@loams/client 0.1.0 → 0.1.2

package/dist/runtime/subscribe.js

@@ -0,0 +1,128 @@
+// `streams.subscribe` (runtime contract R14, SDKP §2.5 and SDKP-2).
+//
+//   const sub = loams.streams.subscribe({ stream: 'events', partition: 0, fromOffset: 1n });
+//   for await (const record of sub) {
+//     handle(record);
+//     if (done) break;            // cancels the loop
+//   }
+//   resumeLater(sub.offset);       // the next offset to read
+//
+// A client loop over unary `Fetch` rather than a server stream, so it works on
+// every transport (Connect-unary included) and through every proxy:
+//
+// - The next offset is the last record's offset + 1.
+// - An empty fetch backs off 100 ms, doubling, up to 1 s, and the backoff
+//   resets when a record arrives. When the caller passes `maxWaitMs`, the
+//   server long-polls instead and the backoff only applies when it answers
+//   empty at its deadline.
+// - `offset` is always the next offset to read, so a caller can stop and
+//   resume without losing or repeating a record.
+// - Breaking out of `for await`, calling `return()`, or aborting `signal`
+//   stops the loop; no further fetch is sent.
+//
+// A fetch that fails is retried by the call path as any `safe` call is; a
+// failure that outlasts the retries ends the iteration with that error, and
+// `offset` still says where to resume.
+import { sleep } from './retry.js';
+/** The first and the largest pause after an empty fetch. */
+export const SUBSCRIBE_MIN_BACKOFF_MS = 100;
+export const SUBSCRIBE_MAX_BACKOFF_MS = 1_000;
+function asBigInt(value) {
+    if (value === undefined) {
+        return 0n;
+    }
+    return typeof value === 'bigint' ? value : BigInt(value);
+}
+/** Starts a subscription over `fetch`. Nothing is sent until the first
+ * `next()`. */
+export function subscribe(fetch, request, options = {}) {
+    let offset = asBigInt(request.fromOffset);
+    let buffer = [];
+    let backoff = SUBSCRIBE_MIN_BACKOFF_MS;
+    let done = false;
+    const controller = new AbortController();
+    const onAbort = () => {
+        done = true;
+        controller.abort(options.signal?.reason);
+    };
+    if (options.signal?.aborted === true) {
+        onAbort();
+    }
+    else {
+        options.signal?.addEventListener('abort', onAbort, { once: true });
+    }
+    const finish = () => {
+        done = true;
+        options.signal?.removeEventListener('abort', onAbort);
+        if (!controller.signal.aborted) {
+            controller.abort();
+        }
+        return { done: true, value: undefined };
+    };
+    const fetchRequest = () => {
+        const out = {
+            stream: request.stream,
+            partition: request.partition ?? 0,
+            offset,
+        };
+        for (const key of ['namespace', 'maxRecords', 'maxBytes', 'maxWaitMs']) {
+            if (request[key] !== undefined) {
+                out[key] = request[key];
+            }
+        }
+        return out;
+    };
+    const subscription = {
+        get offset() {
+            return offset;
+        },
+        cancel() {
+            finish();
+        },
+        async next() {
+            while (!done) {
+                const record = buffer.shift();
+                if (record !== undefined) {
+                    offset = asBigInt(record.offset) + 1n;
+                    return { done: false, value: record };
+                }
+                let answer;
+                try {
+                    answer = await fetch(fetchRequest(), { signal: controller.signal });
+                }
+                catch (error) {
+                    if (done) {
+                        return finish();
+                    }
+                    finish();
+                    throw error;
+                }
+                if (done) {
+                    return finish();
+                }
+                // A record below the next offset is one already yielded (a server that
+                // answers from a segment start); skipping it keeps resume exact.
+                buffer = (answer?.records ?? []).filter((r) => asBigInt(r.offset) >= offset);
+                if (buffer.length > 0) {
+                    backoff = SUBSCRIBE_MIN_BACKOFF_MS;
+                    continue;
+                }
+                try {
+                    await sleep(backoff, controller.signal);
+                }
+                catch {
+                    return finish();
+                }
+                backoff = Math.min(backoff * 2, SUBSCRIBE_MAX_BACKOFF_MS);
+            }
+            return finish();
+        },
+        return() {
+            return Promise.resolve(finish());
+        },
+        [Symbol.asyncIterator]() {
+            return this;
+        },
+    };
+    return subscription;
+}

