@zitadel/config 1.0.0-alpha.23 → 1.0.0-alpha.25

package/dist/{defaults-BxGCGdqS.d.mts → defaults-BtKIcWxW.d.mts}

@@ -1,5 +1,4 @@
 import { CreateFlowDefinitionBodyFlowDefinition, CreateSchemaBody } from "@zitadel/api/generated/model";
-
 //#region src/readmes.d.ts
 /**
  * README content the CLI copies to `.zitadel/schemas/README.md` during setup.
@@ -37,28 +36,34 @@ declare const SETUP_PRESETS: readonly ["password-first", "passkey-first"];
 type SetupPreset = (typeof SETUP_PRESETS)[number];
 declare const DEFAULT_SETUP_PRESET: SetupPreset;
 /**
- * Login-design starting points `zitadel branding eject --design <name>` (and
- * `zitadel setup --design <name>`) scaffold into `.zitadel/branding/`. A
- * design is a full Liquid template plus the descriptor `layout` it degrades
- * to — the wire `layout` enum stays `centered | split`, richer designs are
- * delivered as templates (ADR 040).
+ * Widget-template starting points `zitadel branding eject --design <name>`
+ * scaffolds into `.zitadel/branding/` (setup never does, #1039). Only
+ * widget structure belongs here: `centered` is the bundled default card and
+ * `minimal` the same form without card chrome. Page layouts (the former
+ * `split`, `split-right`, `hero`) were page chrome and live in the embedding
+ * application instead; revisions already published from them keep rendering
+ * (see docs/design/branding/customization-strategy.md). Add a design here
+ * only when it changes the widget's structure, not the page around it.
  */
-declare const BRANDING_DESIGNS: readonly ["centered", "split", "split-right", "hero", "minimal"];
+declare const BRANDING_DESIGNS: readonly ["centered", "minimal"];
 type BrandingDesign = (typeof BRANDING_DESIGNS)[number];
 declare const DEFAULT_BRANDING_DESIGN: BrandingDesign;
 type DefaultBrandingConfig = {
-  /** The `.zitadel/branding/branding.json` descriptor body (sans `$schema`). */branding: {
-    layout: "centered" | "split"; /** A `$file` reference to the sibling template; the CLI inlines it before publishing. */
+  /** The `.zitadel/branding/branding.json` descriptor body (sans `$schema`). */
+  branding: {
+    layout: "centered";
+    /** A `$file` reference to the sibling template; the CLI inlines it before publishing. */
     liquid_template: {
       $file: string;
     };
-  }; /** The `.zitadel/branding/login.liquid` template content. */
+  };
+  /** The `.zitadel/branding/login.liquid` template content. */
   template: string;
 };
 /**
  * Renders the scaffold files for a branding design. The `centered` template
  * is a drift-tested copy of the bundled default in `@zitadel/components`;
- * the other designs are authored variants of it.
+ * `minimal` is an authored variant of it.
  */
 declare function getDefaultBrandingConfig(design?: string): DefaultBrandingConfig;
 /**
@@ -74,8 +79,10 @@ type SetupUseCase = (typeof SETUP_USE_CASES)[number];
 declare const DEFAULT_SETUP_USE_CASE: SetupUseCase;
 type DefaultConfigRenderOptions = {
   builtinSchemaBase?: string;
-  userSchemaUrl?: string; /** Which flow/auth bundle to render; defaults to {@link DEFAULT_SETUP_PRESET}. */
-  preset?: string; /** Which field set to collect; defaults to {@link DEFAULT_SETUP_USE_CASE}. */
+  userSchemaUrl?: string;
+  /** Which flow/auth bundle to render; defaults to {@link DEFAULT_SETUP_PRESET}. */
+  preset?: string;
+  /** Which field set to collect; defaults to {@link DEFAULT_SETUP_USE_CASE}. */
   useCase?: string;
 };
 declare function defaultHumanUserSchemaUrl(builtinSchemaBase?: string): string;
@@ -83,4 +90,4 @@ declare function getDefaultHumanUserSchema(options?: DefaultConfigRenderOptions)
 declare function getDefaultLoginFlow(options?: DefaultConfigRenderOptions): CreateFlowDefinitionBodyFlowDefinition;
 //#endregion
 export { flowsReadmeContent as C, brandingReadmeContent as S, SetupUseCase as _, DEFAULT_BRANDING_TEMPLATE_PATH as a, getDefaultHumanUserSchema as b, DEFAULT_FLOW_SCHEMA_URI as c, DEFAULT_SETUP_USE_CASE as d, DefaultBrandingConfig as f, SetupPreset as g, SETUP_USE_CASES as h, DEFAULT_BRANDING_DESIGN as i, DEFAULT_SCHEMA_CONFIG_PATH as l, SETUP_PRESETS as m, BrandingDesign as n, DEFAULT_BUILTIN_SCHEMA_BASE as o, DefaultConfigRenderOptions as p, DEFAULT_BRANDING_CONFIG_PATH as r, DEFAULT_FLOW_CONFIG_PATH as s, BRANDING_DESIGNS as t, DEFAULT_SETUP_PRESET as u, defaultHumanUserSchemaUrl as v, schemasReadmeContent as w, getDefaultLoginFlow as x, getDefaultBrandingConfig as y };
-//# sourceMappingURL=defaults-BxGCGdqS.d.mts.map
+//# sourceMappingURL=defaults-BtKIcWxW.d.mts.map

package/dist/defaults-BtKIcWxW.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults-BtKIcWxW.d.mts","names":[],"sources":["../src/readmes.ts","../src/defaults.ts"],"mappings":";;;;;;;iBAQgB;;;;;iBAQA;;;;;;iBASA;;;cCJH;cACA;cACA;cACA;cACA;cACA;;;;;;;;cASA;KAED,sBAAsB;cAErB,sBAAsB;;;;;;;;;;;cAmCtB;KAED,yBAAyB;cAExB,yBAAyB;KAa1B;;EAEV;IACE;;IAEA;MAAmB;;;;EAGrB;;;;;;;iBAQc,yBACd,kBACC;;;;;;;;;cAmCU;KAED,uBAAuB;cAEtB,wBAAwB;KA0GzB;EACV;EACA;;EAEA;;EAEA;;iBAGc,0BAA0B;iBAI1B,0BACd,UAAS,6BACR;iBAca,oBACd,UAAS,6BACR"}

package/dist/{defaults-DV6hY2KT.mjs → defaults-COLBFU3S.mjs}

@@ -348,32 +348,31 @@ function presetTemplates(preset) {
 	return PRESET_TEMPLATES[preset];
 }
 /**
-* Login-design starting points `zitadel branding eject --design <name>` (and
-* `zitadel setup --design <name>`) scaffold into `.zitadel/branding/`. A
-* design is a full Liquid template plus the descriptor `layout` it degrades
-* to — the wire `layout` enum stays `centered | split`, richer designs are
-* delivered as templates (ADR 040).
+* Widget-template starting points `zitadel branding eject --design <name>`
+* scaffolds into `.zitadel/branding/` (setup never does, #1039). Only
+* widget structure belongs here: `centered` is the bundled default card and
+* `minimal` the same form without card chrome. Page layouts (the former
+* `split`, `split-right`, `hero`) were page chrome and live in the embedding
+* application instead; revisions already published from them keep rendering
+* (see docs/design/branding/customization-strategy.md). Add a design here
+* only when it changes the widget's structure, not the page around it.
 */
-const BRANDING_DESIGNS = [
-	"centered",
-	"split",
-	"split-right",
-	"hero",
-	"minimal"
-];
+const BRANDING_DESIGNS = ["centered", "minimal"];
 const DEFAULT_BRANDING_DESIGN = "centered";
-/** Descriptor `layout` each design degrades to when its template is rejected. */
+/**
+* Descriptor `layout` each design's `branding.json` carries. Both shipped
+* designs are widget structure and carry `centered`; the wire enum still has
+* `split` for revisions published from the retired page-layout designs
+* (#1039), which no catalog entry produces any more.
+*/
 const DESIGN_LAYOUTS = {
 	centered: "centered",
-	split: "split",
-	"split-right": "split",
-	hero: "split",
 	minimal: "centered"
 };
 /**
 * Renders the scaffold files for a branding design. The `centered` template
 * is a drift-tested copy of the bundled default in `@zitadel/components`;
-* the other designs are authored variants of it.
+* `minimal` is an authored variant of it.
 */
 function getDefaultBrandingConfig(design = DEFAULT_BRANDING_DESIGN) {
 	if (!Object.hasOwn(DESIGN_LAYOUTS, design)) throw new Error(`unknown branding design ${JSON.stringify(design)} (known designs: ${BRANDING_DESIGNS.join(", ")})`);
@@ -540,4 +539,4 @@ function trimTrailingSlash(value) {
 //#endregion
 export { brandingReadmeContent as _, DEFAULT_BUILTIN_SCHEMA_BASE as a, DEFAULT_SCHEMA_CONFIG_PATH as c, SETUP_PRESETS as d, SETUP_USE_CASES as f, getDefaultLoginFlow as g, getDefaultHumanUserSchema as h, DEFAULT_BRANDING_TEMPLATE_PATH as i, DEFAULT_SETUP_PRESET as l, getDefaultBrandingConfig as m, DEFAULT_BRANDING_CONFIG_PATH as n, DEFAULT_FLOW_CONFIG_PATH as o, defaultHumanUserSchemaUrl as p, DEFAULT_BRANDING_DESIGN as r, DEFAULT_FLOW_SCHEMA_URI as s, BRANDING_DESIGNS as t, DEFAULT_SETUP_USE_CASE as u, flowsReadmeContent as v, schemasReadmeContent as y };
 
