@zitadel/config 1.0.0-alpha.24 → 1.0.0-alpha.25

package/dist/index-Cuxu-zQD.d.mts

@@ -0,0 +1,210 @@
+//#region src/idp/provider.d.ts
+/**
+ * What the CLI needs to know about one identity provider to scaffold a working
+ * connection for it: how to name it, where to send the developer to register an
+ * application, and how to compose the connection document.
+ *
+ * One class per provider, because a provider is not only a table of values.
+ * Google is pure data today; GitHub speaks OAuth2 rather than OIDC, has no
+ * family-name claim, and needs a second request to read an email at all. A
+ * shape that only holds data forces that behaviour somewhere else, where it
+ * stops being the provider's business and starts being a branch in shared code.
+ */
+/**
+ * Whether the vendor accepts many redirect URIs on a single client, or needs a
+ * separate application per environment. Surfaced when the developer is told
+ * what to register, so they register the right thing.
+ */
+type CallbackGuidance = "multi_uri_client" | "app_per_environment";
+/** Where a connection points, when not at the vendor. */
+type ConnectionEndpoints = {
+  readonly issuer?: string;
+};
+/** What a connection document needs beyond the provider's own knowledge. */
+type ScaffoldOptions = {
+  /** Properties the target user schema defines, which bounds the claim mapping. */
+  readonly schemaProperties: Iterable<string>;
+  /** Slug to write under; defaults to the provider's own. */
+  readonly slug?: string;
+  /** `$schema` pointer, relative to `.zitadel/idps/`. */
+  readonly schemaRef?: string;
+  /** Point the connection somewhere other than the vendor (local testing). */
+  readonly endpoints?: ConnectionEndpoints;
+};
+interface IdpProvider {
+  /** Default connection slug, and the name `--provider` takes. */
+  readonly slug: string;
+  /** Written to the connection and shown on the sign-in button. */
+  readonly displayName: string;
+  /**
+   * Written to the connection as `template`. Keys vendor knowledge only —
+   * glyphs, button branding, the setup scan — and carries no protocol
+   * behaviour.
+   */
+  readonly template: string;
+  /** Where the developer registers the application. */
+  readonly consoleUrl: string;
+  /** The vendor's own integration documentation. */
+  readonly docsUrl: string;
+  readonly callbackGuidance: CallbackGuidance;
+  /** The issuer the vendor publishes, and the default when one is asked for. */
+  readonly issuer: string;
+  /**
+   * The claims this provider emits, keyed by schema property name, narrowed to
+   * the properties the target schema actually defines.
+   */
+  claimMapping(schemaProperties: Iterable<string>): Record<string, string>;
+  /** The document `zitadel setup` writes to `.zitadel/idps/<slug>.json`. */
+  connection(options: ScaffoldOptions): Record<string, unknown>;
+}
+/** The project variables a connection's two credentials reference. */
+type CredentialVariables = {
+  readonly clientId: string;
+  readonly clientSecret: string;
+};
+/**
+ * The variables a connection scaffolded under `slug` references.
+ *
+ * Derived from the slug rather than the provider: a Project may hold a second
+ * connection for the same provider under a slug of its own, and its
+ * credentials belong to that connection, not to the provider.
+ */
+declare function credentialVariables(slug: string): CredentialVariables;
+/**
+ * A credential's variable name: the slug uppercased with every non-alphanumeric
+ * replaced by `_`, then the suffix. A slug may start with a digit, which no
+ * shell accepts as the first character of a name, so such a name gains a `_`.
+ */
+declare function credentialVariable(slug: string, suffix: string): string;
+/**
+ * The `${{ NAME }}` reference written to a credential field, as
+ * `idp-connection.json` requires: a whole-value placeholder, with no text
+ * around it that would be rendered into the resolved credential.
+ */
+declare function variableReference(name: string): string;
+/**
+ * The variable a `${{ NAME }}` reference names, or `undefined` when the value
+ * is not one.
