@zitadel/config 1.0.0-alpha.21 → 1.0.0-alpha.23

package/dist/meta-schemas-OowgSUfU.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"meta-schemas-OowgSUfU.mjs","names":["flowDefinitionMetaSchema","userSchemaMetaSchema","userPropertyMetaSchema","propertyNameMetaSchema","authMethodsMetaSchema","authMethodMetaSchema","ssoAuthMethodMetaSchema","idpConnectionMetaSchema","brandingMetaSchema"],"sources":["../meta-schemas/auth-method.json","../meta-schemas/auth-methods.json","../meta-schemas/branding.json","../meta-schemas/flow-definition.json","../meta-schemas/idp-connection.json","../meta-schemas/property-name.json","../meta-schemas/sso-auth-method.json","../meta-schemas/user-property.json","../meta-schemas/user-schema.json","../src/meta-schemas.ts"],"sourcesContent":["","","","","","","","","","/**\n * The dialect meta-schemas `zitadel setup` copies into a project's\n * `.zitadel/meta/` so the flow/schema dialect is machine-readable offline:\n * editors validate flow files against `flow-definition.json` via a relative\n * `$schema` pointer, and agents read the dialect files before authoring\n * edits — no docs crawl, no hosted schema required.\n *\n * The files under `meta-schemas/` are generated: `scripts/sync-meta-schemas.mjs`\n * copies them from `api/openapi/endpoints/schemas/*.json` (the files the\n * server embeds) ahead of build, typecheck and test. Those are generated in\n * turn from the OpenAPI YAML by `scripts/generate-meta-schemas.ts` at the repo\n * root, so the YAML is the only thing to edit.\n */\nimport authMethodMetaSchema from \"../meta-schemas/auth-method.json\" with {\n  type: \"json\",\n};\nimport authMethodsMetaSchema from \"../meta-schemas/auth-methods.json\" with {\n  type: \"json\",\n};\nimport brandingMetaSchema from \"../meta-schemas/branding.json\" with {\n  type: \"json\",\n};\nimport flowDefinitionMetaSchema from \"../meta-schemas/flow-definition.json\" with {\n  type: \"json\",\n};\nimport idpConnectionMetaSchema from \"../meta-schemas/idp-connection.json\" with {\n  type: \"json\",\n};\nimport propertyNameMetaSchema from \"../meta-schemas/property-name.json\" with {\n  type: \"json\",\n};\nimport ssoAuthMethodMetaSchema from \"../meta-schemas/sso-auth-method.json\" with {\n  type: \"json\",\n};\nimport userPropertyMetaSchema from \"../meta-schemas/user-property.json\" with {\n  type: \"json\",\n};\nimport userSchemaMetaSchema from \"../meta-schemas/user-schema.json\" with {\n  type: \"json\",\n};\n\n/** Project-relative directory setup writes the meta-schemas to. */\nexport const META_SCHEMA_DIR = \".zitadel/meta\";\n\n/**\n * The `$schema` value scaffolded flow files carry, relative to\n * `.zitadel/flows/` — resolves to `{@link META_SCHEMA_DIR}/flow-definition.json`.\n */\nexport const FLOW_FILE_SCHEMA_REF = \"../meta/flow-definition.json\";\n\n/**\n * The `$schema` value scaffolded branding files carry, relative to\n * `.zitadel/branding/` — resolves to `{@link META_SCHEMA_DIR}/branding.json`.\n */\nexport const BRANDING_FILE_SCHEMA_REF = \"../meta/branding.json\";\n\nexport type MetaSchemaFile = { name: string; body: object };\n\n/**\n * The dialect files to materialize, in write order. `auth-methods.json`,\n * `auth-method.json`, and `sso-auth-method.json` are pulled in by\n * `user-schema.json`'s relative `$ref`s — without them the copied dialect\n * cannot resolve offline.\n */\nexport function metaSchemaFiles(): ReadonlyArray<MetaSchemaFile> {\n  return [\n    { name: \"flow-definition.json\", body: flowDefinitionMetaSchema as object },\n    { name: \"user-schema.json\", body: userSchemaMetaSchema as object },\n    { name: \"user-property.json\", body: userPropertyMetaSchema as object },\n    { name: \"property-name.json\", body: propertyNameMetaSchema as object },\n    { name: \"auth-methods.json\", body: authMethodsMetaSchema as object },\n    { name: \"auth-method.json\", body: authMethodMetaSchema as object },\n    { name: \"sso-auth-method.json\", body: ssoAuthMethodMetaSchema as object },\n    { name: \"idp-connection.json\", body: idpConnectionMetaSchema as object },\n    { name: \"branding.json\", body: brandingMetaSchema as object },\n  ];\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AS0CA,MAAa,kBAAkB;;;;;AAM/B,MAAa,uBAAuB;;;;;AAMpC,MAAa,2BAA2B;;;;;;;AAUxC,SAAgB,kBAAiD;AAC/D,QAAO;EACL;GAAE,MAAM;GAAwB,MAAMA;GAAoC;EAC1E;GAAE,MAAM;GAAoB,MAAMC;GAAgC;EAClE;GAAE,MAAM;GAAsB,MAAMC;GAAkC;EACtE;GAAE,MAAM;GAAsB,MAAMC;GAAkC;EACtE;GAAE,MAAM;GAAqB,MAAMC;GAAiC;EACpE;GAAE,MAAM;GAAoB,MAAMC;GAAgC;EAClE;GAAE,MAAM;GAAwB,MAAMC;GAAmC;EACzE;GAAE,MAAM;GAAuB,MAAMC;GAAmC;EACxE;GAAE,MAAM;GAAiB,MAAMC;GAA8B;EAC9D"}

