@zitadel/api 1.0.0-alpha.20 → 1.0.0-alpha.21

package/src/generated/endpoints/zitadelNextGen.msw.ts

@@ -100,6 +100,18 @@ export const getCreateUserResponseMock = (
       undefined,
     ]),
   },
+  identifier: faker.helpers.arrayElement([
+    faker.string.alpha({ length: { min: 10, max: 20 } }),
+    undefined,
+  ]),
+  identifier_property: faker.helpers.arrayElement([
+    faker.string.alpha({ length: { min: 10, max: 20 } }),
+    undefined,
+  ]),
+  display: faker.helpers.arrayElement([
+    faker.string.alpha({ length: { min: 10, max: 20 } }),
+    undefined,
+  ]),
   teams: faker.helpers.arrayElement([
     Array.from({ length: faker.number.int({ min: 1, max: 10 }) }, (_, i) => i + 1).map(() => ({
       id: faker.string.alpha({ length: { min: 10, max: 20 } }),
@@ -148,6 +160,18 @@ export const getQueryUsersResponseMock = (
         undefined,
       ]),
     },
+    identifier: faker.helpers.arrayElement([
+      faker.string.alpha({ length: { min: 10, max: 20 } }),
+      undefined,
+    ]),
+    identifier_property: faker.helpers.arrayElement([
+      faker.string.alpha({ length: { min: 10, max: 20 } }),
+      undefined,
+    ]),
+    display: faker.helpers.arrayElement([
+      faker.string.alpha({ length: { min: 10, max: 20 } }),
+      undefined,
+    ]),
     teams: faker.helpers.arrayElement([
       Array.from({ length: faker.number.int({ min: 1, max: 10 }) }, (_, i) => i + 1).map(() => ({
         id: faker.string.alpha({ length: { min: 10, max: 20 } }),
@@ -200,6 +224,18 @@ export const getGetUserByIDResponseMock = (
       undefined,
     ]),
   },
+  identifier: faker.helpers.arrayElement([
+    faker.string.alpha({ length: { min: 10, max: 20 } }),
+    undefined,
+  ]),
+  identifier_property: faker.helpers.arrayElement([
+    faker.string.alpha({ length: { min: 10, max: 20 } }),
+    undefined,
+  ]),
+  display: faker.helpers.arrayElement([
+    faker.string.alpha({ length: { min: 10, max: 20 } }),
+    undefined,
+  ]),
   teams: faker.helpers.arrayElement([
     Array.from({ length: faker.number.int({ min: 1, max: 10 }) }, (_, i) => i + 1).map(() => ({
       id: faker.string.alpha({ length: { min: 10, max: 20 } }),
@@ -298,6 +334,18 @@ export const getGetMyUserResponseMock = (
       undefined,
     ]),
   },
+  identifier: faker.helpers.arrayElement([
+    faker.string.alpha({ length: { min: 10, max: 20 } }),
+    undefined,
+  ]),
+  identifier_property: faker.helpers.arrayElement([
+    faker.string.alpha({ length: { min: 10, max: 20 } }),
+    undefined,
+  ]),
+  display: faker.helpers.arrayElement([
+    faker.string.alpha({ length: { min: 10, max: 20 } }),
+    undefined,
+  ]),
   teams: faker.helpers.arrayElement([
     Array.from({ length: faker.number.int({ min: 1, max: 10 }) }, (_, i) => i + 1).map(() => ({
       id: faker.string.alpha({ length: { min: 10, max: 20 } }),
@@ -1165,12 +1213,22 @@ export const getCreateSessionResponseMock = (
       faker.helpers.arrayElement([faker.helpers.fromRegExp("^user_[a-zA-Z0-9_-]+$"), null]),
       undefined,
     ]),
-    name: faker.helpers.arrayElement([
-      faker.string.alpha({ length: { min: 10, max: 20 } }),
-      undefined,
-    ]),
-    email: faker.helpers.arrayElement([
-      faker.string.alpha({ length: { min: 10, max: 20 } }),
+    user: faker.helpers.arrayElement([
+      {
+        user_id: faker.helpers.fromRegExp("^user_[a-zA-Z0-9_-]+$"),
+        identifier: faker.helpers.arrayElement([
+          faker.string.alpha({ length: { min: 10, max: 20 } }),
+          undefined,
+        ]),
+        identifier_property: faker.helpers.arrayElement([
+          faker.string.alpha({ length: { min: 10, max: 20 } }),
+          undefined,
+        ]),
+        display: faker.helpers.arrayElement([
+          faker.string.alpha({ length: { min: 10, max: 20 } }),
+          undefined,
+        ]),
+      },
       undefined,
     ]),
     factors: Array.from({ length: faker.number.int({ min: 1, max: 10 }) }, (_, i) => i + 1).map(
@@ -1237,12 +1295,22 @@ export const getQuerySessionsResponseMock = (
         faker.helpers.arrayElement([faker.helpers.fromRegExp("^user_[a-zA-Z0-9_-]+$"), null]),
