@zitadel/config 0.1.0-alpha.18 → 1.0.0-alpha.20

package/dist/{meta-schemas-B4YiHAX_.mjs → meta-schemas-z4IlqbLd.mjs}

@@ -3,18 +3,12 @@ var auth_method_default = {
 	$schema: "https://json-schema.org/draft/2020-12/schema",
 	title: "AuthMethod",
 	type: "object",
-	required: ["enabled", "position"],
-	properties: {
-		"enabled": {
-			"type": "boolean",
-			"description": "Whether the authentication method is enabled or not"
-		},
-		"position": {
-			"type": "integer",
-			"minimum": 0,
-			"description": "The position of the authentication method in the list of supported methods"
-		}
-	}
+	required: ["enabled"],
+	additionalProperties: false,
+	properties: { "enabled": {
+		"type": "boolean",
+		"description": "Whether the authentication method is enabled or not"
+	} }
 };
 //#endregion
 //#region meta-schemas/auth-methods.json
@@ -49,7 +43,7 @@ var branding_default = {
 			"type": "string",
 			"enum": ["centered", "split"],
 			"default": "centered",
-			"description": "Layout preset the bundled default template branches on. Custom templates may ignore it; it also serves as the degrade target when a template fails component-side validation."
+			"description": "Degrade preset (`centered` or `split`) the bundled default template branches on, not the complete design catalog. All named designs (`centered`, `split`, `split-right`, `hero`, `minimal`) ship as templates and map onto one of these two values; switch designs with the `branding eject --design <name>` command instead of editing this field. Custom templates may ignore it; the preset is also used when a template fails component-side validation."
 		},
 		"liquid_template_file": {
 			"type": "string",
@@ -64,14 +58,14 @@ var branding_default = {
 		"logo_url": {
 			"type": "string",
 			"format": "uri",
-			"pattern": "^[hH][tT][tT][pP][sS]://",
-			"description": "Logo URL (https required)."
+			"pattern": "^([hH][tT][tT][pP][sS]://|[hH][tT][tT][pP]://([lL][oO][cC][aA][lL][hH][oO][sS][tT]|127\\.(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){2}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])|\\[::1\\])(?::0*(?:[0-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?([/?#]|$))",
+			"description": "Logo URL (https required; canonical loopback http is allowed for local development and renders only on loopback pages)."
 		},
 		"hero_url": {
 			"type": "string",
 			"format": "uri",
-			"pattern": "^[hH][tT][tT][pP][sS]://",
-			"description": "Hero/background image URL (https required), used by split designs."
+			"pattern": "^([hH][tT][tT][pP][sS]://|[hH][tT][tT][pP]://([lL][oO][cC][aA][lL][hH][oO][sS][tT]|127\\.(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){2}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])|\\[::1\\])(?::0*(?:[0-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?([/?#]|$))",
+			"description": "Hero/background image URL (https required; canonical loopback http is allowed for local development and renders only on loopback pages), used by split designs."
 		}
 	},
 	not: { "required": ["liquid_template", "liquid_template_file"] }
@@ -341,6 +335,19 @@ var flow_definition_default = {
 						null
 					],
 					"description": "How to interpret `target`. - Omitted: transition to a step in the current definition. - `switch`: replace the current flow with the target flow.   No return; the current flow is discarded. Typical use:   navigating between peer flows like login ↔ register. - `pivot`: push the target flow onto the stack. The current   flow is paused; when the target flow completes the engine   auto-pops back. Typical use: login → recovery → back to login."
+				},
+				"purpose": {
+					"type": ["string", "null"],
+					"enum": [
+						"login",
+						"register",
+						"recovery",
+						"profiling",
+						"reauth",
+						"link_account",
+						null
+					],
+					"description": "Local re-purposing. When set, taking this transition changes the flow's current purpose to this value — the dispatch mode a step's challenges run under — while the flow's original purpose stays pinned. Must be a purpose this definition serves, and `target` must be that purpose's entry step. Mutually exclusive with `action`: a transition either re-purposes within this flow or targets another flow, never both. Example: a \"Sign up\" navigation on the login identifier step (`{ \"target\": \"register\", \"purpose\": \"register\" }`)."
 				}
 			}
 		}
@@ -369,10 +376,6 @@ var user_property_default = {
 			"const": "https://json-schema.org/draft/2020-12/schema",
 			"description": "The JSON Schema version used for this schema."
 		},
-		"x-verify": {
-			"oneOf": [{ "type": "string" }, { "type": "null" }],
-			"description": "The verification method for this property, if applicable"
-		},
 		"x-unique": {
 			"oneOf": [{
 				"type": "string",
@@ -388,20 +391,10 @@ var user_property_default = {
 			"oneOf": [{ "type": "string" }, { "type": "null" }],
 			"description": "The claim name for this property, if applicable"
 		},
-		"x-editable": {
-			"type": "boolean",
-			"default": true,
-			"description": "Whether this property is editable by the user or not"
-		},
-		"x-sensitive": {
+		"x-audit": {
 			"type": "boolean",
 			"default": false,
-			"description": "Whether this property contains sensitive information or not"
-		},
-		"x-mfa": {
-			"type": "boolean",
-			"default": false,
-			"description": "Whether this property is used for multi-factor authentication or not"
+			"description": "Whether this property's value may appear in audit event payloads. Audit payloads are deny-by-default: a property without this annotation contributes its key but never its value."
 		},
 		"properties": {
 			"type": "object",
@@ -448,6 +441,20 @@ var user_schema_default = {
 			"description": "The user Schema version used for this schema."
 		},
 		"x-auth-methods": { "$ref": "auth-methods.json" },
+		"x-identifier": {
+			"type": "string",
+			"minLength": 1,
+			"description": "Path of the leaf property whose value identifies a user (nested leaves are addressed by their dot-joined attribute path). The property must carry x-unique \"project\". Required when an auth method needing identifier-first dispatch (password) is enabled. Passkey is exempt: discoverable credentials identify the user through the assertion itself, so passkey-only and API-managed schemas may designate nothing; flows using identifier-first passkey are validated at the flow level instead."
+		},
+		"x-display": {
+			"type": "array",
+			"minItems": 1,
+			"items": {
+				"type": "string",
+				"minLength": 1
+			},
+			"description": "Ordered leaf property paths whose values, joined with a space, render the user's display name."
+		},
 		"properties": {
 			"type": "object",
 			"description": "A map of additional properties for the user definition, where the key is the property name and the value is the property schema",
@@ -521,4 +528,4 @@ function metaSchemaFiles() {
 //#endregion
 export { metaSchemaFiles as i, FLOW_FILE_SCHEMA_REF as n, META_SCHEMA_DIR as r, BRANDING_FILE_SCHEMA_REF as t };
 
