@zitadel/api 0.1.0-alpha.16 → 0.1.0-alpha.18

package/src/generated/model/completeClaim200.ts

@@ -0,0 +1,19 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * The result of a completed project claim.
+ */
+export type CompleteClaim200 = {
+  /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string;
+  /** @pattern ^[a-zA-Z0-9_-]+$ */
+  team_id: string;
+  /** The time when the project was claimed. */
+  claimed_at: string;
+};

package/src/generated/model/{revokeSession404.ts → completeClaim400.ts}

@@ -5,16 +5,16 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-import type { RevokeSession404Details } from "./revokeSession404Details";
+import type { CompleteClaim400Details } from "./completeClaim400Details";
 
 /**
  * Standard error payload returned for failed API requests.
  */
-export type RevokeSession404 = {
+export type CompleteClaim400 = {
   /** Stable machine-readable error code. */
   code: string;
   /** Human-readable explanation of the error. */
   message: string;
   /** Additional error-specific context. */
-  details?: RevokeSession404Details;
+  details?: CompleteClaim400Details;
 };

package/src/generated/model/{getMyUserDefaultDetails.ts → completeClaim400Details.ts}

@@ -9,4 +9,4 @@
 /**
  * Additional error-specific context.
  */
-export type GetMyUserDefaultDetails = { [key: string]: unknown };
+export type CompleteClaim400Details = { [key: string]: unknown };

package/src/generated/model/completeClaim401.ts

@@ -0,0 +1,24 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * The request lacks valid authentication credentials.
+
+Error code: auth.unauthorized
+
+ */
+export type CompleteClaim401 = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: { [key: string]: unknown };
+} & {
+  code: "auth.unauthorized";
+};

package/src/generated/model/{revokeSession409.ts → completeClaim404.ts}

@@ -5,16 +5,16 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-import type { RevokeSession409Details } from "./revokeSession409Details";
+import type { CompleteClaim404Details } from "./completeClaim404Details";
 
 /**
  * Standard error payload returned for failed API requests.
  */
-export type RevokeSession409 = {
+export type CompleteClaim404 = {
   /** Stable machine-readable error code. */
   code: string;
   /** Human-readable explanation of the error. */
   message: string;
   /** Additional error-specific context. */
-  details?: RevokeSession409Details;
+  details?: CompleteClaim404Details;
 };

package/src/generated/model/{listUsersDefaultDetails.ts → completeClaim404Details.ts}

@@ -9,4 +9,4 @@
 /**
  * Additional error-specific context.
  */
-export type ListUsersDefaultDetails = { [key: string]: unknown };
+export type CompleteClaim404Details = { [key: string]: unknown };

package/src/generated/model/completeClaim409.ts

@@ -0,0 +1,26 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { CompleteClaim409Details } from "./completeClaim409Details";
+
+/**
+ * The project is already claimed by a team. The `details` carry the owning
+team and the dashboard where it can be managed.
+
+ */
+export type CompleteClaim409 = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: { [key: string]: unknown };
+} & {
+  code: "proj.already_claimed";
+} & {
+  details: CompleteClaim409Details;
+};

package/src/generated/model/completeClaim409Details.ts

@@ -0,0 +1,14 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+export type CompleteClaim409Details = {
+  /** @pattern ^[a-zA-Z0-9_-]+$ */
+  team_id: string;
+  /** The dashboard URL for the team that owns the project. */
+  dashboard_url: string;
+};

package/src/generated/model/completeClaim410.ts

@@ -0,0 +1,24 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * The claim challenge has expired
+
+Error code: proj.claim_expired
+
+ */
+export type CompleteClaim410 = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: { [key: string]: unknown };
+} & {
+  code: "proj.claim_expired";
+};

package/src/generated/model/{authorizeGet400.ts → completeClaim429.ts}

@@ -5,16 +5,16 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-import type { AuthorizeGet400Details } from "./authorizeGet400Details";
+import type { CompleteClaim429Details } from "./completeClaim429Details";
 
 /**
  * Standard error payload returned for failed API requests.
  */
-export type AuthorizeGet400 = {
+export type CompleteClaim429 = {
   /** Stable machine-readable error code. */
   code: string;
   /** Human-readable explanation of the error. */
   message: string;
   /** Additional error-specific context. */
-  details?: AuthorizeGet400Details;
+  details?: CompleteClaim429Details;
 };

package/src/generated/model/{revokeSession404Details.ts → completeClaim429Details.ts}

