@zitadel/config 1.0.0-alpha.23 → 1.0.0-alpha.25

package/dist/schemas-CUU4Rf8J.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas-CUU4Rf8J.mjs","names":[],"sources":["../src/branding-css.ts","../src/schemas.ts"],"sourcesContent":["/**\n * Mirror of the server's appearance-value gates\n * (`internal/domain/branding_css.go`), so `plan` rejects what `apply` would.\n *\n * The widget writes these values straight into a CSS declaration, so a value\n * able to close its own declaration can emit rules of its own. Both gates are\n * allowlists: a value is accepted only when it matches a form we recognise,\n * never merely because it avoided the characters someone thought to ban.\n */\n\nexport const MAX_BRANDING_COLOR_LENGTH = 128;\nexport const MAX_BRANDING_FONT_FAMILY_LENGTH = 256;\n/** Asset URL cap in UTF-8 bytes, like the server's `MaxBrandingURLBytes`. */\nexport const MAX_BRANDING_URL_BYTES = 2048;\n\nconst HEX_COLOR = /^#([0-9a-fA-F]{3,4}|[0-9a-fA-F]{6}|[0-9a-fA-F]{8})$/;\n\n/** `url` is absent by construction: it is not a colour function. */\nconst COLOR_FUNCTIONS = new Set([\n  \"rgb\",\n  \"rgba\",\n  \"hsl\",\n  \"hsla\",\n  \"hwb\",\n  \"lab\",\n  \"lch\",\n  \"oklab\",\n  \"oklch\",\n  \"color\",\n  \"color-mix\",\n]);\n\nconst COLOR_ARGS = /^[0-9a-zA-Z%.,+\\-/ ()#]*$/;\n/**\n * A bare colour name. Which names CSS knows is the browser's business: an\n * unknown one paints nothing, and every name of this shape is inert inside a\n * declaration whatever it spells.\n */\nconst COLOR_NAME = /^[a-zA-Z]{3,24}$/;\nconst FONT_IDENT = /^[A-Za-z0-9_-]+( [A-Za-z0-9_-]+)*$/;\n\nfunction isColorFunction(value: string): boolean {\n  const open = value.indexOf(\"(\");\n  if (open <= 0 || !value.endsWith(\")\")) return false;\n  if (!COLOR_FUNCTIONS.has(value.slice(0, open))) return false;\n\n  const args = value.slice(open + 1, -1);\n  if (!COLOR_ARGS.test(args)) return false;\n\n  // Nesting is legal (`color-mix(in srgb, rgb(1 2 3), red)`), so the\n  // parentheses only have to balance, at a bounded depth.\n  let depth = 0;\n  for (const char of args) {\n    if (char === \"(\") {\n      depth += 1;\n      if (depth > 4) return false;\n    } else if (char === \")\") {\n      depth -= 1;\n      if (depth < 0) return false;\n    }\n  }\n  return depth === 0;\n}\n\n/** Whether a value is hex, a CSS colour name, or a colour function. */\nexport function isBrandingColor(value: string): boolean {\n  if (value.length > MAX_BRANDING_COLOR_LENGTH) return false;\n  if (value.trim() === \"\") return false;\n  // Not trimmed: the value is stored and painted verbatim.\n  if (HEX_COLOR.test(value)) return true;\n  return COLOR_NAME.test(value) || isColorFunction(value.toLowerCase());\n}\n\n/** Whether a value is a CSS font stack of identifiers and quoted names. */\nexport function isBrandingFontFamily(value: string): boolean {\n  if (value.length > MAX_BRANDING_FONT_FAMILY_LENGTH) return false;\n  if (value.trim() === \"\") return false;\n  return value.split(\",\").every((family) => isFontName(trimSpaces(family)));\n}\n\n/** Spaces around a comma are ordinary; other whitespace is not a separator. */\nfunction trimSpaces(value: string): string {\n  return value.replace(/^ +/, \"\").replace(/ +$/, \"\");\n}\n\nfunction isFontName(family: string): boolean {\n  if (family === \"\") return false;\n  const quote = family[0];\n  if (quote === '\"' || quote === \"'\") {\n    // A quoted name ends at its matching quote and holds no other, so it\n    // cannot leave the string it opened.\n    if (family.length < 2 || family.at(-1) !== quote) return false;\n    const inner = family.slice(1, -1);\n    return !inner.includes(quote) && !/[\\\\;{}]/.test(inner);\n  }\n  return FONT_IDENT.test(family);\n}\n","import {\n  CreateBrandingBody,\n  CreateFlowDefinitionBody,\n  CreateIdpBody,\n  CreateSchemaBody,\n} from \"@zitadel/api/generated/endpoints/zitadelNextGen.zod\";\nimport { z } from \"zod\";\n\nimport { isBrandingColor, isBrandingFontFamily, MAX_BRANDING_URL_BYTES } from \"./branding-css.js\";\nimport { isCanonicalLoopbackHttpUrl } from \"./branding-url.js\";\n\nexport const schemaConfigSchema = CreateSchemaBody;\nexport const flowConfigSchema = CreateFlowDefinitionBody.shape.flow_definition;\nexport const createFlowDefinitionRequestSchema = CreateFlowDefinitionBody;\n\n/**\n * One `.zitadel/idps/<slug>.json` body: the connection document `POST /idps`\n * carries under `idp`. The generated Zod enforces the contract the meta-schema\n * states, including that `client_secret` is a `${{ NAME }}` reference and\n * never a literal.\n */\nexport const idpConnectionConfigSchema = CreateIdpBody.shape.idp;\n\n/** The wire shape of a branding revision (`POST /branding` request body). */\nexport const brandingWireSchema = CreateBrandingBody;\n\n/**\n * `{ \"$file\": \"<path>\" }`, which a `.zitadel/` file may hold in place of a\n * string field the OpenAPI YAML marks `x-local: file`. The path is relative to\n * the file holding it; the CLI inlines the content before publishing.\n */\nexport const localFileReferenceSchema = z.strictObject({ $file: z.string().min(1) });\n\n/**\n * The local `.zitadel/branding/*.json` dialect: the wire shape, where\n * `liquid_template` may also be a `$file` reference to the sibling `.liquid`\n * template (the meta-schema `branding.json` mirrors this).\n */\nexport const brandingConfigSchema = z\n  .strictObject({\n    // Strict, unlike the generated wire schema: a typo like `hero_urll`\n    // must fail plan, not silently pass, get ignored by the server, and\n    // vanish on canonical write-back. The editor meta-schema already\n    // rejects unknown keys; the CLI gate has to agree.\n    ...CreateBrandingBody.shape,\n    // Raw strings instead of the generated uri fields: those trim and\n    // normalize before refinement runs, hiding exactly the forms the wire\n    // body still carries verbatim and Go's url.Parse rejects.\n    logo_url: z.string().optional(),\n    hero_url: z.string().optional(),\n    $schema: z.string().optional(),\n    liquid_template: z\n      .union([CreateBrandingBody.shape.liquid_template.unwrap(), localFileReferenceSchema])\n      .optional(),\n  })\n  .superRefine((value, ctx) => {\n    // A stylesheet alone names no face to render in, so the server rejects the\n    // pair as a pair (validateBrandingFontURL in\n    // internal/domain/branding_validator.go). plan has to agree, or apply\n    // fails after schemas and flows have already been written.\n    validateBrandingAssetUrl(value.typography?.font_url, \"typography.font_url\", ctx, {\n      loopback: false,\n    });\n    if (value.typography?.font_url !== undefined && value.typography.font_family === undefined) {\n      ctx.addIssue({\n        code: \"custom\",\n        message:\n          \"typography.font_url needs a typography.font_family to load; a stylesheet alone names no face to render in.\",\n      });\n    }\n    // Mirror the server's asset URL gate (validateBrandingAssetURL in\n    // internal/domain/branding_validator.go) so plan rejects what apply would.\n    // Apply mutates schemas and flows before branding, so a late 400 here would\n    // leave a half-applied run.\n    validateBrandingAssetUrl(value.logo_url, \"logo_url\", ctx);\n    validateBrandingAssetUrl(value.hero_url, \"hero_url\", ctx);\n    validateBrandingAssetUrl(value.theme?.light?.logo_url, \"theme.light.logo_url\", ctx);\n    validateBrandingAssetUrl(value.theme?.dark?.logo_url, \"theme.dark.logo_url\", ctx);\n    // The appearance values land in a CSS declaration, so the server stores\n    // only forms it recognises (ValidateBrandingColor / ValidateBrandingFontFamily\n    // in internal/domain/branding_css.go).