@zitadel/config 0.1.0-alpha.15 → 0.1.0-alpha.16

package/defaults/README-flows.md

@@ -40,7 +40,49 @@ Typical edits:
   different next step, or use `action: switch` / `pivot` to jump to
   another flow.
 - **Add another flow** — drop a new JSON file with its own `purposes`
-  and `audience` (e.g. a per-team login).
+  and a distinct `name` (e.g. a per-team login). See
+  [Multiple flows](#multiple-flows) for how it gets selected at runtime.
+
+## Multiple flows
+
+All files in this folder sync on `apply`, but the widget runs exactly
+one flow per sign-in. Which one:
+
+- **By name** — give the flow a distinct `name` and pass it as
+  `flowName` on `ZitadelLogin` (the `flow-name` attribute on
+  `<zitadel-login>`). The platform resolves that definition directly;
+  an unknown name or wrong purpose surfaces as a startup error in the
+  widget.
+- **By audience** — omit `flowName` and scope the flow with
+  `audience.app_ids` / `audience.team_ids`. A start request hinting one
+  of those ids gets the scoped flow (app match beats team match); all
+  other requests get the newest flow without an `audience`.
+
+A flow scoped to an app or team never captures the project default —
+requests that don't identify that audience fall back to the unscoped
+flow.
+
+The flip side: a **new active flow without an `audience` becomes the
+newest unscoped definition, i.e. the default**, the moment it applies.
+`plan` calls this out with a `# warning:` line on the create so an
+experiment can't silently take over `/login` — scope it or pin
+`flow-name` in the widget if that isn't the intent.
+
+## Presets
+
+`zitadel setup` scaffolds this folder from a preset (`--preset
+password-first` or `--preset passkey-first`). The passkey-first flow
+enters login on a fields-less passkey step with an email → password
+fallback path. The preset only decides the starting point — edit
+anything here afterwards.
+
+## Presets
+
+`zitadel setup` scaffolds this folder from a preset (`--preset
+password-first` or `--preset passkey-first`). The passkey-first flow
+enters login on a fields-less passkey step with an email → password
+fallback path. The preset only decides the starting point — edit
+anything here afterwards.
 
 ## Schema revisions
 

package/defaults/README-schemas.md

@@ -124,6 +124,12 @@ Set `"passkey": { "enabled": true }` in `x-auth-methods`.
 
 Create another JSON file in this directory.
 
+## Start from a different preset
+
+`zitadel setup` scaffolds this folder from a preset (`--preset
+password-first` or `--preset passkey-first`). The preset only decides the
+starting point — everything in it is editable afterwards.
+
 ------------------------------------------------------------------------
 
 ## Next step

package/defaults/default-login.json

@@ -1,4 +1,5 @@
 {
+  "$schema": "../meta/flow-definition.json",
   "name": "default-login",
   "status": "active",
   "user_schema": "${USER_SCHEMA_URL}",

package/defaults/presets/passkey-first/human-user.json

@@ -0,0 +1,46 @@
+{
+  "title": "DefaultHumanUserSchema",
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "metaSchema": "${SERVER_URL}/user-schema.json",
+  "$id": "${USER_SCHEMA_URL}",
+  "objectType": "human-user",
+  "kind": "user-schema",
+  "type": "object",
+  "description": "The default editable schema for human users (passkey-first sign-in).",
+  "x-auth-methods": {
+    "passkey": {
+      "enabled": true,
+      "position": 1
+    },
+    "password": {
+      "enabled": true,
+      "position": 2
+    }
+  },
+  "required": [
+    "email"
+  ],
+  "properties": {
+    "email": {
+      "type": "string",
+      "format": "email",
+      "x-unique": "project",
+      "description": "The user's email address."
+    },
+    "givenName": {
+      "type": "string",
+      "maxLength": 50,
+      "description": "The user's given (first) name."
+    },
+    "familyName": {
+      "type": "string",
+      "maxLength": 50,
+      "description": "The user's family (last) name."
+    },
+    "dateOfBirth": {
+      "type": "string",
+      "format": "date",
+      "description": "The user's date of birth (ISO 8601, YYYY-MM-DD)."
+    }
+  }
+}