         undefined,
       ]),
-      name: faker.helpers.arrayElement([
-        faker.string.alpha({ length: { min: 10, max: 20 } }),
-        undefined,
-      ]),
-      email: faker.helpers.arrayElement([
-        faker.string.alpha({ length: { min: 10, max: 20 } }),
+      user: faker.helpers.arrayElement([
+        {
+          user_id: faker.helpers.fromRegExp("^user_[a-zA-Z0-9_-]+$"),
+          identifier: faker.helpers.arrayElement([
+            faker.string.alpha({ length: { min: 10, max: 20 } }),
+            undefined,
+          ]),
+          identifier_property: faker.helpers.arrayElement([
+            faker.string.alpha({ length: { min: 10, max: 20 } }),
+            undefined,
+          ]),
+          display: faker.helpers.arrayElement([
+            faker.string.alpha({ length: { min: 10, max: 20 } }),
+            undefined,
+          ]),
+        },
         undefined,
       ]),
       factors: Array.from({ length: faker.number.int({ min: 1, max: 10 }) }, (_, i) => i + 1).map(
@@ -1312,12 +1380,22 @@ export const getExchangeHandoffResponseMock = (
       faker.helpers.arrayElement([faker.helpers.fromRegExp("^user_[a-zA-Z0-9_-]+$"), null]),
       undefined,
     ]),
-    name: faker.helpers.arrayElement([
-      faker.string.alpha({ length: { min: 10, max: 20 } }),
-      undefined,
-    ]),
-    email: faker.helpers.arrayElement([
-      faker.string.alpha({ length: { min: 10, max: 20 } }),
+    user: faker.helpers.arrayElement([
+      {
+        user_id: faker.helpers.fromRegExp("^user_[a-zA-Z0-9_-]+$"),
+        identifier: faker.helpers.arrayElement([
+          faker.string.alpha({ length: { min: 10, max: 20 } }),
+          undefined,
+        ]),
+        identifier_property: faker.helpers.arrayElement([
+          faker.string.alpha({ length: { min: 10, max: 20 } }),
+          undefined,
+        ]),
+        display: faker.helpers.arrayElement([
+          faker.string.alpha({ length: { min: 10, max: 20 } }),
+          undefined,
+        ]),
+      },
       undefined,
     ]),
     factors: Array.from({ length: faker.number.int({ min: 1, max: 10 }) }, (_, i) => i + 1).map(
@@ -1382,12 +1460,22 @@ export const getGetSessionResponseMock = (
     faker.helpers.arrayElement([faker.helpers.fromRegExp("^user_[a-zA-Z0-9_-]+$"), null]),
     undefined,
   ]),
-  name: faker.helpers.arrayElement([
-    faker.string.alpha({ length: { min: 10, max: 20 } }),
-    undefined,
-  ]),
-  email: faker.helpers.arrayElement([
-    faker.string.alpha({ length: { min: 10, max: 20 } }),
+  user: faker.helpers.arrayElement([
+    {
+      user_id: faker.helpers.fromRegExp("^user_[a-zA-Z0-9_-]+$"),
+      identifier: faker.helpers.arrayElement([
+        faker.string.alpha({ length: { min: 10, max: 20 } }),
+        undefined,
+      ]),
+      identifier_property: faker.helpers.arrayElement([
+        faker.string.alpha({ length: { min: 10, max: 20 } }),
+        undefined,
+      ]),
+      display: faker.helpers.arrayElement([
+        faker.string.alpha({ length: { min: 10, max: 20 } }),
+        undefined,
+      ]),
+    },
     undefined,
   ]),
   factors: Array.from({ length: faker.number.int({ min: 1, max: 10 }) }, (_, i) => i + 1).map(
@@ -1450,12 +1538,22 @@ export const getGetMySessionResponseMock = (
     faker.helpers.arrayElement([faker.helpers.fromRegExp("^user_[a-zA-Z0-9_-]+$"), null]),
     undefined,
   ]),
-  name: faker.helpers.arrayElement([
-    faker.string.alpha({ length: { min: 10, max: 20 } }),
-    undefined,
-  ]),
-  email: faker.helpers.arrayElement([
-    faker.string.alpha({ length: { min: 10, max: 20 } }),
+  user: faker.helpers.arrayElement([
+    {
+      user_id: faker.helpers.fromRegExp("^user_[a-zA-Z0-9_-]+$"),
+      identifier: faker.helpers.arrayElement([
+        faker.string.alpha({ length: { min: 10, max: 20 } }),
+        undefined,
+      ]),
+      identifier_property: faker.helpers.arrayElement([
+        faker.string.alpha({ length: { min: 10, max: 20 } }),
+        undefined,
+      ]),
+      display: faker.helpers.arrayElement([
+        faker.string.alpha({ length: { min: 10, max: 20 } }),
+        undefined,
