@ionite/zod 0.0.24-beta.20260907.2 → 0.0.24-beta.20260907.3

package/dist/index.js

@@ -1 +1,474 @@
-import{ION_SCIM_USER_EXTENSION_URN as y,isEcid as M,withValidate as H}from"@ionite/core";import{z as j}from"zod";function Z(k){for(let K=0;K<k.length;K++){let Q=k.charCodeAt(K);if(Q<=31||Q===127)return!1}let P;try{P=new URL(k)}catch{return!1}if(P.protocol==="https:")return!0;if(P.protocol==="http:"){let K=P.hostname.toLowerCase();return K==="localhost"||K==="127.0.0.1"||K==="[::1]"||K==="::1"}return!1}var $="must be an absolute https URL (http is allowed only for localhost)",v='must be a valid ECID formatted as "ecid:<realm>:<opaque>"',O=()=>j.string().refine(M,v).optional(),W=j.object({id:j.string(),name:j.string(),displayName:j.string().optional(),description:j.string(),metadata:j.record(j.string(),j.unknown()).optional()}),T=j.object({userName:j.string(),name:j.string(),email:j.email(),id:j.string().optional(),avatar:j.union([j.url(),j.literal("")]).optional(),userType:j.string().optional(),ecid:O(),accountClass:j.string().optional()}),x=j.object({userName:j.string(),name:j.string(),email:j.email(),id:j.string().optional(),avatar:j.union([j.url(),j.literal("")]).optional(),userType:j.string().optional()}),q=j.strictObject({type:j.literal("vault"),vaultUrl:j.string().optional(),vaultPath:j.string(),vaultTtl:j.number().optional(),vaultWorkloadTokenUrl:j.string().optional(),vaultWorkloadClientId:j.string().optional(),vaultWorkloadScope:j.string().optional(),vaultLfvServerUrl:j.string().optional(),vaultLfvClientId:j.string().optional(),vaultLfvDeliveryEndpoint:j.string().optional(),vaultLfvVerifyJwks:j.string().optional(),vaultLfvEventsEndpoint:j.string().optional(),vaultLfvPath:j.string().optional(),vaultLfvDeliveryTimeout:j.number().optional(),vaultLfvRetryInterval:j.number().optional(),vaultLfvWarnInterval:j.number().optional(),vaultWebsocketUrl:j.string().optional(),vaultWebsocketClientId:j.string().optional(),vaultWebsocketHeader:j.enum(["X-Vault-Token","Authorization"]).optional()}),A=j.strictObject({type:j.literal("aws"),awsWebhookUrl:j.string(),awsTtl:j.number().optional()}),I=j.strictObject({type:j.literal("azure"),azureAuthMethod:j.enum(["client_secret","workload_identity","managed_identity"]).optional(),azureEntraTenantId:j.string().optional(),azureClientId:j.string().optional(),azureManagedIdentityClientId:j.string().optional(),azureImdsApiVersion:j.string().optional(),azurePath:j.string().optional(),azureVaultUrl:j.string().optional(),azureVaultName:j.string().optional(),azureApiVersion:j.string().optional(),azureScope:j.string().optional(),azureSecretNamePrefix:j.string().optional(),azureTtl:j.number().optional()}),L=j.strictObject({type:j.literal("gcp"),gcpTtl:j.number().optional()}),X=j.discriminatedUnion("type",[q,A,I,L]),Y=j.union([X,j.strictObject({type:j.literal("mirror"),from:X,to:q})]),_=j.object({id:j.string().min(1),companyId:j.string(),companyName:j.string(),environmentType:j.enum(["POC","DEV","QA","PROD"]),status:j.enum(["pending","processing","completed","failed","action_required"]),createdAt:j.date(),updatedAt:j.date(),configLocator:Y.optional(),email:j.string().optional(),webhookUrl:j.string().optional(),callbackUrl:j.string().optional(),tenantUrl:j.string().optional(),error:j.string().optional(),actionUrl:j.string().optional(),requestToken:j.string().optional(),expiresAt:j.string().optional()}),b=j.object({id:j.string(),companyId:j.string(),companyName:j.string(),environmentType:j.enum(["POC","DEV","QA","PROD"]),configLocator:Y.optional(),email:j.email().optional(),webhookUrl:j.url().optional(),callbackUrl:j.url().optional()}),F=j.object({id:j.string().optional(),companyId:j.string().optional(),companyName:j.string().optional(),environmentType:j.enum(["POC","DEV","QA","PROD"]).optional(),configLocator:Y.optional(),email:j.email().optional(),webhookUrl:j.url().optional(),callbackUrl:j.url().optional()}),J={authzEntityBase:()=>H(W),authzResource:()=>{let