@zitadel/config 0.0.0 → 0.1.0-alpha.15

package/defaults/README-flows.md

@@ -0,0 +1,52 @@
+# `.zitadel/flows/`
+
+Flow definitions. Each JSON file describes an end-to-end journey —
+which fields the user sees at each step, which credentials are checked,
+and how one step transitions to the next. The Zitadel flow engine runs
+these on the platform; the widget renders whatever the engine emits.
+
+Flows and schemas work together: the user schema in
+`.zitadel/schemas/` defines **what** data exists, the flow defines
+**when and where** users are asked to provide it. If you add a property
+to the schema, users won't see a new field until a flow step lists it.
+
+## What's in a flow file
+
+- `purposes` — entry step for each purpose (`login`, `register`, …). A
+  single flow can serve multiple purposes.
+- `steps[]` — the ordered list of screens. Each step's `fields[]`
+  references properties of the pinned schema (or reserved tokens like
+  `x-auth-methods#password`), and `transitions` wires it to the next
+  step.
+- `user_schema` — pins the flow to one specific user-schema revision.
+- `audience` (optional) — scopes the flow to specific apps or teams.
+
+## Making changes
+
+The common workflow:
+
+1. Edit the flow (and, if it needs new data, the schema in
+   `.zitadel/schemas/` first).
+2. Run `zitadel plan` to preview the change.
+3. Run `zitadel apply` to publish it.
+
+Typical edits:
+
+- **Change which fields a step collects** — edit `steps[].fields[]`.
+  Values must be properties of the pinned schema (or reserved credential
+  tokens).
+- **Add or remove a step** — extend `steps[]`.
+- **Rewire transitions** — edit `steps[].transitions` to point at a
+  different next step, or use `action: switch` / `pivot` to jump to
+  another flow.
+- **Add another flow** — drop a new JSON file with its own `purposes`
+  and `audience` (e.g. a per-team login).
+
+## Schema revisions
+
+Editing a schema publishes a new immutable revision. When you `apply` a
+schema edit, the CLI rewrites `user_schema` in the flow files pinned to
+the old revision and updates the flows in the same run — the plan
+announces the re-pin beforehand, and the rewrite shows up in your git
+diff. Remember to update `steps[].fields[]` yourself when the edit
+added or removed properties the flow should collect.

package/defaults/README-schemas.md

@@ -0,0 +1,135 @@
+# `.zitadel/schemas/`
+
+This folder contains your project's user schemas.
+
+A user schema defines **what information is stored about a user** and
+**how that type of user can authenticate**.
+
+You can have as many schemas as you need. For example:
+
+-   `customer.json`
+-   `employee.json`
+-   `admin.json`
+
+Here's a simplified example:
+
+``` json
+{
+  "objectType": "customer",
+  "properties": {
+    "firstName": {
+      "type": "string"
+    },
+    "company": {
+      "type": "string"
+    }
+  },
+  "required": [
+    "firstName"
+  ],
+  "x-auth-methods": {
+    "password": { "enabled": true, "position": 1 },
+    "passkey": { "enabled": true, "position": 2 }
+  }
+}
+```
+
+Each schema is made up of four main sections:
+
+## `objectType`
+
+Identifies this type of user.
+
+Once you've applied a schema for the first time, don't rename it.
+Zitadel uses it to recognise future revisions of the same user type.
+
+## `properties`
+
+Defines the information stored for users of this type.
+
+For example:
+
+-   First name
+-   Last name
+-   Company
+-   Phone number
+-   Custom attributes
+
+Every property becomes available to the rest of the identity system,
+including login and registration flows.
+
+## `required`
+
+Lists which properties every user must provide.
+
+Properties that aren't listed here are optional.
+
+## `x-auth-methods`
+
+Controls how users of this type can authenticate.
+
+For example:
+
+-   Password
+-   Passkeys
+-   Social login
+
+------------------------------------------------------------------------
+
+# Making changes
+
+The most common workflow looks like this:
+
+1.  Update your schema.
+2.  If you've added, removed or renamed fields, update the corresponding
+    login flow in `.zitadel/flows/`.
+3.  Run `zitadel plan` to preview the changes.
+4.  Run `zitadel apply` to publish them.
+
+## Why do I need to update the login flow?
+
+The schema defines **what data exists**.
+
+The login flow defines **when and where users are asked to provide that
+data**.
+
+For example, if you add a `company` property to your schema, users won't
+see a new field on the registration form until you also update the
+registration flow.
+
+Likewise, if you remove or rename a property, you'll usually need to
+update any login flows that reference it.
+
+------------------------------------------------------------------------
+
+# Common changes
+
+## Add a new field
+
+Add it under `properties`.
+
+If every user must provide it, also add it to `required`.
+
+Finally, update the login flow if users should be able to enter it.
+
+## Make a field optional
+
+Remove it from `required`.
+
+## Enable passkeys
+
+Set `"passkey": { "enabled": true }` in `x-auth-methods`.
+
+## Create another user type
+
+Create another JSON file in this directory.
+
+------------------------------------------------------------------------
+
+## Next step
+
+Once you've updated your schema, continue with:
+
+    .zitadel/flows/
+
+to update your login and registration flows.