package/dist/runtime/token-source.d.ts

@@ -32,7 +32,7 @@ export declare function envToken(environment?: Record<string, string | undefined
  * rather than one per request.
  */
 export declare function refreshing(fetchToken: () => Promise<string>): TokenSource;
-/** The RFC 8693 token exchange a person signed in through Authentik needs
+/** The RFC 8693 token exchange a person signed in at the IdP needs
  * (design §44 §7.4, D608; §19 §5.2).
  *
  * The instance's `/oauth/token` protocol endpoint takes the identity token and

package/dist/runtime/token-source.js

@@ -64,7 +64,7 @@ export function refreshing(fetchToken) {
     };
     return source;
 }
-/** The RFC 8693 token exchange a person signed in through Authentik needs
+/** The RFC 8693 token exchange a person signed in at the IdP needs
  * (design §44 §7.4, D608; §19 §5.2).
  *
  * The instance's `/oauth/token` protocol endpoint takes the identity token and

package/dist/runtime/transports.d.ts

@@ -33,11 +33,32 @@ export interface TransportOptions {
      * it; this only tells the transport what the request will look like.
      */
     interceptors?: Parameters<typeof createConnectTransport>[0]['interceptors'];
+    /**
+     * The `fetch` the transport calls, for a runtime whose `fetch` needs
+     * wrapping (a proxy, a test double, instrumentation). When set it is used
+     * as given. When unset, the global `fetch` is used, wrapped to send
+     * `redirect: "manual"` in Cloudflare Workers (see `workersFetch`).
+     */
+    fetch?: typeof globalThis.fetch;
 }
+/** True in Cloudflare Workers (workerd), which identifies itself this way. */
+export declare function isWorkerd(): boolean;
+/**
+ * Wraps `fetch` to send `redirect: "manual"`.
+ *
+ * connect-web sets `redirect: "error"` on every request, which Workers rejects
+ * ("Invalid redirect value, must be one of 'follow' or 'manual'"). Loams calls
+ * never redirect, so `manual` loses nothing there; it is applied only in
+ * workerd because in a browser `manual` turns a redirect into an opaque
+ * response that hides the failure `error` reports.
+ */
+export declare function workersFetch(inner: typeof globalThis.fetch): typeof globalThis.fetch;
+/** The `fetch` a transport built from `options` uses, or undefined for connect-web's default. */
+export declare function transportFetch(options: TransportOptions): typeof globalThis.fetch | undefined;
 /**
  * The default transport: Connect over `fetch`.
  *
- * Works in a browser, in Node 18+ (which has `fetch`), in Deno and in Bun, and
+ * Works in a browser, in Node 18+ (which has `fetch`) and in Bun, and
  * speaks both the Connect unary protocol and gRPC-Web, which is what the server
  * serves on the same port (D600). This is the browser path as a first-class
  * case, not a fallback: it is the default in every runtime.