+      ]),
+    },
     undefined,
   ]),
   factors: Array.from({ length: faker.number.int({ min: 1, max: 10 }) }, (_, i) => i + 1).map(

package/src/generated/endpoints/zitadelNextGen.zod.ts

@@ -183,6 +183,24 @@ export const QueryUsersResponse = zod
                 'The team named by `lifecycle_owner_team_id`, present only when the\nrequest asked for it with `expand: [\"lifecycle_owner_team\"]` (ADR 059).\nAbsent means it was not requested; `null` means the user is self-owned\nand there is no owner to resolve.\n\nRequesting it does not guarantee it is present on every user. Today\n`team.read` is checked once for the whole request, so it is; once that\ncheck is per team, a page may contain a user whose owner the caller may\nnot read, and such a row answers with neither the team nor `null` —\n`null` already means self-owned. What it answers with instead is decided\nwith the granular scopes (#420); do not read the two cases above as the\ncomplete set.\n\nThis is the same representation `GET \/teams\/{team_id}` serves. It is a\nsingle team, not a collection, so it carries no cap and no truncation\nflag.\n',
               ),
           }),
+          identifier: zod
+            .string()
+            .optional()
+            .describe(
+              "The current value of the user schema's designated identifier\n(`x-identifier`), resolved live at read time. Absent when the schema\ndesignates no identifier or the user carries no value for it.\n",
+            ),
+          identifier_property: zod
+            .string()
+            .optional()
+            .describe(
+              "The schema property `identifier` came from, so clients can reach the\nproperty's schema for semantics (a mailto link, a field label)\ninstead of guessing from the value. Present exactly when\n`identifier` is.\n",
+            ),
+          display: zod
+            .string()
+            .optional()
+            .describe(
+              "The `x-display` rendering — the designated properties' values joined\nin list order, resolved live at read time. Purely presentational.\nAbsent when the schema designates no display properties or the user\ncarries no values for them. Clients render `display`, falling back\nto `identifier`, then `id`.\n",
+            ),
           teams: zod
             .array(
               zod
@@ -307,6 +325,24 @@ export const GetUserByIDResponse = zod
           'The team named by `lifecycle_owner_team_id`, present only when the\nrequest asked for it with `expand: [\"lifecycle_owner_team\"]` (ADR 059).\nAbsent means it was not requested; `null` means the user is self-owned\nand there is no owner to resolve.\n\nRequesting it does not guarantee it is present on every user. Today\n`team.read` is checked once for the whole request, so it is; once that\ncheck is per team, a page may contain a user whose owner the caller may\nnot read, and such a row answers with neither the team nor `null` —\n`null` already means self-owned. What it answers with instead is decided\nwith the granular scopes (#420); do not read the two cases above as the\ncomplete set.\n\nThis is the same representation `GET \/teams\/{team_id}` serves. It is a\nsingle team, not a collection, so it carries no cap and no truncation\nflag.\n',
         ),
     }),
+    identifier: zod
+      .string()
+      .optional()
+      .describe(
+        "The current value of the user schema's designated identifier\n(`x-identifier`), resolved live at read time. Absent when the schema\ndesignates no identifier or the user carries no value for it.\n",
+      ),
+    identifier_property: zod
+      .string()
+      .optional()
+      .describe(
+        "The schema property `identifier` came from, so clients can reach the\nproperty's schema for semantics (a mailto link, a field label)\ninstead of guessing from the value. Present exactly when\n`identifier` is.\n",
+      ),
+    display: zod
+      .string()
+      .optional()
+      .describe(
+        "The `x-display` rendering — the designated properties' values joined\nin list order, resolved live at read time. Purely presentational.\nAbsent when the schema designates no display properties or the user\ncarries no values for them. Clients render `display`, falling back\nto `identifier`, then `id`.\n",
