@zitadel/config 1.0.0-alpha.24 → 1.0.0-alpha.25

package/dist/schemas.d.mts

@@ -1,17 +1,300 @@
 import { z } from "zod";
-
 //#region src/schemas.d.ts
-declare const schemaConfigSchema: any;
-declare const flowConfigSchema: any;
-declare const createFlowDefinitionRequestSchema: any;
+export declare const schemaConfigSchema: z.ZodUnion<readonly [z.ZodObject<{
+  objectType: z.ZodOptional<z.ZodString>;
+  kind: z.ZodLiteral<"user-schema">;
+  metaSchema: z.ZodURL;
+  "x-auth-methods": z.ZodObject<{
+    password: z.ZodOptional<z.ZodObject<{
+      enabled: z.ZodBoolean;
+    }, z.core.$strip>>;
+    passkey: z.ZodOptional<z.ZodObject<{
+      enabled: z.ZodBoolean;
+    }, z.core.$strip>>;
+    magic_link: z.ZodOptional<z.ZodObject<{
+      enabled: z.ZodBoolean;
+    }, z.core.$strip>>;
+    sso: z.ZodOptional<z.ZodObject<{
+      enabled: z.ZodBoolean;
+      providers: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+    otp: z.ZodOptional<z.ZodObject<{
+      enabled: z.ZodBoolean;
+    }, z.core.$strip>>;
+  }, z.core.$strip>;
+  "x-identifier": z.ZodOptional<z.ZodString>;
+  "x-display": z.ZodOptional<z.ZodArray<z.ZodString>>;
+  properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+    "x-unique": z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+      unspecified: "unspecified";
+      project: "project";
+      team: "team";
+    }>, z.ZodNull]>>;
+    "x-claim": z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNull]>>;
+    "x-audit": z.ZodDefault<z.ZodBoolean>;
+    properties: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+  }, z.core.$strip>>>;
+}, z.core.$strip>, z.ZodObject<{
+  kind: z.ZodLiteral<"schema-url">;
+  url: z.ZodURL;
+}, z.core.$strip>]>;
+export declare const flowConfigSchema: z.ZodObject<{
+  name: z.ZodString;
+  status: z.ZodEnum<{
+    active: "active";
+    draft: "draft";
+  }>;
+  user_schema: z.ZodString;
+  purposes: z.ZodRecord<z.ZodString, z.ZodString>;
+  audience: z.ZodOptional<z.ZodObject<{
+    team_ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    app_ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
+  }, z.core.$strip>>;
+  steps: z.ZodArray<z.ZodObject<{
+    name: z.ZodString;
+    fields: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    actions: z.ZodDefault<z.ZodArray<z.ZodObject<{
+      name: z.ZodString;
+      kind: z.ZodEnum<{
+        passkey: "passkey";
+        submit: "submit";
+        passkey_register: "passkey_register";
+        navigate: "navigate";
+      }>;
+      primary: z.ZodDefault<z.ZodBoolean>;
+      text_key: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>>;
+    gates: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+      kind: z.ZodEnum<{
+        captcha: "captcha";
+      }>;
+      provider: z.ZodString;
+      config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strip>>>;
+    sso_providers: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    on_success: z.ZodOptional<z.ZodEnum<{
+      create_user: "create_user";
+      create_user_with_sso: "create_user_with_sso";
+    }>>;
+    complete: z.ZodOptional<z.ZodEnum<{
+      redirect: "redirect";
+      show: "show";
+    }>>;
+    transitions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+      target: z.ZodString;
+      action: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+        switch: "switch";
+        pivot: "pivot";
+      }>, z.ZodNull]>>;
+      purpose: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+        login: "login";
+        register: "register";
+        recovery: "recovery";
+        profiling: "profiling";
+        reauth: "reauth";
+        link_account: "link_account";
+      }>, z.ZodNull]>>;
+    }, z.core.$strip>>>;
+  }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const createFlowDefinitionRequestSchema: z.ZodObject<{
+  project_id: z.ZodString;
