@zitadel/api 0.1.0-alpha.17 → 0.1.0-alpha.19

package/src/generated/model/revokeSession403.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { RevokeSession403Details } from "./revokeSession403Details";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type RevokeSession403 = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: RevokeSession403Details;
+};

package/src/generated/model/revokeSession403Details.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type RevokeSession403Details = { [key: string]: unknown };

package/src/generated/model/revokeSessionDefault.ts

@@ -5,16 +5,65 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-import type { RevokeSessionDefaultDetails } from "./revokeSessionDefaultDetails";
 
-/**
- * Standard error payload returned for failed API requests.
- */
-export type RevokeSessionDefault = {
-  /** Stable machine-readable error code. */
-  code: string;
-  /** Human-readable explanation of the error. */
-  message: string;
-  /** Additional error-specific context. */
-  details?: RevokeSessionDefaultDetails;
-};
+export type RevokeSessionDefault =
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "auth.unauthorized";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "evt.invalid";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "internal";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "req.invalid";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "sess.not_found";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "sess.permission_denied";
+    });

package/src/generated/model/setUserPasswordBody.ts

@@ -15,5 +15,5 @@ export type SetUserPasswordBody = {
   /** Whether the user is required to change their password on the next login.
   If not provided, it will default to false.
    */
-  isChangeRequired?: boolean;
+  is_change_required?: boolean;
 };

package/src/generated/model/setUserPasswordDefault.ts

@@ -5,16 +5,75 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-import type { SetUserPasswordDefaultDetails } from "./setUserPasswordDefaultDetails";
 
-/**
- * Standard error payload returned for failed API requests.
- */
-export type SetUserPasswordDefault = {
-  /** Stable machine-readable error code. */
-  code: string;
-  /** Human-readable explanation of the error. */
-  message: string;
-  /** Additional error-specific context. */
-  details?: SetUserPasswordDefaultDetails;
-};
+export type SetUserPasswordDefault =
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "auth.unauthorized";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "evt.invalid";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "internal";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "req.invalid";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "user.invalid";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "user.not_found";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "user.permission_denied";
+    });

package/src/generated/model/submitFlowStep200.ts

@@ -24,9 +24,14 @@ export type SubmitFlowStep200 = {
   and builds name-keyed indexes locally for lookup.
    */
   step: SubmitFlowStep200Step;
-  /** Resolved branding configuration. Inherited from the app → team → project
-  hierarchy at flow creation time (most specific wins). Read-only projection —
-  branding is configured via the Team/App Branding API, not the Flow API.
+  /** Branding configuration. Appears in two places with one shape:
+
+  - On flow responses as a read-only projection: the server resolves the
+    latest branding revision for the project per step response (falling
+    back to built-in defaults when none is stored). Branding is configured
+    via the Branding API / `zitadel apply`, not the Flow API.
+  - As the request body of `POST /branding`, which publishes the same
+    shape as a new immutable revision (see ADR 040).
    */
   branding?: SubmitFlowStep200Branding;
   /** Present when `step.complete` is `redirect`. */

package/src/generated/model/submitFlowStep200Branding.ts

@@ -8,25 +8,41 @@
 import type { SubmitFlowStep200BrandingLayout } from "./submitFlowStep200BrandingLayout";
 
 /**
- * Resolved branding configuration. Inherited from the app → team → project
-hierarchy at flow creation time (most specific wins). Read-only projection —
-branding is configured via the Team/App Branding API, not the Flow API.
+ * Branding configuration. Appears in two places with one shape:
+
+- On flow responses as a read-only projection: the server resolves the
+  latest branding revision for the project per step response (falling
+  back to built-in defaults when none is stored). Branding is configured
+  via the Branding API / `zitadel apply`, not the Flow API.
+- As the request body of `POST /branding`, which publishes the same
+  shape as a new immutable revision (see ADR 040).
 
  */
 export type SubmitFlowStep200Branding = {
   /** Layout preset selector. The default.liquid master template uses this
   to branch into layout variants. Customers who eject the template
-  can ignore this field entirely.
+  can ignore this field entirely; it also serves as the degrade target
+  when a custom template fails component-side validation.
    */
   layout?: SubmitFlowStep200BrandingLayout;
-  /** The LiquidJS template string for rendering this step. The orchestrator
+  /**
+     * The LiquidJS template string for rendering this step. The orchestrator
   parses this template, injects the capability dictionaries as context,
   and renders the output HTML into its Shadow DOM.
-   */
+
+     * @maxLength 131072
+     */
   liquid_template?: string;
   /** Team logo URL. */
   logo_url?: string;
-  /** Custom font URL (e.g., Google Fonts CSS). */
+  /** Custom font stylesheet URL (e.g., Google Fonts CSS). Read-only in
+  v1: `POST /branding` rejects a non-empty value, because the login
+  component loads this stylesheet at document level (shadow-scoped
+  `@font-face` rules never register faces) and an arbitrary URL would
+  grant `branding.write` page-wide CSS control over the embedding
+  application. Safe tenant font delivery is an ADR 040 follow-up;
+  until then, load fonts from the embedding page.
+   */
   font_url?: string;
   /** Hero/background image URL (used by split layout). */
   hero_url?: string;

package/src/generated/model/submitFlowStep200BrandingLayout.ts

@@ -9,7 +9,8 @@
 /**
  * Layout preset selector. The default.liquid master template uses this
 to branch into layout variants. Customers who eject the template
-can ignore this field entirely.
+can ignore this field entirely; it also serves as the degrade target
+when a custom template fails component-side validation.
 
