@zitadel/config 0.1.0-alpha.18 → 1.0.0-alpha.20

package/defaults/presets/passkey-first/human-user.json

@@ -6,15 +6,14 @@
   "objectType": "human-user",
   "kind": "user-schema",
   "type": "object",
+  "x-identifier": "email",
   "description": "The default editable schema for human users (passkey-first sign-in).",
   "x-auth-methods": {
     "passkey": {
-      "enabled": true,
-      "position": 1
+      "enabled": true
     },
     "password": {
-      "enabled": true,
-      "position": 2
+      "enabled": true
     }
   },
   "required": [

package/defaults/presets/passkey-first/login.json

@@ -23,6 +23,12 @@
           "kind": "navigate",
           "primary": false,
           "text_key": "passkey-first.action.email_fallback"
+        },
+        {
+          "name": "register",
+          "kind": "navigate",
+          "primary": false,
+          "text_key": "identifier.action.register.link"
         }
       ],
       "transitions": {
@@ -34,6 +40,10 @@
         },
         "user_not_found": {
           "target": "register"
+        },
+        "register": {
+          "target": "register",
+          "purpose": "register"
         }
       }
     },
@@ -54,6 +64,12 @@
           "kind": "passkey",
           "primary": false,
           "text_key": "identifier.action.passkey"
+        },
+        {
+          "name": "register",
+          "kind": "navigate",
+          "primary": false,
+          "text_key": "identifier.action.register.link"
         }
       ],
       "transitions": {
@@ -65,6 +81,10 @@
         },
         "user_not_found": {
           "target": "register"
+        },
+        "register": {
+          "target": "register",
+          "purpose": "register"
         }
       }
     },
@@ -113,6 +133,12 @@
           "kind": "submit",
           "primary": false,
           "text_key": "register.action.password"
+        },
+        {
+          "name": "sign_in",
+          "kind": "navigate",
+          "primary": false,
+          "text_key": "register.action.sign_in.link"
         }
       ],
       "transitions": {
@@ -124,6 +150,10 @@
         },
         "user_already_exists": {
           "target": "password"
+        },
+        "sign_in": {
+          "target": "passkey-first",
+          "purpose": "login"
         }
       }
     },

package/dist/branding-url.d.mts

@@ -0,0 +1,14 @@
+//#region src/branding-url.d.ts
+/**
+ * Reports whether value is an absolute HTTP URL using one of the canonical
+ * loopback spellings shared by the config and component gates.
+ *
+ * The raw-pattern check deliberately runs before WHATWG URL normalisation so
+ * shorthand, integer, hexadecimal, leading-zero, and userinfo forms cannot
+ * become a loopback host in one JavaScript layer while the Go save gate rejects
+ * them.
+ */
+declare function isCanonicalLoopbackHttpUrl(value: string): boolean;
+//#endregion
+export { isCanonicalLoopbackHttpUrl };
+//# sourceMappingURL=branding-url.d.mts.map

package/dist/branding-url.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"branding-url.d.mts","names":[],"sources":["../src/branding-url.ts"],"mappings":";;AAYA;;;;;;;;iBAAgB,0BAAA,CAA2B,KAAA"}

package/dist/branding-url.mjs

@@ -0,0 +1,23 @@
+//#region src/branding-url.ts
+const CANONICAL_LOOPBACK_HTTP_URL = /^http:\/\/(?:localhost|127\.(?:0|[1-9][0-9]{0,2})\.(?:0|[1-9][0-9]{0,2})\.(?:0|[1-9][0-9]{0,2})|\[::1\])(?::[0-9]+)?(?:[/?#]|$)/i;
+/**
+* Reports whether value is an absolute HTTP URL using one of the canonical
+* loopback spellings shared by the config and component gates.
+*
+* The raw-pattern check deliberately runs before WHATWG URL normalisation so
+* shorthand, integer, hexadecimal, leading-zero, and userinfo forms cannot
+* become a loopback host in one JavaScript layer while the Go save gate rejects
+* them.
+*/
+function isCanonicalLoopbackHttpUrl(value) {
+	if (!CANONICAL_LOOPBACK_HTTP_URL.test(value)) return false;
+	try {
+		return new URL(value).protocol === "http:";
+	} catch {
+		return false;
+	}
+}
+//#endregion
+export { isCanonicalLoopbackHttpUrl };
+
+//# sourceMappingURL=branding-url.mjs.map

package/dist/branding-url.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"branding-url.mjs","names":[],"sources":["../src/branding-url.ts"],"sourcesContent":["const CANONICAL_LOOPBACK_HTTP_URL =\n  /^http:\\/\\/(?:localhost|127\\.(?:0|[1-9][0-9]{0,2})\\.(?:0|[1-9][0-9]{0,2})\\.(?:0|[1-9][0-9]{0,2})|\\[::1\\])(?::[0-9]+)?(?:[/?#]|$)/i;\n\n/**\n * Reports whether value is an absolute HTTP URL using one of the canonical\n * loopback spellings shared by the config and component gates.\n *\n * The raw-pattern check deliberately runs before WHATWG URL normalisation so\n * shorthand, integer, hexadecimal, leading-zero, and userinfo forms cannot\n * become a loopback host in one JavaScript layer while the Go save gate rejects\n * them.\n */\nexport function isCanonicalLoopbackHttpUrl(value: string): boolean {\n  if (!CANONICAL_LOOPBACK_HTTP_URL.test(value)) return false;\n  try {\n    return new URL(value).protocol === \"http:\";\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";AAAA,MAAM,8BACJ;;;;;;;;;;AAWF,SAAgB,2BAA2B,OAAwB;AACjE,KAAI,CAAC,4BAA4B,KAAK,MAAM,CAAE,QAAO;AACrD,KAAI;AACF,SAAO,IAAI,IAAI,MAAM,CAAC,aAAa;SAC7B;AACN,SAAO"}