package/defaults/presets/passkey-first/login.json

@@ -0,0 +1,161 @@
+{
+  "$schema": "../meta/flow-definition.json",
+  "name": "default-login",
+  "status": "active",
+  "user_schema": "${USER_SCHEMA_URL}",
+  "purposes": {
+    "login": "passkey-first",
+    "register": "register"
+  },
+  "steps": [
+    {
+      "name": "passkey-first",
+      "fields": [],
+      "actions": [
+        {
+          "name": "passkey",
+          "kind": "passkey",
+          "primary": true,
+          "text_key": "passkey-first.action.passkey"
+        },
+        {
+          "name": "email_fallback",
+          "kind": "navigate",
+          "primary": false,
+          "text_key": "passkey-first.action.email_fallback"
+        }
+      ],
+      "transitions": {
+        "passkey": {
+          "target": "done"
+        },
+        "email_fallback": {
+          "target": "identifier"
+        },
+        "user_not_found": {
+          "target": "register"
+        }
+      }
+    },
+    {
+      "name": "identifier",
+      "fields": [
+        "email"
+      ],
+      "actions": [
+        {
+          "name": "submit",
+          "kind": "submit",
+          "primary": true,
+          "text_key": "identifier.action.continue"
+        },
+        {
+          "name": "passkey",
+          "kind": "passkey",
+          "primary": false,
+          "text_key": "identifier.action.passkey"
+        }
+      ],
+      "transitions": {
+        "submit": {
+          "target": "password"
+        },
+        "passkey": {
+          "target": "done"
+        },
+        "user_not_found": {
+          "target": "register"
+        }
+      }
+    },
+    {
+      "name": "password",
+      "fields": [
+        "x-auth-methods#password"
+      ],
+      "actions": [
+        {
+          "name": "submit",
+          "kind": "submit",
+          "primary": true,
+          "text_key": "password.action.signin"
+        },
+        {
+          "name": "passkey",
+          "kind": "passkey",
+          "primary": false,
+          "text_key": "password.action.passkey"
+        }
+      ],
+      "transitions": {
+        "submit": {
+          "target": "done"
+        },
+        "passkey": {
+          "target": "done"
+        }
+      }
+    },
+    {
+      "name": "register",
+      "fields": [
+        "email",
+        "givenName",
+        "familyName",
+        "dateOfBirth"
+      ],
+      "actions": [
+        {
+          "name": "passkey_register",
+          "kind": "passkey_register",
+          "primary": true,
+          "text_key": "register.action.passkey"
+        },
+        {
+          "name": "submit",
+          "kind": "submit",
+          "primary": false,
+          "text_key": "register.action.password"
+        }
+      ],
+      "transitions": {
+        "passkey_register": {
+          "target": "done"
+        },
+        "submit": {
+          "target": "register-password"
+        },
+        "user_already_exists": {
+          "target": "password"
+        }
+      }
+    },
+    {
+      "name": "register-password",
+      "fields": [
+        "x-auth-methods#password"
+      ],
+      "actions": [
+        {
+          "name": "submit",
+          "kind": "submit",
+          "primary": true,
+          "text_key": "register-password.action.submit"
+        }
+      ],
+      "on_success": "create_user",
+      "transitions": {
+        "submit": {
+          "target": "done"
+        },
+        "user_already_exists": {
+          "target": "password"
+        }
+      }
+    },
+    {
+      "name": "done",
+      "complete": "show"
+    }
+  ]
+}