+  schema_uri: z.ZodOptional<z.ZodURL>;
+  flow_definition: z.ZodObject<{
+    name: z.ZodString;
+    status: z.ZodEnum<{
+      active: "active";
+      draft: "draft";
+    }>;
+    user_schema: z.ZodString;
+    purposes: z.ZodRecord<z.ZodString, z.ZodString>;
+    audience: z.ZodOptional<z.ZodObject<{
+      team_ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
+      app_ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+    steps: z.ZodArray<z.ZodObject<{
+      name: z.ZodString;
+      fields: z.ZodDefault<z.ZodArray<z.ZodString>>;
+      actions: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        kind: z.ZodEnum<{
+          passkey: "passkey";
+          submit: "submit";
+          passkey_register: "passkey_register";
+          navigate: "navigate";
+        }>;
+        primary: z.ZodDefault<z.ZodBoolean>;
+        text_key: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>>>;
+      gates: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        kind: z.ZodEnum<{
+          captcha: "captcha";
+        }>;
+        provider: z.ZodString;
+        config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+      }, z.core.$strip>>>;
+      sso_providers: z.ZodDefault<z.ZodArray<z.ZodString>>;
+      on_success: z.ZodOptional<z.ZodEnum<{
+        create_user: "create_user";
+        create_user_with_sso: "create_user_with_sso";
+      }>>;
+      complete: z.ZodOptional<z.ZodEnum<{
+        redirect: "redirect";
+        show: "show";
+      }>>;
+      transitions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        target: z.ZodString;
+        action: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+          switch: "switch";
+          pivot: "pivot";
+        }>, z.ZodNull]>>;
+        purpose: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+          login: "login";
+          register: "register";
+          recovery: "recovery";
+          profiling: "profiling";
+          reauth: "reauth";
+          link_account: "link_account";
+        }>, z.ZodNull]>>;
+      }, z.core.$strip>>>;
+    }, z.core.$strip>>;
+  }, z.core.$strip>;
+}, z.core.$strip>;
+/**
+ * One `.zitadel/idps/<slug>.json` body: the connection document `POST /idps`
+ * carries under `idp`. The generated Zod enforces the contract the meta-schema
+ * states, including that `client_secret` is a `${{ NAME }}` reference and
+ * never a literal.
+ */
+export declare const idpConnectionConfigSchema: z.ZodObject<{
+  slug: z.ZodString;
+  protocol: z.ZodEnum<{
+    oidc: "oidc";
+    oauth2: "oauth2";
+  }>;
+  template: z.ZodOptional<z.ZodString>;
+  display_name: z.ZodString;
+  subject_claim: z.ZodOptional<z.ZodString>;
+  claim_mapping: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+  verified_claims: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>>>;
+  provisioning: z.ZodOptional<z.ZodObject<{
+    creation: z.ZodDefault<z.ZodEnum<{
+      disabled: "disabled";
+      auto: "auto";
+    }>>;
+  }, z.core.$strip>>;
+  oidc: z.ZodOptional<z.ZodObject<{
+    issuer: z.ZodString;
+    jwks_uri: z.ZodOptional<z.ZodString>;
+    id_token_mapping: z.ZodDefault<z.ZodBoolean>;
+    authorization_endpoint: z.ZodOptional<z.ZodString>;
+    token_endpoint: z.ZodOptional<z.ZodString>;
+    userinfo_endpoint: z.ZodOptional<z.ZodString>;
+    client_id: z.ZodString;
+    client_secret: z.ZodString;
+    token_endpoint_auth_method: z.ZodDefault<z.ZodEnum<{
+      client_secret_basic: "client_secret_basic";
+      client_secret_post: "client_secret_post";
+    }>>;
+    scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    pkce_enabled: z.ZodDefault<z.ZodBoolean>;
+    static_authorize_parameters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+  }, z.core.$strip>>;
+  oauth2: z.ZodOptional<z.ZodObject<{
+    authorization_endpoint: z.ZodString;
+    token_endpoint: z.ZodString;