package/dist/{defaults-CXTnFMHj.mjs → defaults-DPq0o3iU.mjs}

@@ -9,16 +9,11 @@ var default_human_user_default = {
 	objectType: "human-user",
 	kind: "user-schema",
 	type: "object",
+	"x-identifier": "email",
 	description: "The default editable schema for human users.",
 	"x-auth-methods": {
-		"password": {
-			"enabled": true,
-			"position": 1
-		},
-		"passkey": {
-			"enabled": true,
-			"position": 2
-		}
+		"password": { "enabled": true },
+		"passkey": { "enabled": true }
 	},
 	required: ["email"],
 	properties: { "email": {
@@ -43,21 +38,34 @@ var default_login_default = {
 		{
 			"name": "identifier",
 			"fields": ["email"],
-			"actions": [{
-				"name": "submit",
-				"kind": "submit",
-				"primary": true,
-				"text_key": "identifier.action.continue"
-			}, {
-				"name": "passkey",
-				"kind": "passkey",
-				"primary": false,
-				"text_key": "identifier.action.passkey"
-			}],
+			"actions": [
+				{
+					"name": "submit",
+					"kind": "submit",
+					"primary": true,
+					"text_key": "identifier.action.continue"
+				},
+				{
+					"name": "passkey",
+					"kind": "passkey",
+					"primary": false,
+					"text_key": "identifier.action.passkey"
+				},
+				{
+					"name": "register",
+					"kind": "navigate",
+					"primary": false,
+					"text_key": "identifier.action.register.link"
+				}
+			],
 			"transitions": {
 				"submit": { "target": "password" },
 				"passkey": { "target": "done" },
-				"user_not_found": { "target": "register" }
+				"user_not_found": { "target": "register" },
+				"register": {
+					"target": "register",
+					"purpose": "register"
+				}
 			}
 		},
 		{
@@ -82,21 +90,34 @@ var default_login_default = {
 		{
 			"name": "register",
 			"fields": ["email"],
-			"actions": [{
-				"name": "submit",
-				"kind": "submit",
-				"primary": true,
-				"text_key": "register.action.password"
-			}, {
-				"name": "passkey_register",
-				"kind": "passkey_register",
-				"primary": false,
-				"text_key": "register.action.passkey"
-			}],
+			"actions": [
+				{
+					"name": "submit",
+					"kind": "submit",
+					"primary": true,
+					"text_key": "register.action.password"
+				},
+				{
+					"name": "passkey_register",
+					"kind": "passkey_register",
+					"primary": false,
+					"text_key": "register.action.passkey"
+				},
+				{
+					"name": "sign_in",
+					"kind": "navigate",
+					"primary": false,
+					"text_key": "register.action.sign_in.link"
+				}
+			],
 			"transitions": {
 				"submit": { "target": "register-password" },
 				"passkey_register": { "target": "done" },
-				"user_already_exists": { "target": "password" }
+				"user_already_exists": { "target": "password" },
+				"sign_in": {
+					"target": "identifier",
+					"purpose": "login"
+				}
 			}
 		},
 		{
@@ -130,16 +151,11 @@ var human_user_default = {
 	objectType: "human-user",
 	kind: "user-schema",
 	type: "object",
+	"x-identifier": "email",
 	description: "The default editable schema for human users (passkey-first sign-in).",
 	"x-auth-methods": {
-		"passkey": {
-			"enabled": true,
-			"position": 1
-		},
-		"password": {
-			"enabled": true,
-			"position": 2
-		}
+		"passkey": { "enabled": true },
+		"password": { "enabled": true }
 	},
 	required: ["email"],
 	properties: { "email": {
@@ -164,41 +180,67 @@ var login_default = {
 		{
 			"name": "passkey-first",
 			"fields": [],
-			"actions": [{
-				"name": "passkey",
-				"kind": "passkey",
-				"primary": true,
-				"text_key": "passkey-first.action.passkey"
-			}, {
-				"name": "email_fallback",
-				"kind": "navigate",
-				"primary": false,
-				"text_key": "passkey-first.action.email_fallback"
-			}],
+			"actions": [
+				{
+					"name": "passkey",
+					"kind": "passkey",
+					"primary": true,
+					"text_key": "passkey-first.action.passkey"
+				},
+				{
+					"name": "email_fallback",
+					"kind": "navigate",
+					"primary": false,
+					"text_key": "passkey-first.action.email_fallback"
+				},
+				{
+					"name": "register",
+					"kind": "navigate",
+					"primary": false,
+					"text_key": "identifier.action.register.link"
+				}
+			],
 			"transitions": {
 				"passkey": { "target": "done" },
 				"email_fallback": { "target": "identifier" },
-				"user_not_found": { "target": "register" }
+				"user_not_found": { "target": "register" },
+				"register": {
+					"target": "register",
+					"purpose": "register"
+				}
 			}
 		},
 		{
 			"name": "identifier",
 			"fields": ["email"],
-			"actions": [{
-				"name": "submit",
-				"kind": "submit",
-				"primary": true,
-				"text_key": "identifier.action.continue"
-			}, {
-				"name": "passkey",
-				"kind": "passkey",
-				"primary": false,
-				"text_key": "identifier.action.passkey"
-			}],
+			"actions": [
+				{
+					"name": "submit",
+					"kind": "submit",
+					"primary": true,
+					"text_key": "identifier.action.continue"
+				},
+				{
+					"name": "passkey",
+					"kind": "passkey",
+					"primary": false,
+					"text_key": "identifier.action.passkey"
+				},
+				{
+					"name": "register",
+					"kind": "navigate",
+					"primary": false,
+					"text_key": "identifier.action.register.link"
+				}
+			],
 			"transitions": {
 				"submit": { "target": "password" },
 				"passkey": { "target": "done" },
-				"user_not_found": { "target": "register" }
+				"user_not_found": { "target": "register" },
+				"register": {
+					"target": "register",
+					"purpose": "register"
+				}
 			}
 		},
 		{
@@ -223,21 +265,34 @@ var login_default = {
 		{
 			"name": "register",
 			"fields": ["email"],
-			"actions": [{
-				"name": "passkey_register",
-				"kind": "passkey_register",
-				"primary": true,
-				"text_key": "register.action.passkey"
-			}, {
-				"name": "submit",
-				"kind": "submit",
-				"primary": false,
-				"text_key": "register.action.password"
-			}],
+			"actions": [
+				{
+					"name": "passkey_register",
+					"kind": "passkey_register",
+					"primary": true,
+					"text_key": "register.action.passkey"
+				},
+				{
+					"name": "submit",
+					"kind": "submit",
+					"primary": false,
+					"text_key": "register.action.password"
+				},
+				{
+					"name": "sign_in",
+					"kind": "navigate",
+					"primary": false,
+					"text_key": "register.action.sign_in.link"
+				}
+			],
 			"transitions": {
 				"passkey_register": { "target": "done" },
 				"submit": { "target": "register-password" },
-				"user_already_exists": { "target": "password" }
+				"user_already_exists": { "target": "password" },
+				"sign_in": {
+					"target": "passkey-first",
+					"purpose": "login"
+				}
 			}
 		},
 		{
@@ -513,4 +568,4 @@ function trimTrailingSlash(value) {
 //#endregion
 export { brandingReadmeContent as _, DEFAULT_BUILTIN_SCHEMA_BASE as a, DEFAULT_SCHEMA_CONFIG_PATH as c, SETUP_PRESETS as d, SETUP_USE_CASES as f, getDefaultLoginFlow as g, getDefaultHumanUserSchema as h, DEFAULT_BRANDING_TEMPLATE_PATH as i, DEFAULT_SETUP_PRESET as l, getDefaultBrandingConfig as m, DEFAULT_BRANDING_CONFIG_PATH as n, DEFAULT_FLOW_CONFIG_PATH as o, defaultHumanUserSchemaUrl as p, DEFAULT_BRANDING_DESIGN as r, DEFAULT_FLOW_SCHEMA_URI as s, BRANDING_DESIGNS as t, DEFAULT_SETUP_USE_CASE as u, flowsReadmeContent as v, schemasReadmeContent as y };
 
-//# sourceMappingURL=defaults-CXTnFMHj.mjs.map
+//# sourceMappingURL=defaults-DPq0o3iU.mjs.map