package/dist/{defaults-B2iIPSSl.mjs → defaults-BQej3KIY.mjs}

@@ -48,6 +48,7 @@ var default_human_user_default = {
 //#endregion
 //#region defaults/default-login.json
 var default_login_default = {
+	$schema: "../meta/flow-definition.json",
 	name: "default-login",
 	status: "active",
 	user_schema: "${USER_SCHEMA_URL}",
@@ -142,6 +143,169 @@ var default_login_default = {
 	]
 };
 //#endregion
+//#region defaults/presets/passkey-first/human-user.json
+var human_user_default = {
+	title: "DefaultHumanUserSchema",
+	$schema: "https://json-schema.org/draft/2020-12/schema",
+	metaSchema: "${SERVER_URL}/user-schema.json",
+	$id: "${USER_SCHEMA_URL}",
+	objectType: "human-user",
+	kind: "user-schema",
+	type: "object",
+	description: "The default editable schema for human users (passkey-first sign-in).",
+	"x-auth-methods": {
+		"passkey": {
+			"enabled": true,
+			"position": 1
+		},
+		"password": {
+			"enabled": true,
+			"position": 2
+		}
+	},
+	required: ["email"],
+	properties: {
+		"email": {
+			"type": "string",
+			"format": "email",
+			"x-unique": "project",
+			"description": "The user's email address."
+		},
+		"givenName": {
+			"type": "string",
+			"maxLength": 50,
+			"description": "The user's given (first) name."
+		},
+		"familyName": {
+			"type": "string",
+			"maxLength": 50,
+			"description": "The user's family (last) name."
+		},
+		"dateOfBirth": {
+			"type": "string",
+			"format": "date",
+			"description": "The user's date of birth (ISO 8601, YYYY-MM-DD)."
+		}
+	}
+};
+//#endregion
+//#region defaults/presets/passkey-first/login.json
+var login_default = {
+	$schema: "../meta/flow-definition.json",
+	name: "default-login",
+	status: "active",
+	user_schema: "${USER_SCHEMA_URL}",
+	purposes: {
+		"login": "passkey-first",
+		"register": "register"
+	},
+	steps: [
+		{
+			"name": "passkey-first",
+			"fields": [],
+			"actions": [{
+				"name": "passkey",
+				"kind": "passkey",
+				"primary": true,
+				"text_key": "passkey-first.action.passkey"
+			}, {
+				"name": "email_fallback",
+				"kind": "navigate",
+				"primary": false,
+				"text_key": "passkey-first.action.email_fallback"
+			}],
+			"transitions": {
+				"passkey": { "target": "done" },
+				"email_fallback": { "target": "identifier" },
+				"user_not_found": { "target": "register" }
+			}
+		},
+		{
+			"name": "identifier",
+			"fields": ["email"],
+			"actions": [{
+				"name": "submit",
+				"kind": "submit",
+				"primary": true,
+				"text_key": "identifier.action.continue"
+			}, {
+				"name": "passkey",
+				"kind": "passkey",
+				"primary": false,
+				"text_key": "identifier.action.passkey"
+			}],
+			"transitions": {
+				"submit": { "target": "password" },
+				"passkey": { "target": "done" },
+				"user_not_found": { "target": "register" }
+			}
+		},
+		{
+			"name": "password",
+			"fields": ["x-auth-methods#password"],
+			"actions": [{
+				"name": "submit",
+				"kind": "submit",
+				"primary": true,
+				"text_key": "password.action.signin"
+			}, {
+				"name": "passkey",
+				"kind": "passkey",
+				"primary": false,
+				"text_key": "password.action.passkey"
+			}],
+			"transitions": {
+				"submit": { "target": "done" },
+				"passkey": { "target": "done" }
+			}
+		},
+		{
+			"name": "register",
+			"fields": [
+				"email",
+				"givenName",
+				"familyName",
+				"dateOfBirth"
+			],
+			"actions": [{
+				"name": "passkey_register",
+				"kind": "passkey_register",
+				"primary": true,
+				"text_key": "register.action.passkey"
+			}, {
+				"name": "submit",
+				"kind": "submit",
+				"primary": false,
+				"text_key": "register.action.password"
+			}],
+			"transitions": {
+				"passkey_register": { "target": "done" },
+				"submit": { "target": "register-password" },
+				"user_already_exists": { "target": "password" }
+			}
+		},
+		{
+			"name": "register-password",
+			"fields": ["x-auth-methods#password"],
+			"actions": [{
+				"name": "submit",
+				"kind": "submit",
+				"primary": true,
+				"text_key": "register-password.action.submit"
+			}],
+			"on_success": "create_user",
+			"transitions": {
+				"submit": { "target": "done" },
+				"user_already_exists": { "target": "password" }
+			}
+		},
+		{
+			"name": "done",
+			"complete": "show"
+		}
+	]
+};
+//#endregion
 //#region src/readmes.ts
 /**
 * README content the CLI copies to `.zitadel/schemas/README.md` during setup.
@@ -167,19 +331,42 @@ const DEFAULT_BUILTIN_SCHEMA_BASE = "https://nextgen.com/api/schemas";
 const DEFAULT_FLOW_SCHEMA_URI = "https://nextgen.com/flow-definition.json";
 const DEFAULT_SCHEMA_CONFIG_PATH = ".zitadel/schemas/default-human-user.json";
 const DEFAULT_FLOW_CONFIG_PATH = ".zitadel/flows/default-login.json";
+/**
+* Named schema+flow bundles `zitadel setup` can scaffold (#448: the prompt
+* fires before any `.zitadel/` file is written; each preset maps to a
+* pre-defined bundle the CLI copies on first setup). `password-first` is
+* today's default; `passkey-first` puts a passkey ceremony on the login
+* entry step with an email→password fallback path.
+*/
+const SETUP_PRESETS = ["password-first", "passkey-first"];
+const DEFAULT_SETUP_PRESET = "password-first";
+const PRESET_TEMPLATES = {
+	"password-first": {
+		schema: default_human_user_default,
+		flow: default_login_default
+	},
+	"passkey-first": {
+		schema: human_user_default,
+		flow: login_default
+	}
+};
+function presetTemplates(preset) {
+	if (!Object.hasOwn(PRESET_TEMPLATES, preset)) throw new Error(`unknown setup preset ${JSON.stringify(preset)} (known presets: ${SETUP_PRESETS.join(", ")})`);
+	return PRESET_TEMPLATES[preset];
+}
 function defaultHumanUserSchemaUrl(builtinSchemaBase = DEFAULT_BUILTIN_SCHEMA_BASE) {
 	return `${trimTrailingSlash(builtinSchemaBase)}/default-human-user.json`;
 }
 function getDefaultHumanUserSchema(options = {}) {
 	const builtinSchemaBase = trimTrailingSlash(options.builtinSchemaBase ?? "https://nextgen.com/api/schemas");
-	return renderTemplate(default_human_user_default, {
+	return renderTemplate(presetTemplates(options.preset ?? "password-first").schema, {
 		SERVER_URL: builtinSchemaBase,
 		USER_SCHEMA_URL: options.userSchemaUrl ?? defaultHumanUserSchemaUrl(builtinSchemaBase)
 	});
 }
 function getDefaultLoginFlow(options = {}) {
 	const builtinSchemaBase = trimTrailingSlash(options.builtinSchemaBase ?? "https://nextgen.com/api/schemas");
-	return renderTemplate(default_login_default, {
+	return renderTemplate(presetTemplates(options.preset ?? "password-first").flow, {
 		SERVER_URL: builtinSchemaBase,
 		USER_SCHEMA_URL: options.userSchemaUrl ?? defaultHumanUserSchemaUrl(builtinSchemaBase)
 	});
@@ -196,6 +383,6 @@ function trimTrailingSlash(value) {
 	return value.replace(/\/+$/u, "");
 }
 //#endregion
-export { defaultHumanUserSchemaUrl as a, flowsReadmeContent as c, DEFAULT_SCHEMA_CONFIG_PATH as i, schemasReadmeContent as l, DEFAULT_FLOW_CONFIG_PATH as n, getDefaultHumanUserSchema as o, DEFAULT_FLOW_SCHEMA_URI as r, getDefaultLoginFlow as s, DEFAULT_BUILTIN_SCHEMA_BASE as t };
+export { DEFAULT_SETUP_PRESET as a, getDefaultHumanUserSchema as c, schemasReadmeContent as d, DEFAULT_SCHEMA_CONFIG_PATH as i, getDefaultLoginFlow as l, DEFAULT_FLOW_CONFIG_PATH as n, SETUP_PRESETS as o, DEFAULT_FLOW_SCHEMA_URI as r, defaultHumanUserSchemaUrl as s, DEFAULT_BUILTIN_SCHEMA_BASE as t, flowsReadmeContent as u };
 