+    userinfo_endpoint: z.ZodString;
+    client_id: z.ZodString;
+    client_secret: z.ZodString;
+    token_endpoint_auth_method: z.ZodDefault<z.ZodEnum<{
+      client_secret_basic: "client_secret_basic";
+      client_secret_post: "client_secret_post";
+    }>>;
+    scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    pkce_enabled: z.ZodDefault<z.ZodBoolean>;
+    static_authorize_parameters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    supplementary_fetch: z.ZodOptional<z.ZodEnum<{
+      github_primary_email: "github_primary_email";
+    }>>;
+  }, z.core.$strip>>;
+}, z.core.$strip>;
 /** The wire shape of a branding revision (`POST /branding` request body). */
-declare const brandingWireSchema: any;
+export declare const brandingWireSchema: z.ZodObject<{
+  layout: z.ZodDefault<z.ZodEnum<{
+    centered: "centered";
+    split: "split";
+  }>>;
+  liquid_template: z.ZodOptional<z.ZodString>;
+  logo_url: z.ZodOptional<z.ZodURL>;
+  hero_url: z.ZodOptional<z.ZodURL>;
+  theme: z.ZodOptional<z.ZodObject<{
+    mode: z.ZodOptional<z.ZodEnum<{
+      auto: "auto";
+      light: "light";
+      dark: "dark";
+    }>>;
+    light: z.ZodOptional<z.ZodObject<{
+      logo_url: z.ZodOptional<z.ZodURL>;
+      palette: z.ZodOptional<z.ZodObject<{
+        primary: z.ZodOptional<z.ZodString>;
+        on_primary: z.ZodOptional<z.ZodString>;
+        background: z.ZodOptional<z.ZodString>;
+        surface: z.ZodOptional<z.ZodString>;
+        muted: z.ZodOptional<z.ZodString>;
+        border: z.ZodOptional<z.ZodString>;
+        text: z.ZodOptional<z.ZodString>;
+        text_muted: z.ZodOptional<z.ZodString>;
+        link: z.ZodOptional<z.ZodString>;
+        success: z.ZodOptional<z.ZodString>;
+        warning: z.ZodOptional<z.ZodString>;
+        error: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    dark: z.ZodOptional<z.ZodObject<{
+      logo_url: z.ZodOptional<z.ZodURL>;
+      palette: z.ZodOptional<z.ZodObject<{
+        primary: z.ZodOptional<z.ZodString>;
+        on_primary: z.ZodOptional<z.ZodString>;
+        background: z.ZodOptional<z.ZodString>;
+        surface: z.ZodOptional<z.ZodString>;
+        muted: z.ZodOptional<z.ZodString>;
+        border: z.ZodOptional<z.ZodString>;
+        text: z.ZodOptional<z.ZodString>;
+        text_muted: z.ZodOptional<z.ZodString>;
+        link: z.ZodOptional<z.ZodString>;
+        success: z.ZodOptional<z.ZodString>;
+        warning: z.ZodOptional<z.ZodString>;
+        error: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>>;
+    }, z.core.$strip>>;
+  }, z.core.$strip>>;
+  typography: z.ZodOptional<z.ZodObject<{
+    font_family: z.ZodOptional<z.ZodString>;
+    font_url: z.ZodOptional<z.ZodURL>;
+    scale: z.ZodOptional<z.ZodNumber>;
+  }, z.core.$strip>>;
+  shape: z.ZodOptional<z.ZodObject<{
+    radius: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+      none: "none";
+      sm: "sm";
+      md: "md";
+      lg: "lg";
+      full: "full";
+    }>, z.ZodInt]>>;
+    density: z.ZodOptional<z.ZodEnum<{
+      compact: "compact";
+      regular: "regular";
+      comfortable: "comfortable";
+    }>>;
+    logo_scale: z.ZodOptional<z.ZodNumber>;
+  }, z.core.$strip>>;
+}, z.core.$strip>;
 /**
  * `{ "$file": "<path>" }`, which a `.zitadel/` file may hold in place of a
  * string field the OpenAPI YAML marks `x-local: file`. The path is relative to
  * the file holding it; the CLI inlines the content before publishing.
  */
-declare const localFileReferenceSchema: z.ZodObject<{
+export declare const localFileReferenceSchema: z.ZodObject<{
   $file: z.ZodString;
 }, z.core.$strict>;
 /**
@@ -19,9 +302,78 @@ declare const localFileReferenceSchema: z.ZodObject<{
  * `liquid_template` may also be a `$file` reference to the sibling `.liquid`
  * template (the meta-schema `branding.json` mirrors this).