\n    validateBrandingPalette(value.theme?.light?.palette, \"theme.light\", ctx);\n    validateBrandingPalette(value.theme?.dark?.palette, \"theme.dark\", ctx);\n    if (\n      value.typography?.font_family !== undefined &&\n      !isBrandingFontFamily(value.typography.font_family)\n    ) {\n      ctx.addIssue({\n        code: \"custom\",\n        message:\n          'typography.font_family must be comma-separated font names, each an identifier (Inter, ui-sans-serif) or a quoted name (\"APK Futural\").',\n      });\n    }\n  });\n\nfunction validateBrandingPalette(\n  palette: Record<string, unknown> | undefined,\n  side: string,\n  ctx: z.RefinementCtx,\n): void {\n  if (!palette) {\n    return;\n  }\n  for (const [key, colour] of Object.entries(palette)) {\n    // A non-string never reaches here: the generated object schema types every\n    // palette value as a string, and Zod skips refinements once the base parse\n    // has failed. The check is what narrows `unknown` for the call below.\n    if (typeof colour !== \"string\") {\n      continue;\n    }\n    if (isBrandingColor(colour)) {\n      continue;\n    }\n    ctx.addIssue({\n      code: \"custom\",\n      message: `${side}.palette.${key} must be hex (#4F46E5), a CSS colour name, or a colour function such as rgb(), hsl() or oklch().`,\n    });\n  }\n}\n\nfunction validateBrandingAssetUrl(\n  value: string | undefined,\n  field: string,\n  ctx: z.RefinementCtx,\n  options: { loopback?: boolean } = {},\n): void {\n  if (value === undefined || value === \"\") {\n    return;\n  }\n  // The server counts bytes (validateBrandingAssetURL), so a URL with\n  // non-ASCII characters can be short in characters and still too long.\n  if (new TextEncoder().encode(value).length > MAX_BRANDING_URL_BYTES) {\n    ctx.addIssue({\n      code: \"custom\",\n      message: `${field} must be at most ${MAX_BRANDING_URL_BYTES} bytes.`,\n    });\n    return;\n  }\n  // Stricter-or-equal than the Go gate (validateBrandingAssetURL): the WHATWG\n  // parser forgives what Go's url.Parse rejects — `https:example.com`,\n  // backslashes, and whitespace all get silently normalized. plan must never\n  // accept what apply would reject (the reverse is harmless), so reject the\n  // raw forms before parsing.\n  if (/[\\s\\\\]/.test(value)) {\n    ctx.addIssue({ code: \"custom\", message: `${field} is not a valid URL.` });\n    return;\n  }\n  if (!/^https?:\\/\\//i.test(value)) {\n    ctx.addIssue({ code: \"custom\", message: `${field} must be an absolute https URL.` });\n    return;\n  }\n  let parsed: URL;\n  try {\n    parsed = new URL(value);\n  } catch {\n    ctx.addIssue({ code: \"custom\", message: `${field} is not a valid URL.` });\n    return;\n  }\n  // Fetched by every visitor's browser, so userinfo in it is a credential in\n  // every access log — the server refuses it and so must plan.\n  if (parsed.username !== \"\" || parsed.password !== \"\") {\n    ctx.addIssue({\n      code: \"custom\",\n      message: `${field} must not carry credentials; the URL is fetched by every visitor's browser.`,\n    });\n    return;\n  }\n  // Loopback HTTP is the dev-posture carve-out (assets served from the app's\n  // own dev server), and it covers images only: a stylesheet is styling rather\n  // than an image, so it stays https everywhere. Check the raw URL so WHATWG\n  // normalisation cannot make plan accept a host spelling that the Go save\n  // gate rejects.\n  if (\n    options.loopback !== false &&\n    parsed.protocol === \"http:\" &&\n    isCanonicalLoopbackHttpUrl(value)\n  ) {\n    return;\n  }\n  if (parsed.protocol !== \"https:\" || parsed.host === \"\") {\n    ctx.addIssue({\n      code: \"custom\",\n      message: `${field} must be an absolute https URL (http is allowed for canonical loopback development hosts only).`,\n    });\n  }\n}\n"],"mappings":";;;;AAaA,MAAa,yBAAyB;AAEtC,MAAM,YAAY;;AAGlB,MAAM,kCAAkB,IAAI,IAAI;CAC9B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,MAAM,aAAa;;;;;;AAMnB,MAAM,aAAa;AACnB,MAAM,aAAa;AAEnB,SAAS,gBAAgB,OAAwB;CAC/C,MAAM,OAAO,MAAM,QAAQ,GAAG;CAC9B,IAAI,QAAQ,KAAK,CAAC,MAAM,SAAS,GAAG,GAAG,OAAO;CAC9C,IAAI,CAAC,gBAAgB,IAAI,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,OAAO;CAEvD,MAAM,OAAO,MAAM,MAAM,OAAO,GAAG,EAAE;CACrC,IAAI,CAAC,WAAW,KAAK,IAAI,GAAG,OAAO;CAInC,IAAI,QAAQ;CACZ,KAAK,MAAM,QAAQ,MACjB,IAAI,SAAS,KAAK;EAChB,SAAS;EACT,IAAI,QAAQ,GAAG,OAAO;CACxB,OAAO,IAAI,SAAS,KAAK;EACvB,SAAS;EACT,IAAI,QAAQ,GAAG,OAAO;CACxB;CAEF,OAAO,UAAU;AACnB;;AAGA,SAAgB,gBAAgB,OAAwB;CACtD,IAAI,MAAM,SAAA,KAAoC,OAAO;CACrD,IAAI,MAAM,KAAK,MAAM,IAAI,OAAO;CAEhC,IAAI,UAAU,KAAK,KAAK,GAAG,OAAO;CAClC,OAAO,WAAW,KAAK,KAAK,KAAK,gBAAgB,MAAM,YAAY,CAAC;AACtE;;AAGA,SAAgB,qBAAqB,OAAwB;CAC3D,IAAI,MAAM,SAAA,KAA0C,OAAO;CAC3D,IAAI,MAAM,KAAK,MAAM,IAAI,OAAO;CAChC,OAAO,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,WAAW,WAAW,WAAW,MAAM,CAAC,CAAC;AAC1E;;AAGA,SAAS,WAAW,OAAuB;CACzC,OAAO,MAAM,QAAQ,OAAO,EAAE,CAAC,CAAC,QAAQ,OAAO,EAAE;AACnD;AAEA,SAAS,WAAW,QAAyB;CAC3C,IAAI,WAAW,IAAI,OAAO;CAC1B,MAAM,QAAQ,OAAO;CACrB,IAAI,UAAU,QAAO,UAAU,KAAK;EAGlC,IAAI,OAAO,SAAS,KAAK,OAAO,GAAG,EAAE,MAAM,OAAO,OAAO;EACzD,MAAM,QAAQ,OAAO,MAAM,GAAG,EAAE;EAChC,OAAO,CAAC,MAAM,SAAS,KAAK,KAAK,CAAC,UAAU,KAAK,KAAK;CACxD;CACA,OAAO,WAAW,KAAK,MAAM;AAC/B;;;ACrFA,MAAa,qBAAqB;AAClC,MAAa,mBAAmB,yBAAyB,MAAM;AAC/D,MAAa,oCAAoC;;;;;;;AAQjD,MAAa,4BAA4B,cAAc,MAAM;;AAG7D,MAAa,qBAAqB;;;;;;AAOlC,MAAa,2BAA2B,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;;;;;;AAOnF,MAAa,uBAAuB,EACjC,aAAa;CAKZ,GAAG,mBAAmB;CAItB,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS;CAC7B,iBAAiB,EACd,MAAM,CAAC,mBAAmB,MAAM,gBAAgB,OAAO,GAAG,wBAAwB,CAAC,CAAC,CACpF,SAAS;AACd,CAAC,CAAC,CACD,aAAa,OAAO,QAAQ;CAK3B,yBAAyB,MAAM,YAAY,UAAU,uBAAuB,KAAK,EAC/E,UAAU,MACZ,CAAC;CACD,IAAI,MAAM,YAAY,aAAa,KAAA,KAAa,MAAM,WAAW,gBAAgB,KAAA,GAC/E,IAAI,SAAS;EACX,MAAM;EACN,SACE;CACJ,CAAC;CAMH,yBAAyB,MAAM,UAAU,YAAY,GAAG;CACxD,yBAAyB,MAAM,UAAU,YAAY,GAAG;CACxD,yBAAyB,MAAM,OAAO,OAAO,UAAU,wBAAwB,GAAG;CAClF,yBAAyB,MAAM,OAAO,MAAM,UAAU,uBAAuB,GAAG;CAIhF,wBAAwB,MAAM,OAAO,OAAO,SAAS,eAAe,GAAG;CACvE,wBAAwB,MAAM,OAAO,MAAM,SAAS,cAAc,GAAG;CACrE,IACE,MAAM,YAAY,gBAAgB,KAAA,KAClC,CAAC,qBAAqB,MAAM,WAAW,WAAW,GAElD,IAAI,SAAS;EACX,MAAM;EACN,SACE;CACJ,CAAC;AAEL,CAAC;AAEH,SAAS,wBACP,SACA,MACA,KACM;CACN,IAAI,CAAC,SACH;CAEF,KAAK,MAAM,CAAC,KAAK,WAAW,OAAO,QAAQ,OAAO,GAAG;EAInD,IAAI,OAAO,WAAW,UACpB;EAEF,IAAI,gBAAgB,MAAM,GACxB;EAEF,IAAI,SAAS;GACX,MAAM;GACN,SAAS,GAAG,KAAK,WAAW,IAAI;EAClC,CAAC;CACH;AACF;AAEA,SAAS,yBACP,OACA,OACA,KACA,UAAkC,CAAC,GAC7B;CACN,IAAI,UAAU,KAAA,KAAa,UAAU,IACnC;CAIF,IAAI,IAAI,YAAY,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,SAAA,MAAiC;EACnE,IAAI,SAAS;GACX,MAAM;GACN,SAAS,GAAG,MAAM,mBAAmB,uBAAuB;EAC9D,CAAC;EACD;CACF;CAMA,IAAI,SAAS,KAAK,KAAK,GAAG;EACxB,IAAI,SAAS;GAAE,MAAM;GAAU,SAAS,GAAG,MAAM;EAAsB,CAAC;EACxE;CACF;CACA,IAAI,CAAC,gBAAgB,KAAK,KAAK,GAAG;EAChC,IAAI,SAAS;GAAE,MAAM;GAAU,SAAS,GAAG,MAAM;EAAiC,CAAC;EACnF;CACF;CACA,IAAI;CACJ,IAAI;EACF,SAAS,IAAI,IAAI,KAAK;CACxB,QAAQ;EACN,IAAI,SAAS;GAAE,MAAM;GAAU,SAAS,GAAG,MAAM;EAAsB,CAAC;EACxE;CACF;CAGA,IAAI,OAAO,aAAa,MAAM,OAAO,aAAa,IAAI;EACpD,IAAI,SAAS;GACX,MAAM;GACN,SAAS,GAAG,MAAM;EACpB,CAAC;EACD;CACF;CAMA,IACE,QAAQ,aAAa,SACrB,OAAO,aAAa,WACpB,2BAA2B,KAAK,GAEhC;CAEF,IAAI,OAAO,aAAa,YAAY,OAAO,SAAS,IAClD,IAAI,SAAS;EACX,MAAM;EACN,SAAS,GAAG,MAAM;CACpB,CAAC;AAEL"}

