@ionite/zod 0.0.24-beta.20260907.3 → 0.0.24-beta.20260915.2

package/dist/index.d.ts

@@ -242,4 +242,4 @@ declare function createControlValidators(): {
 	iam: IAMAppValidators;
 	sso: SSOAppValidators;
 };
-export { zodValidators, isSafeRedirectUri, createValidators, createControlValidators, ConfigLocatorSchema, BaseUser, BaseTenantUpdateRequestSchema, BaseTenantCreateRequestSchema, BaseTenant, BaseCustomer };
+export { BaseCustomer, BaseTenant, BaseTenantCreateRequestSchema, BaseTenantUpdateRequestSchema, BaseUser, ConfigLocatorSchema, createControlValidators, createValidators, isSafeRedirectUri, zodValidators };

package/dist/index.js

@@ -1,474 +1 @@
-// packages/zod/src/index.ts
-import { ION_SCIM_USER_EXTENSION_URN, isEcid, withValidate } from "@ionite/core";
-import { z } from "zod";
-function isSafeRedirectUri(value) {
-  for (let i = 0;i < value.length; i++) {
-    const code = value.charCodeAt(i);
-    if (code <= 31 || code === 127)
-      return false;
-  }
-  let url;
-  try {
-    url = new URL(value);
-  } catch {
-    return false;
-  }
-  if (url.protocol === "https:")
-    return true;
-  if (url.protocol === "http:") {
-    const host = url.hostname.toLowerCase();
-    return host === "localhost" || host === "127.0.0.1" || host === "[::1]" || host === "::1";
-  }
-  return false;
-}
-var SAFE_REDIRECT_URI_MESSAGE = "must be an absolute https URL (http is allowed only for localhost)";
-var ECID_MESSAGE = 'must be a valid ECID formatted as "ecid:<realm>:<opaque>"';
-var ecidSchema = () => z.string().refine(isEcid, ECID_MESSAGE).optional();
-var authzEntityBaseSchema = z.object({
-  id: z.string(),
-  name: z.string(),
-  displayName: z.string().optional(),
-  description: z.string(),
-  metadata: z.record(z.string(), z.unknown()).optional()
-});
-var BaseUser = z.object({
-  userName: z.string(),
-  name: z.string(),
-  email: z.email(),
-  id: z.string().optional(),
-  avatar: z.union([z.url(), z.literal("")]).optional(),
-  userType: z.string().optional(),
-  ecid: ecidSchema(),
-  accountClass: z.string().optional()
-});
-var BaseCustomer = z.object({
-  userName: z.string(),
-  name: z.string(),
-  email: z.email(),
-  id: z.string().optional(),
-  avatar: z.union([z.url(), z.literal("")]).optional(),
-  userType: z.string().optional()
-});
-var VaultConfigLocatorSchema = z.strictObject({
-  type: z.literal("vault"),
-  vaultUrl: z.string().optional(),
-  vaultPath: z.string(),
-  vaultTtl: z.number().optional(),
-  vaultWorkloadTokenUrl: z.string().optional(),
-  vaultWorkloadClientId: z.string().optional(),
-  vaultWorkloadScope: z.string().optional(),
-  vaultLfvServerUrl: z.string().optional(),
-  vaultLfvClientId: z.string().optional(),
-  vaultLfvDeliveryEndpoint: z.string().optional(),
-  vaultLfvVerifyJwks: z.string().optional(),
-  vaultLfvEventsEndpoint: z.string().optional(),
-  vaultLfvPath: z.string().optional(),
-  vaultLfvDeliveryTimeout: z.number().optional(),
-  vaultLfvRetryInterval: z.number().optional(),
-  vaultLfvWarnInterval: z.number().optional(),
-  vaultWebsocketUrl: z.string().optional(),
-  vaultWebsocketClientId: z.string().optional(),
-  vaultWebsocketHeader: z.enum(["X-Vault-Token", "Authorization"]).optional()
-});
-var AwsConfigLocatorSchema = z.strictObject({
-  type: z.literal("aws"),
-  awsWebhookUrl: z.string(),
-  awsTtl: z.number().optional()
-});
-var AzureConfigLocatorSchema = z.strictObject({
-  type: z.literal("azure"),
-  azureAuthMethod: z.enum(["client_secret", "workload_identity", "managed_identity"]).optional(),
-  azureEntraTenantId: z.string().optional(),
-  azureClientId: z.string().optional(),
-  azureManagedIdentityClientId: z.string().optional(),
-  azureImdsApiVersion: z.string().optional(),
-  azurePath: z.string().optional(),
-  azureVaultUrl: z.string().optional(),
-  azureVaultName: z.string().optional(),
-  azureApiVersion: z.string().optional(),