-//# sourceMappingURL=defaults-B2iIPSSl.mjs.map
+//# sourceMappingURL=defaults-BQej3KIY.mjs.map

package/dist/defaults-BQej3KIY.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults-BQej3KIY.mjs","names":["defaultHumanUserSchemaTemplate","defaultLoginFlowTemplate","passkeyFirstHumanUserSchemaTemplate","passkeyFirstLoginFlowTemplate"],"sources":["../defaults/default-human-user.json","../defaults/default-login.json","../defaults/presets/passkey-first/human-user.json","../defaults/presets/passkey-first/login.json","../src/readmes.ts","../src/defaults.ts"],"sourcesContent":["","","","","import { readFileSync } from \"node:fs\";\nimport { fileURLToPath } from \"node:url\";\n\n/**\n * README content the CLI copies to `.zitadel/schemas/README.md` during setup.\n * Source of truth is `packages/config/defaults/README-schemas.md`; the Go\n * server-side embed reads the same file (see `defaults.go`).\n */\nexport function schemasReadmeContent(): string {\n  return readFileSync(readmeUrl(\"README-schemas.md\"), \"utf8\");\n}\n\n/**\n * README content the CLI copies to `.zitadel/flows/README.md` during setup.\n * Source of truth is `packages/config/defaults/README-flows.md`.\n */\nexport function flowsReadmeContent(): string {\n  return readFileSync(readmeUrl(\"README-flows.md\"), \"utf8\");\n}\n\nfunction readmeUrl(filename: string): string {\n  return fileURLToPath(new URL(`../defaults/${filename}`, import.meta.url));\n}\n","import type {\n  CreateFlowDefinitionBodyFlowDefinition,\n  CreateSchemaBody,\n} from \"@zitadel/api/generated/model\";\n\nimport defaultHumanUserSchemaTemplate from \"../defaults/default-human-user.json\" with {\n  type: \"json\",\n};\nimport defaultLoginFlowTemplate from \"../defaults/default-login.json\" with {\n  type: \"json\",\n};\nimport passkeyFirstHumanUserSchemaTemplate from \"../defaults/presets/passkey-first/human-user.json\" with {\n  type: \"json\",\n};\nimport passkeyFirstLoginFlowTemplate from \"../defaults/presets/passkey-first/login.json\" with {\n  type: \"json\",\n};\n\nexport { flowsReadmeContent, schemasReadmeContent } from \"./readmes.js\";\n\nexport const DEFAULT_BUILTIN_SCHEMA_BASE = \"https://nextgen.com/api/schemas\";\nexport const DEFAULT_FLOW_SCHEMA_URI = \"https://nextgen.com/flow-definition.json\";\nexport const DEFAULT_SCHEMA_CONFIG_PATH = \".zitadel/schemas/default-human-user.json\";\nexport const DEFAULT_FLOW_CONFIG_PATH = \".zitadel/flows/default-login.json\";\n\n/**\n * Named schema+flow bundles `zitadel setup` can scaffold (#448: the prompt\n * fires before any `.zitadel/` file is written; each preset maps to a\n * pre-defined bundle the CLI copies on first setup). `password-first` is\n * today's default; `passkey-first` puts a passkey ceremony on the login\n * entry step with an email→password fallback path.\n */\nexport const SETUP_PRESETS = [\"password-first\", \"passkey-first\"] as const;\n\nexport type SetupPreset = (typeof SETUP_PRESETS)[number];\n\nexport const DEFAULT_SETUP_PRESET: SetupPreset = \"password-first\";\n\nconst PRESET_TEMPLATES: Record<SetupPreset, { schema: unknown; flow: unknown }> = {\n  \"password-first\": {\n    schema: defaultHumanUserSchemaTemplate,\n    flow: defaultLoginFlowTemplate,\n  },\n  \"passkey-first\": {\n    schema: passkeyFirstHumanUserSchemaTemplate,\n    flow: passkeyFirstLoginFlowTemplate,\n  },\n};\n\nfunction presetTemplates(preset: string): { schema: unknown; flow: unknown } {\n  // Own-property check: indexing a plain object with an arbitrary string\n  // would let \"__proto__\"/\"constructor\" resolve via the prototype chain\n  // and bypass the unknown-preset error.