package/dist/schemas.d.mts

@@ -1,17 +1,300 @@
 import { z } from "zod";
-
 //#region src/schemas.d.ts
-declare const schemaConfigSchema: any;
-declare const flowConfigSchema: any;
-declare const createFlowDefinitionRequestSchema: any;
+export declare const schemaConfigSchema: z.ZodUnion<readonly [z.ZodObject<{
+  objectType: z.ZodOptional<z.ZodString>;
+  kind: z.ZodLiteral<"user-schema">;
+  metaSchema: z.ZodURL;
+  "x-auth-methods": z.ZodObject<{
+    password: z.ZodOptional<z.ZodObject<{
+      enabled: z.ZodBoolean;
+    }, z.core.$strip>>;
+    passkey: z.ZodOptional<z.ZodObject<{
+      enabled: z.ZodBoolean;
+    }, z.core.$strip>>;
+    magic_link: z.ZodOptional<z.ZodObject<{
+      enabled: z.ZodBoolean;
+    }, z.core.$strip>>;
+    sso: z.ZodOptional<z.ZodObject<{
+      enabled: z.ZodBoolean;
+      providers: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+    otp: z.ZodOptional<z.ZodObject<{
+      enabled: z.ZodBoolean;
+    }, z.core.$strip>>;
+  }, z.core.$strip>;
+  "x-identifier": z.ZodOptional<z.ZodString>;
+  "x-display": z.ZodOptional<z.ZodArray<z.ZodString>>;
+  properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+    "x-unique": z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+      unspecified: "unspecified";
+      project: "project";
+      team: "team";
+    }>, z.ZodNull]>>;
+    "x-claim": z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNull]>>;
+    "x-audit": z.ZodDefault<z.ZodBoolean>;
+    properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+  }, z.core.$strip>>>;
+}, z.core.$strip>, z.ZodObject<{
+  kind: z.ZodLiteral<"schema-url">;
+  url: z.ZodURL;
+}, z.core.$strip>]>;
+export declare const flowConfigSchema: z.ZodObject<{
+  name: z.ZodString;
+  status: z.ZodEnum<{
+    active: "active";
+    draft: "draft";
+  }>;
+  user_schema: z.ZodString;
+  purposes: z.ZodRecord<z.ZodString, z.ZodString>;
+  audience: z.ZodOptional<z.ZodObject<{
+    team_ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    app_ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  }, z.core.$strip>>;
+  steps: z.ZodArray<z.ZodObject<{
+    name: z.ZodString;
+    fields: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    actions: z.ZodDefault<z.ZodArray<z.ZodObject<{
+      name: z.ZodString;
+      kind: z.ZodEnum<{
+        passkey: "passkey";
+        submit: "submit";
+        passkey_register: "passkey_register";
+        navigate: "navigate";
+      }>;
+      primary: z.ZodDefault<z.ZodBoolean>;
+      text_key: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+    gates: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+      kind: z.ZodEnum<{
+        captcha: "captcha";
+      }>;
+      provider: z.ZodString;
+      config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strip>>>;
+    sso_providers: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    on_success: z.ZodOptional<z.ZodEnum<{
+      create_user: "create_user";
+      create_user_with_sso: "create_user_with_sso";
+    }>>;
+    complete: z.ZodOptional<z.ZodEnum<{
+      redirect: "redirect";
+      show: "show";
+    }>>;
+    transitions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+      target: z.ZodString;
+      action: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+        switch: "switch";
+        pivot: "pivot";
+      }>, z.ZodNull]>>;
+      purpose: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+        login: "login";
+        register: "register";
+        recovery: "recovery";
+        profiling: "profiling";
+        reauth: "reauth";
+        link_account: "link_account";
+      }>, z.ZodNull]>>;
+    }, z.core.$strip>>>;
+  }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const createFlowDefinitionRequestSchema: z.ZodObject<{
+  project_id: z.ZodString;
+  schema_uri: z.ZodOptional<z.ZodURL>;
+  flow_definition: z.ZodObject<{
+    name: z.ZodString;
+    status: z.ZodEnum<{
+      active: "active";
+      draft: "draft";
+    }>;
+    user_schema: z.ZodString;
+    purposes: z.ZodRecord<z.ZodString, z.ZodString>;
+    audience: z.ZodOptional<z.ZodObject<{
+      team_ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
+      app_ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+    steps: z.ZodArray<z.ZodObject<{
+      name: z.ZodString;
+      fields: z.ZodDefault<z.ZodArray<z.ZodString>>;
+      actions: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        kind: z.ZodEnum<{
+          passkey: "passkey";
+          submit: "submit";
+          passkey_register: "passkey_register";
+          navigate: "navigate";
+        }>;
+        primary: z.ZodDefault<z.ZodBoolean>;
+        text_key: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>>>;
+      gates: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        kind: z.ZodEnum<{
+          captcha: "captcha";
+        }>;
+        provider: z.ZodString;
+        config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+      }, z.core.$strip>>>;
+      sso_providers: z.ZodDefault<z.ZodArray<z.ZodString>>;
+      on_success: z.ZodOptional<z.ZodEnum<{
+        create_user: "create_user";
+        create_user_with_sso: "create_user_with_sso";
+      }>>;
+      complete: z.ZodOptional<z.ZodEnum<{
+        redirect: "redirect";
+        show: "show";
+      }>>;
+      transitions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        target: z.ZodString;
+        action: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+          switch: "switch";
+          pivot: "pivot";
+        }>, z.ZodNull]>>;
+        purpose: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+          login: "login";
+          register: "register";
+          recovery: "recovery";
+          profiling: "profiling";
+          reauth: "reauth";
+          link_account: "link_account";
+        }>, z.ZodNull]>>;
+      }, z.core.$strip>>>;
+    }, z.core.$strip>>;
+  }, z.core.$strip>;
+}, z.core.$strip>;
+/**
+ * One `.zitadel/idps/<slug>.json` body: the connection document `POST /idps`
+ * carries under `idp`. The generated Zod enforces the contract the meta-schema
+ * states, including that `client_secret` is a `${{ NAME }}` reference and
+ * never a literal.
+ */
+export declare const idpConnectionConfigSchema: z.ZodObject<{
+  slug: z.ZodString;
+  protocol: z.ZodEnum<{
+    oidc: "oidc";
+    oauth2: "oauth2";
+  }>;
+  template: z.ZodOptional<z.ZodString>;
+  display_name: z.ZodString;
+  subject_claim: z.ZodOptional<z.ZodString>;
+  claim_mapping: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+  verified_claims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>>>;
+  provisioning: z.ZodOptional<z.ZodObject<{
+    creation: z.ZodDefault<z.ZodEnum<{
+      disabled: "disabled";
+      auto: "auto";
+    }>>;
+  }, z.core.$strip>>;
+  oidc: z.ZodOptional<z.ZodObject<{
+    issuer: z.ZodString;
+    jwks_uri: z.ZodOptional<z.ZodString>;
+    id_token_mapping: z.ZodDefault<z.ZodBoolean>;
+    authorization_endpoint: z.ZodOptional<z.ZodString>;
+    token_endpoint: z.ZodOptional<z.ZodString>;
+    userinfo_endpoint: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodString;
+    client_secret: z.ZodString;
+    token_endpoint_auth_method: z.ZodDefault<z.ZodEnum<{