package/dist/{defaults-CXTnFMHj.mjs.map → defaults-DPq0o3iU.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"defaults-CXTnFMHj.mjs","names":["defaultHumanUserSchemaTemplate","defaultLoginFlowTemplate","passkeyFirstHumanUserSchemaTemplate","passkeyFirstLoginFlowTemplate"],"sources":["../defaults/default-human-user.json","../defaults/default-login.json","../defaults/presets/passkey-first/human-user.json","../defaults/presets/passkey-first/login.json","../src/readmes.ts","../src/defaults.ts"],"sourcesContent":["","","","","import { readFileSync } from \"node:fs\";\nimport { fileURLToPath } from \"node:url\";\n\n/**\n * README content the CLI copies to `.zitadel/schemas/README.md` during setup.\n * Source of truth is `packages/config/defaults/README-schemas.md`; the Go\n * server-side embed reads the same file (see `defaults.go`).\n */\nexport function schemasReadmeContent(): string {\n  return readFileSync(readmeUrl(\"README-schemas.md\"), \"utf8\");\n}\n\n/**\n * README content the CLI copies to `.zitadel/flows/README.md` during setup.\n * Source of truth is `packages/config/defaults/README-flows.md`.\n */\nexport function flowsReadmeContent(): string {\n  return readFileSync(readmeUrl(\"README-flows.md\"), \"utf8\");\n}\n\n/**\n * README content the CLI copies to `.zitadel/branding/README.md` when a\n * branding design is ejected. Source of truth is\n * `packages/config/defaults/README-branding.md`.\n */\nexport function brandingReadmeContent(): string {\n  return readFileSync(readmeUrl(\"README-branding.md\"), \"utf8\");\n}\n\nfunction readmeUrl(filename: string): string {\n  return fileURLToPath(new URL(`../defaults/${filename}`, import.meta.url));\n}\n","import { readFileSync } from \"node:fs\";\nimport { fileURLToPath } from \"node:url\";\n\nimport type {\n  CreateFlowDefinitionBodyFlowDefinition,\n  CreateSchemaBody,\n} from \"@zitadel/api/generated/model\";\n\nimport defaultHumanUserSchemaTemplate from \"../defaults/default-human-user.json\" with {\n  type: \"json\",\n};\nimport defaultLoginFlowTemplate from \"../defaults/default-login.json\" with {\n  type: \"json\",\n};\nimport passkeyFirstHumanUserSchemaTemplate from \"../defaults/presets/passkey-first/human-user.json\" with {\n  type: \"json\",\n};\nimport passkeyFirstLoginFlowTemplate from \"../defaults/presets/passkey-first/login.json\" with {\n  type: \"json\",\n};\n\nexport { brandingReadmeContent, flowsReadmeContent, schemasReadmeContent } from \"./readmes.js\";\n\nexport const DEFAULT_BUILTIN_SCHEMA_BASE = \"https://nextgen.com/api/schemas\";\nexport const DEFAULT_FLOW_SCHEMA_URI = \"https://nextgen.com/flow-definition.json\";\nexport const DEFAULT_SCHEMA_CONFIG_PATH = \".zitadel/schemas/default-human-user.json\";\nexport const DEFAULT_FLOW_CONFIG_PATH = \".zitadel/flows/default-login.json\";\nexport const DEFAULT_BRANDING_CONFIG_PATH = \".zitadel/branding/branding.json\";\nexport const DEFAULT_BRANDING_TEMPLATE_PATH = \".zitadel/branding/login.liquid\";\n\n/**\n * Named schema+flow bundles `zitadel setup` can scaffold (#448: the prompt\n * fires before any `.zitadel/` file is written; each preset maps to a\n * pre-defined bundle the CLI copies on first setup). `password-first` is\n * today's default; `passkey-first` puts a passkey ceremony on the login\n * entry step with an email→password fallback path.\n */\nexport const SETUP_PRESETS = [\"password-first\", \"passkey-first\"] as const;\n\nexport type SetupPreset = (typeof SETUP_PRESETS)[number];\n\nexport const DEFAULT_SETUP_PRESET: SetupPreset = \"password-first\";\n\nconst PRESET_TEMPLATES: Record<SetupPreset, { schema: unknown; flow: unknown }> = {\n  \"password-first\": {\n    schema: defaultHumanUserSchemaTemplate,\n    flow: defaultLoginFlowTemplate,\n  },\n  \"passkey-first\": {\n    schema: passkeyFirstHumanUserSchemaTemplate,\n    flow: passkeyFirstLoginFlowTemplate,\n  },\n};\n\nfunction presetTemplates(preset: string): { schema: unknown; flow: unknown } {\n  // Own-property check: indexing a plain object with an arbitrary string\n  // would let \"__proto__\"/\"constructor\" resolve via the prototype chain\n  // and bypass the unknown-preset error.\n  if (!Object.hasOwn(PRESET_TEMPLATES, preset)) {\n    throw new Error(\n      `unknown setup preset ${JSON.stringify(preset)} (known presets: ${SETUP_PRESETS.join(\", \")})`,\n    );\n  }\n  return PRESET_TEMPLATES[preset as SetupPreset];\n}\n\n/**\n * Login-design starting points `zitadel branding eject --design <name>` (and\n * `zitadel setup --design <name>`) scaffold into `.zitadel/branding/`. A\n * design is a full Liquid template plus the descriptor `layout` it degrades\n * to — the wire `layout` enum stays `centered | split`, richer designs are\n * delivered as templates (ADR 040).\n */\nexport const BRANDING_DESIGNS = [\"centered\", \"split\", \"split-right\", \"hero\", \"minimal\"] as const;\n\nexport type BrandingDesign = (typeof BRANDING_DESIGNS)[number];\n\nexport const DEFAULT_BRANDING_DESIGN: BrandingDesign = \"centered\";\n\n/** Descriptor `layout` each design degrades to when its template is rejected. */\nconst DESIGN_LAYOUTS: Record<BrandingDesign, \"centered\" | \"split\"> = {\n  centered: \"centered\",\n  split: \"split\",\n  \"split-right\": \"split\",\n  hero: \"split\",\n  minimal: \"centered\",\n};\n\nexport type DefaultBrandingConfig = {\n  /** The `.zitadel/branding/branding.json` descriptor body (sans `$schema`). */\n  branding: {\n    layout: \"centered\" | \"split\";\n    liquid_template_file: string;\n  };\n  /** The `.zitadel/branding/login.liquid` template content. */\n  template: string;\n};\n\n/**\n * Renders the scaffold files for a branding design. The `centered` template\n * is a drift-tested copy of the bundled default in `@zitadel/components`;\n * the other designs are authored variants of it.\n */\nexport function getDefaultBrandingConfig(\n  design: string = DEFAULT_BRANDING_DESIGN,\n): DefaultBrandingConfig {\n  if (!Object.hasOwn(DESIGN_LAYOUTS, design)) {\n    throw new Error(\n      `unknown branding design ${JSON.stringify(design)} (known designs: ${BRANDING_DESIGNS.join(\", \")})`,\n    );\n  }\n  const known = design as BrandingDesign;\n  return {\n    branding: {\n      layout: DESIGN_LAYOUTS[known],\n      liquid_template_file: \"./login.liquid\",\n    },\n    template: readFileSync(packageFilePath(`../defaults/branding/${known}/login.liquid`), \"utf8\"),\n  };\n}\n\n/**\n * Resolves a package-relative file to a real filesystem path. Vite-driven\n * runtimes (vitest in dependent packages) rewrite `import.meta.url` to a\n * `/@fs/...` URL, which `fileURLToPath` passes through verbatim — strip the\n * prefix so `readFileSync` gets an actual path.\n */\nfunction packageFilePath(relative: string): string {\n  const path = fileURLToPath(new URL(relative, import.meta.url));\n  return path.startsWith(\"/@fs/\") ? path.slice(\"/@fs\".length) : path;\n}\n\n/**\n * The second setup axis (#448): *who* signs in, orthogonal to the sign-in\n * preset (*how* they sign in). The sign-in preset owns the flow shape and\n * auth methods; the use case owns which profile fields the schema collects.\n * Composing the two keeps us at one field catalog + one flow-per-preset\n * instead of a bundle per (use case × preset) pair. `minimal` is the\n * default and never blocks non-interactive runs.\n */\nexport const SETUP_USE_CASES = [\"minimal\", \"consumer\", \"business\"] as const;\n\nexport type SetupUseCase = (typeof SETUP_USE_CASES)[number];\n\nexport const DEFAULT_SETUP_USE_CASE: SetupUseCase = \"minimal\";\n\n/**\n * Fields each use case collects, in register/display order. `email` is\n * always first and stays the only required property; the rest are optional\n * profile attributes gathered on the flow's register step. `givenName`/\n * `familyName` are the attributes the backend reads for a user's identity\n * (`internal/domain/user.go`); `companyName` is stored as a plain user\n * attribute today — there is no org/team model behind it yet.\n */\nconst USE_CASE_FIELDS: Record<SetupUseCase, readonly string[]> = {\n  minimal: [\"email\"],\n  consumer: [\"email\", \"givenName\", \"familyName\"],\n  business: [\"email\", \"givenName\", \"familyName\", \"companyName\"],\n};\n\n/**\n * JSON-Schema bodies for the optional profile fields the CLI composes in per\n * use case. The shipped templates are an email-only baseline (shared verbatim\n * with the Go server fallback), so this catalog owns every field beyond\n * `email`. Authored in the templates' style — no `x-claim`, since the backend\n * maps identity by attribute name and the user-property meta-schema defines no\n * claim keyword. `givenName`/`familyName` are the attributes the backend reads\n * for a user's identity (`internal/domain/user.go`).