@zitadel/config 1.0.0-alpha.24 → 1.0.0-alpha.25

package/dist/defaults.mjs

@@ -1,2 +1,2 @@
-import { _ as brandingReadmeContent, a as DEFAULT_BUILTIN_SCHEMA_BASE, c as DEFAULT_SCHEMA_CONFIG_PATH, d as SETUP_PRESETS, f as SETUP_USE_CASES, g as getDefaultLoginFlow, h as getDefaultHumanUserSchema, i as DEFAULT_BRANDING_TEMPLATE_PATH, l as DEFAULT_SETUP_PRESET, m as getDefaultBrandingConfig, n as DEFAULT_BRANDING_CONFIG_PATH, o as DEFAULT_FLOW_CONFIG_PATH, p as defaultHumanUserSchemaUrl, r as DEFAULT_BRANDING_DESIGN, s as DEFAULT_FLOW_SCHEMA_URI, t as BRANDING_DESIGNS, u as DEFAULT_SETUP_USE_CASE, v as flowsReadmeContent, y as schemasReadmeContent } from "./defaults-BnRHT7RQ.mjs";
+import { _ as brandingReadmeContent, a as DEFAULT_BUILTIN_SCHEMA_BASE, c as DEFAULT_SCHEMA_CONFIG_PATH, d as SETUP_PRESETS, f as SETUP_USE_CASES, g as getDefaultLoginFlow, h as getDefaultHumanUserSchema, i as DEFAULT_BRANDING_TEMPLATE_PATH, l as DEFAULT_SETUP_PRESET, m as getDefaultBrandingConfig, n as DEFAULT_BRANDING_CONFIG_PATH, o as DEFAULT_FLOW_CONFIG_PATH, p as defaultHumanUserSchemaUrl, r as DEFAULT_BRANDING_DESIGN, s as DEFAULT_FLOW_SCHEMA_URI, t as BRANDING_DESIGNS, u as DEFAULT_SETUP_USE_CASE, v as flowsReadmeContent, y as schemasReadmeContent } from "./defaults-COLBFU3S.mjs";
 export { BRANDING_DESIGNS, DEFAULT_BRANDING_CONFIG_PATH, DEFAULT_BRANDING_DESIGN, DEFAULT_BRANDING_TEMPLATE_PATH, DEFAULT_BUILTIN_SCHEMA_BASE, DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, DEFAULT_SETUP_PRESET, DEFAULT_SETUP_USE_CASE, SETUP_PRESETS, SETUP_USE_CASES, brandingReadmeContent, defaultHumanUserSchemaUrl, flowsReadmeContent, getDefaultBrandingConfig, getDefaultHumanUserSchema, getDefaultLoginFlow, schemasReadmeContent };

package/dist/idp/index.d.mts

@@ -0,0 +1,2 @@
+import { a as ISSUER_REQUIREMENT, c as ConnectionEndpoints, d as ScaffoldOptions, f as credentialVariable, g as variableReference, h as referencedVariable, i as OidcProvider, l as CredentialVariables, m as isVariableReference, n as idpProvider, o as isSupportedIssuer, p as credentialVariables, r as GoogleProvider, s as CallbackGuidance, t as IDP_PROVIDERS, u as IdpProvider } from "../index-Cuxu-zQD.mjs";
+export { type CallbackGuidance, type ConnectionEndpoints, type CredentialVariables, GoogleProvider, IDP_PROVIDERS, ISSUER_REQUIREMENT, type IdpProvider, OidcProvider, type ScaffoldOptions, credentialVariable, credentialVariables, idpProvider, isSupportedIssuer, isVariableReference, referencedVariable, variableReference };

package/dist/idp/index.mjs

@@ -0,0 +1,2 @@
+import { a as GoogleProvider, c as credentialVariables, d as variableReference, i as isSupportedIssuer, l as isVariableReference, n as idpProvider, o as OidcProvider, r as ISSUER_REQUIREMENT, s as credentialVariable, t as IDP_PROVIDERS, u as referencedVariable } from "../idp-ByzXQN85.mjs";
+export { GoogleProvider, IDP_PROVIDERS, ISSUER_REQUIREMENT, OidcProvider, credentialVariable, credentialVariables, idpProvider, isSupportedIssuer, isVariableReference, referencedVariable, variableReference };

package/dist/idp-ByzXQN85.mjs

@@ -0,0 +1,207 @@
+import { t as idp_connection_default } from "./idp-connection-CHxGm1Wr.mjs";
+//#region src/idp/provider.ts
+/**
+* The variables a connection scaffolded under `slug` references.
+*
+* Derived from the slug rather than the provider: a Project may hold a second
+* connection for the same provider under a slug of its own, and its
+* credentials belong to that connection, not to the provider.
+*/
+function credentialVariables(slug) {
+	return {
+		clientId: credentialVariable(slug, "CLIENT_ID"),
+		clientSecret: credentialVariable(slug, "CLIENT_SECRET")
+	};
+}
+/**
+* A credential's variable name: the slug uppercased with every non-alphanumeric
+* replaced by `_`, then the suffix. A slug may start with a digit, which no
+* shell accepts as the first character of a name, so such a name gains a `_`.
+*/
+function credentialVariable(slug, suffix) {
+	const name = `${slug.toUpperCase().replace(/[^A-Z0-9]/g, "_")}_${suffix}`;
+	return /^[0-9]/.test(name) ? `_${name}` : name;
+}
+/**
+* The `${{ NAME }}` reference written to a credential field, as
+* `idp-connection.json` requires: a whole-value placeholder, with no text
+* around it that would be rendered into the resolved credential.
+*/
+function variableReference(name) {
+	return `\${{ ${name} }}`;
+}
+/**
+* The variable a `${{ NAME }}` reference names, or `undefined` when the value
+* is not one.
+*
+* A connection is editable, so the name it references need not be the one this
+* CLI would have chosen — a hand-written file may point at `ACME_SECRET`.
+* Publishing to a name derived from the slug instead would store the credential
+* where nothing reads it and report success.