+      client_secret_basic: "client_secret_basic";
+      client_secret_post: "client_secret_post";
+    }>>;
+    scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    pkce_enabled: z.ZodDefault<z.ZodBoolean>;
+    static_authorize_parameters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+  }, z.core.$strip>>;
+  oauth2: z.ZodOptional<z.ZodObject<{
+    authorization_endpoint: z.ZodString;
+    token_endpoint: z.ZodString;
+    userinfo_endpoint: z.ZodString;
+    client_id: z.ZodString;
+    client_secret: z.ZodString;
+    token_endpoint_auth_method: z.ZodDefault<z.ZodEnum<{
+      client_secret_basic: "client_secret_basic";
+      client_secret_post: "client_secret_post";
+    }>>;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    pkce_enabled: z.ZodDefault<z.ZodBoolean>;
+    static_authorize_parameters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    supplementary_fetch: z.ZodOptional<z.ZodEnum<{
+      github_primary_email: "github_primary_email";
+    }>>;
+  }, z.core.$strip>>;
+}, z.core.$strip>;
 /** The wire shape of a branding revision (`POST /branding` request body). */
-declare const brandingWireSchema: any;
+export declare const brandingWireSchema: z.ZodObject<{
+  layout: z.ZodDefault<z.ZodEnum<{
+    centered: "centered";
+    split: "split";
+  }>>;
+  liquid_template: z.ZodOptional<z.ZodString>;
+  logo_url: z.ZodOptional<z.ZodURL>;
+  hero_url: z.ZodOptional<z.ZodURL>;
+  theme: z.ZodOptional<z.ZodObject<{
+    mode: z.ZodOptional<z.ZodEnum<{
+      auto: "auto";
+      light: "light";
+      dark: "dark";
+    }>>;
+    light: z.ZodOptional<z.ZodObject<{
+      logo_url: z.ZodOptional<z.ZodURL>;
+      palette: z.ZodOptional<z.ZodObject<{
+        primary: z.ZodOptional<z.ZodString>;
+        on_primary: z.ZodOptional<z.ZodString>;
+        background: z.ZodOptional<z.ZodString>;
+        surface: z.ZodOptional<z.ZodString>;
+        muted: z.ZodOptional<z.ZodString>;
+        border: z.ZodOptional<z.ZodString>;
+        text: z.ZodOptional<z.ZodString>;
+        text_muted: z.ZodOptional<z.ZodString>;
+        link: z.ZodOptional<z.ZodString>;
+        success: z.ZodOptional<z.ZodString>;
+        warning: z.ZodOptional<z.ZodString>;
+        error: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    dark: z.ZodOptional<z.ZodObject<{
+      logo_url: z.ZodOptional<z.ZodURL>;
+      palette: z.ZodOptional<z.ZodObject<{
+        primary: z.ZodOptional<z.ZodString>;
+        on_primary: z.ZodOptional<z.ZodString>;
+        background: z.ZodOptional<z.ZodString>;
+        surface: z.ZodOptional<z.ZodString>;
+        muted: z.ZodOptional<z.ZodString>;
+        border: z.ZodOptional<z.ZodString>;
+        text: z.ZodOptional<z.ZodString>;
+        text_muted: z.ZodOptional<z.ZodString>;
+        link: z.ZodOptional<z.ZodString>;
+        success: z.ZodOptional<z.ZodString>;
+        warning: z.ZodOptional<z.ZodString>;
+        error: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>>;
+    }, z.core.$strip>>;
+  }, z.core.$strip>>;
+  typography: z.ZodOptional<z.ZodObject<{
+    font_family: z.ZodOptional<z.ZodString>;
+    font_url: z.ZodOptional<z.ZodURL>;
+    scale: z.ZodOptional<z.ZodNumber>;
+  }, z.core.$strip>>;
+  shape: z.ZodOptional<z.ZodObject<{
+    radius: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+      none: "none";
+      sm: "sm";
+      md: "md";
+      lg: "lg";
+      full: "full";
+    }>, z.ZodInt]>>;
+    density: z.ZodOptional<z.ZodEnum<{
+      compact: "compact";
+      regular: "regular";
+      comfortable: "comfortable";
+    }>>;
+    logo_scale: z.ZodOptional<z.ZodNumber>;
+  }, z.core.$strip>>;
+}, z.core.$strip>;
 /**
  * `{ "$file": "<path>" }`, which a `.zitadel/` file may hold in place of a
  * string field the OpenAPI YAML marks `x-local: file`. The path is relative to
  * the file holding it; the CLI inlines the content before publishing.
  */
-declare const localFileReferenceSchema: z.ZodObject<{
+export declare const localFileReferenceSchema: z.ZodObject<{
   $file: z.ZodString;
 }, z.core.$strict>;
 /**
@@ -19,9 +302,78 @@ declare const localFileReferenceSchema: z.ZodObject<{
  * `liquid_template` may also be a `$file` reference to the sibling `.liquid`
  * template (the meta-schema `branding.json` mirrors this).
  */
-declare const brandingConfigSchema: z.ZodObject<{
-  [x: string]: any;
+export declare const brandingConfigSchema: z.ZodObject<{
+  logo_url: z.ZodOptional<z.ZodString>;
+  hero_url: z.ZodOptional<z.ZodString>;
+  $schema: z.ZodOptional<z.ZodString>;
+  liquid_template: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+    $file: z.ZodString;
+  }, z.core.$strict>]>>;
+  layout: z.ZodDefault<z.ZodEnum<{
+    centered: "centered";
+    split: "split";
+  }>>;
+  theme: z.ZodOptional<z.ZodObject<{
+    mode: z.ZodOptional<z.ZodEnum<{
+      auto: "auto";
+      light: "light";
+      dark: "dark";
+    }>>;
+    light: z.ZodOptional<z.ZodObject<{
+      logo_url: z.ZodOptional<z.ZodURL>;
+      palette: z.ZodOptional<z.ZodObject<{
+        primary: z.ZodOptional<z.ZodString>;
+        on_primary: z.ZodOptional<z.ZodString>;
+        background: z.ZodOptional<z.ZodString>;
+        surface: z.ZodOptional<z.ZodString>;
+        muted: z.ZodOptional<z.ZodString>;
+        border: z.ZodOptional<z.ZodString>;
+        text: z.ZodOptional<z.ZodString>;
+        text_muted: z.ZodOptional<z.ZodString>;
+        link: z.ZodOptional<z.ZodString>;
+        success: z.ZodOptional<z.ZodString>;
+        warning: z.ZodOptional<z.ZodString>;
+        error: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    dark: z.ZodOptional<z.ZodObject<{
+      logo_url: z.ZodOptional<z.ZodURL>;
+      palette: z.ZodOptional<z.ZodObject<{
+        primary: z.ZodOptional<z.ZodString>;
+        on_primary: z.ZodOptional<z.ZodString>;
+        background: z.ZodOptional<z.ZodString>;
+        surface: z.ZodOptional<z.ZodString>;
+        muted: z.ZodOptional<z.ZodString>;
+        border: z.ZodOptional<z.ZodString>;
+        text: z.ZodOptional<z.ZodString>;
+        text_muted: z.ZodOptional<z.ZodString>;
+        link: z.ZodOptional<z.ZodString>;
+        success: z.ZodOptional<z.ZodString>;
+        warning: z.ZodOptional<z.ZodString>;
+        error: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>>;
+    }, z.core.$strip>>;
+  }, z.core.$strip>>;
+  typography: z.ZodOptional<z.ZodObject<{
+    font_family: z.ZodOptional<z.ZodString>;
+    font_url: z.ZodOptional<z.ZodURL>;
+    scale: z.ZodOptional<z.ZodNumber>;
+  }, z.core.$strip>>;
+  shape: z.ZodOptional<z.ZodObject<{
+    radius: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+      none: "none";
+      sm: "sm";
+      md: "md";
+      lg: "lg";
+      full: "full";
+    }>, z.ZodInt]>>;
+    density: z.ZodOptional<z.ZodEnum<{
+      compact: "compact";
+      regular: "regular";
+      comfortable: "comfortable";
+    }>>;
+    logo_scale: z.ZodOptional<z.ZodNumber>;
+  }, z.core.$strip>>;
 }, z.core.$strict>;
 //#endregion
-export { brandingConfigSchema, brandingWireSchema, createFlowDefinitionRequestSchema, flowConfigSchema, localFileReferenceSchema, schemaConfigSchema };
 //# sourceMappingURL=schemas.d.mts.map