-//# sourceMappingURL=meta-schemas-B4YiHAX_.mjs.map
+//# sourceMappingURL=meta-schemas-z4IlqbLd.mjs.map

package/dist/{meta-schemas-B4YiHAX_.mjs.map → meta-schemas-z4IlqbLd.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"meta-schemas-B4YiHAX_.mjs","names":["flowDefinitionMetaSchema","userSchemaMetaSchema","userPropertyMetaSchema","propertyNameMetaSchema","authMethodsMetaSchema","authMethodMetaSchema","brandingMetaSchema"],"sources":["../meta-schemas/auth-method.json","../meta-schemas/auth-methods.json","../meta-schemas/branding.json","../meta-schemas/flow-definition.json","../meta-schemas/property-name.json","../meta-schemas/user-property.json","../meta-schemas/user-schema.json","../src/meta-schemas.ts"],"sourcesContent":["","","","","","","","/**\n * The dialect meta-schemas `zitadel setup` copies into a project's\n * `.zitadel/meta/` so the flow/schema dialect is machine-readable offline:\n * editors validate flow files against `flow-definition.json` via a relative\n * `$schema` pointer, and agents read the dialect files before authoring\n * edits — no docs crawl, no hosted schema required.\n *\n * The files under `meta-schemas/` are committed copies of\n * `api/openapi/endpoints/schemas/*.json` (the source the server embeds);\n * a drift-audit test keeps them byte-identical in the monorepo.\n */\nimport authMethodMetaSchema from \"../meta-schemas/auth-method.json\" with {\n  type: \"json\",\n};\nimport authMethodsMetaSchema from \"../meta-schemas/auth-methods.json\" with {\n  type: \"json\",\n};\nimport brandingMetaSchema from \"../meta-schemas/branding.json\" with {\n  type: \"json\",\n};\nimport flowDefinitionMetaSchema from \"../meta-schemas/flow-definition.json\" with {\n  type: \"json\",\n};\nimport propertyNameMetaSchema from \"../meta-schemas/property-name.json\" with {\n  type: \"json\",\n};\nimport userPropertyMetaSchema from \"../meta-schemas/user-property.json\" with {\n  type: \"json\",\n};\nimport userSchemaMetaSchema from \"../meta-schemas/user-schema.json\" with {\n  type: \"json\",\n};\n\n/** Project-relative directory setup writes the meta-schemas to. */\nexport const META_SCHEMA_DIR = \".zitadel/meta\";\n\n/**\n * The `$schema` value scaffolded flow files carry, relative to\n * `.zitadel/flows/` — resolves to `{@link META_SCHEMA_DIR}/flow-definition.json`.\n */\nexport const FLOW_FILE_SCHEMA_REF = \"../meta/flow-definition.json\";\n\n/**\n * The `$schema` value scaffolded branding files carry, relative to\n * `.zitadel/branding/` — resolves to `{@link META_SCHEMA_DIR}/branding.json`.\n */\nexport const BRANDING_FILE_SCHEMA_REF = \"../meta/branding.json\";\n\nexport type MetaSchemaFile = { name: string; body: object };\n\n/**\n * The dialect files to materialize, in write order. `auth-methods.json` and\n * `auth-method.json` are pulled in by `user-schema.json`'s relative `$ref`s —\n * without them the copied dialect cannot resolve offline.\n */\nexport function metaSchemaFiles(): ReadonlyArray<MetaSchemaFile> {\n  return [\n    { name: \"flow-definition.json\", body: flowDefinitionMetaSchema as object },\n    { name: \"user-schema.json\", body: userSchemaMetaSchema as object },\n    { name: \"user-property.json\", body: userPropertyMetaSchema as object },\n    { name: \"property-name.json\", body: propertyNameMetaSchema as object },\n    { name: \"auth-methods.json\", body: authMethodsMetaSchema as object },\n    { name: \"auth-method.json\", body: authMethodMetaSchema as object },\n    { name: \"branding.json\", body: brandingMetaSchema as object },\n  ];\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AOkCA,MAAa,kBAAkB;;;;;AAM/B,MAAa,uBAAuB;;;;;AAMpC,MAAa,2BAA2B;;;;;;AASxC,SAAgB,kBAAiD;AAC/D,QAAO;EACL;GAAE,MAAM;GAAwB,MAAMA;GAAoC;EAC1E;GAAE,MAAM;GAAoB,MAAMC;GAAgC;EAClE;GAAE,MAAM;GAAsB,MAAMC;GAAkC;EACtE;GAAE,MAAM;GAAsB,MAAMC;GAAkC;EACtE;GAAE,MAAM;GAAqB,MAAMC;GAAiC;EACpE;GAAE,MAAM;GAAoB,MAAMC;GAAgC;EAClE;GAAE,MAAM;GAAiB,MAAMC;GAA8B;EAC9D"}
+{"version":3,"file":"meta-schemas-z4IlqbLd.mjs","names":["flowDefinitionMetaSchema","userSchemaMetaSchema","userPropertyMetaSchema","propertyNameMetaSchema","authMethodsMetaSchema","authMethodMetaSchema","brandingMetaSchema"],"sources":["../meta-schemas/auth-method.json","../meta-schemas/auth-methods.json","../meta-schemas/branding.json","../meta-schemas/flow-definition.json","../meta-schemas/property-name.json","../meta-schemas/user-property.json","../meta-schemas/user-schema.json","../src/meta-schemas.ts"],"sourcesContent":["","","","","","","","/**\n * The dialect meta-schemas `zitadel setup` copies into a project's\n * `.zitadel/meta/` so the flow/schema dialect is machine-readable offline:\n * editors validate flow files against `flow-definition.json` via a relative\n * `$schema` pointer, and agents read the dialect files before authoring\n * edits — no docs crawl, no hosted schema required.\n *\n * The files under `meta-schemas/` are committed copies of\n * `api/openapi/endpoints/schemas/*.json` (the source the server embeds);\n * a drift-audit test keeps them byte-identical in the monorepo.\n */\nimport authMethodMetaSchema from \"../meta-schemas/auth-method.json\" with {\n  type: \"json\",\n};\nimport authMethodsMetaSchema from \"../meta-schemas/auth-methods.json\" with {\n  type: \"json\",\n};\nimport brandingMetaSchema from \"../meta-schemas/branding.json\" with {\n  type: \"json\",\n};\nimport flowDefinitionMetaSchema from \"../meta-schemas/flow-definition.json\" with {\n  type: \"json\",\n};\nimport propertyNameMetaSchema from \"../meta-schemas/property-name.json\" with {\n  type: \"json\",\n};\nimport userPropertyMetaSchema from \"../meta-schemas/user-property.json\" with {\n  type: \"json\",\n};\nimport userSchemaMetaSchema from \"../meta-schemas/user-schema.json\" with {\n  type: \"json\",\n};\n\n/** Project-relative directory setup writes the meta-schemas to. */\nexport const META_SCHEMA_DIR = \".zitadel/meta\";\n\n/**\n * The `$schema` value scaffolded flow files carry, relative to\n * `.zitadel/flows/` — resolves to `{@link META_SCHEMA_DIR}/flow-definition.json`.\n */\nexport const FLOW_FILE_SCHEMA_REF = \"../meta/flow-definition.json\";\n\n/**\n * The `$schema` value scaffolded branding files carry, relative to\n * `.zitadel/branding/` — resolves to `{@link META_SCHEMA_DIR}/branding.json`.\n */\nexport const BRANDING_FILE_SCHEMA_REF = \"../meta/branding.json\";\n\nexport type MetaSchemaFile = { name: string; body: object };\n\n/**\n * The dialect files to materialize, in write order. `auth-methods.json` and\n * `auth-method.json` are pulled in by `user-schema.json`'s relative `$ref`s —\n * without them the copied dialect cannot resolve offline.\n */\nexport function metaSchemaFiles(): ReadonlyArray<MetaSchemaFile> {\n  return [\n    { name: \"flow-definition.json\", body: flowDefinitionMetaSchema as object },\n    { name: \"user-schema.json\", body: userSchemaMetaSchema as object },\n    { name: \"user-property.json\", body: userPropertyMetaSchema as object },\n    { name: \"property-name.json\", body: propertyNameMetaSchema as object },\n    { name: \"auth-methods.json\", body: authMethodsMetaSchema as object },\n    { name: \"auth-method.json\", body: authMethodMetaSchema as object },\n    { name: \"branding.json\", body: brandingMetaSchema as object },\n  ];\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AOkCA,MAAa,kBAAkB;;;;;AAM/B,MAAa,uBAAuB;;;;;AAMpC,MAAa,2BAA2B;;;;;;AASxC,SAAgB,kBAAiD;AAC/D,QAAO;EACL;GAAE,MAAM;GAAwB,MAAMA;GAAoC;EAC1E;GAAE,MAAM;GAAoB,MAAMC;GAAgC;EAClE;GAAE,MAAM;GAAsB,MAAMC;GAAkC;EACtE;GAAE,MAAM;GAAsB,MAAMC;GAAkC;EACtE;GAAE,MAAM;GAAqB,MAAMC;GAAiC;EACpE;GAAE,MAAM;GAAoB,MAAMC;GAAgC;EAClE;GAAE,MAAM;GAAiB,MAAMC;GAA8B;EAC9D"}

