@zitadel/config 1.0.0-alpha.21 → 1.0.0-alpha.23

package/dist/meta-schemas-OowgSUfU.mjs

@@ -0,0 +1,1173 @@
+//#region meta-schemas/auth-method.json
+var auth_method_default = {
+	$comment: "Code generated by scripts/generate-meta-schemas.ts; DO NOT EDIT.",
+	$schema: "https://json-schema.org/draft/2020-12/schema",
+	title: "AuthMethod",
+	type: "object",
+	required: ["enabled"],
+	additionalProperties: false,
+	properties: { "enabled": {
+		"type": "boolean",
+		"description": "Whether the authentication method is enabled or not"
+	} }
+};
+//#endregion
+//#region meta-schemas/auth-methods.json
+var auth_methods_default = {
+	$comment: "Code generated by scripts/generate-meta-schemas.ts; DO NOT EDIT.",
+	$schema: "https://json-schema.org/draft/2020-12/schema",
+	title: "AuthMethods",
+	type: "object",
+	description: "A list of authentication methods supported by the user definition.",
+	minProperties: 1,
+	additionalProperties: false,
+	properties: {
+		"password": { "$ref": "auth-method.json" },
+		"passkey": { "$ref": "auth-method.json" },
+		"magic_link": { "$ref": "auth-method.json" },
+		"sso": { "$ref": "sso-auth-method.json" },
+		"otp": { "$ref": "auth-method.json" }
+	}
+};
+//#endregion
+//#region meta-schemas/branding.json
+var branding_default = {
+	$comment: "Code generated by scripts/generate-meta-schemas.ts; DO NOT EDIT.",
+	$schema: "https://json-schema.org/draft/2020-12/schema",
+	title: "Branding",
+	type: "object",
+	description: "Branding configuration, used in two places with one shape: as the request\nbody of `POST /branding`, which publishes it as a new immutable revision,\nand as a read-only projection on flow responses, which carries the\nproject's latest revision. Locally it is the `.zitadel/branding/` descriptor\nthat `zitadel apply` publishes.\n\nEvery field is optional. An omitted key uses Zitadel's maintained default,\nso a revision carrying one colour is as valid as one carrying the whole\nobject.\n",
+	additionalProperties: false,
+	properties: {
+		"$schema": {
+			"type": "string",
+			"description": "Editor affordance: path or URL of this file's JSON meta-schema, so an\neditor validates and autocompletes it. The CLI strips it before upload;\nthe platform ignores it.\n"
+		},
+		"layout": {
+			"type": "string",
+			"enum": ["centered", "split"],
+			"description": "Degrade preset (`centered` or `split`) the bundled default template\nbranches on, and the fallback when a custom template fails validation.\nNot the complete design catalog: all named designs (`centered`, `split`,\n`split-right`, `hero`, `minimal`) ship as templates and map onto one of\nthese two values; switch designs with\n`zitadel branding eject --design <name>` instead of editing this field.\nEjected templates may ignore it. Selects a template rather than restyling\nthe widget, so it is not an appearance control.\n",
+			"default": "centered"
+		},
+		"liquid_template": {
+			"description": "The LiquidJS template for rendering this step. The orchestrator renders\nit into its Shadow DOM with the capability dictionaries as context.\n",
+			"x-local": "file",
+			"anyOf": [{
+				"type": "string",
+				"maxLength": 131072
+			}, { "$ref": "#/$defs/LocalFileReference" }]
+		},
+		"logo_url": {
+			"type": "string",
+			"format": "uri",
+			"maxLength": 2048,
+			"description": "Fallback mark, used only when neither `theme.light.logo_url` nor\n`theme.dark.logo_url` is set. Prefer the per-side marks — one file\ncannot serve both surfaces.\n",
+			"pattern": "^([hH][tT][tT][pP][sS]://(?:\\[[0-9A-Fa-f:.]+\\]|[^/:?#@]+)(?::0*(?:[0-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?(?:[/?#]|$)|[hH][tT][tT][pP]://([lL][oO][cC][aA][lL][hH][oO][sS][tT]|127\\.(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){2}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])|\\[::1\\])(?::0*(?:[0-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?([/?#]|$))"
+		},
+		"hero_url": {
+			"type": "string",
+			"format": "uri",
+			"maxLength": 2048,
+			"description": "Hero/background image URL, used by the split layout.",
+			"pattern": "^([hH][tT][tT][pP][sS]://(?:\\[[0-9A-Fa-f:.]+\\]|[^/:?#@]+)(?::0*(?:[0-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?(?:[/?#]|$)|[hH][tT][tT][pP]://([lL][oO][cC][aA][lL][hH][oO][sS][tT]|127\\.(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){2}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])|\\[::1\\])(?::0*(?:[0-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?([/?#]|$))"
+		},
+		"theme": { "$ref": "#/$defs/BrandingTheme" },
+		"typography": { "$ref": "#/$defs/BrandingTypography" },
+		"shape": { "$ref": "#/$defs/BrandingShape" }
+	},
+	$defs: {
+		"LocalFileReference": {
+			"type": "object",
+			"additionalProperties": false,
+			"required": ["$file"],
+			"properties": { "$file": {
+				"type": "string",
+				"minLength": 1,
+				"description": "Path to the file whose content is this value, relative to the file holding the reference. The CLI inlines it before upload."