@@ -9,4 +9,4 @@
 /**
  * Additional error-specific context.
  */
-export type RevokeSession404Details = { [key: string]: unknown };
+export type CompleteClaim429Details = { [key: string]: unknown };

package/src/generated/model/completeClaimBody.ts

@@ -0,0 +1,18 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * The request to complete a project claim.
+ */
+export type CompleteClaimBody = {
+  /**
+   * Unique identifier for this challenge (dialect-minted prefixed opaque string).
+   * @pattern ^ch_[a-zA-Z0-9_-]+$
+   */
+  challenge_id: string;
+};

package/src/generated/model/completeClaimDefault.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { CompleteClaimDefaultDetails } from "./completeClaimDefaultDetails";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type CompleteClaimDefault = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: CompleteClaimDefaultDetails;
+};

package/src/generated/model/{createProjectDefaultDetails.ts → completeClaimDefaultDetails.ts}

@@ -9,4 +9,4 @@
 /**
  * Additional error-specific context.
  */
-export type CreateProjectDefaultDetails = { [key: string]: unknown };
+export type CompleteClaimDefaultDetails = { [key: string]: unknown };

package/src/generated/model/createAuthAttempt201.ts

@@ -23,8 +23,8 @@ Clients drive the attempt by:
  */
 export type CreateAuthAttempt201 = {
   /**
-   * Unique identifier for this authentication attempt
-   * @pattern ^[a-zA-Z0-9_-]+$
+   * Unique identifier for this authentication attempt (dialect-minted prefixed opaque string).
+   * @pattern ^att_[a-zA-Z0-9_-]+$
    */
   attempt_id: string;
   /** @pattern ^[a-zA-Z0-9_-]+$ */

package/src/generated/model/createAuthAttempt201ChallengesItem.ts

@@ -18,8 +18,8 @@ The client verifies the proof by POST /auth_attempts/{attempt_id}/challenges/{ch
  */
 export type CreateAuthAttempt201ChallengesItem = {
   /**
-   * Unique identifier for this challenge
-   * @pattern ^[a-zA-Z0-9_-]+$
+   * Unique identifier for this challenge (dialect-minted prefixed opaque string).
+   * @pattern ^ch_[a-zA-Z0-9_-]+$
    */
   challenge_id: string;
   /** An authentication factor method. */

package/src/generated/model/createAuthAttemptDefault.ts

@@ -17,6 +17,16 @@ export type CreateAuthAttemptDefault =
     } & {
       code: "att.invalid_request";
     })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "auth.unauthorized";
+    })
   | ({
       /** Stable machine-readable error code. */
       code: string;
@@ -26,4 +36,14 @@ export type CreateAuthAttemptDefault =
       details?: { [key: string]: unknown };
     } & {
       code: "internal";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "req.invalid";
     });

package/src/generated/model/createBranding201.ts

@@ -0,0 +1,31 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { CreateBranding201Branding } from "./createBranding201Branding";
+
+/**
+ * A stored branding revision. `branding` echoes the canonical stored
+configuration so clients (e.g. the CLI sync engine) can reconcile local
+files with the server's stored state.
+
+ */
+export type CreateBranding201 = {
+  /** The unique identifier of this branding revision. */
+  id: string;
+  /** When this revision was published. */
+  created_at: string;
+  /** Branding configuration. Appears in two places with one shape:
+
+  - On flow responses as a read-only projection: the server resolves the
+    latest branding revision for the project per step response (falling
+    back to built-in defaults when none is stored). Branding is configured
+    via the Branding API / `zitadel apply`, not the Flow API.
+  - As the request body of `POST /branding`, which publishes the same
+    shape as a new immutable revision (see ADR 040).
+   */
+  branding: CreateBranding201Branding;
+};

package/src/generated/model/createBranding201Branding.ts

@@ -0,0 +1,49 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { CreateBranding201BrandingLayout } from "./createBranding201BrandingLayout";
+
+/**
+ * Branding configuration. Appears in two places with one shape:
+
+- On flow responses as a read-only projection: the server resolves the
+  latest branding revision for the project per step response (falling
+  back to built-in defaults when none is stored). Branding is configured
+  via the Branding API / `zitadel apply`, not the Flow API.
+- As the request body of `POST /branding`, which publishes the same
+  shape as a new immutable revision (see ADR 040).
+
+ */
+export type CreateBranding201Branding = {
+  /** Layout preset selector. The default.liquid master template uses this
+  to branch into layout variants. Customers who eject the template
+  can ignore this field entirely; it also serves as the degrade target
+  when a custom template fails component-side validation.
+   */
+  layout?: CreateBranding201BrandingLayout;
+  /**
+     * The LiquidJS template string for rendering this step. The orchestrator
+  parses this template, injects the capability dictionaries as context,
+  and renders the output HTML into its Shadow DOM.
+
+     * @maxLength 131072
+     */
+  liquid_template?: string;
+  /** Team logo URL. */
+  logo_url?: string;
+  /** Custom font stylesheet URL (e.g., Google Fonts CSS). Read-only in
+  v1: `POST /branding` rejects a non-empty value, because the login
+  component loads this stylesheet at document level (shadow-scoped
+  `@font-face` rules never register faces) and an arbitrary URL would
+  grant `branding.write` page-wide CSS control over the embedding
+  application. Safe tenant font delivery is an ADR 040 follow-up;
+  until then, load fonts from the embedding page.
+   */
+  font_url?: string;
+  /** Hero/background image URL (used by split layout). */
+  hero_url?: string;
+};

