@zitadel/config 1.0.0-alpha.23 → 1.0.0-alpha.25

package/dist/{meta-schemas-OowgSUfU.mjs → meta-schemas-C03zgFux.mjs}

@@ -1,3 +1,4 @@
+import { t as idp_connection_default } from "./idp-connection-CHxGm1Wr.mjs";
 //#region meta-schemas/auth-method.json
 var auth_method_default = {
 	$comment: "Code generated by scripts/generate-meta-schemas.ts; DO NOT EDIT.",
@@ -46,7 +47,7 @@ var branding_default = {
 		"layout": {
 			"type": "string",
 			"enum": ["centered", "split"],
-			"description": "Degrade preset (`centered` or `split`) the bundled default template\nbranches on, and the fallback when a custom template fails validation.\nNot the complete design catalog: all named designs (`centered`, `split`,\n`split-right`, `hero`, `minimal`) ship as templates and map onto one of\nthese two values; switch designs with\n`zitadel branding eject --design <name>` instead of editing this field.\nEjected templates may ignore it. Selects a template rather than restyling\nthe widget, so it is not an appearance control.\n",
+			"description": "Layout preset the revision declares, `centered` or `split`. It is\nvalidated on publish and handed to the template as `branding.layout`.\nThe bundled default template does not read it, so changing it alone\nchanges nothing on screen, and it is not an appearance control.\nNot a design catalog: the ejectable designs (`centered`, `minimal`)\nship as templates and both carry `centered`; switch designs with\n`zitadel branding eject --design <name>` instead of editing this field.\n`split` is carried by revisions published from the earlier split\ndesigns.\n",
 			"default": "centered"
 		},
 		"liquid_template": {
@@ -68,7 +69,7 @@ var branding_default = {
 			"type": "string",
 			"format": "uri",
 			"maxLength": 2048,
-			"description": "Hero/background image URL, used by the split layout.",
+			"description": "Hero image URL, for templates that reference `branding.hero_url`. The\nbundled default template does not use it.\n",
 			"pattern": "^([hH][tT][tT][pP][sS]://(?:\\[[0-9A-Fa-f:.]+\\]|[^/:?#@]+)(?::0*(?:[0-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?(?:[/?#]|$)|[hH][tT][tT][pP]://([lL][oO][cC][aA][lL][hH][oO][sS][tT]|127\\.(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){2}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])|\\[::1\\])(?::0*(?:[0-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?([/?#]|$))"
 		},
 		"theme": { "$ref": "#/$defs/BrandingTheme" },
@@ -89,7 +90,7 @@ var branding_default = {
 		"BrandingTheme": {
 			"type": "object",
 			"additionalProperties": false,
-			"description": "The theme sides this project publishes, and which of them may run.\n\nPublishing one side makes it the only theme that resolves, even under `auto`\nor an operating-system preference for the other. Publishing both lets `auto`\nfollow the operating system, each side using its own logo and palette.\n\nThe element-level `theme` property overrides `mode`, but cannot select a\nside the project never published.\n",
+			"description": "The theme sides this project publishes, and which of them may run.\n\nPublishing one side makes it the only theme that resolves, even under `auto`\nor an operating-system preference for the other. Publishing both lets `auto`\nfollow the operating system, each side using its own logo and palette.\n\nThe element-level `theme` property overrides `mode`. When one side is\npublished it cannot select the other. Publishing neither side leaves\n`mode`, the `theme` property and the operating system to pick one, painted\nwith the maintained defaults.\n",
 			"properties": {
 				"mode": {
 					"type": "string",
@@ -108,7 +109,7 @@ var branding_default = {
 		"BrandingThemeSide": {
 			"type": "object",
 			"additionalProperties": false,
-			"description": "One complete theme side. Light and dark are independent surfaces — neither\ninherits from the other, and a side that is absent is never used, whatever\n`mode` or the operating system asks for.\n",
+			"description": "One complete theme side. Light and dark are independent surfaces — neither\ninherits from the other. When a revision publishes one side, the absent\nside is never used, whatever `mode` or the operating system asks for. When\nit publishes neither, either side can resolve and paints the maintained\ndefaults.\n",
 			"properties": {
 				"logo_url": {
 					"type": "string",
@@ -213,7 +214,7 @@ var branding_default = {
 					"type": "string",
 					"format": "uri",
 					"maxLength": 2048,
-					"description": "Stylesheet that loads `font_family` — a Google Fonts CSS URL, for\nexample. Must be https; unlike the logo and hero assets there is no\nloopback carve-out. Rejected without `font_family`, which would name\nnothing to paint with.\n\nStored but not applied to an embedded widget: the embedding page loads\nthe face, and Zitadel does not inject a stylesheet into a document it\ndoes not own.\n",
+					"description": "Stylesheet that loads `font_family` — a Google Fonts CSS URL, for\nexample. Must be https; unlike the logo and hero assets there is no\nloopback carve-out. Rejected without `font_family`, which would name\nnothing to paint with.\n\nLoaded only when the login component runs as `variant=\"page\"`, the\nfull-page login. In the default `variant=\"widget\"` it is stored but not\nloaded: the component injects no stylesheet, and the embedding page\nloads the face.\n",
 					"pattern": "^[hH][tT][tT][pP][sS]://(?:\\[[0-9A-Fa-f:.]+\\]|[^/:?#@]+)(?::0*(?:[0-9]|[1-9][0-9]{1,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5]))?(?:[/?#]|$)",
 					"examples": ["https://fonts.googleapis.com/css2?family=Inter&display=swap"]
 				},
@@ -402,7 +403,7 @@ var flow_definition_default = {
 				{
 					"required": ["sso_providers"],
 					"properties": { "sso_providers": { "minItems": 1 } },
-					"anyOf": [{ "not": { "required": ["transitions"] } }, { "properties": { "transitions": { "not": { "required": ["callback"] } } } }]
+					"anyOf": [{ "not": { "required": ["transitions"] } }, { "properties": { "transitions": { "not": { "required": ["sso_authenticated"] } } } }]
 				},
 				{
 					"required": ["complete"],
@@ -436,8 +437,30 @@ var flow_definition_default = {
 						"actions": { "maxItems": 0 },
 						"sso_providers": { "maxItems": 0 },
 						"gates": { "maxProperties": 0 },
-						"transitions": { "not": { "required": ["callback"] } }
+						"transitions": { "not": { "required": ["sso_authenticated"] } }
 					}
+				},
+				{
+					"required": ["transitions"],
+					"properties": { "transitions": { "anyOf": [{
+						"required": ["sso_authenticated"],
+						"properties": { "sso_authenticated": { "anyOf": [{
+							"required": ["purpose"],
+							"properties": { "purpose": { "type": "string" } }
+						}, {
+							"required": ["action"],
+							"properties": { "action": { "type": "string" } }
+						}] } }
+					}, {
+						"required": ["sso_user_not_found"],
+						"properties": { "sso_user_not_found": { "anyOf": [{
+							"required": ["purpose"],
+							"properties": { "purpose": { "type": "string" } }
+						}, {
+							"required": ["action"],
+							"properties": { "action": { "type": "string" } }
+						}] } }
+					}] } }
 				}
 			] },
 			"description": "A step in a flow definition. This is the admin-authored configuration,\nnot the runtime payload sent to the frontend.\n\nSteps are schema-driven: `fields` references properties from the flow's\nuser schema, and the engine resolves field metadata (type, validation,\nimplicit outcomes) from schema annotations at runtime.\n\nA step with only `complete` set is a terminal step. All other steps are\nrendered to the frontend as capability payloads.\n",
@@ -482,8 +505,9 @@ var flow_definition_default = {
 				},
 				"sso_providers": {
 					"type": "array",
-					"description": "Slugs of the identity provider connections this step offers, in display\norder. Each names the `slug` of a connection under `.zitadel/idps/`; the\nconnection carries the display name and template, so a rename there\nreaches every step without editing the flow. The rendered step the client\nreceives carries the resolved `{id, name, template}` objects instead.\n",