+*/
+function referencedVariable(value) {
+	return /^\$\{\{ *(\w+) *\}\}$/.exec(value.trim())?.[1];
+}
+/** Whether a stored value is a reference rather than a credential. */
+function isVariableReference(value) {
+	return referencedVariable(value) !== void 0;
+}
+//#endregion
+//#region src/idp/oidc-provider.ts
+/**
+* The parts of a connection document every OIDC provider composes the same way.
+*
+* A subclass supplies what is genuinely its own — the vendor's identity, its
+* issuer, its claim table, and any protocol settings it needs — and inherits
+* the composition. Nothing here knows about a specific vendor, so a provider
+* whose document is shaped differently overrides rather than adds a branch.
+*/
+var OidcProvider = class {
+	/** The claim that carries the provider's stable, unique id for an account. */
+	subjectClaim = "sub";
+	/**
+	* Schema property name → how its value is verified: a claim to read, `true`
+	* for a provider trusted outright, or `"$supplementary_fetch"`.
+	*
+	* Keyed by schema property, like {@link claimTable}, so it narrows with it.
+	*/
+	verifiedClaims = {};
+	/** Parameters the vendor wants on every authorization request. */
+	staticAuthorizeParameters = {};
+	claimMapping(schemaProperties) {
+		const defined = new Set(schemaProperties);
+		return Object.fromEntries(Object.entries(this.claimTable).filter(([property]) => defined.has(property)));
+	}
+	/**
+	* Compose the connection document. Pure: it returns the object the caller
+	* writes to `.zitadel/idps/<slug>.json`, and performs no IO.
+	*
+	* Neither credential is written into it. Both are `${{ NAME }}` references to
+	* project variables: the secret because the document is committed and a
+	* revision is immutable, so a literal could never be scrubbed; the id because
+	* each environment registers its own application, and a literal would force
+	* one connection file per environment.
+	*
+	* Endpoints are named only when the connection points somewhere other than
+	* the vendor, and then only the issuer. The engine accepts a connection
+	* naming every endpoint or none, and it needs four — so a subset is rejected,
+	* and a stand-in serves its own discovery document as the vendor does.
+	*/
+	connection(options) {
+		const slug = options.slug ?? this.slug;
+		const claimMapping = this.claimMapping(options.schemaProperties);
+		const verifiedClaims = Object.fromEntries(Object.entries(this.verifiedClaims).filter(([property]) => property in claimMapping));
+		const issuer = options.endpoints?.issuer;
+		const variables = credentialVariables(slug);
+		return {
+			...options.schemaRef ? { $schema: options.schemaRef } : {},
+			slug,
+			protocol: "oidc",
+			template: this.template,
+			display_name: this.displayName,
+			subject_claim: this.subjectClaim,
+			...Object.keys(verifiedClaims).length > 0 ? { verified_claims: verifiedClaims } : {},
+			...Object.keys(claimMapping).length > 0 ? { claim_mapping: claimMapping } : {},
+			provisioning: { creation: "auto" },
+			oidc: {
+				issuer: issuer !== void 0 && issuer !== "" ? issuer : this.issuer,
+				scopes: [...this.scopes],
+				...Object.keys(this.staticAuthorizeParameters).length > 0 ? { static_authorize_parameters: { ...this.staticAuthorizeParameters } } : {},
+				client_id: variableReference(variables.clientId),
+				client_secret: variableReference(variables.clientSecret)
+			}
+		};
+	}
+};
+//#endregion
+//#region src/idp/google.ts
+/**
+* Google, as `zitadel setup` and `sso enable` scaffold it.
+*
+* Everything here is Google's own documented behaviour, cross-checked against
+* its discovery document and the provider packages in zitadel/zitadel. It names
+* no endpoints: Google publishes a discovery document, its endpoints do not
+* share the issuer's host, and the engine resolves them at runtime — so a value
+* committed here would be a guess that ages.
+*/
+var GoogleProvider = class extends OidcProvider {
+	slug = "google";
+	displayName = "Google";
+	template = "google";
+	consoleUrl = "https://console.cloud.google.com/apis/credentials";
+	docsUrl = "https://developers.google.com/identity/openid-connect/openid-connect";
+	/** One client takes many redirect URIs, so one application serves every environment. */
+	callbackGuidance = "multi_uri_client";
+	issuer = "https://accounts.google.com";
+	claimTable = {
+		email: "email",
+		givenName: "given_name",
+		familyName: "family_name"
+	};
+	scopes = [
+		"openid",
+		"profile",
+		"email"
+	];
+	/** `sub` never changes, unlike an email, so identity keys on it. */
+	subjectClaim = "sub";
+	verifiedClaims = { email: "email_verified" };
+	/** Google reuses a signed-in session silently without it. */
+	staticAuthorizeParameters = { prompt: "select_account" };
+};
+//#endregion
+//#region src/idp/issuer.ts
+/**
+* The issuer values a connection may name: HTTPS anywhere, or HTTP on
+* `localhost`/`127.0.0.1` for a local stand-in.
+*
+* Read out of the generated meta-schema rather than restated here, so a prompt
+* that accepts a value and the document written from it cannot disagree. That
+* file is generated from the OpenAPI YAML the server embeds, which makes it
+* also what the server will enforce — `http://idp.internal:9100` would be
+* taken by a hand-rolled URL check and then rejected on apply.
+*/
+function issuerPattern() {
+	const pattern = ((idp_connection_default.properties?.oidc)?.properties?.issuer)?.pattern;
+	if (typeof pattern !== "string") throw new Error("idp-connection.json no longer states properties.oidc.properties.issuer.pattern");
+	return new RegExp(pattern);
+}
+let compiled;
+/** Whether a connection may name this issuer. */
+function isSupportedIssuer(value) {
+	compiled ??= issuerPattern();
+	return compiled.test(value.trim());
+}
+/** What to tell someone who typed an issuer the contract does not allow. */
+const ISSUER_REQUIREMENT = "Use an https:// URL, or http:// on localhost or 127.0.0.1.";
+//#endregion
+//#region src/idp/index.ts
+/**
+* The providers `zitadel setup` and `sso enable` can scaffold a connection for.