\n */\nconst EXTRA_FIELD_BODIES: Record<string, Record<string, unknown>> = {\n  givenName: {\n    type: \"string\",\n    maxLength: 50,\n    description: \"The user's given (first) name.\",\n  },\n  familyName: {\n    type: \"string\",\n    maxLength: 50,\n    description: \"The user's family (last) name.\",\n  },\n  companyName: {\n    type: \"string\",\n    maxLength: 200,\n    description: \"The user's company name.\",\n  },\n};\n\nfunction useCaseFields(useCase: string): readonly string[] {\n  // Own-property check, same rationale as presetTemplates: keep prototype\n  // keys (\"__proto__\" etc.) from resolving to a real field list.\n  if (!Object.hasOwn(USE_CASE_FIELDS, useCase)) {\n    throw new Error(\n      `unknown setup use case ${JSON.stringify(useCase)} (known use cases: ${SETUP_USE_CASES.join(\", \")})`,\n    );\n  }\n  return USE_CASE_FIELDS[useCase as SetupUseCase];\n}\n\n/**\n * The body for one use-case field: reuse the template's authored body when it\n * has one (so composed schemas match the shipped defaults for shared fields),\n * else the extra catalog, else a generic editable string so composition stays\n * total for any field a future use case introduces.\n */\nfunction fieldBody(\n  field: string,\n  templateProps: Record<string, Record<string, unknown>>,\n): Record<string, unknown> {\n  if (Object.hasOwn(templateProps, field)) {\n    return { ...templateProps[field] };\n  }\n  if (Object.hasOwn(EXTRA_FIELD_BODIES, field)) {\n    return { ...EXTRA_FIELD_BODIES[field] };\n  }\n  return { type: \"string\", description: `The user's ${field}.` };\n}\n\n/**\n * Narrow a rendered schema to the chosen use case: keep the preset-owned\n * header and `x-auth-methods`, but replace `properties`/`required` with the\n * use case's field set. `email` is the sole required property.\n */\nfunction applyUseCaseToSchema(\n  schema: Record<string, unknown>,\n  useCase: string,\n): Record<string, unknown> {\n  const templateProps = (schema.properties ?? {}) as Record<string, Record<string, unknown>>;\n  const properties: Record<string, unknown> = {};\n  for (const field of useCaseFields(useCase)) {\n    properties[field] = fieldBody(field, templateProps);\n  }\n  return { ...schema, required: [\"email\"], properties };\n}\n\n/**\n * Derive the flow's register-step fields from the use case rather than\n * copying a hard-coded list into every bundle (#448): the register step\n * collects exactly what the schema defines. Other steps are untouched.\n */\nfunction applyUseCaseToFlow(\n  flow: Record<string, unknown>,\n  useCase: string,\n): Record<string, unknown> {\n  const fields = [...useCaseFields(useCase)];\n  const steps = (flow.steps as Array<Record<string, unknown>>).map((step) =>\n    step.name === \"register\" ? { ...step, fields } : step,\n  );\n  return { ...flow, steps };\n}\n\nexport type DefaultConfigRenderOptions = {\n  builtinSchemaBase?: string;\n  userSchemaUrl?: string;\n  /** Which flow/auth bundle to render; defaults to {@link DEFAULT_SETUP_PRESET}. */\n  preset?: string;\n  /** Which field set to collect; defaults to {@link DEFAULT_SETUP_USE_CASE}. */\n  useCase?: string;\n};\n\nexport function defaultHumanUserSchemaUrl(\n  builtinSchemaBase = DEFAULT_BUILTIN_SCHEMA_BASE,\n): string {\n  return `${trimTrailingSlash(builtinSchemaBase)}/default-human-user.json`;\n}\n\nexport function getDefaultHumanUserSchema(\n  options: DefaultConfigRenderOptions = {},\n): CreateSchemaBody {\n  const builtinSchemaBase = trimTrailingSlash(\n    options.builtinSchemaBase ?? DEFAULT_BUILTIN_SCHEMA_BASE,\n  );\n  const rendered = renderTemplate(presetTemplates(options.preset ?? DEFAULT_SETUP_PRESET).schema, {\n    SERVER_URL: builtinSchemaBase,\n    USER_SCHEMA_URL: options.userSchemaUrl ?? defaultHumanUserSchemaUrl(builtinSchemaBase),\n  }) as Record<string, unknown>;\n  return applyUseCaseToSchema(\n    rendered,\n    options.useCase ?? DEFAULT_SETUP_USE_CASE,\n  ) as CreateSchemaBody;\n}\n\nexport function getDefaultLoginFlow(\n  options: DefaultConfigRenderOptions = {},\n): CreateFlowDefinitionBodyFlowDefinition {\n  const builtinSchemaBase = trimTrailingSlash(\n    options.builtinSchemaBase ?? DEFAULT_BUILTIN_SCHEMA_BASE,\n  );\n  const rendered = renderTemplate(presetTemplates(options.preset ?? DEFAULT_SETUP_PRESET).flow, {\n    SERVER_URL: builtinSchemaBase,\n    USER_SCHEMA_URL: options.userSchemaUrl ?? defaultHumanUserSchemaUrl(builtinSchemaBase),\n  }) as Record<string, unknown>;\n  return applyUseCaseToFlow(\n    rendered,\n    options.useCase ?? DEFAULT_SETUP_USE_CASE,\n  ) as CreateFlowDefinitionBodyFlowDefinition;\n}\n\nfunction renderTemplate(value: unknown, replacements: Record<string, string>): unknown {\n  if (Array.isArray(value)) {\n    return value.map((item) => renderTemplate(item, replacements));\n  }\n  if (value !== null && typeof value === \"object\") {\n    return Object.fromEntries(\n      Object.entries(value).map(([key, item]) => [key, renderTemplate(item, replacements)]),\n    );\n  }\n  if (typeof value === \"string\") {\n    return value.replaceAll(/\\$\\{([A-Z_]+)\\}/g, (match, name: string) => {\n      return replacements[name] ?? match;\n    });\n  }\n  return value;\n}\n\nfunction trimTrailingSlash(value: string): string {\n  let trimmed = value;\n  while (trimmed.endsWith(\"/\")) {\n    trimmed = trimmed.slice(0, -1);\n  }\n  return trimmed;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AIQA,SAAgB,uBAA+B;AAC7C,QAAO,aAAa,UAAU,oBAAoB,EAAE,OAAO;;;;;;AAO7D,SAAgB,qBAA6B;AAC3C,QAAO,aAAa,UAAU,kBAAkB,EAAE,OAAO;;;;;;;AAQ3D,SAAgB,wBAAgC;AAC9C,QAAO,aAAa,UAAU,qBAAqB,EAAE,OAAO;;AAG9D,SAAS,UAAU,UAA0B;AAC3C,QAAO,cAAc,IAAI,IAAI,eAAe,YAAY,OAAO,KAAK,IAAI,CAAC;;;;ACP3E,MAAa,8BAA8B;AAC3C,MAAa,0BAA0B;AACvC,MAAa,6BAA6B;AAC1C,MAAa,2BAA2B;AACxC,MAAa,+BAA+B;AAC5C,MAAa,iCAAiC;;;;;;;;AAS9C,MAAa,gBAAgB,CAAC,kBAAkB,gBAAgB;AAIhE,MAAa,uBAAoC;AAEjD,MAAM,mBAA4E;CAChF,kBAAkB;EAChB,QAAQA;EACR,MAAMC;EACP;CACD,iBAAiB;EACf,QAAQC;EACR,MAAMC;EACP;CACF;AAED,SAAS,gBAAgB,QAAoD;AAI3E,KAAI,CAAC,OAAO,OAAO,kBAAkB,OAAO,CAC1C,OAAM,IAAI,MACR,wBAAwB,KAAK,UAAU,OAAO,CAAC,mBAAmB,cAAc,KAAK,KAAK,CAAC,GAC5F;AAEH,QAAO,iBAAiB;;;;;;;;;AAU1B,MAAa,mBAAmB;CAAC;CAAY;CAAS;CAAe;CAAQ;CAAU;AAIvF,MAAa,0BAA0C;;AAGvD,MAAM,iBAA+D;CACnE,UAAU;CACV,OAAO;CACP,eAAe;CACf,MAAM;CACN,SAAS;CACV;;;;;;AAiBD,SAAgB,yBACd,SAAiB,yBACM;AACvB,KAAI,CAAC,OAAO,OAAO,gBAAgB,OAAO,CACxC,OAAM,IAAI,MACR,2BAA2B,KAAK,UAAU,OAAO,CAAC,mBAAmB,iBAAiB,KAAK,KAAK,CAAC,GAClG;CAEH,MAAM,QAAQ;AACd,QAAO;EACL,UAAU;GACR,QAAQ,eAAe;GACvB,sBAAsB;GACvB;EACD,UAAU,aAAa,gBAAgB,wBAAwB,MAAM,eAAe,EAAE,OAAO;EAC9F;;;;;;;;AASH,SAAS,gBAAgB,UAA0B;CACjD,MAAM,OAAO,cAAc,IAAI,IAAI,UAAU,OAAO,KAAK,IAAI,CAAC;AAC9D,QAAO,KAAK,WAAW,QAAQ,GAAG,KAAK,MAAM,EAAc,GAAG;;;;;;;;;;AAWhE,MAAa,kBAAkB;CAAC;CAAW;CAAY;CAAW;AAIlE,MAAa,yBAAuC;;;;;;;;;AAUpD,MAAM,kBAA2D;CAC/D,SAAS,CAAC,QAAQ;CAClB,UAAU;EAAC;EAAS;EAAa;EAAa;CAC9C,UAAU;EAAC;EAAS;EAAa;EAAc;EAAc;CAC9D;;;;;;;;;;AAWD,MAAM,qBAA8D;CAClE,WAAW;EACT,MAAM;EACN,WAAW;EACX,aAAa;EACd;CACD,YAAY;EACV,MAAM;EACN,WAAW;EACX,aAAa;EACd;CACD,aAAa;EACX,MAAM;EACN,WAAW;EACX,aAAa;EACd;CACF;AAED,SAAS,cAAc,SAAoC;AAGzD,KAAI,CAAC,OAAO,OAAO,iBAAiB,QAAQ,CAC1C,OAAM,IAAI,MACR,0BAA0B,KAAK,UAAU,QAAQ,CAAC,qBAAqB,gBAAgB,KAAK,KAAK,CAAC,GACnG;AAEH,QAAO,gBAAgB;;;;;;;;AASzB,SAAS,UACP,OACA,eACyB;AACzB,KAAI,OAAO,OAAO,eAAe,MAAM,CACrC,QAAO,EAAE,GAAG,cAAc,QAAQ;AAEpC,KAAI,OAAO,OAAO,oBAAoB,MAAM,CAC1C,QAAO,EAAE,GAAG,mBAAmB,QAAQ;AAEzC,QAAO;EAAE,MAAM;EAAU,aAAa,cAAc,MAAM;EAAI;;;;;;;AAQhE,SAAS,qBACP,QACA,SACyB;CACzB,MAAM,gBAAiB,OAAO,cAAc,EAAE;CAC9C,MAAM,aAAsC,EAAE;AAC9C,MAAK,MAAM,SAAS,cAAc,QAAQ,CACxC,YAAW,SAAS,UAAU,OAAO,cAAc;AAErD,QAAO;EAAE,GAAG;EAAQ,UAAU,CAAC,QAAQ;EAAE;EAAY;;;;;;;AAQvD,SAAS,mBACP,MACA,SACyB;CACzB,MAAM,SAAS,CAAC,GAAG,cAAc,QAAQ,CAAC;CAC1C,MAAM,QAAS,KAAK,MAAyC,KAAK,SAChE,KAAK,SAAS,aAAa;EAAE,GAAG;EAAM;EAAQ,GAAG,KAClD;AACD,QAAO;EAAE,GAAG;EAAM;EAAO;;AAY3B,SAAgB,0BACd,oBAAoB,6BACZ;AACR,QAAO,GAAG,kBAAkB,kBAAkB,CAAC;;AAGjD,SAAgB,0BACd,UAAsC,EAAE,EACtB;CAClB,MAAM,oBAAoB,kBACxB,QAAQ,qBAAA,kCACT;AAKD,QAAO,qBAJU,eAAe,gBAAgB,QAAQ,UAAA,iBAA+B,CAAC,QAAQ;EAC9F,YAAY;EACZ,iBAAiB,QAAQ,iBAAiB,0BAA0B,kBAAkB;EACvF,CAES,EACR,QAAQ,WAAA,UACT;;AAGH,SAAgB,oBACd,UAAsC,EAAE,EACA;CACxC,MAAM,oBAAoB,kBACxB,QAAQ,qBAAA,kCACT;AAKD,QAAO,mBAJU,eAAe,gBAAgB,QAAQ,UAAA,iBAA+B,CAAC,MAAM;EAC5F,YAAY;EACZ,iBAAiB,QAAQ,iBAAiB,0BAA0B,kBAAkB;EACvF,CAES,EACR,QAAQ,WAAA,UACT;;AAGH,SAAS,eAAe,OAAgB,cAA+C;AACrF,KAAI,MAAM,QAAQ,MAAM,CACtB,QAAO,MAAM,KAAK,SAAS,eAAe,MAAM,aAAa,CAAC;AAEhE,KAAI,UAAU,QAAQ,OAAO,UAAU,SACrC,QAAO,OAAO,YACZ,OAAO,QAAQ,MAAM,CAAC,KAAK,CAAC,KAAK,UAAU,CAAC,KAAK,eAAe,MAAM,aAAa,CAAC,CAAC,CACtF;AAEH,KAAI,OAAO,UAAU,SACnB,QAAO,MAAM,WAAW,qBAAqB,OAAO,SAAiB;AACnE,SAAO,aAAa,SAAS;GAC7B;AAEJ,QAAO;;AAGT,SAAS,kBAAkB,OAAuB;CAChD,IAAI,UAAU;AACd,QAAO,QAAQ,SAAS,IAAI,CAC1B,WAAU,QAAQ,MAAM,GAAG,GAAG;AAEhC,QAAO"}
