@zitadel/api 0.1.0-alpha.17 → 0.1.0-alpha.19

package/src/generated/model/updateFlowDefinitionBodyFlowDefinitionStepsItemTransitions.ts

@@ -31,5 +31,16 @@ export type UpdateFlowDefinitionBodyFlowDefinitionStepsItemTransitions = {
     Example: login → recovery → back to login.
    */
     action?: "switch" | "pivot" | null;
+    /** Local re-purposing. When set, taking this transition changes the
+  flow's current purpose to this value — the dispatch mode a step's
+  challenges run under — while the flow's original purpose stays
+  pinned. Must be a purpose this definition serves, and `target`
+  must be that purpose's entry step. Mutually exclusive with
+  `action`: a transition either re-purposes within this flow or
+  targets another flow, never both.
+  Example: a "Sign up" navigation on the login identifier step
+  (`{ target: register, purpose: register }`).
+   */
+    purpose?: "login" | "register" | "recovery" | "profiling" | "reauth" | "link_account" | null;
   };
 };

package/src/generated/model/updateFlowDefinitionDefault.ts

@@ -5,16 +5,125 @@
  * This is the next generation of the Zitadel identity platform.
  * OpenAPI spec version: 0.0.1
  */
-import type { UpdateFlowDefinitionDefaultDetails } from "./updateFlowDefinitionDefaultDetails";
 
-/**
- * Standard error payload returned for failed API requests.
- */
-export type UpdateFlowDefinitionDefault = {
-  /** Stable machine-readable error code. */
-  code: string;
-  /** Human-readable explanation of the error. */
-  message: string;
-  /** Additional error-specific context. */
-  details?: UpdateFlowDefinitionDefaultDetails;
-};
+export type UpdateFlowDefinitionDefault =
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "auth.unauthorized";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "evt.invalid";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "flowdef.invalid";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "flowdef.not_found";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "flowdef.permission_denied";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "flowdef.update_conflict";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "internal";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "sch.not_found";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "flowdef.missing_id";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "flowdef.missing_project_id";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "req.invalid";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "flowdef.schema_fetch_failed";
+    });

package/src/generated/model/updateTeam200.ts

@@ -0,0 +1,28 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { UpdateTeam200Status } from "./updateTeam200Status";
+
+/**
+ * Details of a team.
+ */
+export type UpdateTeam200 = {
+  /** The unique identifier of the team. */
+  id: string;
+  /** The name of the team. */
+  name: string;
+  /** The lifecycle state of a team.
+
+  active: The team is available for use.
+  deactivated: The team is no longer active but is retained for historical and audit purposes.
+   */
+  status: UpdateTeam200Status;
+  /** The time when the team was created. */
+  created_at: string;
+  /** The time when the team was last updated. */
+  updated_at: string;
+};

package/src/generated/model/updateTeam200Status.ts

@@ -0,0 +1,21 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * The lifecycle state of a team.
+
+active: The team is available for use.
+deactivated: The team is no longer active but is retained for historical and audit purposes.
+
+ */
+export type UpdateTeam200Status = (typeof UpdateTeam200Status)[keyof typeof UpdateTeam200Status];
+
+export const UpdateTeam200Status = {
+  active: "active",
+  deactivated: "deactivated",
+} as const;

package/src/generated/model/updateTeam400.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { UpdateTeam400Details } from "./updateTeam400Details";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type UpdateTeam400 = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: UpdateTeam400Details;
+};

package/src/generated/model/updateTeam400Details.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type UpdateTeam400Details = { [key: string]: unknown };

package/src/generated/model/updateTeam401.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { UpdateTeam401Details } from "./updateTeam401Details";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type UpdateTeam401 = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: UpdateTeam401Details;
+};

package/src/generated/model/updateTeam401Details.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type UpdateTeam401Details = { [key: string]: unknown };

package/src/generated/model/updateTeam403.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { UpdateTeam403Details } from "./updateTeam403Details";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type UpdateTeam403 = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: UpdateTeam403Details;
+};

package/src/generated/model/updateTeam403Details.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type UpdateTeam403Details = { [key: string]: unknown };

package/src/generated/model/updateTeam404.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { UpdateTeam404Details } from "./updateTeam404Details";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type UpdateTeam404 = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: UpdateTeam404Details;
+};

package/src/generated/model/updateTeam404Details.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type UpdateTeam404Details = { [key: string]: unknown };

package/src/generated/model/updateTeam409.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { UpdateTeam409Details } from "./updateTeam409Details";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type UpdateTeam409 = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: UpdateTeam409Details;
+};