+			} }
+		},
+		"BrandingTheme": {
+			"type": "object",
+			"additionalProperties": false,
+			"description": "The theme sides this project publishes, and which of them may run.\n\nPublishing one side makes it the only theme that resolves, even under `auto`\nor an operating-system preference for the other. Publishing both lets `auto`\nfollow the operating system, each side using its own logo and palette.\n\nThe element-level `theme` property overrides `mode`, but cannot select a\nside the project never published.\n",
+			"properties": {
+				"mode": {
+					"type": "string",
+					"enum": [
+						"light",
+						"dark",
+						"auto"
+					],
+					"description": "Which published side may run. `auto` follows the operating system.\n",
+					"examples": ["auto"]
+				},
+				"light": { "$ref": "#/$defs/BrandingThemeSide" },
+				"dark": { "$ref": "#/$defs/BrandingThemeSide" }
+			}
+		},
+		"BrandingThemeSide": {
+			"type": "object",
+			"additionalProperties": false,
+			"description": "One complete theme side. Light and dark are independent surfaces — neither\ninherits from the other, and a side that is absent is never used, whatever\n`mode` or the operating system asks for.\n",
+			"properties": {
+				"logo_url": {
+					"type": "string",
+					"format": "uri",
+					"maxLength": 2048,
+					"description": "The mark for this surface. A logo is never recoloured, so each side\ncarries its own file. Absent means no mark on this side, unless the\ntop-level `logo_url` is the only one set.\n",
+					"pattern": "^([hH][tT][tT][pP][sS]://(?:\\[[0-9A-Fa-f:.]+\\]|[^/:?#@]+)(?::0*(?:[0-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?(?:[/?#]|$)|[hH][tT][tT][pP]://([lL][oO][cC][aA][lL][hH][oO][sS][tT]|127\\.(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){2}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])|\\[::1\\])(?::0*(?:[0-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?([/?#]|$))",
+					"examples": ["https://cdn.example.com/logo-on-light.svg"]
+				},
+				"palette": { "$ref": "#/$defs/BrandingPalette" }
+			}
+		},
+		"BrandingPalette": {
+			"type": "object",
+			"additionalProperties": false,
+			"description": "Semantic colours for one theme side. An omitted key uses the maintained\ndefault for this side, never the other side's value.\n\nEvery value is a `BrandingColor`, which is where the accepted forms and the\nreason for them live; what each key paints is below.\n",
+			"properties": {
+				"primary": {
+					"$ref": "#/$defs/BrandingColor",
+					"description": "Brand colour, and the source the focus rings derive from."
+				},
+				"on_primary": {
+					"$ref": "#/$defs/BrandingColor",
+					"description": "Text and icons drawn on `primary`."
+				},
+				"background": {
+					"$ref": "#/$defs/BrandingColor",
+					"description": "The surface behind the card."
+				},
+				"surface": {
+					"$ref": "#/$defs/BrandingColor",
+					"description": "The card and popover surfaces."
+				},
+				"muted": {
+					"$ref": "#/$defs/BrandingColor",
+					"description": "Neutral fills — the secondary button, accents and muted panels."
+				},
+				"border": {
+					"$ref": "#/$defs/BrandingColor",
+					"description": "Card and control edges."
+				},
+				"text": {
+					"$ref": "#/$defs/BrandingColor",
+					"description": "Body text, and the foreground of every neutral surface — a side that\nsets `muted` without `text` keeps the default label colour on it.\n"
+				},
+				"text_muted": {
+					"$ref": "#/$defs/BrandingColor",
+					"description": "Secondary text."
+				},
+				"link": {
+					"$ref": "#/$defs/BrandingColor",
+					"description": "Link colour. Defaults to the surrounding text colour, so setting it\ntints exactly the links and nothing else.\n"
+				},
+				"success": {
+					"$ref": "#/$defs/BrandingColor",
+					"description": "Valid fields, success alerts and pills."
+				},
+				"warning": {
+					"$ref": "#/$defs/BrandingColor",
+					"description": "Warning surfaces. Persisted, but nothing renders it yet."
+				},
+				"error": {
+					"$ref": "#/$defs/BrandingColor",
+					"description": "Invalid fields, error alerts and pills."
+				}
+			}
+		},
+		"BrandingColor": {
+			"type": "string",
+			"minLength": 1,
+			"maxLength": 128,
+			"description": "A colour on a theme side: hex (`#4F46E5`), a CSS colour name, or a colour\nfunction — `rgb()`, `rgba()`, `hsl()`, `hsla()`, `hwb()`, `lab()`, `lch()`,\n`oklab()`, `oklch()`, `color()` or `color-mix()`. `url()` and `var()` are\nrejected: the value is written into a stylesheet, so only forms that resolve\nto a colour are stored.\n\nThe pattern pins the shape — no semicolons, braces, comment markers or\nbackslashes, so a value cannot leave its declaration whatever it spells.\nWhich names CSS actually knows is the browser's business: an unrecognised\none is stored and paints nothing, rather than being refused here.\n",
+			"pattern": "^(?:#(?:[0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})|[a-zA-Z]{3,24}|[a-zA-Z][a-zA-Z-]{2,12}\\((?:[0-9a-zA-Z%.,+/# -]|[a-zA-Z][a-zA-Z-]{2,12}\\([0-9a-zA-Z%.,+/# -]*\\))*\\))$",
+			"examples": [
+				"#4F46E5",
+				"#fff",
+				"#4F46E5CC",
+				"rebeccapurple",
+				"currentColor",
+				"transparent",
+				"rgb(79 70 229)",
+				"rgba(79 70 229 / 50%)",
+				"oklch(0.7 0.15 250)",
+				"color-mix(in oklab, #4F46E5 40%, white)"
+			]
+		},
+		"BrandingTypography": {
+			"type": "object",
+			"additionalProperties": false,
+			"dependentRequired": { "font_url": ["font_family"] },
+			"description": "The typeface the login surface renders in. One face covers both body and\nheadings; separate heading and mono faces are not modelled yet.\n",
+			"properties": {
+				"font_family": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 256,
+					"pattern": "^ *(?:\"[^\"\\\\;{}]*\"|'[^'\\\\;{}]*'|[A-Za-z0-9_-]+(?: [A-Za-z0-9_-]+)*)(?: *, *(?:\"[^\"\\\\;{}]*\"|'[^'\\\\;{}]*'|[A-Za-z0-9_-]+(?: [A-Za-z0-9_-]+)*))* *$",
+					"description": "CSS font stack for body and heading text. Include a generic family so\nthe surface still renders when the named face is unavailable.\n\nComma-separated family names, each either an identifier (`Inter`,\n`ui-sans-serif`, `Helvetica Neue`) or a quoted name (`\"APK Futural\"`).\nAnything else is rejected — the stack is written into a stylesheet, so\nonly names are stored, and a quoted name must close the quote it opened.\n",
+					"examples": ["Inter, ui-sans-serif, sans-serif"]
+				},
+				"font_url": {
+					"type": "string",
+					"format": "uri",
+					"maxLength": 2048,