-//# sourceMappingURL=defaults-DV6hY2KT.mjs.map
+//# sourceMappingURL=defaults-COLBFU3S.mjs.map

package/dist/defaults-COLBFU3S.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults-COLBFU3S.mjs","names":["defaultHumanUserSchemaTemplate","defaultLoginFlowTemplate","passkeyFirstHumanUserSchemaTemplate","passkeyFirstLoginFlowTemplate"],"sources":["../defaults/default-human-user.json","../defaults/default-login.json","../defaults/presets/passkey-first/human-user.json","../defaults/presets/passkey-first/login.json","../src/readmes.ts","../src/defaults.ts"],"sourcesContent":["","","","","import { readFileSync } from \"node:fs\";\nimport { fileURLToPath } from \"node:url\";\n\n/**\n * README content the CLI copies to `.zitadel/schemas/README.md` during setup.\n * Source of truth is `packages/config/defaults/README-schemas.md`; the Go\n * server-side embed reads the same file (see `defaults.go`).\n */\nexport function schemasReadmeContent(): string {\n  return readFileSync(readmeUrl(\"README-schemas.md\"), \"utf8\");\n}\n\n/**\n * README content the CLI copies to `.zitadel/flows/README.md` during setup.\n * Source of truth is `packages/config/defaults/README-flows.md`.\n */\nexport function flowsReadmeContent(): string {\n  return readFileSync(readmeUrl(\"README-flows.md\"), \"utf8\");\n}\n\n/**\n * README content the CLI copies to `.zitadel/branding/README.md` when a\n * branding design is ejected. Source of truth is\n * `packages/config/defaults/README-branding.md`.\n */\nexport function brandingReadmeContent(): string {\n  return readFileSync(readmeUrl(\"README-branding.md\"), \"utf8\");\n}\n\nfunction readmeUrl(filename: string): string {\n  return fileURLToPath(new URL(`../defaults/${filename}`, import.meta.url));\n}\n","import { readFileSync } from \"node:fs\";\nimport { fileURLToPath } from \"node:url\";\n\nimport type {\n  CreateFlowDefinitionBodyFlowDefinition,\n  CreateSchemaBody,\n} from \"@zitadel/api/generated/model\";\n\nimport defaultHumanUserSchemaTemplate from \"../defaults/default-human-user.json\" with {\n  type: \"json\",\n};\nimport defaultLoginFlowTemplate from \"../defaults/default-login.json\" with { type: \"json\" };\nimport passkeyFirstHumanUserSchemaTemplate from \"../defaults/presets/passkey-first/human-user.json\" with {\n  type: \"json\",\n};\nimport passkeyFirstLoginFlowTemplate from \"../defaults/presets/passkey-first/login.json\" with {\n  type: \"json\",\n};\n\nexport { brandingReadmeContent, flowsReadmeContent, schemasReadmeContent } from \"./readmes.js\";\n\nexport const DEFAULT_BUILTIN_SCHEMA_BASE = \"https://nextgen.com/api/schemas\";\nexport const DEFAULT_FLOW_SCHEMA_URI = \"https://nextgen.com/flow-definition.json\";\nexport const DEFAULT_SCHEMA_CONFIG_PATH = \".zitadel/schemas/default-human-user.json\";\nexport const DEFAULT_FLOW_CONFIG_PATH = \".zitadel/flows/default-login.json\";\nexport const DEFAULT_BRANDING_CONFIG_PATH = \".zitadel/branding/branding.json\";\nexport const DEFAULT_BRANDING_TEMPLATE_PATH = \".zitadel/branding/login.liquid\";\n\n/**\n * Named schema+flow bundles `zitadel setup` can scaffold (#448: the prompt\n * fires before any `.zitadel/` file is written; each preset maps to a\n * pre-defined bundle the CLI copies on first setup). `password-first` is\n * today's default; `passkey-first` puts a passkey ceremony on the login\n * entry step with an email→password fallback path.\n */\nexport const SETUP_PRESETS = [\"password-first\", \"passkey-first\"] as const;\n\nexport type SetupPreset = (typeof SETUP_PRESETS)[number];\n\nexport const DEFAULT_SETUP_PRESET: SetupPreset = \"password-first\";\n\nconst PRESET_TEMPLATES: Record<SetupPreset, { schema: unknown; flow: unknown }> = {\n  \"password-first\": {\n    schema: defaultHumanUserSchemaTemplate,\n    flow: defaultLoginFlowTemplate,\n  },\n  \"passkey-first\": {\n    schema: passkeyFirstHumanUserSchemaTemplate,\n    flow: passkeyFirstLoginFlowTemplate,\n  },\n};\n\nfunction presetTemplates(preset: string): { schema: unknown; flow: unknown } {\n  // Own-property check: indexing a plain object with an arbitrary string\n  // would let \"__proto__\"/\"constructor\" resolve via the prototype chain\n  // and bypass the unknown-preset error.\n  if (!Object.hasOwn(PRESET_TEMPLATES, preset)) {\n    throw new Error(\n      `unknown setup preset ${JSON.stringify(preset)} (known presets: ${SETUP_PRESETS.join(\", \")})`,\n    );\n  }\n  return PRESET_TEMPLATES[preset as SetupPreset];\n}\n\n/**\n * Widget-template starting points `zitadel branding eject --design <name>`\n * scaffolds into `.zitadel/branding/` (setup never does, #1039). Only\n * widget structure belongs here: `centered` is the bundled default card and\n * `minimal` the same form without card chrome. Page layouts (the former\n * `split`, `split-right`, `hero`) were page chrome and live in the embedding\n * application instead; revisions already published from them keep rendering\n * (see docs/design/branding/customization-strategy.md). Add a design here\n * only when it changes the widget's structure, not the page around it.\n */\nexport const BRANDING_DESIGNS = [\"centered\", \"minimal\"] as const;\n\nexport type BrandingDesign = (typeof BRANDING_DESIGNS)[number];\n\nexport const DEFAULT_BRANDING_DESIGN: BrandingDesign = \"centered\";\n\n/**\n * Descriptor `layout` each design's `branding.json` carries. Both shipped\n * designs are widget structure and carry `centered`; the wire enum still has\n * `split` for revisions published from the retired page-layout designs\n * (#1039), which no catalog entry produces any more.\n */\nconst DESIGN_LAYOUTS: Record<BrandingDesign, \"centered\"> = {\n  centered: \"centered\",\n  minimal: \"centered\",\n};\n\nexport type DefaultBrandingConfig = {\n  /** The `.zitadel/branding/branding.json` descriptor body (sans `$schema`). */\n  branding: {\n    layout: \"centered\";\n    /** A `$file` reference to the sibling template; the CLI inlines it before publishing. */\n    liquid_template: { $file: string };\n  };\n  /** The `.zitadel/branding/login.liquid` template content. */\n  template: string;\n};\n\n/**\n * Renders the scaffold files for a branding design. The `centered` template\n * is a drift-tested copy of the bundled default in `@zitadel/components`;\n * `minimal` is an authored variant of it.\n */\nexport function getDefaultBrandingConfig(\n  design: string = DEFAULT_BRANDING_DESIGN,\n): DefaultBrandingConfig {\n  if (!Object.hasOwn(DESIGN_LAYOUTS, design)) {\n    throw new Error(\n      `unknown branding design ${JSON.stringify(design)} (known designs: ${BRANDING_DESIGNS.join(\", \")})`,\n    );\n  }\n  const known = design as BrandingDesign;\n  return {\n    branding: {\n      layout: DESIGN_LAYOUTS[known],\n      liquid_template: { $file: \"./login.liquid\" },\n    },\n    template: readFileSync(packageFilePath(`../defaults/branding/${known}/login.liquid`), \"utf8\"),\n  };\n}\n\n/**\n * Resolves a package-relative file to a real filesystem path. Vite-driven\n * runtimes (vitest in dependent packages) rewrite `import.meta.url` to a\n * `/@fs/...` URL, which `fileURLToPath` passes through verbatim — strip the\n * prefix so `readFileSync` gets an actual path.\n */\nfunction packageFilePath(relative: string): string {\n  const path = fileURLToPath(new URL(relative, import.meta.url));\n  return path.startsWith(\"/@fs/\") ? path.slice(\"/@fs\".length) : path;\n}\n\n/**\n * The second setup axis (#448): *who* signs in, orthogonal to the sign-in\n * preset (*how* they sign in). The sign-in preset owns the flow shape and\n * auth methods; the use case owns which profile fields the schema collects.\n * Composing the two keeps us at one field catalog + one flow-per-preset\n * instead of a bundle per (use case × preset) pair. `minimal` is the\n * default and never blocks non-interactive runs.\n */\nexport const SETUP_USE_CASES = [\"minimal\", \"consumer\", \"business\"] as const;\n\nexport type SetupUseCase = (typeof SETUP_USE_CASES)[number];\n\nexport const DEFAULT_SETUP_USE_CASE: SetupUseCase = \"minimal\";\n\n/**\n * Fields each use case collects, in register/display order. `email` is\n * always first and stays the only required property; the rest are optional\n * profile attributes gathered on the flow's register step. `givenName`/\n * `familyName` are the attributes the backend reads for a user's identity\n * (`internal/domain/user.go`); `companyName` is stored as a plain user\n * attribute today — there is no org/team model behind it yet.\n */\nconst USE_CASE_FIELDS: Record<SetupUseCase, readonly string[]> = {\n  minimal: [\"email\"],\n  consumer: [\"email\", \"givenName\", \"familyName\"],\n  business: [\"email\", \"givenName\", \"familyName\", \"companyName\"],\n};\n\n/**\n * JSON-Schema bodies for the optional profile fields the CLI composes in per\n * use case. The shipped templates are an email-only baseline (shared verbatim\n * with the Go server fallback), so this catalog owns every field beyond\n * `email`. Authored in the templates' style — no `x-claim`, since the backend\n * maps identity by attribute name and the user-property meta-schema defines no\n * claim keyword. `givenName`/`familyName` are the attributes the backend reads\n * for a user's identity (`internal/domain/user.go`).