package/dist/meta-schemas.d.mts

@@ -16,9 +16,10 @@ type MetaSchemaFile = {
   body: object;
 };
 /**
- * The dialect files to materialize, in write order. `auth-methods.json` and
- * `auth-method.json` are pulled in by `user-schema.json`'s relative `$ref`s —
- * without them the copied dialect cannot resolve offline.
+ * The dialect files to materialize, in write order. `auth-methods.json`,
+ * `auth-method.json`, and `sso-auth-method.json` are pulled in by
+ * `user-schema.json`'s relative `$ref`s — without them the copied dialect
+ * cannot resolve offline.
  */
 declare function metaSchemaFiles(): ReadonlyArray<MetaSchemaFile>;
 //#endregion

package/dist/meta-schemas.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"meta-schemas.d.mts","names":[],"sources":["../src/meta-schemas.ts"],"mappings":";;cAkCa,eAAA;;;;;cAMA,oBAAA;;;;;cAMA,wBAAA;AAAA,KAED,cAAA;EAAmB,IAAA;EAAc,IAAA;AAAA;AAA7C;;;;;AAAA,iBAOgB,eAAA,CAAA,GAAmB,aAAA,CAAc,cAAA"}
+{"version":3,"file":"meta-schemas.d.mts","names":[],"sources":["../src/meta-schemas.ts"],"mappings":";;cA0Ca,eAAA;;;;;cAMA,oBAAA;;;;;cAMA,wBAAA;AAAA,KAED,cAAA;EAAmB,IAAA;EAAc,IAAA;AAAA;AAA7C;;;;;AAQA;AARA,iBAQgB,eAAA,CAAA,GAAmB,aAAA,CAAc,cAAA"}

package/dist/meta-schemas.mjs

@@ -1,2 +1,2 @@
-import { i as metaSchemaFiles, n as FLOW_FILE_SCHEMA_REF, r as META_SCHEMA_DIR, t as BRANDING_FILE_SCHEMA_REF } from "./meta-schemas-z4IlqbLd.mjs";
+import { i as metaSchemaFiles, n as FLOW_FILE_SCHEMA_REF, r as META_SCHEMA_DIR, t as BRANDING_FILE_SCHEMA_REF } from "./meta-schemas-OowgSUfU.mjs";
 export { BRANDING_FILE_SCHEMA_REF, FLOW_FILE_SCHEMA_REF, META_SCHEMA_DIR, metaSchemaFiles };