+					"description": "Stylesheet that loads `font_family` — a Google Fonts CSS URL, for\nexample. Must be https; unlike the logo and hero assets there is no\nloopback carve-out. Rejected without `font_family`, which would name\nnothing to paint with.\n\nStored but not applied to an embedded widget: the embedding page loads\nthe face, and Zitadel does not inject a stylesheet into a document it\ndoes not own.\n",
+					"pattern": "^[hH][tT][tT][pP][sS]://(?:\\[[0-9A-Fa-f:.]+\\]|[^/:?#@]+)(?::0*(?:[0-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?(?:[/?#]|$)",
+					"examples": ["https://fonts.googleapis.com/css2?family=Inter&display=swap"]
+				},
+				"scale": {
+					"type": "number",
+					"minimum": .75,
+					"maximum": 1.25,
+					"description": "Multiplier on the base text sizes, `1` when omitted.",
+					"examples": [1]
+				}
+			}
+		},
+		"BrandingShape": {
+			"type": "object",
+			"additionalProperties": false,
+			"description": "Corner rounding, spacing and logo size. Shared across theme sides.\n",
+			"properties": {
+				"radius": {
+					"description": "Corner rounding for the card, inputs, buttons and alerts — either a\npreset name or an integer number of pixels. One value scales the whole\ncorner ramp in proportion, so the card stays rounder than the controls\ninside it.\n",
+					"oneOf": [{ "$ref": "#/$defs/BrandingRadiusPreset" }, {
+						"type": "integer",
+						"minimum": 0,
+						"maximum": 32
+					}],
+					"examples": [10]
+				},
+				"density": {
+					"type": "string",
+					"enum": [
+						"compact",
+						"regular",
+						"comfortable"
+					],
+					"description": "Spacing and control height.",
+					"examples": ["regular"]
+				},
+				"logo_scale": {
+					"type": "number",
+					"minimum": .5,
+					"maximum": 2,
+					"description": "Multiplier on the logo's maximum height, `1` when omitted. The image keeps its intrinsic\naspect ratio inside that cap; no width, height or ratio is stored.\n",
+					"examples": [1]
+				}
+			}
+		},
+		"BrandingRadiusPreset": {
+			"type": "string",
+			"enum": [
+				"none",
+				"sm",
+				"md",
+				"lg",
+				"full"
+			],
+			"description": "A named corner rounding: `none` (0), `sm` (4), `md` (8), `lg` (12), and\n`full` (pill). Send `full` for a pill rather than a large pixel value.\n",
+			"examples": ["md"]
+		}
+	}
+};
+//#endregion
+//#region meta-schemas/flow-definition.json
+var flow_definition_default = {
+	$comment: "Code generated by scripts/generate-meta-schemas.ts; DO NOT EDIT.",
+	$schema: "https://json-schema.org/draft/2020-12/schema",
+	title: "FlowDefinition",
+	type: "object",
+	required: [
+		"name",
+		"status",
+		"user_schema",
+		"purposes",
+		"steps"
+	],
+	description: "A flow definition is the server-side configuration that describes a complete\nauthentication or identity flow. It is NOT sent to the frontend — the flow\nengine evaluates it and produces FlowResponse payloads (steps with capability\ndictionaries) for the client.\n\nFlow definitions are created by administrators and stored in the project/team\nconfiguration hierarchy. The engine selects the matching definition based on\nthe purpose + audience when a flow is created via POST /flow.\n",
+	additionalProperties: false,
+	properties: {
+		"$schema": {
+			"type": "string",
+			"description": "Editor affordance: path or URL of this file's JSON meta-schema, so an\neditor validates and autocompletes it. The CLI strips it before upload;\nthe platform ignores it.\n"
+		},
+		"name": {
+			"type": "string",
+			"pattern": "^[a-z][a-z0-9-]*$",
+			"examples": ["standard-login", "combined-auth"],
+			"description": "Stable identifier for this flow, used as the target of cross-flow\n`switch` and `pivot` transitions. Every revision of a flow shares its\n`name`; publishing a definition under an existing `name` adds a\nrevision to that flow. Renaming is not supported — the `name` is part\nof the public contract another definition may reference. Acts as the\nhuman display label as well; no separate slug.\n"
+		},
+		"status": { "$ref": "#/$defs/FlowDefinitionStatus" },
+		"user_schema": {
+			"type": "string",
+			"description": "Server-assigned identifier of the user schema this flow operates on,\nas returned by `POST /schemas`. Opaque to the client — the shape is a\nserver implementation detail. Step `fields` reference properties\ndefined in the resolved schema; the engine resolves field types, validation, and\nimplicit outcomes from schema annotations at runtime.\n",
+			"examples": ["sch_01KWHF18816ZQESRCS7Z2STJ05"]
+		},
+		"purposes": {
+			"type": "object",
+			"description": "Maps each purpose this definition handles to its entry-point step.\nKeys are purpose names; values must match a `name` in `steps`. A\ndefinition can serve multiple purposes (e.g. a combined login/register\nflow) by listing one entry per purpose.\n",
+			"minProperties": 1,
+			"propertyNames": {
+				"type": "string",
+				"enum": [
+					"login",
+					"register",
+					"recovery",
+					"profiling",
+					"reauth",
+					"link_account"
+				]
+			},
+			"additionalProperties": { "type": "string" },
+			"examples": [{ "login": "identify" }]
+		},
+		"audience": {
+			"$ref": "#/$defs/FlowAudience",
+			"examples": [{ "app_ids": ["app_saas"] }]
+		},
+		"steps": {
+			"type": "array",
+			"items": { "$ref": "#/$defs/FlowDefinitionStep" },
+			"minItems": 1,
+			"description": "Ordered list of steps in this flow. The order is for human readability —\nactual step sequencing is determined by transitions.\n",
+			"examples": [[
+				{
+					"name": "identify",
+					"fields": ["email"],
+					"actions": [{
+						"name": "submit",
+						"kind": "submit",
+						"primary": true
+					}],
+					"transitions": {
+						"submit": { "target": "authenticate" },
+						"user_not_found": {
+							"target": "register",
+							"action": "switch"
+						}
+					}
+				},
+				{
+					"name": "authenticate",
+					"fields": ["password"],
+					"actions": [{
+						"name": "submit",
+						"kind": "submit",
+						"primary": true
+					}],
+					"transitions": { "submit": { "target": "done" } }
+				},
+				{
+					"name": "done",
+					"complete": "redirect"
+				}
+			]]
+		}
+	},
+	$defs: {
+		"FlowDefinitionStatus": {
+			"type": "string",
+			"enum": ["active", "draft"],
+			"description": "The lifecycle state of this flow definition. \n\nactive: The flow definition is ready to be used. The flow engine can select it for new flows.\ndraft: The engine will not select it for new flows, and existing flows must handle it gracefully if they reference this definition.\n\nA revision's status is fixed at creation. Publish a new revision to change it.\n"
+		},
+		"FlowAudience": {
+			"type": "object",
