@zitadel/config 1.0.0-alpha.21 → 1.0.0-alpha.23

package/dist/defaults-DPq0o3iU.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"defaults-DPq0o3iU.mjs","names":["defaultHumanUserSchemaTemplate","defaultLoginFlowTemplate","passkeyFirstHumanUserSchemaTemplate","passkeyFirstLoginFlowTemplate"],"sources":["../defaults/default-human-user.json","../defaults/default-login.json","../defaults/presets/passkey-first/human-user.json","../defaults/presets/passkey-first/login.json","../src/readmes.ts","../src/defaults.ts"],"sourcesContent":["","","","","import { readFileSync } from \"node:fs\";\nimport { fileURLToPath } from \"node:url\";\n\n/**\n * README content the CLI copies to `.zitadel/schemas/README.md` during setup.\n * Source of truth is `packages/config/defaults/README-schemas.md`; the Go\n * server-side embed reads the same file (see `defaults.go`).\n */\nexport function schemasReadmeContent(): string {\n  return readFileSync(readmeUrl(\"README-schemas.md\"), \"utf8\");\n}\n\n/**\n * README content the CLI copies to `.zitadel/flows/README.md` during setup.\n * Source of truth is `packages/config/defaults/README-flows.md`.\n */\nexport function flowsReadmeContent(): string {\n  return readFileSync(readmeUrl(\"README-flows.md\"), \"utf8\");\n}\n\n/**\n * README content the CLI copies to `.zitadel/branding/README.md` when a\n * branding design is ejected. Source of truth is\n * `packages/config/defaults/README-branding.md`.\n */\nexport function brandingReadmeContent(): string {\n  return readFileSync(readmeUrl(\"README-branding.md\"), \"utf8\");\n}\n\nfunction readmeUrl(filename: string): string {\n  return fileURLToPath(new URL(`../defaults/${filename}`, import.meta.url));\n}\n","import { readFileSync } from \"node:fs\";\nimport { fileURLToPath } from \"node:url\";\n\nimport type {\n  CreateFlowDefinitionBodyFlowDefinition,\n  CreateSchemaBody,\n} from \"@zitadel/api/generated/model\";\n\nimport defaultHumanUserSchemaTemplate from \"../defaults/default-human-user.json\" with {\n  type: \"json\",\n};\nimport defaultLoginFlowTemplate from \"../defaults/default-login.json\" with {\n  type: \"json\",\n};\nimport passkeyFirstHumanUserSchemaTemplate from \"../defaults/presets/passkey-first/human-user.json\" with {\n  type: \"json\",\n};\nimport passkeyFirstLoginFlowTemplate from \"../defaults/presets/passkey-first/login.json\" with {\n  type: \"json\",\n};\n\nexport { brandingReadmeContent, flowsReadmeContent, schemasReadmeContent } from \"./readmes.js\";\n\nexport const DEFAULT_BUILTIN_SCHEMA_BASE = \"https://nextgen.com/api/schemas\";\nexport const DEFAULT_FLOW_SCHEMA_URI = \"https://nextgen.com/flow-definition.json\";\nexport const DEFAULT_SCHEMA_CONFIG_PATH = \".zitadel/schemas/default-human-user.json\";\nexport const DEFAULT_FLOW_CONFIG_PATH = \".zitadel/flows/default-login.json\";\nexport const DEFAULT_BRANDING_CONFIG_PATH = \".zitadel/branding/branding.json\";\nexport const DEFAULT_BRANDING_TEMPLATE_PATH = \".zitadel/branding/login.liquid\";\n\n/**\n * Named schema+flow bundles `zitadel setup` can scaffold (#448: the prompt\n * fires before any `.zitadel/` file is written; each preset maps to a\n * pre-defined bundle the CLI copies on first setup). `password-first` is\n * today's default; `passkey-first` puts a passkey ceremony on the login\n * entry step with an email→password fallback path.\n */\nexport const SETUP_PRESETS = [\"password-first\", \"passkey-first\"] as const;\n\nexport type SetupPreset = (typeof SETUP_PRESETS)[number];\n\nexport const DEFAULT_SETUP_PRESET: SetupPreset = \"password-first\";\n\nconst PRESET_TEMPLATES: Record<SetupPreset, { schema: unknown; flow: unknown }> = {\n  \"password-first\": {\n    schema: defaultHumanUserSchemaTemplate,\n    flow: defaultLoginFlowTemplate,\n  },\n  \"passkey-first\": {\n    schema: passkeyFirstHumanUserSchemaTemplate,\n    flow: passkeyFirstLoginFlowTemplate,\n  },\n};\n\nfunction presetTemplates(preset: string): { schema: unknown; flow: unknown } {\n  // Own-property check: indexing a plain object with an arbitrary string\n  // would let \"__proto__\"/\"constructor\" resolve via the prototype chain\n  // and bypass the unknown-preset error.\n  if (!Object.hasOwn(PRESET_TEMPLATES, preset)) {\n    throw new Error(\n      `unknown setup preset ${JSON.stringify(preset)} (known presets: ${SETUP_PRESETS.join(\", \")})`,\n    );\n  }\n  return PRESET_TEMPLATES[preset as SetupPreset];\n}\n\n/**\n * Login-design starting points `zitadel branding eject --design <name>` (and\n * `zitadel setup --design <name>`) scaffold into `.zitadel/branding/`. A\n * design is a full Liquid template plus the descriptor `layout` it degrades\n * to — the wire `layout` enum stays `centered | split`, richer designs are\n * delivered as templates (ADR 040).\n */\nexport const BRANDING_DESIGNS = [\"centered\", \"split\", \"split-right\", \"hero\", \"minimal\"] as const;\n\nexport type BrandingDesign = (typeof BRANDING_DESIGNS)[number];\n\nexport const DEFAULT_BRANDING_DESIGN: BrandingDesign = \"centered\";\n\n/** Descriptor `layout` each design degrades to when its template is rejected. */\nconst DESIGN_LAYOUTS: Record<BrandingDesign, \"centered\" | \"split\"> = {\n  centered: \"centered\",\n  split: \"split\",\n  \"split-right\": \"split\",\n  hero: \"split\",\n  minimal: \"centered\",\n};\n\nexport type DefaultBrandingConfig = {\n  /** The `.zitadel/branding/branding.json` descriptor body (sans `$schema`). */\n  branding: {\n    layout: \"centered\" | \"split\";\n    liquid_template_file: string;\n  };\n  /** The `.zitadel/branding/login.liquid` template content. */\n  template: string;\n};\n\n/**\n * Renders the scaffold files for a branding design. The `centered` template\n * is a drift-tested copy of the bundled default in `@zitadel/components`;\n * the other designs are authored variants of it.