package/dist/meta-schemas.mjs

@@ -1,2 +1,2 @@
-import { i as metaSchemaFiles, n as FLOW_FILE_SCHEMA_REF, r as META_SCHEMA_DIR, t as BRANDING_FILE_SCHEMA_REF } from "./meta-schemas-B4YiHAX_.mjs";
+import { i as metaSchemaFiles, n as FLOW_FILE_SCHEMA_REF, r as META_SCHEMA_DIR, t as BRANDING_FILE_SCHEMA_REF } from "./meta-schemas-z4IlqbLd.mjs";
 export { BRANDING_FILE_SCHEMA_REF, FLOW_FILE_SCHEMA_REF, META_SCHEMA_DIR, metaSchemaFiles };

package/dist/normalize.d.mts

@@ -5,21 +5,22 @@
  * The sync engine compares `.zitadel/**` files against server responses;
  * the server echoes fields the author never wrote (an empty `audience`
  * on flows) and the meta-schema declares defaults an author may or may
- * not spell out (`x-editable` et al on schema properties). Normalizing
- * both sides before hashing or diffing keeps a one-field edit rendering
- * as a one-field diff.
+ * not spell out (`x-audit` on schema properties). Normalizing both
+ * sides before hashing or diffing keeps a one-field edit rendering as a
+ * one-field diff.
  *
  * Normalized bodies are for COMPARISON. Never upload them, and never
  * write a normalized schema body to a file: the server stores schema
  * bytes verbatim without materializing meta-schema defaults, so a
- * stripped `"x-editable": true` would vanish from the next published
+ * stripped `"x-audit": false` would vanish from the next published
  * revision. (Flow write-back may reuse {@link normalizeFlowBody} —
  * everything it strips is pure transport noise.)
  */
 /**
  * Property-level defaults declared by the user-property meta-schema
  * (`api/openapi/endpoints/schemas/user-property.json`). A property that
- * spells one of these out is semantically identical to one that omits it.
+ * spells one of these out is semantically identical to one that omits it:
+ * audit payloads deny by default.
  */
 declare const USER_PROPERTY_DEFAULTS: Readonly<Record<string, boolean>>;
 /**
@@ -34,10 +35,11 @@ declare const USER_PROPERTY_DEFAULTS: Readonly<Record<string, boolean>>;
 declare function normalizeFlowBody(body: object): object;
 /**
  * Return a deep copy of a user-schema body with meta-schema property
- * defaults stripped: a property carrying `"x-editable": true` (or the
- * other {@link USER_PROPERTY_DEFAULTS}) normalizes to one omitting it.
- * Only exact default values are removed; `$id` and every other field
- * pass through untouched.
+ * defaults stripped: a property carrying one of the
+ * {@link USER_PROPERTY_DEFAULTS} normalizes to one omitting it. Only
+ * exact default values are removed; `$id` and every other field pass
+ * through untouched. Nested `properties` are descended into, so a leaf
+ * of an object property normalizes the same way a top-level one does.
  */
 declare function normalizeSchemaBody(body: object): object;
 //#endregion

package/dist/normalize.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.d.mts","names":[],"sources":["../src/normalize.ts"],"mappings":";;AAuBA;;;;;AA0CA;;;;;AAmBA;;;;;;;;;;;cA7Da,sBAAA,EAAwB,QAAA,CAAS,MAAA;;;;;;;;;;iBA0C9B,iBAAA,CAAkB,IAAA;;;;;;;;iBAmBlB,mBAAA,CAAoB,IAAA"}
+{"version":3,"file":"normalize.d.mts","names":[],"sources":["../src/normalize.ts"],"mappings":";;AAwBA;;;;;AAwCA;;;;;AAoBA;;;;;;;;;;;;cA5Da,sBAAA,EAAwB,QAAA,CAAS,MAAA;;;;;;;;;;iBAwC9B,iBAAA,CAAkB,IAAA;;;;;;;;;iBAoBlB,mBAAA,CAAoB,IAAA"}

package/dist/normalize.mjs

@@ -5,36 +5,32 @@
 * The sync engine compares `.zitadel/**` files against server responses;
 * the server echoes fields the author never wrote (an empty `audience`
 * on flows) and the meta-schema declares defaults an author may or may
-* not spell out (`x-editable` et al on schema properties). Normalizing
-* both sides before hashing or diffing keeps a one-field edit rendering
-* as a one-field diff.
+* not spell out (`x-audit` on schema properties). Normalizing both
+* sides before hashing or diffing keeps a one-field edit rendering as a
+* one-field diff.
 *
 * Normalized bodies are for COMPARISON. Never upload them, and never
 * write a normalized schema body to a file: the server stores schema
 * bytes verbatim without materializing meta-schema defaults, so a
-* stripped `"x-editable": true` would vanish from the next published
+* stripped `"x-audit": false` would vanish from the next published
 * revision. (Flow write-back may reuse {@link normalizeFlowBody} —
 * everything it strips is pure transport noise.)
 */
 /**
 * Property-level defaults declared by the user-property meta-schema
 * (`api/openapi/endpoints/schemas/user-property.json`). A property that
-* spells one of these out is semantically identical to one that omits it.
+* spells one of these out is semantically identical to one that omits it:
+* audit payloads deny by default.
 */
-const USER_PROPERTY_DEFAULTS = {
-	"x-editable": true,
-	"x-sensitive": false,
-	"x-mfa": false
-};
+const USER_PROPERTY_DEFAULTS = { "x-audit": false };
 /**
-* Keys of the flow-definition detail envelope. `fetch` in the flow syncer
+* Keys of the flow-definition response envelope. `fetch` in the flow syncer
 * already unwraps the envelope; stripping them here as well makes the
 * normalizer safe on raw detail responses.
 */
 const FLOW_ENVELOPE_KEYS = [
 	"id",
 	"project_id",
-	"schema_uri",
 	"created_at",
 	"updated_at"
 ];
@@ -68,19 +64,29 @@ function normalizeFlowBody(body) {
 }
 /**
 * Return a deep copy of a user-schema body with meta-schema property
-* defaults stripped: a property carrying `"x-editable": true` (or the
-* other {@link USER_PROPERTY_DEFAULTS}) normalizes to one omitting it.
-* Only exact default values are removed; `$id` and every other field
-* pass through untouched.
+* defaults stripped: a property carrying one of the
+* {@link USER_PROPERTY_DEFAULTS} normalizes to one omitting it. Only
+* exact default values are removed; `$id` and every other field pass
+* through untouched. Nested `properties` are descended into, so a leaf
+* of an object property normalizes the same way a top-level one does.
 */
 function normalizeSchemaBody(body) {
 	const result = structuredClone(body);
-	if (!isPlainObject(result.properties)) return result;
-	for (const property of Object.values(result.properties)) {
+	stripPropertyDefaults(result);
+	return result;
+}
+/**
+* Strip {@link USER_PROPERTY_DEFAULTS} from every property of an object
+* schema, descending into nested `properties` so a leaf of an object
+* property normalizes the same way a top-level one does.
+*/
+function stripPropertyDefaults(schema) {
+	if (!isPlainObject(schema.properties)) return;
+	for (const property of Object.values(schema.properties)) {
 		if (!isPlainObject(property)) continue;
 		for (const [key, defaultValue] of Object.entries(USER_PROPERTY_DEFAULTS)) if (property[key] === defaultValue) delete property[key];
+		stripPropertyDefaults(property);
 	}
-	return result;
 }
 //#endregion
 export { USER_PROPERTY_DEFAULTS, normalizeFlowBody, normalizeSchemaBody };