+			"additionalProperties": false,
+			"description": "Scopes which teams or apps this flow definition applies to. Empty or\nomitted fields mean \"no restriction\"; when both are empty the definition\nmatches every request in the project. The engine picks the most specific\nmatching definition: app > team > project-wide.\n",
+			"properties": {
+				"team_ids": {
+					"type": "array",
+					"items": { "type": "string" },
+					"description": "Restrict to specific teams (organizations). Empty means no team restriction.",
+					"uniqueItems": true,
+					"examples": [["team_acme"]]
+				},
+				"app_ids": {
+					"type": "array",
+					"items": { "type": "string" },
+					"description": "Restrict to specific applications. Empty means no app restriction.",
+					"uniqueItems": true,
+					"examples": [["app_saas"]]
+				}
+			}
+		},
+		"FlowDefinitionStep": {
+			"type": "object",
+			"required": ["name"],
+			"additionalProperties": false,
+			"not": { "anyOf": [
+				{
+					"required": ["sso_providers"],
+					"properties": { "sso_providers": { "minItems": 1 } },
+					"anyOf": [{ "not": { "required": ["transitions"] } }, { "properties": { "transitions": { "not": { "required": ["callback"] } } } }]
+				},
+				{
+					"required": ["complete"],
+					"anyOf": [
+						{
+							"required": ["fields"],
+							"properties": { "fields": { "minItems": 1 } }
+						},
+						{
+							"required": ["actions"],
+							"properties": { "actions": { "minItems": 1 } }
+						},
+						{
+							"required": ["sso_providers"],
+							"properties": { "sso_providers": { "minItems": 1 } }
+						},
+						{
+							"required": ["gates"],
+							"properties": { "gates": { "minProperties": 1 } }
+						},
+						{
+							"required": ["transitions"],
+							"properties": { "transitions": { "minProperties": 1 } }
+						}
+					]
+				},
+				{
+					"not": { "required": ["complete"] },
+					"properties": {
+						"fields": { "maxItems": 0 },
+						"actions": { "maxItems": 0 },
+						"sso_providers": { "maxItems": 0 },
+						"gates": { "maxProperties": 0 },
+						"transitions": { "not": { "required": ["callback"] } }
+					}
+				}
+			] },
+			"description": "A step in a flow definition. This is the admin-authored configuration,\nnot the runtime payload sent to the frontend.\n\nSteps are schema-driven: `fields` references properties from the flow's\nuser schema, and the engine resolves field metadata (type, validation,\nimplicit outcomes) from schema annotations at runtime.\n\nA step with only `complete` set is a terminal step. All other steps are\nrendered to the frontend as capability payloads.\n",
+			"properties": {
+				"name": {
+					"type": "string",
+					"description": "Unique step identifier within this flow. Used as transition targets\nand returned in the API response as `step.name`.\n",
+					"pattern": "^[a-z][a-z0-9_-]*$",
+					"examples": ["login"]
+				},
+				"fields": {
+					"type": "array",
+					"description": "Schema property names to collect from the user. Each entry references\na property in the flow's user schema. The engine resolves field type,\nvalidation rules, and implicit outcomes from schema annotations\n(e.g. a property with `x-unique` set implies a `user_not_found`\ntransition outcome).\n",
+					"items": { "type": "string" },
+					"uniqueItems": true,
+					"default": [],
+					"examples": [["email", "password"]]
+				},
+				"actions": {
+					"type": "array",
+					"description": "Ordered list of actions the user can take. The action name is what the\nfrontend sends back in the submit request. If omitted, the engine\nprovides a default `submit` action.\n",
+					"items": { "$ref": "#/$defs/StepAction" },
+					"default": [],
+					"examples": [[{
+						"name": "submit",
+						"kind": "submit",
+						"primary": true
+					}, {
+						"name": "forgot_password",
+						"kind": "navigate"
+					}]]
+				},
+				"gates": {
+					"type": "object",
+					"description": "Security gates that must be satisfied before submission. Keyed by gate\nname. Each gate selects a kind (e.g. \"captcha\") and provider-specific\nconfiguration. The engine may also inject gates dynamically based on\npolicy.\n",
+					"additionalProperties": { "$ref": "#/$defs/Gate" },
+					"default": {},
+					"examples": [{ "bot_check": {
+						"kind": "captcha",
+						"provider": "altcha"
+					} }]
+				},
+				"sso_providers": {
+					"type": "array",
+					"description": "Slugs of the identity provider connections this step offers, in display\norder. Each names the `slug` of a connection under `.zitadel/idps/`; the\nconnection carries the display name and template, so a rename there\nreaches every step without editing the flow. The rendered step the client\nreceives carries the resolved `{id, name, template}` objects instead.\n",
+					"uniqueItems": true,
+					"items": {
+						"type": "string",
+						"pattern": "^[a-z0-9][a-z0-9_-]*$",
+						"maxLength": 64
+					},
+					"default": [],
+					"examples": [["google"]]
+				},
+				"on_success": {
+					"type": "string",
+					"enum": ["create_user"],
+					"description": "Server-side mutation to execute when this step completes successfully.\nRuns after field validation passes, before the transition fires.\n\n- create_user: creates the user record (registration flows)\n",
+					"examples": ["create_user"]
+				},
+				"complete": {
+					"type": "string",
+					"enum": ["redirect", "show"],
+					"description": "Marks this as a terminal step. Tells the frontend what to do:\n- redirect: navigate to redirect_uri (OIDC/SAML callback done)\n- show: render as a success/info screen\n",
+					"examples": ["redirect"]
+				},
+				"transitions": {
+					"type": "object",
+					"description": "Maps action/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` array. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n",
+					"additionalProperties": {
+						"type": "object",
+						"required": ["target"],
+						"properties": {
+							"target": {
+								"type": "string",
+								"description": "Step name within this flow (when `action` is null), or the name\nof another flow (when `action` is `switch` or `pivot`).\n",
+								"examples": ["password"]
+							},
+							"action": {
+								"oneOf": [{
+									"type": "string",
+									"enum": ["switch", "pivot"]
+								}, { "type": "null" }],
+								"description": "How to interpret `target`:\n- null (omitted): transition to a step in the current flow.\n- switch: replace the current flow with the target flow.\n  No return — the current flow is discarded.\n  Example: login ↔ register.\n- pivot: push the target flow onto the stack. The current flow\n  is paused and resumes when the target flow completes (auto-pop).\n  Example: login → recovery → back to login.\n"