k=W.extend({type:j.string(),parent:j.lazy(()=>j.union([j.string(),k])).optional()});return H(k)},authzPermission:()=>{let k=W.extend({requestable:j.boolean().optional(),action:j.string().optional(),permissionTypes:j.array(j.string()).optional(),resourceTypes:j.array(j.string()).optional(),applyToSubResources:j.boolean().optional(),assignableSubjectTypes:j.array(j.enum(["user","customer","workload"])).min(1),recommendedSubjectTypes:j.array(j.enum(["user","customer","workload"])).optional()});return H(k)},authzRole:()=>{let k=J.authzPermission(),P=W.extend({requestable:j.boolean().optional(),roles:j.array(j.union([j.string(),j.lazy(()=>P)])).optional(),permissions:j.array(j.union([j.string(),k])).optional(),assignableSubjectTypes:j.array(j.enum(["user","customer","workload"])).min(1),recommendedSubjectTypes:j.array(j.enum(["user","customer","workload"])).optional()});return H(P)},authzGroup:()=>{let k=J.authzRole(),P=J.authzPermission(),K=J.authzResource(),Q=W.extend({requestable:j.boolean().optional(),groups:j.array(j.union([j.string(),j.lazy(()=>Q)])).optional(),roles:j.array(j.union([j.string(),k])).optional(),permissions:j.array(j.union([j.string(),P])).optional(),resources:j.array(j.union([j.string(),K])).optional(),assignableSubjectTypes:j.array(j.enum(["user","customer","workload"])).min(1),recommendedSubjectTypes:j.array(j.enum(["user","customer","workload"])).optional()});return H(Q)},oidcCallbackParams:()=>j.object({code:j.string(),state:j.string().optional(),session_state:j.string().optional(),error:j.string().optional(),error_description:j.string().optional(),error_uri:j.string().optional(),iss:j.string().optional()}),idTokenClaims:()=>j.object({sub:j.string(),iss:j.string(),aud:j.union([j.string(),j.array(j.string()).nonempty()]),exp:j.number(),iat:j.number().optional(),sid:j.string().optional(),name:j.string().optional(),email:j.union([j.email(),j.string().regex(/^[^@]+@localhost$/i)]).optional(),preferred_username:j.string().optional(),picture:j.url().optional()}).passthrough(),tokenResponse:()=>j.object({access_token:j.string(),id_token:j.string(),refresh_token:j.string().optional(),token_type:j.string(),expires_in:j.number().optional(),scope:j.string().optional(),refresh_expires_in:j.number().optional(),session_state:j.string().optional(),expires:j.string().optional()}),scimUser:()=>{let k=j.object({formatted:j.string().optional(),familyName:j.string().optional(),givenName:j.string().optional(),middleName:j.string().optional(),honorificPrefix:j.string().optional(),honorificSuffix:j.string().optional()}),P=j.object({value:j.email(),display:j.string().optional(),type:j.string().optional(),primary:j.boolean().optional()}),K=j.object({value:j.string(),display:j.string().optional(),type:j.string().optional(),primary:j.boolean().optional()}),Q=j.object({formatted:j.string().optional(),streetAddress:j.string().optional(),locality:j.string().optional(),region:j.string().optional(),postalCode:j.string().optional(),country:j.string().optional(),type:j.string().optional(),primary:j.boolean().optional()}),G=j.object({value:j.string(),$ref:j.string().optional(),display:j.string().optional(),type:j.string().optional()}),D=j.object({value:j.string(),display:j.string().optional(),type:j.string().optional(),primary:j.boolean().optional()}),N=j.object({employeeNumber:j.string().optional(),costCenter:j.string().optional(),organization:j.string().optional(),division:j.string().optional(),department:j.string().optional(),manager:j.object({value:j.string().optional(),$ref:j.string().optional(),displayName:j.string().optional()}).optional()});return