+      ),
     teams: zod
       .array(
         zod
@@ -616,6 +652,24 @@ export const GetMyUserResponse = zod
           'The team named by `lifecycle_owner_team_id`, present only when the\nrequest asked for it with `expand: [\"lifecycle_owner_team\"]` (ADR 059).\nAbsent means it was not requested; `null` means the user is self-owned\nand there is no owner to resolve.\n\nRequesting it does not guarantee it is present on every user. Today\n`team.read` is checked once for the whole request, so it is; once that\ncheck is per team, a page may contain a user whose owner the caller may\nnot read, and such a row answers with neither the team nor `null` —\n`null` already means self-owned. What it answers with instead is decided\nwith the granular scopes (#420); do not read the two cases above as the\ncomplete set.\n\nThis is the same representation `GET \/teams\/{team_id}` serves. It is a\nsingle team, not a collection, so it carries no cap and no truncation\nflag.\n',
         ),
     }),
+    identifier: zod
+      .string()
+      .optional()
+      .describe(
+        "The current value of the user schema's designated identifier\n(`x-identifier`), resolved live at read time. Absent when the schema\ndesignates no identifier or the user carries no value for it.\n",
+      ),
+    identifier_property: zod
+      .string()
+      .optional()
+      .describe(
+        "The schema property `identifier` came from, so clients can reach the\nproperty's schema for semantics (a mailto link, a field label)\ninstead of guessing from the value. Present exactly when\n`identifier` is.\n",
+      ),
+    display: zod
+      .string()
+      .optional()
+      .describe(
+        "The `x-display` rendering — the designated properties' values joined\nin list order, resolved live at read time. Purely presentational.\nAbsent when the schema designates no display properties or the user\ncarries no values for them. Clients render `display`, falling back\nto `identifier`, then `id`.\n",
+      ),
     teams: zod
       .array(
         zod
@@ -2394,6 +2448,9 @@ export const QuerySessionsBody = zod
 export const querySessionsResponseSessionsItemSessionIdRegExp = new RegExp("^sess_[a-zA-Z0-9_-]+$");
 export const querySessionsResponseSessionsItemProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
 export const querySessionsResponseSessionsItemUserIdOneRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
+export const querySessionsResponseSessionsItemUserUserIdRegExp = new RegExp(
+  "^user_[a-zA-Z0-9_-]+$",
+);
 export const querySessionsResponseSessionsItemFactorsItemPayloadOneUserIdRegExp = new RegExp(
   "^user_[a-zA-Z0-9_-]+$",
 );
@@ -2424,17 +2481,31 @@ export const QuerySessionsResponse = zod
             .describe(
               "The authenticated user. Null for anonymous sessions and until the `user`\nfactor has been verified through an `auth_attempt`.\n",
             ),
-          name: zod
-            .string()
-            .optional()
-            .describe(
-              "Human-readable name of the authenticated user, resolved from the\nconventional user-schema properties: `name` when defined, otherwise\nthe given and family name parts joined — `givenName`\/`familyName`\n(the shipped presets' spelling) or `given_name`\/`family_name`. Only\npresent on reads that hydrate the user's identity\n(`GET \/sessions\/me`) and only when the session has an authenticated\nuser whose schema carries those properties; clients fall back to\n`email`, then `user_id`.\n",
-            ),
-          email: zod
-            .string()
+          user: zod
+            .object({
+              user_id: zod.string().regex(querySessionsResponseSessionsItemUserUserIdRegExp),
+              identifier: zod
+                .string()
+                .optional()
+                .describe(
+                  "The current value of the schema's designated identifier\n(`x-identifier`). Absent when the schema designates no identifier or\nthe user carries no value for it.\n",
+                ),