\n */\nconst EXTRA_FIELD_BODIES: Record<string, Record<string, unknown>> = {\n  givenName: {\n    type: \"string\",\n    maxLength: 50,\n    description: \"The user's given (first) name.\",\n  },\n  familyName: {\n    type: \"string\",\n    maxLength: 50,\n    description: \"The user's family (last) name.\",\n  },\n  companyName: {\n    type: \"string\",\n    maxLength: 200,\n    description: \"The user's company name.\",\n  },\n};\n\nfunction useCaseFields(useCase: string): readonly string[] {\n  // Own-property check, same rationale as presetTemplates: keep prototype\n  // keys (\"__proto__\" etc.) from resolving to a real field list.\n  if (!Object.hasOwn(USE_CASE_FIELDS, useCase)) {\n    throw new Error(\n      `unknown setup use case ${JSON.stringify(useCase)} (known use cases: ${SETUP_USE_CASES.join(\", \")})`,\n    );\n  }\n  return USE_CASE_FIELDS[useCase as SetupUseCase];\n}\n\n/**\n * The body for one use-case field: reuse the template's authored body when it\n * has one (so composed schemas match the shipped defaults for shared fields),\n * else the extra catalog, else a generic editable string so composition stays\n * total for any field a future use case introduces.\n */\nfunction fieldBody(\n  field: string,\n  templateProps: Record<string, Record<string, unknown>>,\n): Record<string, unknown> {\n  if (Object.hasOwn(templateProps, field)) {\n    return { ...templateProps[field] };\n  }\n  if (Object.hasOwn(EXTRA_FIELD_BODIES, field)) {\n    return { ...EXTRA_FIELD_BODIES[field] };\n  }\n  return { type: \"string\", description: `The user's ${field}.` };\n}\n\n/**\n * Narrow a rendered schema to the chosen use case: keep the preset-owned\n * header and `x-auth-methods`, but replace `properties`/`required` with the\n * use case's field set. `email` is the sole required property.\n */\nfunction applyUseCaseToSchema(\n  schema: Record<string, unknown>,\n  useCase: string,\n): Record<string, unknown> {\n  const templateProps = (schema.properties ?? {}) as Record<string, Record<string, unknown>>;\n  const properties: Record<string, unknown> = {};\n  for (const field of useCaseFields(useCase)) {\n    properties[field] = fieldBody(field, templateProps);\n  }\n  return { ...schema, required: [\"email\"], properties };\n}\n\n/**\n * Derive the flow's register-step fields from the use case rather than\n * copying a hard-coded list into every bundle (#448): the register step\n * collects exactly what the schema defines. Other steps are untouched.\n */\nfunction applyUseCaseToFlow(\n  flow: Record<string, unknown>,\n  useCase: string,\n): Record<string, unknown> {\n  const fields = [...useCaseFields(useCase)];\n  const steps = (flow.steps as Array<Record<string, unknown>>).map((step) =>\n    step.name === \"register\" ? { ...step, fields } : step,\n  );\n  return { ...flow, steps };\n}\n\nexport type DefaultConfigRenderOptions = {\n  builtinSchemaBase?: string;\n  userSchemaUrl?: string;\n  /** Which flow/auth bundle to render; defaults to {@link DEFAULT_SETUP_PRESET}. */\n  preset?: string;\n  /** Which field set to collect; defaults to {@link DEFAULT_SETUP_USE_CASE}. */\n  useCase?: string;\n};\n\nexport function defaultHumanUserSchemaUrl(builtinSchemaBase = DEFAULT_BUILTIN_SCHEMA_BASE): string {\n  return `${trimTrailingSlash(builtinSchemaBase)}/default-human-user.json`;\n}\n\nexport function getDefaultHumanUserSchema(\n  options: DefaultConfigRenderOptions = {},\n): CreateSchemaBody {\n  const builtinSchemaBase = trimTrailingSlash(\n    options.builtinSchemaBase ?? DEFAULT_BUILTIN_SCHEMA_BASE,\n  );\n  const rendered = renderTemplate(presetTemplates(options.preset ?? DEFAULT_SETUP_PRESET).schema, {\n    SERVER_URL: builtinSchemaBase,\n    USER_SCHEMA_URL: options.userSchemaUrl ?? defaultHumanUserSchemaUrl(builtinSchemaBase),\n  }) as Record<string, unknown>;\n  return applyUseCaseToSchema(\n    rendered,\n    options.useCase ?? DEFAULT_SETUP_USE_CASE,\n  ) as CreateSchemaBody;\n}\n\nexport function getDefaultLoginFlow(\n  options: DefaultConfigRenderOptions = {},\n): CreateFlowDefinitionBodyFlowDefinition {\n  const builtinSchemaBase = trimTrailingSlash(\n    options.builtinSchemaBase ?? DEFAULT_BUILTIN_SCHEMA_BASE,\n  );\n  const rendered = renderTemplate(presetTemplates(options.preset ?? DEFAULT_SETUP_PRESET).flow, {\n    SERVER_URL: builtinSchemaBase,\n    USER_SCHEMA_URL: options.userSchemaUrl ?? defaultHumanUserSchemaUrl(builtinSchemaBase),\n  }) as Record<string, unknown>;\n  return applyUseCaseToFlow(\n    rendered,\n    options.useCase ?? DEFAULT_SETUP_USE_CASE,\n  ) as CreateFlowDefinitionBodyFlowDefinition;\n}\n\nfunction renderTemplate(value: unknown, replacements: Record<string, string>): unknown {\n  if (Array.isArray(value)) {\n    return value.map((item) => renderTemplate(item, replacements));\n  }\n  if (value !== null && typeof value === \"object\") {\n    return Object.fromEntries(\n      Object.entries(value).map(([key, item]) => [key, renderTemplate(item, replacements)]),\n    );\n  }\n  if (typeof value === \"string\") {\n    return value.replaceAll(/\\$\\{([A-Z_]+)\\}/g, (match, name: string) => {\n      return replacements[name] ?? match;\n    });\n  }\n  return value;\n}\n\nfunction trimTrailingSlash(value: string): string {\n  let trimmed = value;\n  while (trimmed.endsWith(\"/\")) {\n    trimmed = trimmed.slice(0, -1);\n  }\n  return trimmed;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AIQA,SAAgB,uBAA+B;CAC7C,OAAO,aAAa,UAAU,mBAAmB,GAAG,MAAM;AAC5D;;;;;AAMA,SAAgB,qBAA6B;CAC3C,OAAO,aAAa,UAAU,iBAAiB,GAAG,MAAM;AAC1D;;;;;;AAOA,SAAgB,wBAAgC;CAC9C,OAAO,aAAa,UAAU,oBAAoB,GAAG,MAAM;AAC7D;AAEA,SAAS,UAAU,UAA0B;CAC3C,OAAO,cAAc,IAAI,IAAI,eAAe,YAAY,YAAY,GAAG,CAAC;AAC1E;;;ACVA,MAAa,8BAA8B;AAC3C,MAAa,0BAA0B;AACvC,MAAa,6BAA6B;AAC1C,MAAa,2BAA2B;AACxC,MAAa,+BAA+B;AAC5C,MAAa,iCAAiC;;;;;;;;AAS9C,MAAa,gBAAgB,CAAC,kBAAkB,eAAe;AAI/D,MAAa,uBAAoC;AAEjD,MAAM,mBAA4E;CAChF,kBAAkB;EAChB,QAAQA;EACR,MAAMC;CACR;CACA,iBAAiB;EACf,QAAQC;EACR,MAAMC;CACR;AACF;AAEA,SAAS,gBAAgB,QAAoD;CAI3E,IAAI,CAAC,OAAO,OAAO,kBAAkB,MAAM,GACzC,MAAM,IAAI,MACR,wBAAwB,KAAK,UAAU,MAAM,EAAE,mBAAmB,cAAc,KAAK,IAAI,EAAE,EAC7F;CAEF,OAAO,iBAAiB;AAC1B;;;;;;;;;;;AAYA,MAAa,mBAAmB,CAAC,YAAY,SAAS;AAItD,MAAa,0BAA0C;;;;;;;AAQvD,MAAM,iBAAqD;CACzD,UAAU;CACV,SAAS;AACX;;;;;;AAkBA,SAAgB,yBACd,SAAiB,yBACM;CACvB,IAAI,CAAC,OAAO,OAAO,gBAAgB,MAAM,GACvC,MAAM,IAAI,MACR,2BAA2B,KAAK,UAAU,MAAM,EAAE,mBAAmB,iBAAiB,KAAK,IAAI,EAAE,EACnG;CAEF,MAAM,QAAQ;CACd,OAAO;EACL,UAAU;GACR,QAAQ,eAAe;GACvB,iBAAiB,EAAE,OAAO,iBAAiB;EAC7C;EACA,UAAU,aAAa,gBAAgB,wBAAwB,MAAM,cAAc,GAAG,MAAM;CAC9F;AACF;;;;;;;AAQA,SAAS,gBAAgB,UAA0B;CACjD,MAAM,OAAO,cAAc,IAAI,IAAI,UAAU,YAAY,GAAG,CAAC;CAC7D,OAAO,KAAK,WAAW,OAAO,IAAI,KAAK,MAAM,CAAa,IAAI;AAChE;;;;;;;;;AAUA,MAAa,kBAAkB;CAAC;CAAW;CAAY;AAAU;AAIjE,MAAa,yBAAuC;;;;;;;;;AAUpD,MAAM,kBAA2D;CAC/D,SAAS,CAAC,OAAO;CACjB,UAAU;EAAC;EAAS;EAAa;CAAY;CAC7C,UAAU;EAAC;EAAS;EAAa;EAAc;CAAa;AAC9D;;;;;;;;;;AAWA,MAAM,qBAA8D;CAClE,WAAW;EACT,MAAM;EACN,WAAW;EACX,aAAa;CACf;CACA,YAAY;EACV,MAAM;EACN,WAAW;EACX,aAAa;CACf;CACA,aAAa;EACX,MAAM;EACN,WAAW;EACX,aAAa;CACf;AACF;AAEA,SAAS,cAAc,SAAoC;CAGzD,IAAI,CAAC,OAAO,OAAO,iBAAiB,OAAO,GACzC,MAAM,IAAI,MACR,0BAA0B,KAAK,UAAU,OAAO,EAAE,qBAAqB,gBAAgB,KAAK,IAAI,EAAE,EACpG;CAEF,OAAO,gBAAgB;AACzB;;;;;;;AAQA,SAAS,UACP,OACA,eACyB;CACzB,IAAI,OAAO,OAAO,eAAe,KAAK,GACpC,OAAO,EAAE,GAAG,cAAc,OAAO;CAEnC,IAAI,OAAO,OAAO,oBAAoB,KAAK,GACzC,OAAO,EAAE,GAAG,mBAAmB,OAAO;CAExC,OAAO;EAAE,MAAM;EAAU,aAAa,cAAc,MAAM;CAAG;AAC/D;;;;;;AAOA,SAAS,qBACP,QACA,SACyB;CACzB,MAAM,gBAAiB,OAAO,cAAc,CAAC;CAC7C,MAAM,aAAsC,CAAC;CAC7C,KAAK,MAAM,SAAS,cAAc,OAAO,GACvC,WAAW,SAAS,UAAU,OAAO,aAAa;CAEpD,OAAO;EAAE,GAAG;EAAQ,UAAU,CAAC,OAAO;EAAG;CAAW;AACtD;;;;;;AAOA,SAAS,mBACP,MACA,SACyB;CACzB,MAAM,SAAS,CAAC,GAAG,cAAc,OAAO,CAAC;CACzC,MAAM,QAAS,KAAK,MAAyC,KAAK,SAChE,KAAK,SAAS,aAAa;EAAE,GAAG;EAAM;CAAO,IAAI,IACnD;CACA,OAAO;EAAE,GAAG;EAAM;CAAM;AAC1B;AAWA,SAAgB,0BAA0B,oBAAoB,6BAAqC;CACjG,OAAO,GAAG,kBAAkB,iBAAiB,EAAE;AACjD;AAEA,SAAgB,0BACd,UAAsC,CAAC,GACrB;CAClB,MAAM,oBAAoB,kBACxB,QAAQ,qBAAA,iCACV;CAKA,OAAO,qBAJU,eAAe,gBAAgB,QAAQ,UAAA,gBAA8B,CAAC,CAAC,QAAQ;EAC9F,YAAY;EACZ,iBAAiB,QAAQ,iBAAiB,0BAA0B,iBAAiB;CACvF,CAES,GACP,QAAQ,WAAA,SACV;AACF;AAEA,SAAgB,oBACd,UAAsC,CAAC,GACC;CACxC,MAAM,oBAAoB,kBACxB,QAAQ,qBAAA,iCACV;CAKA,OAAO,mBAJU,eAAe,gBAAgB,QAAQ,UAAA,gBAA8B,CAAC,CAAC,MAAM;EAC5F,YAAY;EACZ,iBAAiB,QAAQ,iBAAiB,0BAA0B,iBAAiB;CACvF,CAES,GACP,QAAQ,WAAA,SACV;AACF;AAEA,SAAS,eAAe,OAAgB,cAA+C;CACrF,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,MAAM,KAAK,SAAS,eAAe,MAAM,YAAY,CAAC;CAE/D,IAAI,UAAU,QAAQ,OAAO,UAAU,UACrC,OAAO,OAAO,YACZ,OAAO,QAAQ,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,UAAU,CAAC,KAAK,eAAe,MAAM,YAAY,CAAC,CAAC,CACtF;CAEF,IAAI,OAAO,UAAU,UACnB,OAAO,MAAM,WAAW,qBAAqB,OAAO,SAAiB;EACnE,OAAO,aAAa,SAAS;CAC/B,CAAC;CAEH,OAAO;AACT;AAEA,SAAS,kBAAkB,OAAuB;CAChD,IAAI,UAAU;CACd,OAAO,QAAQ,SAAS,GAAG,GACzB,UAAU,QAAQ,MAAM,GAAG,EAAE;CAE/B,OAAO;AACT"}