j.object({id:j.string().optional(),externalId:j.string().optional(),meta:j.object({resourceType:j.string().optional(),created:j.string().optional(),lastModified:j.string().optional(),location:j.string().optional(),version:j.string().optional()}).optional(),userName:j.string(),name:k.optional(),displayName:j.string().optional(),nickName:j.string().optional(),profileUrl:j.url().optional(),title:j.string().optional(),userType:j.string().optional(),preferredLanguage:j.string().optional(),locale:j.string().optional(),timezone:j.string().optional(),active:j.boolean().optional(),password:j.never().optional(),emails:j.array(P).optional(),phoneNumbers:j.array(K).optional(),ims:j.array(j.object({value:j.string(),display:j.string().optional(),type:j.string().optional(),primary:j.boolean().optional()})).optional(),photos:j.array(j.object({value:j.string(),display:j.string().optional(),type:j.string().optional(),primary:j.boolean().optional()})).optional(),addresses:j.array(Q).optional(),groups:j.array(G).optional(),entitlements:j.array(j.object({value:j.string(),display:j.string().optional(),type:j.string().optional(),primary:j.boolean().optional()})).optional(),roles:j.array(D).optional(),x509Certificates:j.array(j.object({value:j.string(),display:j.string().optional(),type:j.string().optional(),primary:j.boolean().optional()})).optional(),"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User":N.optional(),[y]:j.object({ecid:O(),accountClass:j.string().optional()}).optional(),schemas:j.array(j.string()).optional()})},scimGroup:()=>{let k=j.object({value:j.string(),$ref:j.string().optional(),display:j.string().optional(),type:j.enum(["User","Group","Workload","Customer"]).optional()});return j.object({id:j.string().optional(),externalId:j.string().optional(),meta:j.object({resourceType:j.string().optional(),created:j.string().optional(),lastModified:j.string().optional(),location:j.string().optional(),version:j.string().optional()}).optional(),displayName:j.string(),members:j.array(k).optional(),"urn:ionite:params:scim:schemas:extension:authz:2.0:Group":j.object({type:j.enum(["group","role","permission"]).optional(),requestable:j.boolean().optional(),description:j.string().optional(),resources:j.array(j.string()).optional()}).optional(),schemas:j.array(j.string()).optional()})},jwtAssertionClaims:()=>j.object({iss:j.string(),sub:j.string(),aud:j.union([j.string(),j.array(j.string())]).optional(),exp:j.number(),iat:j.number(),jti:j.string().optional(),scope:j.string().optional()}).passthrough(),workloadTokenResponse:()=>j.object({access_token:j.string(),token_type:j.string(),expires_in:j.number().optional(),scope:j.string().optional(),refresh_token:j.string().optional(),expires:j.string().optional()}),baseUser:()=>T,customer:()=>x,createTenantRequest:(k)=>k?b.extend(k):b,updateTenantRequest:(k)=>k?F.extend(k):F,tenantResponse:()=>j.union([j.object({tenantUrl:j.url().optional(),status:j.enum(["pending","processing","completed","failed"]),error:j.string().optional()}),j.object({status:j.literal("action_required"),actionUrl:j.url(),requestToken:j.string(),expiresAt:j.string()})]),registerIAMAppPayload:()=>j.object({id:j.string().min(1),companyId:j.string().min(1),companyName:j.string().min(1),environmentType:j.enum(["POC","DEV","QA","PROD"]),tenantUrl:j.url().optional(),displayName:j.string().optional(),productId:j.string().optional(),applicationId:j.string().optional(),scimBaseUrl:j.url().optional(),workload:j.record(j.string(),j.unknown()).optional()}),registerSSOAppPayload:()=>j.object({redirectUris:j.array(j.string().refine(Z,{message:`redirectUri ${$}`})).min(1),backchannelLogoutUri:j.string().refine(Z,{message:`backchannelLogoutUri ${$}`}).optional(),displayName:j.string().optional(),defaultScope:j.string().optional(),issuerTenant:j.string().optional(),applicationId:j.string().optional()})};function