+							},
+							"purpose": {
+								"oneOf": [{
+									"type": "string",
+									"enum": [
+										"login",
+										"register",
+										"recovery",
+										"profiling",
+										"reauth",
+										"link_account"
+									]
+								}, { "type": "null" }],
+								"description": "Local re-purposing. When set, taking this transition changes the\nflow's current purpose to this value — the dispatch mode a step's\nchallenges run under — while the flow's original purpose stays\npinned. Must be a purpose this definition serves, and `target`\nmust be that purpose's entry step. Mutually exclusive with\n`action`: a transition either re-purposes within this flow or\ntargets another flow, never both.\nExample: a \"Sign up\" navigation on the login identifier step\n(`{ target: register, purpose: register }`).\n"
+							}
+						},
+						"additionalProperties": false,
+						"not": {
+							"required": ["purpose", "action"],
+							"properties": {
+								"purpose": { "type": "string" },
+								"action": { "type": "string" }
+							}
+						}
+					},
+					"examples": [{
+						"submit": { "target": "password" },
+						"recover": {
+							"target": "recovery",
+							"action": "pivot"
+						},
+						"register": {
+							"target": "register",
+							"action": "switch"
+						}
+					}]
+				}
+			}
+		},
+		"StepAction": {
+			"type": "object",
+			"required": ["name", "kind"],
+			"additionalProperties": false,
+			"description": "An action a flow author declares on a step of a flow definition. The\n`name` is sent back in the submit request as `action`; the engine resolves\nthe action's declared `kind` to decide how to handle the submission.\n",
+			"properties": {
+				"name": {
+					"type": "string",
+					"minLength": 1,
+					"description": "Action identifier. Sent back in the submit request as `action`.",
+					"examples": ["submit"]
+				},
+				"kind": {
+					"type": "string",
+					"enum": [
+						"submit",
+						"passkey",
+						"passkey_register",
+						"navigate"
+					],
+					"description": "Classifies how the engine handles this action. `back` is not declarable:\nthe engine injects it into runtime steps (see `flow-step-action.yaml`)\nwhenever going back is available.\n- `submit`: collect the step's fields and run validate/dispatch/on_success.\n- `passkey`: issue a WebAuthn assertion challenge; the matching transition\n  fires once the returned assertion verifies.\n- `passkey_register`: issue a WebAuthn registration challenge; the matching\n  transition fires once the returned attestation verifies.\n- `navigate`: route through the transition without running the input\n  pipeline. Used for pure-routing actions declared in the flow definition.\n",
+					"examples": ["submit"]
+				},
+				"primary": {
+					"type": "boolean",
+					"default": false,
+					"description": "Marks this as the default/primary action. The runtime template uses\nthis hint to choose visual emphasis. At most one action per step\nshould be primary; this is not enforced here.\n",
+					"examples": [true]
+				},
+				"text_key": {
+					"type": "string",
+					"description": "Optional localization key override for the action's label. When\nomitted, the engine derives a key from the step and action names.\nDisplay text is resolved client-side from a locale dictionary, never\nby the engine.\n",
+					"examples": ["actions.signin.submit"]
+				}
+			}
+		},
+		"Gate": {
+			"type": "object",
+			"additionalProperties": false,
+			"required": ["kind", "provider"],
+			"description": "A security challenge that must be satisfied before this step's submission\nis accepted. The engine may also inject gates at runtime based on policy\nor risk evaluation.\n",
+			"properties": {
+				"kind": {
+					"type": "string",
+					"enum": ["captcha"],
+					"description": "The gate category. Only `captcha` is currently defined. Authenticator\nceremonies (e.g. passkey) are modelled as credential auth_attempts via\n`x-credential` on a field, not as gates.\n",
+					"examples": ["captcha"]
+				},
+				"provider": {
+					"type": "string",
+					"description": "Provider identifier within the gate kind — e.g. `altcha`, `turnstile`,\n`hcaptcha`. The engine looks up an implementation in its provider\nregistry.\n",
+					"examples": ["altcha"]
+				},
+				"config": {
+					"type": "object",
+					"description": "Provider-specific configuration consumed by the implementation when\nissuing the per-render challenge. Opaque to the engine.\n",
+					"additionalProperties": true,
+					"examples": [{ "site_key": "0x4AAAAAAA-example-site-key" }]
+				}
+			}
+		}
+	}
+};
+//#endregion
+//#region meta-schemas/idp-connection.json
+var idp_connection_default = {
+	$comment: "Code generated by scripts/generate-meta-schemas.ts; DO NOT EDIT.",
+	$schema: "https://json-schema.org/draft/2020-12/schema",
+	title: "IdentityProviderConnection",
+	type: "object",
+	required: [
+		"slug",
+		"protocol",
+		"display_name"
+	],
+	additionalProperties: false,
+	properties: {
+		"$schema": {
+			"type": "string",
+			"minLength": 1,
+			"description": "Editor affordance: path or URL of this schema so editors validate and autocomplete the file (scaffolded connection files point at `.zitadel/meta/idp-connection.json`). Ignored by the platform."
+		},
+		"slug": {
+			"type": "string",
+			"pattern": "^[a-z0-9][a-z0-9_-]*$",
+			"maxLength": 64,
+			"description": "Stable identifier, referenced by user schemas (x-auth-methods.sso.providers) and flow steps (sso_providers). Unique within the Project.",
+			"examples": [
+				"google",
+				"github",
+				"corp_idp"
+			]
+		},
+		"protocol": {
+			"type": "string",
+			"enum": ["oidc", "oauth2"],
+			"description": "The protocol used by the identity provider."
+		},
+		"template": {
+			"type": "string",
+			"examples": [
+				"google",
+				"github",
+				"okta"
+			],
+			"description": "Template hint for rendering the provider (logo, colors). Carries no protocol behavior: conduct comes only from the protocol blocks."
+		},
+		"display_name": {
+			"type": "string",
+			"minLength": 1,
+			"maxLength": 256,
+			"description": "Shown to the user on the sign-in button."
+		},
+		"subject_claim": {
+			"type": "string",
+			"minLength": 1,
+			"description": "Claim carrying the provider's stable subject identifier. Optional for OIDC (the engine uses `sub` per spec; override where `sub` is pairwise, e.g. Entra `oid`). Required for OAuth2 — no `sub` guarantee."