+ *
+ * A connection is editable, so the name it references need not be the one this
+ * CLI would have chosen — a hand-written file may point at `ACME_SECRET`.
+ * Publishing to a name derived from the slug instead would store the credential
+ * where nothing reads it and report success.
+ */
+declare function referencedVariable(value: string): string | undefined;
+/** Whether a stored value is a reference rather than a credential. */
+declare function isVariableReference(value: string): boolean;
+//#endregion
+//#region src/idp/issuer.d.ts
+/** Whether a connection may name this issuer. */
+declare function isSupportedIssuer(value: string): boolean;
+/** What to tell someone who typed an issuer the contract does not allow. */
+declare const ISSUER_REQUIREMENT = "Use an https:// URL, or http:// on localhost or 127.0.0.1.";
+//#endregion
+//#region src/idp/oidc-provider.d.ts
+/**
+ * The parts of a connection document every OIDC provider composes the same way.
+ *
+ * A subclass supplies what is genuinely its own — the vendor's identity, its
+ * issuer, its claim table, and any protocol settings it needs — and inherits
+ * the composition. Nothing here knows about a specific vendor, so a provider
+ * whose document is shaped differently overrides rather than adds a branch.
+ */
+declare abstract class OidcProvider implements IdpProvider {
+  abstract readonly slug: string;
+  abstract readonly displayName: string;
+  abstract readonly template: string;
+  abstract readonly consoleUrl: string;
+  abstract readonly docsUrl: string;
+  abstract readonly callbackGuidance: CallbackGuidance;
+  abstract readonly issuer: string;
+  /**
+   * Schema property name → the claim this provider documents for it.
+   *
+   * Authored per provider rather than derived: each row pairs a property with
+   * the vendor's documented claim name, and a wrong one fails silently — the
+   * claim is never found and the property stays unmapped.
+   */
+  protected abstract readonly claimTable: Readonly<Record<string, string>>;
+  /** Scopes the connection requests. */
+  protected abstract readonly scopes: readonly string[];
+  /** The claim that carries the provider's stable, unique id for an account. */
+  protected readonly subjectClaim: string;
+  /**
+   * Schema property name → how its value is verified: a claim to read, `true`
+   * for a provider trusted outright, or `"$supplementary_fetch"`.
+   *
+   * Keyed by schema property, like {@link claimTable}, so it narrows with it.
+   */
+  protected readonly verifiedClaims: Readonly<Record<string, string | true>>;
+  /** Parameters the vendor wants on every authorization request. */
+  protected readonly staticAuthorizeParameters: Readonly<Record<string, string>>;
+  claimMapping(schemaProperties: Iterable<string>): Record<string, string>;
+  /**
+   * Compose the connection document. Pure: it returns the object the caller
+   * writes to `.zitadel/idps/<slug>.json`, and performs no IO.
+   *
+   * Neither credential is written into it. Both are `${{ NAME }}` references to
+   * project variables: the secret because the document is committed and a
+   * revision is immutable, so a literal could never be scrubbed; the id because
+   * each environment registers its own application, and a literal would force
+   * one connection file per environment.
+   *
+   * Endpoints are named only when the connection points somewhere other than
+   * the vendor, and then only the issuer. The engine accepts a connection
+   * naming every endpoint or none, and it needs four — so a subset is rejected,
+   * and a stand-in serves its own discovery document as the vendor does.
+   */
+  connection(options: ScaffoldOptions): Record<string, unknown>;
+}
+//#endregion
+//#region src/idp/google.d.ts
+/**
+ * Google, as `zitadel setup` and `sso enable` scaffold it.
+ *
+ * Everything here is Google's own documented behaviour, cross-checked against
+ * its discovery document and the provider packages in zitadel/zitadel. It names
+ * no endpoints: Google publishes a discovery document, its endpoints do not
+ * share the issuer's host, and the engine resolves them at runtime — so a value
+ * committed here would be a guess that ages.