f(){return{sso:{callbackParams:H(J.oidcCallbackParams()),idTokenClaims:H(J.idTokenClaims()),tokenResponse:H(J.tokenResponse())},iam:{user:H(J.scimUser()),group:H(J.scimGroup())},workload:{jwtAssertionClaims:H(J.jwtAssertionClaims()),tokenResponse:H(J.workloadTokenResponse())},tenant:{createTenantRequest:H(J.createTenantRequest()),updateTenantRequest:H(J.updateTenantRequest()),tenantResponse:H(J.tenantResponse())},ciam:{customer:H(J.customer()),callbackParams:H(J.oidcCallbackParams()),idTokenClaims:H(J.idTokenClaims()),tokenResponse:H(J.tokenResponse())}}}function R(){return{iam:{registerIAMAppPayload:H(J.registerIAMAppPayload())},sso:{registerSSOAppPayload:H(J.registerSSOAppPayload())}}}export{J as zodValidators,Z as isSafeRedirectUri,f as createValidators,R as createControlValidators,Y as ConfigLocatorSchema,T as BaseUser,F as BaseTenantUpdateRequestSchema,b as BaseTenantCreateRequestSchema,_ as BaseTenant,x as BaseCustomer};
+// packages/zod/src/index.ts
+import { ION_SCIM_USER_EXTENSION_URN, isEcid, withValidate } from "@ionite/core";
+import { z } from "zod";
+function isSafeRedirectUri(value) {
+  for (let i = 0;i < value.length; i++) {
+    const code = value.charCodeAt(i);
+    if (code <= 31 || code === 127)
+      return false;
+  }
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return false;
+  }
+  if (url.protocol === "https:")
+    return true;
+  if (url.protocol === "http:") {
+    const host = url.hostname.toLowerCase();
+    return host === "localhost" || host === "127.0.0.1" || host === "[::1]" || host === "::1";
+  }
+  return false;
+}
+var SAFE_REDIRECT_URI_MESSAGE = "must be an absolute https URL (http is allowed only for localhost)";
+var ECID_MESSAGE = 'must be a valid ECID formatted as "ecid:<realm>:<opaque>"';
+var ecidSchema = () => z.string().refine(isEcid, ECID_MESSAGE).optional();
+var authzEntityBaseSchema = z.object({
+  id: z.string(),
+  name: z.string(),
+  displayName: z.string().optional(),
+  description: z.string(),
+  metadata: z.record(z.string(), z.unknown()).optional()
+});
+var BaseUser = z.object({
+  userName: z.string(),
+  name: z.string(),
+  email: z.email(),
+  id: z.string().optional(),
+  avatar: z.union([z.url(), z.literal("")]).optional(),
+  userType: z.string().optional(),
+  ecid: ecidSchema(),
+  accountClass: z.string().optional()
+});
+var BaseCustomer = z.object({
+  userName: z.string(),
+  name: z.string(),
+  email: z.email(),
+  id: z.string().optional(),
+  avatar: z.union([z.url(), z.literal("")]).optional(),
+  userType: z.string().optional()
+});
+var VaultConfigLocatorSchema = z.strictObject({
+  type: z.literal("vault"),
+  vaultUrl: z.string().optional(),
+  vaultPath: z.string(),
+  vaultTtl: z.number().optional(),
+  vaultWorkloadTokenUrl: z.string().optional(),
+  vaultWorkloadClientId: z.string().optional(),
+  vaultWorkloadScope: z.string().optional(),
+  vaultLfvServerUrl: z.string().optional(),
+  vaultLfvClientId: z.string().optional(),
+  vaultLfvDeliveryEndpoint: z.string().optional(),
+  vaultLfvVerifyJwks: z.string().optional(),
+  vaultLfvEventsEndpoint: z.string().optional(),
+  vaultLfvPath: z.string().optional(),
+  vaultLfvDeliveryTimeout: z.number().optional(),
+  vaultLfvRetryInterval: z.number().optional(),
+  vaultLfvWarnInterval: z.number().optional(),
+  vaultWebsocketUrl: z.string().optional(),
+  vaultWebsocketClientId: z.string().optional(),
+  vaultWebsocketHeader: z.enum(["X-Vault-Token", "Authorization"]).optional()
+});
+var AwsConfigLocatorSchema = z.strictObject({
+  type: z.literal("aws"),
+  awsWebhookUrl: z.string(),
+  awsTtl: z.number().optional()
+});
+var AzureConfigLocatorSchema = z.strictObject({
+  type: z.literal("azure"),
+  azureAuthMethod: z.enum(["client_secret", "workload_identity", "managed_identity"]).optional(),
+  azureEntraTenantId: z.string().optional(),