package/dist/normalize.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.mjs","names":[],"sources":["../src/normalize.ts"],"sourcesContent":["/**\n * Canonical-form normalizers for the two repo-config resource kinds.\n *\n * The sync engine compares `.zitadel/**` files against server responses;\n * the server echoes fields the author never wrote (an empty `audience`\n * on flows) and the meta-schema declares defaults an author may or may\n * not spell out (`x-editable` et al on schema properties). Normalizing\n * both sides before hashing or diffing keeps a one-field edit rendering\n * as a one-field diff.\n *\n * Normalized bodies are for COMPARISON. Never upload them, and never\n * write a normalized schema body to a file: the server stores schema\n * bytes verbatim without materializing meta-schema defaults, so a\n * stripped `\"x-editable\": true` would vanish from the next published\n * revision. (Flow write-back may reuse {@link normalizeFlowBody} —\n * everything it strips is pure transport noise.)\n */\n\n/**\n * Property-level defaults declared by the user-property meta-schema\n * (`api/openapi/endpoints/schemas/user-property.json`). A property that\n * spells one of these out is semantically identical to one that omits it.\n */\nexport const USER_PROPERTY_DEFAULTS: Readonly<Record<string, boolean>> = {\n  \"x-editable\": true,\n  \"x-sensitive\": false,\n  \"x-mfa\": false,\n};\n\n/**\n * Keys of the flow-definition detail envelope. `fetch` in the flow syncer\n * already unwraps the envelope; stripping them here as well makes the\n * normalizer safe on raw detail responses.\n */\nconst FLOW_ENVELOPE_KEYS = [\"id\", \"project_id\", \"schema_uri\", \"created_at\", \"updated_at\"];\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/**\n * An `audience` counts as empty when it scopes nothing: no keys, or only\n * `team_ids`/`app_ids` that are null or empty arrays. Unknown keys keep\n * the audience — better a noisy diff than a silently dropped scope.\n */\nfunction isEmptyAudience(value: unknown): boolean {\n  if (!isPlainObject(value)) {\n    return false;\n  }\n  return Object.entries(value).every(\n    ([key, entry]) =>\n      (key === \"team_ids\" || key === \"app_ids\") &&\n      (entry === null || entry === undefined || (Array.isArray(entry) && entry.length === 0)),\n  );\n}\n\n/**\n * Return a deep copy of a bare flow-definition body with server-echoed\n * noise removed: an empty `audience` and any detail-envelope keys. A\n * top-level `$schema` is stripped too — it is a local editor affordance\n * (scaffolded flow files point it at `.zitadel/meta/flow-definition.json`),\n * never part of the resource: the server skips it on decode and omits it\n * from responses, so comparing with it would read every scaffolded file\n * as permanently diverged.\n */\nexport function normalizeFlowBody(body: object): object {\n  const result = structuredClone(body) as Record<string, unknown>;\n  for (const key of FLOW_ENVELOPE_KEYS) {\n    delete result[key];\n  }\n  delete result.$schema;\n  if (\"audience\" in result && isEmptyAudience(result.audience)) {\n    delete result.audience;\n  }\n  return result;\n}\n\n/**\n * Return a deep copy of a user-schema body with meta-schema property\n * defaults stripped: a property carrying `\"x-editable\": true` (or the\n * other {@link USER_PROPERTY_DEFAULTS}) normalizes to one omitting it.\n * Only exact default values are removed; `$id` and every other field\n * pass through untouched.\n */\nexport function normalizeSchemaBody(body: object): object {\n  const result = structuredClone(body) as Record<string, unknown>;\n  if (!isPlainObject(result.properties)) {\n    return result;\n  }\n  for (const property of Object.values(result.properties)) {\n    if (!isPlainObject(property)) {\n      continue;\n    }\n    for (const [key, defaultValue] of Object.entries(USER_PROPERTY_DEFAULTS)) {\n      if (property[key] === defaultValue) {\n        delete property[key];\n      }\n    }\n  }\n  return result;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAuBA,MAAa,yBAA4D;CACvE,cAAc;CACd,eAAe;CACf,SAAS;CACV;;;;;;AAOD,MAAM,qBAAqB;CAAC;CAAM;CAAc;CAAc;CAAc;CAAa;AAEzF,SAAS,cAAc,OAAkD;AACvE,QAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;;;;;;AAQ7E,SAAS,gBAAgB,OAAyB;AAChD,KAAI,CAAC,cAAc,MAAM,CACvB,QAAO;AAET,QAAO,OAAO,QAAQ,MAAM,CAAC,OAC1B,CAAC,KAAK,YACJ,QAAQ,cAAc,QAAQ,eAC9B,UAAU,QAAQ,UAAU,KAAA,KAAc,MAAM,QAAQ,MAAM,IAAI,MAAM,WAAW,GACvF;;;;;;;;;;;AAYH,SAAgB,kBAAkB,MAAsB;CACtD,MAAM,SAAS,gBAAgB,KAAK;AACpC,MAAK,MAAM,OAAO,mBAChB,QAAO,OAAO;AAEhB,QAAO,OAAO;AACd,KAAI,cAAc,UAAU,gBAAgB,OAAO,SAAS,CAC1D,QAAO,OAAO;AAEhB,QAAO;;;;;;;;;AAUT,SAAgB,oBAAoB,MAAsB;CACxD,MAAM,SAAS,gBAAgB,KAAK;AACpC,KAAI,CAAC,cAAc,OAAO,WAAW,CACnC,QAAO;AAET,MAAK,MAAM,YAAY,OAAO,OAAO,OAAO,WAAW,EAAE;AACvD,MAAI,CAAC,cAAc,SAAS,CAC1B;AAEF,OAAK,MAAM,CAAC,KAAK,iBAAiB,OAAO,QAAQ,uBAAuB,CACtE,KAAI,SAAS,SAAS,aACpB,QAAO,SAAS;;AAItB,QAAO"}
+{"version":3,"file":"normalize.mjs","names":[],"sources":["../src/normalize.ts"],"sourcesContent":["/**\n * Canonical-form normalizers for the two repo-config resource kinds.\n *\n * The sync engine compares `.zitadel/**` files against server responses;\n * the server echoes fields the author never wrote (an empty `audience`\n * on flows) and the meta-schema declares defaults an author may or may\n * not spell out (`x-audit` on schema properties). Normalizing both\n * sides before hashing or diffing keeps a one-field edit rendering as a\n * one-field diff.\n *\n * Normalized bodies are for COMPARISON. Never upload them, and never\n * write a normalized schema body to a file: the server stores schema\n * bytes verbatim without materializing meta-schema defaults, so a\n * stripped `\"x-audit\": false` would vanish from the next published\n * revision. (Flow write-back may reuse {@link normalizeFlowBody} —\n * everything it strips is pure transport noise.)\n */\n\n/**\n * Property-level defaults declared by the user-property meta-schema\n * (`api/openapi/endpoints/schemas/user-property.json`). A property that\n * spells one of these out is semantically identical to one that omits it:\n * audit payloads deny by default.\n */\nexport const USER_PROPERTY_DEFAULTS: Readonly<Record<string, boolean>> = {\n  \"x-audit\": false,\n};\n\n/**\n * Keys of the flow-definition response envelope. `fetch` in the flow syncer\n * already unwraps the envelope; stripping them here as well makes the\n * normalizer safe on raw detail responses.\n */\nconst FLOW_ENVELOPE_KEYS = [\"id\", \"project_id\", \"created_at\", \"updated_at\"];\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/**\n * An `audience` counts as empty when it scopes nothing: no keys, or only\n * `team_ids`/`app_ids` that are null or empty arrays. Unknown keys keep\n * the audience — better a noisy diff than a silently dropped scope.\n */\nfunction isEmptyAudience(value: unknown): boolean {\n  if (!isPlainObject(value)) {\n    return false;\n  }\n  return Object.entries(value).every(\n    ([key, entry]) =>\n      (key === \"team_ids\" || key === \"app_ids\") &&\n      (entry === null || entry === undefined || (Array.isArray(entry) && entry.length === 0)),\n  );\n}\n\n/**\n * Return a deep copy of a bare flow-definition body with server-echoed\n * noise removed: an empty `audience` and any detail-envelope keys. A\n * top-level `$schema` is stripped too — it is a local editor affordance\n * (scaffolded flow files point it at `.zitadel/meta/flow-definition.json`),\n * never part of the resource: the server skips it on decode and omits it\n * from responses, so comparing with it would read every scaffolded file\n * as permanently diverged.\n */\nexport function normalizeFlowBody(body: object): object {\n  const result = structuredClone(body) as Record<string, unknown>;\n  for (const key of FLOW_ENVELOPE_KEYS) {\n    delete result[key];\n  }\n  delete result.$schema;\n  if (\"audience\" in result && isEmptyAudience(result.audience)) {\n    delete result.audience;\n  }\n  return result;\n}\n\n/**\n * Return a deep copy of a user-schema body with meta-schema property\n * defaults stripped: a property carrying one of the\n * {@link USER_PROPERTY_DEFAULTS} normalizes to one omitting it. Only\n * exact default values are removed; `$id` and every other field pass\n * through untouched. Nested `properties` are descended into, so a leaf\n * of an object property normalizes the same way a top-level one does.\n */\nexport function normalizeSchemaBody(body: object): object {\n  const result = structuredClone(body) as Record<string, unknown>;\n  stripPropertyDefaults(result);\n  return result;\n}\n\n/**\n * Strip {@link USER_PROPERTY_DEFAULTS} from every property of an object\n * schema, descending into nested `properties` so a leaf of an object\n * property normalizes the same way a top-level one does.\n */\nfunction stripPropertyDefaults(schema: Record<string, unknown>): void {\n  if (!isPlainObject(schema.properties)) {\n    return;\n  }\n  for (const property of Object.values(schema.properties)) {\n    if (!isPlainObject(property)) {\n      continue;\n    }\n    for (const [key, defaultValue] of Object.entries(USER_PROPERTY_DEFAULTS)) {\n      if (property[key] === defaultValue) {\n        delete property[key];\n      }\n    }\n    stripPropertyDefaults(property);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAwBA,MAAa,yBAA4D,EACvE,WAAW,OACZ;;;;;;AAOD,MAAM,qBAAqB;CAAC;CAAM;CAAc;CAAc;CAAa;AAE3E,SAAS,cAAc,OAAkD;AACvE,QAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;;;;;;AAQ7E,SAAS,gBAAgB,OAAyB;AAChD,KAAI,CAAC,cAAc,MAAM,CACvB,QAAO;AAET,QAAO,OAAO,QAAQ,MAAM,CAAC,OAC1B,CAAC,KAAK,YACJ,QAAQ,cAAc,QAAQ,eAC9B,UAAU,QAAQ,UAAU,KAAA,KAAc,MAAM,QAAQ,MAAM,IAAI,MAAM,WAAW,GACvF;;;;;;;;;;;AAYH,SAAgB,kBAAkB,MAAsB;CACtD,MAAM,SAAS,gBAAgB,KAAK;AACpC,MAAK,MAAM,OAAO,mBAChB,QAAO,OAAO;AAEhB,QAAO,OAAO;AACd,KAAI,cAAc,UAAU,gBAAgB,OAAO,SAAS,CAC1D,QAAO,OAAO;AAEhB,QAAO;;;;;;;;;;AAWT,SAAgB,oBAAoB,MAAsB;CACxD,MAAM,SAAS,gBAAgB,KAAK;AACpC,uBAAsB,OAAO;AAC7B,QAAO;;;;;;;AAQT,SAAS,sBAAsB,QAAuC;AACpE,KAAI,CAAC,cAAc,OAAO,WAAW,CACnC;AAEF,MAAK,MAAM,YAAY,OAAO,OAAO,OAAO,WAAW,EAAE;AACvD,MAAI,CAAC,cAAc,SAAS,CAC1B;AAEF,OAAK,MAAM,CAAC,KAAK,iBAAiB,OAAO,QAAQ,uBAAuB,CACtE,KAAI,SAAS,SAAS,aACpB,QAAO,SAAS;AAGpB,wBAAsB,SAAS"}