package/dist/schemas-7oNU25Qz.mjs

@@ -0,0 +1,173 @@
+import { isCanonicalLoopbackHttpUrl } from "./branding-url.mjs";
+import { CreateBrandingBody, CreateFlowDefinitionBody, CreateSchemaBody } from "@zitadel/api/generated/endpoints/zitadelNextGen.zod";
+import { z } from "zod";
+/** Asset URL cap in UTF-8 bytes, like the server's `MaxBrandingURLBytes`. */
+const MAX_BRANDING_URL_BYTES = 2048;
+const HEX_COLOR = /^#([0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/;
+/** `url` is absent by construction: it is not a colour function. */
+const COLOR_FUNCTIONS = new Set([
+	"rgb",
+	"rgba",
+	"hsl",
+	"hsla",
+	"hwb",
+	"lab",
+	"lch",
+	"oklab",
+	"oklch",
+	"color",
+	"color-mix"
+]);
+const COLOR_ARGS = /^[0-9a-zA-Z%.,+\-/ ()#]*$/;
+/**
+* A bare colour name. Which names CSS knows is the browser's business: an
+* unknown one paints nothing, and every name of this shape is inert inside a
+* declaration whatever it spells.
+*/
+const COLOR_NAME = /^[a-zA-Z]{3,24}$/;
+const FONT_IDENT = /^[A-Za-z0-9_-]+( [A-Za-z0-9_-]+)*$/;
+function isColorFunction(value) {
+	const open = value.indexOf("(");
+	if (open <= 0 || !value.endsWith(")")) return false;
+	if (!COLOR_FUNCTIONS.has(value.slice(0, open))) return false;
+	const args = value.slice(open + 1, -1);
+	if (!COLOR_ARGS.test(args)) return false;
+	let depth = 0;
+	for (const char of args) if (char === "(") {
+		depth += 1;
+		if (depth > 4) return false;
+	} else if (char === ")") {
+		depth -= 1;
+		if (depth < 0) return false;
+	}
+	return depth === 0;
+}
+/** Whether a value is hex, a CSS colour name, or a colour function. */
+function isBrandingColor(value) {
+	if (value.length > 128) return false;
+	if (value.trim() === "") return false;
+	if (HEX_COLOR.test(value)) return true;
+	return COLOR_NAME.test(value) || isColorFunction(value.toLowerCase());
+}
+/** Whether a value is a CSS font stack of identifiers and quoted names. */
+function isBrandingFontFamily(value) {
+	if (value.length > 256) return false;
+	if (value.trim() === "") return false;
+	return value.split(",").every((family) => isFontName(trimSpaces(family)));
+}
+/** Spaces around a comma are ordinary; other whitespace is not a separator. */
+function trimSpaces(value) {
+	return value.replace(/^ +/, "").replace(/ +$/, "");
+}
+function isFontName(family) {
+	if (family === "") return false;
+	const quote = family[0];
+	if (quote === "\"" || quote === "'") {
+		if (family.length < 2 || family.at(-1) !== quote) return false;
+		const inner = family.slice(1, -1);
+		return !inner.includes(quote) && !/[\\;{}]/.test(inner);
+	}
+	return FONT_IDENT.test(family);
+}
+//#endregion
+//#region src/schemas.ts
+const schemaConfigSchema = CreateSchemaBody;
+const flowConfigSchema = CreateFlowDefinitionBody.shape.flow_definition;
+const createFlowDefinitionRequestSchema = CreateFlowDefinitionBody;
+/** The wire shape of a branding revision (`POST /branding` request body). */
+const brandingWireSchema = CreateBrandingBody;
+/**
+* `{ "$file": "<path>" }`, which a `.zitadel/` file may hold in place of a
+* string field the OpenAPI YAML marks `x-local: file`. The path is relative to
+* the file holding it; the CLI inlines the content before publishing.
+*/
+const localFileReferenceSchema = z.strictObject({ $file: z.string().min(1) });
+/**
+* The local `.zitadel/branding/*.json` dialect: the wire shape, where
+* `liquid_template` may also be a `$file` reference to the sibling `.liquid`
+* template (the meta-schema `branding.json` mirrors this).
+*/
+const brandingConfigSchema = z.strictObject({
+	...CreateBrandingBody.shape,
+	logo_url: z.string().optional(),
+	hero_url: z.string().optional(),
+	$schema: z.string().optional(),
+	liquid_template: z.union([CreateBrandingBody.shape.liquid_template.unwrap(), localFileReferenceSchema]).optional()
+}).superRefine((value, ctx) => {
+	validateBrandingAssetUrl(value.typography?.font_url, "typography.font_url", ctx, { loopback: false });
+	if (value.typography?.font_url !== void 0 && value.typography.font_family === void 0) ctx.addIssue({
+		code: "custom",
+		message: "typography.font_url needs a typography.font_family to load; a stylesheet alone names no face to render in."
+	});
+	validateBrandingAssetUrl(value.logo_url, "logo_url", ctx);
+	validateBrandingAssetUrl(value.hero_url, "hero_url", ctx);
+	validateBrandingAssetUrl(value.theme?.light?.logo_url, "theme.light.logo_url", ctx);
+	validateBrandingAssetUrl(value.theme?.dark?.logo_url, "theme.dark.logo_url", ctx);
+	validateBrandingPalette(value.theme?.light?.palette, "theme.light", ctx);
+	validateBrandingPalette(value.theme?.dark?.palette, "theme.dark", ctx);
+	if (value.typography?.font_family !== void 0 && !isBrandingFontFamily(value.typography.font_family)) ctx.addIssue({
+		code: "custom",
+		message: "typography.font_family must be comma-separated font names, each an identifier (Inter, ui-sans-serif) or a quoted name (\"APK Futural\")."
+	});
+});
+function validateBrandingPalette(palette, side, ctx) {
+	if (!palette) return;
+	for (const [key, colour] of Object.entries(palette)) {
+		if (typeof colour !== "string") continue;
+		if (isBrandingColor(colour)) continue;
+		ctx.addIssue({
+			code: "custom",
+			message: `${side}.palette.${key} must be hex (#4F46E5), a CSS colour name, or a colour function such as rgb(), hsl() or oklch().`
+		});
+	}
+}
+function validateBrandingAssetUrl(value, field, ctx, options = {}) {
+	if (value === void 0 || value === "") return;
+	if (new TextEncoder().encode(value).length > 2048) {
+		ctx.addIssue({
+			code: "custom",
+			message: `${field} must be at most ${MAX_BRANDING_URL_BYTES} bytes.`
+		});
+		return;
+	}
+	if (/[\s\\]/.test(value)) {
+		ctx.addIssue({
+			code: "custom",
+			message: `${field} is not a valid URL.`
+		});
+		return;
+	}
+	if (!/^https?:\/\//i.test(value)) {
+		ctx.addIssue({
+			code: "custom",
+			message: `${field} must be an absolute https URL.`
+		});
+		return;
+	}
+	let parsed;
+	try {
+		parsed = new URL(value);
+	} catch {
+		ctx.addIssue({
+			code: "custom",
+			message: `${field} is not a valid URL.`
+		});
+		return;
+	}
+	if (parsed.username !== "" || parsed.password !== "") {
+		ctx.addIssue({
+			code: "custom",
+			message: `${field} must not carry credentials; the URL is fetched by every visitor's browser.`
+		});
+		return;
+	}
+	if (options.loopback !== false && parsed.protocol === "http:" && isCanonicalLoopbackHttpUrl(value)) return;
+	if (parsed.protocol !== "https:" || parsed.host === "") ctx.addIssue({
+		code: "custom",
+		message: `${field} must be an absolute https URL (http is allowed for canonical loopback development hosts only).`
+	});
+}
+//#endregion
+export { localFileReferenceSchema as a, flowConfigSchema as i, brandingWireSchema as n, schemaConfigSchema as o, createFlowDefinitionRequestSchema as r, brandingConfigSchema as t };
+
+//# sourceMappingURL=schemas-7oNU25Qz.mjs.map