package/dist/defaults.d.mts

@@ -1,2 +1,2 @@
-import { C as flowsReadmeContent, S as brandingReadmeContent, _ as SetupUseCase, a as DEFAULT_BRANDING_TEMPLATE_PATH, b as getDefaultHumanUserSchema, c as DEFAULT_FLOW_SCHEMA_URI, d as DEFAULT_SETUP_USE_CASE, f as DefaultBrandingConfig, g as SetupPreset, h as SETUP_USE_CASES, i as DEFAULT_BRANDING_DESIGN, l as DEFAULT_SCHEMA_CONFIG_PATH, m as SETUP_PRESETS, n as BrandingDesign, o as DEFAULT_BUILTIN_SCHEMA_BASE, p as DefaultConfigRenderOptions, r as DEFAULT_BRANDING_CONFIG_PATH, s as DEFAULT_FLOW_CONFIG_PATH, t as BRANDING_DESIGNS, u as DEFAULT_SETUP_PRESET, v as defaultHumanUserSchemaUrl, w as schemasReadmeContent, x as getDefaultLoginFlow, y as getDefaultBrandingConfig } from "./defaults-BxGCGdqS.mjs";
+import { C as flowsReadmeContent, S as brandingReadmeContent, _ as SetupUseCase, a as DEFAULT_BRANDING_TEMPLATE_PATH, b as getDefaultHumanUserSchema, c as DEFAULT_FLOW_SCHEMA_URI, d as DEFAULT_SETUP_USE_CASE, f as DefaultBrandingConfig, g as SetupPreset, h as SETUP_USE_CASES, i as DEFAULT_BRANDING_DESIGN, l as DEFAULT_SCHEMA_CONFIG_PATH, m as SETUP_PRESETS, n as BrandingDesign, o as DEFAULT_BUILTIN_SCHEMA_BASE, p as DefaultConfigRenderOptions, r as DEFAULT_BRANDING_CONFIG_PATH, s as DEFAULT_FLOW_CONFIG_PATH, t as BRANDING_DESIGNS, u as DEFAULT_SETUP_PRESET, v as defaultHumanUserSchemaUrl, w as schemasReadmeContent, x as getDefaultLoginFlow, y as getDefaultBrandingConfig } from "./defaults-BtKIcWxW.mjs";
 export { BRANDING_DESIGNS, BrandingDesign, DEFAULT_BRANDING_CONFIG_PATH, DEFAULT_BRANDING_DESIGN, DEFAULT_BRANDING_TEMPLATE_PATH, DEFAULT_BUILTIN_SCHEMA_BASE, DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, DEFAULT_SETUP_PRESET, DEFAULT_SETUP_USE_CASE, DefaultBrandingConfig, DefaultConfigRenderOptions, SETUP_PRESETS, SETUP_USE_CASES, SetupPreset, SetupUseCase, brandingReadmeContent, defaultHumanUserSchemaUrl, flowsReadmeContent, getDefaultBrandingConfig, getDefaultHumanUserSchema, getDefaultLoginFlow, schemasReadmeContent };