+*
+* Adding one means adding a class and listing it here. That is a code change
+* rather than a data change, which is the point: a provider is not only a table
+* of values, and the ones that differ — OAuth2 rather than OIDC, a second
+* request to read an email, a claim the vendor does not emit — differ in
+* behaviour. Holding that in the provider keeps it out of the callers.
+*/
+const PROVIDERS = Object.freeze([new GoogleProvider()]);
+const BY_SLUG = new Map(PROVIDERS.map((provider) => [provider.slug, provider]));
+/** Every provider's slug, in listing order. The `--provider` flag takes one. */
+const IDP_PROVIDERS = Object.freeze(PROVIDERS.map((provider) => provider.slug));
+/**
+* One provider by slug.
+*
+* Throws rather than returning `undefined`: every caller has already had the
+* slug validated against {@link IDP_PROVIDERS}, so a miss here is a bug in this
+* package and not something a caller can act on.
+*/
+function idpProvider(slug) {
+	const provider = BY_SLUG.get(slug);
+	if (provider === void 0) throw new Error(`unknown identity provider ${JSON.stringify(slug)} (known providers: ${IDP_PROVIDERS.join(", ")})`);
+	return provider;
+}
+//#endregion
+export { GoogleProvider as a, credentialVariables as c, variableReference as d, isSupportedIssuer as i, isVariableReference as l, idpProvider as n, OidcProvider as o, ISSUER_REQUIREMENT as r, credentialVariable as s, IDP_PROVIDERS as t, referencedVariable as u };
+
+//# sourceMappingURL=idp-ByzXQN85.mjs.map

package/dist/idp-ByzXQN85.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"idp-ByzXQN85.mjs","names":["idpConnectionMetaSchema"],"sources":["../src/idp/provider.ts","../src/idp/oidc-provider.ts","../src/idp/google.ts","../src/idp/issuer.ts","../src/idp/index.ts"],"sourcesContent":["/**\n * What the CLI needs to know about one identity provider to scaffold a working\n * connection for it: how to name it, where to send the developer to register an\n * application, and how to compose the connection document.\n *\n * One class per provider, because a provider is not only a table of values.\n * Google is pure data today; GitHub speaks OAuth2 rather than OIDC, has no\n * family-name claim, and needs a second request to read an email at all. A\n * shape that only holds data forces that behaviour somewhere else, where it\n * stops being the provider's business and starts being a branch in shared code.\n */\n\n/**\n * Whether the vendor accepts many redirect URIs on a single client, or needs a\n * separate application per environment. Surfaced when the developer is told\n * what to register, so they register the right thing.\n */\nexport type CallbackGuidance = \"multi_uri_client\" | \"app_per_environment\";\n\n/** Where a connection points, when not at the vendor. */\nexport type ConnectionEndpoints = {\n  readonly issuer?: string;\n};\n\n/** What a connection document needs beyond the provider's own knowledge. */\nexport type ScaffoldOptions = {\n  /** Properties the target user schema defines, which bounds the claim mapping. */\n  readonly schemaProperties: Iterable<string>;\n  /** Slug to write under; defaults to the provider's own. */\n  readonly slug?: string;\n  /** `$schema` pointer, relative to `.zitadel/idps/`. */\n  readonly schemaRef?: string;\n  /** Point the connection somewhere other than the vendor (local testing). */\n  readonly endpoints?: ConnectionEndpoints;\n};\n\nexport interface IdpProvider {\n  /** Default connection slug, and the name `--provider` takes. */\n  readonly slug: string;\n  /** Written to the connection and shown on the sign-in button. */\n  readonly displayName: string;\n  /**\n   * Written to the connection as `template`. Keys vendor knowledge only —\n   * glyphs, button branding, the setup scan — and carries no protocol\n   * behaviour.\n   */\n  readonly template: string;\n  /** Where the developer registers the application. */\n  readonly consoleUrl: string;\n  /** The vendor's own integration documentation. */\n  readonly docsUrl: string;\n  readonly callbackGuidance: CallbackGuidance;\n  /** The issuer the vendor publishes, and the default when one is asked for. */\n  readonly issuer: string;\n  /**\n   * The claims this provider emits, keyed by schema property name, narrowed to\n   * the properties the target schema actually defines.\n   */\n  claimMapping(schemaProperties: Iterable<string>): Record<string, string>;\n  /** The document `zitadel setup` writes to `.zitadel/idps/<slug>.json`. */\n  connection(options: ScaffoldOptions): Record<string, unknown>;\n}\n\n/** The project variables a connection's two credentials reference. */\nexport type CredentialVariables = {\n  readonly clientId: string;\n  readonly clientSecret: string;\n};\n\n/**\n * The variables a connection scaffolded under `slug` references.\n *\n * Derived from the slug rather than the provider: a Project may hold a second\n * connection for the same provider under a slug of its own, and its\n * credentials belong to that connection, not to the provider.