-  azureScope: z.string().optional(),
-  azureSecretNamePrefix: z.string().optional(),
-  azureTtl: z.number().optional()
-});
-var GcpConfigLocatorSchema = z.strictObject({
-  type: z.literal("gcp"),
-  gcpTtl: z.number().optional()
-});
-var DirectConfigLocatorSchema = z.discriminatedUnion("type", [
-  VaultConfigLocatorSchema,
-  AwsConfigLocatorSchema,
-  AzureConfigLocatorSchema,
-  GcpConfigLocatorSchema
-]);
-var ConfigLocatorSchema = z.union([
-  DirectConfigLocatorSchema,
-  z.strictObject({
-    type: z.literal("mirror"),
-    from: DirectConfigLocatorSchema,
-    to: VaultConfigLocatorSchema
-  })
-]);
-var BaseTenant = z.object({
-  id: z.string().min(1),
-  companyId: z.string(),
-  companyName: z.string(),
-  environmentType: z.enum(["POC", "DEV", "QA", "PROD"]),
-  status: z.enum(["pending", "processing", "completed", "failed", "action_required"]),
-  createdAt: z.date(),
-  updatedAt: z.date(),
-  configLocator: ConfigLocatorSchema.optional(),
-  email: z.string().optional(),
-  webhookUrl: z.string().optional(),
-  callbackUrl: z.string().optional(),
-  tenantUrl: z.string().optional(),
-  error: z.string().optional(),
-  actionUrl: z.string().optional(),
-  requestToken: z.string().optional(),
-  expiresAt: z.string().optional()
-});
-var BaseTenantCreateRequestSchema = z.object({
-  id: z.string(),
-  companyId: z.string(),
-  companyName: z.string(),
-  environmentType: z.enum(["POC", "DEV", "QA", "PROD"]),
-  configLocator: ConfigLocatorSchema.optional(),
-  email: z.email().optional(),
-  webhookUrl: z.url().optional(),
-  callbackUrl: z.url().optional()
-});
-var BaseTenantUpdateRequestSchema = z.object({
-  id: z.string().optional(),
-  companyId: z.string().optional(),
-  companyName: z.string().optional(),
-  environmentType: z.enum(["POC", "DEV", "QA", "PROD"]).optional(),
-  configLocator: ConfigLocatorSchema.optional(),
-  email: z.email().optional(),
-  webhookUrl: z.url().optional(),
-  callbackUrl: z.url().optional()
-});
-var zodValidators = {
-  authzEntityBase: () => withValidate(authzEntityBaseSchema),
-  authzResource: () => {
-    const resourceSchema = authzEntityBaseSchema.extend({
-      type: z.string(),
-      parent: z.lazy(() => z.union([z.string(), resourceSchema])).optional()
-    });
-    return withValidate(resourceSchema);
-  },
-  authzPermission: () => {
-    const permissionSchema = authzEntityBaseSchema.extend({
-      requestable: z.boolean().optional(),
-      action: z.string().optional(),
-      permissionTypes: z.array(z.string()).optional(),
-      resourceTypes: z.array(z.string()).optional(),
-      applyToSubResources: z.boolean().optional(),
-      assignableSubjectTypes: z.array(z.enum(["user", "customer", "workload"])).min(1),
-      recommendedSubjectTypes: z.array(z.enum(["user", "customer", "workload"])).optional()
-    });
-    return withValidate(permissionSchema);
-  },
-  authzRole: () => {
-    const permissionSchema = zodValidators.authzPermission();
-    const roleSchema = authzEntityBaseSchema.extend({
-      requestable: z.boolean().optional(),
-      roles: z.array(z.union([z.string(), z.lazy(() => roleSchema)])).optional(),
-      permissions: z.array(z.union([z.string(), permissionSchema])).optional(),
-      assignableSubjectTypes: z.array(z.enum(["user", "customer", "workload"])).min(1),
-      recommendedSubjectTypes: z.array(z.enum(["user", "customer", "workload"])).optional()
-    });
-    return withValidate(roleSchema);
-  },
-  authzGroup: () => {
-    const roleSchema = zodValidators.authzRole();
-    const permissionSchema = zodValidators.authzPermission();
-    const resourceSchema = zodValidators.authzResource();
-    const groupSchema = authzEntityBaseSchema.extend({
-      requestable: z.boolean().optional(),
-      groups: z.array(z.union([z.string(), z.lazy(() => groupSchema)])).optional(),
-      roles: z.array(z.union([z.string(), roleSchema])).optional(),
