@zitadel/api 0.1.0-alpha.9 → 1.0.0-alpha.21

package/src/generated/model/createRelease200PointersItem.ts

@@ -0,0 +1,58 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { CreateRelease200PointersItemKind } from "./createRelease200PointersItemKind";
+
+/**
+ * One entry of the set a release pins: the revision of a single resource that
+this release includes.
+
+ */
+export type CreateRelease200PointersItem = {
+  /** The kind of resource a release pointer pins.
+
+  Carried explicitly rather than inferred from `revision_id`, because a
+  revision id is not always shaped distinctly enough to identify its kind: a
+  schema's is its `$id`, which may be any URL.
+
+  `flow_definition` rather than `flow`: a release pins the definitions served
+  at `/flow_definitions`, not the runtime flows at `/flow`.
+   */
+  kind: CreateRelease200PointersItemKind;
+  /**
+     * Which resource this pointer pins, independent of which revision of it.
+  `revision_id` chooses the revision; `handle` says what the revision is a
+  revision *of*. Determined when the release is assembled, not supplied by
+  the caller:
+
+  - `schema` — the document's `objectType`, so `human-user` and
+    `machine-user` are separate resources a release pins separately
+  - `flow_definition` — the definition's `name`, likewise for
+    `default-login` and `b2b-login`
+  - `branding` — always `default`. A project has one branding, so there is
+    nothing to distinguish; it is revisioned like everything else, and
+    `revision_id` is what varies between releases.
+
+  Resources inside a release reference each other by handle rather than by
+  revision id, so the same handle names the same resource in every release.
+
+     * @minLength 1
+     * @maxLength 256
+     */
+  handle: string;
+  /**
+     * The revision of that resource this release pins.
+
+  Deliberately not constrained to a prefixed id: for `kind: schema` this is
+  the schema's `$id`, which is a URL whenever the document supplied one and
+  only a generated `sch_*` value otherwise.
+
+     * @minLength 1
+     * @maxLength 512
+     */
+  revision_id: string;
+};

package/src/generated/model/createRelease200PointersItemKind.ts

@@ -0,0 +1,27 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * The kind of resource a release pointer pins.
+
+Carried explicitly rather than inferred from `revision_id`, because a
+revision id is not always shaped distinctly enough to identify its kind: a
+schema's is its `$id`, which may be any URL.
+
+`flow_definition` rather than `flow`: a release pins the definitions served
+at `/flow_definitions`, not the runtime flows at `/flow`.
+
+ */
+export type CreateRelease200PointersItemKind =
+  (typeof CreateRelease200PointersItemKind)[keyof typeof CreateRelease200PointersItemKind];
+
+export const CreateRelease200PointersItemKind = {
+  schema: "schema",
+  flow_definition: "flow_definition",
+  branding: "branding",
+} as const;

package/src/generated/model/createRelease201.ts

@@ -0,0 +1,43 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { CreateRelease201Metadata } from "./createRelease201Metadata";
+import type { CreateRelease201PointersItem } from "./createRelease201PointersItem";
+
+/**
+ * An immutable, project-scoped snapshot that pins one revision of every
+resource it includes.
+
+A release owns pointers and metadata, not content — it records *which*
+revisions belong together. Callers that need the resource bytes resolve each
+`revision_id` through the per-kind read endpoints (`GET /schemas/{id}`,
+`GET /flow_definitions/{id}`, …).
+
+A release exists on its own and is not tied to an environment. Deploying it
+is a separate call.
+
+ */
+export type CreateRelease201 = {
+  /**
+   * The opaque, immutable identifier of a release.
+   * @pattern ^rel_[a-zA-Z0-9_-]+$
+   */
+  id: string;
+  /** @pattern ^[a-zA-Z0-9_-]+$ */
+  project_id: string;
+  /** Who assembled the release, when, and from what source. Set when the release
+  is assembled and never mutated afterwards.
+   */
+  metadata: CreateRelease201Metadata;
+  /**
+     * The revisions this release pins, one entry per `(kind, handle)`. Never
+  empty: a release must contain at least one resource.
+
+     * @minItems 1
+     */
+  readonly pointers: readonly CreateRelease201PointersItem[];
+};

package/src/generated/model/createRelease201Metadata.ts

@@ -0,0 +1,39 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Who assembled the release, when, and from what source. Set when the release
+is assembled and never mutated afterwards.
+
+ */
+export type CreateRelease201Metadata = {
+  /** A short caller-supplied summary of what the release changes, analogous to
+  a git commit message.
+   */
+  message?: string | null;
+  /** The source commit the caller was operating from. Recording it on both
+  releases is what lets two releases be diffed at field level in the
+  source repository they were built from.
+   */
+  git_sha?: string | null;
+  /** True when the working tree had uncommitted changes at construction time.
+  `git_sha` still points at HEAD, but the release content does not
+  correspond to that commit exactly, so consumers of the git-diff mechanism
+  should skip it when either side is dirty.
+   */
+  git_dirty: boolean;
+  /** When the release was assembled. */
+  created_at: string;
+  /** The identity that assembled the release. Absent when the caller is a
+  machine principal carrying no user identity, which is the common case for
+  releases constructed from CI or the CLI.
+   */
+  created_by?: string | null;
+  /** What kind of principal `created_by` names. */
+  created_by_type?: "human" | "service" | "system" | "agent" | null;
+};