+  azureClientId: z.string().optional(),
+  azureManagedIdentityClientId: z.string().optional(),
+  azureImdsApiVersion: z.string().optional(),
+  azurePath: z.string().optional(),
+  azureVaultUrl: z.string().optional(),
+  azureVaultName: z.string().optional(),
+  azureApiVersion: z.string().optional(),
+  azureScope: z.string().optional(),
+  azureSecretNamePrefix: z.string().optional(),
+  azureTtl: z.number().optional()
+});
+var GcpConfigLocatorSchema = z.strictObject({
+  type: z.literal("gcp"),
+  gcpTtl: z.number().optional()
+});
+var DirectConfigLocatorSchema = z.discriminatedUnion("type", [
+  VaultConfigLocatorSchema,
+  AwsConfigLocatorSchema,
+  AzureConfigLocatorSchema,
+  GcpConfigLocatorSchema
+]);
+var ConfigLocatorSchema = z.union([
+  DirectConfigLocatorSchema,
+  z.strictObject({
+    type: z.literal("mirror"),
+    from: DirectConfigLocatorSchema,
+    to: VaultConfigLocatorSchema
+  })
+]);
+var BaseTenant = z.object({
+  id: z.string().min(1),
+  companyId: z.string(),
+  companyName: z.string(),
+  environmentType: z.enum(["POC", "DEV", "QA", "PROD"]),
+  status: z.enum(["pending", "processing", "completed", "failed", "action_required"]),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  configLocator: ConfigLocatorSchema.optional(),
+  email: z.string().optional(),
+  webhookUrl: z.string().optional(),
+  callbackUrl: z.string().optional(),
+  tenantUrl: z.string().optional(),
+  error: z.string().optional(),
+  actionUrl: z.string().optional(),
+  requestToken: z.string().optional(),
+  expiresAt: z.string().optional()
+});
+var BaseTenantCreateRequestSchema = z.object({
+  id: z.string(),
+  companyId: z.string(),
+  companyName: z.string(),
+  environmentType: z.enum(["POC", "DEV", "QA", "PROD"]),
+  configLocator: ConfigLocatorSchema.optional(),
+  email: z.email().optional(),
+  webhookUrl: z.url().optional(),
+  callbackUrl: z.url().optional()
+});
+var BaseTenantUpdateRequestSchema = z.object({
+  id: z.string().optional(),
+  companyId: z.string().optional(),
+  companyName: z.string().optional(),
+  environmentType: z.enum(["POC", "DEV", "QA", "PROD"]).optional(),
+  configLocator: ConfigLocatorSchema.optional(),
+  email: z.email().optional(),
+  webhookUrl: z.url().optional(),
+  callbackUrl: z.url().optional()
+});
+var zodValidators = {
+  authzEntityBase: () => withValidate(authzEntityBaseSchema),
+  authzResource: () => {
+    const resourceSchema = authzEntityBaseSchema.extend({
+      type: z.string(),
+      parent: z.lazy(() => z.union([z.string(), resourceSchema])).optional()
+    });
+    return withValidate(resourceSchema);
+  },
+  authzPermission: () => {
+    const permissionSchema = authzEntityBaseSchema.extend({
+      requestable: z.boolean().optional(),
+      action: z.string().optional(),
+      permissionTypes: z.array(z.string()).optional(),
+      resourceTypes: z.array(z.string()).optional(),
+      applyToSubResources: z.boolean().optional(),
+      assignableSubjectTypes: z.array(z.enum(["user", "customer", "workload"])).min(1),
+      recommendedSubjectTypes: z.array(z.enum(["user", "customer", "workload"])).optional()
+    });
+    return withValidate(permissionSchema);
+  },
+  authzRole: () => {
+    const permissionSchema = zodValidators.authzPermission();
+    const roleSchema = authzEntityBaseSchema.extend({
+      requestable: z.boolean().optional(),
+      roles: z.array(z.union([z.string(), z.lazy(() => roleSchema)])).optional(),
+      permissions: z.array(z.union([z.string(), permissionSchema])).optional(),
+      assignableSubjectTypes: z.array(z.enum(["user", "customer", "workload"])).min(1),
+      recommendedSubjectTypes: z.array(z.enum(["user", "customer", "workload"])).optional()
+    });
+    return withValidate(roleSchema);
+  },
+  authzGroup: () => {