package/dist/runtime/transports.js

@@ -7,7 +7,7 @@
 //   over `fetch`, which is what `@connectrpc/connect-web` implements. Because
 //   the API serves gRPC-Web on the same port as everything else, the same
 //   client code runs in a browser with no proxy and no sidecar.
-// - **Node, Deno and Bun** can do HTTP/2 gRPC. `@connectrpc/connect-node`
+// - **Node and Bun** can do HTTP/2 gRPC. `@connectrpc/connect-node`
 //   implements it over `node:http2`, and the server's plaintext listener means
 //   no ALPN to negotiate — the client asks for HTTP/2 with prior knowledge.
 //
@@ -17,22 +17,48 @@
 // HTTP/2 transport in a browser bundle would be a build error, which is the
 // right failure.
 import { createConnectTransport } from '@connectrpc/connect-web';
+/** True in Cloudflare Workers (workerd), which identifies itself this way. */
+export function isWorkerd() {
+    return typeof navigator !== 'undefined' && navigator.userAgent === 'Cloudflare-Workers';
+}
+/**
+ * Wraps `fetch` to send `redirect: "manual"`.
+ *
+ * connect-web sets `redirect: "error"` on every request, which Workers rejects
+ * ("Invalid redirect value, must be one of 'follow' or 'manual'"). Loams calls
+ * never redirect, so `manual` loses nothing there; it is applied only in
+ * workerd because in a browser `manual` turns a redirect into an opaque
+ * response that hides the failure `error` reports.
+ */
+export function workersFetch(inner) {
+    return (input, init) => inner(input, init === undefined ? init : { ...init, redirect: 'manual' });
+}
+/** The `fetch` a transport built from `options` uses, or undefined for connect-web's default. */
+export function transportFetch(options) {
+    if (options.fetch !== undefined) {
+        return options.fetch;
+    }
+    // Resolve the global lazily so a later polyfill or test stub is honoured.
+    return isWorkerd() ? workersFetch((input, init) => globalThis.fetch(input, init)) : undefined;
+}
 /**
  * The default transport: Connect over `fetch`.
  *
- * Works in a browser, in Node 18+ (which has `fetch`), in Deno and in Bun, and
+ * Works in a browser, in Node 18+ (which has `fetch`) and in Bun, and
  * speaks both the Connect unary protocol and gRPC-Web, which is what the server
  * serves on the same port (D600). This is the browser path as a first-class
  * case, not a fallback: it is the default in every runtime.
  */
 export function createLoamsTransport(options = {}) {
     const interceptors = transportInterceptors(options);
+    const fetchImpl = transportFetch(options);
     return createConnectTransport({
         baseUrl: options.baseUrl ?? '',
         useBinaryFormat: options.useBinaryFormat ?? true,
         ...(options.defaultTimeoutMs === undefined
             ? {}
             : { defaultTimeoutMs: options.defaultTimeoutMs }),
+        ...(fetchImpl === undefined ? {} : { fetch: fetchImpl }),
         ...(interceptors.length === 0 ? {} : { interceptors }),
     });
 }

package/dist/vendor/proto/collection-v1.d.ts

@@ -0,0 +1,3 @@
+export * from './gen/loams/collection/v1/collection_pb.js';
+export * from './gen/loams/collection/v1/document_pb.js';
+export * from './gen/loams/collection/v1/query_pb.js';

package/dist/vendor/proto/collection-v1.js

@@ -0,0 +1,7 @@
+// `loams.collection.v1` as one module: the package spans three proto files
+// (`collection`, `document`, `query`), and the SDK facade imports a package's
+// types from one specifier (`@loams/proto/collection-v1`), as `./admin.ts`
+// does for `loams.admin.v1`. Each file stays importable on its own path too.
+export * from './gen/loams/collection/v1/collection_pb.js';
+export * from './gen/loams/collection/v1/document_pb.js';
+export * from './gen/loams/collection/v1/query_pb.js';

package/dist/vendor/proto/gen/loams/auth/v1/auth_pb.d.ts

@@ -110,7 +110,8 @@ export declare const ListProvidersResponseSchema: GenMessage<ListProvidersRespon
  */
 export type CompleteSetupRequest = Message<"loams.auth.v1.CompleteSetupRequest"> & {
     /**
-     * The token `loams` printed at first start; not needed from loopback.
+     * This engine's LOAMS_SETUP_TOKEN. Required when authentication is on;
+     * ignored with LOAMS_AUTH_MODE=off.
      *
      * @generated from field: string setup_token = 1;
      */
@@ -333,7 +334,11 @@ export declare enum OidcProviderKind {
     /**
      * @generated from enum value: OIDC_PROVIDER_KIND_GENERIC = 7;
      */
-    GENERIC = 7
+    GENERIC = 7,
+    /**
+     * @generated from enum value: OIDC_PROVIDER_KIND_ZITADEL = 8;
+     */
+    ZITADEL = 8
 }
 /**
  * Describes the enum loams.auth.v1.OidcProviderKind.