package/dist/schemas.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.d.mts","names":[],"sources":["../src/schemas.ts"],"mappings":";;;cAca,kBAAA;AAAA,cACA,gBAAA;AAAA,cACA,iCAAA;;cAGA,kBAAA;;;AAJb;;;cAWa,wBAAA,EAAwB,CAAA,CAAA,SAAA;;;;;;;AAPrC;cAca,oBAAA,EAAoB,CAAA,CAAA,SAAA;EAAA;GAoD7B,CAAA,CAAA,IAAA,CAAA,OAAA"}
+{"version":3,"file":"schemas.d.mts","names":[],"sources":["../src/schemas.ts"],"mappings":";;qBAWa,oBAAkB,EAAA,mBAAA,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAAmB,EAAA,KAAA;qBACrC,kBAAgB,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAAiD,EAAA,KAAA;qBACjE,mCAAiC,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAA2B,EAAA,KAAA;;;;;;;qBAQ5D,2BAAyB,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAA0B,EAAA,KAAA;;qBAGnD,oBAAkB,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAAqB,EAAA,KAAA;;;;;;qBAOvC,0BAAwB,EAAA;;GAA+C,EAAA,KAAA;;;;;;qBAOvE,sBAAoB,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuD7B,EAAA,KAAA"}

package/dist/schemas.mjs

@@ -1,3 +1,3 @@
 import "./branding-url.mjs";
-import { a as localFileReferenceSchema, i as flowConfigSchema, n as brandingWireSchema, o as schemaConfigSchema, r as createFlowDefinitionRequestSchema, t as brandingConfigSchema } from "./schemas-7oNU25Qz.mjs";
-export { brandingConfigSchema, brandingWireSchema, createFlowDefinitionRequestSchema, flowConfigSchema, localFileReferenceSchema, schemaConfigSchema };
+import { a as idpConnectionConfigSchema, i as flowConfigSchema, n as brandingWireSchema, o as localFileReferenceSchema, r as createFlowDefinitionRequestSchema, s as schemaConfigSchema, t as brandingConfigSchema } from "./schemas-CUU4Rf8J.mjs";
+export { brandingConfigSchema, brandingWireSchema, createFlowDefinitionRequestSchema, flowConfigSchema, idpConnectionConfigSchema, localFileReferenceSchema, schemaConfigSchema };

package/dist/template.d.mts

@@ -1,19 +1,19 @@
 //#region src/template.d.ts
 /** The `{% mandatory_gates %}` runtime safety-net tag every template must emit. */
-declare const MANDATORY_GATES_TAG = "mandatory_gates";
+export declare const MANDATORY_GATES_TAG = "mandatory_gates";
 /**
  * Custom Liquid tags the login orchestrator registers beyond the standard
  * set. Validators must register them (as no-ops) or parsing valid templates
  * fails; `@zitadel/components` registers the real implementations.
  */
-declare const TEMPLATE_TAGS: readonly ["mandatory_gates"];
+export declare const TEMPLATE_TAGS: readonly ["mandatory_gates"];
 /**
  * Byte cap for stored templates. Mirrors `maxLength` on
  * `branding.liquid_template` in the OpenAPI contract and
  * `MaxBrandingTemplateBytes` in the Go gate.
  */
-declare const MAX_TEMPLATE_BYTES = 131072;
-type TemplateValidationSeverity = "error" | "warning";
+export declare const MAX_TEMPLATE_BYTES = 131072;
+export type TemplateValidationSeverity = "error" | "warning";
 /**
  * Rule catalog with pointers into the Go lexical gate
  * (`internal/domain/branding_validator.go`) where a server-side mirror
@@ -21,7 +21,7 @@ type TemplateValidationSeverity = "error" | "warning";
  * cannot check them (wrong dialect) and render-time behavior degrades
  * safely without them.
  */
-declare const TEMPLATE_VALIDATION_RULES: {
+export declare const TEMPLATE_VALIDATION_RULES: {
   readonly parse: {
     readonly goRef: null;
   };
@@ -47,8 +47,8 @@ declare const TEMPLATE_VALIDATION_RULES: {
     readonly goRef: null;
   };
 };
-type TemplateValidationRuleId = keyof typeof TEMPLATE_VALIDATION_RULES;
-type TemplateValidationIssue = {
+export type TemplateValidationRuleId = keyof typeof TEMPLATE_VALIDATION_RULES;
+export type TemplateValidationIssue = {
   severity: TemplateValidationSeverity;
   rule: TemplateValidationRuleId;
   message: string;
@@ -64,13 +64,12 @@ type BannedPattern = {
  * doesn't false-positive; its separator class includes `/` because HTML
  * treats a slash between attributes as whitespace (`<img/onerror=…>`).
  */
-declare const BANNED_TEMPLATE_PATTERNS: readonly BannedPattern[];
+export declare const BANNED_TEMPLATE_PATTERNS: readonly BannedPattern[];
 /**
  * Validates a login template. Pure and non-throwing, like
  * `validateFlowDefinition`: returns an issue list, empty when the template
  * is valid.
  */
-declare function validateLoginTemplate(template: string): TemplateValidationIssue[];
+export declare function validateLoginTemplate(template: string): TemplateValidationIssue[];
 //#endregion
-export { BANNED_TEMPLATE_PATTERNS, MANDATORY_GATES_TAG, MAX_TEMPLATE_BYTES, TEMPLATE_TAGS, TEMPLATE_VALIDATION_RULES, TemplateValidationIssue, TemplateValidationRuleId, TemplateValidationSeverity, validateLoginTemplate };
 //# sourceMappingURL=template.d.mts.map

package/dist/template.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"template.d.mts","names":[],"sources":["../src/template.ts"],"mappings":";;cAkBa,mBAAA;;;;;AAOb;cAAa,aAAA;;;;AAOb;;cAAa,kBAAA;AAAA,KAED,0BAAA;;AAAZ;;;;;AASA;cAAa,yBAAA;EAAA;;;;;;;;;;;;;;;;;;;;;;;;;KAWD,wBAAA,gBAAwC,yBAAA;AAAA,KAExC,uBAAA;EACV,QAAA,EAAU,0BAAA;EACV,IAAA,EAAM,wBAAA;EACN,OAAA;AAAA;AAAA,KAGG,aAAA;EACH,IAAA,EAAM,wBAAA;EACN,OAAA,EAAS,MAAA;EACT,OAAA;AAAA;AALA;;;;;;AAAA,cAcW,wBAAA,WAAmC,aAAA;;;;;AAAhD;iBAqEgB,qBAAA,CAAsB,QAAA,WAAmB,uBAAA"}
+{"version":3,"file":"template.d.mts","names":[],"sources":["../src/template.ts"],"mappings":";;qBAkBa;;;;;;qBAOA;;;;;;qBAOA;YAED;;;;;;;;qBASC;;;;;;;;;;;;;;;;;;;;;;;;;;YAWD,wCAAwC;YAExC;EACV,UAAU;EACV,MAAM;EACN;;KAGG;EACH,MAAM;EACN,SAAS;EACT;;;;;;;;qBASW,mCAAmC;;;;;;wBAqEhC,sBAAsB,mBAAmB"}

package/dist/template.mjs

@@ -126,7 +126,7 @@ function validateLoginTemplate(template) {
 	if (!MANDATORY_GATES_PATTERN.test(template)) issues.push({
 		severity: "error",
 		rule: "mandatory-gates",
-		message: "Template must contain a trailing {% mandatory_gates %} tag — the runtime safety net that appends required fields, gates, and the submit action a template forgot to render."
+		message: "Template must contain a trailing {% mandatory_gates %} tag — the runtime safety net that appends any required field and the primary action a template left out."
 	});
 	try {
 		getParseEngine().parse(template);