+					"description": "Slugs of the identity provider connections this step offers, in display\norder. Each names the `slug` of a connection under `.zitadel/idps/`; the\nconnection carries the display name and template, so a rename there\nreaches every step without editing the flow. The rendered step the client\nreceives carries the resolved `{id, name, template}` objects instead. A\nstep offers at most 20 providers.\n",
 					"uniqueItems": true,
+					"maxItems": 20,
 					"items": {
 						"type": "string",
 						"pattern": "^[a-z0-9][a-z0-9_-]*$",
@@ -494,8 +518,8 @@ var flow_definition_default = {
 				},
 				"on_success": {
 					"type": "string",
-					"enum": ["create_user"],
-					"description": "Server-side mutation to execute when this step completes successfully.\nRuns after field validation passes, before the transition fires.\n\n- create_user: creates the user record (registration flows)\n",
+					"enum": ["create_user", "create_user_with_sso"],
+					"description": "Server-side mutation to execute when this step completes successfully.\nRuns after field validation passes, before the transition fires.\n\n- create_user: creates the user record (registration flows)\n- create_user_with_sso: creates the user record from the identity an\n  external provider returned, linking it to that identity. Accepted by\n  the API so an SSO flow can be authored and stored; the engine handler\n  is not wired yet, and a step reaching it fails with a flow integrity\n  error rather than creating anything.\n",
 					"examples": ["create_user"]
 				},
 				"complete": {
@@ -506,7 +530,7 @@ var flow_definition_default = {
 				},
 				"transitions": {
 					"type": "object",
-					"description": "Maps action/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` array. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso`, `callback`).\n",
+					"description": "Maps action/outcome names to their transition descriptor.\n\nKeys match action names from the `actions` array. Additional keys\ncome from implicit outcomes based on schema annotations\n(e.g. `user_not_found` from `x-unique` fields) and engine\nevents (e.g. `sso_authenticated`, `sso_user_not_found`).\n",
 					"additionalProperties": {
 						"type": "object",
 						"required": ["target"],
@@ -625,327 +649,6 @@ var flow_definition_default = {
 	}
 };
 //#endregion
-//#region meta-schemas/idp-connection.json
-var idp_connection_default = {
-	$comment: "Code generated by scripts/generate-meta-schemas.ts; DO NOT EDIT.",
-	$schema: "https://json-schema.org/draft/2020-12/schema",
-	title: "IdentityProviderConnection",
-	type: "object",
-	required: [
-		"slug",
-		"protocol",
-		"display_name"
-	],
-	additionalProperties: false,
-	properties: {
-		"$schema": {
-			"type": "string",
-			"minLength": 1,
-			"description": "Editor affordance: path or URL of this schema so editors validate and autocomplete the file (scaffolded connection files point at `.zitadel/meta/idp-connection.json`). Ignored by the platform."
-		},
-		"slug": {
-			"type": "string",
-			"pattern": "^[a-z0-9][a-z0-9_-]*$",
-			"maxLength": 64,
-			"description": "Stable identifier, referenced by user schemas (x-auth-methods.sso.providers) and flow steps (sso_providers). Unique within the Project.",
-			"examples": [
-				"google",
-				"github",
-				"corp_idp"
-			]
-		},
-		"protocol": {
-			"type": "string",
-			"enum": ["oidc", "oauth2"],
-			"description": "The protocol used by the identity provider."
-		},
-		"template": {
-			"type": "string",
-			"examples": [
-				"google",
-				"github",
-				"okta"
-			],
-			"description": "Template hint for rendering the provider (logo, colors). Carries no protocol behavior: conduct comes only from the protocol blocks."
-		},
-		"display_name": {
-			"type": "string",
-			"minLength": 1,
-			"maxLength": 256,
-			"description": "Shown to the user on the sign-in button."
-		},
-		"subject_claim": {
-			"type": "string",
-			"minLength": 1,
-			"description": "Claim carrying the provider's stable subject identifier. Optional for OIDC (the engine uses `sub` per spec; override where `sub` is pairwise, e.g. Entra `oid`). Required for OAuth2 — no `sub` guarantee."
-		},
-		"claim_mapping": {
-			"type": "object",
-			"additionalProperties": {
-				"type": "string",
-				"pattern": "^[^$]"
-			},
-			"description": "Maps user-schema property names (keys) to provider claim names (values). A value is an exact top-level claim key: no path syntax, and a dot is part of the key, so nested claims (OIDC `address`, GitHub `plan`) are not addressable yet. `$`-prefixed strings and non-string values are reserved for future mapping forms. Add properties defined in the user schemas; unmatched entries are ignored."
-		},
-		"verified_claims": {
-			"type": "object",
-			"additionalProperties": { "anyOf": [
-				{ "const": true },
-				{ "const": "$supplementary_fetch" },
-				{
-					"type": "string",
-					"pattern": "^[^$]"
-				}
-			] },
-			"description": "Maps a verifiable user-schema property to its verification source: a claim name (read the claim), the literal `true` (trust this provider unconditionally), or the `$`-pointer `\"$supplementary_fetch\"` (verified by the selected supplementary_fetch strategy per its contract - e.g. github_primary_email verifies `email` via primary && verified). Values starting with `$` are reserved; only `$supplementary_fetch` is defined. Distinct from claim_mapping, which carries values, not verification state.",
-			"examples": [
-				{ "email": "email_verified" },
-				{ "email": true },
-				{ "email": "$supplementary_fetch" }
-			]
-		},
-		"provisioning": {
-			"type": "object",
-			"additionalProperties": false,
-			"description": "How far this provider's data is trusted. `creation` defines what happens to a subject that has no account yet. With `disabled`, a user is not created. With `auto`, the user is created without a collection step when the mapped claims fill every required property of the schema. A required property with an `x-unique` scope must also arrive verified according to `verified_claims`. When a required property is missing or such a property is unverified, the collection step is shown instead, prefilled with the claims. Gating on other properties will be added when `x-verify` returns to the dialect. The following are deferred and will be added as additive changes. The `auto_only` value creates the user from complete claims or fails without collecting. The linking policy (`is_linking_allowed`, `auto_linking`), together with the account-linking journey. `is_auto_update`, together with per-property verification state.",
-			"properties": { "creation": {
-				"type": "string",
-				"enum": ["disabled", "auto"],
-				"default": "auto"
-			} }
-		},
-		"oidc": {
-			"type": "object",
-			"additionalProperties": false,
-			"description": "OIDC connection details. Endpoints come from discovery, but any may be supplied to override it, or to serve a provider that exposes no .well-known document.",
-			"required": [
-				"issuer",
-				"client_id",
-				"client_secret",
-				"scopes"
-			],
-			"properties": {
-				"issuer": {
-					"type": "string",
-					"format": "uri",
-					"pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)(/[^\\s?#]*)?$",
-					"description": "Discovery base. Endpoints are resolved from its .well-known document unless overridden below."
-				},
-				"jwks_uri": {
-					"type": "string",
-					"format": "uri",
-					"pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)([/?][^\\s#]*)?$",
-					"description": "Overrides the JWKS endpoint from discovery. Required in practice when the provider exposes no .well-known document, since ID tokens cannot otherwise be validated."
-				},
-				"id_token_mapping": {
-					"type": "boolean",
-					"default": false,
-					"description": "Read user claims from the id_token instead of the userinfo endpoint, for providers that populate only the former."