package/dist/defaults.mjs

@@ -1,2 +1,2 @@
-import { _ as brandingReadmeContent, a as DEFAULT_BUILTIN_SCHEMA_BASE, c as DEFAULT_SCHEMA_CONFIG_PATH, d as SETUP_PRESETS, f as SETUP_USE_CASES, g as getDefaultLoginFlow, h as getDefaultHumanUserSchema, i as DEFAULT_BRANDING_TEMPLATE_PATH, l as DEFAULT_SETUP_PRESET, m as getDefaultBrandingConfig, n as DEFAULT_BRANDING_CONFIG_PATH, o as DEFAULT_FLOW_CONFIG_PATH, p as defaultHumanUserSchemaUrl, r as DEFAULT_BRANDING_DESIGN, s as DEFAULT_FLOW_SCHEMA_URI, t as BRANDING_DESIGNS, u as DEFAULT_SETUP_USE_CASE, v as flowsReadmeContent, y as schemasReadmeContent } from "./defaults-DV6hY2KT.mjs";
+import { _ as brandingReadmeContent, a as DEFAULT_BUILTIN_SCHEMA_BASE, c as DEFAULT_SCHEMA_CONFIG_PATH, d as SETUP_PRESETS, f as SETUP_USE_CASES, g as getDefaultLoginFlow, h as getDefaultHumanUserSchema, i as DEFAULT_BRANDING_TEMPLATE_PATH, l as DEFAULT_SETUP_PRESET, m as getDefaultBrandingConfig, n as DEFAULT_BRANDING_CONFIG_PATH, o as DEFAULT_FLOW_CONFIG_PATH, p as defaultHumanUserSchemaUrl, r as DEFAULT_BRANDING_DESIGN, s as DEFAULT_FLOW_SCHEMA_URI, t as BRANDING_DESIGNS, u as DEFAULT_SETUP_USE_CASE, v as flowsReadmeContent, y as schemasReadmeContent } from "./defaults-COLBFU3S.mjs";
 export { BRANDING_DESIGNS, DEFAULT_BRANDING_CONFIG_PATH, DEFAULT_BRANDING_DESIGN, DEFAULT_BRANDING_TEMPLATE_PATH, DEFAULT_BUILTIN_SCHEMA_BASE, DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, DEFAULT_SETUP_PRESET, DEFAULT_SETUP_USE_CASE, SETUP_PRESETS, SETUP_USE_CASES, brandingReadmeContent, defaultHumanUserSchemaUrl, flowsReadmeContent, getDefaultBrandingConfig, getDefaultHumanUserSchema, getDefaultLoginFlow, schemasReadmeContent };

package/dist/idp/index.d.mts

@@ -0,0 +1,2 @@
+import { a as ISSUER_REQUIREMENT, c as ConnectionEndpoints, d as ScaffoldOptions, f as credentialVariable, g as variableReference, h as referencedVariable, i as OidcProvider, l as CredentialVariables, m as isVariableReference, n as idpProvider, o as isSupportedIssuer, p as credentialVariables, r as GoogleProvider, s as CallbackGuidance, t as IDP_PROVIDERS, u as IdpProvider } from "../index-Cuxu-zQD.mjs";
+export { type CallbackGuidance, type ConnectionEndpoints, type CredentialVariables, GoogleProvider, IDP_PROVIDERS, ISSUER_REQUIREMENT, type IdpProvider, OidcProvider, type ScaffoldOptions, credentialVariable, credentialVariables, idpProvider, isSupportedIssuer, isVariableReference, referencedVariable, variableReference };

package/dist/idp/index.mjs

@@ -0,0 +1,2 @@
+import { a as GoogleProvider, c as credentialVariables, d as variableReference, i as isSupportedIssuer, l as isVariableReference, n as idpProvider, o as OidcProvider, r as ISSUER_REQUIREMENT, s as credentialVariable, t as IDP_PROVIDERS, u as referencedVariable } from "../idp-ByzXQN85.mjs";
+export { GoogleProvider, IDP_PROVIDERS, ISSUER_REQUIREMENT, OidcProvider, credentialVariable, credentialVariables, idpProvider, isSupportedIssuer, isVariableReference, referencedVariable, variableReference };