\n  if (!Object.hasOwn(PRESET_TEMPLATES, preset)) {\n    throw new Error(\n      `unknown setup preset ${JSON.stringify(preset)} (known presets: ${SETUP_PRESETS.join(\", \")})`,\n    );\n  }\n  return PRESET_TEMPLATES[preset as SetupPreset];\n}\n\nexport type DefaultConfigRenderOptions = {\n  builtinSchemaBase?: string;\n  userSchemaUrl?: string;\n  /** Which bundle to render; defaults to {@link DEFAULT_SETUP_PRESET}. */\n  preset?: string;\n};\n\nexport function defaultHumanUserSchemaUrl(\n  builtinSchemaBase = DEFAULT_BUILTIN_SCHEMA_BASE,\n): string {\n  return `${trimTrailingSlash(builtinSchemaBase)}/default-human-user.json`;\n}\n\nexport function getDefaultHumanUserSchema(\n  options: DefaultConfigRenderOptions = {},\n): CreateSchemaBody {\n  const builtinSchemaBase = trimTrailingSlash(\n    options.builtinSchemaBase ?? DEFAULT_BUILTIN_SCHEMA_BASE,\n  );\n  return renderTemplate(presetTemplates(options.preset ?? DEFAULT_SETUP_PRESET).schema, {\n    SERVER_URL: builtinSchemaBase,\n    USER_SCHEMA_URL: options.userSchemaUrl ?? defaultHumanUserSchemaUrl(builtinSchemaBase),\n  }) as CreateSchemaBody;\n}\n\nexport function getDefaultLoginFlow(\n  options: DefaultConfigRenderOptions = {},\n): CreateFlowDefinitionBodyFlowDefinition {\n  const builtinSchemaBase = trimTrailingSlash(\n    options.builtinSchemaBase ?? DEFAULT_BUILTIN_SCHEMA_BASE,\n  );\n  return renderTemplate(presetTemplates(options.preset ?? DEFAULT_SETUP_PRESET).flow, {\n    SERVER_URL: builtinSchemaBase,\n    USER_SCHEMA_URL: options.userSchemaUrl ?? defaultHumanUserSchemaUrl(builtinSchemaBase),\n  }) as CreateFlowDefinitionBodyFlowDefinition;\n}\n\nfunction renderTemplate(value: unknown, replacements: Record<string, string>): unknown {\n  if (Array.isArray(value)) {\n    return value.map((item) => renderTemplate(item, replacements));\n  }\n  if (value !== null && typeof value === \"object\") {\n    return Object.fromEntries(\n      Object.entries(value).map(([key, item]) => [key, renderTemplate(item, replacements)]),\n    );\n  }\n  if (typeof value === \"string\") {\n    return value.replaceAll(/\\$\\{([A-Z_]+)\\}/g, (match, name: string) => {\n      return replacements[name] ?? match;\n    });\n  }\n  return value;\n}\n\nfunction trimTrailingSlash(value: string): string {\n  return value.replace(/\\/+$/u, \"\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AIQA,SAAgB,uBAA+B;AAC7C,QAAO,aAAa,UAAU,oBAAoB,EAAE,OAAO;;;;;;AAO7D,SAAgB,qBAA6B;AAC3C,QAAO,aAAa,UAAU,kBAAkB,EAAE,OAAO;;AAG3D,SAAS,UAAU,UAA0B;AAC3C,QAAO,cAAc,IAAI,IAAI,eAAe,YAAY,OAAO,KAAK,IAAI,CAAC;;;;ACD3E,MAAa,8BAA8B;AAC3C,MAAa,0BAA0B;AACvC,MAAa,6BAA6B;AAC1C,MAAa,2BAA2B;;;;;;;;AASxC,MAAa,gBAAgB,CAAC,kBAAkB,gBAAgB;AAIhE,MAAa,uBAAoC;AAEjD,MAAM,mBAA4E;CAChF,kBAAkB;EAChB,QAAQA;EACR,MAAMC;EACP;CACD,iBAAiB;EACf,QAAQC;EACR,MAAMC;EACP;CACF;AAED,SAAS,gBAAgB,QAAoD;AAI3E,KAAI,CAAC,OAAO,OAAO,kBAAkB,OAAO,CAC1C,OAAM,IAAI,MACR,wBAAwB,KAAK,UAAU,OAAO,CAAC,mBAAmB,cAAc,KAAK,KAAK,CAAC,GAC5F;AAEH,QAAO,iBAAiB;;AAU1B,SAAgB,0BACd,oBAAoB,6BACZ;AACR,QAAO,GAAG,kBAAkB,kBAAkB,CAAC;;AAGjD,SAAgB,0BACd,UAAsC,EAAE,EACtB;CAClB,MAAM,oBAAoB,kBACxB,QAAQ,qBAAA,kCACT;AACD,QAAO,eAAe,gBAAgB,QAAQ,UAAA,iBAA+B,CAAC,QAAQ;EACpF,YAAY;EACZ,iBAAiB,QAAQ,iBAAiB,0BAA0B,kBAAkB;EACvF,CAAC;;AAGJ,SAAgB,oBACd,UAAsC,EAAE,EACA;CACxC,MAAM,oBAAoB,kBACxB,QAAQ,qBAAA,kCACT;AACD,QAAO,eAAe,gBAAgB,QAAQ,UAAA,iBAA+B,CAAC,MAAM;EAClF,YAAY;EACZ,iBAAiB,QAAQ,iBAAiB,0BAA0B,kBAAkB;EACvF,CAAC;;AAGJ,SAAS,eAAe,OAAgB,cAA+C;AACrF,KAAI,MAAM,QAAQ,MAAM,CACtB,QAAO,MAAM,KAAK,SAAS,eAAe,MAAM,aAAa,CAAC;AAEhE,KAAI,UAAU,QAAQ,OAAO,UAAU,SACrC,QAAO,OAAO,YACZ,OAAO,QAAQ,MAAM,CAAC,KAAK,CAAC,KAAK,UAAU,CAAC,KAAK,eAAe,MAAM,aAAa,CAAC,CAAC,CACtF;AAEH,KAAI,OAAO,UAAU,SACnB,QAAO,MAAM,WAAW,qBAAqB,OAAO,SAAiB;AACnE,SAAO,aAAa,SAAS;GAC7B;AAEJ,QAAO;;AAGT,SAAS,kBAAkB,OAAuB;AAChD,QAAO,MAAM,QAAQ,SAAS,GAAG"}