+              identifier_property: zod
+                .string()
+                .optional()
+                .describe(
+                  "The schema property `identifier` came from, so clients can reach the\nproperty's schema for semantics (a mailto link, a field label)\ninstead of guessing from the value. Present exactly when\n`identifier` is.\n",
+                ),
+              display: zod
+                .string()
+                .optional()
+                .describe(
+                  "The `x-display` rendering — the designated properties' values joined\nin list order. Purely presentational, with no source attribution.\nAbsent when the schema designates no display properties or the user\ncarries no values for them.\n",
+                ),
+            })
             .optional()
             .describe(
-              "Email address of the authenticated user, resolved from the\nconventional `email` user-schema property. Only present on reads\nthat hydrate the user's identity (`GET \/sessions\/me`) and only when\nthe session has an authenticated user whose schema carries that\nproperty.\n",
+              "A resolved reference to a user (ADR 058 §3). Fields are role-named, not\nproperty-named, so responses can mix users from different schemas.\n`identifier` and `display` are resolved independently from the user\nschema's `x-identifier` and `x-display` designations, live at read time.\nClients render `display`, falling back to `identifier`, then `user_id`.\n",
             ),
           factors: zod
             .array(
@@ -2601,6 +2672,7 @@ export const ExchangeHandoffBody = zod
 export const exchangeHandoffResponseSessionSessionIdRegExp = new RegExp("^sess_[a-zA-Z0-9_-]+$");
 export const exchangeHandoffResponseSessionProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
 export const exchangeHandoffResponseSessionUserIdOneRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
+export const exchangeHandoffResponseSessionUserUserIdRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
 export const exchangeHandoffResponseSessionFactorsItemPayloadOneUserIdRegExp = new RegExp(
   "^user_[a-zA-Z0-9_-]+$",
 );
@@ -2625,17 +2697,31 @@ export const ExchangeHandoffResponse = zod
           .describe(
             "The authenticated user. Null for anonymous sessions and until the `user`\nfactor has been verified through an `auth_attempt`.\n",
           ),
-        name: zod
-          .string()
-          .optional()
-          .describe(
-            "Human-readable name of the authenticated user, resolved from the\nconventional user-schema properties: `name` when defined, otherwise\nthe given and family name parts joined — `givenName`\/`familyName`\n(the shipped presets' spelling) or `given_name`\/`family_name`. Only\npresent on reads that hydrate the user's identity\n(`GET \/sessions\/me`) and only when the session has an authenticated\nuser whose schema carries those properties; clients fall back to\n`email`, then `user_id`.\n",
-          ),
-        email: zod
-          .string()
+        user: zod
+          .object({
+            user_id: zod.string().regex(exchangeHandoffResponseSessionUserUserIdRegExp),
+            identifier: zod
+              .string()
+              .optional()
+              .describe(
+                "The current value of the schema's designated identifier\n(`x-identifier`). Absent when the schema designates no identifier or\nthe user carries no value for it.\n",
+              ),
+            identifier_property: zod
+              .string()
+              .optional()
+              .describe(
+                "The schema property `identifier` came from, so clients can reach the\nproperty's schema for semantics (a mailto link, a field label)\ninstead of guessing from the value. Present exactly when\n`identifier` is.\n",
+              ),
+            display: zod
+              .string()
+              .optional()
+              .describe(
+                "The `x-display` rendering — the designated properties' values joined\nin list order. Purely presentational, with no source attribution.\nAbsent when the schema designates no display properties or the user\ncarries no values for them.\n",