+{"version":3,"file":"defaults-DPq0o3iU.mjs","names":["defaultHumanUserSchemaTemplate","defaultLoginFlowTemplate","passkeyFirstHumanUserSchemaTemplate","passkeyFirstLoginFlowTemplate"],"sources":["../defaults/default-human-user.json","../defaults/default-login.json","../defaults/presets/passkey-first/human-user.json","../defaults/presets/passkey-first/login.json","../src/readmes.ts","../src/defaults.ts"],"sourcesContent":["","","","","import { readFileSync } from \"node:fs\";\nimport { fileURLToPath } from \"node:url\";\n\n/**\n * README content the CLI copies to `.zitadel/schemas/README.md` during setup.\n * Source of truth is `packages/config/defaults/README-schemas.md`; the Go\n * server-side embed reads the same file (see `defaults.go`).\n */\nexport function schemasReadmeContent(): string {\n  return readFileSync(readmeUrl(\"README-schemas.md\"), \"utf8\");\n}\n\n/**\n * README content the CLI copies to `.zitadel/flows/README.md` during setup.\n * Source of truth is `packages/config/defaults/README-flows.md`.\n */\nexport function flowsReadmeContent(): string {\n  return readFileSync(readmeUrl(\"README-flows.md\"), \"utf8\");\n}\n\n/**\n * README content the CLI copies to `.zitadel/branding/README.md` when a\n * branding design is ejected. Source of truth is\n * `packages/config/defaults/README-branding.md`.\n */\nexport function brandingReadmeContent(): string {\n  return readFileSync(readmeUrl(\"README-branding.md\"), \"utf8\");\n}\n\nfunction readmeUrl(filename: string): string {\n  return fileURLToPath(new URL(`../defaults/${filename}`, import.meta.url));\n}\n","import { readFileSync } from \"node:fs\";\nimport { fileURLToPath } from \"node:url\";\n\nimport type {\n  CreateFlowDefinitionBodyFlowDefinition,\n  CreateSchemaBody,\n} from \"@zitadel/api/generated/model\";\n\nimport defaultHumanUserSchemaTemplate from \"../defaults/default-human-user.json\" with {\n  type: \"json\",\n};\nimport defaultLoginFlowTemplate from \"../defaults/default-login.json\" with {\n  type: \"json\",\n};\nimport passkeyFirstHumanUserSchemaTemplate from \"../defaults/presets/passkey-first/human-user.json\" with {\n  type: \"json\",\n};\nimport passkeyFirstLoginFlowTemplate from \"../defaults/presets/passkey-first/login.json\" with {\n  type: \"json\",\n};\n\nexport { brandingReadmeContent, flowsReadmeContent, schemasReadmeContent } from \"./readmes.js\";\n\nexport const DEFAULT_BUILTIN_SCHEMA_BASE = \"https://nextgen.com/api/schemas\";\nexport const DEFAULT_FLOW_SCHEMA_URI = \"https://nextgen.com/flow-definition.json\";\nexport const DEFAULT_SCHEMA_CONFIG_PATH = \".zitadel/schemas/default-human-user.json\";\nexport const DEFAULT_FLOW_CONFIG_PATH = \".zitadel/flows/default-login.json\";\nexport const DEFAULT_BRANDING_CONFIG_PATH = \".zitadel/branding/branding.json\";\nexport const DEFAULT_BRANDING_TEMPLATE_PATH = \".zitadel/branding/login.liquid\";\n\n/**\n * Named schema+flow bundles `zitadel setup` can scaffold (#448: the prompt\n * fires before any `.zitadel/` file is written; each preset maps to a\n * pre-defined bundle the CLI copies on first setup). `password-first` is\n * today's default; `passkey-first` puts a passkey ceremony on the login\n * entry step with an email→password fallback path.\n */\nexport const SETUP_PRESETS = [\"password-first\", \"passkey-first\"] as const;\n\nexport type SetupPreset = (typeof SETUP_PRESETS)[number];\n\nexport const DEFAULT_SETUP_PRESET: SetupPreset = \"password-first\";\n\nconst PRESET_TEMPLATES: Record<SetupPreset, { schema: unknown; flow: unknown }> = {\n  \"password-first\": {\n    schema: defaultHumanUserSchemaTemplate,\n    flow: defaultLoginFlowTemplate,\n  },\n  \"passkey-first\": {\n    schema: passkeyFirstHumanUserSchemaTemplate,\n    flow: passkeyFirstLoginFlowTemplate,\n  },\n};\n\nfunction presetTemplates(preset: string): { schema: unknown; flow: unknown } {\n  // Own-property check: indexing a plain object with an arbitrary string\n  // would let \"__proto__\"/\"constructor\" resolve via the prototype chain\n  // and bypass the unknown-preset error.\n  if (!Object.hasOwn(PRESET_TEMPLATES, preset)) {\n    throw new Error(\n      `unknown setup preset ${JSON.stringify(preset)} (known presets: ${SETUP_PRESETS.join(\", \")})`,\n    );\n  }\n  return PRESET_TEMPLATES[preset as SetupPreset];\n}\n\n/**\n * Login-design starting points `zitadel branding eject --design <name>` (and\n * `zitadel setup --design <name>`) scaffold into `.zitadel/branding/`. A\n * design is a full Liquid template plus the descriptor `layout` it degrades\n * to — the wire `layout` enum stays `centered | split`, richer designs are\n * delivered as templates (ADR 040).\n */\nexport const BRANDING_DESIGNS = [\"centered\", \"split\", \"split-right\", \"hero\", \"minimal\"] as const;\n\nexport type BrandingDesign = (typeof BRANDING_DESIGNS)[number];\n\nexport const DEFAULT_BRANDING_DESIGN: BrandingDesign = \"centered\";\n\n/** Descriptor `layout` each design degrades to when its template is rejected. */\nconst DESIGN_LAYOUTS: Record<BrandingDesign, \"centered\" | \"split\"> = {\n  centered: \"centered\",\n  split: \"split\",\n  \"split-right\": \"split\",\n  hero: \"split\",\n  minimal: \"centered\",\n};\n\nexport type DefaultBrandingConfig = {\n  /** The `.zitadel/branding/branding.json` descriptor body (sans `$schema`). */\n  branding: {\n    layout: \"centered\" | \"split\";\n    liquid_template_file: string;\n  };\n  /** The `.zitadel/branding/login.liquid` template content. */\n  template: string;\n};\n\n/**\n * Renders the scaffold files for a branding design. The `centered` template\n * is a drift-tested copy of the bundled default in `@zitadel/components`;\n * the other designs are authored variants of it.\n */\nexport function getDefaultBrandingConfig(\n  design: string = DEFAULT_BRANDING_DESIGN,\n): DefaultBrandingConfig {\n  if (!Object.hasOwn(DESIGN_LAYOUTS, design)) {\n    throw new Error(\n      `unknown branding design ${JSON.stringify(design)} (known designs: ${BRANDING_DESIGNS.join(\", \")})`,\n    );\n  }\n  const known = design as BrandingDesign;\n  return {\n    branding: {\n      layout: DESIGN_LAYOUTS[known],\n      liquid_template_file: \"./login.liquid\",\n    },\n    template: readFileSync(packageFilePath(`../defaults/branding/${known}/login.liquid`), \"utf8\"),\n  };\n}\n\n/**\n * Resolves a package-relative file to a real filesystem path. Vite-driven\n * runtimes (vitest in dependent packages) rewrite `import.meta.url` to a\n * `/@fs/...` URL, which `fileURLToPath` passes through verbatim — strip the\n * prefix so `readFileSync` gets an actual path.\n */\nfunction packageFilePath(relative: string): string {\n  const path = fileURLToPath(new URL(relative, import.meta.url));\n  return path.startsWith(\"/@fs/\") ? path.slice(\"/@fs\".length) : path;\n}\n\n/**\n * The second setup axis (#448): *who* signs in, orthogonal to the sign-in\n * preset (*how* they sign in). The sign-in preset owns the flow shape and\n * auth methods; the use case owns which profile fields the schema collects.\n * Composing the two keeps us at one field catalog + one flow-per-preset\n * instead of a bundle per (use case × preset) pair. `minimal` is the\n * default and never blocks non-interactive runs.\n */\nexport const SETUP_USE_CASES = [\"minimal\", \"consumer\", \"business\"] as const;\n\nexport type SetupUseCase = (typeof SETUP_USE_CASES)[number];\n\nexport const DEFAULT_SETUP_USE_CASE: SetupUseCase = \"minimal\";\n\n/**\n * Fields each use case collects, in register/display order. `email` is\n * always first and stays the only required property; the rest are optional\n * profile attributes gathered on the flow's register step. `givenName`/\n * `familyName` are the attributes the backend reads for a user's identity\n * (`internal/domain/user.go`); `companyName` is stored as a plain user\n * attribute today — there is no org/team model behind it yet.\n */\nconst USE_CASE_FIELDS: Record<SetupUseCase, readonly string[]> = {\n  minimal: [\"email\"],\n  consumer: [\"email\", \"givenName\", \"familyName\"],\n  business: [\"email\", \"givenName\", \"familyName\", \"companyName\"],\n};\n\n/**\n * JSON-Schema bodies for the optional profile fields the CLI composes in per\n * use case. The shipped templates are an email-only baseline (shared verbatim\n * with the Go server fallback), so this catalog owns every field beyond\n * `email`. Authored in the templates' style — no `x-claim`, since the backend\n * maps identity by attribute name and the user-property meta-schema defines no\n * claim keyword. `givenName`/`familyName` are the attributes the backend reads\n * for a user's identity (`internal/domain/user.go`).