package/dist/template.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"template.mjs","names":[],"sources":["../src/template.ts"],"sourcesContent":["/**\n * The authoritative login-template validator (ADR 040).\n *\n * Runs where authoring happens — `zitadel plan`/`apply`, and later editors —\n * against the same LiquidJS dialect `@zitadel/components` renders. The Go\n * server cannot parse this dialect faithfully, so it only mirrors the\n * lexical subset below (`internal/domain/branding_validator.go`, see the\n * `goRef` entries in {@link TEMPLATE_VALIDATION_RULES}); keep the two\n * pattern lists in sync.\n *\n * Render-time safety does not depend on this validator: the component\n * escapes all output, neuters `| raw`, sanitises via DOMPurify, and patches\n * missing required UI with `{% mandatory_gates %}`\n * (`docs/design/flowengine/template-security.md`).\n */\nimport { Liquid } from \"liquidjs\";\n\n/** The `{% mandatory_gates %}` runtime safety-net tag every template must emit. */\nexport const MANDATORY_GATES_TAG = \"mandatory_gates\";\n\n/**\n * Custom Liquid tags the login orchestrator registers beyond the standard\n * set. Validators must register them (as no-ops) or parsing valid templates\n * fails; `@zitadel/components` registers the real implementations.\n */\nexport const TEMPLATE_TAGS = [MANDATORY_GATES_TAG] as const;\n\n/**\n * Byte cap for stored templates. Mirrors `maxLength` on\n * `branding.liquid_template` in the OpenAPI contract and\n * `MaxBrandingTemplateBytes` in the Go gate.\n */\nexport const MAX_TEMPLATE_BYTES = 131072;\n\nexport type TemplateValidationSeverity = \"error\" | \"warning\";\n\n/**\n * Rule catalog with pointers into the Go lexical gate\n * (`internal/domain/branding_validator.go`) where a server-side mirror\n * exists. `parse` and `mandatory-gates` are authoring-only: the server\n * cannot check them (wrong dialect) and render-time behavior degrades\n * safely without them.\n */\nexport const TEMPLATE_VALIDATION_RULES = {\n  parse: { goRef: null },\n  size: { goRef: \"MaxBrandingTemplateBytes\" },\n  \"no-script-tag\": { goRef: \"brandingScriptTag\" },\n  \"no-style-tag\": { goRef: \"brandingStyleTag\" },\n  \"no-inline-handlers\": { goRef: \"brandingInlineHandler\" },\n  \"no-javascript-urls\": { goRef: \"brandingJavascriptURL\" },\n  \"no-raw-filter\": { goRef: \"brandingRawFilter\" },\n  \"mandatory-gates\": { goRef: null },\n} as const;\n\nexport type TemplateValidationRuleId = keyof typeof TEMPLATE_VALIDATION_RULES;\n\nexport type TemplateValidationIssue = {\n  severity: TemplateValidationSeverity;\n  rule: TemplateValidationRuleId;\n  message: string;\n};\n\ntype BannedPattern = {\n  rule: TemplateValidationRuleId;\n  pattern: RegExp;\n  message: string;\n};\n\n/**\n * Lexical bans, identical to the Go gate. The inline-handler pattern only\n * matches inside an open tag so Liquid like `{% assign online = true %}`\n * doesn't false-positive; its separator class includes `/` because HTML\n * treats a slash between attributes as whitespace (`<img/onerror=…>`).\n */\nexport const BANNED_TEMPLATE_PATTERNS: readonly BannedPattern[] = [\n  {\n    rule: \"no-script-tag\",\n    pattern: /<\\s*script\\b/i,\n    message: \"Templates must not contain <script> tags.\",\n  },\n  {\n    rule: \"no-style-tag\",\n    pattern: /<\\s*style\\b/i,\n    message: \"Templates must not contain <style> tags — theming is orchestrator-owned via tokens.\",\n  },\n  {\n    rule: \"no-inline-handlers\",\n    pattern: /<[a-z][^>]*[\\s/]on[a-z]+\\s*=/i,\n    message: \"Templates must not contain inline event handlers (on*= attributes).\",\n  },\n  {\n    rule: \"no-javascript-urls\",\n    pattern: /javascript\\s*:/i,\n    message: \"Templates must not contain javascript: URLs.\",\n  },\n  {\n    rule: \"no-raw-filter\",\n    pattern: /\\|\\s*raw\\b/,\n    message:\n      \"Templates must not use the | raw filter. The renderer neuters it anyway; remove it from the template.\",\n  },\n] as const;\n\n// Derived from the exported tag name so a rename cannot silently diverge\n// the validator from the renderer contract.\nconst MANDATORY_GATES_PATTERN = new RegExp(`\\\\{%-?\\\\s*${MANDATORY_GATES_TAG}\\\\s*-?%\\\\}`);\n\nlet parseEngine: Liquid | undefined;\n\n/**\n * A parse-only engine mirroring the orchestrator's dialect options\n * (`packages/components/src/orchestrator/liquid.ts`); custom tags are\n * registered as no-ops because only parseability matters here.\n */\nfunction getParseEngine(): Liquid {\n  if (!parseEngine) {\n    const engine = new Liquid({\n      cache: false,\n      jsTruthy: true,\n      relativeReference: false,\n      strictFilters: false,\n      strictVariables: false,\n    });\n    for (const tag of TEMPLATE_TAGS) {\n      engine.registerTag(tag, {\n        parse() {\n          // no-op: the tag takes no arguments and no body\n        },\n        render() {\n          return \"\";\n        },\n      });\n    }\n    parseEngine = engine;\n  }\n  return parseEngine;\n}\n\n/**\n * Validates a login template. Pure and non-throwing, like\n * `validateFlowDefinition`: returns an issue list, empty when the template\n * is valid.\n */\nexport function validateLoginTemplate(template: string): TemplateValidationIssue[] {\n  const issues: TemplateValidationIssue[] = [];\n\n  const bytes = new TextEncoder().encode(template).length;\n  if (bytes > MAX_TEMPLATE_BYTES) {\n    issues.push({\n      severity: \"error\",\n      rule: \"size\",\n      message: `Template is ${bytes} bytes; the platform caps liquid_template at ${MAX_TEMPLATE_BYTES} bytes.`,\n    });\n  }\n\n  for (const banned of BANNED_TEMPLATE_PATTERNS) {\n    if (banned.pattern.test(template)) {\n      issues.push({ severity: \"error\", rule: banned.rule, message: banned.message });\n    }\n  }\n\n  if (!MANDATORY_GATES_PATTERN.test(template)) {\n    issues.push({\n      severity: \"error\",\n      rule: \"mandatory-gates\",\n      message:\n        \"Template must contain a trailing {% mandatory_gates %} tag — the runtime safety net that appends required fields, gates, and the submit action a template forgot to render.\",\n    });\n  }\n\n  try {\n    getParseEngine().parse(template);\n  } catch (error) {\n    issues.push({\n      severity: \"error\",\n      rule: \"parse\",\n      message: `Template is not valid LiquidJS: ${error instanceof Error ? error.message : String(error)}`,\n    });\n  }\n\n  return issues;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAkBA,MAAa,sBAAsB;;;;;;AAOnC,MAAa,gBAAgB,CAAC,oBAAoB;;;;;;AAOlD,MAAa,qBAAqB;;;;;;;;AAWlC,MAAa,4BAA4B;CACvC,OAAO,EAAE,OAAO,MAAM;CACtB,MAAM,EAAE,OAAO,4BAA4B;CAC3C,iBAAiB,EAAE,OAAO,qBAAqB;CAC/C,gBAAgB,EAAE,OAAO,oBAAoB;CAC7C,sBAAsB,EAAE,OAAO,yBAAyB;CACxD,sBAAsB,EAAE,OAAO,yBAAyB;CACxD,iBAAiB,EAAE,OAAO,qBAAqB;CAC/C,mBAAmB,EAAE,OAAO,MAAM;CACnC;;;;;;;AAsBD,MAAa,2BAAqD;CAChE;EACE,MAAM;EACN,SAAS;EACT,SAAS;EACV;CACD;EACE,MAAM;EACN,SAAS;EACT,SAAS;EACV;CACD;EACE,MAAM;EACN,SAAS;EACT,SAAS;EACV;CACD;EACE,MAAM;EACN,SAAS;EACT,SAAS;EACV;CACD;EACE,MAAM;EACN,SAAS;EACT,SACE;EACH;CACF;AAID,MAAM,0BAA0B,IAAI,OAAO,aAAa,oBAAoB,YAAY;AAExF,IAAI;;;;;;AAOJ,SAAS,iBAAyB;AAChC,KAAI,CAAC,aAAa;EAChB,MAAM,SAAS,IAAI,OAAO;GACxB,OAAO;GACP,UAAU;GACV,mBAAmB;GACnB,eAAe;GACf,iBAAiB;GAClB,CAAC;AACF,OAAK,MAAM,OAAO,cAChB,QAAO,YAAY,KAAK;GACtB,QAAQ;GAGR,SAAS;AACP,WAAO;;GAEV,CAAC;AAEJ,gBAAc;;AAEhB,QAAO;;;;;;;AAQT,SAAgB,sBAAsB,UAA6C;CACjF,MAAM,SAAoC,EAAE;CAE5C,MAAM,QAAQ,IAAI,aAAa,CAAC,OAAO,SAAS,CAAC;AACjD,KAAI,QAAA,OACF,QAAO,KAAK;EACV,UAAU;EACV,MAAM;EACN,SAAS,eAAe,MAAM,+CAA+C,mBAAmB;EACjG,CAAC;AAGJ,MAAK,MAAM,UAAU,yBACnB,KAAI,OAAO,QAAQ,KAAK,SAAS,CAC/B,QAAO,KAAK;EAAE,UAAU;EAAS,MAAM,OAAO;EAAM,SAAS,OAAO;EAAS,CAAC;AAIlF,KAAI,CAAC,wBAAwB,KAAK,SAAS,CACzC,QAAO,KAAK;EACV,UAAU;EACV,MAAM;EACN,SACE;EACH,CAAC;AAGJ,KAAI;AACF,kBAAgB,CAAC,MAAM,SAAS;UACzB,OAAO;AACd,SAAO,KAAK;GACV,UAAU;GACV,MAAM;GACN,SAAS,mCAAmC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;GACnG,CAAC;;AAGJ,QAAO"}