+              ),
+          })
           .optional()
           .describe(
-            "Email address of the authenticated user, resolved from the\nconventional `email` user-schema property. Only present on reads\nthat hydrate the user's identity (`GET \/sessions\/me`) and only when\nthe session has an authenticated user whose schema carries that\nproperty.\n",
+            "A resolved reference to a user (ADR 058 §3). Fields are role-named, not\nproperty-named, so responses can mix users from different schemas.\n`identifier` and `display` are resolved independently from the user\nschema's `x-identifier` and `x-display` designations, live at read time.\nClients render `display`, falling back to `identifier`, then `user_id`.\n",
           ),
         factors: zod
           .array(
@@ -2758,6 +2844,7 @@ export const GetSessionParams = zod.object({
 export const getSessionResponseSessionIdRegExp = new RegExp("^sess_[a-zA-Z0-9_-]+$");
 export const getSessionResponseProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
 export const getSessionResponseUserIdOneRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
+export const getSessionResponseUserUserIdRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
 export const getSessionResponseFactorsItemPayloadOneUserIdRegExp = new RegExp(
   "^user_[a-zA-Z0-9_-]+$",
 );
@@ -2780,17 +2867,31 @@ export const GetSessionResponse = zod
       .describe(
         "The authenticated user. Null for anonymous sessions and until the `user`\nfactor has been verified through an `auth_attempt`.\n",
       ),
-    name: zod
-      .string()
-      .optional()
-      .describe(
-        "Human-readable name of the authenticated user, resolved from the\nconventional user-schema properties: `name` when defined, otherwise\nthe given and family name parts joined — `givenName`\/`familyName`\n(the shipped presets' spelling) or `given_name`\/`family_name`. Only\npresent on reads that hydrate the user's identity\n(`GET \/sessions\/me`) and only when the session has an authenticated\nuser whose schema carries those properties; clients fall back to\n`email`, then `user_id`.\n",
-      ),
-    email: zod
-      .string()
+    user: zod
+      .object({
+        user_id: zod.string().regex(getSessionResponseUserUserIdRegExp),
+        identifier: zod
+          .string()
+          .optional()
+          .describe(
+            "The current value of the schema's designated identifier\n(`x-identifier`). Absent when the schema designates no identifier or\nthe user carries no value for it.\n",
+          ),
+        identifier_property: zod
+          .string()
+          .optional()
+          .describe(
+            "The schema property `identifier` came from, so clients can reach the\nproperty's schema for semantics (a mailto link, a field label)\ninstead of guessing from the value. Present exactly when\n`identifier` is.\n",
+          ),
+        display: zod
+          .string()
+          .optional()
+          .describe(
+            "The `x-display` rendering — the designated properties' values joined\nin list order. Purely presentational, with no source attribution.\nAbsent when the schema designates no display properties or the user\ncarries no values for them.\n",
+          ),
+      })
       .optional()
       .describe(
-        "Email address of the authenticated user, resolved from the\nconventional `email` user-schema property. Only present on reads\nthat hydrate the user's identity (`GET \/sessions\/me`) and only when\nthe session has an authenticated user whose schema carries that\nproperty.\n",
+        "A resolved reference to a user (ADR 058 §3). Fields are role-named, not\nproperty-named, so responses can mix users from different schemas.\n`identifier` and `display` are resolved independently from the user\nschema's `x-identifier` and `x-display` designations, live at read time.\nClients render `display`, falling back to `identifier`, then `user_id`.\n",
       ),
     factors: zod
       .array(
@@ -2917,6 +3018,7 @@ against the same `session_id`) to restore a dropped assurance level.