\n */\nconst EXTRA_FIELD_BODIES: Record<string, Record<string, unknown>> = {\n  givenName: {\n    type: \"string\",\n    maxLength: 50,\n    description: \"The user's given (first) name.\",\n  },\n  familyName: {\n    type: \"string\",\n    maxLength: 50,\n    description: \"The user's family (last) name.\",\n  },\n  companyName: {\n    type: \"string\",\n    maxLength: 200,\n    description: \"The user's company name.\",\n  },\n};\n\nfunction useCaseFields(useCase: string): readonly string[] {\n  // Own-property check, same rationale as presetTemplates: keep prototype\n  // keys (\"__proto__\" etc.) from resolving to a real field list.\n  if (!Object.hasOwn(USE_CASE_FIELDS, useCase)) {\n    throw new Error(\n      `unknown setup use case ${JSON.stringify(useCase)} (known use cases: ${SETUP_USE_CASES.join(\", \")})`,\n    );\n  }\n  return USE_CASE_FIELDS[useCase as SetupUseCase];\n}\n\n/**\n * The body for one use-case field: reuse the template's authored body when it\n * has one (so composed schemas match the shipped defaults for shared fields),\n * else the extra catalog, else a generic editable string so composition stays\n * total for any field a future use case introduces.\n */\nfunction fieldBody(\n  field: string,\n  templateProps: Record<string, Record<string, unknown>>,\n): Record<string, unknown> {\n  if (Object.hasOwn(templateProps, field)) {\n    return { ...templateProps[field] };\n  }\n  if (Object.hasOwn(EXTRA_FIELD_BODIES, field)) {\n    return { ...EXTRA_FIELD_BODIES[field] };\n  }\n  return { type: \"string\", description: `The user's ${field}.` };\n}\n\n/**\n * Narrow a rendered schema to the chosen use case: keep the preset-owned\n * header and `x-auth-methods`, but replace `properties`/`required` with the\n * use case's field set. `email` is the sole required property.\n */\nfunction applyUseCaseToSchema(\n  schema: Record<string, unknown>,\n  useCase: string,\n): Record<string, unknown> {\n  const templateProps = (schema.properties ?? {}) as Record<string, Record<string, unknown>>;\n  const properties: Record<string, unknown> = {};\n  for (const field of useCaseFields(useCase)) {\n    properties[field] = fieldBody(field, templateProps);\n  }\n  return { ...schema, required: [\"email\"], properties };\n}\n\n/**\n * Derive the flow's register-step fields from the use case rather than\n * copying a hard-coded list into every bundle (#448): the register step\n * collects exactly what the schema defines. Other steps are untouched.\n */\nfunction applyUseCaseToFlow(\n  flow: Record<string, unknown>,\n  useCase: string,\n): Record<string, unknown> {\n  const fields = [...useCaseFields(useCase)];\n  const steps = (flow.steps as Array<Record<string, unknown>>).map((step) =>\n    step.name === \"register\" ? { ...step, fields } : step,\n  );\n  return { ...flow, steps };\n}\n\nexport type DefaultConfigRenderOptions = {\n  builtinSchemaBase?: string;\n  userSchemaUrl?: string;\n  /** Which flow/auth bundle to render; defaults to {@link DEFAULT_SETUP_PRESET}. */\n  preset?: string;\n  /** Which field set to collect; defaults to {@link DEFAULT_SETUP_USE_CASE}. */\n  useCase?: string;\n};\n\nexport function defaultHumanUserSchemaUrl(\n  builtinSchemaBase = DEFAULT_BUILTIN_SCHEMA_BASE,\n): string {\n  return `${trimTrailingSlash(builtinSchemaBase)}/default-human-user.json`;\n}\n\nexport function getDefaultHumanUserSchema(\n  options: DefaultConfigRenderOptions = {},\n): CreateSchemaBody {\n  const builtinSchemaBase = trimTrailingSlash(\n    options.builtinSchemaBase ?? DEFAULT_BUILTIN_SCHEMA_BASE,\n  );\n  const rendered = renderTemplate(presetTemplates(options.preset ?? DEFAULT_SETUP_PRESET).schema, {\n    SERVER_URL: builtinSchemaBase,\n    USER_SCHEMA_URL: options.userSchemaUrl ?? defaultHumanUserSchemaUrl(builtinSchemaBase),\n  }) as Record<string, unknown>;\n  return applyUseCaseToSchema(\n    rendered,\n    options.useCase ?? DEFAULT_SETUP_USE_CASE,\n  ) as CreateSchemaBody;\n}\n\nexport function getDefaultLoginFlow(\n  options: DefaultConfigRenderOptions = {},\n): CreateFlowDefinitionBodyFlowDefinition {\n  const builtinSchemaBase = trimTrailingSlash(\n    options.builtinSchemaBase ?? DEFAULT_BUILTIN_SCHEMA_BASE,\n  );\n  const rendered = renderTemplate(presetTemplates(options.preset ?? DEFAULT_SETUP_PRESET).flow, {\n    SERVER_URL: builtinSchemaBase,\n    USER_SCHEMA_URL: options.userSchemaUrl ?? defaultHumanUserSchemaUrl(builtinSchemaBase),\n  }) as Record<string, unknown>;\n  return applyUseCaseToFlow(\n    rendered,\n    options.useCase ?? DEFAULT_SETUP_USE_CASE,\n  ) as CreateFlowDefinitionBodyFlowDefinition;\n}\n\nfunction renderTemplate(value: unknown, replacements: Record<string, string>): unknown {\n  if (Array.isArray(value)) {\n    return value.map((item) => renderTemplate(item, replacements));\n  }\n  if (value !== null && typeof value === \"object\") {\n    return Object.fromEntries(\n      Object.entries(value).map(([key, item]) => [key, renderTemplate(item, replacements)]),\n    );\n  }\n  if (typeof value === \"string\") {\n    return value.replaceAll(/\\$\\{([A-Z_]+)\\}/g, (match, name: string) => {\n      return replacements[name] ?? match;\n    });\n  }\n  return value;\n}\n\nfunction trimTrailingSlash(value: string): string {\n  let trimmed = value;\n  while (trimmed.endsWith(\"/\")) {\n    trimmed = trimmed.slice(0, -1);\n  }\n  return trimmed;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AIQA,SAAgB,uBAA+B;AAC7C,QAAO,aAAa,UAAU,oBAAoB,EAAE,OAAO;;;;;;AAO7D,SAAgB,qBAA6B;AAC3C,QAAO,aAAa,UAAU,kBAAkB,EAAE,OAAO;;;;;;;AAQ3D,SAAgB,wBAAgC;AAC9C,QAAO,aAAa,UAAU,qBAAqB,EAAE,OAAO;;AAG9D,SAAS,UAAU,UAA0B;AAC3C,QAAO,cAAc,IAAI,IAAI,eAAe,YAAY,OAAO,KAAK,IAAI,CAAC;;;;ACP3E,MAAa,8BAA8B;AAC3C,MAAa,0BAA0B;AACvC,MAAa,6BAA6B;AAC1C,MAAa,2BAA2B;AACxC,MAAa,+BAA+B;AAC5C,MAAa,iCAAiC;;;;;;;;AAS9C,MAAa,gBAAgB,CAAC,kBAAkB,gBAAgB;AAIhE,MAAa,uBAAoC;AAEjD,MAAM,mBAA4E;CAChF,kBAAkB;EAChB,QAAQA;EACR,MAAMC;EACP;CACD,iBAAiB;EACf,QAAQC;EACR,MAAMC;EACP;CACF;AAED,SAAS,gBAAgB,QAAoD;AAI3E,KAAI,CAAC,OAAO,OAAO,kBAAkB,OAAO,CAC1C,OAAM,IAAI,MACR,wBAAwB,KAAK,UAAU,OAAO,CAAC,mBAAmB,cAAc,KAAK,KAAK,CAAC,GAC5F;AAEH,QAAO,iBAAiB;;;;;;;;;AAU1B,MAAa,mBAAmB;CAAC;CAAY;CAAS;CAAe;CAAQ;CAAU;AAIvF,MAAa,0BAA0C;;AAGvD,MAAM,iBAA+D;CACnE,UAAU;CACV,OAAO;CACP,eAAe;CACf,MAAM;CACN,SAAS;CACV;;;;;;AAiBD,SAAgB,yBACd,SAAiB,yBACM;AACvB,KAAI,CAAC,OAAO,OAAO,gBAAgB,OAAO,CACxC,OAAM,IAAI,MACR,2BAA2B,KAAK,UAAU,OAAO,CAAC,mBAAmB,iBAAiB,KAAK,KAAK,CAAC,GAClG;CAEH,MAAM,QAAQ;AACd,QAAO;EACL,UAAU;GACR,QAAQ,eAAe;GACvB,sBAAsB;GACvB;EACD,UAAU,aAAa,gBAAgB,wBAAwB,MAAM,eAAe,EAAE,OAAO;EAC9F;;;;;;;;AASH,SAAS,gBAAgB,UAA0B;CACjD,MAAM,OAAO,cAAc,IAAI,IAAI,UAAU,OAAO,KAAK,IAAI,CAAC;AAC9D,QAAO,KAAK,WAAW,QAAQ,GAAG,KAAK,MAAM,EAAc,GAAG;;;;;;;;;;AAWhE,MAAa,kBAAkB;CAAC;CAAW;CAAY;CAAW;AAIlE,MAAa,yBAAuC;;;;;;;;;AAUpD,MAAM,kBAA2D;CAC/D,SAAS,CAAC,QAAQ;CAClB,UAAU;EAAC;EAAS;EAAa;EAAa;CAC9C,UAAU;EAAC;EAAS;EAAa;EAAc;EAAc;CAC9D;;;;;;;;;;AAWD,MAAM,qBAA8D;CAClE,WAAW;EACT,MAAM;EACN,WAAW;EACX,aAAa;EACd;CACD,YAAY;EACV,MAAM;EACN,WAAW;EACX,aAAa;EACd;CACD,aAAa;EACX,MAAM;EACN,WAAW;EACX,aAAa;EACd;CACF;AAED,SAAS,cAAc,SAAoC;AAGzD,KAAI,CAAC,OAAO,OAAO,iBAAiB,QAAQ,CAC1C,OAAM,IAAI,MACR,0BAA0B,KAAK,UAAU,QAAQ,CAAC,qBAAqB,gBAAgB,KAAK,KAAK,CAAC,GACnG;AAEH,QAAO,gBAAgB;;;;;;;;AASzB,SAAS,UACP,OACA,eACyB;AACzB,KAAI,OAAO,OAAO,eAAe,MAAM,CACrC,QAAO,EAAE,GAAG,cAAc,QAAQ;AAEpC,KAAI,OAAO,OAAO,oBAAoB,MAAM,CAC1C,QAAO,EAAE,GAAG,mBAAmB,QAAQ;AAEzC,QAAO;EAAE,MAAM;EAAU,aAAa,cAAc,MAAM;EAAI;;;;;;;AAQhE,SAAS,qBACP,QACA,SACyB;CACzB,MAAM,gBAAiB,OAAO,cAAc,EAAE;CAC9C,MAAM,aAAsC,EAAE;AAC9C,MAAK,MAAM,SAAS,cAAc,QAAQ,CACxC,YAAW,SAAS,UAAU,OAAO,cAAc;AAErD,QAAO;EAAE,GAAG;EAAQ,UAAU,CAAC,QAAQ;EAAE;EAAY;;;;;;;AAQvD,SAAS,mBACP,MACA,SACyB;CACzB,MAAM,SAAS,CAAC,GAAG,cAAc,QAAQ,CAAC;CAC1C,MAAM,QAAS,KAAK,MAAyC,KAAK,SAChE,KAAK,SAAS,aAAa;EAAE,GAAG;EAAM;EAAQ,GAAG,KAClD;AACD,QAAO;EAAE,GAAG;EAAM;EAAO;;AAY3B,SAAgB,0BACd,oBAAoB,6BACZ;AACR,QAAO,GAAG,kBAAkB,kBAAkB,CAAC;;AAGjD,SAAgB,0BACd,UAAsC,EAAE,EACtB;CAClB,MAAM,oBAAoB,kBACxB,QAAQ,qBAAA,kCACT;AAKD,QAAO,qBAJU,eAAe,gBAAgB,QAAQ,UAAA,iBAA+B,CAAC,QAAQ;EAC9F,YAAY;EACZ,iBAAiB,QAAQ,iBAAiB,0BAA0B,kBAAkB;EACvF,CAES,EACR,QAAQ,WAAA,UACT;;AAGH,SAAgB,oBACd,UAAsC,EAAE,EACA;CACxC,MAAM,oBAAoB,kBACxB,QAAQ,qBAAA,kCACT;AAKD,QAAO,mBAJU,eAAe,gBAAgB,QAAQ,UAAA,iBAA+B,CAAC,MAAM;EAC5F,YAAY;EACZ,iBAAiB,QAAQ,iBAAiB,0BAA0B,kBAAkB;EACvF,CAES,EACR,QAAQ,WAAA,UACT;;AAGH,SAAS,eAAe,OAAgB,cAA+C;AACrF,KAAI,MAAM,QAAQ,MAAM,CACtB,QAAO,MAAM,KAAK,SAAS,eAAe,MAAM,aAAa,CAAC;AAEhE,KAAI,UAAU,QAAQ,OAAO,UAAU,SACrC,QAAO,OAAO,YACZ,OAAO,QAAQ,MAAM,CAAC,KAAK,CAAC,KAAK,UAAU,CAAC,KAAK,eAAe,MAAM,aAAa,CAAC,CAAC,CACtF;AAEH,KAAI,OAAO,UAAU,SACnB,QAAO,MAAM,WAAW,qBAAqB,OAAO,SAAiB;AACnE,SAAO,aAAa,SAAS;GAC7B;AAEJ,QAAO;;AAGT,SAAS,kBAAkB,OAAuB;CAChD,IAAI,UAAU;AACd,QAAO,QAAQ,SAAS,IAAI,CAC1B,WAAU,QAAQ,MAAM,GAAG,GAAG;AAEhC,QAAO"}