package/dist/schemas-7oNU25Qz.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas-7oNU25Qz.mjs","names":[],"sources":["../src/branding-css.ts","../src/schemas.ts"],"sourcesContent":["/**\n * Mirror of the server's appearance-value gates\n * (`internal/domain/branding_css.go`), so `plan` rejects what `apply` would.\n *\n * The widget writes these values straight into a CSS declaration, so a value\n * able to close its own declaration can emit rules of its own. Both gates are\n * allowlists: a value is accepted only when it matches a form we recognise,\n * never merely because it avoided the characters someone thought to ban.\n */\n\nexport const MAX_BRANDING_COLOR_LENGTH = 128;\nexport const MAX_BRANDING_FONT_FAMILY_LENGTH = 256;\n/** Asset URL cap in UTF-8 bytes, like the server's `MaxBrandingURLBytes`. */\nexport const MAX_BRANDING_URL_BYTES = 2048;\n\nconst HEX_COLOR = /^#([0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/;\n\n/** `url` is absent by construction: it is not a colour function. */\nconst COLOR_FUNCTIONS = new Set([\n  \"rgb\",\n  \"rgba\",\n  \"hsl\",\n  \"hsla\",\n  \"hwb\",\n  \"lab\",\n  \"lch\",\n  \"oklab\",\n  \"oklch\",\n  \"color\",\n  \"color-mix\",\n]);\n\nconst COLOR_ARGS = /^[0-9a-zA-Z%.,+\\-/ ()#]*$/;\n/**\n * A bare colour name. Which names CSS knows is the browser's business: an\n * unknown one paints nothing, and every name of this shape is inert inside a\n * declaration whatever it spells.\n */\nconst COLOR_NAME = /^[a-zA-Z]{3,24}$/;\nconst FONT_IDENT = /^[A-Za-z0-9_-]+( [A-Za-z0-9_-]+)*$/;\n\nfunction isColorFunction(value: string): boolean {\n  const open = value.indexOf(\"(\");\n  if (open <= 0 || !value.endsWith(\")\")) return false;\n  if (!COLOR_FUNCTIONS.has(value.slice(0, open))) return false;\n\n  const args = value.slice(open + 1, -1);\n  if (!COLOR_ARGS.test(args)) return false;\n\n  // Nesting is legal (`color-mix(in srgb, rgb(1 2 3), red)`), so the\n  // parentheses only have to balance, at a bounded depth.\n  let depth = 0;\n  for (const char of args) {\n    if (char === \"(\") {\n      depth += 1;\n      if (depth > 4) return false;\n    } else if (char === \")\") {\n      depth -= 1;\n      if (depth < 0) return false;\n    }\n  }\n  return depth === 0;\n}\n\n/** Whether a value is hex, a CSS colour name, or a colour function. */\nexport function isBrandingColor(value: string): boolean {\n  if (value.length > MAX_BRANDING_COLOR_LENGTH) return false;\n  if (value.trim() === \"\") return false;\n  // Not trimmed: the value is stored and painted verbatim.\n  if (HEX_COLOR.test(value)) return true;\n  return COLOR_NAME.test(value) || isColorFunction(value.toLowerCase());\n}\n\n/** Whether a value is a CSS font stack of identifiers and quoted names. */\nexport function isBrandingFontFamily(value: string): boolean {\n  if (value.length > MAX_BRANDING_FONT_FAMILY_LENGTH) return false;\n  if (value.trim() === \"\") return false;\n  return value.split(\",\").every((family) => isFontName(trimSpaces(family)));\n}\n\n/** Spaces around a comma are ordinary; other whitespace is not a separator. */\nfunction trimSpaces(value: string): string {\n  return value.replace(/^ +/, \"\").replace(/ +$/, \"\");\n}\n\nfunction isFontName(family: string): boolean {\n  if (family === \"\") return false;\n  const quote = family[0];\n  if (quote === '\"' || quote === \"'\") {\n    // A quoted name ends at its matching quote and holds no other, so it\n    // cannot leave the string it opened.\n    if (family.length < 2 || family.at(-1) !== quote) return false;\n    const inner = family.slice(1, -1);\n    return !inner.includes(quote) && !/[\\\\;{}]/.test(inner);\n  }\n  return FONT_IDENT.test(family);\n}\n","import {\n  CreateBrandingBody,\n  CreateFlowDefinitionBody,\n  CreateSchemaBody,\n} from \"@zitadel/api/generated/endpoints/zitadelNextGen.zod\";\nimport { z } from \"zod\";\n\nimport {\n  isBrandingColor,\n  isBrandingFontFamily,\n  MAX_BRANDING_URL_BYTES,\n} from \"./branding-css.js\";\nimport { isCanonicalLoopbackHttpUrl } from \"./branding-url.js\";\n\nexport const schemaConfigSchema = CreateSchemaBody;\nexport const flowConfigSchema = CreateFlowDefinitionBody.shape.flow_definition;\nexport const createFlowDefinitionRequestSchema = CreateFlowDefinitionBody;\n\n/** The wire shape of a branding revision (`POST /branding` request body). */\nexport const brandingWireSchema = CreateBrandingBody;\n\n/**\n * `{ \"$file\": \"<path>\" }`, which a `.zitadel/` file may hold in place of a\n * string field the OpenAPI YAML marks `x-local: file`. The path is relative to\n * the file holding it; the CLI inlines the content before publishing.