  */
-declare const brandingConfigSchema: z.ZodObject<{
-  [x: string]: any;
+export declare const brandingConfigSchema: z.ZodObject<{
+  logo_url: z.ZodOptional<z.ZodString>;
+  hero_url: z.ZodOptional<z.ZodString>;
+  $schema: z.ZodOptional<z.ZodString>;
+  liquid_template: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+    $file: z.ZodString;
+  }, z.core.$strict>]>>;
+  layout: z.ZodDefault<z.ZodEnum<{
+    centered: "centered";
+    split: "split";
+  }>>;
+  theme: z.ZodOptional<z.ZodObject<{
+    mode: z.ZodOptional<z.ZodEnum<{
+      auto: "auto";
+      light: "light";
+      dark: "dark";
+    }>>;
+    light: z.ZodOptional<z.ZodObject<{
+      logo_url: z.ZodOptional<z.ZodURL>;
+      palette: z.ZodOptional<z.ZodObject<{
+        primary: z.ZodOptional<z.ZodString>;
+        on_primary: z.ZodOptional<z.ZodString>;
+        background: z.ZodOptional<z.ZodString>;
+        surface: z.ZodOptional<z.ZodString>;
+        muted: z.ZodOptional<z.ZodString>;
+        border: z.ZodOptional<z.ZodString>;
+        text: z.ZodOptional<z.ZodString>;
+        text_muted: z.ZodOptional<z.ZodString>;
+        link: z.ZodOptional<z.ZodString>;
+        success: z.ZodOptional<z.ZodString>;
+        warning: z.ZodOptional<z.ZodString>;
+        error: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    dark: z.ZodOptional<z.ZodObject<{
+      logo_url: z.ZodOptional<z.ZodURL>;
+      palette: z.ZodOptional<z.ZodObject<{
+        primary: z.ZodOptional<z.ZodString>;
+        on_primary: z.ZodOptional<z.ZodString>;
+        background: z.ZodOptional<z.ZodString>;
+        surface: z.ZodOptional<z.ZodString>;
+        muted: z.ZodOptional<z.ZodString>;
+        border: z.ZodOptional<z.ZodString>;
+        text: z.ZodOptional<z.ZodString>;
+        text_muted: z.ZodOptional<z.ZodString>;
+        link: z.ZodOptional<z.ZodString>;
+        success: z.ZodOptional<z.ZodString>;
+        warning: z.ZodOptional<z.ZodString>;
+        error: z.ZodOptional<z.ZodString>;
+      }, z.core.$strip>>;
+    }, z.core.$strip>>;
+  }, z.core.$strip>>;
+  typography: z.ZodOptional<z.ZodObject<{
+    font_family: z.ZodOptional<z.ZodString>;
+    font_url: z.ZodOptional<z.ZodURL>;
+    scale: z.ZodOptional<z.ZodNumber>;
+  }, z.core.$strip>>;
+  shape: z.ZodOptional<z.ZodObject<{
+    radius: z.ZodOptional<z.ZodUnion<readonly [z.ZodEnum<{
+      none: "none";
+      sm: "sm";
+      md: "md";
+      lg: "lg";
+      full: "full";
+    }>, z.ZodInt]>>;
+    density: z.ZodOptional<z.ZodEnum<{
+      compact: "compact";
+      regular: "regular";
+      comfortable: "comfortable";
+    }>>;
+    logo_scale: z.ZodOptional<z.ZodNumber>;
+  }, z.core.$strip>>;
 }, z.core.$strict>;
 //#endregion
-export { brandingConfigSchema, brandingWireSchema, createFlowDefinitionRequestSchema, flowConfigSchema, localFileReferenceSchema, schemaConfigSchema };
 //# sourceMappingURL=schemas.d.mts.map

package/dist/schemas.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.d.mts","names":[],"sources":["../src/schemas.ts"],"mappings":";;;cAca,kBAAA;AAAA,cACA,gBAAA;AAAA,cACA,iCAAA;;cAGA,kBAAA;;;AAJb;;;cAWa,wBAAA,EAAwB,CAAA,CAAA,SAAA;;;;;;;AAPrC;cAca,oBAAA,EAAoB,CAAA,CAAA,SAAA;EAAA;GAoD7B,CAAA,CAAA,IAAA,CAAA,OAAA"}
+{"version":3,"file":"schemas.d.mts","names":[],"sources":["../src/schemas.ts"],"mappings":";;qBAWa,oBAAkB,EAAA,mBAAA,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAAmB,EAAA,KAAA;qBACrC,kBAAgB,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAAiD,EAAA,KAAA;qBACjE,mCAAiC,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAA2B,EAAA,KAAA;;;;;;;qBAQ5D,2BAAyB,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAA0B,EAAA,KAAA;;qBAGnD,oBAAkB,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAAqB,EAAA,KAAA;;;;;;qBAOvC,0BAAwB,EAAA;;GAA+C,EAAA,KAAA;;;;;;qBAOvE,sBAAoB,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuD7B,EAAA,KAAA"}