package/dist/vendor/proto/gen/loams/auth/v1/auth_pb.js

@@ -9,7 +9,7 @@ import { file_loams_options_v1_options } from "../../options/v1/options_pb.js";
 /**
  * Describes the file loams/auth/v1/auth.proto.
  */
-export const file_loams_auth_v1_auth = /*@__PURE__*/ fileDesc("Chhsb2Ftcy9hdXRoL3YxL2F1dGgucHJvdG8SDWxvYW1zLmF1dGgudjEiVwoMT2lkY1Byb3ZpZGVyEgoKAmlkGAEgASgJEgwKBG5hbWUYAiABKAkSLQoEa2luZBgDIAEoDjIfLmxvYW1zLmF1dGgudjEuT2lkY1Byb3ZpZGVyS2luZCK6AQoHU2Vzc2lvbhIiCgR1c2VyGAEgASgLMhQubG9hbXMuYWRtaW4udjEuVXNlchIgCgNvcmcYAiABKAsyEy5sb2Ftcy5hZG1pbi52MS5PcmcSJQoEcm9sZRgDIAEoDjIXLmxvYW1zLmFkbWluLnYxLk9yZ1JvbGUSEgoKY3NyZl90b2tlbhgEIAEoCRIuCgpleHBpcmVzX2F0GAUgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCIWChRMaXN0UHJvdmlkZXJzUmVxdWVzdCJ0ChVMaXN0UHJvdmlkZXJzUmVzcG9uc2USEAoIcGFzc3dvcmQYASABKAgSDAoEdG90cBgCIAEoCBIQCghwYXNza2V5cxgDIAEoCBIpCgRvaWRjGAQgAygLMhsubG9hbXMuYXV0aC52MS5PaWRjUHJvdmlkZXIibAoUQ29tcGxldGVTZXR1cFJlcXVlc3QSEwoLc2V0dXBfdG9rZW4YASABKAkSEAoIb3JnX25hbWUYAiABKAkSDAoEbmFtZRgDIAEoCRINCgVlbWFpbBgEIAEoCRIQCghwYXNzd29yZBgFIAEoCSJAChVDb21wbGV0ZVNldHVwUmVzcG9uc2USJwoHc2Vzc2lvbhgBIAEoCzIWLmxvYW1zLmF1dGgudjEuU2Vzc2lvbiITChFHZXRTZXNzaW9uUmVxdWVzdCI9ChJHZXRTZXNzaW9uUmVzcG9uc2USJwoHc2Vzc2lvbhgBIAEoCzIWLmxvYW1zLmF1dGgudjEuU2Vzc2lvbiJKChRDcmVhdGVTZXNzaW9uUmVxdWVzdBINCgVlbWFpbBgBIAEoCRIQCghwYXNzd29yZBgCIAEoCRIRCgl0b3RwX2NvZGUYAyABKAkiQAoVQ3JlYXRlU2Vzc2lvblJlc3BvbnNlEicKB3Nlc3Npb24YASABKAsyFi5sb2Ftcy5hdXRoLnYxLlNlc3Npb24iFgoURGVsZXRlU2Vzc2lvblJlcXVlc3QiFwoVRGVsZXRlU2Vzc2lvblJlc3BvbnNlItgBChREZWNpZGVDb25zZW50UmVxdWVzdBIwCghkZWNpc2lvbhgBIAEoDjIeLmxvYW1zLmF1dGgudjEuQ29uc2VudERlY2lzaW9uEhEKCWNsaWVudF9pZBgCIAEoCRIUCgxyZWRpcmVjdF91cmkYAyABKAkSDQoFc2NvcGUYBCABKAkSEAoIYXVkaWVuY2UYBSABKAkSDQoFc3RhdGUYBiABKAkSFgoOY29kZV9jaGFsbGVuZ2UYByABKAkSHQoVY29kZV9jaGFsbGVuZ2VfbWV0aG9kGAggASgJIiwKFURlY2lkZUNvbnNlbnRSZXNwb25zZRITCgtyZWRpcmVjdF90bxgBIAEoCSqPAgoQT