+{"version":3,"file":"template.mjs","names":[],"sources":["../src/template.ts"],"sourcesContent":["/**\n * The authoritative login-template validator (ADR 040).\n *\n * Runs where authoring happens — `zitadel plan`/`apply`, and later editors —\n * against the same LiquidJS dialect `@zitadel/components` renders. The Go\n * server cannot parse this dialect faithfully, so it only mirrors the\n * lexical subset below (`internal/domain/branding_validator.go`, see the\n * `goRef` entries in {@link TEMPLATE_VALIDATION_RULES}); keep the two\n * pattern lists in sync.\n *\n * Render-time safety does not depend on this validator: the component\n * escapes all output, neuters `| raw`, sanitises via DOMPurify, and patches\n * missing required UI with `{% mandatory_gates %}`\n * (`docs/design/flowengine/template-security.md`).\n */\nimport { Liquid } from \"liquidjs\";\n\n/** The `{% mandatory_gates %}` runtime safety-net tag every template must emit. */\nexport const MANDATORY_GATES_TAG = \"mandatory_gates\";\n\n/**\n * Custom Liquid tags the login orchestrator registers beyond the standard\n * set. Validators must register them (as no-ops) or parsing valid templates\n * fails; `@zitadel/components` registers the real implementations.\n */\nexport const TEMPLATE_TAGS = [MANDATORY_GATES_TAG] as const;\n\n/**\n * Byte cap for stored templates. Mirrors `maxLength` on\n * `branding.liquid_template` in the OpenAPI contract and\n * `MaxBrandingTemplateBytes` in the Go gate.\n */\nexport const MAX_TEMPLATE_BYTES = 131072;\n\nexport type TemplateValidationSeverity = \"error\" | \"warning\";\n\n/**\n * Rule catalog with pointers into the Go lexical gate\n * (`internal/domain/branding_validator.go`) where a server-side mirror\n * exists. `parse` and `mandatory-gates` are authoring-only: the server\n * cannot check them (wrong dialect) and render-time behavior degrades\n * safely without them.\n */\nexport const TEMPLATE_VALIDATION_RULES = {\n  parse: { goRef: null },\n  size: { goRef: \"MaxBrandingTemplateBytes\" },\n  \"no-script-tag\": { goRef: \"brandingScriptTag\" },\n  \"no-style-tag\": { goRef: \"brandingStyleTag\" },\n  \"no-inline-handlers\": { goRef: \"brandingInlineHandler\" },\n  \"no-javascript-urls\": { goRef: \"brandingJavascriptURL\" },\n  \"no-raw-filter\": { goRef: \"brandingRawFilter\" },\n  \"mandatory-gates\": { goRef: null },\n} as const;\n\nexport type TemplateValidationRuleId = keyof typeof TEMPLATE_VALIDATION_RULES;\n\nexport type TemplateValidationIssue = {\n  severity: TemplateValidationSeverity;\n  rule: TemplateValidationRuleId;\n  message: string;\n};\n\ntype BannedPattern = {\n  rule: TemplateValidationRuleId;\n  pattern: RegExp;\n  message: string;\n};\n\n/**\n * Lexical bans, identical to the Go gate. The inline-handler pattern only\n * matches inside an open tag so Liquid like `{% assign online = true %}`\n * doesn't false-positive; its separator class includes `/` because HTML\n * treats a slash between attributes as whitespace (`<img/onerror=…>`).\n */\nexport const BANNED_TEMPLATE_PATTERNS: readonly BannedPattern[] = [\n  {\n    rule: \"no-script-tag\",\n    pattern: /<\\s*script\\b/i,\n    message: \"Templates must not contain <script> tags.\",\n  },\n  {\n    rule: \"no-style-tag\",\n    pattern: /<\\s*style\\b/i,\n    message: \"Templates must not contain <style> tags — theming is orchestrator-owned via tokens.\",\n  },\n  {\n    rule: \"no-inline-handlers\",\n    pattern: /<[a-z][^>]*[\\s/]on[a-z]+\\s*=/i,\n    message: \"Templates must not contain inline event handlers (on*= attributes).\",\n  },\n  {\n    rule: \"no-javascript-urls\",\n    pattern: /javascript\\s*:/i,\n    message: \"Templates must not contain javascript: URLs.\",\n  },\n  {\n    rule: \"no-raw-filter\",\n    pattern: /\\|\\s*raw\\b/,\n    message:\n      \"Templates must not use the | raw filter. The renderer neuters it anyway; remove it from the template.\",\n  },\n] as const;\n\n// Derived from the exported tag name so a rename cannot silently diverge\n// the validator from the renderer contract.\nconst MANDATORY_GATES_PATTERN = new RegExp(`\\\\{%-?\\\\s*${MANDATORY_GATES_TAG}\\\\s*-?%\\\\}`);\n\nlet parseEngine: Liquid | undefined;\n\n/**\n * A parse-only engine mirroring the orchestrator's dialect options\n * (`packages/components/src/orchestrator/liquid.ts`); custom tags are\n * registered as no-ops because only parseability matters here.\n */\nfunction getParseEngine(): Liquid {\n  if (!parseEngine) {\n    const engine = new Liquid({\n      cache: false,\n      jsTruthy: true,\n      relativeReference: false,\n      strictFilters: false,\n      strictVariables: false,\n    });\n    for (const tag of TEMPLATE_TAGS) {\n      engine.registerTag(tag, {\n        parse() {\n          // no-op: the tag takes no arguments and no body\n        },\n        render() {\n          return \"\";\n        },\n      });\n    }\n    parseEngine = engine;\n  }\n  return parseEngine;\n}\n\n/**\n * Validates a login template. Pure and non-throwing, like\n * `validateFlowDefinition`: returns an issue list, empty when the template\n * is valid.\n */\nexport function validateLoginTemplate(template: string): TemplateValidationIssue[] {\n  const issues: TemplateValidationIssue[] = [];\n\n  const bytes = new TextEncoder().encode(template).length;\n  if (bytes > MAX_TEMPLATE_BYTES) {\n    issues.push({\n      severity: \"error\",\n      rule: \"size\",\n      message: `Template is ${bytes} bytes; the platform caps liquid_template at ${MAX_TEMPLATE_BYTES} bytes.`,\n    });\n  }\n\n  for (const banned of BANNED_TEMPLATE_PATTERNS) {\n    if (banned.pattern.test(template)) {\n      issues.push({ severity: \"error\", rule: banned.rule, message: banned.message });\n    }\n  }\n\n  if (!MANDATORY_GATES_PATTERN.test(template)) {\n    issues.push({\n      severity: \"error\",\n      rule: \"mandatory-gates\",\n      message:\n        \"Template must contain a trailing {% mandatory_gates %} tag — the runtime safety net that appends any required field and the primary action a template left out.\",\n    });\n  }\n\n  try {\n    getParseEngine().parse(template);\n  } catch (error) {\n    issues.push({\n      severity: \"error\",\n      rule: \"parse\",\n      message: `Template is not valid LiquidJS: ${error instanceof Error ? error.message : String(error)}`,\n    });\n  }\n\n  return issues;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAkBA,MAAa,sBAAsB;;;;;;AAOnC,MAAa,gBAAgB,CAAC,mBAAmB;;;;;;AAOjD,MAAa,qBAAqB;;;;;;;;AAWlC,MAAa,4BAA4B;CACvC,OAAO,EAAE,OAAO,KAAK;CACrB,MAAM,EAAE,OAAO,2BAA2B;CAC1C,iBAAiB,EAAE,OAAO,oBAAoB;CAC9C,gBAAgB,EAAE,OAAO,mBAAmB;CAC5C,sBAAsB,EAAE,OAAO,wBAAwB;CACvD,sBAAsB,EAAE,OAAO,wBAAwB;CACvD,iBAAiB,EAAE,OAAO,oBAAoB;CAC9C,mBAAmB,EAAE,OAAO,KAAK;AACnC;;;;;;;AAsBA,MAAa,2BAAqD;CAChE;EACE,MAAM;EACN,SAAS;EACT,SAAS;CACX;CACA;EACE,MAAM;EACN,SAAS;EACT,SAAS;CACX;CACA;EACE,MAAM;EACN,SAAS;EACT,SAAS;CACX;CACA;EACE,MAAM;EACN,SAAS;EACT,SAAS;CACX;CACA;EACE,MAAM;EACN,SAAS;EACT,SACE;CACJ;AACF;AAIA,MAAM,0BAA0B,IAAI,OAAO,aAAa,oBAAoB,WAAW;AAEvF,IAAI;;;;;;AAOJ,SAAS,iBAAyB;CAChC,IAAI,CAAC,aAAa;EAChB,MAAM,SAAS,IAAI,OAAO;GACxB,OAAO;GACP,UAAU;GACV,mBAAmB;GACnB,eAAe;GACf,iBAAiB;EACnB,CAAC;EACD,KAAK,MAAM,OAAO,eAChB,OAAO,YAAY,KAAK;GACtB,QAAQ,CAER;GACA,SAAS;IACP,OAAO;GACT;EACF,CAAC;EAEH,cAAc;CAChB;CACA,OAAO;AACT;;;;;;AAOA,SAAgB,sBAAsB,UAA6C;CACjF,MAAM,SAAoC,CAAC;CAE3C,MAAM,QAAQ,IAAI,YAAY,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC;CACjD,IAAI,QAAA,QACF,OAAO,KAAK;EACV,UAAU;EACV,MAAM;EACN,SAAS,eAAe,MAAM,+CAA+C,mBAAmB;CAClG,CAAC;CAGH,KAAK,MAAM,UAAU,0BACnB,IAAI,OAAO,QAAQ,KAAK,QAAQ,GAC9B,OAAO,KAAK;EAAE,UAAU;EAAS,MAAM,OAAO;EAAM,SAAS,OAAO;CAAQ,CAAC;CAIjF,IAAI,CAAC,wBAAwB,KAAK,QAAQ,GACxC,OAAO,KAAK;EACV,UAAU;EACV,MAAM;EACN,SACE;CACJ,CAAC;CAGH,IAAI;EACF,eAAe,CAAC,CAAC,MAAM,QAAQ;CACjC,SAAS,OAAO;EACd,OAAO,KAAK;GACV,UAAU;GACV,MAAM;GACN,SAAS,mCAAmC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EACnG,CAAC;CACH;CAEA,OAAO;AACT"}