+ */
+declare class GoogleProvider extends OidcProvider {
+  readonly slug = "google";
+  readonly displayName = "Google";
+  readonly template = "google";
+  readonly consoleUrl = "https://console.cloud.google.com/apis/credentials";
+  readonly docsUrl = "https://developers.google.com/identity/openid-connect/openid-connect";
+  /** One client takes many redirect URIs, so one application serves every environment. */
+  readonly callbackGuidance: CallbackGuidance;
+  readonly issuer = "https://accounts.google.com";
+  protected readonly claimTable: {
+    email: string;
+    givenName: string;
+    familyName: string;
+  };
+  protected readonly scopes: string[];
+  /** `sub` never changes, unlike an email, so identity keys on it. */
+  protected readonly subjectClaim = "sub";
+  protected readonly verifiedClaims: {
+    email: string;
+  };
+  /** Google reuses a signed-in session silently without it. */
+  protected readonly staticAuthorizeParameters: {
+    prompt: string;
+  };
+}
+//#endregion
+//#region src/idp/index.d.ts
+/** Every provider's slug, in listing order. The `--provider` flag takes one. */
+declare const IDP_PROVIDERS: readonly string[];
+/**
+ * One provider by slug.
+ *
+ * Throws rather than returning `undefined`: every caller has already had the
+ * slug validated against {@link IDP_PROVIDERS}, so a miss here is a bug in this
+ * package and not something a caller can act on.
+ */
+declare function idpProvider(slug: string): IdpProvider;
+//#endregion
+export { ISSUER_REQUIREMENT as a, ConnectionEndpoints as c, ScaffoldOptions as d, credentialVariable as f, variableReference as g, referencedVariable as h, OidcProvider as i, CredentialVariables as l, isVariableReference as m, idpProvider as n, isSupportedIssuer as o, credentialVariables as p, GoogleProvider as r, CallbackGuidance as s, IDP_PROVIDERS as t, IdpProvider as u };
+//# sourceMappingURL=index-Cuxu-zQD.d.mts.map

package/dist/index-Cuxu-zQD.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-Cuxu-zQD.d.mts","names":[],"sources":["../src/idp/provider.ts","../src/idp/issuer.ts","../src/idp/oidc-provider.ts","../src/idp/google.ts","../src/idp/index.ts"],"mappings":";;;;;;;;;;;;;;;;;KAiBY;;KAGA;WACD;;;KAIC;;WAED,kBAAkB;;WAElB;;WAEA;;WAEA,YAAY;;UAGN;;WAEN;;WAEA;;;;;;WAMA;;WAEA;;WAEA;WACA,kBAAkB;;WAElB;;;;;EAKT,aAAa,kBAAkB,mBAAmB;;EAElD,WAAW,SAAS,kBAAkB;;;KAI5B;WACD;WACA;;;;;;;;;iBAUK,oBAAoB,eAAe;;;;;;iBAYnC,mBAAmB,cAAc;;;;;;iBAUjC,kBAAkB;;;;;;;;;;iBAalB,mBAAmB;;iBAKnB,oBAAoB;;;;iBCtFpB,kBAAkB;;cAMrB;;;;;;;;;;;uBCpBS,wBAAwB;oBAC1B;oBACA;oBACA;oBACA;oBACA;oBACA,kBAAkB;oBAClB;;;;;;;;8BASU,YAAY,SAAS;;8BAGrB;;qBAGT;;;;;;;qBAQA,gBAAgB,SAAS;;qBAGzB,2BAA2B,SAAS;EAEvD,aAAa,kBAAkB,mBAAmB;;;;;;;;;;;;;;;;EAsBlD,WAAW,SAAS,kBAAkB;;;;;;;;;;;;;cC7D3B,uBAAuB;WACzB;WACA;WACA;WACA;WACA;;WAEA,kBAAkB;WAClB;qBAEU;;;;;qBAMA;;qBAGS;qBAEA;;;;qBAGA;;;;;;;cCjBjB;;;;;;;;iBAWG,YAAY,eAAe"}