\n */\nexport function credentialVariables(slug: string): CredentialVariables {\n  return {\n    clientId: credentialVariable(slug, \"CLIENT_ID\"),\n    clientSecret: credentialVariable(slug, \"CLIENT_SECRET\"),\n  };\n}\n\n/**\n * A credential's variable name: the slug uppercased with every non-alphanumeric\n * replaced by `_`, then the suffix. A slug may start with a digit, which no\n * shell accepts as the first character of a name, so such a name gains a `_`.\n */\nexport function credentialVariable(slug: string, suffix: string): string {\n  const name = `${slug.toUpperCase().replace(/[^A-Z0-9]/g, \"_\")}_${suffix}`;\n  return /^[0-9]/.test(name) ? `_${name}` : name;\n}\n\n/**\n * The `${{ NAME }}` reference written to a credential field, as\n * `idp-connection.json` requires: a whole-value placeholder, with no text\n * around it that would be rendered into the resolved credential.\n */\nexport function variableReference(name: string): string {\n  return `\\${{ ${name} }}`;\n}\n\n/**\n * The variable a `${{ NAME }}` reference names, or `undefined` when the value\n * is not one.\n *\n * A connection is editable, so the name it references need not be the one this\n * CLI would have chosen — a hand-written file may point at `ACME_SECRET`.\n * Publishing to a name derived from the slug instead would store the credential\n * where nothing reads it and report success.\n */\nexport function referencedVariable(value: string): string | undefined {\n  return /^\\$\\{\\{ *(\\w+) *\\}\\}$/.exec(value.trim())?.[1];\n}\n\n/** Whether a stored value is a reference rather than a credential. */\nexport function isVariableReference(value: string): boolean {\n  return referencedVariable(value) !== undefined;\n}\n","import {\n  credentialVariables,\n  variableReference,\n  type CallbackGuidance,\n  type IdpProvider,\n  type ScaffoldOptions,\n} from \"./provider.js\";\n\n/**\n * The parts of a connection document every OIDC provider composes the same way.\n *\n * A subclass supplies what is genuinely its own — the vendor's identity, its\n * issuer, its claim table, and any protocol settings it needs — and inherits\n * the composition. Nothing here knows about a specific vendor, so a provider\n * whose document is shaped differently overrides rather than adds a branch.\n */\nexport abstract class OidcProvider implements IdpProvider {\n  abstract readonly slug: string;\n  abstract readonly displayName: string;\n  abstract readonly template: string;\n  abstract readonly consoleUrl: string;\n  abstract readonly docsUrl: string;\n  abstract readonly callbackGuidance: CallbackGuidance;\n  abstract readonly issuer: string;\n\n  /**\n   * Schema property name → the claim this provider documents for it.\n   *\n   * Authored per provider rather than derived: each row pairs a property with\n   * the vendor's documented claim name, and a wrong one fails silently — the\n   * claim is never found and the property stays unmapped.\n   */\n  protected abstract readonly claimTable: Readonly<Record<string, string>>;\n\n  /** Scopes the connection requests. */\n  protected abstract readonly scopes: readonly string[];\n\n  /** The claim that carries the provider's stable, unique id for an account. */\n  protected readonly subjectClaim: string = \"sub\";\n\n  /**\n   * Schema property name → how its value is verified: a claim to read, `true`\n   * for a provider trusted outright, or `\"$supplementary_fetch\"`.\n   *\n   * Keyed by schema property, like {@link claimTable}, so it narrows with it.\n   */\n  protected readonly verifiedClaims: Readonly<Record<string, string | true>> = {};\n\n  /** Parameters the vendor wants on every authorization request. */\n  protected readonly staticAuthorizeParameters: Readonly<Record<string, string>> = {};\n\n  claimMapping(schemaProperties: Iterable<string>): Record<string, string> {\n    const defined = new Set(schemaProperties);\n    return Object.fromEntries(\n      Object.entries(this.claimTable).filter(([property]) => defined.has(property)),\n    );\n  }\n\n  /**\n   * Compose the connection document. Pure: it returns the object the caller\n   * writes to `.zitadel/idps/<slug>.json`, and performs no IO.\n   *\n   * Neither credential is written into it. Both are `${{ NAME }}` references to\n   * project variables: the secret because the document is committed and a\n   * revision is immutable, so a literal could never be scrubbed; the id because\n   * each environment registers its own application, and a literal would force\n   * one connection file per environment.\n   *\n   * Endpoints are named only when the connection points somewhere other than\n   * the vendor, and then only the issuer. The engine accepts a connection\n   * naming every endpoint or none, and it needs four — so a subset is rejected,\n   * and a stand-in serves its own discovery document as the vendor does.\n   */\n  connection(options: ScaffoldOptions): Record<string, unknown> {\n    const slug = options.slug ?? this.slug;\n    const claimMapping = this.claimMapping(options.schemaProperties);\n    // Verification is of a mapped value, so it narrows to what was mapped: a\n    // schema without `email` gets no email mapping, and an `email` entry here\n    // would then claim to verify a value this connection never supplies.