\n */\nexport function getDefaultBrandingConfig(\n  design: string = DEFAULT_BRANDING_DESIGN,\n): DefaultBrandingConfig {\n  if (!Object.hasOwn(DESIGN_LAYOUTS, design)) {\n    throw new Error(\n      `unknown branding design ${JSON.stringify(design)} (known designs: ${BRANDING_DESIGNS.join(\", \")})`,\n    );\n  }\n  const known = design as BrandingDesign;\n  return {\n    branding: {\n      layout: DESIGN_LAYOUTS[known],\n      liquid_template_file: \"./login.liquid\",\n    },\n    template: readFileSync(packageFilePath(`../defaults/branding/${known}/login.liquid`), \"utf8\"),\n  };\n}\n\n/**\n * Resolves a package-relative file to a real filesystem path. Vite-driven\n * runtimes (vitest in dependent packages) rewrite `import.meta.url` to a\n * `/@fs/...` URL, which `fileURLToPath` passes through verbatim — strip the\n * prefix so `readFileSync` gets an actual path.\n */\nfunction packageFilePath(relative: string): string {\n  const path = fileURLToPath(new URL(relative, import.meta.url));\n  return path.startsWith(\"/@fs/\") ? path.slice(\"/@fs\".length) : path;\n}\n\n/**\n * The second setup axis (#448): *who* signs in, orthogonal to the sign-in\n * preset (*how* they sign in). The sign-in preset owns the flow shape and\n * auth methods; the use case owns which profile fields the schema collects.\n * Composing the two keeps us at one field catalog + one flow-per-preset\n * instead of a bundle per (use case × preset) pair. `minimal` is the\n * default and never blocks non-interactive runs.\n */\nexport const SETUP_USE_CASES = [\"minimal\", \"consumer\", \"business\"] as const;\n\nexport type SetupUseCase = (typeof SETUP_USE_CASES)[number];\n\nexport const DEFAULT_SETUP_USE_CASE: SetupUseCase = \"minimal\";\n\n/**\n * Fields each use case collects, in register/display order. `email` is\n * always first and stays the only required property; the rest are optional\n * profile attributes gathered on the flow's register step. `givenName`/\n * `familyName` are the attributes the backend reads for a user's identity\n * (`internal/domain/user.go`); `companyName` is stored as a plain user\n * attribute today — there is no org/team model behind it yet.\n */\nconst USE_CASE_FIELDS: Record<SetupUseCase, readonly string[]> = {\n  minimal: [\"email\"],\n  consumer: [\"email\", \"givenName\", \"familyName\"],\n  business: [\"email\", \"givenName\", \"familyName\", \"companyName\"],\n};\n\n/**\n * JSON-Schema bodies for the optional profile fields the CLI composes in per\n * use case. The shipped templates are an email-only baseline (shared verbatim\n * with the Go server fallback), so this catalog owns every field beyond\n * `email`. Authored in the templates' style — no `x-claim`, since the backend\n * maps identity by attribute name and the user-property meta-schema defines no\n * claim keyword. `givenName`/`familyName` are the attributes the backend reads\n * for a user's identity (`internal/domain/user.go`).\n */\nconst EXTRA_FIELD_BODIES: Record<string, Record<string, unknown>> = {\n  givenName: {\n    type: \"string\",\n    maxLength: 50,\n    description: \"The user's given (first) name.\",\n  },\n  familyName: {\n    type: \"string\",\n    maxLength: 50,\n    description: \"The user's family (last) name.\",\n  },\n  companyName: {\n    type: \"string\",\n    maxLength: 200,\n    description: \"The user's company name.\",\n  },\n};\n\nfunction useCaseFields(useCase: string): readonly string[] {\n  // Own-property check, same rationale as presetTemplates: keep prototype\n  // keys (\"__proto__\" etc.) from resolving to a real field list.\n  if (!Object.hasOwn(USE_CASE_FIELDS, useCase)) {\n    throw new Error(\n      `unknown setup use case ${JSON.stringify(useCase)} (known use cases: ${SETUP_USE_CASES.join(\", \")})`,\n    );\n  }\n  return USE_CASE_FIELDS[useCase as SetupUseCase];\n}\n\n/**\n * The body for one use-case field: reuse the template's authored body when it\n * has one (so composed schemas match the shipped defaults for shared fields),\n * else the extra catalog, else a generic editable string so composition stays\n * total for any field a future use case introduces.\n */\nfunction fieldBody(\n  field: string,\n  templateProps: Record<string, Record<string, unknown>>,\n): Record<string, unknown> {\n  if (Object.hasOwn(templateProps, field)) {\n    return { ...templateProps[field] };\n  }\n  if (Object.hasOwn(EXTRA_FIELD_BODIES, field)) {\n    return { ...EXTRA_FIELD_BODIES[field] };\n  }\n  return { type: \"string\", description: `The user's ${field}.` };\n}\n\n/**\n * Narrow a rendered schema to the chosen use case: keep the preset-owned\n * header and `x-auth-methods`, but replace `properties`/`required` with the\n * use case's field set. `email` is the sole required property.\n */\nfunction applyUseCaseToSchema(\n  schema: Record<string, unknown>,\n  useCase: string,\n): Record<string, unknown> {\n  const templateProps = (schema.properties ?? {}) as Record<string, Record<string, unknown>>;\n  const properties: Record<string, unknown> = {};\n  for (const field of useCaseFields(useCase)) {\n    properties[field] = fieldBody(field, templateProps);\n  }\n  return { ...schema, required: [\"email\"], properties };\n}\n\n/**\n * Derive the flow's register-step fields from the use case rather than\n * copying a hard-coded list into every bundle (#448): the register step\n * collects exactly what the schema defines. Other steps are untouched.