package/dist/index.d.mts

@@ -1,8 +1,9 @@
 import { isCanonicalLoopbackHttpUrl } from "./branding-url.mjs";
-import { C as flowsReadmeContent, S as brandingReadmeContent, _ as SetupUseCase, a as DEFAULT_BRANDING_TEMPLATE_PATH, b as getDefaultHumanUserSchema, c as DEFAULT_FLOW_SCHEMA_URI, d as DEFAULT_SETUP_USE_CASE, f as DefaultBrandingConfig, g as SetupPreset, h as SETUP_USE_CASES, i as DEFAULT_BRANDING_DESIGN, l as DEFAULT_SCHEMA_CONFIG_PATH, m as SETUP_PRESETS, n as BrandingDesign, o as DEFAULT_BUILTIN_SCHEMA_BASE, p as DefaultConfigRenderOptions, r as DEFAULT_BRANDING_CONFIG_PATH, s as DEFAULT_FLOW_CONFIG_PATH, t as BRANDING_DESIGNS, u as DEFAULT_SETUP_PRESET, v as defaultHumanUserSchemaUrl, w as schemasReadmeContent, x as getDefaultLoginFlow, y as getDefaultBrandingConfig } from "./defaults-BnWXllBk.mjs";
+import { C as flowsReadmeContent, S as brandingReadmeContent, _ as SetupUseCase, a as DEFAULT_BRANDING_TEMPLATE_PATH, b as getDefaultHumanUserSchema, c as DEFAULT_FLOW_SCHEMA_URI, d as DEFAULT_SETUP_USE_CASE, f as DefaultBrandingConfig, g as SetupPreset, h as SETUP_USE_CASES, i as DEFAULT_BRANDING_DESIGN, l as DEFAULT_SCHEMA_CONFIG_PATH, m as SETUP_PRESETS, n as BrandingDesign, o as DEFAULT_BUILTIN_SCHEMA_BASE, p as DefaultConfigRenderOptions, r as DEFAULT_BRANDING_CONFIG_PATH, s as DEFAULT_FLOW_CONFIG_PATH, t as BRANDING_DESIGNS, u as DEFAULT_SETUP_PRESET, v as defaultHumanUserSchemaUrl, w as schemasReadmeContent, x as getDefaultLoginFlow, y as getDefaultBrandingConfig } from "./defaults-BtKIcWxW.mjs";
+import { a as ISSUER_REQUIREMENT, c as ConnectionEndpoints, d as ScaffoldOptions, f as credentialVariable, g as variableReference, h as referencedVariable, i as OidcProvider, l as CredentialVariables, m as isVariableReference, n as idpProvider, o as isSupportedIssuer, p as credentialVariables, r as GoogleProvider, s as CallbackGuidance, t as IDP_PROVIDERS, u as IdpProvider } from "./index-Cuxu-zQD.mjs";
 import { BRANDING_FILE_SCHEMA_REF, FLOW_FILE_SCHEMA_REF, META_SCHEMA_DIR, MetaSchemaFile, metaSchemaFiles } from "./meta-schemas.mjs";
 import { USER_PROPERTY_DEFAULTS, normalizeFlowBody, normalizeSchemaBody } from "./normalize.mjs";
-import { brandingConfigSchema, brandingWireSchema, createFlowDefinitionRequestSchema, flowConfigSchema, localFileReferenceSchema, schemaConfigSchema } from "./schemas.mjs";
+import { brandingConfigSchema, brandingWireSchema, createFlowDefinitionRequestSchema, flowConfigSchema, idpConnectionConfigSchema, localFileReferenceSchema, schemaConfigSchema } from "./schemas.mjs";