\n    const verifiedClaims = Object.fromEntries(\n      Object.entries(this.verifiedClaims).filter(([property]) => property in claimMapping),\n    );\n    const issuer = options.endpoints?.issuer;\n    const variables = credentialVariables(slug);\n    return {\n      ...(options.schemaRef ? { $schema: options.schemaRef } : {}),\n      slug,\n      protocol: \"oidc\",\n      template: this.template,\n      display_name: this.displayName,\n      subject_claim: this.subjectClaim,\n      ...(Object.keys(verifiedClaims).length > 0 ? { verified_claims: verifiedClaims } : {}),\n      ...(Object.keys(claimMapping).length > 0 ? { claim_mapping: claimMapping } : {}),\n      provisioning: { creation: \"auto\" },\n      oidc: {\n        issuer: issuer !== undefined && issuer !== \"\" ? issuer : this.issuer,\n        scopes: [...this.scopes],\n        ...(Object.keys(this.staticAuthorizeParameters).length > 0\n          ? { static_authorize_parameters: { ...this.staticAuthorizeParameters } }\n          : {}),\n        client_id: variableReference(variables.clientId),\n        client_secret: variableReference(variables.clientSecret),\n      },\n    };\n  }\n}\n","import { OidcProvider } from \"./oidc-provider.js\";\nimport type { CallbackGuidance } from \"./provider.js\";\n\n/**\n * Google, as `zitadel setup` and `sso enable` scaffold it.\n *\n * Everything here is Google's own documented behaviour, cross-checked against\n * its discovery document and the provider packages in zitadel/zitadel. It names\n * no endpoints: Google publishes a discovery document, its endpoints do not\n * share the issuer's host, and the engine resolves them at runtime — so a value\n * committed here would be a guess that ages.\n */\nexport class GoogleProvider extends OidcProvider {\n  readonly slug = \"google\";\n  readonly displayName = \"Google\";\n  readonly template = \"google\";\n  readonly consoleUrl = \"https://console.cloud.google.com/apis/credentials\";\n  readonly docsUrl = \"https://developers.google.com/identity/openid-connect/openid-connect\";\n  /** One client takes many redirect URIs, so one application serves every environment. */\n  readonly callbackGuidance: CallbackGuidance = \"multi_uri_client\";\n  readonly issuer = \"https://accounts.google.com\";\n\n  protected readonly claimTable = {\n    email: \"email\",\n    givenName: \"given_name\",\n    familyName: \"family_name\",\n  };\n\n  protected readonly scopes = [\"openid\", \"profile\", \"email\"];\n\n  /** `sub` never changes, unlike an email, so identity keys on it. */\n  protected override readonly subjectClaim = \"sub\";\n\n  protected override readonly verifiedClaims = { email: \"email_verified\" };\n\n  /** Google reuses a signed-in session silently without it. */\n  protected override readonly staticAuthorizeParameters = { prompt: \"select_account\" };\n}\n","import idpConnectionMetaSchema from \"../../meta-schemas/idp-connection.json\" with { type: \"json\" };\n\n/**\n * The issuer values a connection may name: HTTPS anywhere, or HTTP on\n * `localhost`/`127.0.0.1` for a local stand-in.\n *\n * Read out of the generated meta-schema rather than restated here, so a prompt\n * that accepts a value and the document written from it cannot disagree. That\n * file is generated from the OpenAPI YAML the server embeds, which makes it\n * also what the server will enforce — `http://idp.internal:9100` would be\n * taken by a hand-rolled URL check and then rejected on apply.\n */\nfunction issuerPattern(): RegExp {\n  const oidc = (idpConnectionMetaSchema as { properties?: Record<string, unknown> }).properties\n    ?.oidc;\n  const issuer = (oidc as { properties?: Record<string, unknown> } | undefined)?.properties?.issuer;\n  const pattern = (issuer as { pattern?: unknown } | undefined)?.pattern;\n  if (typeof pattern !== \"string\") {\n    // Silently accepting everything would be the worst outcome: the prompt\n    // would go on reporting success for connections the server refuses.\n    throw new Error(\n      \"idp-connection.json no longer states properties.oidc.properties.issuer.pattern\",\n    );\n  }\n  return new RegExp(pattern);\n}\n\nlet compiled: RegExp | undefined;\n\n/** Whether a connection may name this issuer. */\nexport function isSupportedIssuer(value: string): boolean {\n  compiled ??= issuerPattern();\n  return compiled.test(value.trim());\n}\n\n/** What to tell someone who typed an issuer the contract does not allow. */\nexport const ISSUER_REQUIREMENT = \"Use an https:// URL, or http:// on localhost or 127.0.0.1.\";\n","/**\n * The providers `zitadel setup` and `sso enable` can scaffold a connection for.\n *\n * Adding one means adding a class and listing it here. That is a code change\n * rather than a data change, which is the point: a provider is not only a table\n * of values, and the ones that differ — OAuth2 rather than OIDC, a second\n * request to read an email, a claim the vendor does not emit — differ in\n * behaviour. Holding that in the provider keeps it out of the callers.