package/dist/idp-ByzXQN85.mjs

@@ -0,0 +1,207 @@
+import { t as idp_connection_default } from "./idp-connection-CHxGm1Wr.mjs";
+//#region src/idp/provider.ts
+/**
+* The variables a connection scaffolded under `slug` references.
+*
+* Derived from the slug rather than the provider: a Project may hold a second
+* connection for the same provider under a slug of its own, and its
+* credentials belong to that connection, not to the provider.
+*/
+function credentialVariables(slug) {
+	return {
+		clientId: credentialVariable(slug, "CLIENT_ID"),
+		clientSecret: credentialVariable(slug, "CLIENT_SECRET")
+	};
+}
+/**
+* A credential's variable name: the slug uppercased with every non-alphanumeric
+* replaced by `_`, then the suffix. A slug may start with a digit, which no
+* shell accepts as the first character of a name, so such a name gains a `_`.
+*/
+function credentialVariable(slug, suffix) {
+	const name = `${slug.toUpperCase().replace(/[^A-Z0-9]/g, "_")}_${suffix}`;
+	return /^[0-9]/.test(name) ? `_${name}` : name;
+}
+/**
+* The `${{ NAME }}` reference written to a credential field, as
+* `idp-connection.json` requires: a whole-value placeholder, with no text
+* around it that would be rendered into the resolved credential.
+*/
+function variableReference(name) {
+	return `\${{ ${name} }}`;
+}
+/**
+* The variable a `${{ NAME }}` reference names, or `undefined` when the value
+* is not one.
+*
+* A connection is editable, so the name it references need not be the one this
+* CLI would have chosen — a hand-written file may point at `ACME_SECRET`.
+* Publishing to a name derived from the slug instead would store the credential
+* where nothing reads it and report success.
+*/
+function referencedVariable(value) {
+	return /^\$\{\{ *(\w+) *\}\}$/.exec(value.trim())?.[1];
+}
+/** Whether a stored value is a reference rather than a credential. */
+function isVariableReference(value) {
+	return referencedVariable(value) !== void 0;
+}
+//#endregion
+//#region src/idp/oidc-provider.ts
+/**
+* The parts of a connection document every OIDC provider composes the same way.
+*
+* A subclass supplies what is genuinely its own — the vendor's identity, its
+* issuer, its claim table, and any protocol settings it needs — and inherits
+* the composition. Nothing here knows about a specific vendor, so a provider
+* whose document is shaped differently overrides rather than adds a branch.
+*/
+var OidcProvider = class {
+	/** The claim that carries the provider's stable, unique id for an account. */
+	subjectClaim = "sub";
+	/**
+	* Schema property name → how its value is verified: a claim to read, `true`
+	* for a provider trusted outright, or `"$supplementary_fetch"`.
+	*
+	* Keyed by schema property, like {@link claimTable}, so it narrows with it.
+	*/
+	verifiedClaims = {};
+	/** Parameters the vendor wants on every authorization request. */
+	staticAuthorizeParameters = {};
+	claimMapping(schemaProperties) {
+		const defined = new Set(schemaProperties);
+		return Object.fromEntries(Object.entries(this.claimTable).filter(([property]) => defined.has(property)));
+	}
+	/**
+	* Compose the connection document. Pure: it returns the object the caller
+	* writes to `.zitadel/idps/<slug>.json`, and performs no IO.
+	*
+	* Neither credential is written into it. Both are `${{ NAME }}` references to
+	* project variables: the secret because the document is committed and a
+	* revision is immutable, so a literal could never be scrubbed; the id because
+	* each environment registers its own application, and a literal would force
+	* one connection file per environment.
+	*
+	* Endpoints are named only when the connection points somewhere other than
+	* the vendor, and then only the issuer. The engine accepts a connection
+	* naming every endpoint or none, and it needs four — so a subset is rejected,
+	* and a stand-in serves its own discovery document as the vendor does.
+	*/
+	connection(options) {
+		const slug = options.slug ?? this.slug;
+		const claimMapping = this.claimMapping(options.schemaProperties);
+		const verifiedClaims = Object.fromEntries(Object.entries(this.verifiedClaims).filter(([property]) => property in claimMapping));
+		const issuer = options.endpoints?.issuer;
+		const variables = credentialVariables(slug);
+		return {
+			...options.schemaRef ? { $schema: options.schemaRef } : {},
+			slug,
+			protocol: "oidc",
+			template: this.template,
+			display_name: this.displayName,
+			subject_claim: this.subjectClaim,
+			...Object.keys(verifiedClaims).length > 0 ? { verified_claims: verifiedClaims } : {},
+			...Object.keys(claimMapping).length > 0 ? { claim_mapping: claimMapping } : {},
+			provisioning: { creation: "auto" },
+			oidc: {
+				issuer: issuer !== void 0 && issuer !== "" ? issuer : this.issuer,
+				scopes: [...this.scopes],
+				...Object.keys(this.staticAuthorizeParameters).length > 0 ? { static_authorize_parameters: { ...this.staticAuthorizeParameters } } : {},
+				client_id: variableReference(variables.clientId),
+				client_secret: variableReference(variables.clientSecret)
+			}
+		};
+	}
+};
+//#endregion
+//#region src/idp/google.ts
+/**
+* Google, as `zitadel setup` and `sso enable` scaffold it.
+*
+* Everything here is Google's own documented behaviour, cross-checked against
+* its discovery document and the provider packages in zitadel/zitadel. It names
+* no endpoints: Google publishes a discovery document, its endpoints do not
+* share the issuer's host, and the engine resolves them at runtime — so a value
+* committed here would be a guess that ages.
+*/
+var GoogleProvider = class extends OidcProvider {
+	slug = "google";
+	displayName = "Google";
+	template = "google";
+	consoleUrl = "https://console.cloud.google.com/apis/credentials";
+	docsUrl = "https://developers.google.com/identity/openid-connect/openid-connect";
+	/** One client takes many redirect URIs, so one application serves every environment. */
+	callbackGuidance = "multi_uri_client";
+	issuer = "https://accounts.google.com";
+	claimTable = {
+		email: "email",
+		givenName: "given_name",
+		familyName: "family_name"
+	};
+	scopes = [
+		"openid",
+		"profile",
+		"email"
+	];
+	/** `sub` never changes, unlike an email, so identity keys on it. */
+	subjectClaim = "sub";
+	verifiedClaims = { email: "email_verified" };
+	/** Google reuses a signed-in session silently without it. */
+	staticAuthorizeParameters = { prompt: "select_account" };
+};
+//#endregion
+//#region src/idp/issuer.ts
+/**
+* The issuer values a connection may name: HTTPS anywhere, or HTTP on
+* `localhost`/`127.0.0.1` for a local stand-in.
+*
+* Read out of the generated meta-schema rather than restated here, so a prompt
+* that accepts a value and the document written from it cannot disagree. That
+* file is generated from the OpenAPI YAML the server embeds, which makes it
+* also what the server will enforce — `http://idp.internal:9100` would be
+* taken by a hand-rolled URL check and then rejected on apply.
+*/
+function issuerPattern() {
+	const pattern = ((idp_connection_default.properties?.oidc)?.properties?.issuer)?.pattern;
+	if (typeof pattern !== "string") throw new Error("idp-connection.json no longer states properties.oidc.properties.issuer.pattern");
+	return new RegExp(pattern);
+}
+let compiled;
+/** Whether a connection may name this issuer. */
+function isSupportedIssuer(value) {
+	compiled ??= issuerPattern();
+	return compiled.test(value.trim());
+}
+/** What to tell someone who typed an issuer the contract does not allow. */
+const ISSUER_REQUIREMENT = "Use an https:// URL, or http:// on localhost or 127.0.0.1.";
+//#endregion
+//#region src/idp/index.ts
+/**
+* The providers `zitadel setup` and `sso enable` can scaffold a connection for.
+*
+* Adding one means adding a class and listing it here. That is a code change
+* rather than a data change, which is the point: a provider is not only a table
+* of values, and the ones that differ — OAuth2 rather than OIDC, a second
+* request to read an email, a claim the vendor does not emit — differ in
+* behaviour. Holding that in the provider keeps it out of the callers.
+*/
+const PROVIDERS = Object.freeze([new GoogleProvider()]);
+const BY_SLUG = new Map(PROVIDERS.map((provider) => [provider.slug, provider]));
+/** Every provider's slug, in listing order. The `--provider` flag takes one. */
+const IDP_PROVIDERS = Object.freeze(PROVIDERS.map((provider) => provider.slug));
+/**
+* One provider by slug.
+*
+* Throws rather than returning `undefined`: every caller has already had the
+* slug validated against {@link IDP_PROVIDERS}, so a miss here is a bug in this
+* package and not something a caller can act on.
+*/
+function idpProvider(slug) {
+	const provider = BY_SLUG.get(slug);
+	if (provider === void 0) throw new Error(`unknown identity provider ${JSON.stringify(slug)} (known providers: ${IDP_PROVIDERS.join(", ")})`);
+	return provider;
+}
+//#endregion
+export { GoogleProvider as a, credentialVariables as c, variableReference as d, isSupportedIssuer as i, isVariableReference as l, idpProvider as n, OidcProvider as o, ISSUER_REQUIREMENT as r, credentialVariable as s, IDP_PROVIDERS as t, referencedVariable as u };
+
+//# sourceMappingURL=idp-ByzXQN85.mjs.map