package/dist/schemas.mjs

@@ -1,3 +1,3 @@
 import "./branding-url.mjs";
-import { a as localFileReferenceSchema, i as flowConfigSchema, n as brandingWireSchema, o as schemaConfigSchema, r as createFlowDefinitionRequestSchema, t as brandingConfigSchema } from "./schemas-7oNU25Qz.mjs";
-export { brandingConfigSchema, brandingWireSchema, createFlowDefinitionRequestSchema, flowConfigSchema, localFileReferenceSchema, schemaConfigSchema };
+import { a as idpConnectionConfigSchema, i as flowConfigSchema, n as brandingWireSchema, o as localFileReferenceSchema, r as createFlowDefinitionRequestSchema, s as schemaConfigSchema, t as brandingConfigSchema } from "./schemas-CUU4Rf8J.mjs";
+export { brandingConfigSchema, brandingWireSchema, createFlowDefinitionRequestSchema, flowConfigSchema, idpConnectionConfigSchema, localFileReferenceSchema, schemaConfigSchema };

package/dist/template.d.mts

@@ -1,19 +1,19 @@
 //#region src/template.d.ts
 /** The `{% mandatory_gates %}` runtime safety-net tag every template must emit. */
-declare const MANDATORY_GATES_TAG = "mandatory_gates";
+export declare const MANDATORY_GATES_TAG = "mandatory_gates";
 /**
  * Custom Liquid tags the login orchestrator registers beyond the standard
  * set. Validators must register them (as no-ops) or parsing valid templates
  * fails; `@zitadel/components` registers the real implementations.
  */
-declare const TEMPLATE_TAGS: readonly ["mandatory_gates"];
+export declare const TEMPLATE_TAGS: readonly ["mandatory_gates"];
 /**
  * Byte cap for stored templates. Mirrors `maxLength` on
  * `branding.liquid_template` in the OpenAPI contract and
  * `MaxBrandingTemplateBytes` in the Go gate.
  */
-declare const MAX_TEMPLATE_BYTES = 131072;
-type TemplateValidationSeverity = "error" | "warning";
+export declare const MAX_TEMPLATE_BYTES = 131072;
+export type TemplateValidationSeverity = "error" | "warning";
 /**
  * Rule catalog with pointers into the Go lexical gate
  * (`internal/domain/branding_validator.go`) where a server-side mirror
@@ -21,7 +21,7 @@ type TemplateValidationSeverity = "error" | "warning";
  * cannot check them (wrong dialect) and render-time behavior degrades
  * safely without them.
  */
-declare const TEMPLATE_VALIDATION_RULES: {
+export declare const TEMPLATE_VALIDATION_RULES: {
   readonly parse: {
     readonly goRef: null;
   };
@@ -47,8 +47,8 @@ declare const TEMPLATE_VALIDATION_RULES: {
     readonly goRef: null;
   };
 };
-type TemplateValidationRuleId = keyof typeof TEMPLATE_VALIDATION_RULES;
-type TemplateValidationIssue = {
+export type TemplateValidationRuleId = keyof typeof TEMPLATE_VALIDATION_RULES;
+export type TemplateValidationIssue = {
   severity: TemplateValidationSeverity;
   rule: TemplateValidationRuleId;
   message: string;
@@ -64,13 +64,12 @@ type BannedPattern = {
  * doesn't false-positive; its separator class includes `/` because HTML
  * treats a slash between attributes as whitespace (`<img/onerror=…>`).
  */
-declare const BANNED_TEMPLATE_PATTERNS: readonly BannedPattern[];
+export declare const BANNED_TEMPLATE_PATTERNS: readonly BannedPattern[];
 /**
  * Validates a login template. Pure and non-throwing, like
  * `validateFlowDefinition`: returns an issue list, empty when the template
  * is valid.