2lkY1Byb3ZpZGVyS2luZBIiCh5PSURDX1BST1ZJREVSX0tJTkRfVU5TUEVDSUZJRUQQABIfChtPSURDX1BST1ZJREVSX0tJTkRfS0VZQ0xPQUsQARIbChdPSURDX1BST1ZJREVSX0tJTkRfT0tUQRACEhwKGE9JRENfUFJPVklERVJfS0lORF9FTlRSQRADEh0KGU9JRENfUFJPVklERVJfS0lORF9HT09HTEUQBBIgChxPSURDX1BST1ZJREVSX0tJTkRfQVVUSEVOVElLEAUSGgoWT0lEQ19QUk9WSURFUl9LSU5EX0RFWBAGEh4KGk9JRENfUFJPVklERVJfS0lORF9HRU5FUklDEAcqagoPQ29uc2VudERlY2lzaW9uEiAKHENPTlNFTlRfREVDSVNJT05fVU5TUEVDSUZJRUQQABIaChZDT05TRU5UX0RFQ0lTSU9OX0FMTE9XEAESGQoVQ09OU0VOVF9ERUNJU0lPTl9ERU5ZEAIy/QUKC0F1dGhTZXJ2aWNlEnIKDUxpc3RQcm92aWRlcnMSIy5sb2Ftcy5hdXRoLnYxLkxpc3RQcm92aWRlcnNSZXF1ZXN0GiQubG9hbXMuYXV0aC52MS5MaXN0UHJvdmlkZXJzUmVzcG9uc2UiFpACAZK1GA8SDWxpc3RQcm92aWRlcnMSbwoNQ29tcGxldGVTZXR1cBIjLmxvYW1zLmF1dGgudjEuQ29tcGxldGVTZXR1cFJlcXVlc3QaJC5sb2Ftcy5hdXRoLnYxLkNvbXBsZXRlU2V0dXBSZXNwb25zZSITkrUYDxINY29tcGxldGVTZXR1cBJmCgpHZXRTZXNzaW9uEiAubG9hbXMuYXV0aC52MS5HZXRTZXNzaW9uUmVxdWVzdBohLmxvYW1zLmF1dGgudjEuR2V0U2Vzc2lvblJlc3BvbnNlIhOQAgGStRgMEgpnZXRTZXNzaW9uEm8KDUNyZWF0ZVNlc3Npb24SIy5sb2Ftcy5hdXRoLnYxLkNyZWF0ZVNlc3Npb25SZXF1ZXN0GiQubG9hbXMuYXV0aC52MS5DcmVhdGVTZXNzaW9uUmVzcG9uc2UiE5K1GA8SDWNyZWF0ZVNlc3Npb24ScgoNRGVsZXRlU2Vzc2lvbhIjLmxvYW1zLmF1dGgudjEuRGVsZXRlU2Vzc2lvblJlcXVlc3QaJC5sb2Ftcy5hdXRoLnYxLkRlbGV0ZVNlc3Npb25SZXNwb25zZSIWkAICkrUYDxINZGVsZXRlU2Vzc2lvbhJvCg1EZWNpZGVDb25zZW50EiMubG9hbXMuYXV0aC52MS5EZWNpZGVDb25zZW50UmVxdWVzdBokLmxvYW1zLmF1dGgudjEuRGVjaWRlQ29uc2VudFJlc3BvbnNlIhOStRgPEg1kZWNpZGVDb25zZW50GkuKtRhHCgRhdXRoEj9TaWduLWluIHByb3ZpZGVycywgZmlyc3QtcnVuIHNldHVwLCBzZXNzaW9ucyBhbmQgT0F1dGggY29uc2VudC5iBnByb3RvMw", [file_google_protobuf_timestamp, file_loams_admin_v1_common, file_loams_admin_v1_org, file_loams_options_v1_options]);