-				},
-				"authorization_endpoint": {
-					"type": "string",
-					"format": "uri",
-					"pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)([/?][^\\s#]*)?$",
-					"description": "Overrides discovery."
-				},
-				"token_endpoint": {
-					"type": "string",
-					"format": "uri",
-					"pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)([/?][^\\s#]*)?$",
-					"description": "Overrides discovery."
-				},
-				"userinfo_endpoint": {
-					"type": "string",
-					"format": "uri",
-					"pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)([/?][^\\s#]*)?$",
-					"description": "Overrides discovery."
-				},
-				"client_id": {
-					"type": "string",
-					"minLength": 1,
-					"maxLength": 512,
-					"description": "Either a literal in case the same client is used in all environments, or a `${{ NAME }}` reference to a variable in case of separate clients per environment."
-				},
-				"client_secret": {
-					"type": "string",
-					"pattern": "^\\$\\{\\{ *[A-Za-z0-9_]+ *\\}\\}$",
-					"description": "A reference to the variable holding the client secret, never the secret itself. A secret may only be referenced as the entire value: text around the placeholder would be rendered into the resolved credential, so it is rejected. The engine resolves it against the environment serving the request."
-				},
-				"token_endpoint_auth_method": {
-					"type": "string",
-					"enum": ["client_secret_basic", "client_secret_post"],
-					"default": "client_secret_basic",
-					"description": "How the client authenticates at the token endpoint."
-				},
-				"scopes": {
-					"type": "array",
-					"items": {
-						"type": "string",
-						"minLength": 1
-					},
-					"uniqueItems": true,
-					"minItems": 1,
-					"contains": { "const": "openid" },
-					"default": [
-						"openid",
-						"profile",
-						"email"
-					],
-					"description": "Must contain `openid` - without it the provider returns no id_token and the connection is not OIDC. Enforced by `required` + `contains`; the `default` is a UI-prefill hint only - validators never inject it, so an omitted `scopes` is rejected regardless."
-				},
-				"pkce_enabled": {
-					"type": "boolean",
-					"default": true,
-					"description": "Send PKCE (code_challenge/code_verifier). Providers that do not support PKCE typically ignore the parameters, so `true` is safe and future-proofs; set `false` only for a provider whose token endpoint rejects them."
-				},
-				"static_authorize_parameters": {
-					"type": "object",
-					"propertyNames": {
-						"minLength": 1,
-						"not": { "enum": [
-							"client_id",
-							"redirect_uri",
-							"response_type",
-							"scope",
-							"state",
-							"nonce",
-							"code_challenge",
-							"code_challenge_method",
-							"response_mode",
-							"request",
-							"request_uri",
-							"client_secret",
-							"client_assertion"
-						] }
-					},
-					"additionalProperties": { "type": "string" },
-					"description": "Extra provider-specific authorize parameters (for example `prompt`). Engine-owned protocol parameters are reserved and rejected by `propertyNames`: the engine composes them itself, and an override of `state` or `nonce` would silently defeat CSRF and token binding. `client_secret` and `client_assertion` are rejected as they could be appended to the public authorize URL."
-				}
-			}
-		},
-		"oauth2": {
-			"type": "object",
-			"additionalProperties": false,
-			"description": "OAuth 2.0 connection details.",
-			"required": [
-				"authorization_endpoint",
-				"token_endpoint",
-				"userinfo_endpoint",
-				"client_id",
-				"client_secret"
-			],
-			"properties": {
-				"authorization_endpoint": {
-					"type": "string",
-					"format": "uri",
-					"pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)([/?][^\\s#]*)?$",
-					"description": "Where the user is sent to authorize."
-				},
-				"token_endpoint": {
-					"type": "string",
-					"format": "uri",
-					"pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)([/?][^\\s#]*)?$",
-					"description": "Where the authorization code is exchanged."
-				},
-				"userinfo_endpoint": {
-					"type": "string",
-					"format": "uri",
-					"pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)([/?][^\\s#]*)?$",
-					"description": "Where the authenticated user's profile is fetched."
-				},
-				"client_id": {
-					"type": "string",
-					"minLength": 1,
-					"maxLength": 512,
-					"description": "Either a literal in case the same client is used in all environments, or a `${{ NAME }}` reference to a variable in case of separate clients per environment."
-				},
-				"client_secret": {
-					"type": "string",
-					"pattern": "^\\$\\{\\{ *[A-Za-z0-9_]+ *\\}\\}$",
-					"description": "A reference to the variable holding the client secret, never the secret itself. A secret may only be referenced as the entire value: text around the placeholder would be rendered into the resolved credential, so it is rejected. The engine resolves it against the environment serving the request."
-				},
-				"token_endpoint_auth_method": {
-					"type": "string",
-					"enum": ["client_secret_basic", "client_secret_post"],
-					"default": "client_secret_basic",
-					"description": "How the client authenticates at the token endpoint."
-				},
-				"scopes": {
-					"type": "array",
-					"items": {
-						"type": "string",
-						"minLength": 1
-					},
-					"uniqueItems": true,
-					"description": "Provider-specific; OAuth 2.0 defines no universal scope."
-				},
-				"pkce_enabled": {
-					"type": "boolean",
-					"default": true,
-					"description": "Send PKCE (code_challenge/code_verifier). Providers that do not support PKCE typically ignore the parameters, so `true` is safe and future-proofs; set `false` only for a provider whose token endpoint rejects them."
-				},
-				"static_authorize_parameters": {
-					"type": "object",
-					"propertyNames": {
-						"minLength": 1,
-						"not": { "enum": [
-							"client_id",
-							"redirect_uri",
-							"response_type",
-							"scope",
-							"state",
-							"nonce",
-							"code_challenge",
-							"code_challenge_method",
-							"response_mode",
-							"request",
-							"request_uri",
-							"client_secret",
-							"client_assertion"
-						] }
-					},
-					"additionalProperties": { "type": "string" },
-					"description": "Extra provider-specific authorize parameters (for example `prompt`). Engine-owned protocol parameters are reserved and rejected by `propertyNames`: the engine composes them itself, and an override of `state` or `nonce` would silently defeat CSRF and token binding. `client_secret` and `client_assertion` are rejected as they could be appended to the public authorize URL."
-				},
-				"supplementary_fetch": {
-					"type": "string",
-					"enum": ["github_primary_email"],
-					"description": "Provider-specific follow-up call after userinfo. New values are non-breaking."
-				}
-			},
-			"allOf": [{
-				"if": {
-					"properties": { "supplementary_fetch": { "const": "github_primary_email" } },
-					"required": ["supplementary_fetch"]
-				},
-				"then": {
-					"required": ["scopes"],
-					"properties": { "scopes": { "contains": { "const": "user:email" } } }
-				}
-			}]
-		}
-	},
-	allOf: [{
-		"if": {
-			"properties": { "protocol": { "const": "oidc" } },
-			"required": ["protocol"]
-		},
-		"then": {
-			"required": ["oidc"],
-			"properties": { "oauth2": false }
-		}
-	}, {
-		"if": {
-			"properties": { "protocol": { "const": "oauth2" } },
-			"required": ["protocol"]
-		},
-		"then": {
-			"required": ["oauth2", "subject_claim"],
-			"properties": { "oidc": false }
-		}
-	}]
-};
-//#endregion
 //#region meta-schemas/property-name.json
 var property_name_default = {
 	$comment: "Code generated by scripts/generate-meta-schemas.ts; DO NOT EDIT.",
@@ -1170,4 +873,4 @@ function metaSchemaFiles() {
 //#endregion
 export { metaSchemaFiles as i, FLOW_FILE_SCHEMA_REF as n, META_SCHEMA_DIR as r, BRANDING_FILE_SCHEMA_REF as t };
 