package/dist/defaults.mjs

@@ -1,2 +1,2 @@
-import { _ as brandingReadmeContent, a as DEFAULT_BUILTIN_SCHEMA_BASE, c as DEFAULT_SCHEMA_CONFIG_PATH, d as SETUP_PRESETS, f as SETUP_USE_CASES, g as getDefaultLoginFlow, h as getDefaultHumanUserSchema, i as DEFAULT_BRANDING_TEMPLATE_PATH, l as DEFAULT_SETUP_PRESET, m as getDefaultBrandingConfig, n as DEFAULT_BRANDING_CONFIG_PATH, o as DEFAULT_FLOW_CONFIG_PATH, p as defaultHumanUserSchemaUrl, r as DEFAULT_BRANDING_DESIGN, s as DEFAULT_FLOW_SCHEMA_URI, t as BRANDING_DESIGNS, u as DEFAULT_SETUP_USE_CASE, v as flowsReadmeContent, y as schemasReadmeContent } from "./defaults-CXTnFMHj.mjs";
+import { _ as brandingReadmeContent, a as DEFAULT_BUILTIN_SCHEMA_BASE, c as DEFAULT_SCHEMA_CONFIG_PATH, d as SETUP_PRESETS, f as SETUP_USE_CASES, g as getDefaultLoginFlow, h as getDefaultHumanUserSchema, i as DEFAULT_BRANDING_TEMPLATE_PATH, l as DEFAULT_SETUP_PRESET, m as getDefaultBrandingConfig, n as DEFAULT_BRANDING_CONFIG_PATH, o as DEFAULT_FLOW_CONFIG_PATH, p as defaultHumanUserSchemaUrl, r as DEFAULT_BRANDING_DESIGN, s as DEFAULT_FLOW_SCHEMA_URI, t as BRANDING_DESIGNS, u as DEFAULT_SETUP_USE_CASE, v as flowsReadmeContent, y as schemasReadmeContent } from "./defaults-DPq0o3iU.mjs";
 export { BRANDING_DESIGNS, DEFAULT_BRANDING_CONFIG_PATH, DEFAULT_BRANDING_DESIGN, DEFAULT_BRANDING_TEMPLATE_PATH, DEFAULT_BUILTIN_SCHEMA_BASE, DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, DEFAULT_SETUP_PRESET, DEFAULT_SETUP_USE_CASE, SETUP_PRESETS, SETUP_USE_CASES, brandingReadmeContent, defaultHumanUserSchemaUrl, flowsReadmeContent, getDefaultBrandingConfig, getDefaultHumanUserSchema, getDefaultLoginFlow, schemasReadmeContent };