\n */\nexport const localFileReferenceSchema = z.strictObject({ $file: z.string().min(1) });\n\n/**\n * The local `.zitadel/branding/*.json` dialect: the wire shape, where\n * `liquid_template` may also be a `$file` reference to the sibling `.liquid`\n * template (the meta-schema `branding.json` mirrors this).\n */\nexport const brandingConfigSchema = z\n  .strictObject({\n    // Strict, unlike the generated wire schema: a typo like `hero_urll`\n    // must fail plan, not silently pass, get ignored by the server, and\n    // vanish on canonical write-back. The editor meta-schema already\n    // rejects unknown keys; the CLI gate has to agree.\n    ...CreateBrandingBody.shape,\n    // Raw strings instead of the generated uri fields: those trim and\n    // normalize before refinement runs, hiding exactly the forms the wire\n    // body still carries verbatim and Go's url.Parse rejects.\n    logo_url: z.string().optional(),\n    hero_url: z.string().optional(),\n    $schema: z.string().optional(),\n    liquid_template: z\n      .union([CreateBrandingBody.shape.liquid_template.unwrap(), localFileReferenceSchema])\n      .optional(),\n  })\n  .superRefine((value, ctx) => {\n    // A stylesheet alone names no face to render in, so the server rejects the\n    // pair as a pair (validateBrandingFontURL in\n    // internal/domain/branding_validator.go). plan has to agree, or apply\n    // fails after schemas and flows have already been written.\n    validateBrandingAssetUrl(value.typography?.font_url, \"typography.font_url\", ctx, {\n      loopback: false,\n    });\n    if (value.typography?.font_url !== undefined && value.typography.font_family === undefined) {\n      ctx.addIssue({\n        code: \"custom\",\n        message:\n          \"typography.font_url needs a typography.font_family to load; a stylesheet alone names no face to render in.\",\n      });\n    }\n    // Mirror the server's asset URL gate (validateBrandingAssetURL in\n    // internal/domain/branding_validator.go) so plan rejects what apply would.\n    // Apply mutates schemas and flows before branding, so a late 400 here would\n    // leave a half-applied run.\n    validateBrandingAssetUrl(value.logo_url, \"logo_url\", ctx);\n    validateBrandingAssetUrl(value.hero_url, \"hero_url\", ctx);\n    validateBrandingAssetUrl(value.theme?.light?.logo_url, \"theme.light.logo_url\", ctx);\n    validateBrandingAssetUrl(value.theme?.dark?.logo_url, \"theme.dark.logo_url\", ctx);\n    // The appearance values land in a CSS declaration, so the server stores\n    // only forms it recognises (ValidateBrandingColor / ValidateBrandingFontFamily\n    // in internal/domain/branding_css.go).\n    validateBrandingPalette(value.theme?.light?.palette, \"theme.light\", ctx);\n    validateBrandingPalette(value.theme?.dark?.palette, \"theme.dark\", ctx);\n    if (value.typography?.font_family !== undefined && !isBrandingFontFamily(value.typography.font_family)) {\n      ctx.addIssue({\n        code: \"custom\",\n        message:\n          'typography.font_family must be comma-separated font names, each an identifier (Inter, ui-sans-serif) or a quoted name (\"APK Futural\").',\n      });\n    }\n  });\n\nfunction validateBrandingPalette(\n  palette: Record<string, unknown> | undefined,\n  side: string,\n  ctx: z.RefinementCtx,\n): void {\n  if (!palette) {\n    return;\n  }\n  for (const [key, colour] of Object.entries(palette)) {\n    // A non-string never reaches here: the generated object schema types every\n    // palette value as a string, and Zod skips refinements once the base parse\n    // has failed. The check is what narrows `unknown` for the call below.\n    if (typeof colour !== \"string\") {\n      continue;\n    }\n    if (isBrandingColor(colour)) {\n      continue;\n    }\n    ctx.addIssue({\n      code: \"custom\",\n      message: `${side}.palette.${key} must be hex (#4F46E5), a CSS colour name, or a colour function such as rgb(), hsl() or oklch().`,\n    });\n  }\n}\n\nfunction validateBrandingAssetUrl(\n  value: string | undefined,\n  field: string,\n  ctx: z.RefinementCtx,\n  options: { loopback?: boolean } = {},\n): void {\n  if (value === undefined || value === \"\") {\n    return;\n  }\n  // The server counts bytes (validateBrandingAssetURL), so a URL with\n  // non-ASCII characters can be short in characters and still too long.\n  if (new TextEncoder().encode(value).length > MAX_BRANDING_URL_BYTES) {\n    ctx.addIssue({\n      code: \"custom\",\n      message: `${field} must be at most ${MAX_BRANDING_URL_BYTES} bytes.`,\n    });\n    return;\n  }\n  // Stricter-or-equal than the Go gate (validateBrandingAssetURL): the WHATWG\n  // parser forgives what Go's url.Parse rejects — `https:example.com`,\n  // backslashes, and whitespace all get silently normalized. plan must never\n  // accept what apply would reject (the reverse is harmless), so reject the\n  // raw forms before parsing.\n  if (/[\\s\\\\]/.test(value)) {\n    ctx.addIssue({ code: \"custom\", message: `${field} is not a valid URL.` });\n    return;\n  }\n  if (!/^https?:\\/\\//i.test(value)) {\n    ctx.addIssue({ code: \"custom\", message: `${field} must be an absolute https URL.` });\n    return;\n  }\n  let parsed: URL;\n  try {\n    parsed = new URL(value);\n  } catch {\n    ctx.addIssue({ code: \"custom\", message: `${field} is not a valid URL.` });\n    return;\n  }\n  // Fetched by every visitor's browser, so userinfo in it is a credential in\n  // every access log — the server refuses it and so must plan.\n  if (parsed.username !== \"\" || parsed.password !== \"\") {\n    ctx.addIssue({\n      code: \"custom\",\n      message: `${field} must not carry credentials; the URL is fetched by every visitor's browser.`,\n    });\n    return;\n  }\n  // Loopback HTTP is the dev-posture carve-out (assets served from the app's\n  // own dev server), and it covers images only: a stylesheet is styling rather\n  // than an image, so it stays https everywhere. Check the raw URL so WHATWG\n  // normalisation cannot make plan accept a host spelling that the Go save\n  // gate rejects.\n  if (options.loopback !== false && parsed.protocol === \"http:\" && isCanonicalLoopbackHttpUrl(value)) {\n    return;\n  }\n  if (parsed.protocol !== \"https:\" || parsed.host === \"\") {\n    ctx.addIssue({\n      code: \"custom\",\n      message: `${field} must be an absolute https URL (http is allowed for canonical loopback development hosts only).`,\n    });\n  }\n}\n"],"mappings":";;;;AAaA,MAAa,yBAAyB;AAEtC,MAAM,YAAY;;AAGlB,MAAM,kBAAkB,IAAI,IAAI;CAC9B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;AAEF,MAAM,aAAa;;;;;;AAMnB,MAAM,aAAa;AACnB,MAAM,aAAa;AAEnB,SAAS,gBAAgB,OAAwB;CAC/C,MAAM,OAAO,MAAM,QAAQ,IAAI;AAC/B,KAAI,QAAQ,KAAK,CAAC,MAAM,SAAS,IAAI,CAAE,QAAO;AAC9C,KAAI,CAAC,gBAAgB,IAAI,MAAM,MAAM,GAAG,KAAK,CAAC,CAAE,QAAO;CAEvD,MAAM,OAAO,MAAM,MAAM,OAAO,GAAG,GAAG;AACtC,KAAI,CAAC,WAAW,KAAK,KAAK,CAAE,QAAO;CAInC,IAAI,QAAQ;AACZ,MAAK,MAAM,QAAQ,KACjB,KAAI,SAAS,KAAK;AAChB,WAAS;AACT,MAAI,QAAQ,EAAG,QAAO;YACb,SAAS,KAAK;AACvB,WAAS;AACT,MAAI,QAAQ,EAAG,QAAO;;AAG1B,QAAO,UAAU;;;AAInB,SAAgB,gBAAgB,OAAwB;AACtD,KAAI,MAAM,SAAA,IAAoC,QAAO;AACrD,KAAI,MAAM,MAAM,KAAK,GAAI,QAAO;AAEhC,KAAI,UAAU,KAAK,MAAM,CAAE,QAAO;AAClC,QAAO,WAAW,KAAK,MAAM,IAAI,gBAAgB,MAAM,aAAa,CAAC;;;AAIvE,SAAgB,qBAAqB,OAAwB;AAC3D,KAAI,MAAM,SAAA,IAA0C,QAAO;AAC3D,KAAI,MAAM,MAAM,KAAK,GAAI,QAAO;AAChC,QAAO,MAAM,MAAM,IAAI,CAAC,OAAO,WAAW,WAAW,WAAW,OAAO,CAAC,CAAC;;;AAI3E,SAAS,WAAW,OAAuB;AACzC,QAAO,MAAM,QAAQ,OAAO,GAAG,CAAC,QAAQ,OAAO,GAAG;;AAGpD,SAAS,WAAW,QAAyB;AAC3C,KAAI,WAAW,GAAI,QAAO;CAC1B,MAAM,QAAQ,OAAO;AACrB,KAAI,UAAU,QAAO,UAAU,KAAK;AAGlC,MAAI,OAAO,SAAS,KAAK,OAAO,GAAG,GAAG,KAAK,MAAO,QAAO;EACzD,MAAM,QAAQ,OAAO,MAAM,GAAG,GAAG;AACjC,SAAO,CAAC,MAAM,SAAS,MAAM,IAAI,CAAC,UAAU,KAAK,MAAM;;AAEzD,QAAO,WAAW,KAAK,OAAO;;;;ACjFhC,MAAa,qBAAqB;AAClC,MAAa,mBAAmB,yBAAyB,MAAM;AAC/D,MAAa,oCAAoC;;AAGjD,MAAa,qBAAqB;;;;;;AAOlC,MAAa,2BAA2B,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;;;;;;AAOpF,MAAa,uBAAuB,EACjC,aAAa;CAKZ,GAAG,mBAAmB;CAItB,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,SAAS,EAAE,QAAQ,CAAC,UAAU;CAC9B,iBAAiB,EACd,MAAM,CAAC,mBAAmB,MAAM,gBAAgB,QAAQ,EAAE,yBAAyB,CAAC,CACpF,UAAU;CACd,CAAC,CACD,aAAa,OAAO,QAAQ;AAK3B,0BAAyB,MAAM,YAAY,UAAU,uBAAuB,KAAK,EAC/E,UAAU,OACX,CAAC;AACF,KAAI,MAAM,YAAY,aAAa,KAAA,KAAa,MAAM,WAAW,gBAAgB,KAAA,EAC/E,KAAI,SAAS;EACX,MAAM;EACN,SACE;EACH,CAAC;AAMJ,0BAAyB,MAAM,UAAU,YAAY,IAAI;AACzD,0BAAyB,MAAM,UAAU,YAAY,IAAI;AACzD,0BAAyB,MAAM,OAAO,OAAO,UAAU,wBAAwB,IAAI;AACnF,0BAAyB,MAAM,OAAO,MAAM,UAAU,uBAAuB,IAAI;AAIjF,yBAAwB,MAAM,OAAO,OAAO,SAAS,eAAe,IAAI;AACxE,yBAAwB,MAAM,OAAO,MAAM,SAAS,cAAc,IAAI;AACtE,KAAI,MAAM,YAAY,gBAAgB,KAAA,KAAa,CAAC,qBAAqB,MAAM,WAAW,YAAY,CACpG,KAAI,SAAS;EACX,MAAM;EACN,SACE;EACH,CAAC;EAEJ;AAEJ,SAAS,wBACP,SACA,MACA,KACM;AACN,KAAI,CAAC,QACH;AAEF,MAAK,MAAM,CAAC,KAAK,WAAW,OAAO,QAAQ,QAAQ,EAAE;AAInD,MAAI,OAAO,WAAW,SACpB;AAEF,MAAI,gBAAgB,OAAO,CACzB;AAEF,MAAI,SAAS;GACX,MAAM;GACN,SAAS,GAAG,KAAK,WAAW,IAAI;GACjC,CAAC;;;AAIN,SAAS,yBACP,OACA,OACA,KACA,UAAkC,EAAE,EAC9B;AACN,KAAI,UAAU,KAAA,KAAa,UAAU,GACnC;AAIF,KAAI,IAAI,aAAa,CAAC,OAAO,MAAM,CAAC,SAAA,MAAiC;AACnE,MAAI,SAAS;GACX,MAAM;GACN,SAAS,GAAG,MAAM,mBAAmB,uBAAuB;GAC7D,CAAC;AACF;;AAOF,KAAI,SAAS,KAAK,MAAM,EAAE;AACxB,MAAI,SAAS;GAAE,MAAM;GAAU,SAAS,GAAG,MAAM;GAAuB,CAAC;AACzE;;AAEF,KAAI,CAAC,gBAAgB,KAAK,MAAM,EAAE;AAChC,MAAI,SAAS;GAAE,MAAM;GAAU,SAAS,GAAG,MAAM;GAAkC,CAAC;AACpF;;CAEF,IAAI;AACJ,KAAI;AACF,WAAS,IAAI,IAAI,MAAM;SACjB;AACN,MAAI,SAAS;GAAE,MAAM;GAAU,SAAS,GAAG,MAAM;GAAuB,CAAC;AACzE;;AAIF,KAAI,OAAO,aAAa,MAAM,OAAO,aAAa,IAAI;AACpD,MAAI,SAAS;GACX,MAAM;GACN,SAAS,GAAG,MAAM;GACnB,CAAC;AACF;;AAOF,KAAI,QAAQ,aAAa,SAAS,OAAO,aAAa,WAAW,2BAA2B,MAAM,CAChG;AAEF,KAAI,OAAO,aAAa,YAAY,OAAO,SAAS,GAClD,KAAI,SAAS;EACX,MAAM;EACN,SAAS,GAAG,MAAM;EACnB,CAAC"}