+export const file_loams_auth_v1_auth = /*@__PURE__*/ fileDesc("Chhsb2Ftcy9hdXRoL3YxL2F1dGgucHJvdG8SDWxvYW1zLmF1dGgudjEiVwoMT2lkY1Byb3ZpZGVyEgoKAmlkGAEgASgJEgwKBG5hbWUYAiABKAkSLQoEa2luZBgDIAEoDjIfLmxvYW1zLmF1dGgudjEuT2lkY1Byb3ZpZGVyS2luZCK6AQoHU2Vzc2lvbhIiCgR1c2VyGAEgASgLMhQubG9hbXMuYWRtaW4udjEuVXNlchIgCgNvcmcYAiABKAsyEy5sb2Ftcy5hZG1pbi52MS5PcmcSJQoEcm9sZRgDIAEoDjIXLmxvYW1zLmFkbWluLnYxLk9yZ1JvbGUSEgoKY3NyZl90b2tlbhgEIAEoCRIuCgpleHBpcmVzX2F0GAUgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcCIWChRMaXN0UHJvdmlkZXJzUmVxdWVzdCJ0ChVMaXN0UHJvdmlkZXJzUmVzcG9uc2USEAoIcGFzc3dvcmQYASABKAgSDAoEdG90cBgCIAEoCBIQCghwYXNza2V5cxgDIAEoCBIpCgRvaWRjGAQgAygLMhsubG9hbXMuYXV0aC52MS5PaWRjUHJvdmlkZXIibAoUQ29tcGxldGVTZXR1cFJlcXVlc3QSEwoLc2V0dXBfdG9rZW4YASABKAkSEAoIb3JnX25hbWUYAiABKAkSDAoEbmFtZRgDIAEoCRINCgVlbWFpbBgEIAEoCRIQCghwYXNzd29yZBgFIAEoCSJAChVDb21wbGV0ZVNldHVwUmVzcG9uc2USJwoHc2Vzc2lvbhgBIAEoCzIWLmxvYW1zLmF1dGgudjEuU2Vzc2lvbiITChFHZXRTZXNzaW9uUmVxdWVzdCI9ChJHZXRTZXNzaW9uUmVzcG9uc2USJwoHc2Vzc2lvbhgBIAEoCzIWLmxvYW1zLmF1dGgudjEuU2Vzc2lvbiJKChRDcmVhdGVTZXNzaW9uUmVxdWVzdBINCgVlbWFpbBgBIAEoCRIQCghwYXNzd29yZBgCIAEoCRIRCgl0b3RwX2NvZGUYAyABKAkiQAoVQ3JlYXRlU2Vzc2lvblJlc3BvbnNlEicKB3Nlc3Npb24YASABKAsyFi5sb2Ftcy5hdXRoLnYxLlNlc3Npb24iFgoURGVsZXRlU2Vzc2lvblJlcXVlc3QiFwoVRGVsZXRlU2Vzc2lvblJlc3BvbnNlItgBChREZWNpZGVDb25zZW50UmVxdWVzdBIwCghkZWNpc2lvbhgBIAEoDjIeLmxvYW1zLmF1dGgudjEuQ29uc2VudERlY2lzaW9uEhEKCWNsaWVudF9pZBgCIAEoCRIUCgxyZWRpcmVjdF91cmkYAyABKAkSDQoFc2NvcGUYBCABKAkSEAoIYXVkaWVuY2UYBSABKAkSDQoFc3RhdGUYBiABKAkSFgoOY29kZV9jaGFsbGVuZ2UYByABKAkSHQoVY29kZV9jaGFsbGVuZ2VfbWV0aG9kGAggASgJIiwKFURlY2lkZUNvbnNlbnRSZXNwb25zZRITCgtyZWRpcmVjdF90bxgBIAEoCSqvAgoQT2lkY1Byb3ZpZGVyS2luZBIiCh5PSURDX1BST1ZJREVSX0tJTkRfVU5TUEVDSUZJRUQQABIfChtPSURDX1BST1ZJREVSX0tJTkRfS0VZQ0xPQUsQARIbChdPSURDX1BST1ZJREVSX0tJTkRfT0tUQRACEhwKGE9JRENfUFJPVklERVJfS0lORF9FTlRSQRADEh0KGU9JRENfUFJPVklERVJfS0lORF9HT09HTEUQBBIgChxPSURDX1BST1ZJREVSX0tJTkRfQVVUSEVOVElLEAUSGgoWT0lEQ19QUk9WSURFUl9LSU5EX0RFWBAGEh4KGk9JRENfUFJPVklERVJfS0lORF9HRU5FUklDEAcSHgoaT0lEQ19QUk9WSURFUl9LSU5EX1pJVEFERUwQCCpqCg9Db25zZW50RGVjaXNpb24SIAocQ09OU0VOVF9ERUNJU0lPTl9VTlNQRUNJRklFRBAAEhoKFkNPTlNFTlRfREVDSVNJT05fQUxMT1cQARIZChVDT05TRU5UX0RFQ0lTSU9OX0RFTlkQAjL9BQoLQXV0aFNlcnZpY2UScgoNTGlzdFByb3ZpZGVycxIjLmxvYW1zLmF1dGgudjEuTGlzdFByb3ZpZGVyc1JlcXVlc3QaJC5sb2Ftcy5hdXRoLnYxLkxpc3RQcm92aWRlcnNSZXNwb25zZSIWkAIBkrUYDxINbGlzdFByb3ZpZGVycxJvCg1Db21wbGV0ZVNldHVwEiMubG9hbXMuYXV0aC52MS5Db21wbGV0ZVNldHVwUmVxdWVzdBokLmxvYW1zLmF1dGgudjEuQ29tcGxldGVTZXR1cFJlc3BvbnNlIhOStRgPEg1jb21wbGV0ZVNldHVwEmYKCkdldFNlc3Npb24SIC5sb2Ftcy5hdXRoLnYxLkdldFNlc3Npb25SZXF1ZXN0GiEubG9hbXMuYXV0aC52MS5HZXRTZXNzaW9uUmVzcG9uc2UiE5ACAZK1GAwSCmdldFNlc3Npb24SbwoNQ3JlYXRlU2Vzc2lvbhIjLmxvYW1zLmF1dGgudjEuQ3JlYXRlU2Vzc2lvblJlcXVlc3QaJC5sb2Ftcy5hdXRoLnYxLkNyZWF0ZVNlc3Npb25SZXNwb25zZSITkrUYDxINY3JlYXRlU2Vzc2lvbhJyCg1EZWxldGVTZXNzaW9uEiMubG9hbXMuYXV0aC52MS5EZWxldGVTZXNzaW9uUmVxdWVzdBokLmxvYW1zLmF1dGgudjEuRGVsZXRlU2Vzc2lvblJlc3BvbnNlIhaQAgKStRgPEg1kZWxldGVTZXNzaW9uEm8KDURlY2lkZUNvbnNlbnQSIy5sb2Ftcy5hdXRoLnYxLkRlY2lkZUNvbnNlbnRSZXF1ZXN0GiQubG9hbXMuYXV0aC52MS5EZWNpZGVDb25zZW50UmVzcG9uc2UiE5K1GA8SDWRlY2lkZUNvbnNlbnQaS4q1GEcKBGF1dGgSP1NpZ24taW4gcHJvdmlkZXJzLCBmaXJzdC1ydW4gc2V0dXAsIHNlc3Npb25zIGFuZCBPQXV0aCBjb25zZW50LmIGcHJvdG8z", [file_google_protobuf_timestamp, file_loams_admin_v1_common, file_loams_admin_v1_org, file_loams_options_v1_options]);
 /**
  * Describes the message loams.auth.v1.OidcProvider.
  * Use `create(OidcProviderSchema)` to create a new message.
@@ -119,6 +119,10 @@ export var OidcProviderKind;
      * @generated from enum value: OIDC_PROVIDER_KIND_GENERIC = 7;
      */
     OidcProviderKind[OidcProviderKind["GENERIC"] = 7] = "GENERIC";
+    /**
+     * @generated from enum value: OIDC_PROVIDER_KIND_ZITADEL = 8;
+     */
+    OidcProviderKind[OidcProviderKind["ZITADEL"] = 8] = "ZITADEL";
 })(OidcProviderKind || (OidcProviderKind = {}));
 /**
  * Describes the enum loams.auth.v1.OidcProviderKind.