-      permissions: z.array(z.union([z.string(), permissionSchema])).optional(),
-      resources: z.array(z.union([z.string(), resourceSchema])).optional(),
-      assignableSubjectTypes: z.array(z.enum(["user", "customer", "workload"])).min(1),
-      recommendedSubjectTypes: z.array(z.enum(["user", "customer", "workload"])).optional()
-    });
-    return withValidate(groupSchema);
-  },
-  oidcCallbackParams: () => z.object({
-    code: z.string(),
-    state: z.string().optional(),
-    session_state: z.string().optional(),
-    error: z.string().optional(),
-    error_description: z.string().optional(),
-    error_uri: z.string().optional(),
-    iss: z.string().optional()
-  }),
-  idTokenClaims: () => z.object({
-    sub: z.string(),
-    iss: z.string(),
-    aud: z.union([z.string(), z.array(z.string()).nonempty()]),
-    exp: z.number(),
-    iat: z.number().optional(),
-    sid: z.string().optional(),
-    name: z.string().optional(),
-    email: z.union([z.email(), z.string().regex(/^[^@]+@localhost$/i)]).optional(),
-    preferred_username: z.string().optional(),
-    picture: z.url().optional()
-  }).passthrough(),
-  tokenResponse: () => z.object({
-    access_token: z.string(),
-    id_token: z.string(),
-    refresh_token: z.string().optional(),
-    token_type: z.string(),
-    expires_in: z.number().optional(),
-    scope: z.string().optional(),
-    refresh_expires_in: z.number().optional(),
-    session_state: z.string().optional(),
-    expires: z.string().optional()
-  }),
-  scimUser: () => {
-    const nameSchema = z.object({
-      formatted: z.string().optional(),
-      familyName: z.string().optional(),
-      givenName: z.string().optional(),
-      middleName: z.string().optional(),
-      honorificPrefix: z.string().optional(),
-      honorificSuffix: z.string().optional()
-    });
-    const emailSchema = z.object({
-      value: z.email(),
-      display: z.string().optional(),
-      type: z.string().optional(),
-      primary: z.boolean().optional()
-    });
-    const phoneNumberSchema = z.object({
-      value: z.string(),
-      display: z.string().optional(),
-      type: z.string().optional(),
-      primary: z.boolean().optional()
-    });
-    const addressSchema = z.object({
-      formatted: z.string().optional(),
-      streetAddress: z.string().optional(),
-      locality: z.string().optional(),
-      region: z.string().optional(),
-      postalCode: z.string().optional(),
-      country: z.string().optional(),
-      type: z.string().optional(),
-      primary: z.boolean().optional()
-    });
-    const groupSchema = z.object({
-      value: z.string(),
-      $ref: z.string().optional(),
-      display: z.string().optional(),
-      type: z.string().optional()
-    });
-    const roleSchema = z.object({
-      value: z.string(),
-      display: z.string().optional(),
-      type: z.string().optional(),
-      primary: z.boolean().optional()
-    });
-    const enterpriseUserSchema = z.object({
-      employeeNumber: z.string().optional(),
-      costCenter: z.string().optional(),
-      organization: z.string().optional(),
-      division: z.string().optional(),
-      department: z.string().optional(),
-      manager: z.object({
-        value: z.string().optional(),
-        $ref: z.string().optional(),
-        displayName: z.string().optional()
-      }).optional()
-    });
-    return z.object({
-      id: z.string().optional(),
-      externalId: z.string().optional(),
-      meta: z.object({
-        resourceType: z.string().optional(),
-        created: z.string().optional(),
-        lastModified: z.string().optional(),
-        location: z.string().optional(),
-        version: z.string().optional()
-      }).optional(),
-      userName: z.string(),
-      name: nameSchema.optional(),
-      displayName: z.string().optional(),
-      nickName: z.string().optional(),
-      profileUrl: z.url().optional(),
-      title: z.string().optional(),
-      userType: z.string().optional(),
-      preferredLanguage: z.string().optional(),
-      locale: z.string().optional(),
-      timezone: z.string().optional(),
-      active: z.boolean().optional(),
-      password: z.never().optional(),
-      emails: z.array(emailSchema).optional(),
-      phoneNumbers: z.array(phoneNumberSchema).optional(),
-      ims: z.array(z.object({
-        value: z.string(),
-        display: z.string().optional(),
-        type: z.string().optional(),
-        primary: z.boolean().optional()
-      })).optional(),
-      photos: z.array(z.object({
-        value: z.string(),
-        display: z.string().optional(),
-        type: z.string().optional(),
-        primary: z.boolean().optional()
-      })).optional(),
-      addresses: z.array(addressSchema).optional(),
-      groups: z.array(groupSchema).optional(),
-      entitlements: z.array(z.object({
-        value: z.string(),
-        display: z.string().optional(),
-        type: z.string().optional(),
-        primary: z.boolean().optional()
-      })).optional(),
-      roles: z.array(roleSchema).optional(),
-      x509Certificates: z.array(z.object({
-        value: z.string(),
-        display: z.string().optional(),
-        type: z.string().optional(),
-        primary: z.boolean().optional()
-      })).optional(),
-      "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User": enterpriseUserSchema.optional(),
-      [ION_SCIM_USER_EXTENSION_URN]: z.object({
-        ecid: ecidSchema(),
-        accountClass: z.string().optional()
-      }).optional(),
-      schemas: z.array(z.string()).optional()
-    });
-  },
-  scimGroup: () => {
-    const groupMemberSchema = z.object({
-      value: z.string(),
-      $ref: z.string().optional(),
-      display: z.string().optional(),
-      type: z.enum(["User", "Group", "Workload", "Customer"]).optional()
-    });
-    return z.object({
-      id: z.string().optional(),
-      externalId: z.string().optional(),
-      meta: z.object({
-        resourceType: z.string().optional(),
-        created: z.string().optional(),
-        lastModified: z.string().optional(),
-        location: z.string().optional(),
-        version: z.string().optional()
-      }).optional(),
-      displayName: z.string(),
-      members: z.array(groupMemberSchema).optional(),
-      "urn:ionite:params:scim:schemas:extension:authz:2.0:Group": z.object({
-        type: z.enum(["group", "role", "permission"]).optional(),
-        requestable: z.boolean().optional(),
-        description: z.string().optional(),
-        resources: z.array(z.string()).optional()
-      }).optional(),
-      schemas: z.array(z.string()).optional()
-    });
-  },
-  jwtAssertionClaims: () => z.object({
-    iss: z.string(),
-    sub: z.string(),
-    aud: z.union([z.string(), z.array(z.string())]).optional(),
-    exp: z.number(),
-    iat: z.number(),
-    jti: z.string().optional(),
-    scope: z.string().optional()
-  }).passthrough(),
-  workloadTokenResponse: () => z.object({
-    access_token: z.string(),
-    token_type: z.string(),
-    expires_in: z.number().optional(),
-    scope: z.string().optional(),
-    refresh_token: z.string().optional(),
-    expires: z.string().optional()
-  }),
-  baseUser: () => BaseUser,
-  customer: () => BaseCustomer,
-  createTenantRequest: (extendedShape) => extendedShape ? BaseTenantCreateRequestSchema.extend(extendedShape) : BaseTenantCreateRequestSchema,
-  updateTenantRequest: (extendedShape) => extendedShape ? BaseTenantUpdateRequestSchema.extend(extendedShape) : BaseTenantUpdateRequestSchema,
-  tenantResponse: () => z.union([
-    z.object({
-      tenantUrl: z.url().optional(),
-      status: z.enum(["pending", "processing", "completed", "failed"]),
-      error: z.string().optional()
-    }),