package/dist/validate.d.mts

@@ -28,18 +28,21 @@
  * validator all go away. New rules land in Go first and are ported here
  * only until then.
  */
-type FlowValidationSeverity = "error" | "warning";
-type FlowValidationIssue = {
-  severity: FlowValidationSeverity; /** Stable rule id from {@link FLOW_VALIDATION_RULES}. */
-  rule: FlowValidationRuleId; /** Mirrors the Go `ErrFlowDefinitionInvalid` detail string where a Go rule exists. */
-  message: string; /** Step the issue is anchored to, when applicable. */
+export type FlowValidationSeverity = "error" | "warning";
+export type FlowValidationIssue = {
+  severity: FlowValidationSeverity;
+  /** Stable rule id from {@link FLOW_VALIDATION_RULES}. */
+  rule: FlowValidationRuleId;
+  /** Mirrors the Go `ErrFlowDefinitionInvalid` detail string where a Go rule exists. */
+  message: string;
+  /** Step the issue is anchored to, when applicable. */
   step?: string;
 };
 /**
  * Rule registry: rule id → the Go function it ports. `goRef: null` marks
  * CLI-only guidance with no server counterpart.
  */
-declare const FLOW_VALIDATION_RULES: {
+export declare const FLOW_VALIDATION_RULES: {
   readonly "step-names": {
     readonly goRef: "stepNamesMap";
   };
@@ -74,19 +77,19 @@ declare const FLOW_VALIDATION_RULES: {
     readonly goRef: null;
   };
 };
-type FlowValidationRuleId = keyof typeof FLOW_VALIDATION_RULES;
+export type FlowValidationRuleId = keyof typeof FLOW_VALIDATION_RULES;
 /** Mirrors `reservedOutcomes` in flow_definition_validator.go. */
-declare const RESERVED_OUTCOMES: readonly ["user_not_found", "user_already_exists", "identity_unknown", "callback"];
+export declare const RESERVED_OUTCOMES: readonly ["user_not_found", "user_already_exists", "sso_user_not_found", "sso_authenticated"];
 /** Mirrors the `FlowDefinitionPurpose` enum (snake transform) in flow_definition.go. */
-declare const FLOW_PURPOSES: readonly ["login", "register", "recovery", "profiling", "reauth", "link_account"];
+export declare const FLOW_PURPOSES: readonly ["login", "register", "recovery", "profiling", "reauth", "link_account"];
 /**
  * Mirrors `purposeFlipTargets` in flow_definition_validator.go: the
- * identifier outcomes only. `identity_unknown` comes only from SSO
+ * identifier outcomes only. `sso_user_not_found` comes only from SSO
  * resolution and is left out here; requiring it on every combined entry
  * step would reject the shipped default flow. A rule on steps carrying
  * sso_providers is future work (#1044).
  */
-declare const PURPOSE_FLIP_TARGETS: Readonly<Record<string, Readonly<Record<string, string>>>>;
+export declare const PURPOSE_FLIP_TARGETS: Readonly<Record<string, Readonly<Record<string, string>>>>;
 /**
  * Validate a flow-definition config body (the `.zitadel/flows/*.json`
  * content) against the rules the server enforces on apply. `schema` is
@@ -94,7 +97,6 @@ declare const PURPOSE_FLIP_TARGETS: Readonly<Record<string, Readonly<Record<stri
  * omitted, schema-dependent rules are skipped. Pure — collects all
  * issues, never throws.
  */
-declare function validateFlowDefinition(flow: object, schema?: object): FlowValidationIssue[];
+export declare function validateFlowDefinition(flow: object, schema?: object): FlowValidationIssue[];
 //#endregion
-export { FLOW_PURPOSES, FLOW_VALIDATION_RULES, FlowValidationIssue, FlowValidationRuleId, FlowValidationSeverity, PURPOSE_FLIP_TARGETS, RESERVED_OUTCOMES, validateFlowDefinition };
 //# sourceMappingURL=validate.d.mts.map

package/dist/validate.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.mts","names":[],"sources":["../src/validate.ts"],"mappings":";;AA8BA;;;;;AAEA;;;;;;;;;;;;AAcA;;;;;;;;;;;KAhBY,sBAAA;AAAA,KAEA,mBAAA;EACV,QAAA,EAAU,sBAAA;EAEV,IAAA,EAAM,oBAAA;EAEN,OAAA;EAEA,IAAA;AAAA;;;;;cAOW,qBAAA;EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAcD,oBAAA,gBAAoC,qBAAA;;cAGnC,iBAAA;;cAQA,aAAA;;;;;;;;cAgBA,oBAAA,EAAsB,QAAA,CAAS,MAAA,SAAe,QAAA,CAAS,MAAA;;;;;;;;iBAoCpD,sBAAA,CAAuB,IAAA,UAAc,MAAA,YAAkB,mBAAA"}
+{"version":3,"file":"validate.d.mts","names":[],"sources":["../src/validate.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YA8BY;YAEA;EACV,UAAU;;EAEV,MAAM;;EAEN;;EAEA;;;;;;qBAOW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAcD,oCAAoC;;qBAGnC;;qBAQA;;;;;;;;qBAgBA,sBAAsB,SAAS,eAAe,SAAS;;;;;;;;wBA2CpD,uBAAuB,cAAc,kBAAkB"}