package/dist/index.d.mts

@@ -1,7 +1,8 @@
+import { isCanonicalLoopbackHttpUrl } from "./branding-url.mjs";
 import { C as flowsReadmeContent, S as brandingReadmeContent, _ as SetupUseCase, a as DEFAULT_BRANDING_TEMPLATE_PATH, b as getDefaultHumanUserSchema, c as DEFAULT_FLOW_SCHEMA_URI, d as DEFAULT_SETUP_USE_CASE, f as DefaultBrandingConfig, g as SetupPreset, h as SETUP_USE_CASES, i as DEFAULT_BRANDING_DESIGN, l as DEFAULT_SCHEMA_CONFIG_PATH, m as SETUP_PRESETS, n as BrandingDesign, o as DEFAULT_BUILTIN_SCHEMA_BASE, p as DefaultConfigRenderOptions, r as DEFAULT_BRANDING_CONFIG_PATH, s as DEFAULT_FLOW_CONFIG_PATH, t as BRANDING_DESIGNS, u as DEFAULT_SETUP_PRESET, v as defaultHumanUserSchemaUrl, w as schemasReadmeContent, x as getDefaultLoginFlow, y as getDefaultBrandingConfig } from "./defaults-Bh4_xVbh.mjs";
 import { BRANDING_FILE_SCHEMA_REF, FLOW_FILE_SCHEMA_REF, META_SCHEMA_DIR, MetaSchemaFile, metaSchemaFiles } from "./meta-schemas.mjs";
 import { USER_PROPERTY_DEFAULTS, normalizeFlowBody, normalizeSchemaBody } from "./normalize.mjs";
 import { brandingConfigSchema, brandingWireSchema, createFlowDefinitionRequestSchema, flowConfigSchema, schemaConfigSchema } from "./schemas.mjs";
 import { BANNED_TEMPLATE_PATTERNS, MANDATORY_GATES_TAG, MAX_TEMPLATE_BYTES, TEMPLATE_TAGS, TEMPLATE_VALIDATION_RULES, TemplateValidationIssue, TemplateValidationRuleId, TemplateValidationSeverity, validateLoginTemplate } from "./template.mjs";
 import { FLOW_PURPOSES, FLOW_VALIDATION_RULES, FlowValidationIssue, FlowValidationRuleId, FlowValidationSeverity, PURPOSE_FLIP_TARGETS, RESERVED_OUTCOMES, validateFlowDefinition } from "./validate.mjs";
-export { BANNED_TEMPLATE_PATTERNS, BRANDING_DESIGNS, BRANDING_FILE_SCHEMA_REF, BrandingDesign, DEFAULT_BRANDING_CONFIG_PATH, DEFAULT_BRANDING_DESIGN, DEFAULT_BRANDING_TEMPLATE_PATH, DEFAULT_BUILTIN_SCHEMA_BASE, DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, DEFAULT_SETUP_PRESET, DEFAULT_SETUP_USE_CASE, DefaultBrandingConfig, DefaultConfigRenderOptions, FLOW_FILE_SCHEMA_REF, FLOW_PURPOSES, FLOW_VALIDATION_RULES, FlowValidationIssue, FlowValidationRuleId, FlowValidationSeverity, MANDATORY_GATES_TAG, MAX_TEMPLATE_BYTES, META_SCHEMA_DIR, MetaSchemaFile, PURPOSE_FLIP_TARGETS, RESERVED_OUTCOMES, SETUP_PRESETS, SETUP_USE_CASES, SetupPreset, SetupUseCase, TEMPLATE_TAGS, TEMPLATE_VALIDATION_RULES, TemplateValidationIssue, TemplateValidationRuleId, TemplateValidationSeverity, USER_PROPERTY_DEFAULTS, brandingConfigSchema, brandingReadmeContent, brandingWireSchema, createFlowDefinitionRequestSchema, defaultHumanUserSchemaUrl, flowConfigSchema, flowsReadmeContent, getDefaultBrandingConfig, getDefaultHumanUserSchema, getDefaultLoginFlow, metaSchemaFiles, normalizeFlowBody, normalizeSchemaBody, schemaConfigSchema, schemasReadmeContent, validateFlowDefinition, validateLoginTemplate };
+export { BANNED_TEMPLATE_PATTERNS, BRANDING_DESIGNS, BRANDING_FILE_SCHEMA_REF, BrandingDesign, DEFAULT_BRANDING_CONFIG_PATH, DEFAULT_BRANDING_DESIGN, DEFAULT_BRANDING_TEMPLATE_PATH, DEFAULT_BUILTIN_SCHEMA_BASE, DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, DEFAULT_SETUP_PRESET, DEFAULT_SETUP_USE_CASE, DefaultBrandingConfig, DefaultConfigRenderOptions, FLOW_FILE_SCHEMA_REF, FLOW_PURPOSES, FLOW_VALIDATION_RULES, FlowValidationIssue, FlowValidationRuleId, FlowValidationSeverity, MANDATORY_GATES_TAG, MAX_TEMPLATE_BYTES, META_SCHEMA_DIR, MetaSchemaFile, PURPOSE_FLIP_TARGETS, RESERVED_OUTCOMES, SETUP_PRESETS, SETUP_USE_CASES, SetupPreset, SetupUseCase, TEMPLATE_TAGS, TEMPLATE_VALIDATION_RULES, TemplateValidationIssue, TemplateValidationRuleId, TemplateValidationSeverity, USER_PROPERTY_DEFAULTS, brandingConfigSchema, brandingReadmeContent, brandingWireSchema, createFlowDefinitionRequestSchema, defaultHumanUserSchemaUrl, flowConfigSchema, flowsReadmeContent, getDefaultBrandingConfig, getDefaultHumanUserSchema, getDefaultLoginFlow, isCanonicalLoopbackHttpUrl, metaSchemaFiles, normalizeFlowBody, normalizeSchemaBody, schemaConfigSchema, schemasReadmeContent, validateFlowDefinition, validateLoginTemplate };

package/dist/index.mjs

@@ -1,7 +1,8 @@
-import { _ as brandingReadmeContent, a as DEFAULT_BUILTIN_SCHEMA_BASE, c as DEFAULT_SCHEMA_CONFIG_PATH, d as SETUP_PRESETS, f as SETUP_USE_CASES, g as getDefaultLoginFlow, h as getDefaultHumanUserSchema, i as DEFAULT_BRANDING_TEMPLATE_PATH, l as DEFAULT_SETUP_PRESET, m as getDefaultBrandingConfig, n as DEFAULT_BRANDING_CONFIG_PATH, o as DEFAULT_FLOW_CONFIG_PATH, p as defaultHumanUserSchemaUrl, r as DEFAULT_BRANDING_DESIGN, s as DEFAULT_FLOW_SCHEMA_URI, t as BRANDING_DESIGNS, u as DEFAULT_SETUP_USE_CASE, v as flowsReadmeContent, y as schemasReadmeContent } from "./defaults-CXTnFMHj.mjs";
-import { i as metaSchemaFiles, n as FLOW_FILE_SCHEMA_REF, r as META_SCHEMA_DIR, t as BRANDING_FILE_SCHEMA_REF } from "./meta-schemas-B4YiHAX_.mjs";
+import { isCanonicalLoopbackHttpUrl } from "./branding-url.mjs";
+import { _ as brandingReadmeContent, a as DEFAULT_BUILTIN_SCHEMA_BASE, c as DEFAULT_SCHEMA_CONFIG_PATH, d as SETUP_PRESETS, f as SETUP_USE_CASES, g as getDefaultLoginFlow, h as getDefaultHumanUserSchema, i as DEFAULT_BRANDING_TEMPLATE_PATH, l as DEFAULT_SETUP_PRESET, m as getDefaultBrandingConfig, n as DEFAULT_BRANDING_CONFIG_PATH, o as DEFAULT_FLOW_CONFIG_PATH, p as defaultHumanUserSchemaUrl, r as DEFAULT_BRANDING_DESIGN, s as DEFAULT_FLOW_SCHEMA_URI, t as BRANDING_DESIGNS, u as DEFAULT_SETUP_USE_CASE, v as flowsReadmeContent, y as schemasReadmeContent } from "./defaults-DPq0o3iU.mjs";
+import { i as metaSchemaFiles, n as FLOW_FILE_SCHEMA_REF, r as META_SCHEMA_DIR, t as BRANDING_FILE_SCHEMA_REF } from "./meta-schemas-z4IlqbLd.mjs";
 import { USER_PROPERTY_DEFAULTS, normalizeFlowBody, normalizeSchemaBody } from "./normalize.mjs";
 import { brandingConfigSchema, brandingWireSchema, createFlowDefinitionRequestSchema, flowConfigSchema, schemaConfigSchema } from "./schemas.mjs";
 import { BANNED_TEMPLATE_PATTERNS, MANDATORY_GATES_TAG, MAX_TEMPLATE_BYTES, TEMPLATE_TAGS, TEMPLATE_VALIDATION_RULES, validateLoginTemplate } from "./template.mjs";
 import { FLOW_PURPOSES, FLOW_VALIDATION_RULES, PURPOSE_FLIP_TARGETS, RESERVED_OUTCOMES, validateFlowDefinition } from "./validate.mjs";
-export { BANNED_TEMPLATE_PATTERNS, BRANDING_DESIGNS, BRANDING_FILE_SCHEMA_REF, DEFAULT_BRANDING_CONFIG_PATH, DEFAULT_BRANDING_DESIGN, DEFAULT_BRANDING_TEMPLATE_PATH, DEFAULT_BUILTIN_SCHEMA_BASE, DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, DEFAULT_SETUP_PRESET, DEFAULT_SETUP_USE_CASE, FLOW_FILE_SCHEMA_REF, FLOW_PURPOSES, FLOW_VALIDATION_RULES, MANDATORY_GATES_TAG, MAX_TEMPLATE_BYTES, META_SCHEMA_DIR, PURPOSE_FLIP_TARGETS, RESERVED_OUTCOMES, SETUP_PRESETS, SETUP_USE_CASES, TEMPLATE_TAGS, TEMPLATE_VALIDATION_RULES, USER_PROPERTY_DEFAULTS, brandingConfigSchema, brandingReadmeContent, brandingWireSchema, createFlowDefinitionRequestSchema, defaultHumanUserSchemaUrl, flowConfigSchema, flowsReadmeContent, getDefaultBrandingConfig, getDefaultHumanUserSchema, getDefaultLoginFlow, metaSchemaFiles, normalizeFlowBody, normalizeSchemaBody, schemaConfigSchema, schemasReadmeContent, validateFlowDefinition, validateLoginTemplate };
+export { BANNED_TEMPLATE_PATTERNS, BRANDING_DESIGNS, BRANDING_FILE_SCHEMA_REF, DEFAULT_BRANDING_CONFIG_PATH, DEFAULT_BRANDING_DESIGN, DEFAULT_BRANDING_TEMPLATE_PATH, DEFAULT_BUILTIN_SCHEMA_BASE, DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, DEFAULT_SETUP_PRESET, DEFAULT_SETUP_USE_CASE, FLOW_FILE_SCHEMA_REF, FLOW_PURPOSES, FLOW_VALIDATION_RULES, MANDATORY_GATES_TAG, MAX_TEMPLATE_BYTES, META_SCHEMA_DIR, PURPOSE_FLIP_TARGETS, RESERVED_OUTCOMES, SETUP_PRESETS, SETUP_USE_CASES, TEMPLATE_TAGS, TEMPLATE_VALIDATION_RULES, USER_PROPERTY_DEFAULTS, brandingConfigSchema, brandingReadmeContent, brandingWireSchema, createFlowDefinitionRequestSchema, defaultHumanUserSchemaUrl, flowConfigSchema, flowsReadmeContent, getDefaultBrandingConfig, getDefaultHumanUserSchema, getDefaultLoginFlow, isCanonicalLoopbackHttpUrl, metaSchemaFiles, normalizeFlowBody, normalizeSchemaBody, schemaConfigSchema, schemasReadmeContent, validateFlowDefinition, validateLoginTemplate };