-//# sourceMappingURL=meta-schemas-OowgSUfU.mjs.map
+//# sourceMappingURL=meta-schemas-C03zgFux.mjs.map

package/dist/meta-schemas-C03zgFux.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"meta-schemas-C03zgFux.mjs","names":["flowDefinitionMetaSchema","userSchemaMetaSchema","userPropertyMetaSchema","propertyNameMetaSchema","authMethodsMetaSchema","authMethodMetaSchema","ssoAuthMethodMetaSchema","idpConnectionMetaSchema","brandingMetaSchema"],"sources":["../meta-schemas/auth-method.json","../meta-schemas/auth-methods.json","../meta-schemas/branding.json","../meta-schemas/flow-definition.json","../meta-schemas/property-name.json","../meta-schemas/sso-auth-method.json","../meta-schemas/user-property.json","../meta-schemas/user-schema.json","../src/meta-schemas.ts"],"sourcesContent":["","","","","","","","","/**\n * The dialect meta-schemas `zitadel setup` copies into a project's\n * `.zitadel/meta/` so the flow/schema dialect is machine-readable offline:\n * editors validate flow files against `flow-definition.json` via a relative\n * `$schema` pointer, and agents read the dialect files before authoring\n * edits — no docs crawl, no hosted schema required.\n *\n * The files under `meta-schemas/` are generated: `scripts/sync-meta-schemas.mjs`\n * copies them from `api/openapi/endpoints/schemas/*.json` (the files the\n * server embeds) ahead of build, typecheck and test. Those are generated in\n * turn from the OpenAPI YAML by `scripts/generate-meta-schemas.ts` at the repo\n * root, so the YAML is the only thing to edit.\n */\nimport authMethodMetaSchema from \"../meta-schemas/auth-method.json\" with { type: \"json\" };\nimport authMethodsMetaSchema from \"../meta-schemas/auth-methods.json\" with { type: \"json\" };\nimport brandingMetaSchema from \"../meta-schemas/branding.json\" with { type: \"json\" };\nimport flowDefinitionMetaSchema from \"../meta-schemas/flow-definition.json\" with { type: \"json\" };\nimport idpConnectionMetaSchema from \"../meta-schemas/idp-connection.json\" with { type: \"json\" };\nimport propertyNameMetaSchema from \"../meta-schemas/property-name.json\" with { type: \"json\" };\nimport ssoAuthMethodMetaSchema from \"../meta-schemas/sso-auth-method.json\" with { type: \"json\" };\nimport userPropertyMetaSchema from \"../meta-schemas/user-property.json\" with { type: \"json\" };\nimport userSchemaMetaSchema from \"../meta-schemas/user-schema.json\" with { type: \"json\" };\n\n/** Project-relative directory setup writes the meta-schemas to. */\nexport const META_SCHEMA_DIR = \".zitadel/meta\";\n\n/**\n * The `$schema` value scaffolded flow files carry, relative to\n * `.zitadel/flows/` — resolves to `{@link META_SCHEMA_DIR}/flow-definition.json`.\n */\nexport const FLOW_FILE_SCHEMA_REF = \"../meta/flow-definition.json\";\n\n/**\n * The `$schema` value scaffolded branding files carry, relative to\n * `.zitadel/branding/` — resolves to `{@link META_SCHEMA_DIR}/branding.json`.\n */\nexport const BRANDING_FILE_SCHEMA_REF = \"../meta/branding.json\";\n\nexport type MetaSchemaFile = { name: string; body: object };\n\n/**\n * The dialect files to materialize, in write order. `auth-methods.json`,\n * `auth-method.json`, and `sso-auth-method.json` are pulled in by\n * `user-schema.json`'s relative `$ref`s — without them the copied dialect\n * cannot resolve offline.\n */\nexport function metaSchemaFiles(): ReadonlyArray<MetaSchemaFile> {\n  return [\n    { name: \"flow-definition.json\", body: flowDefinitionMetaSchema as object },\n    { name: \"user-schema.json\", body: userSchemaMetaSchema as object },\n    { name: \"user-property.json\", body: userPropertyMetaSchema as object },\n    { name: \"property-name.json\", body: propertyNameMetaSchema as object },\n    { name: \"auth-methods.json\", body: authMethodsMetaSchema as object },\n    { name: \"auth-method.json\", body: authMethodMetaSchema as object },\n    { name: \"sso-auth-method.json\", body: ssoAuthMethodMetaSchema as object },\n    { name: \"idp-connection.json\", body: idpConnectionMetaSchema as object },\n    { name: \"branding.json\", body: brandingMetaSchema as object },\n  ];\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AQwBA,MAAa,kBAAkB;;;;;AAM/B,MAAa,uBAAuB;;;;;AAMpC,MAAa,2BAA2B;;;;;;;AAUxC,SAAgB,kBAAiD;CAC/D,OAAO;EACL;GAAE,MAAM;GAAwB,MAAMA;EAAmC;EACzE;GAAE,MAAM;GAAoB,MAAMC;EAA+B;EACjE;GAAE,MAAM;GAAsB,MAAMC;EAAiC;EACrE;GAAE,MAAM;GAAsB,MAAMC;EAAiC;EACrE;GAAE,MAAM;GAAqB,MAAMC;EAAgC;EACnE;GAAE,MAAM;GAAoB,MAAMC;EAA+B;EACjE;GAAE,MAAM;GAAwB,MAAMC;EAAkC;EACxE;GAAE,MAAM;GAAuB,MAAMC;EAAkC;EACvE;GAAE,MAAM;GAAiB,MAAMC;EAA6B;CAC9D;AACF"}