package/dist/{defaults-DzfOT2_7.d.mts → defaults-CSjBjBkQ.d.mts}

@@ -18,13 +18,24 @@ declare const DEFAULT_BUILTIN_SCHEMA_BASE = "https://nextgen.com/api/schemas";
 declare const DEFAULT_FLOW_SCHEMA_URI = "https://nextgen.com/flow-definition.json";
 declare const DEFAULT_SCHEMA_CONFIG_PATH = ".zitadel/schemas/default-human-user.json";
 declare const DEFAULT_FLOW_CONFIG_PATH = ".zitadel/flows/default-login.json";
+/**
+ * Named schema+flow bundles `zitadel setup` can scaffold (#448: the prompt
+ * fires before any `.zitadel/` file is written; each preset maps to a
+ * pre-defined bundle the CLI copies on first setup). `password-first` is
+ * today's default; `passkey-first` puts a passkey ceremony on the login
+ * entry step with an email→password fallback path.
+ */
+declare const SETUP_PRESETS: readonly ["password-first", "passkey-first"];
+type SetupPreset = (typeof SETUP_PRESETS)[number];
+declare const DEFAULT_SETUP_PRESET: SetupPreset;
 type DefaultConfigRenderOptions = {
   builtinSchemaBase?: string;
-  userSchemaUrl?: string;
+  userSchemaUrl?: string; /** Which bundle to render; defaults to {@link DEFAULT_SETUP_PRESET}. */
+  preset?: string;
 };
 declare function defaultHumanUserSchemaUrl(builtinSchemaBase?: string): string;
 declare function getDefaultHumanUserSchema(options?: DefaultConfigRenderOptions): CreateSchemaBody;
 declare function getDefaultLoginFlow(options?: DefaultConfigRenderOptions): CreateFlowDefinitionBodyFlowDefinition;
 //#endregion
-export { DefaultConfigRenderOptions as a, getDefaultLoginFlow as c, DEFAULT_SCHEMA_CONFIG_PATH as i, flowsReadmeContent as l, DEFAULT_FLOW_CONFIG_PATH as n, defaultHumanUserSchemaUrl as o, DEFAULT_FLOW_SCHEMA_URI as r, getDefaultHumanUserSchema as s, DEFAULT_BUILTIN_SCHEMA_BASE as t, schemasReadmeContent as u };
-//# sourceMappingURL=defaults-DzfOT2_7.d.mts.map
+export { DEFAULT_SETUP_PRESET as a, SetupPreset as c, getDefaultLoginFlow as d, flowsReadmeContent as f, DEFAULT_SCHEMA_CONFIG_PATH as i, defaultHumanUserSchemaUrl as l, DEFAULT_FLOW_CONFIG_PATH as n, DefaultConfigRenderOptions as o, schemasReadmeContent as p, DEFAULT_FLOW_SCHEMA_URI as r, SETUP_PRESETS as s, DEFAULT_BUILTIN_SCHEMA_BASE as t, getDefaultHumanUserSchema as u };
+//# sourceMappingURL=defaults-CSjBjBkQ.d.mts.map

package/dist/defaults-CSjBjBkQ.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults-CSjBjBkQ.d.mts","names":[],"sources":["../src/readmes.ts","../src/defaults.ts"],"mappings":";;;;;;AAQA;;iBAAgB,oBAAA,CAAA;;;AAQhB;;iBAAgB,kBAAA,CAAA;;;cCIH,2BAAA;AAAA,cACA,uBAAA;AAAA,cACA,0BAAA;AAAA,cACA,wBAAA;;;ADPb;;;;;cCgBa,aAAA;AAAA,KAED,WAAA,WAAsB,aAAA;AAAA,cAErB,oBAAA,EAAsB,WAAA;AAAA,KAyBvB,0BAAA;EACV,iBAAA;EACA,aAAA,WA3CsC;EA6CtC,MAAA;AAAA;AAAA,iBAGc,yBAAA,CACd,iBAAA;AAAA,iBAKc,yBAAA,CACd,OAAA,GAAS,0BAAA,GACR,gBAAA;AAAA,iBAUa,mBAAA,CACd,OAAA,GAAS,0BAAA,GACR,sCAAA"}