package/src/generated/model/updateTeam409Details.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type UpdateTeam409Details = { [key: string]: unknown };

package/src/generated/model/{deleteFlowDefinitionParams.ts → updateTeamBody.ts}

@@ -6,10 +6,11 @@
  * OpenAPI spec version: 0.0.1
  */
 
-export type DeleteFlowDefinitionParams = {
+export type UpdateTeamBody = {
   /**
-   * The project id to filter by.
-   * @pattern ^[a-zA-Z0-9_-]+$
+   * The name of the team. Must be unique within the project.
+   * @minLength 1
+   * @maxLength 200
    */
-  project_id: string;
+  name?: string;
 };

package/src/generated/model/updateTeamDefault.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { UpdateTeamDefaultDetails } from "./updateTeamDefaultDetails";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type UpdateTeamDefault = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: UpdateTeamDefaultDetails;
+};

package/src/generated/model/updateTeamDefaultDetails.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type UpdateTeamDefaultDetails = { [key: string]: unknown };

package/src/generated/model/verifyChallengeProof200.ts

@@ -23,8 +23,8 @@ Clients drive the attempt by:
  */
 export type VerifyChallengeProof200 = {
   /**
-   * Unique identifier for this authentication attempt
-   * @pattern ^[a-zA-Z0-9_-]+$
+   * Unique identifier for this authentication attempt (dialect-minted prefixed opaque string).
+   * @pattern ^att_[a-zA-Z0-9_-]+$
    */
   attempt_id: string;
   /** @pattern ^[a-zA-Z0-9_-]+$ */

package/src/generated/model/verifyChallengeProof200ChallengesItem.ts

@@ -18,8 +18,8 @@ The client verifies the proof by POST /auth_attempts/{attempt_id}/challenges/{ch
  */
 export type VerifyChallengeProof200ChallengesItem = {
   /**
-   * Unique identifier for this challenge
-   * @pattern ^[a-zA-Z0-9_-]+$
+   * Unique identifier for this challenge (dialect-minted prefixed opaque string).
+   * @pattern ^ch_[a-zA-Z0-9_-]+$
    */
   challenge_id: string;
   /** An authentication factor method. */

package/src/generated/model/verifyChallengeProofDefault.ts

@@ -15,7 +15,7 @@ export type VerifyChallengeProofDefault =
       /** Additional error-specific context. */
       details?: { [key: string]: unknown };
     } & {
-      code: "att.not_found";
+      code: "att.already_handed_off";
     })
   | ({
       /** Stable machine-readable error code. */
@@ -25,7 +25,7 @@ export type VerifyChallengeProofDefault =
       /** Additional error-specific context. */
       details?: { [key: string]: unknown };
     } & {
-      code: "att.stale_challenge";
+      code: "att.invalid_proof";
     })
   | ({
       /** Stable machine-readable error code. */
@@ -37,6 +37,26 @@ export type VerifyChallengeProofDefault =
     } & {
       code: "att.invalid_request";
     })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "att.invalid_state";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "att.not_found";
+    })
   | ({
       /** Stable machine-readable error code. */
       code: string;
@@ -55,7 +75,7 @@ export type VerifyChallengeProofDefault =
       /** Additional error-specific context. */
       details?: { [key: string]: unknown };
     } & {
-      code: "att.invalid_state";
+      code: "att.stale_challenge";
     })
   | ({
       /** Stable machine-readable error code. */
@@ -65,7 +85,17 @@ export type VerifyChallengeProofDefault =
       /** Additional error-specific context. */
       details?: { [key: string]: unknown };
     } & {
-      code: "att.already_completed";
+      code: "auth.unauthorized";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "evt.invalid";
     })
   | ({
       /** Stable machine-readable error code. */
@@ -76,4 +106,14 @@ export type VerifyChallengeProofDefault =
       details?: { [key: string]: unknown };
     } & {
       code: "internal";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "req.invalid";
     });

package/src/runtime/api-factory.ts

@@ -49,11 +49,14 @@ export type ZitadelClientOptions = {
  * generated orval function:
  *
  *     const client = createZitadelClient({ baseUrl, token });
- *     await client.createProject({ previewOrigins: [] });
+ *     await client.createProject({ preview_origins: [] });
  *     await client.createSchema(body, { project_id });
  */
 export function createZitadelClient(opts: ZitadelClientOptions): ZitadelClient {
-  const baseUrl = opts.baseUrl.replace(/\/+$/, "");
+  let baseUrl = opts.baseUrl;
+  while (baseUrl.endsWith("/")) {
+    baseUrl = baseUrl.slice(0, -1);
+  }
   return new Proxy(endpoints as ZitadelClient, {
     get(target, prop, receiver) {
       const value = Reflect.get(target, prop, receiver);

package/src/runtime/config.spec.ts

@@ -104,7 +104,7 @@ describe("getApi", () => {
 
     expect(api).toBeDefined();
     expect(typeof api.createFlow).toBe("function");
-    expect(typeof api.endSession).toBe("function");
+    expect(typeof api.revokeMySession).toBe("function");
     expect(typeof api.getMySession).toBe("function");
   });
 