package/dist/meta-schemas.d.mts

@@ -1,17 +1,17 @@
 //#region src/meta-schemas.d.ts
 /** Project-relative directory setup writes the meta-schemas to. */
-declare const META_SCHEMA_DIR = ".zitadel/meta";
+export declare const META_SCHEMA_DIR = ".zitadel/meta";
 /**
  * The `$schema` value scaffolded flow files carry, relative to
  * `.zitadel/flows/` — resolves to `{@link META_SCHEMA_DIR}/flow-definition.json`.
  */
-declare const FLOW_FILE_SCHEMA_REF = "../meta/flow-definition.json";
+export declare const FLOW_FILE_SCHEMA_REF = "../meta/flow-definition.json";
 /**
  * The `$schema` value scaffolded branding files carry, relative to
  * `.zitadel/branding/` — resolves to `{@link META_SCHEMA_DIR}/branding.json`.
  */
-declare const BRANDING_FILE_SCHEMA_REF = "../meta/branding.json";
-type MetaSchemaFile = {
+export declare const BRANDING_FILE_SCHEMA_REF = "../meta/branding.json";
+export type MetaSchemaFile = {
   name: string;
   body: object;
 };
@@ -21,7 +21,6 @@ type MetaSchemaFile = {
  * `user-schema.json`'s relative `$ref`s — without them the copied dialect
  * cannot resolve offline.
  */
-declare function metaSchemaFiles(): ReadonlyArray<MetaSchemaFile>;
+export declare function metaSchemaFiles(): ReadonlyArray<MetaSchemaFile>;
 //#endregion
-export { BRANDING_FILE_SCHEMA_REF, FLOW_FILE_SCHEMA_REF, META_SCHEMA_DIR, MetaSchemaFile, metaSchemaFiles };
 //# sourceMappingURL=meta-schemas.d.mts.map

package/dist/meta-schemas.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"meta-schemas.d.mts","names":[],"sources":["../src/meta-schemas.ts"],"mappings":";;cA0Ca,eAAA;;;;;cAMA,oBAAA;;;;;cAMA,wBAAA;AAAA,KAED,cAAA;EAAmB,IAAA;EAAc,IAAA;AAAA;AAA7C;;;;;AAQA;AARA,iBAQgB,eAAA,CAAA,GAAmB,aAAA,CAAc,cAAA"}
+{"version":3,"file":"meta-schemas.d.mts","names":[],"sources":["../src/meta-schemas.ts"],"mappings":";;qBAwBa;;;;;qBAMA;;;;;qBAMA;YAED;EAAmB;EAAc;;;;;;;;wBAQ7B,mBAAmB,cAAc"}