package/defaults/default-human-user.json

@@ -0,0 +1,46 @@
+{
+  "title": "DefaultHumanUserSchema",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "metaSchema": "${SERVER_URL}/user-schema.json",
+  "$id": "${USER_SCHEMA_URL}",
+  "objectType": "human-user",
+  "kind": "user-schema",
+  "type": "object",
+  "description": "The default editable schema for human users.",
+  "x-auth-methods": {
+    "password": {
+      "enabled": true,
+      "position": 1
+    },
+    "passkey": {
+      "enabled": true,
+      "position": 2
+    }
+  },
+  "required": [
+    "email"
+  ],
+  "properties": {
+    "email": {
+      "type": "string",
+      "format": "email",
+      "x-unique": "project",
+      "description": "The user's email address."
+    },
+    "givenName": {
+      "type": "string",
+      "maxLength": 50,
+      "description": "The user's given (first) name."
+    },
+    "familyName": {
+      "type": "string",
+      "maxLength": 50,
+      "description": "The user's family (last) name."
+    },
+    "dateOfBirth": {
+      "type": "string",
+      "format": "date",
+      "description": "The user's date of birth (ISO 8601, YYYY-MM-DD)."
+    }
+  }
+}

package/defaults/default-login.json

@@ -0,0 +1,131 @@
+{
+  "name": "default-login",
+  "status": "active",
+  "user_schema": "${USER_SCHEMA_URL}",
+  "purposes": {
+    "login": "identifier",
+    "register": "register"
+  },
+  "steps": [
+    {
+      "name": "identifier",
+      "fields": [
+        "email"
+      ],
+      "actions": [
+        {
+          "name": "submit",
+          "kind": "submit",
+          "primary": true,
+          "text_key": "identifier.action.continue"
+        },
+        {
+          "name": "passkey",
+          "kind": "passkey",
+          "primary": false,
+          "text_key": "identifier.action.passkey"
+        }
+      ],
+      "transitions": {
+        "submit": {
+          "target": "password"
+        },
+        "passkey": {
+          "target": "done"
+        },
+        "user_not_found": {
+          "target": "register"
+        }
+      }
+    },
+    {
+      "name": "password",
+      "fields": [
+        "x-auth-methods#password"
+      ],
+      "actions": [
+        {
+          "name": "submit",
+          "kind": "submit",
+          "primary": true,
+          "text_key": "password.action.signin"
+        },
+        {
+          "name": "passkey",
+          "kind": "passkey",
+          "primary": false,
+          "text_key": "password.action.passkey"
+        }
+      ],
+      "transitions": {
+        "submit": {
+          "target": "done"
+        },
+        "passkey": {
+          "target": "done"
+        }
+      }
+    },
+    {
+      "name": "register",
+      "fields": [
+        "email",
+        "givenName",
+        "familyName",
+        "dateOfBirth"
+      ],
+      "actions": [
+        {
+          "name": "submit",
+          "kind": "submit",
+          "primary": true,
+          "text_key": "register.action.password"
+        },
+        {
+          "name": "passkey_register",
+          "kind": "passkey_register",
+          "primary": false,
+          "text_key": "register.action.passkey"
+        }
+      ],
+      "transitions": {
+        "submit": {
+          "target": "register-password"
+        },
+        "passkey_register": {
+          "target": "done"
+        },
+        "user_already_exists": {
+          "target": "password"
+        }
+      }
+    },
+    {
+      "name": "register-password",
+      "fields": [
+        "x-auth-methods#password"
+      ],
+      "actions": [
+        {
+          "name": "submit",
+          "kind": "submit",
+          "primary": true,
+          "text_key": "register-password.action.submit"
+        }
+      ],
+      "on_success": "create_user",
+      "transitions": {
+        "submit": {
+          "target": "done"
+        },
+        "user_already_exists": {
+          "target": "password"
+        }
+      }
+    },
+    {
+      "name": "done",
+      "complete": "show"
+    }
+  ]
+}