package/dist/idp-ByzXQN85.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"idp-ByzXQN85.mjs","names":["idpConnectionMetaSchema"],"sources":["../src/idp/provider.ts","../src/idp/oidc-provider.ts","../src/idp/google.ts","../src/idp/issuer.ts","../src/idp/index.ts"],"sourcesContent":["/**\n * What the CLI needs to know about one identity provider to scaffold a working\n * connection for it: how to name it, where to send the developer to register an\n * application, and how to compose the connection document.\n *\n * One class per provider, because a provider is not only a table of values.\n * Google is pure data today; GitHub speaks OAuth2 rather than OIDC, has no\n * family-name claim, and needs a second request to read an email at all. A\n * shape that only holds data forces that behaviour somewhere else, where it\n * stops being the provider's business and starts being a branch in shared code.\n */\n\n/**\n * Whether the vendor accepts many redirect URIs on a single client, or needs a\n * separate application per environment. Surfaced when the developer is told\n * what to register, so they register the right thing.\n */\nexport type CallbackGuidance = \"multi_uri_client\" | \"app_per_environment\";\n\n/** Where a connection points, when not at the vendor. */\nexport type ConnectionEndpoints = {\n  readonly issuer?: string;\n};\n\n/** What a connection document needs beyond the provider's own knowledge. */\nexport type ScaffoldOptions = {\n  /** Properties the target user schema defines, which bounds the claim mapping. */\n  readonly schemaProperties: Iterable<string>;\n  /** Slug to write under; defaults to the provider's own. */\n  readonly slug?: string;\n  /** `$schema` pointer, relative to `.zitadel/idps/`. */\n  readonly schemaRef?: string;\n  /** Point the connection somewhere other than the vendor (local testing). */\n  readonly endpoints?: ConnectionEndpoints;\n};\n\nexport interface IdpProvider {\n  /** Default connection slug, and the name `--provider` takes. */\n  readonly slug: string;\n  /** Written to the connection and shown on the sign-in button. */\n  readonly displayName: string;\n  /**\n   * Written to the connection as `template`. Keys vendor knowledge only —\n   * glyphs, button branding, the setup scan — and carries no protocol\n   * behaviour.\n   */\n  readonly template: string;\n  /** Where the developer registers the application. */\n  readonly consoleUrl: string;\n  /** The vendor's own integration documentation. */\n  readonly docsUrl: string;\n  readonly callbackGuidance: CallbackGuidance;\n  /** The issuer the vendor publishes, and the default when one is asked for. */\n  readonly issuer: string;\n  /**\n   * The claims this provider emits, keyed by schema property name, narrowed to\n   * the properties the target schema actually defines.\n   */\n  claimMapping(schemaProperties: Iterable<string>): Record<string, string>;\n  /** The document `zitadel setup` writes to `.zitadel/idps/<slug>.json`. */\n  connection(options: ScaffoldOptions): Record<string, unknown>;\n}\n\n/** The project variables a connection's two credentials reference. */\nexport type CredentialVariables = {\n  readonly clientId: string;\n  readonly clientSecret: string;\n};\n\n/**\n * The variables a connection scaffolded under `slug` references.\n *\n * Derived from the slug rather than the provider: a Project may hold a second\n * connection for the same provider under a slug of its own, and its\n * credentials belong to that connection, not to the provider.\n */\nexport function credentialVariables(slug: string): CredentialVariables {\n  return {\n    clientId: credentialVariable(slug, \"CLIENT_ID\"),\n    clientSecret: credentialVariable(slug, \"CLIENT_SECRET\"),\n  };\n}\n\n/**\n * A credential's variable name: the slug uppercased with every non-alphanumeric\n * replaced by `_`, then the suffix. A slug may start with a digit, which no\n * shell accepts as the first character of a name, so such a name gains a `_`.\n */\nexport function credentialVariable(slug: string, suffix: string): string {\n  const name = `${slug.toUpperCase().replace(/[^A-Z0-9]/g, \"_\")}_${suffix}`;\n  return /^[0-9]/.test(name) ? `_${name}` : name;\n}\n\n/**\n * The `${{ NAME }}` reference written to a credential field, as\n * `idp-connection.json` requires: a whole-value placeholder, with no text\n * around it that would be rendered into the resolved credential.\n */\nexport function variableReference(name: string): string {\n  return `\\${{ ${name} }}`;\n}\n\n/**\n * The variable a `${{ NAME }}` reference names, or `undefined` when the value\n * is not one.\n *\n * A connection is editable, so the name it references need not be the one this\n * CLI would have chosen — a hand-written file may point at `ACME_SECRET`.\n * Publishing to a name derived from the slug instead would store the credential\n * where nothing reads it and report success.\n */\nexport function referencedVariable(value: string): string | undefined {\n  return /^\\$\\{\\{ *(\\w+) *\\}\\}$/.exec(value.trim())?.[1];\n}\n\n/** Whether a stored value is a reference rather than a credential. */\nexport function isVariableReference(value: string): boolean {\n  return referencedVariable(value) !== undefined;\n}\n","import {\n  credentialVariables,\n  variableReference,\n  type CallbackGuidance,\n  type IdpProvider,\n  type ScaffoldOptions,\n} from \"./provider.js\";\n\n/**\n * The parts of a connection document every OIDC provider composes the same way.\n *\n * A subclass supplies what is genuinely its own — the vendor's identity, its\n * issuer, its claim table, and any protocol settings it needs — and inherits\n * the composition. Nothing here knows about a specific vendor, so a provider\n * whose document is shaped differently overrides rather than adds a branch.\n */\nexport abstract class OidcProvider implements IdpProvider {\n  abstract readonly slug: string;\n  abstract readonly displayName: string;\n  abstract readonly template: string;\n  abstract readonly consoleUrl: string;\n  abstract readonly docsUrl: string;\n  abstract readonly callbackGuidance: CallbackGuidance;\n  abstract readonly issuer: string;\n\n  /**\n   * Schema property name → the claim this provider documents for it.\n   *\n   * Authored per provider rather than derived: each row pairs a property with\n   * the vendor's documented claim name, and a wrong one fails silently — the\n   * claim is never found and the property stays unmapped.\n   */\n  protected abstract readonly claimTable: Readonly<Record<string, string>>;\n\n  /** Scopes the connection requests. */\n  protected abstract readonly scopes: readonly string[];\n\n  /** The claim that carries the provider's stable, unique id for an account. */\n  protected readonly subjectClaim: string = \"sub\";\n\n  /**\n   * Schema property name → how its value is verified: a claim to read, `true`\n   * for a provider trusted outright, or `\"$supplementary_fetch\"`.\n   *\n   * Keyed by schema property, like {@link claimTable}, so it narrows with it.\n   */\n  protected readonly verifiedClaims: Readonly<Record<string, string | true>> = {};\n\n  /** Parameters the vendor wants on every authorization request. */\n  protected readonly staticAuthorizeParameters: Readonly<Record<string, string>> = {};\n\n  claimMapping(schemaProperties: Iterable<string>): Record<string, string> {\n    const defined = new Set(schemaProperties);\n    return Object.fromEntries(\n      Object.entries(this.claimTable).filter(([property]) => defined.has(property)),\n    );\n  }\n\n  /**\n   * Compose the connection document. Pure: it returns the object the caller\n   * writes to `.zitadel/idps/<slug>.json`, and performs no IO.\n   *\n   * Neither credential is written into it. Both are `${{ NAME }}` references to\n   * project variables: the secret because the document is committed and a\n   * revision is immutable, so a literal could never be scrubbed; the id because\n   * each environment registers its own application, and a literal would force\n   * one connection file per environment.\n   *\n   * Endpoints are named only when the connection points somewhere other than\n   * the vendor, and then only the issuer. The engine accepts a connection\n   * naming every endpoint or none, and it needs four — so a subset is rejected,\n   * and a stand-in serves its own discovery document as the vendor does.\n   */\n  connection(options: ScaffoldOptions): Record<string, unknown> {\n    const slug = options.slug ?? this.slug;\n    const claimMapping = this.claimMapping(options.schemaProperties);\n    // Verification is of a mapped value, so it narrows to what was mapped: a\n    // schema without `email` gets no email mapping, and an `email` entry here\n    // would then claim to verify a value this connection never supplies.