 export const getMySessionResponseSessionIdRegExp = new RegExp("^sess_[a-zA-Z0-9_-]+$");
 export const getMySessionResponseProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
 export const getMySessionResponseUserIdOneRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
+export const getMySessionResponseUserUserIdRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
 export const getMySessionResponseFactorsItemPayloadOneUserIdRegExp = new RegExp(
   "^user_[a-zA-Z0-9_-]+$",
 );
@@ -2939,17 +3041,31 @@ export const GetMySessionResponse = zod
       .describe(
         "The authenticated user. Null for anonymous sessions and until the `user`\nfactor has been verified through an `auth_attempt`.\n",
       ),
-    name: zod
-      .string()
-      .optional()
-      .describe(
-        "Human-readable name of the authenticated user, resolved from the\nconventional user-schema properties: `name` when defined, otherwise\nthe given and family name parts joined — `givenName`\/`familyName`\n(the shipped presets' spelling) or `given_name`\/`family_name`. Only\npresent on reads that hydrate the user's identity\n(`GET \/sessions\/me`) and only when the session has an authenticated\nuser whose schema carries those properties; clients fall back to\n`email`, then `user_id`.\n",
-      ),
-    email: zod
-      .string()
+    user: zod
+      .object({
+        user_id: zod.string().regex(getMySessionResponseUserUserIdRegExp),
+        identifier: zod
+          .string()
+          .optional()
+          .describe(
+            "The current value of the schema's designated identifier\n(`x-identifier`). Absent when the schema designates no identifier or\nthe user carries no value for it.\n",
+          ),
+        identifier_property: zod
+          .string()
+          .optional()
+          .describe(
+            "The schema property `identifier` came from, so clients can reach the\nproperty's schema for semantics (a mailto link, a field label)\ninstead of guessing from the value. Present exactly when\n`identifier` is.\n",
+          ),
+        display: zod
+          .string()
+          .optional()
+          .describe(
+            "The `x-display` rendering — the designated properties' values joined\nin list order. Purely presentational, with no source attribution.\nAbsent when the schema designates no display properties or the user\ncarries no values for them.\n",
+          ),
+      })
       .optional()
       .describe(
-        "Email address of the authenticated user, resolved from the\nconventional `email` user-schema property. Only present on reads\nthat hydrate the user's identity (`GET \/sessions\/me`) and only when\nthe session has an authenticated user whose schema carries that\nproperty.\n",
+        "A resolved reference to a user (ADR 058 §3). Fields are role-named, not\nproperty-named, so responses can mix users from different schemas.\n`identifier` and `display` are resolved independently from the user\nschema's `x-identifier` and `x-display` designations, live at read time.\nClients render `display`, falling back to `identifier`, then `user_id`.\n",
       ),
     factors: zod
       .array(

package/src/generated/model/createSession201Session.ts

@@ -8,6 +8,7 @@
 import type { CreateSession201SessionFactorsItem } from "./createSession201SessionFactorsItem";
 import type { CreateSession201SessionMetadata } from "./createSession201SessionMetadata";
 import type { CreateSession201SessionState } from "./createSession201SessionState";
+import type { CreateSession201SessionUser } from "./createSession201SessionUser";
 import type { CreateSession201SessionUserAgent } from "./createSession201SessionUserAgent";
 
 /**
@@ -37,23 +38,13 @@ export type CreateSession201Session = {
   factor has been verified through an `auth_attempt`.
    */
   user_id?: string | null;
-  /** Human-readable name of the authenticated user, resolved from the
-  conventional user-schema properties: `name` when defined, otherwise
-  the given and family name parts joined — `givenName`/`familyName`
-  (the shipped presets' spelling) or `given_name`/`family_name`. Only
-  present on reads that hydrate the user's identity
-  (`GET /sessions/me`) and only when the session has an authenticated
-  user whose schema carries those properties; clients fall back to
-  `email`, then `user_id`.
+  /** A resolved reference to a user (ADR 058 §3). Fields are role-named, not
+  property-named, so responses can mix users from different schemas.
+  `identifier` and `display` are resolved independently from the user
+  schema's `x-identifier` and `x-display` designations, live at read time.
+  Clients render `display`, falling back to `identifier`, then `user_id`.
    */
-  name?: string;
-  /** Email address of the authenticated user, resolved from the
-  conventional `email` user-schema property. Only present on reads
-  that hydrate the user's identity (`GET /sessions/me`) and only when
-  the session has an authenticated user whose schema carries that
-  property.
-   */
-  email?: string;
+  user?: CreateSession201SessionUser;
   /** Verified authentication factors accumulated by this session.
   Each key is a factor type (e.g. `password`, `totp`, `passkey`).
   Each value is a factor event object with at least `verified_at` and

package/src/generated/model/createSession201SessionUser.ts

@@ -0,0 +1,37 @@
+/**
+ * Generated by orval v8.10.0 🍺
+ * Do not edit manually.
+ * Zitadel NextGen
+ * This is the next generation of the Zitadel identity platform.
+ * OpenAPI spec version: 0.0.1
+ */
+
+/**
+ * A resolved reference to a user (ADR 058 §3). Fields are role-named, not
+property-named, so responses can mix users from different schemas.