package/dist/meta-schemas.mjs

@@ -1,2 +1,2 @@
-import { i as metaSchemaFiles, n as FLOW_FILE_SCHEMA_REF, r as META_SCHEMA_DIR, t as BRANDING_FILE_SCHEMA_REF } from "./meta-schemas-OowgSUfU.mjs";
+import { i as metaSchemaFiles, n as FLOW_FILE_SCHEMA_REF, r as META_SCHEMA_DIR, t as BRANDING_FILE_SCHEMA_REF } from "./meta-schemas-C03zgFux.mjs";
 export { BRANDING_FILE_SCHEMA_REF, FLOW_FILE_SCHEMA_REF, META_SCHEMA_DIR, metaSchemaFiles };

package/dist/normalize.d.mts

@@ -22,7 +22,7 @@
  * spells one of these out is semantically identical to one that omits it:
  * audit payloads deny by default.
  */
-declare const USER_PROPERTY_DEFAULTS: Readonly<Record<string, boolean>>;
+export declare const USER_PROPERTY_DEFAULTS: Readonly<Record<string, boolean>>;
 /**
  * Return a deep copy of a bare flow-definition body with server-echoed
  * noise removed: an empty `audience` and any detail-envelope keys. A
@@ -32,7 +32,7 @@ declare const USER_PROPERTY_DEFAULTS: Readonly<Record<string, boolean>>;
  * from responses, so comparing with it would read every scaffolded file
  * as permanently diverged.
  */
-declare function normalizeFlowBody(body: object): object;
+export declare function normalizeFlowBody(body: object): object;
 /**
  * Return a deep copy of a user-schema body with meta-schema property
  * defaults stripped: a property carrying one of the
@@ -41,7 +41,6 @@ declare function normalizeFlowBody(body: object): object;
  * through untouched. Nested `properties` are descended into, so a leaf
  * of an object property normalizes the same way a top-level one does.
  */
-declare function normalizeSchemaBody(body: object): object;
+export declare function normalizeSchemaBody(body: object): object;
 //#endregion
-export { USER_PROPERTY_DEFAULTS, normalizeFlowBody, normalizeSchemaBody };
 //# sourceMappingURL=normalize.d.mts.map

package/dist/normalize.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.d.mts","names":[],"sources":["../src/normalize.ts"],"mappings":";;AAwBA;;;;;AAwCA;;;;;AAoBA;;;;;;;;;;;;cA5Da,sBAAA,EAAwB,QAAA,CAAS,MAAA;;;;;;;;;;iBAwC9B,iBAAA,CAAkB,IAAA;;;;;;;;;iBAoBlB,mBAAA,CAAoB,IAAA"}
+{"version":3,"file":"normalize.d.mts","names":[],"sources":["../src/normalize.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;qBAwBa,wBAAwB,SAAS;;;;;;;;;;wBAwC9B,kBAAkB;;;;;;;;;wBAoBlB,oBAAoB"}