+    const roleSchema = zodValidators.authzRole();
+    const permissionSchema = zodValidators.authzPermission();
+    const resourceSchema = zodValidators.authzResource();
+    const groupSchema = authzEntityBaseSchema.extend({
+      requestable: z.boolean().optional(),
+      groups: z.array(z.union([z.string(), z.lazy(() => groupSchema)])).optional(),
+      roles: z.array(z.union([z.string(), roleSchema])).optional(),
+      permissions: z.array(z.union([z.string(), permissionSchema])).optional(),
+      resources: z.array(z.union([z.string(), resourceSchema])).optional(),
+      assignableSubjectTypes: z.array(z.enum(["user", "customer", "workload"])).min(1),
+      recommendedSubjectTypes: z.array(z.enum(["user", "customer", "workload"])).optional()
+    });
+    return withValidate(groupSchema);
+  },
+  oidcCallbackParams: () => z.object({
+    code: z.string(),
+    state: z.string().optional(),
+    session_state: z.string().optional(),
+    error: z.string().optional(),
+    error_description: z.string().optional(),
+    error_uri: z.string().optional(),
+    iss: z.string().optional()
+  }),
+  idTokenClaims: () => z.object({
+    sub: z.string(),
+    iss: z.string(),
+    aud: z.union([z.string(), z.array(z.string()).nonempty()]),
+    exp: z.number(),
+    iat: z.number().optional(),
+    sid: z.string().optional(),
+    name: z.string().optional(),
+    email: z.union([z.email(), z.string().regex(/^[^@]+@localhost$/i)]).optional(),
+    preferred_username: z.string().optional(),
+    picture: z.url().optional()
+  }).passthrough(),
+  tokenResponse: () => z.object({
+    access_token: z.string(),
+    id_token: z.string(),
+    refresh_token: z.string().optional(),
+    token_type: z.string(),
+    expires_in: z.number().optional(),
+    scope: z.string().optional(),
+    refresh_expires_in: z.number().optional(),
+    session_state: z.string().optional(),
+    expires: z.string().optional()
+  }),
+  scimUser: () => {
+    const nameSchema = z.object({
+      formatted: z.string().optional(),
+      familyName: z.string().optional(),
+      givenName: z.string().optional(),
+      middleName: z.string().optional(),
+      honorificPrefix: z.string().optional(),
+      honorificSuffix: z.string().optional()
+    });
+    const emailSchema = z.object({
+      value: z.email(),
+      display: z.string().optional(),
+      type: z.string().optional(),
+      primary: z.boolean().optional()
+    });
+    const phoneNumberSchema = z.object({
+      value: z.string(),
+      display: z.string().optional(),
+      type: z.string().optional(),
+      primary: z.boolean().optional()
+    });
+    const addressSchema = z.object({
+      formatted: z.string().optional(),
+      streetAddress: z.string().optional(),
+      locality: z.string().optional(),
+      region: z.string().optional(),
+      postalCode: z.string().optional(),
+      country: z.string().optional(),
+      type: z.string().optional(),
+      primary: z.boolean().optional()
+    });
+    const groupSchema = z.object({
+      value: z.string(),
+      $ref: z.string().optional(),
+      display: z.string().optional(),
+      type: z.string().optional()
+    });
+    const roleSchema = z.object({
+      value: z.string(),
+      display: z.string().optional(),
+      type: z.string().optional(),
+      primary: z.boolean().optional()
+    });
+    const enterpriseUserSchema = z.object({
+      employeeNumber: z.string().optional(),
+      costCenter: z.string().optional(),
+      organization: z.string().optional(),
+      division: z.string().optional(),
+      department: z.string().optional(),
+      manager: z.object({
+        value: z.string().optional(),
+        $ref: z.string().optional(),
+        displayName: z.string().optional()
+      }).optional()
+    });