package/dist/schemas.d.mts

@@ -7,14 +7,21 @@ declare const createFlowDefinitionRequestSchema: any;
 /** The wire shape of a branding revision (`POST /branding` request body). */
 declare const brandingWireSchema: any;
 /**
- * The local `.zitadel/branding/*.json` dialect: the wire shape plus
- * `liquid_template_file`, a descriptor-relative path the CLI inlines into
- * `liquid_template` when publishing. Exactly one of the two template carriers
- * may be present (the meta-schema `branding.json` mirrors this).
+ * `{ "$file": "<path>" }`, which a `.zitadel/` file may hold in place of a
+ * string field the OpenAPI YAML marks `x-local: file`. The path is relative to
+ * the file holding it; the CLI inlines the content before publishing.
+ */
+declare const localFileReferenceSchema: z.ZodObject<{
+  $file: z.ZodString;
+}, z.core.$strict>;
+/**
+ * The local `.zitadel/branding/*.json` dialect: the wire shape, where
+ * `liquid_template` may also be a `$file` reference to the sibling `.liquid`
+ * template (the meta-schema `branding.json` mirrors this).
  */
 declare const brandingConfigSchema: z.ZodObject<{
   [x: string]: any;
 }, z.core.$strict>;
 //#endregion
-export { brandingConfigSchema, brandingWireSchema, createFlowDefinitionRequestSchema, flowConfigSchema, schemaConfigSchema };
+export { brandingConfigSchema, brandingWireSchema, createFlowDefinitionRequestSchema, flowConfigSchema, localFileReferenceSchema, schemaConfigSchema };
 //# sourceMappingURL=schemas.d.mts.map

package/dist/schemas.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.d.mts","names":[],"sources":["../src/schemas.ts"],"mappings":";;;cASa,kBAAA;AAAA,cACA,gBAAA;AAAA,cACA,iCAAA;;cAGA,kBAAA;;;AAJb;;;;cAYa,oBAAA,EAAoB,CAAA,CAAA,SAAA;EAAA;GAuC7B,CAAA,CAAA,IAAA,CAAA,OAAA"}
+{"version":3,"file":"schemas.d.mts","names":[],"sources":["../src/schemas.ts"],"mappings":";;;cAca,kBAAA;AAAA,cACA,gBAAA;AAAA,cACA,iCAAA;;cAGA,kBAAA;;;AAJb;;;cAWa,wBAAA,EAAwB,CAAA,CAAA,SAAA;;;;;;;AAPrC;cAca,oBAAA,EAAoB,CAAA,CAAA,SAAA;EAAA;GAoD7B,CAAA,CAAA,IAAA,CAAA,OAAA"}

package/dist/schemas.mjs

@@ -1,69 +1,3 @@
-import { isCanonicalLoopbackHttpUrl } from "./branding-url.mjs";
-import { CreateBrandingBody, CreateFlowDefinitionBody, CreateSchemaBody } from "@zitadel/api/generated/endpoints/zitadelNextGen.zod";
-import { z } from "zod";
-//#region src/schemas.ts
-const schemaConfigSchema = CreateSchemaBody;
-const flowConfigSchema = CreateFlowDefinitionBody.shape.flow_definition;
-const createFlowDefinitionRequestSchema = CreateFlowDefinitionBody;
-/** The wire shape of a branding revision (`POST /branding` request body). */
-const brandingWireSchema = CreateBrandingBody;
-/**
-* The local `.zitadel/branding/*.json` dialect: the wire shape plus
-* `liquid_template_file`, a descriptor-relative path the CLI inlines into
-* `liquid_template` when publishing. Exactly one of the two template carriers
-* may be present (the meta-schema `branding.json` mirrors this).
-*/
-const brandingConfigSchema = z.strictObject({
-	...CreateBrandingBody.shape,
-	logo_url: z.string().optional(),
-	hero_url: z.string().optional(),
-	$schema: z.string().optional(),
-	liquid_template_file: z.string().min(1).optional()
-}).superRefine((value, ctx) => {
-	if (value.liquid_template !== void 0 && value.liquid_template_file !== void 0) ctx.addIssue({
-		code: "custom",
-		message: "Use either liquid_template_file or an inline liquid_template, not both."
-	});
-	if (value.font_url !== void 0) ctx.addIssue({
-		code: "custom",
-		message: "font_url is not writable yet (tenant font delivery needs a safe design, see ADR 040); load fonts from the embedding page instead."
-	});
-	validateBrandingAssetUrl(value.logo_url, "logo_url", ctx);
-	validateBrandingAssetUrl(value.hero_url, "hero_url", ctx);
-});
-function validateBrandingAssetUrl(value, field, ctx) {
-	if (value === void 0 || value === "") return;
-	if (/[\s\\]/.test(value)) {
-		ctx.addIssue({
-			code: "custom",
-			message: `${field} is not a valid URL.`
-		});
-		return;
-	}
-	if (!/^https?:\/\//i.test(value)) {
-		ctx.addIssue({
-			code: "custom",
-			message: `${field} must be an absolute https URL.`
-		});
-		return;
-	}
-	let parsed;
-	try {
-		parsed = new URL(value);
-	} catch {
-		ctx.addIssue({
-			code: "custom",
-			message: `${field} is not a valid URL.`
-		});
-		return;
-	}
-	if (parsed.protocol === "http:" && isCanonicalLoopbackHttpUrl(value)) return;
-	if (parsed.protocol !== "https:" || parsed.host === "") ctx.addIssue({
-		code: "custom",
-		message: `${field} must be an absolute https URL (http is allowed for canonical loopback development hosts only).`
-	});
-}
-//#endregion
-export { brandingConfigSchema, brandingWireSchema, createFlowDefinitionRequestSchema, flowConfigSchema, schemaConfigSchema };
-
-//# sourceMappingURL=schemas.mjs.map
+import "./branding-url.mjs";
+import { a as localFileReferenceSchema, i as flowConfigSchema, n as brandingWireSchema, o as schemaConfigSchema, r as createFlowDefinitionRequestSchema, t as brandingConfigSchema } from "./schemas-7oNU25Qz.mjs";
+export { brandingConfigSchema, brandingWireSchema, createFlowDefinitionRequestSchema, flowConfigSchema, localFileReferenceSchema, schemaConfigSchema };