\n    const verifiedClaims = Object.fromEntries(\n      Object.entries(this.verifiedClaims).filter(([property]) => property in claimMapping),\n    );\n    const issuer = options.endpoints?.issuer;\n    const variables = credentialVariables(slug);\n    return {\n      ...(options.schemaRef ? { $schema: options.schemaRef } : {}),\n      slug,\n      protocol: \"oidc\",\n      template: this.template,\n      display_name: this.displayName,\n      subject_claim: this.subjectClaim,\n      ...(Object.keys(verifiedClaims).length > 0 ? { verified_claims: verifiedClaims } : {}),\n      ...(Object.keys(claimMapping).length > 0 ? { claim_mapping: claimMapping } : {}),\n      provisioning: { creation: \"auto\" },\n      oidc: {\n        issuer: issuer !== undefined && issuer !== \"\" ? issuer : this.issuer,\n        scopes: [...this.scopes],\n        ...(Object.keys(this.staticAuthorizeParameters).length > 0\n          ? { static_authorize_parameters: { ...this.staticAuthorizeParameters } }\n          : {}),\n        client_id: variableReference(variables.clientId),\n        client_secret: variableReference(variables.clientSecret),\n      },\n    };\n  }\n}\n","import { OidcProvider } from \"./oidc-provider.js\";\nimport type { CallbackGuidance } from \"./provider.js\";\n\n/**\n * Google, as `zitadel setup` and `sso enable` scaffold it.\n *\n * Everything here is Google's own documented behaviour, cross-checked against\n * its discovery document and the provider packages in zitadel/zitadel. It names\n * no endpoints: Google publishes a discovery document, its endpoints do not\n * share the issuer's host, and the engine resolves them at runtime — so a value\n * committed here would be a guess that ages.\n */\nexport class GoogleProvider extends OidcProvider {\n  readonly slug = \"google\";\n  readonly displayName = \"Google\";\n  readonly template = \"google\";\n  readonly consoleUrl = \"https://console.cloud.google.com/apis/credentials\";\n  readonly docsUrl = \"https://developers.google.com/identity/openid-connect/openid-connect\";\n  /** One client takes many redirect URIs, so one application serves every environment. */\n  readonly callbackGuidance: CallbackGuidance = \"multi_uri_client\";\n  readonly issuer = \"https://accounts.google.com\";\n\n  protected readonly claimTable = {\n    email: \"email\",\n    givenName: \"given_name\",\n    familyName: \"family_name\",\n  };\n\n  protected readonly scopes = [\"openid\", \"profile\", \"email\"];\n\n  /** `sub` never changes, unlike an email, so identity keys on it. */\n  protected override readonly subjectClaim = \"sub\";\n\n  protected override readonly verifiedClaims = { email: \"email_verified\" };\n\n  /** Google reuses a signed-in session silently without it. */\n  protected override readonly staticAuthorizeParameters = { prompt: \"select_account\" };\n}\n","import idpConnectionMetaSchema from \"../../meta-schemas/idp-connection.json\" with { type: \"json\" };\n\n/**\n * The issuer values a connection may name: HTTPS anywhere, or HTTP on\n * `localhost`/`127.0.0.1` for a local stand-in.\n *\n * Read out of the generated meta-schema rather than restated here, so a prompt\n * that accepts a value and the document written from it cannot disagree. That\n * file is generated from the OpenAPI YAML the server embeds, which makes it\n * also what the server will enforce — `http://idp.internal:9100` would be\n * taken by a hand-rolled URL check and then rejected on apply.\n */\nfunction issuerPattern(): RegExp {\n  const oidc = (idpConnectionMetaSchema as { properties?: Record<string, unknown> }).properties\n    ?.oidc;\n  const issuer = (oidc as { properties?: Record<string, unknown> } | undefined)?.properties?.issuer;\n  const pattern = (issuer as { pattern?: unknown } | undefined)?.pattern;\n  if (typeof pattern !== \"string\") {\n    // Silently accepting everything would be the worst outcome: the prompt\n    // would go on reporting success for connections the server refuses.\n    throw new Error(\n      \"idp-connection.json no longer states properties.oidc.properties.issuer.pattern\",\n    );\n  }\n  return new RegExp(pattern);\n}\n\nlet compiled: RegExp | undefined;\n\n/** Whether a connection may name this issuer. */\nexport function isSupportedIssuer(value: string): boolean {\n  compiled ??= issuerPattern();\n  return compiled.test(value.trim());\n}\n\n/** What to tell someone who typed an issuer the contract does not allow. */\nexport const ISSUER_REQUIREMENT = \"Use an https:// URL, or http:// on localhost or 127.0.0.1.\";\n","/**\n * The providers `zitadel setup` and `sso enable` can scaffold a connection for.\n *\n * Adding one means adding a class and listing it here. That is a code change\n * rather than a data change, which is the point: a provider is not only a table\n * of values, and the ones that differ — OAuth2 rather than OIDC, a second\n * request to read an email, a claim the vendor does not emit — differ in\n * behaviour. Holding that in the provider keeps it out of the callers.\n */\nimport { GoogleProvider } from \"./google.js\";\nimport type { IdpProvider } from \"./provider.js\";\n\nconst PROVIDERS: readonly IdpProvider[] = Object.freeze([new GoogleProvider()]);\n\nconst BY_SLUG: ReadonlyMap<string, IdpProvider> = new Map(\n  PROVIDERS.map((provider) => [provider.slug, provider]),\n);\n\n/** Every provider's slug, in listing order. The `--provider` flag takes one. */\nexport const IDP_PROVIDERS: readonly string[] = Object.freeze(\n  PROVIDERS.map((provider) => provider.slug),\n);\n\n/**\n * One provider by slug.\n *\n * Throws rather than returning `undefined`: every caller has already had the\n * slug validated against {@link IDP_PROVIDERS}, so a miss here is a bug in this\n * package and not something a caller can act on.\n */\nexport function idpProvider(slug: string): IdpProvider {\n  const provider = BY_SLUG.get(slug);\n  if (provider === undefined) {\n    throw new Error(\n      `unknown identity provider ${JSON.stringify(slug)} (known providers: ${IDP_PROVIDERS.join(\", \")})`,\n    );\n  }\n  return provider;\n}\n\nexport { ISSUER_REQUIREMENT, isSupportedIssuer } from \"./issuer.js\";\n\nexport { GoogleProvider } from \"./google.js\";\nexport { OidcProvider } from \"./oidc-provider.js\";\nexport {\n  credentialVariable,\n  credentialVariables,\n  isVariableReference,\n  referencedVariable,\n  variableReference,\n  type CallbackGuidance,\n  type ConnectionEndpoints,\n  type CredentialVariables,\n  type IdpProvider,\n  type ScaffoldOptions,\n} from \"./provider.js\";\n"],"mappings":";;;;;;;;;AA4EA,SAAgB,oBAAoB,MAAmC;CACrE,OAAO;EACL,UAAU,mBAAmB,MAAM,WAAW;EAC9C,cAAc,mBAAmB,MAAM,eAAe;CACxD;AACF;;;;;;AAOA,SAAgB,mBAAmB,MAAc,QAAwB;CACvE,MAAM,OAAO,GAAG,KAAK,YAAY,CAAC,CAAC,QAAQ,cAAc,GAAG,EAAE,GAAG;CACjE,OAAO,SAAS,KAAK,IAAI,IAAI,IAAI,SAAS;AAC5C;;;;;;AAOA,SAAgB,kBAAkB,MAAsB;CACtD,OAAO,QAAQ,KAAK;AACtB;;;;;;;;;;AAWA,SAAgB,mBAAmB,OAAmC;CACpE,OAAO,wBAAwB,KAAK,MAAM,KAAK,CAAC,CAAC,GAAG;AACtD;;AAGA,SAAgB,oBAAoB,OAAwB;CAC1D,OAAO,mBAAmB,KAAK,MAAM,KAAA;AACvC;;;;;;;;;;;ACtGA,IAAsB,eAAtB,MAA0D;;CAsBxD,eAA0C;;;;;;;CAQ1C,iBAA6E,CAAC;;CAG9E,4BAAiF,CAAC;CAElF,aAAa,kBAA4D;EACvE,MAAM,UAAU,IAAI,IAAI,gBAAgB;EACxC,OAAO,OAAO,YACZ,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,QAAQ,CAAC,cAAc,QAAQ,IAAI,QAAQ,CAAC,CAC9E;CACF;;;;;;;;;;;;;;;;CAiBA,WAAW,SAAmD;EAC5D,MAAM,OAAO,QAAQ,QAAQ,KAAK;EAClC,MAAM,eAAe,KAAK,aAAa,QAAQ,gBAAgB;EAI/D,MAAM,iBAAiB,OAAO,YAC5B,OAAO,QAAQ,KAAK,cAAc,CAAC,CAAC,QAAQ,CAAC,cAAc,YAAY,YAAY,CACrF;EACA,MAAM,SAAS,QAAQ,WAAW;EAClC,MAAM,YAAY,oBAAoB,IAAI;EAC1C,OAAO;GACL,GAAI,QAAQ,YAAY,EAAE,SAAS,QAAQ,UAAU,IAAI,CAAC;GAC1D;GACA,UAAU;GACV,UAAU,KAAK;GACf,cAAc,KAAK;GACnB,eAAe,KAAK;GACpB,GAAI,OAAO,KAAK,cAAc,CAAC,CAAC,SAAS,IAAI,EAAE,iBAAiB,eAAe,IAAI,CAAC;GACpF,GAAI,OAAO,KAAK,YAAY,CAAC,CAAC,SAAS,IAAI,EAAE,eAAe,aAAa,IAAI,CAAC;GAC9E,cAAc,EAAE,UAAU,OAAO;GACjC,MAAM;IACJ,QAAQ,WAAW,KAAA,KAAa,WAAW,KAAK,SAAS,KAAK;IAC9D,QAAQ,CAAC,GAAG,KAAK,MAAM;IACvB,GAAI,OAAO,KAAK,KAAK,yBAAyB,CAAC,CAAC,SAAS,IACrD,EAAE,6BAA6B,EAAE,GAAG,KAAK,0BAA0B,EAAE,IACrE,CAAC;IACL,WAAW,kBAAkB,UAAU,QAAQ;IAC/C,eAAe,kBAAkB,UAAU,YAAY;GACzD;EACF;CACF;AACF;;;;;;;;;;;;AC7FA,IAAa,iBAAb,cAAoC,aAAa;CAC/C,OAAgB;CAChB,cAAuB;CACvB,WAAoB;CACpB,aAAsB;CACtB,UAAmB;;CAEnB,mBAA8C;CAC9C,SAAkB;CAElB,aAAgC;EAC9B,OAAO;EACP,WAAW;EACX,YAAY;CACd;CAEA,SAA4B;EAAC;EAAU;EAAW;CAAO;;CAGzD,eAA2C;CAE3C,iBAA6C,EAAE,OAAO,iBAAiB;;CAGvE,4BAAwD,EAAE,QAAQ,iBAAiB;AACrF;;;;;;;;;;;;;ACzBA,SAAS,gBAAwB;CAI/B,MAAM,YAHQA,uBAAqE,YAC/E,KAAA,EAC2E,YAAY,OAAA,EAC5B;CAC/D,IAAI,OAAO,YAAY,UAGrB,MAAM,IAAI,MACR,gFACF;CAEF,OAAO,IAAI,OAAO,OAAO;AAC3B;AAEA,IAAI;;AAGJ,SAAgB,kBAAkB,OAAwB;CACxD,aAAa,cAAc;CAC3B,OAAO,SAAS,KAAK,MAAM,KAAK,CAAC;AACnC;;AAGA,MAAa,qBAAqB;;;;;;;;;;;;ACxBlC,MAAM,YAAoC,OAAO,OAAO,CAAC,IAAI,eAAe,CAAC,CAAC;AAE9E,MAAM,UAA4C,IAAI,IACpD,UAAU,KAAK,aAAa,CAAC,SAAS,MAAM,QAAQ,CAAC,CACvD;;AAGA,MAAa,gBAAmC,OAAO,OACrD,UAAU,KAAK,aAAa,SAAS,IAAI,CAC3C;;;;;;;;AASA,SAAgB,YAAY,MAA2B;CACrD,MAAM,WAAW,QAAQ,IAAI,IAAI;CACjC,IAAI,aAAa,KAAA,GACf,MAAM,IAAI,MACR,6BAA6B,KAAK,UAAU,IAAI,EAAE,qBAAqB,cAAc,KAAK,IAAI,EAAE,EAClG;CAEF,OAAO;AACT"}