-    z.object({
-      status: z.literal("action_required"),
-      actionUrl: z.url(),
-      requestToken: z.string(),
-      expiresAt: z.string()
-    })
-  ]),
-  registerIAMAppPayload: () => z.object({
-    id: z.string().min(1),
-    companyId: z.string().min(1),
-    companyName: z.string().min(1),
-    environmentType: z.enum(["POC", "DEV", "QA", "PROD"]),
-    tenantUrl: z.url().optional(),
-    displayName: z.string().optional(),
-    productId: z.string().optional(),
-    applicationId: z.string().optional(),
-    scimBaseUrl: z.url().optional(),
-    workload: z.record(z.string(), z.unknown()).optional()
-  }),
-  registerSSOAppPayload: () => z.object({
-    redirectUris: z.array(z.string().refine(isSafeRedirectUri, { message: `redirectUri ${SAFE_REDIRECT_URI_MESSAGE}` })).min(1),
-    backchannelLogoutUri: z.string().refine(isSafeRedirectUri, { message: `backchannelLogoutUri ${SAFE_REDIRECT_URI_MESSAGE}` }).optional(),
-    displayName: z.string().optional(),
-    defaultScope: z.string().optional(),
-    issuerTenant: z.string().optional(),
-    applicationId: z.string().optional()
-  })
-};
-function createValidators() {
-  return {
-    sso: {
-      callbackParams: withValidate(zodValidators.oidcCallbackParams()),
-      idTokenClaims: withValidate(zodValidators.idTokenClaims()),
-      tokenResponse: withValidate(zodValidators.tokenResponse())
-    },
-    iam: {
-      user: withValidate(zodValidators.scimUser()),
-      group: withValidate(zodValidators.scimGroup())
-    },
-    workload: {
-      jwtAssertionClaims: withValidate(zodValidators.jwtAssertionClaims()),
-      tokenResponse: withValidate(zodValidators.workloadTokenResponse())
-    },
-    tenant: {
-      createTenantRequest: withValidate(zodValidators.createTenantRequest()),
-      updateTenantRequest: withValidate(zodValidators.updateTenantRequest()),
-      tenantResponse: withValidate(zodValidators.tenantResponse())
-    },
-    ciam: {
-      customer: withValidate(zodValidators.customer()),
-      callbackParams: withValidate(zodValidators.oidcCallbackParams()),
-      idTokenClaims: withValidate(zodValidators.idTokenClaims()),
-      tokenResponse: withValidate(zodValidators.tokenResponse())
-    }
-  };
-}
-function createControlValidators() {
-  return {
-    iam: {
-      registerIAMAppPayload: withValidate(zodValidators.registerIAMAppPayload())
-    },
-    sso: {
-      registerSSOAppPayload: withValidate(zodValidators.registerSSOAppPayload())
-    }
-  };
-}
-export {
-  zodValidators,
-  isSafeRedirectUri,
-  createValidators,
-  createControlValidators,
-  ConfigLocatorSchema,
-  BaseUser,
-  BaseTenantUpdateRequestSchema,
-  BaseTenantCreateRequestSchema,
-  BaseTenant,
-  BaseCustomer
-};
+import{ION_SCIM_USER_EXTENSION_URN as z,isEcid as b,withValidate as n}from"@ionite/core";import{z as o}from"zod";function l(e){for(let a=0;a<e.length;a++){let r=e.charCodeAt(a);if(r<=31||r===127)return!1}let i;try{i=new URL(e)}catch{return!1}if(i.protocol==="https:")return!0;if(i.protocol==="http:"){let a=i.hostname.toLowerCase();return a==="localhost"||a==="127.0.0.1"||a==="[::1]"||a==="::1"}return!1}var c="must be an absolute https URL (http is allowed only for localhost)",k='must be a valid ECID formatted as "ecid:<realm>:<opaque>"',g=()=>o.string().refine(b,k).optional(),s=o.object({id:o.string(),name:o.string(),displayName:o.string().optional(),description:o.string(),metadata:o.record(o.string(),o.unknown()).optional()}),Z=o.object({userName:o.string(),name:o.string(),email:o.email(),id:o.string().optional(),avatar:o.union([o.url(),o.literal("")]).optional(),userType:o.string().optional(),ecid:g(),accountClass:o.string().optional()}),R=o.object({userName:o.string(),name:o.string(),email:o.email(),id:o.string().optional(),avatar:o.union([o.url(),o.literal("")]).optional(),userType:o.string().optional()}),y=o.strictObject({type:o.literal("vault"),vaultUrl:o.string().optional(),vaultPath:o.string(),vaultTtl:o.number().optional(),vaultWorkloadTokenUrl:o.string().optional(),vaultWorkloadClientId:o.string().optional(),vaultWorkloadScope:o.string().optional(),vaultLfvServerUrl:o.string().optional(),vaultLfvClientId:o.string().optional(),vaultLfvDeliveryEndpoint:o.string().optional(),vaultLfvVerifyJwks:o.string().optional(),vaultLfvEventsEndpoint:o.string().optional(),vaultLfvPath:o.string().optional(),vaultLfvDeliveryTimeout:o.number().optional(),vaultLfvRetryInterval:o.number().optional(),vaultLfvWarnInterval:o.number().optional(),vaultWebsocketUrl:o.string().optional(),vaultWebsocketClientId:o.string().optional(),vaultWebsocketHeader:o.enum(["X-Vault-Token","Authorization"]).optional()}),w=o.strictObject({type:o.literal("aws"),awsWebhookUrl:o.string(),awsTtl:o.number().optional()}),f=o.strictObject({type:o.literal("azure"),azureAuthMethod:o.enum(["client_secret","workload_identity","managed_identity"]).optional(),azureEntraTenantId:o.string().optional(),azureClientId:o.string().optional(),azureManagedIdentityClientId:o.string().optional(),azureImdsApiVersion:o.string().optional(),azurePath:o.string().optional(),azureVaultUrl:o.string().optional(),azureVaultName:o.string().optional(),azureApiVersion:o.string().optional(),azureScope:o.string().optional(),azureSecretNamePrefix:o.string().optional(),azureTtl:o.number().optional()}),C=o.strictObject({type:o.literal("gcp"),gcpTtl:o.number().optional()}),d=o.discriminatedUnion("type",[y,w,f,C]),p=o.union([d,o.strictObject({type:o.literal("mirror"),from:d,to:y})]),O=o.object({id:o.string().min(1),companyId:o.string(),companyName:o.string(),environmentType:o.enum(["POC","DEV","QA","PROD"]),status:o.enum(["pending","processing","completed","failed","action_required"]),createdAt:o.date(),updatedAt:o.date(),configLocator:p.optional(),email:o.string().optional(),webhookUrl:o.string().optional(),callbackUrl:o.string().optional(),tenantUrl:o.string().optional(),error:o.string().optional(),actionUrl:o.string().optional(),requestToken:o.string().optional(),expiresAt:o.string().optional()}),u=o.object({id:o.string(),companyId:o.string(),companyName:o.string(),environmentType:o.enum(["POC","DEV","QA","PROD"]),configLocator:p.optional(),email:o.email().optional(),webhookUrl:o.url().optional(),callbackUrl:o.url().optional()}),m=o.object({id:o.string().optional(),companyId:o.string().optional(),companyName:o.string().optional(),environmentType:o.enum(["POC","DEV","QA","PROD"]).optional(),configLocator:p.optional(),email:o.email().optional(),webhookUrl:o.url().optional(),callbackUrl:o.url().optional()}),t={authzEntityBase:()=>n(s),authzResource:()=>{let e=s.extend({type:o.string(),parent:o.lazy(()=>o.union([o.string(),e])).optional()});return n(e)},authzPermission:()=>{let e=s.extend({requestable:o.boolean().optional(),riskLevel:o.string().optional(),action:o.string().optional(),permissionTypes:o.array(o.string()).optional(),resourceTypes:o.array(o.string()).optional(),applyToSubResources:o.boolean().optional(),assignableSubjectTypes:o.array(o.enum(["user","customer","workload"])).min(1),recommendedSubjectTypes:o.array(o.enum(["user","customer","workload"])).optional()});return n(e)},authzRole:()=>{let e=t.authzPermission(),i=s.extend({requestable:o.boolean().optional(),riskLevel:o.string().optional(),roles:o.array(o.union([o.string(),o.lazy(()=>i)])).optional(),permissions:o.array(o.union([o.string(),e])).optional(),assignableSubjectTypes:o.array(o.enum(["user","customer","workload"])).min(1),recommendedSubjectTypes:o.array(o.enum(["user","customer","workload"])).optional()});return n(i)},authzGroup:()=>{let