package/src/generated/model/createRelease201PointersItem.ts

@@ -0,0 +1,58 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { CreateRelease201PointersItemKind } from "./createRelease201PointersItemKind";
+
+/**
+ * One entry of the set a release pins: the revision of a single resource that
+this release includes.
+
+ */
+export type CreateRelease201PointersItem = {
+  /** The kind of resource a release pointer pins.
+
+  Carried explicitly rather than inferred from `revision_id`, because a
+  revision id is not always shaped distinctly enough to identify its kind: a
+  schema's is its `$id`, which may be any URL.
+
+  `flow_definition` rather than `flow`: a release pins the definitions served
+  at `/flow_definitions`, not the runtime flows at `/flow`.
+   */
+  kind: CreateRelease201PointersItemKind;
+  /**
+     * Which resource this pointer pins, independent of which revision of it.
+  `revision_id` chooses the revision; `handle` says what the revision is a
+  revision *of*. Determined when the release is assembled, not supplied by
+  the caller:
+
+  - `schema` — the document's `objectType`, so `human-user` and
+    `machine-user` are separate resources a release pins separately
+  - `flow_definition` — the definition's `name`, likewise for
+    `default-login` and `b2b-login`
+  - `branding` — always `default`. A project has one branding, so there is
+    nothing to distinguish; it is revisioned like everything else, and
+    `revision_id` is what varies between releases.
+
+  Resources inside a release reference each other by handle rather than by
+  revision id, so the same handle names the same resource in every release.
+
+     * @minLength 1
+     * @maxLength 256
+     */
+  handle: string;
+  /**
+     * The revision of that resource this release pins.
+
+  Deliberately not constrained to a prefixed id: for `kind: schema` this is
+  the schema's `$id`, which is a URL whenever the document supplied one and
+  only a generated `sch_*` value otherwise.
+
+     * @minLength 1
+     * @maxLength 512
+     */
+  revision_id: string;
+};

package/src/generated/model/createRelease201PointersItemKind.ts

@@ -0,0 +1,27 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * The kind of resource a release pointer pins.
+
+Carried explicitly rather than inferred from `revision_id`, because a
+revision id is not always shaped distinctly enough to identify its kind: a
+schema's is its `$id`, which may be any URL.
+
+`flow_definition` rather than `flow`: a release pins the definitions served
+at `/flow_definitions`, not the runtime flows at `/flow`.
+
+ */
+export type CreateRelease201PointersItemKind =
+  (typeof CreateRelease201PointersItemKind)[keyof typeof CreateRelease201PointersItemKind];
+
+export const CreateRelease201PointersItemKind = {
+  schema: "schema",
+  flow_definition: "flow_definition",
+  branding: "branding",
+} as const;

package/src/generated/model/createReleaseBody.ts

@@ -0,0 +1,48 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { CreateReleaseBodyPointersItem } from "./createReleaseBodyPointersItem";
+
+/**
+ * The set of revisions to bundle into a release, plus the metadata to record
+alongside it.
+
+`created_at` and `created_by` are derived server-side from the caller's
+authentication context and are not accepted here.
+
+ */
+export type CreateReleaseBody = {
+  /**
+     * The revisions to pin. Must not be empty.
+
+  A kind usually appears more than once: a project has several user schemas
+  and several flow definitions, and each is pinned on its own. What it
+  cannot do is
+  pin two revisions of the *same* resource — a second revision of the
+  `human-user` schema is rejected rather than ordered, since a release
+  describes one state of the project.
+
+     * @minItems 1
+     */
+  pointers: CreateReleaseBodyPointersItem[];
+  /**
+     * A short summary of what the release changes, analogous to a git commit
+  message. Recorded on the release and shown when listing releases.
+
+     * @maxLength 1024
+     */
+  message?: string;
+  /**
+   * The source commit the caller was operating from.
+   * @maxLength 64
+   */
+  git_sha?: string;
+  /** Set when the working tree had uncommitted changes, so the release content
+  does not correspond exactly to `git_sha`.
+   */
+  git_dirty?: boolean;
+};

package/src/generated/model/createReleaseBodyPointersItem.ts

@@ -0,0 +1,39 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { CreateReleaseBodyPointersItemKind } from "./createReleaseBodyPointersItemKind";
+
+/**
+ * One revision to pin. The handle is not supplied: it is the resource's own
+identifying field, so the server reads it from the revision being pinned and
+records it on the release.
+
+ */
+export type CreateReleaseBodyPointersItem = {
+  /** The kind of resource a release pointer pins.
+
+  Carried explicitly rather than inferred from `revision_id`, because a
+  revision id is not always shaped distinctly enough to identify its kind: a
+  schema's is its `$id`, which may be any URL.
+
+  `flow_definition` rather than `flow`: a release pins the definitions served
+  at `/flow_definitions`, not the runtime flows at `/flow`.
+   */
+  kind: CreateReleaseBodyPointersItemKind;
+  /**
+     * The revision of that resource to pin. Must already exist in the project —
+  this endpoint pins revisions, it does not create them.
+
+  Deliberately not constrained to a prefixed id: for `kind: schema` this is
+  the schema's `$id`, which is a URL whenever the document supplied one and
+  only a generated `sch_*` value otherwise.
+
+     * @minLength 1
+     * @maxLength 512
+     */
+  revision_id: string;
+};

package/src/generated/model/createReleaseBodyPointersItemKind.ts

@@ -0,0 +1,27 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * The kind of resource a release pointer pins.
+
+Carried explicitly rather than inferred from `revision_id`, because a
+revision id is not always shaped distinctly enough to identify its kind: a
+schema's is its `$id`, which may be any URL.
+
+`flow_definition` rather than `flow`: a release pins the definitions served
+at `/flow_definitions`, not the runtime flows at `/flow`.
+
+ */
+export type CreateReleaseBodyPointersItemKind =
+  (typeof CreateReleaseBodyPointersItemKind)[keyof typeof CreateReleaseBodyPointersItemKind];
+
+export const CreateReleaseBodyPointersItemKind = {
+  schema: "schema",
+  flow_definition: "flow_definition",
+  branding: "branding",
+} as const;

package/src/generated/model/createReleaseDefault.ts

@@ -0,0 +1,39 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+export type CreateReleaseDefault =
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "auth.unauthorized";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "internal";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "req.invalid";
+    });

package/src/generated/model/createReleaseParams.ts

@@ -0,0 +1,15 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+export type CreateReleaseParams = {
+  /**
+   * The unique identifier of the project
+   * @pattern ^[a-zA-Z0-9_-]+$
+   */
+  project_id: string;
+};

package/src/generated/model/createSchemaBody.ts

@@ -8,6 +8,12 @@
 
 export type CreateSchemaBody =
   | {
+      /**
+     * The type of user this schema describes. This is a customer chosen name.
+
+     * @maxLength 256
+     */
+      objectType?: string;
       /** Discriminator value for a user schema create request. */
       kind: "user-schema";
       /** The user Schema version used for this schema. */
@@ -17,65 +23,61 @@ export type CreateSchemaBody =
         password?: {
           /** Whether the authentication method is enabled or not */
           enabled: boolean;
-          /**
-           * The position of the authentication method in the list of supported methods
-           * @minimum 0
-           */
-          position: number;
         };
         passkey?: {
           /** Whether the authentication method is enabled or not */
           enabled: boolean;
-          /**
-           * The position of the authentication method in the list of supported methods
-           * @minimum 0
-           */
-          position: number;
         };
         magic_link?: {
           /** Whether the authentication method is enabled or not */
           enabled: boolean;
-          /**
-           * The position of the authentication method in the list of supported methods
-           * @minimum 0
-           */
-          position: number;
         };
         sso?: {
           /** Whether the authentication method is enabled or not */
           enabled: boolean;
-          /**
-           * The position of the authentication method in the list of supported methods
-           * @minimum 0
-           */
-          position: number;
         };
         otp?: {
           /** Whether the authentication method is enabled or not */
           enabled: boolean;
-          /**
-           * The position of the authentication method in the list of supported methods
-           * @minimum 0
-           */
-          position: number;
         };
       };
-      /** A map of additional properties for the user definition, where the key is the property name and the value is the property schema */
+      /**
+     * Path of the leaf property whose value identifies a user (nested leaves
+  are addressed by their dot-joined attribute path). The property must
+  carry `x-unique` "project". Required when an auth method needing
+  identifier-first dispatch (password) is enabled. Passkey is exempt:
+  discoverable credentials identify the user through the assertion
+  itself, so passkey-only and API-managed schemas may designate nothing;
+  flows using identifier-first passkey are validated at the flow level
+  instead.
+
+     * @minLength 1
+     */
+      "x-identifier"?: string;
+      /**
+     * Ordered leaf property paths whose values, joined with a space, render
+  the user's display name.
+
+     * @minItems 1
+     */
+      "x-display"?: string[];
+      /** A map of additional properties for the user definition, where the
+  key is the property name and the value is the property schema
+   */
       properties?: {
         [key: string]: {
-          /** The verification method for this property, if applicable */
-          "x-verify"?: string | null;
           /** The level of uniqueness for this property, if applicable */
           "x-unique"?: "unspecified" | "project" | "team" | null;
           /** The claim name for this property, if applicable */
           "x-claim"?: string | null;
-          /** Whether this property is editable by the user or not */
-          "x-editable"?: boolean;
-          /** Whether this property contains sensitive information or not */
-          "x-sensitive"?: boolean;
-          /** Whether this property is used for multi-factor authentication or not */
-          "x-mfa"?: boolean;
-          /** A map of additional properties for the user definition, where the key is the property name and the value is the property schema */
+          /** Whether this property's value may appear in audit event payloads. Audit
+  payloads are deny-by-default: a property without this annotation
+  contributes its key but never its value.
+   */
+          "x-audit"?: boolean;
+          /** A map of additional properties for the user definition, where the key is
+  the property name and the value is the property schema.
+   */
           properties?: { [key: string]: unknown };
           [key: string]: unknown;
         };

package/src/generated/model/createSession201Session.ts

@@ -8,6 +8,7 @@
 import type { CreateSession201SessionFactorsItem } from "./createSession201SessionFactorsItem";
 import type { CreateSession201SessionMetadata } from "./createSession201SessionMetadata";
 import type { CreateSession201SessionState } from "./createSession201SessionState";
+import type { CreateSession201SessionUser } from "./createSession201SessionUser";
 import type { CreateSession201SessionUserAgent } from "./createSession201SessionUserAgent";
 
 /**
@@ -21,23 +22,29 @@ in through `auth_attempts`.
  */
 export type CreateSession201Session = {
   /**
-   * Unique identifier for this session.
-   * @pattern ^[a-zA-Z0-9_-]+$
+   * Unique identifier for this session (dialect-minted prefixed opaque string).
+   * @pattern ^sess_[a-zA-Z0-9_-]+$
    */
   session_id: string;
   /** @pattern ^[a-zA-Z0-9_-]+$ */
   project_id: string;
   /** Current lifecycle state of the session:
-  - `building`: has a user factor but is still gathering authentication factors
+  - `building`: no verified authentication factors yet
   - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
   - `expired`: TTL elapsed
-  - `revoked`: explicitly revoked via DELETE
    */
   state: CreateSession201SessionState;
   /** The authenticated user. Null for anonymous sessions and until the `user`
   factor has been verified through an `auth_attempt`.
    */
   user_id?: string | null;
+  /** A resolved reference to a user (ADR 058 §3). Fields are role-named, not
+  property-named, so responses can mix users from different schemas.
+  `identifier` and `display` are resolved independently from the user
+  schema's `x-identifier` and `x-display` designations, live at read time.
+  Clients render `display`, falling back to `identifier`, then `user_id`.
+   */
+  user?: CreateSession201SessionUser;
   /** Verified authentication factors accumulated by this session.
   Each key is a factor type (e.g. `password`, `totp`, `passkey`).
   Each value is a factor event object with at least `verified_at` and

package/src/generated/model/createSession201SessionState.ts

@@ -8,10 +8,9 @@
 
 /**
  * Current lifecycle state of the session:
-- `building`: has a user factor but is still gathering authentication factors
+- `building`: no verified authentication factors yet
 - `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age
 - `expired`: TTL elapsed
-- `revoked`: explicitly revoked via DELETE
 
  */
 export type CreateSession201SessionState =
@@ -21,5 +20,4 @@ export const CreateSession201SessionState = {
   building: "building",
   active: "active",
   expired: "expired",
-  revoked: "revoked",
 } as const;

package/src/generated/model/createSession201SessionUser.ts

@@ -0,0 +1,37 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * A resolved reference to a user (ADR 058 §3). Fields are role-named, not
+property-named, so responses can mix users from different schemas.
+`identifier` and `display` are resolved independently from the user
+schema's `x-identifier` and `x-display` designations, live at read time.
+Clients render `display`, falling back to `identifier`, then `user_id`.
+
+ */
+export type CreateSession201SessionUser = {
+  /** @pattern ^user_[a-zA-Z0-9_-]+$ */
+  user_id: string;
+  /** The current value of the schema's designated identifier
+  (`x-identifier`). Absent when the schema designates no identifier or
+  the user carries no value for it.
+   */
+  identifier?: string;
+  /** The schema property `identifier` came from, so clients can reach the
+  property's schema for semantics (a mailto link, a field label)
+  instead of guessing from the value. Present exactly when
+  `identifier` is.
+   */
+  identifier_property?: string;
+  /** The `x-display` rendering — the designated properties' values joined
+  in list order. Purely presentational, with no source attribution.
+  Absent when the schema designates no display properties or the user
+  carries no values for them.
+   */
+  display?: string;
+};