package/dist/validate.d.mts

@@ -76,10 +76,16 @@ declare const FLOW_VALIDATION_RULES: {
 };
 type FlowValidationRuleId = keyof typeof FLOW_VALIDATION_RULES;
 /** Mirrors `reservedOutcomes` in flow_definition_validator.go. */
-declare const RESERVED_OUTCOMES: readonly ["user_not_found", "user_already_exists", "callback"];
+declare const RESERVED_OUTCOMES: readonly ["user_not_found", "user_already_exists", "identity_unknown", "callback"];
 /** Mirrors the `FlowDefinitionPurpose` enum (snake transform) in flow_definition.go. */
 declare const FLOW_PURPOSES: readonly ["login", "register", "recovery", "profiling", "reauth", "link_account"];
-/** Mirrors `purposeFlipTargets` in flow_definition_validator.go. */
+/**
+ * Mirrors `purposeFlipTargets` in flow_definition_validator.go: the
+ * identifier outcomes only. `identity_unknown` comes only from SSO
+ * resolution and is left out here; requiring it on every combined entry
+ * step would reject the shipped default flow. A rule on steps carrying
+ * sso_providers is future work (#1044).
+ */
 declare const PURPOSE_FLIP_TARGETS: Readonly<Record<string, Readonly<Record<string, string>>>>;
 /**
  * Validate a flow-definition config body (the `.zitadel/flows/*.json`

package/dist/validate.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.mts","names":[],"sources":["../src/validate.ts"],"mappings":";;AA8BA;;;;;AAEA;;;;;;;;;;;;AAcA;;;;;;;;;;;KAhBY,sBAAA;AAAA,KAEA,mBAAA;EACV,QAAA,EAAU,sBAAA;EAEV,IAAA,EAAM,oBAAA;EAEN,OAAA;EAEA,IAAA;AAAA;;;;;cAOW,qBAAA;EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAcD,oBAAA,gBAAoC,qBAAA;;cAGnC,iBAAA;;cAGA,aAAA;;cAUA,oBAAA,EAAsB,QAAA,CAAS,MAAA,SAAe,QAAA,CAAS,MAAA;;;;;;;;iBAoCpD,sBAAA,CAAuB,IAAA,UAAc,MAAA,YAAkB,mBAAA"}
+{"version":3,"file":"validate.d.mts","names":[],"sources":["../src/validate.ts"],"mappings":";;AA8BA;;;;;AAEA;;;;;;;;;;;;AAcA;;;;;;;;;;;KAhBY,sBAAA;AAAA,KAEA,mBAAA;EACV,QAAA,EAAU,sBAAA;EAEV,IAAA,EAAM,oBAAA;EAEN,OAAA;EAEA,IAAA;AAAA;;;;;cAOW,qBAAA;EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAcD,oBAAA,gBAAoC,qBAAA;;cAGnC,iBAAA;;cAQA,aAAA;;;;;;;;cAgBA,oBAAA,EAAsB,QAAA,CAAS,MAAA,SAAe,QAAA,CAAS,MAAA;;;;;;;;iBAoCpD,sBAAA,CAAuB,IAAA,UAAc,MAAA,YAAkB,mBAAA"}

package/dist/validate.mjs

@@ -20,6 +20,7 @@ const FLOW_VALIDATION_RULES = {
 const RESERVED_OUTCOMES = [
 	"user_not_found",
 	"user_already_exists",
+	"identity_unknown",
 	"callback"
 ];
 /** Mirrors the `FlowDefinitionPurpose` enum (snake transform) in flow_definition.go. */
@@ -31,7 +32,13 @@ const FLOW_PURPOSES = [
 	"reauth",
 	"link_account"
 ];
-/** Mirrors `purposeFlipTargets` in flow_definition_validator.go. */
+/**
+* Mirrors `purposeFlipTargets` in flow_definition_validator.go: the
+* identifier outcomes only. `identity_unknown` comes only from SSO
+* resolution and is left out here; requiring it on every combined entry
+* step would reject the shipped default flow. A rule on steps carrying
+* sso_providers is future work (#1044).
+*/
 const PURPOSE_FLIP_TARGETS = {
 	login: { user_not_found: "register" },
 	register: { user_already_exists: "login" }
@@ -188,7 +195,7 @@ function validateStep(step) {
 	if (step.fields.length === 0 && step.actions.length === 0 && step.ssoProviderCount === 0 && step.gateCount === 0 && !hasCallback) issues.push(error("steps", `step ${q(name)} is non-terminal but has no fields, actions, sso_providers, gates, or transitions.callback`, name));
 	if (step.ssoProviderCount > 0 && !hasCallback) issues.push(error("steps", `step ${q(name)}: has sso_providers but is missing transitions.callback`, name));
 	for (const actionName of actionNames) if (!step.transitions.has(actionName)) issues.push(error("steps", `step ${q(name)}: action ${q(actionName)} has no matching transition`, name));
-	for (const transitionKey of step.transitions.keys()) if (!actionNames.has(transitionKey) && !RESERVED_OUTCOMES.includes(transitionKey)) issues.push(error("steps", `step ${q(name)}: transition key ${q(transitionKey)} is not an action name or reserved outcome (user_not_found, user_already_exists, callback)`, name));
+	for (const transitionKey of step.transitions.keys()) if (!actionNames.has(transitionKey) && !RESERVED_OUTCOMES.includes(transitionKey)) issues.push(error("steps", `step ${q(name)}: transition key ${q(transitionKey)} is not an action name or reserved outcome (user_not_found, user_already_exists, identity_unknown, callback)`, name));
 	return issues;
 }
 /** A transition with no cross-flow action targets a step in this flow. */