package/dist/normalize.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"normalize.mjs","names":[],"sources":["../src/normalize.ts"],"sourcesContent":["/**\n * Canonical-form normalizers for the two repo-config resource kinds.\n *\n * The sync engine compares `.zitadel/**` files against server responses;\n * the server echoes fields the author never wrote (an empty `audience`\n * on flows) and the meta-schema declares defaults an author may or may\n * not spell out (`x-audit` on schema properties). Normalizing both\n * sides before hashing or diffing keeps a one-field edit rendering as a\n * one-field diff.\n *\n * Normalized bodies are for COMPARISON. Never upload them, and never\n * write a normalized schema body to a file: the server stores schema\n * bytes verbatim without materializing meta-schema defaults, so a\n * stripped `\"x-audit\": false` would vanish from the next published\n * revision. (Flow write-back may reuse {@link normalizeFlowBody} —\n * everything it strips is pure transport noise.)\n */\n\n/**\n * Property-level defaults declared by the user-property meta-schema\n * (`api/openapi/endpoints/schemas/user-property.json`). A property that\n * spells one of these out is semantically identical to one that omits it:\n * audit payloads deny by default.\n */\nexport const USER_PROPERTY_DEFAULTS: Readonly<Record<string, boolean>> = {\n  \"x-audit\": false,\n};\n\n/**\n * Keys of the flow-definition response envelope. `fetch` in the flow syncer\n * already unwraps the envelope; stripping them here as well makes the\n * normalizer safe on raw detail responses.\n */\nconst FLOW_ENVELOPE_KEYS = [\"id\", \"project_id\", \"created_at\", \"updated_at\"];\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/**\n * An `audience` counts as empty when it scopes nothing: no keys, or only\n * `team_ids`/`app_ids` that are null or empty arrays. Unknown keys keep\n * the audience — better a noisy diff than a silently dropped scope.\n */\nfunction isEmptyAudience(value: unknown): boolean {\n  if (!isPlainObject(value)) {\n    return false;\n  }\n  return Object.entries(value).every(\n    ([key, entry]) =>\n      (key === \"team_ids\" || key === \"app_ids\") &&\n      (entry === null || entry === undefined || (Array.isArray(entry) && entry.length === 0)),\n  );\n}\n\n/**\n * Return a deep copy of a bare flow-definition body with server-echoed\n * noise removed: an empty `audience` and any detail-envelope keys. A\n * top-level `$schema` is stripped too — it is a local editor affordance\n * (scaffolded flow files point it at `.zitadel/meta/flow-definition.json`),\n * never part of the resource: the server skips it on decode and omits it\n * from responses, so comparing with it would read every scaffolded file\n * as permanently diverged.\n */\nexport function normalizeFlowBody(body: object): object {\n  const result = structuredClone(body) as Record<string, unknown>;\n  for (const key of FLOW_ENVELOPE_KEYS) {\n    delete result[key];\n  }\n  delete result.$schema;\n  if (\"audience\" in result && isEmptyAudience(result.audience)) {\n    delete result.audience;\n  }\n  return result;\n}\n\n/**\n * Return a deep copy of a user-schema body with meta-schema property\n * defaults stripped: a property carrying one of the\n * {@link USER_PROPERTY_DEFAULTS} normalizes to one omitting it. Only\n * exact default values are removed; `$id` and every other field pass\n * through untouched. Nested `properties` are descended into, so a leaf\n * of an object property normalizes the same way a top-level one does.\n */\nexport function normalizeSchemaBody(body: object): object {\n  const result = structuredClone(body) as Record<string, unknown>;\n  stripPropertyDefaults(result);\n  return result;\n}\n\n/**\n * Strip {@link USER_PROPERTY_DEFAULTS} from every property of an object\n * schema, descending into nested `properties` so a leaf of an object\n * property normalizes the same way a top-level one does.\n */\nfunction stripPropertyDefaults(schema: Record<string, unknown>): void {\n  if (!isPlainObject(schema.properties)) {\n    return;\n  }\n  for (const property of Object.values(schema.properties)) {\n    if (!isPlainObject(property)) {\n      continue;\n    }\n    for (const [key, defaultValue] of Object.entries(USER_PROPERTY_DEFAULTS)) {\n      if (property[key] === defaultValue) {\n        delete property[key];\n      }\n    }\n    stripPropertyDefaults(property);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAwBA,MAAa,yBAA4D,EACvE,WAAW,OACZ;;;;;;AAOD,MAAM,qBAAqB;CAAC;CAAM;CAAc;CAAc;CAAa;AAE3E,SAAS,cAAc,OAAkD;AACvE,QAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,MAAM;;;;;;;AAQ7E,SAAS,gBAAgB,OAAyB;AAChD,KAAI,CAAC,cAAc,MAAM,CACvB,QAAO;AAET,QAAO,OAAO,QAAQ,MAAM,CAAC,OAC1B,CAAC,KAAK,YACJ,QAAQ,cAAc,QAAQ,eAC9B,UAAU,QAAQ,UAAU,KAAA,KAAc,MAAM,QAAQ,MAAM,IAAI,MAAM,WAAW,GACvF;;;;;;;;;;;AAYH,SAAgB,kBAAkB,MAAsB;CACtD,MAAM,SAAS,gBAAgB,KAAK;AACpC,MAAK,MAAM,OAAO,mBAChB,QAAO,OAAO;AAEhB,QAAO,OAAO;AACd,KAAI,cAAc,UAAU,gBAAgB,OAAO,SAAS,CAC1D,QAAO,OAAO;AAEhB,QAAO;;;;;;;;;;AAWT,SAAgB,oBAAoB,MAAsB;CACxD,MAAM,SAAS,gBAAgB,KAAK;AACpC,uBAAsB,OAAO;AAC7B,QAAO;;;;;;;AAQT,SAAS,sBAAsB,QAAuC;AACpE,KAAI,CAAC,cAAc,OAAO,WAAW,CACnC;AAEF,MAAK,MAAM,YAAY,OAAO,OAAO,OAAO,WAAW,EAAE;AACvD,MAAI,CAAC,cAAc,SAAS,CAC1B;AAEF,OAAK,MAAM,CAAC,KAAK,iBAAiB,OAAO,QAAQ,uBAAuB,CACtE,KAAI,SAAS,SAAS,aACpB,QAAO,SAAS;AAGpB,wBAAsB,SAAS"}
+{"version":3,"file":"normalize.mjs","names":[],"sources":["../src/normalize.ts"],"sourcesContent":["/**\n * Canonical-form normalizers for the two repo-config resource kinds.\n *\n * The sync engine compares `.zitadel/**` files against server responses;\n * the server echoes fields the author never wrote (an empty `audience`\n * on flows) and the meta-schema declares defaults an author may or may\n * not spell out (`x-audit` on schema properties). Normalizing both\n * sides before hashing or diffing keeps a one-field edit rendering as a\n * one-field diff.\n *\n * Normalized bodies are for COMPARISON. Never upload them, and never\n * write a normalized schema body to a file: the server stores schema\n * bytes verbatim without materializing meta-schema defaults, so a\n * stripped `\"x-audit\": false` would vanish from the next published\n * revision. (Flow write-back may reuse {@link normalizeFlowBody} —\n * everything it strips is pure transport noise.)\n */\n\n/**\n * Property-level defaults declared by the user-property meta-schema\n * (`api/openapi/endpoints/schemas/user-property.json`). A property that\n * spells one of these out is semantically identical to one that omits it:\n * audit payloads deny by default.\n */\nexport const USER_PROPERTY_DEFAULTS: Readonly<Record<string, boolean>> = {\n  \"x-audit\": false,\n};\n\n/**\n * Keys of the flow-definition response envelope. `fetch` in the flow syncer\n * already unwraps the envelope; stripping them here as well makes the\n * normalizer safe on raw detail responses.\n */\nconst FLOW_ENVELOPE_KEYS = [\"id\", \"project_id\", \"created_at\", \"updated_at\"];\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/**\n * An `audience` counts as empty when it scopes nothing: no keys, or only\n * `team_ids`/`app_ids` that are null or empty arrays. Unknown keys keep\n * the audience — better a noisy diff than a silently dropped scope.\n */\nfunction isEmptyAudience(value: unknown): boolean {\n  if (!isPlainObject(value)) {\n    return false;\n  }\n  return Object.entries(value).every(\n    ([key, entry]) =>\n      (key === \"team_ids\" || key === \"app_ids\") &&\n      (entry === null || entry === undefined || (Array.isArray(entry) && entry.length === 0)),\n  );\n}\n\n/**\n * Return a deep copy of a bare flow-definition body with server-echoed\n * noise removed: an empty `audience` and any detail-envelope keys. A\n * top-level `$schema` is stripped too — it is a local editor affordance\n * (scaffolded flow files point it at `.zitadel/meta/flow-definition.json`),\n * never part of the resource: the server skips it on decode and omits it\n * from responses, so comparing with it would read every scaffolded file\n * as permanently diverged.\n */\nexport function normalizeFlowBody(body: object): object {\n  const result = structuredClone(body) as Record<string, unknown>;\n  for (const key of FLOW_ENVELOPE_KEYS) {\n    delete result[key];\n  }\n  delete result.$schema;\n  if (\"audience\" in result && isEmptyAudience(result.audience)) {\n    delete result.audience;\n  }\n  return result;\n}\n\n/**\n * Return a deep copy of a user-schema body with meta-schema property\n * defaults stripped: a property carrying one of the\n * {@link USER_PROPERTY_DEFAULTS} normalizes to one omitting it. Only\n * exact default values are removed; `$id` and every other field pass\n * through untouched. Nested `properties` are descended into, so a leaf\n * of an object property normalizes the same way a top-level one does.\n */\nexport function normalizeSchemaBody(body: object): object {\n  const result = structuredClone(body) as Record<string, unknown>;\n  stripPropertyDefaults(result);\n  return result;\n}\n\n/**\n * Strip {@link USER_PROPERTY_DEFAULTS} from every property of an object\n * schema, descending into nested `properties` so a leaf of an object\n * property normalizes the same way a top-level one does.\n */\nfunction stripPropertyDefaults(schema: Record<string, unknown>): void {\n  if (!isPlainObject(schema.properties)) {\n    return;\n  }\n  for (const property of Object.values(schema.properties)) {\n    if (!isPlainObject(property)) {\n      continue;\n    }\n    for (const [key, defaultValue] of Object.entries(USER_PROPERTY_DEFAULTS)) {\n      if (property[key] === defaultValue) {\n        delete property[key];\n      }\n    }\n    stripPropertyDefaults(property);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAwBA,MAAa,yBAA4D,EACvE,WAAW,MACb;;;;;;AAOA,MAAM,qBAAqB;CAAC;CAAM;CAAc;CAAc;AAAY;AAE1E,SAAS,cAAc,OAAkD;CACvE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E;;;;;;AAOA,SAAS,gBAAgB,OAAyB;CAChD,IAAI,CAAC,cAAc,KAAK,GACtB,OAAO;CAET,OAAO,OAAO,QAAQ,KAAK,CAAC,CAAC,OAC1B,CAAC,KAAK,YACJ,QAAQ,cAAc,QAAQ,eAC9B,UAAU,QAAQ,UAAU,KAAA,KAAc,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,EACxF;AACF;;;;;;;;;;AAWA,SAAgB,kBAAkB,MAAsB;CACtD,MAAM,SAAS,gBAAgB,IAAI;CACnC,KAAK,MAAM,OAAO,oBAChB,OAAO,OAAO;CAEhB,OAAO,OAAO;CACd,IAAI,cAAc,UAAU,gBAAgB,OAAO,QAAQ,GACzD,OAAO,OAAO;CAEhB,OAAO;AACT;;;;;;;;;AAUA,SAAgB,oBAAoB,MAAsB;CACxD,MAAM,SAAS,gBAAgB,IAAI;CACnC,sBAAsB,MAAM;CAC5B,OAAO;AACT;;;;;;AAOA,SAAS,sBAAsB,QAAuC;CACpE,IAAI,CAAC,cAAc,OAAO,UAAU,GAClC;CAEF,KAAK,MAAM,YAAY,OAAO,OAAO,OAAO,UAAU,GAAG;EACvD,IAAI,CAAC,cAAc,QAAQ,GACzB;EAEF,KAAK,MAAM,CAAC,KAAK,iBAAiB,OAAO,QAAQ,sBAAsB,GACrE,IAAI,SAAS,SAAS,cACpB,OAAO,SAAS;EAGpB,sBAAsB,QAAQ;CAChC;AACF"}