\n */\nimport { GoogleProvider } from \"./google.js\";\nimport type { IdpProvider } from \"./provider.js\";\n\nconst PROVIDERS: readonly IdpProvider[] = Object.freeze([new GoogleProvider()]);\n\nconst BY_SLUG: ReadonlyMap<string, IdpProvider> = new Map(\n  PROVIDERS.map((provider) => [provider.slug, provider]),\n);\n\n/** Every provider's slug, in listing order. The `--provider` flag takes one. */\nexport const IDP_PROVIDERS: readonly string[] = Object.freeze(\n  PROVIDERS.map((provider) => provider.slug),\n);\n\n/**\n * One provider by slug.\n *\n * Throws rather than returning `undefined`: every caller has already had the\n * slug validated against {@link IDP_PROVIDERS}, so a miss here is a bug in this\n * package and not something a caller can act on.\n */\nexport function idpProvider(slug: string): IdpProvider {\n  const provider = BY_SLUG.get(slug);\n  if (provider === undefined) {\n    throw new Error(\n      `unknown identity provider ${JSON.stringify(slug)} (known providers: ${IDP_PROVIDERS.join(\", \")})`,\n    );\n  }\n  return provider;\n}\n\nexport { ISSUER_REQUIREMENT, isSupportedIssuer } from \"./issuer.js\";\n\nexport { GoogleProvider } from \"./google.js\";\nexport { OidcProvider } from \"./oidc-provider.js\";\nexport {\n  credentialVariable,\n  credentialVariables,\n  isVariableReference,\n  referencedVariable,\n  variableReference,\n  type CallbackGuidance,\n  type ConnectionEndpoints,\n  type CredentialVariables,\n  type IdpProvider,\n  type ScaffoldOptions,\n} from \"./provider.js\";\n"],"mappings":";;;;;;;;;AA4EA,SAAgB,oBAAoB,MAAmC;CACrE,OAAO;EACL,UAAU,mBAAmB,MAAM,WAAW;EAC9C,cAAc,mBAAmB,MAAM,eAAe;CACxD;AACF;;;;;;AAOA,SAAgB,mBAAmB,MAAc,QAAwB;CACvE,MAAM,OAAO,GAAG,KAAK,YAAY,CAAC,CAAC,QAAQ,cAAc,GAAG,EAAE,GAAG;CACjE,OAAO,SAAS,KAAK,IAAI,IAAI,IAAI,SAAS;AAC5C;;;;;;AAOA,SAAgB,kBAAkB,MAAsB;CACtD,OAAO,QAAQ,KAAK;AACtB;;;;;;;;;;AAWA,SAAgB,mBAAmB,OAAmC;CACpE,OAAO,wBAAwB,KAAK,MAAM,KAAK,CAAC,CAAC,GAAG;AACtD;;AAGA,SAAgB,oBAAoB,OAAwB;CAC1D,OAAO,mBAAmB,KAAK,MAAM,KAAA;AACvC;;;;;;;;;;;ACtGA,IAAsB,eAAtB,MAA0D;;CAsBxD,eAA0C;;;;;;;CAQ1C,iBAA6E,CAAC;;CAG9E,4BAAiF,CAAC;CAElF,aAAa,kBAA4D;EACvE,MAAM,UAAU,IAAI,IAAI,gBAAgB;EACxC,OAAO,OAAO,YACZ,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,QAAQ,CAAC,cAAc,QAAQ,IAAI,QAAQ,CAAC,CAC9E;CACF;;;;;;;;;;;;;;;;CAiBA,WAAW,SAAmD;EAC5D,MAAM,OAAO,QAAQ,QAAQ,KAAK;EAClC,MAAM,eAAe,KAAK,aAAa,QAAQ,gBAAgB;EAI/D,MAAM,iBAAiB,OAAO,YAC5B,OAAO,QAAQ,KAAK,cAAc,CAAC,CAAC,QAAQ,CAAC,cAAc,YAAY,YAAY,CACrF;EACA,MAAM,SAAS,QAAQ,WAAW;EAClC,MAAM,YAAY,oBAAoB,IAAI;EAC1C,OAAO;GACL,GAAI,QAAQ,YAAY,EAAE,SAAS,QAAQ,UAAU,IAAI,CAAC;GAC1D;GACA,UAAU;GACV,UAAU,KAAK;GACf,cAAc,KAAK;GACnB,eAAe,KAAK;GACpB,GAAI,OAAO,KAAK,cAAc,CAAC,CAAC,SAAS,IAAI,EAAE,iBAAiB,eAAe,IAAI,CAAC;GACpF,GAAI,OAAO,KAAK,YAAY,CAAC,CAAC,SAAS,IAAI,EAAE,eAAe,aAAa,IAAI,CAAC;GAC9E,cAAc,EAAE,UAAU,OAAO;GACjC,MAAM;IACJ,QAAQ,WAAW,KAAA,KAAa,WAAW,KAAK,SAAS,KAAK;IAC9D,QAAQ,CAAC,GAAG,KAAK,MAAM;IACvB,GAAI,OAAO,KAAK,KAAK,yBAAyB,CAAC,CAAC,SAAS,IACrD,EAAE,6BAA6B,EAAE,GAAG,KAAK,0BAA0B,EAAE,IACrE,CAAC;IACL,WAAW,kBAAkB,UAAU,QAAQ;IAC/C,eAAe,kBAAkB,UAAU,YAAY;GACzD;EACF;CACF;AACF;;;;;;;;;;;;AC7FA,IAAa,iBAAb,cAAoC,aAAa;CAC/C,OAAgB;CAChB,cAAuB;CACvB,WAAoB;CACpB,aAAsB;CACtB,UAAmB;;CAEnB,mBAA8C;CAC9C,SAAkB;CAElB,aAAgC;EAC9B,OAAO;EACP,WAAW;EACX,YAAY;CACd;CAEA,SAA4B;EAAC;EAAU;EAAW;CAAO;;CAGzD,eAA2C;CAE3C,iBAA6C,EAAE,OAAO,iBAAiB;;CAGvE,4BAAwD,EAAE,QAAQ,iBAAiB;AACrF;;;;;;;;;;;;;ACzBA,SAAS,gBAAwB;CAI/B,MAAM,YAHQA,uBAAqE,YAC/E,KAAA,EAC2E,YAAY,OAAA,EAC5B;CAC/D,IAAI,OAAO,YAAY,UAGrB,MAAM,IAAI,MACR,gFACF;CAEF,OAAO,IAAI,OAAO,OAAO;AAC3B;AAEA,IAAI;;AAGJ,SAAgB,kBAAkB,OAAwB;CACxD,aAAa,cAAc;CAC3B,OAAO,SAAS,KAAK,MAAM,KAAK,CAAC;AACnC;;AAGA,MAAa,qBAAqB;;;;;;;;;;;;ACxBlC,MAAM,YAAoC,OAAO,OAAO,CAAC,IAAI,eAAe,CAAC,CAAC;AAE9E,MAAM,UAA4C,IAAI,IACpD,UAAU,KAAK,aAAa,CAAC,SAAS,MAAM,QAAQ,CAAC,CACvD;;AAGA,MAAa,gBAAmC,OAAO,OACrD,UAAU,KAAK,aAAa,SAAS,IAAI,CAC3C;;;;;;;;AASA,SAAgB,YAAY,MAA2B;CACrD,MAAM,WAAW,QAAQ,IAAI,IAAI;CACjC,IAAI,aAAa,KAAA,GACf,MAAM,IAAI,MACR,6BAA6B,KAAK,UAAU,IAAI,EAAE,qBAAqB,cAAc,KAAK,IAAI,EAAE,EAClG;CAEF,OAAO;AACT"}

package/dist/idp-connection-CHxGm1Wr.mjs

@@ -0,0 +1,324 @@
+//#region meta-schemas/idp-connection.json
+var idp_connection_default = {
+	$comment: "Code generated by scripts/generate-meta-schemas.ts; DO NOT EDIT.",
+	$schema: "https://json-schema.org/draft/2020-12/schema",
+	title: "IdentityProviderConnection",
+	type: "object",
+	required: [
+		"slug",
+		"protocol",
+		"display_name"
+	],
+	additionalProperties: false,
+	properties: {
+		"$schema": {
+			"type": "string",
+			"minLength": 1,
+			"description": "Editor affordance: path or URL of this schema so editors validate and autocomplete the file (scaffolded connection files point at `.zitadel/meta/idp-connection.json`). Ignored by the platform."
+		},
+		"slug": {
+			"type": "string",
+			"pattern": "^[a-z0-9][a-z0-9_-]*$",
+			"maxLength": 64,
+			"description": "Stable identifier, referenced by user schemas (x-auth-methods.sso.providers) and flow steps (sso_providers). Unique within the Project.",
+			"examples": [
+				"google",
+				"github",
+				"corp_idp"
+			]
+		},
+		"protocol": {
+			"type": "string",
+			"enum": ["oidc", "oauth2"],
+			"description": "The protocol used by the identity provider."
