v.optional(v.boolean())
+    });
+    const phoneNumberSchema = v.object({
+      value: v.string(),
+      display: v.optional(v.string()),
+      type: v.optional(v.string()),
+      primary: v.optional(v.boolean())
+    });
+    const addressSchema = v.object({
+      formatted: v.optional(v.string()),
+      streetAddress: v.optional(v.string()),
+      locality: v.optional(v.string()),
+      region: v.optional(v.string()),
+      postalCode: v.optional(v.string()),
+      country: v.optional(v.string()),
+      type: v.optional(v.string()),
+      primary: v.optional(v.boolean())
+    });
+    const groupSchema = v.object({
+      value: v.string(),
+      $ref: v.optional(v.string()),
+      display: v.optional(v.string()),
+      type: v.optional(v.string())
+    });
+    const roleSchema = v.object({
+      value: v.string(),
+      display: v.optional(v.string()),
+      type: v.optional(v.string()),
+      primary: v.optional(v.boolean())
+    });
+    const enterpriseUserSchema = v.object({
+      employeeNumber: v.optional(v.string()),
+      costCenter: v.optional(v.string()),
+      organization: v.optional(v.string()),
+      division: v.optional(v.string()),
+      department: v.optional(v.string()),
+      manager: v.optional(v.object({
+        value: v.optional(v.string()),
+        $ref: v.optional(v.string()),
+        displayName: v.optional(v.string())
+      }))
+    });
+    return v.object({
+      id: v.optional(v.string()),
+      externalId: v.optional(v.string()),
+      meta: v.optional(v.object({
+        resourceType: v.optional(v.string()),
+        created: v.optional(v.string()),
+        lastModified: v.optional(v.string()),
+        location: v.optional(v.string()),
+        version: v.optional(v.string())
+      })),
+      userName: v.string(),
+      name: v.optional(nameSchema),
+      displayName: v.optional(v.string()),
+      nickName: v.optional(v.string()),
+      profileUrl: v.optional(v.pipe(v.string(), v.url())),
+      title: v.optional(v.string()),
+      userType: v.optional(v.string()),
+      preferredLanguage: v.optional(v.string()),
+      locale: v.optional(v.string()),
+      timezone: v.optional(v.string()),
+      active: v.optional(v.boolean()),
+      password: v.optional(v.never()),
+      emails: v.optional(v.array(emailSchema)),
+      phoneNumbers: v.optional(v.array(phoneNumberSchema)),
+      ims: v.optional(v.array(v.object({
+        value: v.string(),
+        display: v.optional(v.string()),
+        type: v.optional(v.string()),
+        primary: v.optional(v.boolean())
+      }))),
+      photos: v.optional(v.array(v.object({
+        value: v.string(),
+        display: v.optional(v.string()),
+        type: v.optional(v.string()),
+        primary: v.optional(v.boolean())
+      }))),
+      addresses: v.optional(v.array(addressSchema)),
+      groups: v.optional(v.array(groupSchema)),
+      entitlements: v.optional(v.array(v.object({
+        value: v.string(),
+        display: v.optional(v.string()),
+        type: v.optional(v.string()),
+        primary: v.optional(v.boolean())
+      }))),
+      roles: v.optional(v.array(roleSchema)),
+      x509Certificates: v.optional(v.array(v.object({
+        value: v.string(),
+        display: v.optional(v.string()),
+        type: v.optional(v.string()),
+        primary: v.optional(v.boolean())
+      }))),
+      "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User": v.optional(enterpriseUserSchema),
+      [ION_SCIM_USER_EXTENSION_URN]: v.optional(v.object({
+        ecid: ecidSchema(),
+        accountClass: v.optional(v.string())
+      })),
+      schemas: v.optional(v.array(v.string()))
+    });
+  },
+  scimGroup: () => {
+    const groupMemberSchema = v.object({
+      value: v.string(),
+      $ref: v.optional(v.string()),
+      display: v.optional(v.string()),
+      type: v.optional(v.picklist(["User", "Group", "Workload", "Customer"]))
+    });
+    return v.object({
+      id: v.optional(v.string()),
+      externalId: v.optional(v.string()),
+      meta: v.optional(v.object({
+        resourceType: v.optional(v.string()),
+        created: v.optional(v.string()),
+        lastModified: v.optional(v.string()),
+        location: v.optional(v.string()),
+        version: v.optional(v.string())
+      })),
+      displayName: v.string(),
+      members: v.optional(v.array(groupMemberSchema)),
+      "urn:ionite:params:scim:schemas:extension:authz:2.0:Group": v.optional(v.object({
+        type: v.optional(v.picklist(["group", "role", "permission"])),
+        requestable: v.optional(v.boolean()),
+        description: v.optional(v.string()),
+        resources: v.optional(v.array(v.string()))