package/dist/{schemas-7oNU25Qz.mjs → schemas-CUU4Rf8J.mjs}

@@ -1,11 +1,11 @@
 import { isCanonicalLoopbackHttpUrl } from "./branding-url.mjs";
-import { CreateBrandingBody, CreateFlowDefinitionBody, CreateSchemaBody } from "@zitadel/api/generated/endpoints/zitadelNextGen.zod";
+import { CreateBrandingBody, CreateFlowDefinitionBody, CreateIdpBody, CreateSchemaBody } from "@zitadel/api/generated/endpoints/zitadelNextGen.zod";
 import { z } from "zod";
 /** Asset URL cap in UTF-8 bytes, like the server's `MaxBrandingURLBytes`. */
 const MAX_BRANDING_URL_BYTES = 2048;
 const HEX_COLOR = /^#([0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/;
 /** `url` is absent by construction: it is not a colour function. */
-const COLOR_FUNCTIONS = new Set([
+const COLOR_FUNCTIONS = /* @__PURE__ */ new Set([
 	"rgb",
 	"rgba",
 	"hsl",
@@ -74,6 +74,13 @@ function isFontName(family) {
 const schemaConfigSchema = CreateSchemaBody;
 const flowConfigSchema = CreateFlowDefinitionBody.shape.flow_definition;
 const createFlowDefinitionRequestSchema = CreateFlowDefinitionBody;
+/**
+* One `.zitadel/idps/<slug>.json` body: the connection document `POST /idps`
+* carries under `idp`. The generated Zod enforces the contract the meta-schema
+* states, including that `client_secret` is a `${{ NAME }}` reference and
+* never a literal.
+*/
+const idpConnectionConfigSchema = CreateIdpBody.shape.idp;
 /** The wire shape of a branding revision (`POST /branding` request body). */
 const brandingWireSchema = CreateBrandingBody;
 /**
@@ -168,6 +175,6 @@ function validateBrandingAssetUrl(value, field, ctx, options = {}) {
 	});
 }
 //#endregion
-export { localFileReferenceSchema as a, flowConfigSchema as i, brandingWireSchema as n, schemaConfigSchema as o, createFlowDefinitionRequestSchema as r, brandingConfigSchema as t };
+export { idpConnectionConfigSchema as a, flowConfigSchema as i, brandingWireSchema as n, localFileReferenceSchema as o, createFlowDefinitionRequestSchema as r, schemaConfigSchema as s, brandingConfigSchema as t };
 
-//# sourceMappingURL=schemas-7oNU25Qz.mjs.map
+//# sourceMappingURL=schemas-CUU4Rf8J.mjs.map