+    return z.object({
+      id: z.string().optional(),
+      externalId: z.string().optional(),
+      meta: z.object({
+        resourceType: z.string().optional(),
+        created: z.string().optional(),
+        lastModified: z.string().optional(),
+        location: z.string().optional(),
+        version: z.string().optional()
+      }).optional(),
+      userName: z.string(),
+      name: nameSchema.optional(),
+      displayName: z.string().optional(),
+      nickName: z.string().optional(),
+      profileUrl: z.url().optional(),
+      title: z.string().optional(),
+      userType: z.string().optional(),
+      preferredLanguage: z.string().optional(),
+      locale: z.string().optional(),
+      timezone: z.string().optional(),
+      active: z.boolean().optional(),
+      password: z.never().optional(),
+      emails: z.array(emailSchema).optional(),
+      phoneNumbers: z.array(phoneNumberSchema).optional(),
+      ims: z.array(z.object({
+        value: z.string(),
+        display: z.string().optional(),
+        type: z.string().optional(),
+        primary: z.boolean().optional()
+      })).optional(),
+      photos: z.array(z.object({
+        value: z.string(),
+        display: z.string().optional(),
+        type: z.string().optional(),
+        primary: z.boolean().optional()
+      })).optional(),
+      addresses: z.array(addressSchema).optional(),
+      groups: z.array(groupSchema).optional(),
+      entitlements: z.array(z.object({
+        value: z.string(),
+        display: z.string().optional(),
+        type: z.string().optional(),
+        primary: z.boolean().optional()
+      })).optional(),
+      roles: z.array(roleSchema).optional(),
+      x509Certificates: z.array(z.object({
+        value: z.string(),
+        display: z.string().optional(),
+        type: z.string().optional(),
+        primary: z.boolean().optional()
+      })).optional(),
+      "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User": enterpriseUserSchema.optional(),
+      [ION_SCIM_USER_EXTENSION_URN]: z.object({
+        ecid: ecidSchema(),
+        accountClass: z.string().optional()
+      }).optional(),
+      schemas: z.array(z.string()).optional()
+    });
+  },
+  scimGroup: () => {
+    const groupMemberSchema = z.object({
+      value: z.string(),
+      $ref: z.string().optional(),
+      display: z.string().optional(),
+      type: z.enum(["User", "Group", "Workload", "Customer"]).optional()
+    });
+    return z.object({
+      id: z.string().optional(),
+      externalId: z.string().optional(),
+      meta: z.object({
+        resourceType: z.string().optional(),
+        created: z.string().optional(),
+        lastModified: z.string().optional(),
+        location: z.string().optional(),
+        version: z.string().optional()
+      }).optional(),
+      displayName: z.string(),
+      members: z.array(groupMemberSchema).optional(),
+      "urn:ionite:params:scim:schemas:extension:authz:2.0:Group": z.object({
+        type: z.enum(["group", "role", "permission"]).optional(),
+        requestable: z.boolean().optional(),
+        description: z.string().optional(),
+        resources: z.array(z.string()).optional()
+      }).optional(),
+      schemas: z.array(z.string()).optional()
+    });
+  },
+  jwtAssertionClaims: () => z.object({
+    iss: z.string(),
+    sub: z.string(),
+    aud: z.union([z.string(), z.array(z.string())]).optional(),
+    exp: z.number(),
+    iat: z.number(),
+    jti: z.string().optional(),
+    scope: z.string().optional()
+  }).passthrough(),
+  workloadTokenResponse: () => z.object({
+    access_token: z.string(),
+    token_type: z.string(),
+    expires_in: z.number().optional(),
+    scope: z.string().optional(),
+    refresh_token: z.string().optional(),
+    expires: z.string().optional()