package/dist/defaults-B2iIPSSl.mjs

@@ -0,0 +1,201 @@
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+//#region defaults/default-human-user.json
+var default_human_user_default = {
+	title: "DefaultHumanUserSchema",
+	$schema: "https://json-schema.org/draft/2020-12/schema",
+	metaSchema: "${SERVER_URL}/user-schema.json",
+	$id: "${USER_SCHEMA_URL}",
+	objectType: "human-user",
+	kind: "user-schema",
+	type: "object",
+	description: "The default editable schema for human users.",
+	"x-auth-methods": {
+		"password": {
+			"enabled": true,
+			"position": 1
+		},
+		"passkey": {
+			"enabled": true,
+			"position": 2
+		}
+	},
+	required: ["email"],
+	properties: {
+		"email": {
+			"type": "string",
+			"format": "email",
+			"x-unique": "project",
+			"description": "The user's email address."
+		},
+		"givenName": {
+			"type": "string",
+			"maxLength": 50,
+			"description": "The user's given (first) name."
+		},
+		"familyName": {
+			"type": "string",
+			"maxLength": 50,
+			"description": "The user's family (last) name."
+		},
+		"dateOfBirth": {
+			"type": "string",
+			"format": "date",
+			"description": "The user's date of birth (ISO 8601, YYYY-MM-DD)."
+		}
+	}
+};
+//#endregion
+//#region defaults/default-login.json
+var default_login_default = {
+	name: "default-login",
+	status: "active",
+	user_schema: "${USER_SCHEMA_URL}",
+	purposes: {
+		"login": "identifier",
+		"register": "register"
+	},
+	steps: [
+		{
+			"name": "identifier",
+			"fields": ["email"],
+			"actions": [{
+				"name": "submit",
+				"kind": "submit",
+				"primary": true,
+				"text_key": "identifier.action.continue"
+			}, {
+				"name": "passkey",
+				"kind": "passkey",
+				"primary": false,
+				"text_key": "identifier.action.passkey"
+			}],
+			"transitions": {
+				"submit": { "target": "password" },
+				"passkey": { "target": "done" },
+				"user_not_found": { "target": "register" }
+			}
+		},
+		{
+			"name": "password",
+			"fields": ["x-auth-methods#password"],
+			"actions": [{
+				"name": "submit",
+				"kind": "submit",
+				"primary": true,
+				"text_key": "password.action.signin"
+			}, {
+				"name": "passkey",
+				"kind": "passkey",
+				"primary": false,
+				"text_key": "password.action.passkey"
+			}],
+			"transitions": {
+				"submit": { "target": "done" },
+				"passkey": { "target": "done" }
+			}
+		},
+		{
+			"name": "register",
+			"fields": [
+				"email",
+				"givenName",
+				"familyName",
+				"dateOfBirth"
+			],
+			"actions": [{
+				"name": "submit",
+				"kind": "submit",
+				"primary": true,
+				"text_key": "register.action.password"
+			}, {
+				"name": "passkey_register",
+				"kind": "passkey_register",
+				"primary": false,
+				"text_key": "register.action.passkey"
+			}],
+			"transitions": {
+				"submit": { "target": "register-password" },
+				"passkey_register": { "target": "done" },
+				"user_already_exists": { "target": "password" }
+			}
+		},
+		{
+			"name": "register-password",
+			"fields": ["x-auth-methods#password"],
+			"actions": [{
+				"name": "submit",
+				"kind": "submit",
+				"primary": true,
+				"text_key": "register-password.action.submit"
+			}],
+			"on_success": "create_user",
+			"transitions": {
+				"submit": { "target": "done" },
+				"user_already_exists": { "target": "password" }
+			}
+		},
+		{
+			"name": "done",
+			"complete": "show"
+		}
+	]
+};
+//#endregion
+//#region src/readmes.ts
+/**
+* README content the CLI copies to `.zitadel/schemas/README.md` during setup.
+* Source of truth is `packages/config/defaults/README-schemas.md`; the Go
+* server-side embed reads the same file (see `defaults.go`).
+*/
+function schemasReadmeContent() {
+	return readFileSync(readmeUrl("README-schemas.md"), "utf8");
+}
+/**
+* README content the CLI copies to `.zitadel/flows/README.md` during setup.
+* Source of truth is `packages/config/defaults/README-flows.md`.
+*/
+function flowsReadmeContent() {
+	return readFileSync(readmeUrl("README-flows.md"), "utf8");
+}
+function readmeUrl(filename) {
+	return fileURLToPath(new URL(`../defaults/${filename}`, import.meta.url));
+}
+//#endregion
+//#region src/defaults.ts
+const DEFAULT_BUILTIN_SCHEMA_BASE = "https://nextgen.com/api/schemas";
+const DEFAULT_FLOW_SCHEMA_URI = "https://nextgen.com/flow-definition.json";
+const DEFAULT_SCHEMA_CONFIG_PATH = ".zitadel/schemas/default-human-user.json";
+const DEFAULT_FLOW_CONFIG_PATH = ".zitadel/flows/default-login.json";
+function defaultHumanUserSchemaUrl(builtinSchemaBase = DEFAULT_BUILTIN_SCHEMA_BASE) {
+	return `${trimTrailingSlash(builtinSchemaBase)}/default-human-user.json`;
+}
+function getDefaultHumanUserSchema(options = {}) {
+	const builtinSchemaBase = trimTrailingSlash(options.builtinSchemaBase ?? "https://nextgen.com/api/schemas");
+	return renderTemplate(default_human_user_default, {
+		SERVER_URL: builtinSchemaBase,
+		USER_SCHEMA_URL: options.userSchemaUrl ?? defaultHumanUserSchemaUrl(builtinSchemaBase)
+	});
+}
+function getDefaultLoginFlow(options = {}) {
+	const builtinSchemaBase = trimTrailingSlash(options.builtinSchemaBase ?? "https://nextgen.com/api/schemas");
+	return renderTemplate(default_login_default, {
+		SERVER_URL: builtinSchemaBase,
+		USER_SCHEMA_URL: options.userSchemaUrl ?? defaultHumanUserSchemaUrl(builtinSchemaBase)
+	});
+}
+function renderTemplate(value, replacements) {
+	if (Array.isArray(value)) return value.map((item) => renderTemplate(item, replacements));
+	if (value !== null && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, renderTemplate(item, replacements)]));
+	if (typeof value === "string") return value.replaceAll(/\$\{([A-Z_]+)\}/g, (match, name) => {
+		return replacements[name] ?? match;
+	});
+	return value;
+}
+function trimTrailingSlash(value) {
+	return value.replace(/\/+$/u, "");
+}
+//#endregion
+export { defaultHumanUserSchemaUrl as a, flowsReadmeContent as c, DEFAULT_SCHEMA_CONFIG_PATH as i, schemasReadmeContent as l, DEFAULT_FLOW_CONFIG_PATH as n, getDefaultHumanUserSchema as o, DEFAULT_FLOW_SCHEMA_URI as r, getDefaultLoginFlow as s, DEFAULT_BUILTIN_SCHEMA_BASE as t };
+
+//# sourceMappingURL=defaults-B2iIPSSl.mjs.map

package/dist/defaults-B2iIPSSl.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults-B2iIPSSl.mjs","names":["defaultHumanUserSchemaTemplate","defaultLoginFlowTemplate"],"sources":["../defaults/default-human-user.json","../defaults/default-login.json","../src/readmes.ts","../src/defaults.ts"],"sourcesContent":["","","import { readFileSync } from \"node:fs\";\nimport { fileURLToPath } from \"node:url\";\n\n/**\n * README content the CLI copies to `.zitadel/schemas/README.md` during setup.\n * Source of truth is `packages/config/defaults/README-schemas.md`; the Go\n * server-side embed reads the same file (see `defaults.go`).\n */\nexport function schemasReadmeContent(): string {\n  return readFileSync(readmeUrl(\"README-schemas.md\"), \"utf8\");\n}\n\n/**\n * README content the CLI copies to `.zitadel/flows/README.md` during setup.\n * Source of truth is `packages/config/defaults/README-flows.md`.\n */\nexport function flowsReadmeContent(): string {\n  return readFileSync(readmeUrl(\"README-flows.md\"), \"utf8\");\n}\n\nfunction readmeUrl(filename: string): string {\n  return fileURLToPath(new URL(`../defaults/${filename}`, import.meta.url));\n}\n","import type {\n  CreateFlowDefinitionBodyFlowDefinition,\n  CreateSchemaBody,\n} from \"@zitadel/api/generated/model\";\n\nimport defaultHumanUserSchemaTemplate from \"../defaults/default-human-user.json\" with {\n  type: \"json\",\n};\nimport defaultLoginFlowTemplate from \"../defaults/default-login.json\" with {\n  type: \"json\",\n};\n\nexport { flowsReadmeContent, schemasReadmeContent } from \"./readmes.js\";\n\nexport const DEFAULT_BUILTIN_SCHEMA_BASE = \"https://nextgen.com/api/schemas\";\nexport const DEFAULT_FLOW_SCHEMA_URI = \"https://nextgen.com/flow-definition.json\";\nexport const DEFAULT_SCHEMA_CONFIG_PATH = \".zitadel/schemas/default-human-user.json\";\nexport const DEFAULT_FLOW_CONFIG_PATH = \".zitadel/flows/default-login.json\";\n\nexport type DefaultConfigRenderOptions = {\n  builtinSchemaBase?: string;\n  userSchemaUrl?: string;\n};\n\nexport function defaultHumanUserSchemaUrl(\n  builtinSchemaBase = DEFAULT_BUILTIN_SCHEMA_BASE,\n): string {\n  return `${trimTrailingSlash(builtinSchemaBase)}/default-human-user.json`;\n}\n\nexport function getDefaultHumanUserSchema(\n  options: DefaultConfigRenderOptions = {},\n): CreateSchemaBody {\n  const builtinSchemaBase = trimTrailingSlash(\n    options.builtinSchemaBase ?? DEFAULT_BUILTIN_SCHEMA_BASE,\n  );\n  return renderTemplate(defaultHumanUserSchemaTemplate, {\n    SERVER_URL: builtinSchemaBase,\n    USER_SCHEMA_URL: options.userSchemaUrl ?? defaultHumanUserSchemaUrl(builtinSchemaBase),\n  }) as CreateSchemaBody;\n}\n\nexport function getDefaultLoginFlow(\n  options: DefaultConfigRenderOptions = {},\n): CreateFlowDefinitionBodyFlowDefinition {\n  const builtinSchemaBase = trimTrailingSlash(\n    options.builtinSchemaBase ?? DEFAULT_BUILTIN_SCHEMA_BASE,\n  );\n  return renderTemplate(defaultLoginFlowTemplate, {\n    SERVER_URL: builtinSchemaBase,\n    USER_SCHEMA_URL: options.userSchemaUrl ?? defaultHumanUserSchemaUrl(builtinSchemaBase),\n  }) as CreateFlowDefinitionBodyFlowDefinition;\n}\n\nfunction renderTemplate(value: unknown, replacements: Record<string, string>): unknown {\n  if (Array.isArray(value)) {\n    return value.map((item) => renderTemplate(item, replacements));\n  }\n  if (value !== null && typeof value === \"object\") {\n    return Object.fromEntries(\n      Object.entries(value).map(([key, item]) => [key, renderTemplate(item, replacements)]),\n    );\n  }\n  if (typeof value === \"string\") {\n    return value.replaceAll(/\\$\\{([A-Z_]+)\\}/g, (match, name: string) => {\n      return replacements[name] ?? match;\n    });\n  }\n  return value;\n}\n\nfunction trimTrailingSlash(value: string): string {\n  return value.replace(/\\/+$/u, \"\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AEQA,SAAgB,uBAA+B;AAC7C,QAAO,aAAa,UAAU,oBAAoB,EAAE,OAAO;;;;;;AAO7D,SAAgB,qBAA6B;AAC3C,QAAO,aAAa,UAAU,kBAAkB,EAAE,OAAO;;AAG3D,SAAS,UAAU,UAA0B;AAC3C,QAAO,cAAc,IAAI,IAAI,eAAe,YAAY,OAAO,KAAK,IAAI,CAAC;;;;ACP3E,MAAa,8BAA8B;AAC3C,MAAa,0BAA0B;AACvC,MAAa,6BAA6B;AAC1C,MAAa,2BAA2B;AAOxC,SAAgB,0BACd,oBAAoB,6BACZ;AACR,QAAO,GAAG,kBAAkB,kBAAkB,CAAC;;AAGjD,SAAgB,0BACd,UAAsC,EAAE,EACtB;CAClB,MAAM,oBAAoB,kBACxB,QAAQ,qBAAA,kCACT;AACD,QAAO,eAAeA,4BAAgC;EACpD,YAAY;EACZ,iBAAiB,QAAQ,iBAAiB,0BAA0B,kBAAkB;EACvF,CAAC;;AAGJ,SAAgB,oBACd,UAAsC,EAAE,EACA;CACxC,MAAM,oBAAoB,kBACxB,QAAQ,qBAAA,kCACT;AACD,QAAO,eAAeC,uBAA0B;EAC9C,YAAY;EACZ,iBAAiB,QAAQ,iBAAiB,0BAA0B,kBAAkB;EACvF,CAAC;;AAGJ,SAAS,eAAe,OAAgB,cAA+C;AACrF,KAAI,MAAM,QAAQ,MAAM,CACtB,QAAO,MAAM,KAAK,SAAS,eAAe,MAAM,aAAa,CAAC;AAEhE,KAAI,UAAU,QAAQ,OAAO,UAAU,SACrC,QAAO,OAAO,YACZ,OAAO,QAAQ,MAAM,CAAC,KAAK,CAAC,KAAK,UAAU,CAAC,KAAK,eAAe,MAAM,aAAa,CAAC,CAAC,CACtF;AAEH,KAAI,OAAO,UAAU,SACnB,QAAO,MAAM,WAAW,qBAAqB,OAAO,SAAiB;AACnE,SAAO,aAAa,SAAS;GAC7B;AAEJ,QAAO;;AAGT,SAAS,kBAAkB,OAAuB;AAChD,QAAO,MAAM,QAAQ,SAAS,GAAG"}

package/dist/defaults-DzfOT2_7.d.mts

@@ -0,0 +1,30 @@
+import { CreateFlowDefinitionBodyFlowDefinition, CreateSchemaBody } from "@zitadel/api/generated/model";
+
+//#region src/readmes.d.ts
+/**
+ * README content the CLI copies to `.zitadel/schemas/README.md` during setup.
+ * Source of truth is `packages/config/defaults/README-schemas.md`; the Go
+ * server-side embed reads the same file (see `defaults.go`).
+ */
+declare function schemasReadmeContent(): string;
+/**
+ * README content the CLI copies to `.zitadel/flows/README.md` during setup.
+ * Source of truth is `packages/config/defaults/README-flows.md`.
+ */
+declare function flowsReadmeContent(): string;
+//#endregion
+//#region src/defaults.d.ts
+declare const DEFAULT_BUILTIN_SCHEMA_BASE = "https://nextgen.com/api/schemas";
+declare const DEFAULT_FLOW_SCHEMA_URI = "https://nextgen.com/flow-definition.json";
+declare const DEFAULT_SCHEMA_CONFIG_PATH = ".zitadel/schemas/default-human-user.json";
+declare const DEFAULT_FLOW_CONFIG_PATH = ".zitadel/flows/default-login.json";
+type DefaultConfigRenderOptions = {
+  builtinSchemaBase?: string;
+  userSchemaUrl?: string;
+};
+declare function defaultHumanUserSchemaUrl(builtinSchemaBase?: string): string;
+declare function getDefaultHumanUserSchema(options?: DefaultConfigRenderOptions): CreateSchemaBody;
+declare function getDefaultLoginFlow(options?: DefaultConfigRenderOptions): CreateFlowDefinitionBodyFlowDefinition;
+//#endregion
+export { DefaultConfigRenderOptions as a, getDefaultLoginFlow as c, DEFAULT_SCHEMA_CONFIG_PATH as i, flowsReadmeContent as l, DEFAULT_FLOW_CONFIG_PATH as n, defaultHumanUserSchemaUrl as o, DEFAULT_FLOW_SCHEMA_URI as r, getDefaultHumanUserSchema as s, DEFAULT_BUILTIN_SCHEMA_BASE as t, schemasReadmeContent as u };
+//# sourceMappingURL=defaults-DzfOT2_7.d.mts.map

package/dist/defaults-DzfOT2_7.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults-DzfOT2_7.d.mts","names":[],"sources":["../src/readmes.ts","../src/defaults.ts"],"mappings":";;;;;;AAQA;;iBAAgB,oBAAA,CAAA;;;AAQhB;;iBAAgB,kBAAA,CAAA;;;cCFH,2BAAA;AAAA,cACA,uBAAA;AAAA,cACA,0BAAA;AAAA,cACA,wBAAA;AAAA,KAED,0BAAA;EACV,iBAAA;EACA,aAAA;AAAA;AAAA,iBAGc,yBAAA,CACd,iBAAA;AAAA,iBAKc,yBAAA,CACd,OAAA,GAAS,0BAAA,GACR,gBAAA;AAAA,iBAUa,mBAAA,CACd,OAAA,GAAS,0BAAA,GACR,sCAAA"}

package/dist/defaults.d.mts

@@ -0,0 +1,2 @@
+import { a as DefaultConfigRenderOptions, c as getDefaultLoginFlow, i as DEFAULT_SCHEMA_CONFIG_PATH, l as flowsReadmeContent, n as DEFAULT_FLOW_CONFIG_PATH, o as defaultHumanUserSchemaUrl, r as DEFAULT_FLOW_SCHEMA_URI, s as getDefaultHumanUserSchema, t as DEFAULT_BUILTIN_SCHEMA_BASE, u as schemasReadmeContent } from "./defaults-DzfOT2_7.mjs";
+export { DEFAULT_BUILTIN_SCHEMA_BASE, DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, DefaultConfigRenderOptions, defaultHumanUserSchemaUrl, flowsReadmeContent, getDefaultHumanUserSchema, getDefaultLoginFlow, schemasReadmeContent };

package/dist/defaults.mjs

@@ -0,0 +1,2 @@
+import { a as defaultHumanUserSchemaUrl, c as flowsReadmeContent, i as DEFAULT_SCHEMA_CONFIG_PATH, l as schemasReadmeContent, n as DEFAULT_FLOW_CONFIG_PATH, o as getDefaultHumanUserSchema, r as DEFAULT_FLOW_SCHEMA_URI, s as getDefaultLoginFlow, t as DEFAULT_BUILTIN_SCHEMA_BASE } from "./defaults-B2iIPSSl.mjs";
+export { DEFAULT_BUILTIN_SCHEMA_BASE, DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, defaultHumanUserSchemaUrl, flowsReadmeContent, getDefaultHumanUserSchema, getDefaultLoginFlow, schemasReadmeContent };

package/dist/index.d.mts

@@ -0,0 +1,4 @@
+import { a as DefaultConfigRenderOptions, c as getDefaultLoginFlow, i as DEFAULT_SCHEMA_CONFIG_PATH, l as flowsReadmeContent, n as DEFAULT_FLOW_CONFIG_PATH, o as defaultHumanUserSchemaUrl, r as DEFAULT_FLOW_SCHEMA_URI, s as getDefaultHumanUserSchema, t as DEFAULT_BUILTIN_SCHEMA_BASE, u as schemasReadmeContent } from "./defaults-DzfOT2_7.mjs";
+import { USER_PROPERTY_DEFAULTS, normalizeFlowBody, normalizeSchemaBody } from "./normalize.mjs";
+import { createFlowDefinitionRequestSchema, flowConfigSchema, schemaConfigSchema } from "./schemas.mjs";
+export { DEFAULT_BUILTIN_SCHEMA_BASE, DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, DefaultConfigRenderOptions, USER_PROPERTY_DEFAULTS, createFlowDefinitionRequestSchema, defaultHumanUserSchemaUrl, flowConfigSchema, flowsReadmeContent, getDefaultHumanUserSchema, getDefaultLoginFlow, normalizeFlowBody, normalizeSchemaBody, schemaConfigSchema, schemasReadmeContent };

package/dist/index.mjs

@@ -0,0 +1,4 @@
+import { a as defaultHumanUserSchemaUrl, c as flowsReadmeContent, i as DEFAULT_SCHEMA_CONFIG_PATH, l as schemasReadmeContent, n as DEFAULT_FLOW_CONFIG_PATH, o as getDefaultHumanUserSchema, r as DEFAULT_FLOW_SCHEMA_URI, s as getDefaultLoginFlow, t as DEFAULT_BUILTIN_SCHEMA_BASE } from "./defaults-B2iIPSSl.mjs";
+import { USER_PROPERTY_DEFAULTS, normalizeFlowBody, normalizeSchemaBody } from "./normalize.mjs";
+import { createFlowDefinitionRequestSchema, flowConfigSchema, schemaConfigSchema } from "./schemas.mjs";
+export { DEFAULT_BUILTIN_SCHEMA_BASE, DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, USER_PROPERTY_DEFAULTS, createFlowDefinitionRequestSchema, defaultHumanUserSchemaUrl, flowConfigSchema, flowsReadmeContent, getDefaultHumanUserSchema, getDefaultLoginFlow, normalizeFlowBody, normalizeSchemaBody, schemaConfigSchema, schemasReadmeContent };

package/dist/normalize.d.mts

@@ -0,0 +1,40 @@
+//#region src/normalize.d.ts
+/**
+ * Canonical-form normalizers for the two repo-config resource kinds.
+ *
+ * The sync engine compares `.zitadel/**` files against server responses;
+ * the server echoes fields the author never wrote (an empty `audience`
+ * on flows) and the meta-schema declares defaults an author may or may
+ * not spell out (`x-editable` et al on schema properties). Normalizing
+ * both sides before hashing or diffing keeps a one-field edit rendering
+ * as a one-field diff.
+ *
+ * Normalized bodies are for COMPARISON. Never upload them, and never
+ * write a normalized schema body to a file: the server stores schema
+ * bytes verbatim without materializing meta-schema defaults, so a
+ * stripped `"x-editable": true` would vanish from the next published
+ * revision. (Flow write-back may reuse {@link normalizeFlowBody} —
+ * everything it strips is pure transport noise.)
+ */
+/**
+ * Property-level defaults declared by the user-property meta-schema
+ * (`api/openapi/endpoints/schemas/user-property.json`). A property that
+ * spells one of these out is semantically identical to one that omits it.
+ */
+declare const USER_PROPERTY_DEFAULTS: Readonly<Record<string, boolean>>;
+/**
+ * Return a deep copy of a bare flow-definition body with server-echoed
+ * noise removed: an empty `audience` and any detail-envelope keys.
+ */
+declare function normalizeFlowBody(body: object): object;
+/**
+ * Return a deep copy of a user-schema body with meta-schema property
+ * defaults stripped: a property carrying `"x-editable": true` (or the
+ * other {@link USER_PROPERTY_DEFAULTS}) normalizes to one omitting it.
+ * Only exact default values are removed; `$id` and every other field
+ * pass through untouched.
+ */
+declare function normalizeSchemaBody(body: object): object;
+//#endregion
+export { USER_PROPERTY_DEFAULTS, normalizeFlowBody, normalizeSchemaBody };
+//# sourceMappingURL=normalize.d.mts.map

package/dist/normalize.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.d.mts","names":[],"sources":["../src/normalize.ts"],"mappings":";;AAuBA;;;;;AAqCA;;;;;AAkBA;;;;;;;;;;;cAvDa,sBAAA,EAAwB,QAAA,CAAS,MAAA;;;;;iBAqC9B,iBAAA,CAAkB,IAAA;;;;;;;;iBAkBlB,mBAAA,CAAoB,IAAA"}

package/dist/normalize.mjs

@@ -0,0 +1,82 @@
+//#region src/normalize.ts
+/**
+* Canonical-form normalizers for the two repo-config resource kinds.
+*
+* The sync engine compares `.zitadel/**` files against server responses;
+* the server echoes fields the author never wrote (an empty `audience`
+* on flows) and the meta-schema declares defaults an author may or may
+* not spell out (`x-editable` et al on schema properties). Normalizing
+* both sides before hashing or diffing keeps a one-field edit rendering
+* as a one-field diff.
+*
+* Normalized bodies are for COMPARISON. Never upload them, and never
+* write a normalized schema body to a file: the server stores schema
+* bytes verbatim without materializing meta-schema defaults, so a
+* stripped `"x-editable": true` would vanish from the next published
+* revision. (Flow write-back may reuse {@link normalizeFlowBody} —
+* everything it strips is pure transport noise.)
+*/
+/**
+* Property-level defaults declared by the user-property meta-schema
+* (`api/openapi/endpoints/schemas/user-property.json`). A property that
+* spells one of these out is semantically identical to one that omits it.
+*/
+const USER_PROPERTY_DEFAULTS = {
+	"x-editable": true,
+	"x-sensitive": false,
+	"x-mfa": false
+};
+/**
+* Keys of the flow-definition detail envelope. `fetch` in the flow syncer
+* already unwraps the envelope; stripping them here as well makes the
+* normalizer safe on raw detail responses.
+*/
+const FLOW_ENVELOPE_KEYS = [
+	"id",
+	"project_id",
+	"schema_uri",
+	"created_at",
+	"updated_at"
+];
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* An `audience` counts as empty when it scopes nothing: no keys, or only
+* `team_ids`/`app_ids` that are null or empty arrays. Unknown keys keep
+* the audience — better a noisy diff than a silently dropped scope.
+*/
+function isEmptyAudience(value) {
+	if (!isPlainObject(value)) return false;
+	return Object.entries(value).every(([key, entry]) => (key === "team_ids" || key === "app_ids") && (entry === null || entry === void 0 || Array.isArray(entry) && entry.length === 0));
+}
+/**
+* Return a deep copy of a bare flow-definition body with server-echoed
+* noise removed: an empty `audience` and any detail-envelope keys.
+*/
+function normalizeFlowBody(body) {
+	const result = structuredClone(body);
+	for (const key of FLOW_ENVELOPE_KEYS) delete result[key];
+	if ("audience" in result && isEmptyAudience(result.audience)) delete result.audience;
+	return result;
+}
+/**
+* Return a deep copy of a user-schema body with meta-schema property
+* defaults stripped: a property carrying `"x-editable": true` (or the
+* other {@link USER_PROPERTY_DEFAULTS}) normalizes to one omitting it.
+* Only exact default values are removed; `$id` and every other field
+* pass through untouched.
+*/
+function normalizeSchemaBody(body) {
+	const result = structuredClone(body);
+	if (!isPlainObject(result.properties)) return result;
+	for (const property of Object.values(result.properties)) {
+		if (!isPlainObject(property)) continue;
+		for (const [key, defaultValue] of Object.entries(USER_PROPERTY_DEFAULTS)) if (property[key] === defaultValue) delete property[key];
+	}
+	return result;
+}
+//#endregion
+export { USER_PROPERTY_DEFAULTS, normalizeFlowBody, normalizeSchemaBody };
+
+//# sourceMappingURL=normalize.mjs.map

package/dist/normalize.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.mjs","names":[],"sources":["../src/normalize.ts"],"sourcesContent":["/**\n * Canonical-form normalizers for the two repo-config resource kinds.\n *\n * The sync engine compares `.zitadel/**` files against server responses;\n * the server echoes fields the author never wrote (an empty `audience`\n * on flows) and the meta-schema declares defaults an author may or may\n * not spell out (`x-editable` et al on schema properties). Normalizing\n * both sides before hashing or diffing keeps a one-field edit rendering\n * as a one-field diff.\n *\n * Normalized bodies are for COMPARISON. Never upload them, and never\n * write a normalized schema body to a file: the server stores schema\n * bytes verbatim without materializing meta-schema defaults, so a\n * stripped `\"x-editable\": true` would vanish from the next published\n * revision. (Flow write-back may reuse {@link normalizeFlowBody} —\n * everything it strips is pure transport noise.)\n */\n\n/**\n * Property-level defaults declared by the user-property meta-schema\n * (`api/openapi/endpoints/schemas/user-property.json`). A property that\n * spells one of these out is semantically identical to one that omits it.\n */\nexport const USER_PROPERTY_DEFAULTS: Readonly<Record<string, boolean>> = {\n  \"x-editable\": true,\n  \"x-sensitive\": false,\n  \"x-mfa\": false,\n};\n\n/**\n * Keys of the flow-definition detail envelope. `fetch` in the flow syncer\n * already unwraps the envelope; stripping them here as well makes the\n * normalizer safe on raw detail responses.\n */\nconst FLOW_ENVELOPE_KEYS = [\"id\", \"project_id\", \"schema_uri\", \"created_at\", \"updated_at\"];\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/**\n * An `audience` counts as empty when it scopes nothing: no keys, or only\n * `team_ids`/`app_ids` that are null or empty arrays. Unknown keys keep\n * the audience — better a noisy diff than a silently dropped scope.\n */\nfunction isEmptyAudience(value: unknown): boolean {\n  if (!isPlainObject(value)) {\n    return false;\n  }\n  return Object.entries(value).every(\n    ([key, entry]) =>\n      (key === \"team_ids\" || key === \"app_ids\") &&\n      (entry === null || entry === undefined || (Array.isArray(entry) && entry.length === 0)),\n  );\n}\n\n/**\n * Return a deep copy of a bare flow-definition body with server-echoed\n * noise removed: an empty `audience` and any detail-envelope keys.\n */\nexport function normalizeFlowBody(body: object): object {\n  const result = structuredClone(body) as Record<string, unknown>;\n  for (const key of FLOW_ENVELOPE_KEYS) {\n    delete result[key];\n  }\n  if (\"audience\" in result && isEmptyAudience(result.audience)) {\n    delete result.audience;\n  }\n  return result;\n}\n\n/**\n * Return a deep copy of a user-schema body with meta-schema property\n * defaults stripped: a property carrying `\"x-editable\": true` (or the\n * other {@link USER_PROPERTY_DEFAULTS}) normalizes to one omitting it.\n * Only exact default values are removed; `$id` and every other field\n * pass through untouched.\n */\nexport function normalizeSchemaBody(body: object): object {\n  const result = structuredClone(body) as Record<string, unknown>;\n  if (!isPlainObject(result.properties)) {\n    return result;\n  }\n  for (const property of Object.values(result.properties)) {\n    if (!isPlainObject(property)) {\n      continue;\n    }\n    for (const [key, defaultValue] of Object.entries(USER_PROPERTY_DEFAULTS)) {\n      if (property[key] === defaultValue) {\n        delete property[key];\n      }\n    }\n  }\n  return result;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAuBA,MAAa,yBAA4D;CACvE,cAAc;CACd,eAAe;CACf,SAAS;CACV;;;;;;AAOD,MAAM,qBAAqB;CAAC;CAAM;CAAc;CAAc;CAAc;CAAa;AAEzF,SAAS,cAAc,OAAkD;AACvE,QAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;;;;;;AAQ7E,SAAS,gBAAgB,OAAyB;AAChD,KAAI,CAAC,cAAc,MAAM,CACvB,QAAO;AAET,QAAO,OAAO,QAAQ,MAAM,CAAC,OAC1B,CAAC,KAAK,YACJ,QAAQ,cAAc,QAAQ,eAC9B,UAAU,QAAQ,UAAU,KAAA,KAAc,MAAM,QAAQ,MAAM,IAAI,MAAM,WAAW,GACvF;;;;;;AAOH,SAAgB,kBAAkB,MAAsB;CACtD,MAAM,SAAS,gBAAgB,KAAK;AACpC,MAAK,MAAM,OAAO,mBAChB,QAAO,OAAO;AAEhB,KAAI,cAAc,UAAU,gBAAgB,OAAO,SAAS,CAC1D,QAAO,OAAO;AAEhB,QAAO;;;;;;;;;AAUT,SAAgB,oBAAoB,MAAsB;CACxD,MAAM,SAAS,gBAAgB,KAAK;AACpC,KAAI,CAAC,cAAc,OAAO,WAAW,CACnC,QAAO;AAET,MAAK,MAAM,YAAY,OAAO,OAAO,OAAO,WAAW,EAAE;AACvD,MAAI,CAAC,cAAc,SAAS,CAC1B;AAEF,OAAK,MAAM,CAAC,KAAK,iBAAiB,OAAO,QAAQ,uBAAuB,CACtE,KAAI,SAAS,SAAS,aACpB,QAAO,SAAS;;AAItB,QAAO"}