+      })),
+      schemas: v.optional(v.array(v.string()))
+    });
+  },
+  jwtAssertionClaims: () => v.looseObject({
+    iss: v.string(),
+    sub: v.string(),
+    aud: v.optional(v.union([v.string(), v.array(v.string())])),
+    exp: v.number(),
+    iat: v.number(),
+    jti: v.optional(v.string()),
+    scope: v.optional(v.string())
+  }),
+  workloadTokenResponse: () => v.object({
+    access_token: v.string(),
+    token_type: v.string(),
+    expires_in: v.optional(v.number()),
+    scope: v.optional(v.string()),
+    refresh_token: v.optional(v.string()),
+    expires: v.optional(v.string())
+  }),
+  createTenantRequest: (extendedShape) => extendedShape ? v.object({ ...BaseTenantCreateRequestSchema.entries, ...extendedShape }) : BaseTenantCreateRequestSchema,
+  updateTenantRequest: (extendedShape) => extendedShape ? v.object({ ...BaseTenantUpdateRequestSchema.entries, ...extendedShape }) : BaseTenantUpdateRequestSchema,
+  baseUser: () => BaseUser,
+  customer: () => BaseCustomer,
+  tenantResponse: () => v.union([
+    v.object({
+      tenantUrl: v.optional(v.pipe(v.string(), v.url())),
+      status: v.picklist(["pending", "processing", "completed", "failed"]),
+      error: v.optional(v.string())
+    }),
+    v.object({
+      status: v.literal("action_required"),
+      actionUrl: v.pipe(v.string(), v.url()),
+      requestToken: v.string(),
+      expiresAt: v.string()
+    })
+  ]),
+  registerIAMAppPayload: () => v.object({
+    id: v.pipe(v.string(), v.minLength(1)),
+    companyId: v.pipe(v.string(), v.minLength(1)),
+    companyName: v.pipe(v.string(), v.minLength(1)),
+    environmentType: v.picklist(["POC", "DEV", "QA", "PROD"]),
+    tenantUrl: v.optional(v.pipe(v.string(), v.url())),
+    displayName: v.optional(v.string()),
+    productId: v.optional(v.string()),
+    applicationId: v.optional(v.string()),
+    scimBaseUrl: v.optional(v.pipe(v.string(), v.url())),
+    workload: v.optional(v.record(v.string(), v.unknown()))
+  }),
+  registerSSOAppPayload: () => v.object({
+    redirectUris: v.pipe(v.array(v.pipe(v.string(), v.check(isSafeRedirectUri, `redirectUri ${SAFE_REDIRECT_URI_MESSAGE}`))), v.minLength(1)),
+    backchannelLogoutUri: v.optional(v.pipe(v.string(), v.check(isSafeRedirectUri, `backchannelLogoutUri ${SAFE_REDIRECT_URI_MESSAGE}`))),
+    displayName: v.optional(v.string()),
+    defaultScope: v.optional(v.string()),
+    issuerTenant: v.optional(v.string()),
+    applicationId: v.optional(v.string())
+  })
+};
+function createValidators() {
+  return {
+    sso: {
+      callbackParams: withValidate(valibotValidators.oidcCallbackParams()),
+      idTokenClaims: withValidate(valibotValidators.idTokenClaims()),
+      tokenResponse: withValidate(valibotValidators.tokenResponse())
+    },
+    iam: {
+      user: withValidate(valibotValidators.scimUser()),
+      group: withValidate(valibotValidators.scimGroup())
+    },
+    workload: {
+      jwtAssertionClaims: withValidate(valibotValidators.jwtAssertionClaims()),
+      tokenResponse: withValidate(valibotValidators.workloadTokenResponse())
+    },
+    tenant: {
+      createTenantRequest: withValidate(valibotValidators.createTenantRequest()),
+      updateTenantRequest: withValidate(valibotValidators.updateTenantRequest()),
+      tenantResponse: withValidate(valibotValidators.tenantResponse())
+    },
+    ciam: {
+      customer: withValidate(valibotValidators.customer()),
+      callbackParams: withValidate(valibotValidators.oidcCallbackParams()),
+      idTokenClaims: withValidate(valibotValidators.idTokenClaims()),
+      tokenResponse: withValidate(valibotValidators.tokenResponse())
+    }
+  };
+}
+function createControlValidators() {
+  return {
+    iam: {
+      registerIAMAppPayload: withValidate(valibotValidators.registerIAMAppPayload())
+    },
+    sso: {
+      registerSSOAppPayload: withValidate(valibotValidators.registerSSOAppPayload())
+    }
+  };
+}
+export {
+  valibotValidators,
+  isSafeRedirectUri,
+  createValidators,
+  createControlValidators,
+  ConfigLocatorSchema,
+  BaseUser,
+  BaseTenantUpdateRequestSchema,
+  BaseTenantCreateRequestSchema,
+  BaseTenant,
+  BaseCustomer
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ionite/valibot",
-  "version": "0.0.24-beta.20260907.2",
+  "version": "0.0.24-beta.20260907.3",
   "description": "Valibot validators for ionite (SSO, IAM, workload, tenant, CIAM)",
   "type": "module",
   "engines": {
@@ -9,7 +9,7 @@
   "author": "ionite",
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
-    "@ionite/core": "0.0.24-beta.20260907.2",
+    "@ionite/core": "0.0.24-beta.20260907.3",
     "@standard-schema/spec": "^1.1.0",
     "valibot": "^1.4.2"
   },