e=t.authzRole(),i=t.authzPermission(),a=t.authzResource(),r=s.extend({requestable:o.boolean().optional(),riskLevel:o.string().optional(),groups:o.array(o.union([o.string(),o.lazy(()=>r)])).optional(),roles:o.array(o.union([o.string(),e])).optional(),permissions:o.array(o.union([o.string(),i])).optional(),resources:o.array(o.union([o.string(),a])).optional(),assignableSubjectTypes:o.array(o.enum(["user","customer","workload"])).min(1),recommendedSubjectTypes:o.array(o.enum(["user","customer","workload"])).optional()});return n(r)},oidcCallbackParams:()=>o.object({code:o.string(),state:o.string().optional(),session_state:o.string().optional(),error:o.string().optional(),error_description:o.string().optional(),error_uri:o.string().optional(),iss:o.string().optional()}),idTokenClaims:()=>o.object({sub:o.string(),iss:o.string(),aud:o.union([o.string(),o.array(o.string()).nonempty()]),exp:o.number(),iat:o.number().optional(),sid:o.string().optional(),name:o.string().optional(),email:o.union([o.email(),o.string().regex(/^[^@]+@localhost$/i)]).optional(),preferred_username:o.string().optional(),picture:o.url().optional()}).passthrough(),tokenResponse:()=>o.object({access_token:o.string(),id_token:o.string(),refresh_token:o.string().optional(),token_type:o.string(),expires_in:o.number().optional(),scope:o.string().optional(),refresh_expires_in:o.number().optional(),session_state:o.string().optional(),expires:o.string().optional()}),scimUser:()=>{let e=o.object({formatted:o.string().optional(),familyName:o.string().optional(),givenName:o.string().optional(),middleName:o.string().optional(),honorificPrefix:o.string().optional(),honorificSuffix:o.string().optional()}),i=o.object({value:o.email(),display:o.string().optional(),type:o.string().optional(),primary:o.boolean().optional()}),a=o.object({value:o.string(),display:o.string().optional(),type:o.string().optional(),primary:o.boolean().optional()}),r=o.object({formatted:o.string().optional(),streetAddress:o.string().optional(),locality:o.string().optional(),region:o.string().optional(),postalCode:o.string().optional(),country:o.string().optional(),type:o.string().optional(),primary:o.boolean().optional()}),S=o.object({value:o.string(),$ref:o.string().optional(),display:o.string().optional(),type:o.string().optional()}),T=o.object({value:o.string(),display:o.string().optional(),type:o.string().optional(),primary:o.boolean().optional()}),h=o.object({employeeNumber:o.string().optional(),costCenter:o.string().optional(),organization:o.string().optional(),division:o.string().optional(),department:o.string().optional(),manager:o.object({value:o.string().optional(),$ref:o.string().optional(),displayName:o.string().optional()}).optional()});return o.object({id:o.string().optional(),externalId:o.string().optional(),meta:o.object({resourceType:o.string().optional(),created:o.string().optional(),lastModified:o.string().optional(),location:o.string().optional(),version:o.string().optional()}).optional(),userName:o.string(),name:e.optional(),displayName:o.string().optional(),nickName:o.string().optional(),profileUrl:o.url().optional(),title:o.string().optional(),userType:o.string().optional(),preferredLanguage:o.string().optional(),locale:o.string().optional(),timezone:o.string().optional(),active:o.boolean().optional(),password:o.never().optional(),emails:o.array(i).optional(),phoneNumbers:o.array(a).optional(),ims:o.array(o.object({value:o.string(),display:o.string().optional(),type:o.string().optional(),primary:o.boolean().optional()})).optional(),photos:o.array(o.object({value:o.string(),display:o.string().optional(),type:o.string().optional(),primary:o.boolean().optional()})).optional(),addresses:o.array(r).optional(),groups:o.array(S).optional(),entitlements:o.array(o.object({value:o.string(),display:o.string().optional(),type:o.string().optional(),primary:o.boolean().optional()})).optional(),roles:o.array(T).optional(),x509Certificates:o.array(o.object({value:o.string(),display:o.string().optional(),type:o.string().optional(),primary:o.boolean().optional()})).optional(),"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User":h.optional(),[z]:o.object({ecid:g(),accountClass:o.string().optional()}).optional(),schemas:o.array(o.string()).optional()})},scimGroup:()=>{let