package/dist/defaults.d.mts

@@ -1,2 +1,2 @@
-import { a as DefaultConfigRenderOptions, c as getDefaultLoginFlow, i as DEFAULT_SCHEMA_CONFIG_PATH, l as flowsReadmeContent, n as DEFAULT_FLOW_CONFIG_PATH, o as defaultHumanUserSchemaUrl, r as DEFAULT_FLOW_SCHEMA_URI, s as getDefaultHumanUserSchema, t as DEFAULT_BUILTIN_SCHEMA_BASE, u as schemasReadmeContent } from "./defaults-DzfOT2_7.mjs";
-export { DEFAULT_BUILTIN_SCHEMA_BASE, DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, DefaultConfigRenderOptions, defaultHumanUserSchemaUrl, flowsReadmeContent, getDefaultHumanUserSchema, getDefaultLoginFlow, schemasReadmeContent };
+import { a as DEFAULT_SETUP_PRESET, c as SetupPreset, d as getDefaultLoginFlow, f as flowsReadmeContent, i as DEFAULT_SCHEMA_CONFIG_PATH, l as defaultHumanUserSchemaUrl, n as DEFAULT_FLOW_CONFIG_PATH, o as DefaultConfigRenderOptions, p as schemasReadmeContent, r as DEFAULT_FLOW_SCHEMA_URI, s as SETUP_PRESETS, t as DEFAULT_BUILTIN_SCHEMA_BASE, u as getDefaultHumanUserSchema } from "./defaults-CSjBjBkQ.mjs";
+export { DEFAULT_BUILTIN_SCHEMA_BASE, DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, DEFAULT_SETUP_PRESET, DefaultConfigRenderOptions, SETUP_PRESETS, SetupPreset, defaultHumanUserSchemaUrl, flowsReadmeContent, getDefaultHumanUserSchema, getDefaultLoginFlow, schemasReadmeContent };

package/dist/defaults.mjs

@@ -1,2 +1,2 @@
-import { a as defaultHumanUserSchemaUrl, c as flowsReadmeContent, i as DEFAULT_SCHEMA_CONFIG_PATH, l as schemasReadmeContent, n as DEFAULT_FLOW_CONFIG_PATH, o as getDefaultHumanUserSchema, r as DEFAULT_FLOW_SCHEMA_URI, s as getDefaultLoginFlow, t as DEFAULT_BUILTIN_SCHEMA_BASE } from "./defaults-B2iIPSSl.mjs";
-export { DEFAULT_BUILTIN_SCHEMA_BASE, DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, defaultHumanUserSchemaUrl, flowsReadmeContent, getDefaultHumanUserSchema, getDefaultLoginFlow, schemasReadmeContent };
+import { a as DEFAULT_SETUP_PRESET, c as getDefaultHumanUserSchema, d as schemasReadmeContent, i as DEFAULT_SCHEMA_CONFIG_PATH, l as getDefaultLoginFlow, n as DEFAULT_FLOW_CONFIG_PATH, o as SETUP_PRESETS, r as DEFAULT_FLOW_SCHEMA_URI, s as defaultHumanUserSchemaUrl, t as DEFAULT_BUILTIN_SCHEMA_BASE, u as flowsReadmeContent } from "./defaults-BQej3KIY.mjs";
+export { DEFAULT_BUILTIN_SCHEMA_BASE, DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, DEFAULT_SETUP_PRESET, SETUP_PRESETS, defaultHumanUserSchemaUrl, flowsReadmeContent, getDefaultHumanUserSchema, getDefaultLoginFlow, schemasReadmeContent };