+		},
+		"claim_mapping": {
+			"type": "object",
+			"additionalProperties": {
+				"type": "string",
+				"pattern": "^[^$]"
+			},
+			"description": "Maps user-schema property names (keys) to provider claim names (values). A value is an exact top-level claim key: no path syntax, and a dot is part of the key, so nested claims (OIDC `address`, GitHub `plan`) are not addressable yet. `$`-prefixed strings and non-string values are reserved for future mapping forms. Add properties defined in the user schemas; unmatched entries are ignored."
+		},
+		"verified_claims": {
+			"type": "object",
+			"additionalProperties": { "anyOf": [
+				{ "const": true },
+				{ "const": "$supplementary_fetch" },
+				{
+					"type": "string",
+					"pattern": "^[^$]"
+				}
+			] },
+			"description": "Maps a verifiable user-schema property to its verification source: a claim name (read the claim), the literal `true` (trust this provider unconditionally), or the `$`-pointer `\"$supplementary_fetch\"` (verified by the selected supplementary_fetch strategy per its contract - e.g. github_primary_email verifies `email` via primary && verified). Values starting with `$` are reserved; only `$supplementary_fetch` is defined. Distinct from claim_mapping, which carries values, not verification state.",
+			"examples": [
+				{ "email": "email_verified" },
+				{ "email": true },
+				{ "email": "$supplementary_fetch" }
+			]
+		},
+		"provisioning": {
+			"type": "object",
+			"additionalProperties": false,
+			"description": "How far this provider's data is trusted. `creation` defines what happens to a subject that has no account yet. With `disabled`, a user is not created. With `auto`, the user is created without a collection step when the mapped claims fill every required property of the schema. A required property with an `x-unique` scope must also arrive verified according to `verified_claims`. When a required property is missing or such a property is unverified, the collection step is shown instead, prefilled with the claims. Gating on other properties will be added when `x-verify` returns to the dialect. The following are deferred and will be added as additive changes. The `auto_only` value creates the user from complete claims or fails without collecting. The linking policy (`is_linking_allowed`, `auto_linking`), together with the account-linking journey. `is_auto_update`, together with per-property verification state.",
+			"properties": { "creation": {
+				"type": "string",
+				"enum": ["disabled", "auto"],
+				"default": "auto"
+			} }
+		},
+		"oidc": {
+			"type": "object",
+			"additionalProperties": false,
+			"description": "OIDC connection details. Endpoints come from discovery, but any may be supplied to override it, or to serve a provider that exposes no .well-known document.",
+			"required": [
+				"issuer",
+				"client_id",
+				"client_secret",
+				"scopes"
+			],
+			"properties": {
+				"issuer": {
+					"type": "string",
+					"format": "uri",
+					"pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)(/[^\\s?#]*)?$",
+					"description": "Discovery base. Endpoints are resolved from its .well-known document unless overridden below."
+				},
+				"jwks_uri": {
+					"type": "string",
+					"format": "uri",
+					"pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)([/?][^\\s#]*)?$",
+					"description": "Overrides the JWKS endpoint from discovery. Required in practice when the provider exposes no .well-known document, since ID tokens cannot otherwise be validated."
+				},
+				"id_token_mapping": {
+					"type": "boolean",
+					"default": false,
+					"description": "Read user claims from the id_token instead of the userinfo endpoint, for providers that populate only the former."
+				},
+				"authorization_endpoint": {
+					"type": "string",
+					"format": "uri",
+					"pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)([/?][^\\s#]*)?$",
+					"description": "Overrides discovery."
+				},
+				"token_endpoint": {
+					"type": "string",
+					"format": "uri",
+					"pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)([/?][^\\s#]*)?$",
+					"description": "Overrides discovery."
+				},
+				"userinfo_endpoint": {
+					"type": "string",
+					"format": "uri",
+					"pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)([/?][^\\s#]*)?$",
+					"description": "Overrides discovery."
+				},
+				"client_id": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 512,
+					"description": "Either a literal in case the same client is used in all environments, or a `${{ NAME }}` reference to a variable in case of separate clients per environment."
+				},
+				"client_secret": {
+					"type": "string",
+					"pattern": "^\\$\\{\\{ *[A-Za-z0-9_]+ *\\}\\}$",
+					"description": "A reference to the variable holding the client secret, never the secret itself. A secret may only be referenced as the entire value: text around the placeholder would be rendered into the resolved credential, so it is rejected. The engine resolves it against the environment serving the request."
+				},
+				"token_endpoint_auth_method": {
+					"type": "string",
+					"enum": ["client_secret_basic", "client_secret_post"],
+					"default": "client_secret_basic",
+					"description": "How the client authenticates at the token endpoint."
+				},
+				"scopes": {
+					"type": "array",
+					"items": {
+						"type": "string",
+						"minLength": 1
+					},
+					"uniqueItems": true,
+					"minItems": 1,
+					"contains": { "const": "openid" },
+					"default": [
+						"openid",
+						"profile",
+						"email"
+					],
+					"description": "Must contain `openid` - without it the provider returns no id_token and the connection is not OIDC. Enforced by `required` + `contains`; the `default` is a UI-prefill hint only - validators never inject it, so an omitted `scopes` is rejected regardless."
+				},
+				"pkce_enabled": {
+					"type": "boolean",
+					"default": true,
+					"description": "Send PKCE (code_challenge/code_verifier). Providers that do not support PKCE typically ignore the parameters, so `true` is safe and future-proofs; set `false` only for a provider whose token endpoint rejects them."
+				},
+				"static_authorize_parameters": {
+					"type": "object",
+					"propertyNames": {
+						"minLength": 1,
+						"not": { "enum": [
+							"client_id",
+							"redirect_uri",
+							"response_type",
+							"scope",
+							"state",
+							"nonce",
+							"code_challenge",
+							"code_challenge_method",
+							"response_mode",
+							"request",
+							"request_uri",
+							"client_secret",
+							"client_assertion"
+						] }
+					},
+					"additionalProperties": { "type": "string" },
+					"description": "Extra provider-specific authorize parameters (for example `prompt`). Engine-owned protocol parameters are reserved and rejected by `propertyNames`: the engine composes them itself, and an override of `state` or `nonce` would silently defeat CSRF and token binding. `client_secret` and `client_assertion` are rejected as they could be appended to the public authorize URL."