package/src/generated/model/createBranding201BrandingLayout.ts

@@ -0,0 +1,22 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Layout preset selector. The default.liquid master template uses this
+to branch into layout variants. Customers who eject the template
+can ignore this field entirely; it also serves as the degrade target
+when a custom template fails component-side validation.
+
+ */
+export type CreateBranding201BrandingLayout =
+  (typeof CreateBranding201BrandingLayout)[keyof typeof CreateBranding201BrandingLayout];
+
+export const CreateBranding201BrandingLayout = {
+  centered: "centered",
+  split: "split",
+} as const;

package/src/generated/model/createBranding400.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { CreateBranding400Details } from "./createBranding400Details";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type CreateBranding400 = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: CreateBranding400Details;
+};

package/src/generated/model/{createUserDefaultDetails.ts → createBranding400Details.ts}

@@ -9,4 +9,4 @@
 /**
  * Additional error-specific context.
  */
-export type CreateUserDefaultDetails = { [key: string]: unknown };
+export type CreateBranding400Details = { [key: string]: unknown };

package/src/generated/model/createBrandingBody.ts

@@ -0,0 +1,49 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { CreateBrandingBodyLayout } from "./createBrandingBodyLayout";
+
+/**
+ * Branding configuration. Appears in two places with one shape:
+
+- On flow responses as a read-only projection: the server resolves the
+  latest branding revision for the project per step response (falling
+  back to built-in defaults when none is stored). Branding is configured
+  via the Branding API / `zitadel apply`, not the Flow API.
+- As the request body of `POST /branding`, which publishes the same
+  shape as a new immutable revision (see ADR 040).
+
+ */
+export type CreateBrandingBody = {
+  /** Layout preset selector. The default.liquid master template uses this
+  to branch into layout variants. Customers who eject the template
+  can ignore this field entirely; it also serves as the degrade target
+  when a custom template fails component-side validation.
+   */
+  layout?: CreateBrandingBodyLayout;
+  /**
+     * The LiquidJS template string for rendering this step. The orchestrator
+  parses this template, injects the capability dictionaries as context,
+  and renders the output HTML into its Shadow DOM.
+
+     * @maxLength 131072
+     */
+  liquid_template?: string;
+  /** Team logo URL. */
+  logo_url?: string;
+  /** Custom font stylesheet URL (e.g., Google Fonts CSS). Read-only in
+  v1: `POST /branding` rejects a non-empty value, because the login
+  component loads this stylesheet at document level (shadow-scoped
+  `@font-face` rules never register faces) and an arbitrary URL would
+  grant `branding.write` page-wide CSS control over the embedding
+  application. Safe tenant font delivery is an ADR 040 follow-up;
+  until then, load fonts from the embedding page.
+   */
+  font_url?: string;
+  /** Hero/background image URL (used by split layout). */
+  hero_url?: string;
+};

package/src/generated/model/createBrandingBodyLayout.ts

@@ -0,0 +1,22 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Layout preset selector. The default.liquid master template uses this
+to branch into layout variants. Customers who eject the template
+can ignore this field entirely; it also serves as the degrade target
+when a custom template fails component-side validation.
+
+ */
+export type CreateBrandingBodyLayout =
+  (typeof CreateBrandingBodyLayout)[keyof typeof CreateBrandingBodyLayout];
+
+export const CreateBrandingBodyLayout = {
+  centered: "centered",
+  split: "split",
+} as const;

package/src/generated/model/createBrandingDefault.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { CreateBrandingDefaultDetails } from "./createBrandingDefaultDetails";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type CreateBrandingDefault = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: CreateBrandingDefaultDetails;
+};

package/src/generated/model/{submitFlowStepDefaultDetails.ts → createBrandingDefaultDetails.ts}

@@ -9,4 +9,4 @@
 /**
  * Additional error-specific context.
  */
-export type SubmitFlowStepDefaultDetails = { [key: string]: unknown };
+export type CreateBrandingDefaultDetails = { [key: string]: unknown };

package/src/generated/model/{activateFlowDefinitionParams.ts → createBrandingParams.ts}