package/dist/index.d.mts

@@ -1,4 +1,6 @@
-import { a as DefaultConfigRenderOptions, c as getDefaultLoginFlow, i as DEFAULT_SCHEMA_CONFIG_PATH, l as flowsReadmeContent, n as DEFAULT_FLOW_CONFIG_PATH, o as defaultHumanUserSchemaUrl, r as DEFAULT_FLOW_SCHEMA_URI, s as getDefaultHumanUserSchema, t as DEFAULT_BUILTIN_SCHEMA_BASE, u as schemasReadmeContent } from "./defaults-DzfOT2_7.mjs";
+import { a as DEFAULT_SETUP_PRESET, c as SetupPreset, d as getDefaultLoginFlow, f as flowsReadmeContent, i as DEFAULT_SCHEMA_CONFIG_PATH, l as defaultHumanUserSchemaUrl, n as DEFAULT_FLOW_CONFIG_PATH, o as DefaultConfigRenderOptions, p as schemasReadmeContent, r as DEFAULT_FLOW_SCHEMA_URI, s as SETUP_PRESETS, t as DEFAULT_BUILTIN_SCHEMA_BASE, u as getDefaultHumanUserSchema } from "./defaults-CSjBjBkQ.mjs";
+import { FLOW_FILE_SCHEMA_REF, META_SCHEMA_DIR, MetaSchemaFile, metaSchemaFiles } from "./meta-schemas.mjs";
 import { USER_PROPERTY_DEFAULTS, normalizeFlowBody, normalizeSchemaBody } from "./normalize.mjs";
 import { createFlowDefinitionRequestSchema, flowConfigSchema, schemaConfigSchema } from "./schemas.mjs";
-export { DEFAULT_BUILTIN_SCHEMA_BASE, DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, DefaultConfigRenderOptions, USER_PROPERTY_DEFAULTS, createFlowDefinitionRequestSchema, defaultHumanUserSchemaUrl, flowConfigSchema, flowsReadmeContent, getDefaultHumanUserSchema, getDefaultLoginFlow, normalizeFlowBody, normalizeSchemaBody, schemaConfigSchema, schemasReadmeContent };
+import { FLOW_PURPOSES, FLOW_VALIDATION_RULES, FlowValidationIssue, FlowValidationRuleId, FlowValidationSeverity, PURPOSE_FLIP_TARGETS, RESERVED_OUTCOMES, validateFlowDefinition } from "./validate.mjs";
+export { DEFAULT_BUILTIN_SCHEMA_BASE, DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, DEFAULT_SETUP_PRESET, DefaultConfigRenderOptions, FLOW_FILE_SCHEMA_REF, FLOW_PURPOSES, FLOW_VALIDATION_RULES, FlowValidationIssue, FlowValidationRuleId, FlowValidationSeverity, META_SCHEMA_DIR, MetaSchemaFile, PURPOSE_FLIP_TARGETS, RESERVED_OUTCOMES, SETUP_PRESETS, SetupPreset, USER_PROPERTY_DEFAULTS, createFlowDefinitionRequestSchema, defaultHumanUserSchemaUrl, flowConfigSchema, flowsReadmeContent, getDefaultHumanUserSchema, getDefaultLoginFlow, metaSchemaFiles, normalizeFlowBody, normalizeSchemaBody, schemaConfigSchema, schemasReadmeContent, validateFlowDefinition };

package/dist/index.mjs

@@ -1,4 +1,6 @@
-import { a as defaultHumanUserSchemaUrl, c as flowsReadmeContent, i as DEFAULT_SCHEMA_CONFIG_PATH, l as schemasReadmeContent, n as DEFAULT_FLOW_CONFIG_PATH, o as getDefaultHumanUserSchema, r as DEFAULT_FLOW_SCHEMA_URI, s as getDefaultLoginFlow, t as DEFAULT_BUILTIN_SCHEMA_BASE } from "./defaults-B2iIPSSl.mjs";
+import { a as DEFAULT_SETUP_PRESET, c as getDefaultHumanUserSchema, d as schemasReadmeContent, i as DEFAULT_SCHEMA_CONFIG_PATH, l as getDefaultLoginFlow, n as DEFAULT_FLOW_CONFIG_PATH, o as SETUP_PRESETS, r as DEFAULT_FLOW_SCHEMA_URI, s as defaultHumanUserSchemaUrl, t as DEFAULT_BUILTIN_SCHEMA_BASE, u as flowsReadmeContent } from "./defaults-BQej3KIY.mjs";
+import { n as META_SCHEMA_DIR, r as metaSchemaFiles, t as FLOW_FILE_SCHEMA_REF } from "./meta-schemas-8nlyVL7g.mjs";
 import { USER_PROPERTY_DEFAULTS, normalizeFlowBody, normalizeSchemaBody } from "./normalize.mjs";
 import { createFlowDefinitionRequestSchema, flowConfigSchema, schemaConfigSchema } from "./schemas.mjs";
-export { DEFAULT_BUILTIN_SCHEMA_BASE, DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, USER_PROPERTY_DEFAULTS, createFlowDefinitionRequestSchema, defaultHumanUserSchemaUrl, flowConfigSchema, flowsReadmeContent, getDefaultHumanUserSchema, getDefaultLoginFlow, normalizeFlowBody, normalizeSchemaBody, schemaConfigSchema, schemasReadmeContent };
+import { FLOW_PURPOSES, FLOW_VALIDATION_RULES, PURPOSE_FLIP_TARGETS, RESERVED_OUTCOMES, validateFlowDefinition } from "./validate.mjs";
+export { DEFAULT_BUILTIN_SCHEMA_BASE, DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, DEFAULT_SETUP_PRESET, FLOW_FILE_SCHEMA_REF, FLOW_PURPOSES, FLOW_VALIDATION_RULES, META_SCHEMA_DIR, PURPOSE_FLIP_TARGETS, RESERVED_OUTCOMES, SETUP_PRESETS, USER_PROPERTY_DEFAULTS, createFlowDefinitionRequestSchema, defaultHumanUserSchemaUrl, flowConfigSchema, flowsReadmeContent, getDefaultHumanUserSchema, getDefaultLoginFlow, metaSchemaFiles, normalizeFlowBody, normalizeSchemaBody, schemaConfigSchema, schemasReadmeContent, validateFlowDefinition };