e=o.object({value:o.string(),$ref:o.string().optional(),display:o.string().optional(),type:o.enum(["User","Group","Workload","Customer"]).optional()});return o.object({id:o.string().optional(),externalId:o.string().optional(),meta:o.object({resourceType:o.string().optional(),created:o.string().optional(),lastModified:o.string().optional(),location:o.string().optional(),version:o.string().optional()}).optional(),displayName:o.string(),members:o.array(e).optional(),"urn:ionite:params:scim:schemas:extension:authz:2.0:Group":o.object({type:o.enum(["group","role","permission"]).optional(),requestable:o.boolean().optional(),description:o.string().optional(),resources:o.array(o.string()).optional()}).optional(),schemas:o.array(o.string()).optional()})},jwtAssertionClaims:()=>o.object({iss:o.string(),sub:o.string(),aud:o.union([o.string(),o.array(o.string())]).optional(),exp:o.number(),iat:o.number(),jti:o.string().optional(),scope:o.string().optional()}).passthrough(),workloadTokenResponse:()=>o.object({access_token:o.string(),token_type:o.string(),expires_in:o.number().optional(),scope:o.string().optional(),refresh_token:o.string().optional(),expires:o.string().optional()}),baseUser:()=>Z,customer:()=>R,createTenantRequest:(e)=>e?u.extend(e):u,updateTenantRequest:(e)=>e?m.extend(e):m,tenantResponse:()=>o.union([o.object({tenantUrl:o.url().optional(),status:o.enum(["pending","processing","completed","failed"]),error:o.string().optional()}),o.object({status:o.literal("action_required"),actionUrl:o.url(),requestToken:o.string(),expiresAt:o.string()})]),registerIAMAppPayload:()=>o.object({id:o.string().min(1),companyId:o.string().min(1),companyName:o.string().min(1),environmentType:o.enum(["POC","DEV","QA","PROD"]),tenantUrl:o.url().optional(),displayName:o.string().optional(),productId:o.string().optional(),applicationId:o.string().optional(),scimBaseUrl:o.url().optional(),workload:o.record(o.string(),o.unknown()).optional()}),registerSSOAppPayload:()=>o.object({redirectUris:o.array(o.string().refine(l,{message:`redirectUri ${c}`})).min(1),backchannelLogoutUri:o.string().refine(l,{message:`backchannelLogoutUri ${c}`}).optional(),displayName:o.string().optional(),defaultScope:o.string().optional(),issuerTenant:o.string().optional(),applicationId:o.string().optional()})};function j(){return{sso:{callbackParams:n(t.oidcCallbackParams()),idTokenClaims:n(t.idTokenClaims()),tokenResponse:n(t.tokenResponse())},iam:{user:n(t.scimUser()),group:n(t.scimGroup())},workload:{jwtAssertionClaims:n(t.jwtAssertionClaims()),tokenResponse:n(t.workloadTokenResponse())},tenant:{createTenantRequest:n(t.createTenantRequest()),updateTenantRequest:n(t.updateTenantRequest()),tenantResponse:n(t.tenantResponse())},ciam:{customer:n(t.customer()),callbackParams:n(t.oidcCallbackParams()),idTokenClaims:n(t.idTokenClaims()),tokenResponse:n(t.tokenResponse())}}}function A(){return{iam:{registerIAMAppPayload:n(t.registerIAMAppPayload())},sso:{registerSSOAppPayload:n(t.registerSSOAppPayload())}}}export{R as BaseCustomer,O as BaseTenant,u as BaseTenantCreateRequestSchema,m as BaseTenantUpdateRequestSchema,Z as BaseUser,p as ConfigLocatorSchema,A as createControlValidators,j as createValidators,l as isSafeRedirectUri,t as zodValidators};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ionite/zod",
-  "version": "0.0.24-beta.20260907.3",
+  "version": "0.0.24-beta.20260915.2",
   "description": "Zod validators for ionite (SSO, IAM, workload, tenant, CIAM)",
   "type": "module",
   "engines": {
@@ -9,7 +9,7 @@
   "author": "ionite",
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
-    "@ionite/core": "0.0.24-beta.20260907.3",
+    "@ionite/core": "0.0.24-beta.20260915.2",
     "@standard-schema/spec": "^1.1.0",
     "zod": "^4.4.3"
   },