+`identifier` and `display` are resolved independently from the user
+schema's `x-identifier` and `x-display` designations, live at read time.
+Clients render `display`, falling back to `identifier`, then `user_id`.
+
+ */
+export type CreateSession201SessionUser = {
+  /** @pattern ^user_[a-zA-Z0-9_-]+$ */
+  user_id: string;
+  /** The current value of the schema's designated identifier
+  (`x-identifier`). Absent when the schema designates no identifier or
+  the user carries no value for it.
+   */
+  identifier?: string;
+  /** The schema property `identifier` came from, so clients can reach the
+  property's schema for semantics (a mailto link, a field label)
+  instead of guessing from the value. Present exactly when
+  `identifier` is.
+   */
+  identifier_property?: string;
+  /** The `x-display` rendering — the designated properties' values joined
+  in list order. Purely presentational, with no source attribution.
+  Absent when the schema designates no display properties or the user
+  carries no values for them.
+   */
+  display?: string;
+};

package/src/generated/model/createUser201.ts

@@ -36,6 +36,24 @@ export type CreateUser201 = {
    */
   attributes: CreateUser201Attributes;
   metadata: CreateUser201Metadata;
+  /** The current value of the user schema's designated identifier
+  (`x-identifier`), resolved live at read time. Absent when the schema
+  designates no identifier or the user carries no value for it.
+   */
+  readonly identifier?: string;
+  /** The schema property `identifier` came from, so clients can reach the
+  property's schema for semantics (a mailto link, a field label)
+  instead of guessing from the value. Present exactly when
+  `identifier` is.
+   */
+  readonly identifier_property?: string;
+  /** The `x-display` rendering — the designated properties' values joined
+  in list order, resolved live at read time. Purely presentational.
+  Absent when the schema designates no display properties or the user
+  carries no values for them. Clients render `display`, falling back
+  to `identifier`, then `id`.
+   */
+  readonly display?: string;
   /** The user's team memberships, present only when the request asked for them with
   `expand: ["teams"]` (ADR 059). Absent means it was not requested; `[]`
   means the user has none.

package/src/generated/model/exchangeHandoff200Session.ts

@@ -8,6 +8,7 @@
 import type { ExchangeHandoff200SessionFactorsItem } from "./exchangeHandoff200SessionFactorsItem";
 import type { ExchangeHandoff200SessionMetadata } from "./exchangeHandoff200SessionMetadata";
 import type { ExchangeHandoff200SessionState } from "./exchangeHandoff200SessionState";
+import type { ExchangeHandoff200SessionUser } from "./exchangeHandoff200SessionUser";
 import type { ExchangeHandoff200SessionUserAgent } from "./exchangeHandoff200SessionUserAgent";
 
 /**
@@ -37,23 +38,13 @@ export type ExchangeHandoff200Session = {
   factor has been verified through an `auth_attempt`.
    */
   user_id?: string | null;
-  /** Human-readable name of the authenticated user, resolved from the
-  conventional user-schema properties: `name` when defined, otherwise
-  the given and family name parts joined — `givenName`/`familyName`
-  (the shipped presets' spelling) or `given_name`/`family_name`. Only
-  present on reads that hydrate the user's identity
-  (`GET /sessions/me`) and only when the session has an authenticated
-  user whose schema carries those properties; clients fall back to
-  `email`, then `user_id`.
+  /** A resolved reference to a user (ADR 058 §3). Fields are role-named, not
+  property-named, so responses can mix users from different schemas.
+  `identifier` and `display` are resolved independently from the user
+  schema's `x-identifier` and `x-display` designations, live at read time.
+  Clients render `display`, falling back to `identifier`, then `user_id`.
    */
-  name?: string;
-  /** Email address of the authenticated user, resolved from the
-  conventional `email` user-schema property. Only present on reads
-  that hydrate the user's identity (`GET /sessions/me`) and only when
-  the session has an authenticated user whose schema carries that
-  property.
-   */
-  email?: string;
+  user?: ExchangeHandoff200SessionUser;
   /** Verified authentication factors accumulated by this session.
   Each key is a factor type (e.g. `password`, `totp`, `passkey`).
   Each value is a factor event object with at least `verified_at` and