\n */\nfunction applyUseCaseToFlow(\n  flow: Record<string, unknown>,\n  useCase: string,\n): Record<string, unknown> {\n  const fields = [...useCaseFields(useCase)];\n  const steps = (flow.steps as Array<Record<string, unknown>>).map((step) =>\n    step.name === \"register\" ? { ...step, fields } : step,\n  );\n  return { ...flow, steps };\n}\n\nexport type DefaultConfigRenderOptions = {\n  builtinSchemaBase?: string;\n  userSchemaUrl?: string;\n  /** Which flow/auth bundle to render; defaults to {@link DEFAULT_SETUP_PRESET}. */\n  preset?: string;\n  /** Which field set to collect; defaults to {@link DEFAULT_SETUP_USE_CASE}. */\n  useCase?: string;\n};\n\nexport function defaultHumanUserSchemaUrl(\n  builtinSchemaBase = DEFAULT_BUILTIN_SCHEMA_BASE,\n): string {\n  return `${trimTrailingSlash(builtinSchemaBase)}/default-human-user.json`;\n}\n\nexport function getDefaultHumanUserSchema(\n  options: DefaultConfigRenderOptions = {},\n): CreateSchemaBody {\n  const builtinSchemaBase = trimTrailingSlash(\n    options.builtinSchemaBase ?? DEFAULT_BUILTIN_SCHEMA_BASE,\n  );\n  const rendered = renderTemplate(presetTemplates(options.preset ?? DEFAULT_SETUP_PRESET).schema, {\n    SERVER_URL: builtinSchemaBase,\n    USER_SCHEMA_URL: options.userSchemaUrl ?? defaultHumanUserSchemaUrl(builtinSchemaBase),\n  }) as Record<string, unknown>;\n  return applyUseCaseToSchema(\n    rendered,\n    options.useCase ?? DEFAULT_SETUP_USE_CASE,\n  ) as CreateSchemaBody;\n}\n\nexport function getDefaultLoginFlow(\n  options: DefaultConfigRenderOptions = {},\n): CreateFlowDefinitionBodyFlowDefinition {\n  const builtinSchemaBase = trimTrailingSlash(\n    options.builtinSchemaBase ?? DEFAULT_BUILTIN_SCHEMA_BASE,\n  );\n  const rendered = renderTemplate(presetTemplates(options.preset ?? DEFAULT_SETUP_PRESET).flow, {\n    SERVER_URL: builtinSchemaBase,\n    USER_SCHEMA_URL: options.userSchemaUrl ?? defaultHumanUserSchemaUrl(builtinSchemaBase),\n  }) as Record<string, unknown>;\n  return applyUseCaseToFlow(\n    rendered,\n    options.useCase ?? DEFAULT_SETUP_USE_CASE,\n  ) as CreateFlowDefinitionBodyFlowDefinition;\n}\n\nfunction renderTemplate(value: unknown, replacements: Record<string, string>): unknown {\n  if (Array.isArray(value)) {\n    return value.map((item) => renderTemplate(item, replacements));\n  }\n  if (value !== null && typeof value === \"object\") {\n    return Object.fromEntries(\n      Object.entries(value).map(([key, item]) => [key, renderTemplate(item, replacements)]),\n    );\n  }\n  if (typeof value === \"string\") {\n    return value.replaceAll(/\\$\\{([A-Z_]+)\\}/g, (match, name: string) => {\n      return replacements[name] ?? match;\n    });\n  }\n  return value;\n}\n\nfunction trimTrailingSlash(value: string): string {\n  let trimmed = value;\n  while (trimmed.endsWith(\"/\")) {\n    trimmed = trimmed.slice(0, -1);\n  }\n  return trimmed;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AIQA,SAAgB,uBAA+B;AAC7C,QAAO,aAAa,UAAU,oBAAoB,EAAE,OAAO;;;;;;AAO7D,SAAgB,qBAA6B;AAC3C,QAAO,aAAa,UAAU,kBAAkB,EAAE,OAAO;;;;;;;AAQ3D,SAAgB,wBAAgC;AAC9C,QAAO,aAAa,UAAU,qBAAqB,EAAE,OAAO;;AAG9D,SAAS,UAAU,UAA0B;AAC3C,QAAO,cAAc,IAAI,IAAI,eAAe,YAAY,OAAO,KAAK,IAAI,CAAC;;;;ACP3E,MAAa,8BAA8B;AAC3C,MAAa,0BAA0B;AACvC,MAAa,6BAA6B;AAC1C,MAAa,2BAA2B;AACxC,MAAa,+BAA+B;AAC5C,MAAa,iCAAiC;;;;;;;;AAS9C,MAAa,gBAAgB,CAAC,kBAAkB,gBAAgB;AAIhE,MAAa,uBAAoC;AAEjD,MAAM,mBAA4E;CAChF,kBAAkB;EAChB,QAAQA;EACR,MAAMC;EACP;CACD,iBAAiB;EACf,QAAQC;EACR,MAAMC;EACP;CACF;AAED,SAAS,gBAAgB,QAAoD;AAI3E,KAAI,CAAC,OAAO,OAAO,kBAAkB,OAAO,CAC1C,OAAM,IAAI,MACR,wBAAwB,KAAK,UAAU,OAAO,CAAC,mBAAmB,cAAc,KAAK,KAAK,CAAC,GAC5F;AAEH,QAAO,iBAAiB;;;;;;;;;AAU1B,MAAa,mBAAmB;CAAC;CAAY;CAAS;CAAe;CAAQ;CAAU;AAIvF,MAAa,0BAA0C;;AAGvD,MAAM,iBAA+D;CACnE,UAAU;CACV,OAAO;CACP,eAAe;CACf,MAAM;CACN,SAAS;CACV;;;;;;AAiBD,SAAgB,yBACd,SAAiB,yBACM;AACvB,KAAI,CAAC,OAAO,OAAO,gBAAgB,OAAO,CACxC,OAAM,IAAI,MACR,2BAA2B,KAAK,UAAU,OAAO,CAAC,mBAAmB,iBAAiB,KAAK,KAAK,CAAC,GAClG;CAEH,MAAM,QAAQ;AACd,QAAO;EACL,UAAU;GACR,QAAQ,eAAe;GACvB,sBAAsB;GACvB;EACD,UAAU,aAAa,gBAAgB,wBAAwB,MAAM,eAAe,EAAE,OAAO;EAC9F;;;;;;;;AASH,SAAS,gBAAgB,UAA0B;CACjD,MAAM,OAAO,cAAc,IAAI,IAAI,UAAU,OAAO,KAAK,IAAI,CAAC;AAC9D,QAAO,KAAK,WAAW,QAAQ,GAAG,KAAK,MAAM,EAAc,GAAG;;;;;;;;;;AAWhE,MAAa,kBAAkB;CAAC;CAAW;CAAY;CAAW;AAIlE,MAAa,yBAAuC;;;;;;;;;AAUpD,MAAM,kBAA2D;CAC/D,SAAS,CAAC,QAAQ;CAClB,UAAU;EAAC;EAAS;EAAa;EAAa;CAC9C,UAAU;EAAC;EAAS;EAAa;EAAc;EAAc;CAC9D;;;;;;;;;;AAWD,MAAM,qBAA8D;CAClE,WAAW;EACT,MAAM;EACN,WAAW;EACX,aAAa;EACd;CACD,YAAY;EACV,MAAM;EACN,WAAW;EACX,aAAa;EACd;CACD,aAAa;EACX,MAAM;EACN,WAAW;EACX,aAAa;EACd;CACF;AAED,SAAS,cAAc,SAAoC;AAGzD,KAAI,CAAC,OAAO,OAAO,iBAAiB,QAAQ,CAC1C,OAAM,IAAI,MACR,0BAA0B,KAAK,UAAU,QAAQ,CAAC,qBAAqB,gBAAgB,KAAK,KAAK,CAAC,GACnG;AAEH,QAAO,gBAAgB;;;;;;;;AASzB,SAAS,UACP,OACA,eACyB;AACzB,KAAI,OAAO,OAAO,eAAe,MAAM,CACrC,QAAO,EAAE,GAAG,cAAc,QAAQ;AAEpC,KAAI,OAAO,OAAO,oBAAoB,MAAM,CAC1C,QAAO,EAAE,GAAG,mBAAmB,QAAQ;AAEzC,QAAO;EAAE,MAAM;EAAU,aAAa,cAAc,MAAM;EAAI;;;;;;;AAQhE,SAAS,qBACP,QACA,SACyB;CACzB,MAAM,gBAAiB,OAAO,cAAc,EAAE;CAC9C,MAAM,aAAsC,EAAE;AAC9C,MAAK,MAAM,SAAS,cAAc,QAAQ,CACxC,YAAW,SAAS,UAAU,OAAO,cAAc;AAErD,QAAO;EAAE,GAAG;EAAQ,UAAU,CAAC,QAAQ;EAAE;EAAY;;;;;;;AAQvD,SAAS,mBACP,MACA,SACyB;CACzB,MAAM,SAAS,CAAC,GAAG,cAAc,QAAQ,CAAC;CAC1C,MAAM,QAAS,KAAK,MAAyC,KAAK,SAChE,KAAK,SAAS,aAAa;EAAE,GAAG;EAAM;EAAQ,GAAG,KAClD;AACD,QAAO;EAAE,GAAG;EAAM;EAAO;;AAY3B,SAAgB,0BACd,oBAAoB,6BACZ;AACR,QAAO,GAAG,kBAAkB,kBAAkB,CAAC;;AAGjD,SAAgB,0BACd,UAAsC,EAAE,EACtB;CAClB,MAAM,oBAAoB,kBACxB,QAAQ,qBAAA,kCACT;AAKD,QAAO,qBAJU,eAAe,gBAAgB,QAAQ,UAAA,iBAA+B,CAAC,QAAQ;EAC9F,YAAY;EACZ,iBAAiB,QAAQ,iBAAiB,0BAA0B,kBAAkB;EACvF,CAES,EACR,QAAQ,WAAA,UACT;;AAGH,SAAgB,oBACd,UAAsC,EAAE,EACA;CACxC,MAAM,oBAAoB,kBACxB,QAAQ,qBAAA,kCACT;AAKD,QAAO,mBAJU,eAAe,gBAAgB,QAAQ,UAAA,iBAA+B,CAAC,MAAM;EAC5F,YAAY;EACZ,iBAAiB,QAAQ,iBAAiB,0BAA0B,kBAAkB;EACvF,CAES,EACR,QAAQ,WAAA,UACT;;AAGH,SAAS,eAAe,OAAgB,cAA+C;AACrF,KAAI,MAAM,QAAQ,MAAM,CACtB,QAAO,MAAM,KAAK,SAAS,eAAe,MAAM,aAAa,CAAC;AAEhE,KAAI,UAAU,QAAQ,OAAO,UAAU,SACrC,QAAO,OAAO,YACZ,OAAO,QAAQ,MAAM,CAAC,KAAK,CAAC,KAAK,UAAU,CAAC,KAAK,eAAe,MAAM,aAAa,CAAC,CAAC,CACtF;AAEH,KAAI,OAAO,UAAU,SACnB,QAAO,MAAM,WAAW,qBAAqB,OAAO,SAAiB;AACnE,SAAO,aAAa,SAAS;GAC7B;AAEJ,QAAO;;AAGT,SAAS,kBAAkB,OAAuB;CAChD,IAAI,UAAU;AACd,QAAO,QAAQ,SAAS,IAAI,CAC1B,WAAU,QAAQ,MAAM,GAAG,GAAG;AAEhC,QAAO"}

package/dist/meta-schemas-z4IlqbLd.mjs

@@ -1,531 +0,0 @@
-//#region meta-schemas/auth-method.json
-var auth_method_default = {
-	$schema: "https://json-schema.org/draft/2020-12/schema",
-	title: "AuthMethod",
-	type: "object",
-	required: ["enabled"],
-	additionalProperties: false,
-	properties: { "enabled": {
-		"type": "boolean",
-		"description": "Whether the authentication method is enabled or not"
-	} }
-};
-//#endregion
-//#region meta-schemas/auth-methods.json
-var auth_methods_default = {
-	type: "object",
-	$schema: "https://json-schema.org/draft/2020-12/schema",
-	description: "A list of authentication methods supported by the user definition.",
-	minProperties: 1,
-	additionalProperties: false,
-	properties: {
-		"password": { "$ref": "auth-method.json" },
-		"passkey": { "$ref": "auth-method.json" },
-		"magic_link": { "$ref": "auth-method.json" },
-		"sso": { "$ref": "auth-method.json" },
-		"otp": { "$ref": "auth-method.json" }
-	}
-};
-//#endregion
-//#region meta-schemas/branding.json
-var branding_default = {
-	$schema: "https://json-schema.org/draft/2020-12/schema",
-	title: "Branding",
-	description: "Local branding descriptor for the login UI. Carries the layout preset, asset URLs, and the LiquidJS template (by file reference or inline). `zitadel apply` publishes this as an immutable branding revision; flow responses resolve the latest revision per project (ADR 040). This schema describes the local configuration shape only.",
-	type: "object",
-	additionalProperties: false,
-	properties: {
-		"$schema": {
-			"type": "string",
-			"description": "Editor affordance: path or URL of this meta-schema so editors validate and autocomplete the file (scaffolded branding files point at `.zitadel/meta/branding.json`). Ignored by the platform."
-		},
-		"layout": {
-			"type": "string",
-			"enum": ["centered", "split"],
-			"default": "centered",
-			"description": "Degrade preset (`centered` or `split`) the bundled default template branches on, not the complete design catalog. All named designs (`centered`, `split`, `split-right`, `hero`, `minimal`) ship as templates and map onto one of these two values; switch designs with the `branding eject --design <name>` command instead of editing this field. Custom templates may ignore it; the preset is also used when a template fails component-side validation."
-		},
-		"liquid_template_file": {
-			"type": "string",
-			"examples": ["./login.liquid"],
-			"description": "Path to the LiquidJS template file, relative to this descriptor. The CLI inlines the file content into `liquid_template` when publishing, and writes server state back to the file. Mutually exclusive with `liquid_template`."
-		},
-		"liquid_template": {
-			"type": "string",
-			"maxLength": 131072,
-			"description": "Inline LiquidJS template string. Prefer `liquid_template_file` — a real `.liquid` file edits far better than a JSON-escaped string. Mutually exclusive with `liquid_template_file`."
-		},
-		"logo_url": {
-			"type": "string",
-			"format": "uri",
-			"pattern": "^([hH][tT][tT][pP][sS]://|[hH][tT][tT][pP]://([lL][oO][cC][aA][lL][hH][oO][sS][tT]|127\\.(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){2}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])|\\[::1\\])(?::0*(?:[0-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?([/?#]|$))",
-			"description": "Logo URL (https required; canonical loopback http is allowed for local development and renders only on loopback pages)."
-		},
-		"hero_url": {
-			"type": "string",
-			"format": "uri",
-			"pattern": "^([hH][tT][tT][pP][sS]://|[hH][tT][tT][pP]://([lL][oO][cC][aA][lL][hH][oO][sS][tT]|127\\.(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){2}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])|\\[::1\\])(?::0*(?:[0-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?([/?#]|$))",
-			"description": "Hero/background image URL (https required; canonical loopback http is allowed for local development and renders only on loopback pages), used by split designs."
-		}
-	},
-	not: { "required": ["liquid_template", "liquid_template_file"] }
-};
-//#endregion
-//#region meta-schemas/flow-definition.json
-var flow_definition_default = {
-	$schema: "https://json-schema.org/draft/2020-12/schema",
-	title: "FlowDefinition",
-	description: "Admin-authored configuration for a flow. A flow definition is a directed graph of steps backed by a user schema. The flow engine selects a definition based on `purpose` and `audience`, then walks the graph by evaluating `transitions` against client submissions.  This schema describes the configuration shape only. Runtime emission to the client (capability dictionaries, branding, localized text) is a separate concern and is not modelled here.",
-	type: "object",
-	required: [
-		"name",
-		"status",
-		"user_schema",
-		"purposes",
-		"steps"
-	],
-	additionalProperties: false,
-	properties: {
-		"$schema": {
-			"type": "string",
-			"description": "Editor affordance: path or URL of this meta-schema so editors validate and autocomplete the file (scaffolded flow files point at `.zitadel/meta/flow-definition.json`). Ignored by the platform."
-		},
-		"name": {
-			"type": "string",
-			"pattern": "^[a-z][a-z0-9-]*$",
-			"examples": ["standard-login", "combined-auth"],
-			"description": "Stable identifier for this flow, used as the target of cross-flow `switch` and `pivot` transitions. Renaming is not supported — the `name` is part of the public contract another definition may reference. Acts as the human display label as well; no separate slug."
-		},
-		"status": {
-			"type": "string",
-			"enum": ["active", "draft"],
-			"description": "Lifecycle state. - active: the engine can select this definition for new flows. - draft: never selected for new flows; existing flows referencing it must handle it gracefully."
-		},
-		"user_schema": {
-			"type": "string",
-			"examples": ["sch_01KWHF18816ZQESRCS7Z2STJ05"],
-			"description": "Server-assigned identifier of the user schema this flow operates on, as returned by `POST /schemas`. Opaque to the client — the shape is a server implementation detail. Step `fields` reference property names defined in that schema; the engine resolves field type, validation, and implicit transition outcomes from the schema's `x-*` annotations at runtime."
-		},
-		"purposes": {
-			"type": "object",
-			"minProperties": 1,
-			"propertyNames": { "$ref": "#/$defs/Purpose" },
-			"additionalProperties": {
-				"type": "string",
-				"description": "Name of an entry-point step within this definition."
-			},
-			"examples": [{ "login": "identify" }, {
-				"login": "identify",
-				"register": "identify"
-			}],
-			"description": "Maps each purpose this definition handles to the step that begins the flow for that purpose. Every value must match a `name` in `steps`; the check is enforced by the engine, not by this schema."
-		},
-		"audience": {
-			"$ref": "#/$defs/Audience",
-			"description": "Scopes which requests this definition applies to. Omitted or empty arrays mean project-wide. The engine ranks matches by specificity (app > team > project-wide)."
-		},
-		"steps": {
-			"type": "array",
-			"minItems": 1,
-			"items": { "$ref": "#/$defs/Step" },
-			"description": "Step graph. Order is for human readability; actual sequencing is determined entirely by `transitions`. Every step's `name` must be unique within this array."
-		}
-	},
-	$defs: {
-		"Purpose": {
-			"type": "string",
-			"enum": [
-				"login",
-				"register",
-				"recovery",
-				"profiling",
-				"reauth",
-				"link_account"
-			],
-			"description": "What the user is trying to accomplish. - login: authenticate an existing user. - register: create a new user. - recovery: recover access (e.g. password reset). - profiling: collect required profile fields after authentication. - reauth: re-verify factors on an active session for step-up. - link_account: attach an external identity to an existing user."
-		},
-		"Audience": {
-			"type": "object",
-			"additionalProperties": false,
-			"properties": {
-				"team_ids": {
-					"type": "array",
-					"uniqueItems": true,
-					"items": { "type": "string" },
-					"examples": [["team_acme"]],
-					"description": "Restrict to specific teams (organizations)."
-				},
-				"app_ids": {
-					"type": "array",
-					"uniqueItems": true,
-					"items": { "type": "string" },
-					"examples": [["app_dashboard"]],
-					"description": "Restrict to specific applications."
-				}
-			}
-		},
-		"Step": {
-			"type": "object",
-			"required": ["name"],
-			"additionalProperties": false,
-			"properties": {
-				"name": {
-					"type": "string",
-					"pattern": "^[a-z][a-z0-9-]*$",
-					"examples": [
-						"identify",
-						"authenticate",
-						"done"
-					],
-					"description": "Unique step identifier within this definition. Slug-shaped so it is safe to use as a transition `target` and as a value in `purposes`. Referenced by other steps in the same definition."
-				},
-				"fields": {
-					"type": "array",
-					"uniqueItems": true,
-					"items": { "type": "string" },
-					"examples": [["email"], ["email", "password"]],
-					"description": "Schema property names to collect from the user on this step. Each entry must resolve to a property in the definition's `user_schema`, or use the reserved token `x-auth-methods#<method>` (e.g. `x-auth-methods#password`) to collect a credential proof for a method enabled at the schema root. The engine reads the schema's `x-*` annotations to derive: - field type and validation (rendered into the runtime payload), - implicit transition outcomes - e.g. a property with a non-empty `x-unique` scope makes `user_not_found` a valid `transitions` key on this step."
-				},
-				"actions": {
-					"type": "array",
-					"items": { "$ref": "#/$defs/Action" },
-					"description": "Ordered list of actions the user can take on this step. The `name` is what the client echoes back on submit. Every action's name must have a matching key in `transitions`; the engine rejects submissions for actions without a defined transition."
-				},
-				"gates": {
-					"type": "object",
-					"additionalProperties": { "$ref": "#/$defs/Gate" },
-					"description": "Security challenges that must be satisfied before this step's submission is accepted. Keyed by gate name (free identifier; referenced as the key in the runtime `step.gates` dictionary). The engine may inject additional gates at runtime based on policy or risk evaluation."
-				},
-				"sso_providers": {
-					"type": "array",
-					"items": { "$ref": "#/$defs/SSOProvider" },
-					"description": "Identity providers available on this step. When non-empty, the step must define a `transitions.callback` entry — the engine handles the reserved `sso` action transparently (redirect to the IdP, code exchange, user resolution) and fires `callback` on this step when the IdP returns. The flow author never writes a `transitions.sso`."
-				},
-				"on_success": {
-					"type": "string",
-					"enum": ["create_user"],
-					"description": "Server-side mutation to run after the step's fields validate and before the transition fires. - create_user: materialize the user from collected schema   fields. Used by register flows."
-				},
-				"complete": {
-					"type": "string",
-					"enum": ["redirect", "show"],
-					"description": "Marks this step as terminal. A terminal step has no `fields`, `actions`, `transitions`, `gates`, or `sso_providers`. - redirect: client navigates to a `redirect_uri` resolved from   the originating protocol request (OIDC, SAML). - show: client renders the step as a success or info screen."
-				},
-				"transitions": {
-					"type": "object",
-					"additionalProperties": { "$ref": "#/$defs/Transition" },
-					"description": "Maps action names and engine-emitted outcomes to the next state. Keys are either: - an action name declared in this step's `actions`, or - a reserved outcome the engine produces: - `user_not_found` - emitted when a unique field (`x-unique`) does not match an existing user. - `user_already_exists` - emitted when registration matches an existing user. - `callback` - emitted when an external system returns control to the flow (SSO callback, device authorization poll, etc.). A transition's `action` field controls whether the target is interpreted as a step in this definition (default) or as the name of another definition to switch or pivot into."
-				}
-			}
-		},
-		"Action": {
-			"type": "object",
-			"additionalProperties": false,
-			"properties": {
-				"name": {
-					"type": "string",
-					"minLength": 1,
-					"examples": [
-						"submit",
-						"passkey",
-						"email_fallback"
-					],
-					"description": "Action identifier, echoed back by the client on submit and matched against `transitions`. The name `back` is reserved for engine-injected back navigation."
-				},
-				"kind": {
-					"type": "string",
-					"enum": [
-						"submit",
-						"passkey",
-						"passkey_register",
-						"navigate"
-					],
-					"description": "How the engine handles the action. - submit: collect the step's fields and run validate/dispatch/on_success. - passkey: issue a WebAuthn assertion challenge; the matching transition fires once the assertion verifies. - passkey_register: issue a WebAuthn registration challenge; the matching transition fires once the attestation verifies. - navigate: route through the transition without running the input pipeline. (`back` exists on the wire but is engine-injected; declaring it is rejected.)"
-				},
-				"primary": {
-					"type": "boolean",
-					"default": false,
-					"description": "Marks this as the default/primary action. The runtime template uses this hint to choose visual emphasis. At most one action per step should be primary; this is not enforced here."
-				},
-				"text_key": {
-					"type": "string",
-					"examples": ["actions.signin.submit"],
-					"description": "Optional localization key override for the action's label. When omitted, the engine derives a key from the step and action names. Display text is resolved client-side from a locale dictionary, never by the engine."
-				}
-			},
-			"description": "Configuration for a user-invokable action on a step.",
-			"required": ["name", "kind"]
-		},
-		"Gate": {
-			"type": "object",
-			"required": ["kind", "provider"],
-			"additionalProperties": false,
-			"properties": {
-				"kind": {
-					"type": "string",
-					"enum": ["captcha"],
-					"description": "The gate category. Only `captcha` is currently defined. Authenticator ceremonies (e.g. passkey) are modelled as credential auth_attempts via `x-credential` on a field, not as gates."
-				},
-				"provider": {
-					"type": "string",
-					"examples": [
-						"altcha",
-						"turnstile",
-						"hcaptcha"
-					],
-					"description": "Provider identifier within the gate kind — e.g. `altcha`, `turnstile`, `hcaptcha`. The engine looks up an implementation in its provider registry."
-				},
-				"config": {
-					"type": "object",
-					"additionalProperties": true,
-					"examples": [{ "site_key": "0x4AAAAAAAxxxxxxxxxxxxxx" }],
-					"description": "Provider-specific configuration consumed by the implementation when issuing the per-render challenge. Opaque to the engine."
-				}
-			}
-		},
-		"SSOProvider": {
-			"type": "object",
-			"required": [
-				"id",
-				"name",
-				"template"
-			],
-			"additionalProperties": false,
-			"properties": {
-				"id": {
-					"type": "string",
-					"examples": ["google", "corp_idp"],
-					"description": "Provider instance identifier. Echoed back by the client when the user picks a provider; routed to the corresponding configured IdP at the engine."
-				},
-				"name": {
-					"type": "string",
-					"examples": ["Google", "Acme SSO"],
-					"description": "Display name surfaced to the user. Localized client-side if a matching text key exists in the locale dictionary."
-				},
-				"template": {
-					"type": "string",
-					"examples": [
-						"google",
-						"entraid",
-						"github"
-					],
-					"description": "Hint for rendering (logo, brand colors) — e.g. `google`, `entraid`, `github`. Consumed by the runtime template, not by the engine."
-				}
-			}
-		},
-		"Transition": {
-			"type": "object",
-			"required": ["target"],
-			"additionalProperties": false,
-			"properties": {
-				"target": {
-					"type": "string",
-					"examples": [
-						"authenticate",
-						"register",
-						"recovery"
-					],
-					"description": "When `action` is omitted, the `name` of a step in the same definition. When `action` is `switch` or `pivot`, the `name` of another flow definition in the same project."
-				},
-				"action": {
-					"type": ["string", "null"],
-					"enum": [
-						"switch",
-						"pivot",
-						null
-					],
-					"description": "How to interpret `target`. - Omitted: transition to a step in the current definition. - `switch`: replace the current flow with the target flow.   No return; the current flow is discarded. Typical use:   navigating between peer flows like login ↔ register. - `pivot`: push the target flow onto the stack. The current   flow is paused; when the target flow completes the engine   auto-pops back. Typical use: login → recovery → back to login."
-				},
-				"purpose": {
-					"type": ["string", "null"],
-					"enum": [
-						"login",
-						"register",
-						"recovery",
-						"profiling",
-						"reauth",
-						"link_account",
-						null
-					],
-					"description": "Local re-purposing. When set, taking this transition changes the flow's current purpose to this value — the dispatch mode a step's challenges run under — while the flow's original purpose stays pinned. Must be a purpose this definition serves, and `target` must be that purpose's entry step. Mutually exclusive with `action`: a transition either re-purposes within this flow or targets another flow, never both. Example: a \"Sign up\" navigation on the login identifier step (`{ \"target\": \"register\", \"purpose\": \"register\" }`)."
-				}
-			}
-		}
-	}
-};
-//#endregion
-//#region meta-schemas/property-name.json
-var property_name_default = {
-	$schema: "https://json-schema.org/draft/2020-12/schema",
-	title: "PropertyName",
-	type: "string",
-	pattern: "^[^.]+$",
-	description: "The name of a single user attribute."
-};
-//#endregion
-//#region meta-schemas/user-property.json
-var user_property_default = {
-	$schema: "https://json-schema.org/draft/2020-12/schema",
-	title: "UserProperty",
-	type: "object",
-	allOf: [{ "$ref": "https://json-schema.org/draft/2020-12/schema" }],
-	additionalProperties: true,
-	properties: {
-		"$schema": {
-			"type": "string",
-			"const": "https://json-schema.org/draft/2020-12/schema",
-			"description": "The JSON Schema version used for this schema."
-		},
-		"x-unique": {
-			"oneOf": [{
-				"type": "string",
-				"enum": [
-					"unspecified",
-					"project",
-					"team"
-				]
-			}, { "type": "null" }],
-			"description": "The level of uniqueness for this property, if applicable"
-		},
-		"x-claim": {
-			"oneOf": [{ "type": "string" }, { "type": "null" }],
-			"description": "The claim name for this property, if applicable"
-		},
-		"x-audit": {
-			"type": "boolean",
-			"default": false,
-			"description": "Whether this property's value may appear in audit event payloads. Audit payloads are deny-by-default: a property without this annotation contributes its key but never its value."
-		},
-		"properties": {
-			"type": "object",
-			"description": "A map of additional properties for the user definition, where the key is the property name and the value is the property schema",
-			"propertyNames": { "$ref": "property-name.json" },
-			"additionalProperties": { "$ref": "user-property.json" }
-		}
-	}
-};
-//#endregion
-//#region meta-schemas/user-schema.json
-var user_schema_default = {
-	title: "UserSchema",
-	$schema: "https://json-schema.org/draft/2020-12/schema",
-	type: "object",
-	required: [
-		"metaSchema",
-		"kind",
-		"x-auth-methods"
-	],
-	allOf: [{ "$ref": "https://json-schema.org/draft/2020-12/schema" }],
-	additionalProperties: true,
-	properties: {
-		"$schema": {
-			"type": "string",
-			"const": "https://json-schema.org/draft/2020-12/schema",
-			"description": "The JSON Schema version used for this schema."
-		},
-		"objectType": {
-			"type": "string",
-			"maxLength": 256,
-			"description": "The type of user this schema describes. This is a customer chosen name.",
-			"example": "human-user"
-		},
-		"kind": {
-			"type": "string",
-			"const": "user-schema",
-			"description": "Discriminator value for a user schema create request."
-		},
-		"metaSchema": {
-			"type": "string",
-			"maxLength": 1024,
-			"format": "uri",
-			"description": "The user Schema version used for this schema."
-		},
-		"x-auth-methods": { "$ref": "auth-methods.json" },
-		"x-identifier": {
-			"type": "string",
-			"minLength": 1,
-			"description": "Path of the leaf property whose value identifies a user (nested leaves are addressed by their dot-joined attribute path). The property must carry x-unique \"project\". Required when an auth method needing identifier-first dispatch (password) is enabled. Passkey is exempt: discoverable credentials identify the user through the assertion itself, so passkey-only and API-managed schemas may designate nothing; flows using identifier-first passkey are validated at the flow level instead."
-		},
-		"x-display": {
-			"type": "array",
-			"minItems": 1,
-			"items": {
-				"type": "string",
-				"minLength": 1
-			},
-			"description": "Ordered leaf property paths whose values, joined with a space, render the user's display name."
-		},
-		"properties": {
-			"type": "object",
-			"description": "A map of additional properties for the user definition, where the key is the property name and the value is the property schema",
-			"propertyNames": { "$ref": "property-name.json" },
-			"additionalProperties": { "$ref": "user-property.json" }
-		}
-	}
-};
-//#endregion
-//#region src/meta-schemas.ts
-/**
-* The dialect meta-schemas `zitadel setup` copies into a project's
-* `.zitadel/meta/` so the flow/schema dialect is machine-readable offline:
-* editors validate flow files against `flow-definition.json` via a relative
-* `$schema` pointer, and agents read the dialect files before authoring
-* edits — no docs crawl, no hosted schema required.
-*
-* The files under `meta-schemas/` are committed copies of
-* `api/openapi/endpoints/schemas/*.json` (the source the server embeds);
-* a drift-audit test keeps them byte-identical in the monorepo.
-*/
-/** Project-relative directory setup writes the meta-schemas to. */
-const META_SCHEMA_DIR = ".zitadel/meta";
-/**
-* The `$schema` value scaffolded flow files carry, relative to
-* `.zitadel/flows/` — resolves to `{@link META_SCHEMA_DIR}/flow-definition.json`.
-*/
-const FLOW_FILE_SCHEMA_REF = "../meta/flow-definition.json";
-/**
-* The `$schema` value scaffolded branding files carry, relative to
-* `.zitadel/branding/` — resolves to `{@link META_SCHEMA_DIR}/branding.json`.
-*/
-const BRANDING_FILE_SCHEMA_REF = "../meta/branding.json";
-/**
-* The dialect files to materialize, in write order. `auth-methods.json` and
-* `auth-method.json` are pulled in by `user-schema.json`'s relative `$ref`s —
-* without them the copied dialect cannot resolve offline.
-*/
-function metaSchemaFiles() {
-	return [
-		{
-			name: "flow-definition.json",
-			body: flow_definition_default
-		},
-		{
-			name: "user-schema.json",
-			body: user_schema_default
-		},
-		{
-			name: "user-property.json",
-			body: user_property_default
-		},
-		{
-			name: "property-name.json",
-			body: property_name_default
-		},
-		{
-			name: "auth-methods.json",
-			body: auth_methods_default
-		},
-		{
-			name: "auth-method.json",
-			body: auth_method_default
-		},
-		{
-			name: "branding.json",
-			body: branding_default
-		}
-	];
-}
-//#endregion
-export { metaSchemaFiles as i, FLOW_FILE_SCHEMA_REF as n, META_SCHEMA_DIR as r, BRANDING_FILE_SCHEMA_REF as t };
-
-//# sourceMappingURL=meta-schemas-z4IlqbLd.mjs.map

package/dist/meta-schemas-z4IlqbLd.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"meta-schemas-z4IlqbLd.mjs","names":["flowDefinitionMetaSchema","userSchemaMetaSchema","userPropertyMetaSchema","propertyNameMetaSchema","authMethodsMetaSchema","authMethodMetaSchema","brandingMetaSchema"],"sources":["../meta-schemas/auth-method.json","../meta-schemas/auth-methods.json","../meta-schemas/branding.json","../meta-schemas/flow-definition.json","../meta-schemas/property-name.json","../meta-schemas/user-property.json","../meta-schemas/user-schema.json","../src/meta-schemas.ts"],"sourcesContent":["","","","","","","","/**\n * The dialect meta-schemas `zitadel setup` copies into a project's\n * `.zitadel/meta/` so the flow/schema dialect is machine-readable offline:\n * editors validate flow files against `flow-definition.json` via a relative\n * `$schema` pointer, and agents read the dialect files before authoring\n * edits — no docs crawl, no hosted schema required.\n *\n * The files under `meta-schemas/` are committed copies of\n * `api/openapi/endpoints/schemas/*.json` (the source the server embeds);\n * a drift-audit test keeps them byte-identical in the monorepo.\n */\nimport authMethodMetaSchema from \"../meta-schemas/auth-method.json\" with {\n  type: \"json\",\n};\nimport authMethodsMetaSchema from \"../meta-schemas/auth-methods.json\" with {\n  type: \"json\",\n};\nimport brandingMetaSchema from \"../meta-schemas/branding.json\" with {\n  type: \"json\",\n};\nimport flowDefinitionMetaSchema from \"../meta-schemas/flow-definition.json\" with {\n  type: \"json\",\n};\nimport propertyNameMetaSchema from \"../meta-schemas/property-name.json\" with {\n  type: \"json\",\n};\nimport userPropertyMetaSchema from \"../meta-schemas/user-property.json\" with {\n  type: \"json\",\n};\nimport userSchemaMetaSchema from \"../meta-schemas/user-schema.json\" with {\n  type: \"json\",\n};\n\n/** Project-relative directory setup writes the meta-schemas to. */\nexport const META_SCHEMA_DIR = \".zitadel/meta\";\n\n/**\n * The `$schema` value scaffolded flow files carry, relative to\n * `.zitadel/flows/` — resolves to `{@link META_SCHEMA_DIR}/flow-definition.json`.\n */\nexport const FLOW_FILE_SCHEMA_REF = \"../meta/flow-definition.json\";\n\n/**\n * The `$schema` value scaffolded branding files carry, relative to\n * `.zitadel/branding/` — resolves to `{@link META_SCHEMA_DIR}/branding.json`.\n */\nexport const BRANDING_FILE_SCHEMA_REF = \"../meta/branding.json\";\n\nexport type MetaSchemaFile = { name: string; body: object };\n\n/**\n * The dialect files to materialize, in write order. `auth-methods.json` and\n * `auth-method.json` are pulled in by `user-schema.json`'s relative `$ref`s —\n * without them the copied dialect cannot resolve offline.\n */\nexport function metaSchemaFiles(): ReadonlyArray<MetaSchemaFile> {\n  return [\n    { name: \"flow-definition.json\", body: flowDefinitionMetaSchema as object },\n    { name: \"user-schema.json\", body: userSchemaMetaSchema as object },\n    { name: \"user-property.json\", body: userPropertyMetaSchema as object },\n    { name: \"property-name.json\", body: propertyNameMetaSchema as object },\n    { name: \"auth-methods.json\", body: authMethodsMetaSchema as object },\n    { name: \"auth-method.json\", body: authMethodMetaSchema as object },\n    { name: \"branding.json\", body: brandingMetaSchema as object },\n  ];\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AOkCA,MAAa,kBAAkB;;;;;AAM/B,MAAa,uBAAuB;;;;;AAMpC,MAAa,2BAA2B;;;;;;AASxC,SAAgB,kBAAiD;AAC/D,QAAO;EACL;GAAE,MAAM;GAAwB,MAAMA;GAAoC;EAC1E;GAAE,MAAM;GAAoB,MAAMC;GAAgC;EAClE;GAAE,MAAM;GAAsB,MAAMC;GAAkC;EACtE;GAAE,MAAM;GAAsB,MAAMC;GAAkC;EACtE;GAAE,MAAM;GAAqB,MAAMC;GAAiC;EACpE;GAAE,MAAM;GAAoB,MAAMC;GAAgC;EAClE;GAAE,MAAM;GAAiB,MAAMC;GAA8B;EAC9D"}

package/dist/schemas.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"schemas.mjs","names":[],"sources":["../src/schemas.ts"],"sourcesContent":["import {\n  CreateBrandingBody,\n  CreateFlowDefinitionBody,\n  CreateSchemaBody,\n} from \"@zitadel/api/generated/endpoints/zitadelNextGen.zod\";\nimport { z } from \"zod\";\n\nimport { isCanonicalLoopbackHttpUrl } from \"./branding-url.js\";\n\nexport const schemaConfigSchema = CreateSchemaBody;\nexport const flowConfigSchema = CreateFlowDefinitionBody.shape.flow_definition;\nexport const createFlowDefinitionRequestSchema = CreateFlowDefinitionBody;\n\n/** The wire shape of a branding revision (`POST /branding` request body). */\nexport const brandingWireSchema = CreateBrandingBody;\n\n/**\n * The local `.zitadel/branding/*.json` dialect: the wire shape plus\n * `liquid_template_file`, a descriptor-relative path the CLI inlines into\n * `liquid_template` when publishing. Exactly one of the two template carriers\n * may be present (the meta-schema `branding.json` mirrors this).\n */\nexport const brandingConfigSchema = z\n  .strictObject({\n    // Strict, unlike the generated wire schema: a typo like `hero_urll`\n    // must fail plan, not silently pass, get ignored by the server, and\n    // vanish on canonical write-back. The editor meta-schema already\n    // rejects unknown keys; the CLI gate has to agree.\n    ...CreateBrandingBody.shape,\n    // Raw strings instead of the generated uri fields: those trim and\n    // normalize before refinement runs, hiding exactly the forms the wire\n    // body still carries verbatim and Go's url.Parse rejects.\n    logo_url: z.string().optional(),\n    hero_url: z.string().optional(),\n    $schema: z.string().optional(),\n    liquid_template_file: z.string().min(1).optional(),\n  })\n  .superRefine((value, ctx) => {\n    if (value.liquid_template !== undefined && value.liquid_template_file !== undefined) {\n      ctx.addIssue({\n        code: \"custom\",\n        message: \"Use either liquid_template_file or an inline liquid_template, not both.\",\n      });\n    }\n    // font_url is read-only in v1: the login component loads it as a\n    // document-level stylesheet (shadow-scoped @font-face never registers\n    // faces), which would give branding.write arbitrary CSS over the embedding\n    // page. The server rejects it too; safe delivery is an ADR 040 follow-up.\n    if (value.font_url !== undefined) {\n      ctx.addIssue({\n        code: \"custom\",\n        message:\n          \"font_url is not writable yet (tenant font delivery needs a safe design, see ADR 040); load fonts from the embedding page instead.\",\n      });\n    }\n    // Mirror the server's asset URL gate (validateBrandingAssetURL in\n    // internal/domain/branding_validator.go) so plan rejects what apply would.\n    // Apply mutates schemas and flows before branding, so a late 400 here would\n    // leave a half-applied run.\n    validateBrandingAssetUrl(value.logo_url, \"logo_url\", ctx);\n    validateBrandingAssetUrl(value.hero_url, \"hero_url\", ctx);\n  });\n\nfunction validateBrandingAssetUrl(\n  value: string | undefined,\n  field: \"logo_url\" | \"hero_url\",\n  ctx: z.RefinementCtx,\n): void {\n  if (value === undefined || value === \"\") {\n    return;\n  }\n  // Stricter-or-equal than the Go gate (validateBrandingAssetURL): the WHATWG\n  // parser forgives what Go's url.Parse rejects — `https:example.com`,\n  // backslashes, and whitespace all get silently normalized. plan must never\n  // accept what apply would reject (the reverse is harmless), so reject the\n  // raw forms before parsing.\n  if (/[\\s\\\\]/.test(value)) {\n    ctx.addIssue({ code: \"custom\", message: `${field} is not a valid URL.` });\n    return;\n  }\n  if (!/^https?:\\/\\//i.test(value)) {\n    ctx.addIssue({ code: \"custom\", message: `${field} must be an absolute https URL.` });\n    return;\n  }\n  let parsed: URL;\n  try {\n    parsed = new URL(value);\n  } catch {\n    ctx.addIssue({ code: \"custom\", message: `${field} is not a valid URL.` });\n    return;\n  }\n  // Loopback HTTP is the dev-posture carve-out (assets served from the app's\n  // own dev server). Check the raw URL so WHATWG normalisation cannot make\n  // plan accept a host spelling that the Go save gate rejects.\n  if (parsed.protocol === \"http:\" && isCanonicalLoopbackHttpUrl(value)) {\n    return;\n  }\n  if (parsed.protocol !== \"https:\" || parsed.host === \"\") {\n    ctx.addIssue({\n      code: \"custom\",\n      message: `${field} must be an absolute https URL (http is allowed for canonical loopback development hosts only).`,\n    });\n  }\n}\n"],"mappings":";;;;AASA,MAAa,qBAAqB;AAClC,MAAa,mBAAmB,yBAAyB,MAAM;AAC/D,MAAa,oCAAoC;;AAGjD,MAAa,qBAAqB;;;;;;;AAQlC,MAAa,uBAAuB,EACjC,aAAa;CAKZ,GAAG,mBAAmB;CAItB,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,SAAS,EAAE,QAAQ,CAAC,UAAU;CAC9B,sBAAsB,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACnD,CAAC,CACD,aAAa,OAAO,QAAQ;AAC3B,KAAI,MAAM,oBAAoB,KAAA,KAAa,MAAM,yBAAyB,KAAA,EACxE,KAAI,SAAS;EACX,MAAM;EACN,SAAS;EACV,CAAC;AAMJ,KAAI,MAAM,aAAa,KAAA,EACrB,KAAI,SAAS;EACX,MAAM;EACN,SACE;EACH,CAAC;AAMJ,0BAAyB,MAAM,UAAU,YAAY,IAAI;AACzD,0BAAyB,MAAM,UAAU,YAAY,IAAI;EACzD;AAEJ,SAAS,yBACP,OACA,OACA,KACM;AACN,KAAI,UAAU,KAAA,KAAa,UAAU,GACnC;AAOF,KAAI,SAAS,KAAK,MAAM,EAAE;AACxB,MAAI,SAAS;GAAE,MAAM;GAAU,SAAS,GAAG,MAAM;GAAuB,CAAC;AACzE;;AAEF,KAAI,CAAC,gBAAgB,KAAK,MAAM,EAAE;AAChC,MAAI,SAAS;GAAE,MAAM;GAAU,SAAS,GAAG,MAAM;GAAkC,CAAC;AACpF;;CAEF,IAAI;AACJ,KAAI;AACF,WAAS,IAAI,IAAI,MAAM;SACjB;AACN,MAAI,SAAS;GAAE,MAAM;GAAU,SAAS,GAAG,MAAM;GAAuB,CAAC;AACzE;;AAKF,KAAI,OAAO,aAAa,WAAW,2BAA2B,MAAM,CAClE;AAEF,KAAI,OAAO,aAAa,YAAY,OAAO,SAAS,GAClD,KAAI,SAAS;EACX,MAAM;EACN,SAAS,GAAG,MAAM;EACnB,CAAC"}