+		},
+		"template": {
+			"type": "string",
+			"examples": [
+				"google",
+				"github",
+				"okta"
+			],
+			"description": "Template hint for rendering the provider (logo, colors). Carries no protocol behavior: conduct comes only from the protocol blocks."
+		},
+		"display_name": {
+			"type": "string",
+			"minLength": 1,
+			"maxLength": 256,
+			"description": "Shown to the user on the sign-in button."
+		},
+		"subject_claim": {
+			"type": "string",
+			"minLength": 1,
+			"description": "Claim carrying the provider's stable subject identifier. Optional for OIDC (the engine uses `sub` per spec; override where `sub` is pairwise, e.g. Entra `oid`). Required for OAuth2 — no `sub` guarantee."
+		},
+		"claim_mapping": {
+			"type": "object",
+			"additionalProperties": {
+				"type": "string",
+				"pattern": "^[^$]"
+			},
+			"description": "Maps user-schema property names (keys) to provider claim names (values). A value is an exact top-level claim key: no path syntax, and a dot is part of the key, so nested claims (OIDC `address`, GitHub `plan`) are not addressable yet. `$`-prefixed strings and non-string values are reserved for future mapping forms. Add properties defined in the user schemas; unmatched entries are ignored."
+		},
+		"verified_claims": {
+			"type": "object",
+			"additionalProperties": { "anyOf": [
+				{ "const": true },
+				{ "const": "$supplementary_fetch" },
+				{
+					"type": "string",
+					"pattern": "^[^$]"
+				}
+			] },
+			"description": "Maps a verifiable user-schema property to its verification source: a claim name (read the claim), the literal `true` (trust this provider unconditionally), or the `$`-pointer `\"$supplementary_fetch\"` (verified by the selected supplementary_fetch strategy per its contract - e.g. github_primary_email verifies `email` via primary && verified). Values starting with `$` are reserved; only `$supplementary_fetch` is defined. Distinct from claim_mapping, which carries values, not verification state.",
+			"examples": [
+				{ "email": "email_verified" },
+				{ "email": true },
+				{ "email": "$supplementary_fetch" }
+			]
+		},
+		"provisioning": {
+			"type": "object",
+			"additionalProperties": false,
+			"description": "How far this provider's data is trusted. `creation` defines what happens to a subject that has no account yet. With `disabled`, a user is not created. With `auto`, the user is created without a collection step when the mapped claims fill every required property of the schema. A required property with an `x-unique` scope must also arrive verified according to `verified_claims`. When a required property is missing or such a property is unverified, the collection step is shown instead, prefilled with the claims. Gating on other properties will be added when `x-verify` returns to the dialect. The following are deferred and will be added as additive changes. The `auto_only` value creates the user from complete claims or fails without collecting. The linking policy (`is_linking_allowed`, `auto_linking`), together with the account-linking journey. `is_auto_update`, together with per-property verification state.",
+			"properties": { "creation": {
+				"type": "string",
+				"enum": ["disabled", "auto"],
+				"default": "auto"
+			} }
+		},
+		"oidc": {
+			"type": "object",
+			"additionalProperties": false,
+			"description": "OIDC connection details. Endpoints come from the issuer's discovery document. A provider that exposes no .well-known document names them all instead: authorization_endpoint, token_endpoint, jwks_uri, and userinfo_endpoint unless id_token_mapping is set. Setting some but not all is rejected.",
+			"required": [
+				"issuer",
+				"client_id",
+				"client_secret",
+				"scopes"
+			],
+			"properties": {
+				"issuer": {
+					"type": "string",
+					"format": "uri",
+					"pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)(/[^\\s?#]*)?$",
+					"description": "Discovery base. Endpoints are resolved from its .well-known document unless the connection names them all."
+				},
+				"jwks_uri": {
+					"type": "string",
+					"format": "uri",
+					"pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)([/?][^\\s#]*)?$",
+					"description": "JWKS endpoint, for a provider that exposes no .well-known document. Set together with the other endpoints."
+				},
+				"id_token_mapping": {
+					"type": "boolean",
+					"default": false,
+					"description": "Read user claims from the id_token instead of the userinfo endpoint, for providers that populate only the former."
+				},
+				"authorization_endpoint": {
+					"type": "string",
+					"format": "uri",
+					"pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)([/?][^\\s#]*)?$",
+					"description": "For a provider that exposes no .well-known document. Set together with the other endpoints."
+				},
+				"token_endpoint": {
+					"type": "string",
+					"format": "uri",
+					"pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)([/?][^\\s#]*)?$",
+					"description": "For a provider that exposes no .well-known document. Set together with the other endpoints."
+				},
+				"userinfo_endpoint": {
+					"type": "string",
+					"format": "uri",
+					"pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)([/?][^\\s#]*)?$",
+					"description": "For a provider that exposes no .well-known document. Set together with the other endpoints; not needed when id_token_mapping is set."
+				},
+				"client_id": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 512,
+					"description": "Either a literal in case the same client is used in all environments, or a `${{ NAME }}` reference to a variable in case of separate clients per environment."
+				},
+				"client_secret": {
+					"type": "string",
+					"pattern": "^\\$\\{\\{ *[A-Za-z0-9_]+ *\\}\\}$",
+					"description": "A reference to the variable holding the client secret, never the secret itself. A secret may only be referenced as the entire value: text around the placeholder would be rendered into the resolved credential, so it is rejected. The engine resolves it against the environment serving the request."
+				},
+				"token_endpoint_auth_method": {
+					"type": "string",
+					"enum": ["client_secret_basic", "client_secret_post"],
+					"default": "client_secret_basic",
+					"description": "How the client authenticates at the token endpoint."
+				},
+				"scopes": {
+					"type": "array",
+					"items": {
+						"type": "string",
+						"minLength": 1
+					},
+					"uniqueItems": true,
+					"minItems": 1,
+					"contains": { "const": "openid" },
+					"default": [
+						"openid",
+						"profile",
+						"email"
+					],
+					"description": "Must contain `openid` - without it the provider returns no id_token and the connection is not OIDC. Enforced by `required` + `contains`; the `default` is a UI-prefill hint only - validators never inject it, so an omitted `scopes` is rejected regardless."