package/dist/schemas.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.d.mts","names":[],"sources":["../src/schemas.ts"],"mappings":";;;cAQa,kBAAA;AAAA,cACA,gBAAA;AAAA,cACA,iCAAA;;cAGA,kBAAA;;;AAJb;;;;cAYa,oBAAA,EAAoB,CAAA,CAAA,SAAA;EAAA;GAuC/B,CAAA,CAAA,IAAA,CAAA,OAAA"}
+{"version":3,"file":"schemas.d.mts","names":[],"sources":["../src/schemas.ts"],"mappings":";;;cASa,kBAAA;AAAA,cACA,gBAAA;AAAA,cACA,iCAAA;;cAGA,kBAAA;;;AAJb;;;;cAYa,oBAAA,EAAoB,CAAA,CAAA,SAAA;EAAA;GAuC7B,CAAA,CAAA,IAAA,CAAA,OAAA"}

package/dist/schemas.mjs

@@ -1,5 +1,6 @@
-import { z } from "zod";
+import { isCanonicalLoopbackHttpUrl } from "./branding-url.mjs";
 import { CreateBrandingBody, CreateFlowDefinitionBody, CreateSchemaBody } from "@zitadel/api/generated/endpoints/zitadelNextGen.zod";
+import { z } from "zod";
 //#region src/schemas.ts
 const schemaConfigSchema = CreateSchemaBody;
 const flowConfigSchema = CreateFlowDefinitionBody.shape.flow_definition;
@@ -27,10 +28,10 @@ const brandingConfigSchema = z.strictObject({
 		code: "custom",
 		message: "font_url is not writable yet (tenant font delivery needs a safe design, see ADR 040); load fonts from the embedding page instead."
 	});
-	requireHttpsUrl(value.logo_url, "logo_url", ctx);
-	requireHttpsUrl(value.hero_url, "hero_url", ctx);
+	validateBrandingAssetUrl(value.logo_url, "logo_url", ctx);
+	validateBrandingAssetUrl(value.hero_url, "hero_url", ctx);
 });
-function requireHttpsUrl(value, field, ctx) {
+function validateBrandingAssetUrl(value, field, ctx) {
 	if (value === void 0 || value === "") return;
 	if (/[\s\\]/.test(value)) {
 		ctx.addIssue({
@@ -39,7 +40,7 @@ function requireHttpsUrl(value, field, ctx) {
 		});
 		return;
 	}
-	if (!/^https:\/\//i.test(value)) {
+	if (!/^https?:\/\//i.test(value)) {
 		ctx.addIssue({
 			code: "custom",
 			message: `${field} must be an absolute https URL.`
@@ -56,9 +57,10 @@ function requireHttpsUrl(value, field, ctx) {
 		});
 		return;
 	}
+	if (parsed.protocol === "http:" && isCanonicalLoopbackHttpUrl(value)) return;
 	if (parsed.protocol !== "https:" || parsed.host === "") ctx.addIssue({
 		code: "custom",
-		message: `${field} must be an absolute https URL.`
+		message: `${field} must be an absolute https URL (http is allowed for canonical loopback development hosts only).`
 	});
 }
 //#endregion

package/dist/schemas.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.mjs","names":[],"sources":["../src/schemas.ts"],"sourcesContent":["import { z } from \"zod\";\n\nimport {\n  CreateBrandingBody,\n  CreateFlowDefinitionBody,\n  CreateSchemaBody,\n} from \"@zitadel/api/generated/endpoints/zitadelNextGen.zod\";\n\nexport const schemaConfigSchema = CreateSchemaBody;\nexport const flowConfigSchema = CreateFlowDefinitionBody.shape.flow_definition;\nexport const createFlowDefinitionRequestSchema = CreateFlowDefinitionBody;\n\n/** The wire shape of a branding revision (`POST /branding` request body). */\nexport const brandingWireSchema = CreateBrandingBody;\n\n/**\n * The local `.zitadel/branding/*.json` dialect: the wire shape plus\n * `liquid_template_file`, a descriptor-relative path the CLI inlines into\n * `liquid_template` when publishing. Exactly one of the two template carriers\n * may be present (the meta-schema `branding.json` mirrors this).\n */\nexport const brandingConfigSchema = z\n  .strictObject({\n    // Strict, unlike the generated wire schema: a typo like `hero_urll`\n    // must fail plan, not silently pass, get ignored by the server, and\n    // vanish on canonical write-back. The editor meta-schema already\n    // rejects unknown keys; the CLI gate has to agree.\n    ...CreateBrandingBody.shape,\n    // Raw strings instead of the generated uri fields: those trim and\n    // normalize before refinement runs, hiding exactly the forms the wire\n    // body still carries verbatim and Go's url.Parse rejects.\n    logo_url: z.string().optional(),\n    hero_url: z.string().optional(),\n    $schema: z.string().optional(),\n    liquid_template_file: z.string().min(1).optional(),\n  })\n  .superRefine((value, ctx) => {\n  if (value.liquid_template !== undefined && value.liquid_template_file !== undefined) {\n    ctx.addIssue({\n      code: \"custom\",\n      message: \"Use either liquid_template_file or an inline liquid_template, not both.\",\n    });\n  }\n  // font_url is read-only in v1: the login component loads it as a\n  // document-level stylesheet (shadow-scoped @font-face never registers\n  // faces), which would give branding.write arbitrary CSS over the embedding\n  // page. The server rejects it too; safe delivery is an ADR 040 follow-up.\n  if (value.font_url !== undefined) {\n    ctx.addIssue({\n      code: \"custom\",\n      message:\n        \"font_url is not writable yet (tenant font delivery needs a safe design, see ADR 040); load fonts from the embedding page instead.\",\n    });\n  }\n  // Mirror the server's https-only asset gate (validateBrandingAssetURL in\n  // internal/domain/branding_validator.go) so plan rejects what apply would —\n  // apply mutates schemas and flows before branding, so a late 400 here\n  // would leave a half-applied run.\n  requireHttpsUrl(value.logo_url, \"logo_url\", ctx);\n  requireHttpsUrl(value.hero_url, \"hero_url\", ctx);\n});\n\nfunction requireHttpsUrl(\n  value: string | undefined,\n  field: \"logo_url\" | \"hero_url\",\n  ctx: z.RefinementCtx,\n): void {\n  if (value === undefined || value === \"\") {\n    return;\n  }\n  // Stricter-or-equal than the Go gate (validateBrandingAssetURL): the WHATWG\n  // parser forgives what Go's url.Parse rejects — `https:example.com`,\n  // backslashes, and whitespace all get silently normalized. plan must never\n  // accept what apply would reject (the reverse is harmless), so reject the\n  // raw forms before parsing.\n  if (/[\\s\\\\]/.test(value)) {\n    ctx.addIssue({ code: \"custom\", message: `${field} is not a valid URL.` });\n    return;\n  }\n  if (!/^https:\\/\\//i.test(value)) {\n    ctx.addIssue({ code: \"custom\", message: `${field} must be an absolute https URL.` });\n    return;\n  }\n  let parsed: URL;\n  try {\n    parsed = new URL(value);\n  } catch {\n    ctx.addIssue({ code: \"custom\", message: `${field} is not a valid URL.` });\n    return;\n  }\n  if (parsed.protocol !== \"https:\" || parsed.host === \"\") {\n    ctx.addIssue({ code: \"custom\", message: `${field} must be an absolute https URL.` });\n  }\n}\n"],"mappings":";;;AAQA,MAAa,qBAAqB;AAClC,MAAa,mBAAmB,yBAAyB,MAAM;AAC/D,MAAa,oCAAoC;;AAGjD,MAAa,qBAAqB;;;;;;;AAQlC,MAAa,uBAAuB,EACjC,aAAa;CAKZ,GAAG,mBAAmB;CAItB,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,SAAS,EAAE,QAAQ,CAAC,UAAU;CAC9B,sBAAsB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACnD,CAAC,CACD,aAAa,OAAO,QAAQ;AAC7B,KAAI,MAAM,oBAAoB,KAAA,KAAa,MAAM,yBAAyB,KAAA,EACxE,KAAI,SAAS;EACX,MAAM;EACN,SAAS;EACV,CAAC;AAMJ,KAAI,MAAM,aAAa,KAAA,EACrB,KAAI,SAAS;EACX,MAAM;EACN,SACE;EACH,CAAC;AAMJ,iBAAgB,MAAM,UAAU,YAAY,IAAI;AAChD,iBAAgB,MAAM,UAAU,YAAY,IAAI;EAChD;AAEF,SAAS,gBACP,OACA,OACA,KACM;AACN,KAAI,UAAU,KAAA,KAAa,UAAU,GACnC;AAOF,KAAI,SAAS,KAAK,MAAM,EAAE;AACxB,MAAI,SAAS;GAAE,MAAM;GAAU,SAAS,GAAG,MAAM;GAAuB,CAAC;AACzE;;AAEF,KAAI,CAAC,eAAe,KAAK,MAAM,EAAE;AAC/B,MAAI,SAAS;GAAE,MAAM;GAAU,SAAS,GAAG,MAAM;GAAkC,CAAC;AACpF;;CAEF,IAAI;AACJ,KAAI;AACF,WAAS,IAAI,IAAI,MAAM;SACjB;AACN,MAAI,SAAS;GAAE,MAAM;GAAU,SAAS,GAAG,MAAM;GAAuB,CAAC;AACzE;;AAEF,KAAI,OAAO,aAAa,YAAY,OAAO,SAAS,GAClD,KAAI,SAAS;EAAE,MAAM;EAAU,SAAS,GAAG,MAAM;EAAkC,CAAC"}
+{"version":3,"file":"schemas.mjs","names":[],"sources":["../src/schemas.ts"],"sourcesContent":["import {\n  CreateBrandingBody,\n  CreateFlowDefinitionBody,\n  CreateSchemaBody,\n} from \"@zitadel/api/generated/endpoints/zitadelNextGen.zod\";\nimport { z } from \"zod\";\n\nimport { isCanonicalLoopbackHttpUrl } from \"./branding-url.js\";\n\nexport const schemaConfigSchema = CreateSchemaBody;\nexport const flowConfigSchema = CreateFlowDefinitionBody.shape.flow_definition;\nexport const createFlowDefinitionRequestSchema = CreateFlowDefinitionBody;\n\n/** The wire shape of a branding revision (`POST /branding` request body). */\nexport const brandingWireSchema = CreateBrandingBody;\n\n/**\n * The local `.zitadel/branding/*.json` dialect: the wire shape plus\n * `liquid_template_file`, a descriptor-relative path the CLI inlines into\n * `liquid_template` when publishing. Exactly one of the two template carriers\n * may be present (the meta-schema `branding.json` mirrors this).\n */\nexport const brandingConfigSchema = z\n  .strictObject({\n    // Strict, unlike the generated wire schema: a typo like `hero_urll`\n    // must fail plan, not silently pass, get ignored by the server, and\n    // vanish on canonical write-back. The editor meta-schema already\n    // rejects unknown keys; the CLI gate has to agree.\n    ...CreateBrandingBody.shape,\n    // Raw strings instead of the generated uri fields: those trim and\n    // normalize before refinement runs, hiding exactly the forms the wire\n    // body still carries verbatim and Go's url.Parse rejects.\n    logo_url: z.string().optional(),\n    hero_url: z.string().optional(),\n    $schema: z.string().optional(),\n    liquid_template_file: z.string().min(1).optional(),\n  })\n  .superRefine((value, ctx) => {\n    if (value.liquid_template !== undefined && value.liquid_template_file !== undefined) {\n      ctx.addIssue({\n        code: \"custom\",\n        message: \"Use either liquid_template_file or an inline liquid_template, not both.\",\n      });\n    }\n    // font_url is read-only in v1: the login component loads it as a\n    // document-level stylesheet (shadow-scoped @font-face never registers\n    // faces), which would give branding.write arbitrary CSS over the embedding\n    // page. The server rejects it too; safe delivery is an ADR 040 follow-up.\n    if (value.font_url !== undefined) {\n      ctx.addIssue({\n        code: \"custom\",\n        message:\n          \"font_url is not writable yet (tenant font delivery needs a safe design, see ADR 040); load fonts from the embedding page instead.\",\n      });\n    }\n    // Mirror the server's asset URL gate (validateBrandingAssetURL in\n    // internal/domain/branding_validator.go) so plan rejects what apply would.\n    // Apply mutates schemas and flows before branding, so a late 400 here would\n    // leave a half-applied run.\n    validateBrandingAssetUrl(value.logo_url, \"logo_url\", ctx);\n    validateBrandingAssetUrl(value.hero_url, \"hero_url\", ctx);\n  });\n\nfunction validateBrandingAssetUrl(\n  value: string | undefined,\n  field: \"logo_url\" | \"hero_url\",\n  ctx: z.RefinementCtx,\n): void {\n  if (value === undefined || value === \"\") {\n    return;\n  }\n  // Stricter-or-equal than the Go gate (validateBrandingAssetURL): the WHATWG\n  // parser forgives what Go's url.Parse rejects — `https:example.com`,\n  // backslashes, and whitespace all get silently normalized. plan must never\n  // accept what apply would reject (the reverse is harmless), so reject the\n  // raw forms before parsing.\n  if (/[\\s\\\\]/.test(value)) {\n    ctx.addIssue({ code: \"custom\", message: `${field} is not a valid URL.` });\n    return;\n  }\n  if (!/^https?:\\/\\//i.test(value)) {\n    ctx.addIssue({ code: \"custom\", message: `${field} must be an absolute https URL.` });\n    return;\n  }\n  let parsed: URL;\n  try {\n    parsed = new URL(value);\n  } catch {\n    ctx.addIssue({ code: \"custom\", message: `${field} is not a valid URL.` });\n    return;\n  }\n  // Loopback HTTP is the dev-posture carve-out (assets served from the app's\n  // own dev server). Check the raw URL so WHATWG normalisation cannot make\n  // plan accept a host spelling that the Go save gate rejects.\n  if (parsed.protocol === \"http:\" && isCanonicalLoopbackHttpUrl(value)) {\n    return;\n  }\n  if (parsed.protocol !== \"https:\" || parsed.host === \"\") {\n    ctx.addIssue({\n      code: \"custom\",\n      message: `${field} must be an absolute https URL (http is allowed for canonical loopback development hosts only).`,\n    });\n  }\n}\n"],"mappings":";;;;AASA,MAAa,qBAAqB;AAClC,MAAa,mBAAmB,yBAAyB,MAAM;AAC/D,MAAa,oCAAoC;;AAGjD,MAAa,qBAAqB;;;;;;;AAQlC,MAAa,uBAAuB,EACjC,aAAa;CAKZ,GAAG,mBAAmB;CAItB,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,SAAS,EAAE,QAAQ,CAAC,UAAU;CAC9B,sBAAsB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACnD,CAAC,CACD,aAAa,OAAO,QAAQ;AAC3B,KAAI,MAAM,oBAAoB,KAAA,KAAa,MAAM,yBAAyB,KAAA,EACxE,KAAI,SAAS;EACX,MAAM;EACN,SAAS;EACV,CAAC;AAMJ,KAAI,MAAM,aAAa,KAAA,EACrB,KAAI,SAAS;EACX,MAAM;EACN,SACE;EACH,CAAC;AAMJ,0BAAyB,MAAM,UAAU,YAAY,IAAI;AACzD,0BAAyB,MAAM,UAAU,YAAY,IAAI;EACzD;AAEJ,SAAS,yBACP,OACA,OACA,KACM;AACN,KAAI,UAAU,KAAA,KAAa,UAAU,GACnC;AAOF,KAAI,SAAS,KAAK,MAAM,EAAE;AACxB,MAAI,SAAS;GAAE,MAAM;GAAU,SAAS,GAAG,MAAM;GAAuB,CAAC;AACzE;;AAEF,KAAI,CAAC,gBAAgB,KAAK,MAAM,EAAE;AAChC,MAAI,SAAS;GAAE,MAAM;GAAU,SAAS,GAAG,MAAM;GAAkC,CAAC;AACpF;;CAEF,IAAI;AACJ,KAAI;AACF,WAAS,IAAI,IAAI,MAAM;SACjB;AACN,MAAI,SAAS;GAAE,MAAM;GAAU,SAAS,GAAG,MAAM;GAAuB,CAAC;AACzE;;AAKF,KAAI,OAAO,aAAa,WAAW,2BAA2B,MAAM,CAClE;AAEF,KAAI,OAAO,aAAa,YAAY,OAAO,SAAS,GAClD,KAAI,SAAS;EACX,MAAM;EACN,SAAS,GAAG,MAAM;EACnB,CAAC"}

package/dist/validate.mjs

@@ -114,7 +114,8 @@ function readFlow(flow) {
 			const entry = isPlainObject(t) ? t : {};
 			transitions.set(key, {
 				target: str(entry.target),
-				action: typeof entry.action === "string" ? entry.action : null
+				action: typeof entry.action === "string" ? entry.action : null,
+				purpose: typeof entry.purpose === "string" ? entry.purpose : null
 			});
 		}
 		steps.push({
@@ -226,9 +227,18 @@ function bfs(start, adj, visited) {
 }
 function validateGraph(def, stepNames) {
 	const issues = [];
-	for (const step of def.steps) for (const [key, t] of step.transitions) if (isCurrentFlow(t)) {
-		if (!stepNames.has(t.target)) issues.push(error("graph", `step ${q(step.name)}: transition ${q(key)} targets unknown step ${q(t.target)}`, step.name));
-	} else if (t.action !== "switch" && t.action !== "pivot") issues.push(error("graph", `step ${q(step.name)}: transition ${q(key)} has invalid action ${q(t.action ?? "")}`, step.name));
+	for (const step of def.steps) for (const [key, t] of step.transitions) {
+		if (t.purpose !== null) if (t.action !== null) issues.push(error("graph", `step ${q(step.name)}: transition ${q(key)} declares both purpose and action; a transition either re-purposes locally or targets another flow`, step.name));
+		else if (!FLOW_PURPOSES.includes(t.purpose)) issues.push(error("graph", `step ${q(step.name)}: transition ${q(key)} has invalid purpose`, step.name));
+		else {
+			const entry = def.purposes.get(t.purpose);
+			if (entry === void 0) issues.push(error("graph", `step ${q(step.name)}: transition ${q(key)} re-purposes to ${q(t.purpose)}, which this definition does not serve`, step.name));
+			else if (t.target !== entry) issues.push(error("graph", `step ${q(step.name)}: transition ${q(key)} re-purposes to ${q(t.purpose)} but targets ${q(t.target)}; it must target that purpose's entry step ${q(entry)}`, step.name));
+		}
+		if (isCurrentFlow(t)) {
+			if (!stepNames.has(t.target)) issues.push(error("graph", `step ${q(step.name)}: transition ${q(key)} targets unknown step ${q(t.target)}`, step.name));
+		} else if (t.action !== "switch" && t.action !== "pivot") issues.push(error("graph", `step ${q(step.name)}: transition ${q(key)} has invalid action ${q(t.action ?? "")}`, step.name));
+	}
 	for (const step of def.steps) if (!step.terminal && step.transitions.size === 0) issues.push(error("graph", `step ${q(step.name)} is non-terminal but has no outgoing transitions`, step.name));
 	const reachable = /* @__PURE__ */ new Set();
 	const adj = localAdjacency(def);
@@ -276,6 +286,38 @@ function schemaProperties(schema) {
 function schemaRequired(schema) {
 	return Array.isArray(schema.required) ? schema.required.map(str).filter((n) => n !== "") : [];
 }
+/**
+* Mirrors `schemaReader.RequiredPaths`: every name in `required`,
+* recursed through the nested `required` of each required object. A
+* required object declaring no `required` of its own ends the descent at
+* the object itself.
+*
+* An optional object contributes its own `required` too once it appears
+* in `materialized`. It only exists in the document because something
+* beneath it was collected, and from that point document validation
+* enforces the rest of its `required` list.
+*/
+function requiredPaths(schema, materialized, prefix = "") {
+	const properties = schemaProperties(schema);
+	const required = schemaRequired(schema);
+	const out = /* @__PURE__ */ new Set();
+	for (const name of required) {
+		const path = prefix === "" ? name : `${prefix}.${name}`;
+		const property = properties !== void 0 && Object.hasOwn(properties, name) ? properties[name] : void 0;
+		if (!isPlainObject(property) || schemaRequired(property).length === 0) {
+			out.add(path);
+			continue;
+		}
+		for (const nested of requiredPaths(property, materialized, path)) out.add(nested);
+	}
+	for (const [name, property] of Object.entries(properties ?? {})) {
+		if (required.includes(name) || !isPlainObject(property)) continue;
+		const path = prefix === "" ? name : `${prefix}.${name}`;
+		if (!materialized.has(path)) continue;
+		for (const nested of requiredPaths(property, materialized, path)) out.add(nested);
+	}
+	return [...out];
+}
 /** Mirrors `xAuthMethodsReader.IsEnabled` in flow_field_resolver_schema.go. */
 function authMethodEnabled(schema, method) {
 	if (!isPlainObject(schema["x-auth-methods"])) return false;
@@ -294,15 +336,26 @@ function resolveFieldChallenge(field, properties, schema) {
 		if (!authMethodEnabled(schema, method)) return { message: `${q(method)} is not an enabled authentication method` };
 		return { challenge: "password" };
 	}
-	const property = properties[field];
-	if (property === void 0) return { message: `flow field: not a property in the user schema: ${q(field)}` };
+	const segments = field.split(".");
+	let property = void 0;
+	let level = properties;
+	for (const [i, segment] of segments.entries()) {
+		property = level !== void 0 && Object.hasOwn(level, segment) ? level[segment] : void 0;
+		if (property === void 0) return { message: `flow field: not a property in the user schema: ${q(field)}` };
+		const nested = isPlainObject(property) ? schemaProperties(property) : void 0;
+		if (i < segments.length - 1 && nested === void 0) return { message: `flow field: not a property in the user schema: ${q(field)}` };
+		level = nested;
+	}
 	if (!isPlainObject(property)) return { challenge: null };
-	const jsonType = property.type;
+	let jsonType = property.type;
 	if (Array.isArray(jsonType)) {
-		if (jsonType.filter((t) => t !== "null").length > 1) return { message: `flow field: unsupported JSON type: [${jsonType.map(str).join(" ")}]` };
+		const nonNull = jsonType.filter((t) => t !== "null");
+		if (nonNull.length > 1) return { message: `flow field: unsupported JSON type: [${jsonType.map(str).join(" ")}]` };
+		jsonType = nonNull[0];
 	}
-	const unique = property["x-unique"];
-	if (unique === "project" || unique === "team") return { challenge: "identifier" };
+	if (jsonType === "object" || jsonType === "array" || schemaProperties(property) !== void 0 || "items" in property) return { message: `flow field: not a scalar property, name a nested leaf instead: ${q(field)}` };
+	const identifier = schema["x-identifier"];
+	if (typeof identifier === "string" && identifier !== "" && field === identifier) return { challenge: "identifier" };
 	return { challenge: null };
 }
 function validateAgainstSchema(def, schema) {
@@ -313,9 +366,15 @@ function validateAgainstSchema(def, schema) {
 		issues.push(error("schema/fields-resolve", "user schema has no properties"));
 		return issues;
 	}
-	const collected = /* @__PURE__ */ new Set();
-	for (const step of def.steps) for (const field of step.fields) collected.add(field);
-	const missing = schemaRequired(raw).filter((field) => !collected.has(field)).sort();
+	const covered = /* @__PURE__ */ new Set();
+	for (const step of def.steps) for (const field of step.fields) {
+		let path = "";
+		for (const node of field.split(".")) {
+			path = path === "" ? node : `${path}.${node}`;
+			covered.add(path);
+		}
+	}
+	const missing = requiredPaths(raw, covered).filter((field) => !covered.has(field)).sort();
 	if (missing.length > 0) issues.push(error("schema/required-fields", `required fields [${missing.join(" ")}] in user schema are missing in the flow definition steps`));
 	const challengesByStep = /* @__PURE__ */ new Map();
 	let resolutionFailed = false;