 import { BANNED_TEMPLATE_PATTERNS, MANDATORY_GATES_TAG, MAX_TEMPLATE_BYTES, TEMPLATE_TAGS, TEMPLATE_VALIDATION_RULES, TemplateValidationIssue, TemplateValidationRuleId, TemplateValidationSeverity, validateLoginTemplate } from "./template.mjs";
 import { FLOW_PURPOSES, FLOW_VALIDATION_RULES, FlowValidationIssue, FlowValidationRuleId, FlowValidationSeverity, PURPOSE_FLIP_TARGETS, RESERVED_OUTCOMES, validateFlowDefinition } from "./validate.mjs";
-export { BANNED_TEMPLATE_PATTERNS, BRANDING_DESIGNS, BRANDING_FILE_SCHEMA_REF, BrandingDesign, DEFAULT_BRANDING_CONFIG_PATH, DEFAULT_BRANDING_DESIGN, DEFAULT_BRANDING_TEMPLATE_PATH, DEFAULT_BUILTIN_SCHEMA_BASE, DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, DEFAULT_SETUP_PRESET, DEFAULT_SETUP_USE_CASE, DefaultBrandingConfig, DefaultConfigRenderOptions, FLOW_FILE_SCHEMA_REF, FLOW_PURPOSES, FLOW_VALIDATION_RULES, FlowValidationIssue, FlowValidationRuleId, FlowValidationSeverity, MANDATORY_GATES_TAG, MAX_TEMPLATE_BYTES, META_SCHEMA_DIR, MetaSchemaFile, PURPOSE_FLIP_TARGETS, RESERVED_OUTCOMES, SETUP_PRESETS, SETUP_USE_CASES, SetupPreset, SetupUseCase, TEMPLATE_TAGS, TEMPLATE_VALIDATION_RULES, TemplateValidationIssue, TemplateValidationRuleId, TemplateValidationSeverity, USER_PROPERTY_DEFAULTS, brandingConfigSchema, brandingReadmeContent, brandingWireSchema, createFlowDefinitionRequestSchema, defaultHumanUserSchemaUrl, flowConfigSchema, flowsReadmeContent, getDefaultBrandingConfig, getDefaultHumanUserSchema, getDefaultLoginFlow, isCanonicalLoopbackHttpUrl, localFileReferenceSchema, metaSchemaFiles, normalizeFlowBody, normalizeSchemaBody, schemaConfigSchema, schemasReadmeContent, validateFlowDefinition, validateLoginTemplate };
+export { BANNED_TEMPLATE_PATTERNS, BRANDING_DESIGNS, BRANDING_FILE_SCHEMA_REF, BrandingDesign, type CallbackGuidance, type ConnectionEndpoints, type CredentialVariables, DEFAULT_BRANDING_CONFIG_PATH, DEFAULT_BRANDING_DESIGN, DEFAULT_BRANDING_TEMPLATE_PATH, DEFAULT_BUILTIN_SCHEMA_BASE, DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, DEFAULT_SETUP_PRESET, DEFAULT_SETUP_USE_CASE, DefaultBrandingConfig, DefaultConfigRenderOptions, FLOW_FILE_SCHEMA_REF, FLOW_PURPOSES, FLOW_VALIDATION_RULES, FlowValidationIssue, FlowValidationRuleId, FlowValidationSeverity, GoogleProvider, IDP_PROVIDERS, ISSUER_REQUIREMENT, type IdpProvider, MANDATORY_GATES_TAG, MAX_TEMPLATE_BYTES, META_SCHEMA_DIR, MetaSchemaFile, OidcProvider, PURPOSE_FLIP_TARGETS, RESERVED_OUTCOMES, SETUP_PRESETS, SETUP_USE_CASES, type ScaffoldOptions, SetupPreset, SetupUseCase, TEMPLATE_TAGS, TEMPLATE_VALIDATION_RULES, TemplateValidationIssue, TemplateValidationRuleId, TemplateValidationSeverity, USER_PROPERTY_DEFAULTS, brandingConfigSchema, brandingReadmeContent, brandingWireSchema, createFlowDefinitionRequestSchema, credentialVariable, credentialVariables, defaultHumanUserSchemaUrl, flowConfigSchema, flowsReadmeContent, getDefaultBrandingConfig, getDefaultHumanUserSchema, getDefaultLoginFlow, idpConnectionConfigSchema, idpProvider, isCanonicalLoopbackHttpUrl, isSupportedIssuer, isVariableReference, localFileReferenceSchema, metaSchemaFiles, normalizeFlowBody, normalizeSchemaBody, referencedVariable, schemaConfigSchema, schemasReadmeContent, validateFlowDefinition, validateLoginTemplate, variableReference };

package/dist/index.mjs

@@ -1,8 +1,9 @@
 import { isCanonicalLoopbackHttpUrl } from "./branding-url.mjs";
-import { _ as brandingReadmeContent, a as DEFAULT_BUILTIN_SCHEMA_BASE, c as DEFAULT_SCHEMA_CONFIG_PATH, d as SETUP_PRESETS, f as SETUP_USE_CASES, g as getDefaultLoginFlow, h as getDefaultHumanUserSchema, i as DEFAULT_BRANDING_TEMPLATE_PATH, l as DEFAULT_SETUP_PRESET, m as getDefaultBrandingConfig, n as DEFAULT_BRANDING_CONFIG_PATH, o as DEFAULT_FLOW_CONFIG_PATH, p as defaultHumanUserSchemaUrl, r as DEFAULT_BRANDING_DESIGN, s as DEFAULT_FLOW_SCHEMA_URI, t as BRANDING_DESIGNS, u as DEFAULT_SETUP_USE_CASE, v as flowsReadmeContent, y as schemasReadmeContent } from "./defaults-BnRHT7RQ.mjs";
-import { i as metaSchemaFiles, n as FLOW_FILE_SCHEMA_REF, r as META_SCHEMA_DIR, t as BRANDING_FILE_SCHEMA_REF } from "./meta-schemas-K8f7YZYz.mjs";
+import { _ as brandingReadmeContent, a as DEFAULT_BUILTIN_SCHEMA_BASE, c as DEFAULT_SCHEMA_CONFIG_PATH, d as SETUP_PRESETS, f as SETUP_USE_CASES, g as getDefaultLoginFlow, h as getDefaultHumanUserSchema, i as DEFAULT_BRANDING_TEMPLATE_PATH, l as DEFAULT_SETUP_PRESET, m as getDefaultBrandingConfig, n as DEFAULT_BRANDING_CONFIG_PATH, o as DEFAULT_FLOW_CONFIG_PATH, p as defaultHumanUserSchemaUrl, r as DEFAULT_BRANDING_DESIGN, s as DEFAULT_FLOW_SCHEMA_URI, t as BRANDING_DESIGNS, u as DEFAULT_SETUP_USE_CASE, v as flowsReadmeContent, y as schemasReadmeContent } from "./defaults-COLBFU3S.mjs";
+import { a as GoogleProvider, c as credentialVariables, d as variableReference, i as isSupportedIssuer, l as isVariableReference, n as idpProvider, o as OidcProvider, r as ISSUER_REQUIREMENT, s as credentialVariable, t as IDP_PROVIDERS, u as referencedVariable } from "./idp-ByzXQN85.mjs";
+import { i as metaSchemaFiles, n as FLOW_FILE_SCHEMA_REF, r as META_SCHEMA_DIR, t as BRANDING_FILE_SCHEMA_REF } from "./meta-schemas-C03zgFux.mjs";
 import { USER_PROPERTY_DEFAULTS, normalizeFlowBody, normalizeSchemaBody } from "./normalize.mjs";
-import { a as localFileReferenceSchema, i as flowConfigSchema, n as brandingWireSchema, o as schemaConfigSchema, r as createFlowDefinitionRequestSchema, t as brandingConfigSchema } from "./schemas-7oNU25Qz.mjs";
+import { a as idpConnectionConfigSchema, i as flowConfigSchema, n as brandingWireSchema, o as localFileReferenceSchema, r as createFlowDefinitionRequestSchema, s as schemaConfigSchema, t as brandingConfigSchema } from "./schemas-CUU4Rf8J.mjs";
 import { BANNED_TEMPLATE_PATTERNS, MANDATORY_GATES_TAG, MAX_TEMPLATE_BYTES, TEMPLATE_TAGS, TEMPLATE_VALIDATION_RULES, validateLoginTemplate } from "./template.mjs";
 import { FLOW_PURPOSES, FLOW_VALIDATION_RULES, PURPOSE_FLIP_TARGETS, RESERVED_OUTCOMES, validateFlowDefinition } from "./validate.mjs";
-export { BANNED_TEMPLATE_PATTERNS, BRANDING_DESIGNS, BRANDING_FILE_SCHEMA_REF, DEFAULT_BRANDING_CONFIG_PATH, DEFAULT_BRANDING_DESIGN, DEFAULT_BRANDING_TEMPLATE_PATH, DEFAULT_BUILTIN_SCHEMA_BASE, DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, DEFAULT_SETUP_PRESET, DEFAULT_SETUP_USE_CASE, FLOW_FILE_SCHEMA_REF, FLOW_PURPOSES, FLOW_VALIDATION_RULES, MANDATORY_GATES_TAG, MAX_TEMPLATE_BYTES, META_SCHEMA_DIR, PURPOSE_FLIP_TARGETS, RESERVED_OUTCOMES, SETUP_PRESETS, SETUP_USE_CASES, TEMPLATE_TAGS, TEMPLATE_VALIDATION_RULES, USER_PROPERTY_DEFAULTS, brandingConfigSchema, brandingReadmeContent, brandingWireSchema, createFlowDefinitionRequestSchema, defaultHumanUserSchemaUrl, flowConfigSchema, flowsReadmeContent, getDefaultBrandingConfig, getDefaultHumanUserSchema, getDefaultLoginFlow, isCanonicalLoopbackHttpUrl, localFileReferenceSchema, metaSchemaFiles, normalizeFlowBody, normalizeSchemaBody, schemaConfigSchema, schemasReadmeContent, validateFlowDefinition, validateLoginTemplate };
+export { BANNED_TEMPLATE_PATTERNS, BRANDING_DESIGNS, BRANDING_FILE_SCHEMA_REF, DEFAULT_BRANDING_CONFIG_PATH, DEFAULT_BRANDING_DESIGN, DEFAULT_BRANDING_TEMPLATE_PATH, DEFAULT_BUILTIN_SCHEMA_BASE, DEFAULT_FLOW_CONFIG_PATH, DEFAULT_FLOW_SCHEMA_URI, DEFAULT_SCHEMA_CONFIG_PATH, DEFAULT_SETUP_PRESET, DEFAULT_SETUP_USE_CASE, FLOW_FILE_SCHEMA_REF, FLOW_PURPOSES, FLOW_VALIDATION_RULES, GoogleProvider, IDP_PROVIDERS, ISSUER_REQUIREMENT, MANDATORY_GATES_TAG, MAX_TEMPLATE_BYTES, META_SCHEMA_DIR, OidcProvider, PURPOSE_FLIP_TARGETS, RESERVED_OUTCOMES, SETUP_PRESETS, SETUP_USE_CASES, TEMPLATE_TAGS, TEMPLATE_VALIDATION_RULES, USER_PROPERTY_DEFAULTS, brandingConfigSchema, brandingReadmeContent, brandingWireSchema, createFlowDefinitionRequestSchema, credentialVariable, credentialVariables, defaultHumanUserSchemaUrl, flowConfigSchema, flowsReadmeContent, getDefaultBrandingConfig, getDefaultHumanUserSchema, getDefaultLoginFlow, idpConnectionConfigSchema, idpProvider, isCanonicalLoopbackHttpUrl, isSupportedIssuer, isVariableReference, localFileReferenceSchema, metaSchemaFiles, normalizeFlowBody, normalizeSchemaBody, referencedVariable, schemaConfigSchema, schemasReadmeContent, validateFlowDefinition, validateLoginTemplate, variableReference };