package/dist/schemas.d.mts

@@ -0,0 +1,7 @@
+//#region src/schemas.d.ts
+declare const schemaConfigSchema: any;
+declare const flowConfigSchema: any;
+declare const createFlowDefinitionRequestSchema: any;
+//#endregion
+export { createFlowDefinitionRequestSchema, flowConfigSchema, schemaConfigSchema };
+//# sourceMappingURL=schemas.d.mts.map

package/dist/schemas.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.mts","names":[],"sources":["../src/schemas.ts"],"mappings":";cAKa,kBAAA;AAAA,cACA,gBAAA;AAAA,cACA,iCAAA"}

package/dist/schemas.mjs

@@ -0,0 +1,9 @@
+import { CreateFlowDefinitionBody, CreateSchemaBody } from "@zitadel/api/generated/endpoints/zitadelNextGen.zod";
+//#region src/schemas.ts
+const schemaConfigSchema = CreateSchemaBody;
+const flowConfigSchema = CreateFlowDefinitionBody.shape.flow_definition;
+const createFlowDefinitionRequestSchema = CreateFlowDefinitionBody;
+//#endregion
+export { createFlowDefinitionRequestSchema, flowConfigSchema, schemaConfigSchema };
+
+//# sourceMappingURL=schemas.mjs.map

package/dist/schemas.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.mjs","names":[],"sources":["../src/schemas.ts"],"sourcesContent":["import {\n  CreateFlowDefinitionBody,\n  CreateSchemaBody,\n} from \"@zitadel/api/generated/endpoints/zitadelNextGen.zod\";\n\nexport const schemaConfigSchema = CreateSchemaBody;\nexport const flowConfigSchema = CreateFlowDefinitionBody.shape.flow_definition;\nexport const createFlowDefinitionRequestSchema = CreateFlowDefinitionBody;\n"],"mappings":";;AAKA,MAAa,qBAAqB;AAClC,MAAa,mBAAmB,yBAAyB,MAAM;AAC/D,MAAa,oCAAoC"}

package/package.json

@@ -1,10 +1,64 @@
 {
   "name": "@zitadel/config",
-  "version": "0.0.0",
-  "description": "Bootstrap placeholder for npm trusted publishing setup.",
+  "version": "0.1.0-alpha.15",
+  "description": "Versioned Zitadel local config schemas and defaults",
+  "homepage": "https://github.com/zitadel/nextgen/tree/main/packages/config#readme",
+  "bugs": {
+    "url": "https://github.com/zitadel/nextgen/issues"
+  },
   "license": "MIT",
-  "private": false,
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/zitadel/nextgen.git",
+    "directory": "packages/config"
+  },
+  "files": [
+    "dist",
+    "defaults/*.json",
+    "defaults/*.md",
+    "LICENSE"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "@zitadel/source": "./src/index.ts",
+      "types": "./dist/index.d.mts",
+      "import": "./dist/index.mjs"
+    },
+    "./defaults": {
+      "@zitadel/source": "./src/defaults.ts",
+      "types": "./dist/defaults.d.mts",
+      "import": "./dist/defaults.mjs"
+    },
+    "./schemas": {
+      "@zitadel/source": "./src/schemas.ts",
+      "types": "./dist/schemas.d.mts",
+      "import": "./dist/schemas.mjs"
+    },
+    "./normalize": {
+      "@zitadel/source": "./src/normalize.ts",
+      "types": "./dist/normalize.d.mts",
+      "import": "./dist/normalize.mjs"
+    },
+    "./defaults/default-human-user.json": "./defaults/default-human-user.json",
+    "./defaults/default-login.json": "./defaults/default-login.json",
+    "./package.json": "./package.json"
+  },
   "publishConfig": {
     "access": "public"
+  },
+  "dependencies": {
+    "@zitadel/api": "0.1.0-alpha.15"
+  },
+  "devDependencies": {
+    "tsdown": "^0.21.10",
+    "tslib": "^2.8.1",
+    "vitest": "^4.1.7"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "typecheck": "tsc --noEmit -p tsconfig.json",
+    "test": "vitest run --passWithNoTests",
+    "lint": "oxlint ."
   }
-}
+}

package/README.md

@@ -1,3 +0,0 @@
-# @zitadel/config
-
-Bootstrap placeholder. Use a released alpha version.