@@ -6,7 +6,7 @@
  * OpenAPI spec version: 0.0.1
  */
 
-export type ActivateFlowDefinitionParams = {
+export type CreateBrandingParams = {
   /**
    * The unique identifier of the project
    * @pattern ^[a-zA-Z0-9_-]+$

package/src/generated/model/createFlow201.ts

@@ -24,9 +24,14 @@ export type CreateFlow201 = {
   and builds name-keyed indexes locally for lookup.
    */
   step: CreateFlow201Step;
-  /** Resolved branding configuration. Inherited from the app → team → project
-  hierarchy at flow creation time (most specific wins). Read-only projection —
-  branding is configured via the Team/App Branding API, not the Flow API.
+  /** Branding configuration. Appears in two places with one shape:
+
+  - On flow responses as a read-only projection: the server resolves the
+    latest branding revision for the project per step response (falling
+    back to built-in defaults when none is stored). Branding is configured
+    via the Branding API / `zitadel apply`, not the Flow API.
+  - As the request body of `POST /branding`, which publishes the same
+    shape as a new immutable revision (see ADR 040).
    */
   branding?: CreateFlow201Branding;
   /** Present when `step.complete` is `redirect`. */

package/src/generated/model/createFlow201Branding.ts

@@ -8,25 +8,41 @@
 import type { CreateFlow201BrandingLayout } from "./createFlow201BrandingLayout";
 
 /**
- * Resolved branding configuration. Inherited from the app → team → project
-hierarchy at flow creation time (most specific wins). Read-only projection —
-branding is configured via the Team/App Branding API, not the Flow API.
+ * Branding configuration. Appears in two places with one shape:
+
+- On flow responses as a read-only projection: the server resolves the
+  latest branding revision for the project per step response (falling
+  back to built-in defaults when none is stored). Branding is configured
+  via the Branding API / `zitadel apply`, not the Flow API.
+- As the request body of `POST /branding`, which publishes the same
+  shape as a new immutable revision (see ADR 040).
 
  */
 export type CreateFlow201Branding = {
   /** Layout preset selector. The default.liquid master template uses this
   to branch into layout variants. Customers who eject the template
-  can ignore this field entirely.
+  can ignore this field entirely; it also serves as the degrade target
+  when a custom template fails component-side validation.
    */
   layout?: CreateFlow201BrandingLayout;
-  /** The LiquidJS template string for rendering this step. The orchestrator
+  /**
+     * The LiquidJS template string for rendering this step. The orchestrator
   parses this template, injects the capability dictionaries as context,
   and renders the output HTML into its Shadow DOM.
-   */
+
+     * @maxLength 131072
+     */
   liquid_template?: string;
   /** Team logo URL. */
   logo_url?: string;
-  /** Custom font URL (e.g., Google Fonts CSS). */
+  /** Custom font stylesheet URL (e.g., Google Fonts CSS). Read-only in
+  v1: `POST /branding` rejects a non-empty value, because the login
+  component loads this stylesheet at document level (shadow-scoped
+  `@font-face` rules never register faces) and an arbitrary URL would
+  grant `branding.write` page-wide CSS control over the embedding
+  application. Safe tenant font delivery is an ADR 040 follow-up;
+  until then, load fonts from the embedding page.
+   */
   font_url?: string;
   /** Hero/background image URL (used by split layout). */
   hero_url?: string;

package/src/generated/model/createFlow201BrandingLayout.ts

@@ -9,7 +9,8 @@
 /**
  * Layout preset selector. The default.liquid master template uses this
 to branch into layout variants. Customers who eject the template
-can ignore this field entirely.
+can ignore this field entirely; it also serves as the degrade target
+when a custom template fails component-side validation.
 
  */
 export type CreateFlow201BrandingLayout =

package/src/generated/model/createFlow201Step.ts

@@ -32,9 +32,11 @@ export type CreateFlow201Step = {
   (e.g. `error.email_required`; the `format` rule is spelled
   `error.<field>_invalid`), multiple violations joined with `"; "`.
   Field names appear verbatim, so clients localise unknown keys via
-  the generic `error.field_<rule>` catalog entries. Other failures
-  carry a verbatim diagnostic token instead (e.g. `user_not_found`,
-  `auth_attempt.password_invalid`).
+  the generic `error.field_<rule>` catalog entries. Other engine
+  failures carry `error.*` catalog keys as well (e.g.
+  `error.invalid_credentials`, `error.passkey_invalid`); a
+  non-`error.` payload is an outcome token (e.g. `user_not_found`)
+  that clients keep verbatim.
    */
   error?: string | null;
   /** Present only on terminal steps. Tells the frontend what to do: