@zitadel/api 0.1.0-alpha.9 → 1.0.0-alpha.21

package/src/generated/model/updateTeam409Details.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type UpdateTeam409Details = { [key: string]: unknown };

package/src/generated/model/{getFlowDefinitionParams.ts → updateTeamBody.ts}

@@ -6,10 +6,11 @@
  * OpenAPI spec version: 0.0.1
  */
 
-export type GetFlowDefinitionParams = {
+export type UpdateTeamBody = {
   /**
-   * The project id to filter by.
-   * @pattern ^[a-zA-Z0-9_-]+$
+   * The name of the team. Must be unique within the project.
+   * @minLength 1
+   * @maxLength 200
    */
-  project_id: string;
+  name?: string;
 };

package/src/generated/model/updateTeamDefault.ts

@@ -0,0 +1,20 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+import type { UpdateTeamDefaultDetails } from "./updateTeamDefaultDetails";
+
+/**
+ * Standard error payload returned for failed API requests.
+ */
+export type UpdateTeamDefault = {
+  /** Stable machine-readable error code. */
+  code: string;
+  /** Human-readable explanation of the error. */
+  message: string;
+  /** Additional error-specific context. */
+  details?: UpdateTeamDefaultDetails;
+};

package/src/generated/model/updateTeamDefaultDetails.ts

@@ -0,0 +1,12 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * Additional error-specific context.
+ */
+export type UpdateTeamDefaultDetails = { [key: string]: unknown };

package/src/generated/model/verifyChallengeProof200.ts

@@ -23,8 +23,8 @@ Clients drive the attempt by:
  */
 export type VerifyChallengeProof200 = {
   /**
-   * Unique identifier for this authentication attempt
-   * @pattern ^[a-zA-Z0-9_-]+$
+   * Unique identifier for this authentication attempt (dialect-minted prefixed opaque string).
+   * @pattern ^att_[a-zA-Z0-9_-]+$
    */
   attempt_id: string;
   /** @pattern ^[a-zA-Z0-9_-]+$ */

package/src/generated/model/verifyChallengeProof200ChallengesItem.ts

@@ -18,8 +18,8 @@ The client verifies the proof by POST /auth_attempts/{attempt_id}/challenges/{ch
  */
 export type VerifyChallengeProof200ChallengesItem = {
   /**
-   * Unique identifier for this challenge
-   * @pattern ^[a-zA-Z0-9_-]+$
+   * Unique identifier for this challenge (dialect-minted prefixed opaque string).
+   * @pattern ^ch_[a-zA-Z0-9_-]+$
    */
   challenge_id: string;
   /** An authentication factor method. */

package/src/generated/model/verifyChallengeProofDefault.ts

@@ -15,7 +15,7 @@ export type VerifyChallengeProofDefault =
       /** Additional error-specific context. */
       details?: { [key: string]: unknown };
     } & {
-      code: "att.not_found";
+      code: "att.already_handed_off";
     })
   | ({
       /** Stable machine-readable error code. */
@@ -25,7 +25,7 @@ export type VerifyChallengeProofDefault =
       /** Additional error-specific context. */
       details?: { [key: string]: unknown };
     } & {
-      code: "att.stale_challenge";
+      code: "att.invalid_proof";
     })
   | ({
       /** Stable machine-readable error code. */
@@ -37,6 +37,26 @@ export type VerifyChallengeProofDefault =
     } & {
       code: "att.invalid_request";
     })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "att.invalid_state";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "att.not_found";
+    })
   | ({
       /** Stable machine-readable error code. */
       code: string;
@@ -55,7 +75,17 @@ export type VerifyChallengeProofDefault =
       /** Additional error-specific context. */
       details?: { [key: string]: unknown };
     } & {
-      code: "att.invalid_state";
+      code: "att.stale_challenge";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "auth.unauthorized";
     })
   | ({
       /** Stable machine-readable error code. */
@@ -65,7 +95,7 @@ export type VerifyChallengeProofDefault =
       /** Additional error-specific context. */
       details?: { [key: string]: unknown };
     } & {
-      code: "att.already_completed";
+      code: "evt.invalid";
     })
   | ({
       /** Stable machine-readable error code. */
@@ -76,4 +106,34 @@ export type VerifyChallengeProofDefault =
       details?: { [key: string]: unknown };
     } & {
       code: "internal";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "req.invalid";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "user.already_exists";
+    })
+  | ({
+      /** Stable machine-readable error code. */
+      code: string;
+      /** Human-readable explanation of the error. */
+      message: string;
+      /** Additional error-specific context. */
+      details?: { [key: string]: unknown };
+    } & {
+      code: "user.invalid";
     });

package/src/runtime/api-factory.ts

@@ -49,11 +49,14 @@ export type ZitadelClientOptions = {
  * generated orval function:
  *
  *     const client = createZitadelClient({ baseUrl, token });
- *     await client.createProject({ previewOrigins: [] });
+ *     await client.createProject({ preview_origins: [] });
  *     await client.createSchema(body, { project_id });
  */
 export function createZitadelClient(opts: ZitadelClientOptions): ZitadelClient {
-  const baseUrl = opts.baseUrl.replace(/\/+$/, "");
+  let baseUrl = opts.baseUrl;
+  while (baseUrl.endsWith("/")) {
+    baseUrl = baseUrl.slice(0, -1);
+  }
   return new Proxy(endpoints as ZitadelClient, {
     get(target, prop, receiver) {
       const value = Reflect.get(target, prop, receiver);

package/src/runtime/config.spec.ts

@@ -104,7 +104,7 @@ describe("getApi", () => {
 
     expect(api).toBeDefined();
     expect(typeof api.createFlow).toBe("function");
-    expect(typeof api.endSession).toBe("function");
+    expect(typeof api.revokeMySession).toBe("function");
     expect(typeof api.getMySession).toBe("function");
   });
 
@@ -114,4 +114,34 @@ describe("getApi", () => {
     const api2 = getApi(project);
     expect(api1).toBe(api2);
   });
+
+  test("a publishable key on the handle rides as the bearer (ADR 036)", async () => {
+    const fetchSpy = vi
+      .spyOn(globalThis, "fetch")
+      .mockResolvedValue(new Response("{}", { status: 200 }));
+
+    const project = configureZitadel({
+      proxyPath: "http://localhost/__nextgen",
+      projectId: "proj_1",
+      publishableKey: "pk_test_123",
+    });
+    expect(project.publishableKey).toBe("pk_test_123");
+
+    await getApi(project).getHealth();
+
+    const headers = new Headers((fetchSpy.mock.calls[0]![1] as RequestInit).headers);
+    expect(headers.get("authorization")).toBe("Bearer pk_test_123");
+  });
+
+  test("a handle without a publishable key produces token-less requests", async () => {
+    const fetchSpy = vi
+      .spyOn(globalThis, "fetch")
+      .mockResolvedValue(new Response("{}", { status: 200 }));
+
+    const project = configureZitadel({ proxyPath: "http://localhost/__nextgen", projectId: "proj_1" });
+    await getApi(project).getHealth();
+
+    const headers = new Headers((fetchSpy.mock.calls[0]![1] as RequestInit).headers);
+    expect(headers.get("authorization")).toBeNull();
+  });
 });

package/src/runtime/config.ts

@@ -1,5 +1,5 @@
 import { setProxyPath } from "./base-url";
-import { createApi, type ZitadelApi } from "./api-factory";
+import { createZitadelClient, type ZitadelApi } from "./api-factory";
 
 /**
  * Input options for {@link configureZitadel}.
@@ -17,6 +17,17 @@ export interface ZitadelConfig {
    * Optional — not needed in client-only setups.
    */
   url?: string;
+
+  /**
+   * The project's **publishable key** (ADR 036): an origin-scoped,
+   * browser-safe bearer sent on public-plane calls (flow operations and the
+   * body-delivered handoff exchange). Safe to ship in client bundles and
+   * committed config by construction — never put a project secret
+   * (`sk_proj_…`) here. Optional — omitted, requests carry no bearer and
+   * secret-requiring operations must be authenticated by a server-side
+   * proxy instead.
+   */
+  publishableKey?: string;
 }
 
 /**
@@ -32,6 +43,9 @@ export interface ZitadelProject {
 
   /** Full URL of the Zitadel auth backend. */
   readonly url?: string;
+
+  /** The project's publishable key (ADR 036), sent as the bearer when set. */
+  readonly publishableKey?: string;
 }
 
 export type { ZitadelApi };
@@ -86,7 +100,8 @@ export function configureZitadel(config: ZitadelConfig): ZitadelProject {
     if (
       existing.proxyPath === resolvedProxyPath &&
       existing.projectId === config.projectId &&
-      existing.url === config.url
+      existing.url === config.url &&
+      existing.publishableKey === config.publishableKey
     ) {
       setProxyPath(resolvedProxyPath);
       return existing;
@@ -103,6 +118,7 @@ export function configureZitadel(config: ZitadelConfig): ZitadelProject {
     proxyPath: resolvedProxyPath,
     projectId: config.projectId,
     url: config.url,
+    publishableKey: config.publishableKey,
   });
   writeSlot(project);
   setProxyPath(resolvedProxyPath);
@@ -121,7 +137,10 @@ export function configureZitadel(config: ZitadelConfig): ZitadelProject {
 export function getApi(project: ZitadelProject): ZitadelApi {
   let api = apiCache.get(project);
   if (!api) {
-    api = createApi(project.proxyPath);
+    // The publishable key (when the handle carries one) rides as the bearer
+    // on every call from this client — the ADR 036 public-plane credential.
+    // Handles without a key produce a token-less client, exactly as before.
+    api = createZitadelClient({ baseUrl: project.proxyPath, token: project.publishableKey });
     apiCache.set(project, api);
   }
   return api;

package/src/runtime/fetch.ts

@@ -73,3 +73,48 @@ function safeJsonParse(text: string): unknown {
     return { raw: text };
   }
 }
+
+/**
+ * Extracts the server's `{code, message, details}` envelope from an
+ * {@link ApiError} into a display string. Falls back to the fetch layer's
+ * `"METHOD url returned N"` when the body isn't shaped like an envelope, so
+ * transport-level failures (HTML from a proxy, empty 5xx) still say
+ * something.
+ */
+export function apiErrorMessage(error: ApiError): string {
+  const body = error.body;
+  if (!isRecord(body)) {
+    return error.message;
+  }
+  const serverMessage = typeof body.message === "string" ? body.message : undefined;
+  const detail = pickDetailString(body.details);
+  if (!serverMessage) {
+    return error.message;
+  }
+  return detail ? `${serverMessage}: ${detail}` : serverMessage;
+}
+
+/**
+ * Reads the innermost human-readable string out of the spec's error
+ * `details` field. Handles both `details: "..."` and the nested
+ * `details: { details: "..." }` shape the platform emits for validation
+ * failures.
+ */
+function pickDetailString(details: unknown): string | undefined {
+  if (typeof details === "string") {
+    return details;
+  }
+  if (isRecord(details)) {
+    if (typeof details.details === "string") {
+      return details.details;
+    }
+    if (typeof details.message === "string") {
+      return details.message;
+    }
+  }
+  return undefined;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}