+				},
+				"pkce_enabled": {
+					"type": "boolean",
+					"default": true,
+					"description": "Send PKCE (code_challenge/code_verifier). Providers that do not support PKCE typically ignore the parameters, so `true` is safe and future-proofs; set `false` only for a provider whose token endpoint rejects them."
+				},
+				"static_authorize_parameters": {
+					"type": "object",
+					"propertyNames": {
+						"minLength": 1,
+						"not": { "enum": [
+							"client_id",
+							"redirect_uri",
+							"response_type",
+							"scope",
+							"state",
+							"nonce",
+							"code_challenge",
+							"code_challenge_method",
+							"response_mode",
+							"request",
+							"request_uri",
+							"client_secret",
+							"client_assertion"
+						] }
+					},
+					"additionalProperties": { "type": "string" },
+					"description": "Extra provider-specific authorize parameters (for example `prompt`). Engine-owned protocol parameters are reserved and rejected by `propertyNames`: the engine composes them itself, and an override of `state` or `nonce` would silently defeat CSRF and token binding. `client_secret` and `client_assertion` are rejected as they could be appended to the public authorize URL."
+				}
+			}
+		},
+		"oauth2": {
+			"type": "object",
+			"additionalProperties": false,
+			"description": "OAuth 2.0 connection details.",
+			"required": [
+				"authorization_endpoint",
+				"token_endpoint",
+				"userinfo_endpoint",
+				"client_id",
+				"client_secret"
+			],
+			"properties": {
+				"authorization_endpoint": {
+					"type": "string",
+					"format": "uri",
+					"pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)([/?][^\\s#]*)?$",
+					"description": "Where the user is sent to authorize."
+				},
+				"token_endpoint": {
+					"type": "string",
+					"format": "uri",
+					"pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)([/?][^\\s#]*)?$",
+					"description": "Where the authorization code is exchanged."
+				},
+				"userinfo_endpoint": {
+					"type": "string",
+					"format": "uri",
+					"pattern": "^(https://[^\\s/?#]+|http://(localhost|127\\.0\\.0\\.1)(:[0-9]+)?)([/?][^\\s#]*)?$",
+					"description": "Where the authenticated user's profile is fetched."
+				},
+				"client_id": {
+					"type": "string",
+					"minLength": 1,
+					"maxLength": 512,
+					"description": "Either a literal in case the same client is used in all environments, or a `${{ NAME }}` reference to a variable in case of separate clients per environment."
+				},
+				"client_secret": {
+					"type": "string",
+					"pattern": "^\\$\\{\\{ *[A-Za-z0-9_]+ *\\}\\}$",
+					"description": "A reference to the variable holding the client secret, never the secret itself. A secret may only be referenced as the entire value: text around the placeholder would be rendered into the resolved credential, so it is rejected. The engine resolves it against the environment serving the request."
+				},
+				"token_endpoint_auth_method": {
+					"type": "string",
+					"enum": ["client_secret_basic", "client_secret_post"],
+					"default": "client_secret_basic",
+					"description": "How the client authenticates at the token endpoint."
+				},
+				"scopes": {
+					"type": "array",
+					"items": {
+						"type": "string",
+						"minLength": 1
+					},
+					"uniqueItems": true,
+					"description": "Provider-specific; OAuth 2.0 defines no universal scope."
+				},
+				"pkce_enabled": {
+					"type": "boolean",
+					"default": true,
+					"description": "Send PKCE (code_challenge/code_verifier). Providers that do not support PKCE typically ignore the parameters, so `true` is safe and future-proofs; set `false` only for a provider whose token endpoint rejects them."
+				},
+				"static_authorize_parameters": {
+					"type": "object",
+					"propertyNames": {
+						"minLength": 1,
+						"not": { "enum": [
+							"client_id",
+							"redirect_uri",
+							"response_type",
+							"scope",
+							"state",
+							"nonce",
+							"code_challenge",
+							"code_challenge_method",
+							"response_mode",
+							"request",
+							"request_uri",
+							"client_secret",
+							"client_assertion"
+						] }
+					},
+					"additionalProperties": { "type": "string" },
+					"description": "Extra provider-specific authorize parameters (for example `prompt`). Engine-owned protocol parameters are reserved and rejected by `propertyNames`: the engine composes them itself, and an override of `state` or `nonce` would silently defeat CSRF and token binding. `client_secret` and `client_assertion` are rejected as they could be appended to the public authorize URL."
+				},
+				"supplementary_fetch": {
+					"type": "string",
+					"enum": ["github_primary_email"],
+					"description": "Provider-specific follow-up call after userinfo. New values are non-breaking."
+				}
+			},
+			"allOf": [{
+				"if": {
+					"properties": { "supplementary_fetch": { "const": "github_primary_email" } },
+					"required": ["supplementary_fetch"]
+				},
+				"then": {
+					"required": ["scopes"],
+					"properties": { "scopes": { "contains": { "const": "user:email" } } }
+				}
+			}]
+		}
+	},
+	allOf: [{
+		"if": {
+			"properties": { "protocol": { "const": "oidc" } },
+			"required": ["protocol"]
+		},
+		"then": {
+			"required": ["oidc"],
+			"properties": { "oauth2": false }
+		}
+	}, {
+		"if": {
+			"properties": { "protocol": { "const": "oauth2" } },
+			"required": ["protocol"]
+		},
+		"then": {
+			"required": ["oauth2", "subject_claim"],
+			"properties": { "oidc": false }
+		}
+	}]
+};
+//#endregion
+export { idp_connection_default as t };
+
+//# sourceMappingURL=idp-connection-CHxGm1Wr.mjs.map

package/dist/idp-connection-CHxGm1Wr.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"idp-connection-CHxGm1Wr.mjs","names":[],"sources":["../meta-schemas/idp-connection.json"],"sourcesContent":[""],"mappings":""}