  */
 export type SubmitFlowStep200BrandingLayout =

package/src/generated/model/submitFlowStep400.ts

@@ -24,9 +24,14 @@ export type SubmitFlowStep400 = {
   and builds name-keyed indexes locally for lookup.
    */
   step: SubmitFlowStep400Step;
-  /** Resolved branding configuration. Inherited from the app → team → project
-  hierarchy at flow creation time (most specific wins). Read-only projection —
-  branding is configured via the Team/App Branding API, not the Flow API.
+  /** Branding configuration. Appears in two places with one shape:
+
+  - On flow responses as a read-only projection: the server resolves the
+    latest branding revision for the project per step response (falling
+    back to built-in defaults when none is stored). Branding is configured
+    via the Branding API / `zitadel apply`, not the Flow API.
+  - As the request body of `POST /branding`, which publishes the same
+    shape as a new immutable revision (see ADR 040).
    */
   branding?: SubmitFlowStep400Branding;
   /** Present when `step.complete` is `redirect`. */

package/src/generated/model/submitFlowStep400Branding.ts

@@ -8,25 +8,41 @@
 import type { SubmitFlowStep400BrandingLayout } from "./submitFlowStep400BrandingLayout";
 
 /**
- * Resolved branding configuration. Inherited from the app → team → project
-hierarchy at flow creation time (most specific wins). Read-only projection —
-branding is configured via the Team/App Branding API, not the Flow API.
+ * Branding configuration. Appears in two places with one shape:
+
+- On flow responses as a read-only projection: the server resolves the
+  latest branding revision for the project per step response (falling
+  back to built-in defaults when none is stored). Branding is configured
+  via the Branding API / `zitadel apply`, not the Flow API.
+- As the request body of `POST /branding`, which publishes the same
+  shape as a new immutable revision (see ADR 040).
 
  */
 export type SubmitFlowStep400Branding = {
   /** Layout preset selector. The default.liquid master template uses this
   to branch into layout variants. Customers who eject the template
-  can ignore this field entirely.
+  can ignore this field entirely; it also serves as the degrade target
+  when a custom template fails component-side validation.
    */
   layout?: SubmitFlowStep400BrandingLayout;
-  /** The LiquidJS template string for rendering this step. The orchestrator
+  /**
+     * The LiquidJS template string for rendering this step. The orchestrator
   parses this template, injects the capability dictionaries as context,
   and renders the output HTML into its Shadow DOM.
-   */
+
+     * @maxLength 131072
+     */
   liquid_template?: string;
   /** Team logo URL. */
   logo_url?: string;
-  /** Custom font URL (e.g., Google Fonts CSS). */
+  /** Custom font stylesheet URL (e.g., Google Fonts CSS). Read-only in
+  v1: `POST /branding` rejects a non-empty value, because the login
+  component loads this stylesheet at document level (shadow-scoped
+  `@font-face` rules never register faces) and an arbitrary URL would
+  grant `branding.write` page-wide CSS control over the embedding
+  application. Safe tenant font delivery is an ADR 040 follow-up;
+  until then, load fonts from the embedding page.
+   */
   font_url?: string;
   /** Hero/background image URL (used by split layout). */
   hero_url?: string;

package/src/generated/model/submitFlowStep400BrandingLayout.ts

@@ -9,7 +9,8 @@
 /**
  * Layout preset selector. The default.liquid master template uses this
 to branch into layout variants. Customers who eject the template
-can ignore this field entirely.
+can ignore this field entirely; it also serves as the degrade target
+when a custom template fails component-side validation.
 
  */
 export type SubmitFlowStep400BrandingLayout =

package/src/generated/model/submitFlowStepDefault.ts

@@ -5,16 +5,275 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-import type { SubmitFlowStepDefaultDetails } from "./submitFlowStepDefaultDetails";
 
-/**
- * Standard error payload returned for failed API requests.
- */
-export type SubmitFlowStepDefault = {
-  /** Stable machine-readable error code. */
-  code: string;
-  /** Human-readable explanation of the error. */
-  message: string;
-  /** Additional error-specific context. */
-  details?: SubmitFlowStepDefaultDetails;
-};
+export type SubmitFlowStepDefault =
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "att.already_handed_off";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "att.invalid_request";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "att.invalid_state";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "att.not_completed";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "att.not_found";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "att.proof_rejected";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "att.stale_challenge";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "enc_key.decrypt_failed";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "enc_key.encrypt_failed";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "enc_key.not_found";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "evt.invalid";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "flow.cookie_expired";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "flow.cookie_invalid";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "flow.integrity";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "flow.invalid_action";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "flow.not_found";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "flow.unsupported";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "internal";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "tkn.invalid";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "not_implemented";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "pkreg.not_found";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "req.invalid";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "enc_key.unknown_alg";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "unavailable";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "user.already_exists";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "user.invalid";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "user.not_found";
+    });

package/src/generated/model/updateFlowDefinition200FlowDefinitionStepsItemTransitions.ts

@@ -31,5 +31,16 @@ export type UpdateFlowDefinition200FlowDefinitionStepsItemTransitions = {
     Example: login → recovery → back to login.
    */
     action?: "switch" | "pivot" | null;
+    /** Local re-purposing. When set, taking this transition changes the
+  flow's current purpose to this value — the dispatch mode a step's
+  challenges run under — while the flow's original purpose stays
+  pinned. Must be a purpose this definition serves, and `target`
+  must be that purpose's entry step. Mutually exclusive with
+  `action`: a transition either re-purposes within this flow or
+  targets another flow, never both.
+  Example: a "Sign up" navigation on the login identifier step
+  (`{ target: register, purpose: register }`).
+   */
+    purpose?: "login" | "register" | "recovery" | "profiling" | "reauth" | "link_account" | null;
   };
 };