+  }),
+  baseUser: () => BaseUser,
+  customer: () => BaseCustomer,
+  createTenantRequest: (extendedShape) => extendedShape ? BaseTenantCreateRequestSchema.extend(extendedShape) : BaseTenantCreateRequestSchema,
+  updateTenantRequest: (extendedShape) => extendedShape ? BaseTenantUpdateRequestSchema.extend(extendedShape) : BaseTenantUpdateRequestSchema,
+  tenantResponse: () => z.union([
+    z.object({
+      tenantUrl: z.url().optional(),
+      status: z.enum(["pending", "processing", "completed", "failed"]),
+      error: z.string().optional()
+    }),
+    z.object({
+      status: z.literal("action_required"),
+      actionUrl: z.url(),
+      requestToken: z.string(),
+      expiresAt: z.string()
+    })
+  ]),
+  registerIAMAppPayload: () => z.object({
+    id: z.string().min(1),
+    companyId: z.string().min(1),
+    companyName: z.string().min(1),
+    environmentType: z.enum(["POC", "DEV", "QA", "PROD"]),
+    tenantUrl: z.url().optional(),
+    displayName: z.string().optional(),
+    productId: z.string().optional(),
+    applicationId: z.string().optional(),
+    scimBaseUrl: z.url().optional(),
+    workload: z.record(z.string(), z.unknown()).optional()
+  }),
+  registerSSOAppPayload: () => z.object({
+    redirectUris: z.array(z.string().refine(isSafeRedirectUri, { message: `redirectUri ${SAFE_REDIRECT_URI_MESSAGE}` })).min(1),
+    backchannelLogoutUri: z.string().refine(isSafeRedirectUri, { message: `backchannelLogoutUri ${SAFE_REDIRECT_URI_MESSAGE}` }).optional(),
+    displayName: z.string().optional(),
+    defaultScope: z.string().optional(),
+    issuerTenant: z.string().optional(),
+    applicationId: z.string().optional()
+  })
+};
+function createValidators() {
+  return {
+    sso: {
+      callbackParams: withValidate(zodValidators.oidcCallbackParams()),
+      idTokenClaims: withValidate(zodValidators.idTokenClaims()),
+      tokenResponse: withValidate(zodValidators.tokenResponse())
+    },
+    iam: {
+      user: withValidate(zodValidators.scimUser()),
+      group: withValidate(zodValidators.scimGroup())
+    },
+    workload: {
+      jwtAssertionClaims: withValidate(zodValidators.jwtAssertionClaims()),
+      tokenResponse: withValidate(zodValidators.workloadTokenResponse())
+    },
+    tenant: {
+      createTenantRequest: withValidate(zodValidators.createTenantRequest()),
+      updateTenantRequest: withValidate(zodValidators.updateTenantRequest()),
+      tenantResponse: withValidate(zodValidators.tenantResponse())
+    },
+    ciam: {
+      customer: withValidate(zodValidators.customer()),
+      callbackParams: withValidate(zodValidators.oidcCallbackParams()),
+      idTokenClaims: withValidate(zodValidators.idTokenClaims()),
+      tokenResponse: withValidate(zodValidators.tokenResponse())
+    }
+  };
+}
+function createControlValidators() {
+  return {
+    iam: {
+      registerIAMAppPayload: withValidate(zodValidators.registerIAMAppPayload())
+    },
+    sso: {
+      registerSSOAppPayload: withValidate(zodValidators.registerSSOAppPayload())
+    }
+  };
+}
+export {
+  zodValidators,
+  isSafeRedirectUri,
+  createValidators,
+  createControlValidators,
+  ConfigLocatorSchema,
+  BaseUser,
+  BaseTenantUpdateRequestSchema,
+  BaseTenantCreateRequestSchema,
+  BaseTenant,
+  BaseCustomer
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ionite/zod",
-  "version": "0.0.24-beta.20260907.2",
+  "version": "0.0.24-beta.20260907.3",
   "description": "Zod validators for ionite (SSO, IAM, workload, tenant, CIAM)",
   "type": "module",
   "engines": {
@@ -9,7 +9,7 @@
   "author": "ionite",
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
-    "@ionite/core": "0.0.24-beta.20260907.2",
+    "@ionite/core": "0.0.24-beta.20260907.3",
     "@standard-schema/spec": "^1.1.0",
     "zod": "^4.4.3"
   },