+				}
+			}
+		},
+		"oauth2": {
+			"type": "object",
+			"additionalProperties": false,
+			"description": "OAuth 2.0 connection details.",
+			"required": [
+				"authorization_endpoint",
+				"token_endpoint",
+				"userinfo_endpoint",
+				"client_id",
+				"client_secret"
+			],
+			"properties": {
+				"authorization_endpoint": {
+					"type": "string",
+					"format": "uri",
+					"pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)([/?][^\\s#]*)?$",
+					"description": "Where the user is sent to authorize."
+				},
+				"token_endpoint": {
+					"type": "string",
+					"format": "uri",
+					"pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)([/?][^\\s#]*)?$",
+					"description": "Where the authorization code is exchanged."
+				},
+				"userinfo_endpoint": {
+					"type": "string",
+					"format": "uri",
+					"pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)([/?][^\\s#]*)?$",
+					"description": "Where the authenticated user's profile is fetched."
+				},
+				"client_id": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 512,
+					"description": "Either a literal in case the same client is used in all environments, or a `${{ NAME }}` reference to a variable in case of separate clients per environment."
+				},
+				"client_secret": {
+					"type": "string",
+					"pattern": "^\\$\\{\\{ *[A-Za-z0-9_]+ *\\}\\}$",
+					"description": "A reference to the variable holding the client secret, never the secret itself. A secret may only be referenced as the entire value: text around the placeholder would be rendered into the resolved credential, so it is rejected. The engine resolves it against the environment serving the request."
+				},
+				"token_endpoint_auth_method": {
+					"type": "string",
+					"enum": ["client_secret_basic", "client_secret_post"],
+					"default": "client_secret_basic",
+					"description": "How the client authenticates at the token endpoint."
+				},
+				"scopes": {
+					"type": "array",
+					"items": {
+						"type": "string",
+						"minLength": 1
+					},
+					"uniqueItems": true,
+					"description": "Provider-specific; OAuth 2.0 defines no universal scope."
+				},
+				"pkce_enabled": {
+					"type": "boolean",
+					"default": true,
+					"description": "Send PKCE (code_challenge/code_verifier). Providers that do not support PKCE typically ignore the parameters, so `true` is safe and future-proofs; set `false` only for a provider whose token endpoint rejects them."
+				},
+				"static_authorize_parameters": {
+					"type": "object",
+					"propertyNames": {
+						"minLength": 1,
+						"not": { "enum": [
+							"client_id",
+							"redirect_uri",
+							"response_type",
+							"scope",
+							"state",
+							"nonce",
+							"code_challenge",
+							"code_challenge_method",
+							"response_mode",
+							"request",
+							"request_uri",
+							"client_secret",
+							"client_assertion"
+						] }
+					},
+					"additionalProperties": { "type": "string" },
+					"description": "Extra provider-specific authorize parameters (for example `prompt`). Engine-owned protocol parameters are reserved and rejected by `propertyNames`: the engine composes them itself, and an override of `state` or `nonce` would silently defeat CSRF and token binding. `client_secret` and `client_assertion` are rejected as they could be appended to the public authorize URL."
+				},
+				"supplementary_fetch": {
+					"type": "string",
+					"enum": ["github_primary_email"],
+					"description": "Provider-specific follow-up call after userinfo. New values are non-breaking."
+				}
+			},
+			"allOf": [{
+				"if": {
+					"properties": { "supplementary_fetch": { "const": "github_primary_email" } },
+					"required": ["supplementary_fetch"]
+				},
+				"then": {
+					"required": ["scopes"],
+					"properties": { "scopes": { "contains": { "const": "user:email" } } }
+				}
+			}]
+		}
+	},
+	allOf: [{
+		"if": {
+			"properties": { "protocol": { "const": "oidc" } },
+			"required": ["protocol"]
+		},
+		"then": {
+			"required": ["oidc"],
+			"properties": { "oauth2": false }
+		}
+	}, {
+		"if": {
+			"properties": { "protocol": { "const": "oauth2" } },
+			"required": ["protocol"]
+		},
+		"then": {
+			"required": ["oauth2", "subject_claim"],
+			"properties": { "oidc": false }
+		}
+	}]
+};
+//#endregion
+//#region meta-schemas/property-name.json
+var property_name_default = {
+	$comment: "Code generated by scripts/generate-meta-schemas.ts; DO NOT EDIT.",
+	$schema: "https://json-schema.org/draft/2020-12/schema",
+	title: "PropertyName",
+	type: "string",
+	pattern: "^[^.]+$",
+	description: "The name of a single user attribute."
+};
+//#endregion
+//#region meta-schemas/sso-auth-method.json
+var sso_auth_method_default = {
+	$comment: "Code generated by scripts/generate-meta-schemas.ts; DO NOT EDIT.",
+	$schema: "https://json-schema.org/draft/2020-12/schema",
+	title: "SSOAuthMethod",
+	type: "object",
+	required: ["enabled"],
+	additionalProperties: false,
+	properties: {
+		"enabled": {
+			"type": "boolean",
+			"description": "Whether the authentication method is enabled or not"
+		},
+		"providers": {
+			"type": "array",
+			"minItems": 1,
+			"uniqueItems": true,
+			"items": {
+				"type": "string",
+				"pattern": "^[a-z0-9][a-z0-9_-]*$",
+				"maxLength": 64,
+				"examples": [
+					"google",
+					"github",
+					"corp_idp"
+				]
+			},
+			"description": "Slugs of the Project-level identity provider connections available to users of this schema. Each entry must match the `slug` of a connection under `.zitadel/idps/`; a connection existing does not by itself make it available here."