@@ -114,4 +114,34 @@ describe("getApi", () => {
     const api2 = getApi(project);
     expect(api1).toBe(api2);
   });
+
+  test("a publishable key on the handle rides as the bearer (ADR 036)", async () => {
+    const fetchSpy = vi
+      .spyOn(globalThis, "fetch")
+      .mockResolvedValue(new Response("{}", { status: 200 }));
+
+    const project = configureZitadel({
+      proxyPath: "http://localhost/__nextgen",
+      projectId: "proj_1",
+      publishableKey: "pk_test_123",
+    });
+    expect(project.publishableKey).toBe("pk_test_123");
+
+    await getApi(project).getHealth();
+
+    const headers = new Headers((fetchSpy.mock.calls[0]![1] as RequestInit).headers);
+    expect(headers.get("authorization")).toBe("Bearer pk_test_123");
+  });
+
+  test("a handle without a publishable key produces token-less requests", async () => {
+    const fetchSpy = vi
+      .spyOn(globalThis, "fetch")
+      .mockResolvedValue(new Response("{}", { status: 200 }));
+
+    const project = configureZitadel({ proxyPath: "http://localhost/__nextgen", projectId: "proj_1" });
+    await getApi(project).getHealth();
+
+    const headers = new Headers((fetchSpy.mock.calls[0]![1] as RequestInit).headers);
+    expect(headers.get("authorization")).toBeNull();
+  });
 });

package/src/runtime/config.ts

@@ -1,5 +1,5 @@
 import { setProxyPath } from "./base-url";
-import { createApi, type ZitadelApi } from "./api-factory";
+import { createZitadelClient, type ZitadelApi } from "./api-factory";
 
 /**
  * Input options for {@link configureZitadel}.
@@ -17,6 +17,17 @@ export interface ZitadelConfig {
    * Optional — not needed in client-only setups.
    */
   url?: string;
+
+  /**
+   * The project's **publishable key** (ADR 036): an origin-scoped,
+   * browser-safe bearer sent on public-plane calls (flow operations and the
+   * body-delivered handoff exchange). Safe to ship in client bundles and
+   * committed config by construction — never put a project secret
+   * (`sk_proj_…`) here. Optional — omitted, requests carry no bearer and
+   * secret-requiring operations must be authenticated by a server-side
+   * proxy instead.
+   */
+  publishableKey?: string;
 }
 
 /**
@@ -32,6 +43,9 @@ export interface ZitadelProject {
 
   /** Full URL of the Zitadel auth backend. */
   readonly url?: string;
+
+  /** The project's publishable key (ADR 036), sent as the bearer when set. */
+  readonly publishableKey?: string;
 }
 
 export type { ZitadelApi };
@@ -86,7 +100,8 @@ export function configureZitadel(config: ZitadelConfig): ZitadelProject {
     if (
       existing.proxyPath === resolvedProxyPath &&
       existing.projectId === config.projectId &&
-      existing.url === config.url
+      existing.url === config.url &&
+      existing.publishableKey === config.publishableKey
     ) {
       setProxyPath(resolvedProxyPath);
       return existing;
@@ -103,6 +118,7 @@ export function configureZitadel(config: ZitadelConfig): ZitadelProject {
     proxyPath: resolvedProxyPath,
     projectId: config.projectId,
     url: config.url,
+    publishableKey: config.publishableKey,
   });
   writeSlot(project);
   setProxyPath(resolvedProxyPath);
@@ -121,7 +137,10 @@ export function configureZitadel(config: ZitadelConfig): ZitadelProject {
 export function getApi(project: ZitadelProject): ZitadelApi {
   let api = apiCache.get(project);
   if (!api) {
-    api = createApi(project.proxyPath);
+    // The publishable key (when the handle carries one) rides as the bearer
+    // on every call from this client — the ADR 036 public-plane credential.
+    // Handles without a key produce a token-less client, exactly as before.
+    api = createZitadelClient({ baseUrl: project.proxyPath, token: project.publishableKey });
     apiCache.set(project, api);
   }
   return api;