+		}
+	},
+	"if": {
+		"properties": { "enabled": { "const": true } },
+		"required": ["enabled"]
+	},
+	then: { "required": ["providers"] },
+	"else": { "not": { "required": ["providers"] } }
+};
+//#endregion
+//#region meta-schemas/user-property.json
+var user_property_default = {
+	$comment: "Code generated by scripts/generate-meta-schemas.ts; DO NOT EDIT.",
+	$schema: "https://json-schema.org/draft/2020-12/schema",
+	title: "UserProperty",
+	type: "object",
+	description: "The meta-schema one property of a customer's user schema is validated\nagainst. The generated `user-property.json` adds\n`allOf: [{$ref: draft-2020-12}]`, which cannot live here because code\ngenerators choke on it.\n\nNative JSON Schema keywords such as `type`, `format`, `title` and `writeOnly`\nare accepted without being listed below. `writeOnly: true` is reserved for a\nvalue that may be written but is never returned by the read API; nothing\nenforces it today, so responses still include write-only properties.\n",
+	additionalProperties: true,
+	properties: {
+		"x-unique": {
+			"oneOf": [{
+				"type": "string",
+				"enum": [
+					"unspecified",
+					"project",
+					"team"
+				]
+			}, { "type": "null" }],
+			"description": "The level of uniqueness for this property, if applicable"
+		},
+		"x-claim": {
+			"oneOf": [{ "type": "string" }, { "type": "null" }],
+			"description": "The claim name for this property, if applicable"
+		},
+		"x-audit": {
+			"type": "boolean",
+			"default": false,
+			"description": "Whether this property's value may appear in audit event payloads. Audit\npayloads are deny-by-default: a property without this annotation\ncontributes its key but never its value.\n"
+		},
+		"properties": {
+			"type": "object",
+			"description": "A map of additional properties for the user definition, where the key is\nthe property name and the value is the property schema.\n",
+			"propertyNames": { "$ref": "property-name.json" },
+			"additionalProperties": { "$ref": "user-property.json" }
+		}
+	},
+	allOf: [{ "$ref": "https://json-schema.org/draft/2020-12/schema" }]
+};
+//#endregion
+//#region meta-schemas/user-schema.json
+var user_schema_default = {
+	$comment: "Code generated by scripts/generate-meta-schemas.ts; DO NOT EDIT.",
+	$schema: "https://json-schema.org/draft/2020-12/schema",
+	title: "UserSchema",
+	type: "object",
+	description: "The meta-schema a customer's user schema document is validated against.\nThe generated `user-schema.json` adds `allOf: [{$ref: draft-2020-12}]`,\nwhich cannot live here because code generators choke on it.\n",
+	required: [
+		"metaSchema",
+		"kind",
+		"x-auth-methods"
+	],
+	additionalProperties: true,
+	properties: {
+		"$schema": {
+			"type": "string",
+			"const": "https://json-schema.org/draft/2020-12/schema",
+			"description": "The JSON Schema version used for this schema."
+		},
+		"objectType": {
+			"type": "string",
+			"maxLength": 256,
+			"description": "The type of user this schema describes. This is a customer chosen name.\n",
+			"examples": ["human-user"]
+		},
+		"kind": {
+			"type": "string",
+			"const": "user-schema",
+			"description": "Discriminator value for a user schema create request."
+		},
+		"metaSchema": {
+			"type": "string",
+			"format": "uri",
+			"maxLength": 1024,
+			"description": "The user Schema version used for this schema."
+		},
+		"x-auth-methods": { "$ref": "auth-methods.json" },
+		"x-identifier": {
+			"type": "string",
+			"minLength": 1,
+			"description": "Path of the leaf property whose value identifies a user (nested leaves\nare addressed by their dot-joined attribute path). The property must\ncarry `x-unique` \"project\". Required when an auth method needing\nidentifier-first dispatch (password) is enabled. Passkey is exempt:\ndiscoverable credentials identify the user through the assertion\nitself, so passkey-only and API-managed schemas may designate nothing;\nflows using identifier-first passkey are validated at the flow level\ninstead.\n",
+			"examples": ["email"]
+		},
+		"x-display": {
+			"type": "array",
+			"minItems": 1,
+			"items": {
+				"type": "string",
+				"minLength": 1
+			},
+			"description": "Ordered leaf property paths whose values, joined with a space, render\nthe user's display name.\n"
+		},
+		"properties": {
+			"type": "object",
+			"description": "A map of additional properties for the user definition, where the\nkey is the property name and the value is the property schema\n",
+			"propertyNames": { "$ref": "property-name.json" },
+			"additionalProperties": { "$ref": "user-property.json" }
+		}
+	},
+	allOf: [{ "$ref": "https://json-schema.org/draft/2020-12/schema" }]
+};
+//#endregion
+//#region src/meta-schemas.ts
+/**
+* The dialect meta-schemas `zitadel setup` copies into a project's
+* `.zitadel/meta/` so the flow/schema dialect is machine-readable offline:
+* editors validate flow files against `flow-definition.json` via a relative
+* `$schema` pointer, and agents read the dialect files before authoring
+* edits — no docs crawl, no hosted schema required.
+*
+* The files under `meta-schemas/` are generated: `scripts/sync-meta-schemas.mjs`
+* copies them from `api/openapi/endpoints/schemas/*.json` (the files the
+* server embeds) ahead of build, typecheck and test. Those are generated in
+* turn from the OpenAPI YAML by `scripts/generate-meta-schemas.ts` at the repo
+* root, so the YAML is the only thing to edit.
+*/
+/** Project-relative directory setup writes the meta-schemas to. */
+const META_SCHEMA_DIR = ".zitadel/meta";
+/**
+* The `$schema` value scaffolded flow files carry, relative to
+* `.zitadel/flows/` — resolves to `{@link META_SCHEMA_DIR}/flow-definition.json`.
+*/
+const FLOW_FILE_SCHEMA_REF = "../meta/flow-definition.json";
+/**
+* The `$schema` value scaffolded branding files carry, relative to
+* `.zitadel/branding/` — resolves to `{@link META_SCHEMA_DIR}/branding.json`.
+*/
+const BRANDING_FILE_SCHEMA_REF = "../meta/branding.json";
+/**
+* The dialect files to materialize, in write order. `auth-methods.json`,
+* `auth-method.json`, and `sso-auth-method.json` are pulled in by
+* `user-schema.json`'s relative `$ref`s — without them the copied dialect
+* cannot resolve offline.
+*/
+function metaSchemaFiles() {
+	return [
+		{
+			name: "flow-definition.json",
+			body: flow_definition_default
+		},
+		{
+			name: "user-schema.json",
+			body: user_schema_default
+		},
+		{
+			name: "user-property.json",
+			body: user_property_default
+		},
+		{
+			name: "property-name.json",
+			body: property_name_default
+		},
+		{
+			name: "auth-methods.json",
+			body: auth_methods_default
+		},
+		{
+			name: "auth-method.json",
+			body: auth_method_default
+		},
+		{
+			name: "sso-auth-method.json",
+			body: sso_auth_method_default
+		},
+		{
+			name: "idp-connection.json",
+			body: idp_connection_default
+		},
+		{
+			name: "branding.json",
+			body: branding_default
+		}
+	];
+}
+//#endregion
+export { metaSchemaFiles as i, FLOW_FILE_SCHEMA_REF as n, META_SCHEMA_DIR as r, BRANDING_FILE_SCHEMA_REF as t };
+
+//# sourceMappingURL=meta-schemas-OowgSUfU.mjs.map