  */
-declare function validateLoginTemplate(template: string): TemplateValidationIssue[];
+export declare function validateLoginTemplate(template: string): TemplateValidationIssue[];
 //#endregion
-export { BANNED_TEMPLATE_PATTERNS, MANDATORY_GATES_TAG, MAX_TEMPLATE_BYTES, TEMPLATE_TAGS, TEMPLATE_VALIDATION_RULES, TemplateValidationIssue, TemplateValidationRuleId, TemplateValidationSeverity, validateLoginTemplate };
 //# sourceMappingURL=template.d.mts.map

package/dist/template.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"template.d.mts","names":[],"sources":["../src/template.ts"],"mappings":";;cAkBa,mBAAA;;;;;AAOb;cAAa,aAAA;;;;AAOb;;cAAa,kBAAA;AAAA,KAED,0BAAA;;AAAZ;;;;;AASA;cAAa,yBAAA;EAAA;;;;;;;;;;;;;;;;;;;;;;;;;KAWD,wBAAA,gBAAwC,yBAAA;AAAA,KAExC,uBAAA;EACV,QAAA,EAAU,0BAAA;EACV,IAAA,EAAM,wBAAA;EACN,OAAA;AAAA;AAAA,KAGG,aAAA;EACH,IAAA,EAAM,wBAAA;EACN,OAAA,EAAS,MAAA;EACT,OAAA;AAAA;AALA;;;;;;AAAA,cAcW,wBAAA,WAAmC,aAAA;;;;;AAAhD;iBAqEgB,qBAAA,CAAsB,QAAA,WAAmB,uBAAA"}
+{"version":3,"file":"template.d.mts","names":[],"sources":["../src/template.ts"],"mappings":";;qBAkBa;;;;;;qBAOA;;;;;;qBAOA;YAED;;;;;;;;qBASC;;;;;;;;;;;;;;;;;;;;;;;;;;YAWD,wCAAwC;YAExC;EACV,UAAU;EACV,MAAM;EACN;;KAGG;EACH,MAAM;EACN,SAAS;EACT;;;;;;;;qBASW,mCAAmC;;;;;;wBAqEhC,sBAAsB,mBAAmB"}

package/dist/template.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"template.mjs","names":[],"sources":["../src/template.ts"],"sourcesContent":["/**\n * The authoritative login-template validator (ADR 040).\n *\n * Runs where authoring happens — `zitadel plan`/`apply`, and later editors —\n * against the same LiquidJS dialect `@zitadel/components` renders. The Go\n * server cannot parse this dialect faithfully, so it only mirrors the\n * lexical subset below (`internal/domain/branding_validator.go`, see the\n * `goRef` entries in {@link TEMPLATE_VALIDATION_RULES}); keep the two\n * pattern lists in sync.\n *\n * Render-time safety does not depend on this validator: the component\n * escapes all output, neuters `| raw`, sanitises via DOMPurify, and patches\n * missing required UI with `{% mandatory_gates %}`\n * (`docs/design/flowengine/template-security.md`).\n */\nimport { Liquid } from \"liquidjs\";\n\n/** The `{% mandatory_gates %}` runtime safety-net tag every template must emit. */\nexport const MANDATORY_GATES_TAG = \"mandatory_gates\";\n\n/**\n * Custom Liquid tags the login orchestrator registers beyond the standard\n * set. Validators must register them (as no-ops) or parsing valid templates\n * fails; `@zitadel/components` registers the real implementations.\n */\nexport const TEMPLATE_TAGS = [MANDATORY_GATES_TAG] as const;\n\n/**\n * Byte cap for stored templates. Mirrors `maxLength` on\n * `branding.liquid_template` in the OpenAPI contract and\n * `MaxBrandingTemplateBytes` in the Go gate.\n */\nexport const MAX_TEMPLATE_BYTES = 131072;\n\nexport type TemplateValidationSeverity = \"error\" | \"warning\";\n\n/**\n * Rule catalog with pointers into the Go lexical gate\n * (`internal/domain/branding_validator.go`) where a server-side mirror\n * exists. `parse` and `mandatory-gates` are authoring-only: the server\n * cannot check them (wrong dialect) and render-time behavior degrades\n * safely without them.\n */\nexport const TEMPLATE_VALIDATION_RULES = {\n  parse: { goRef: null },\n  size: { goRef: \"MaxBrandingTemplateBytes\" },\n  \"no-script-tag\": { goRef: \"brandingScriptTag\" },\n  \"no-style-tag\": { goRef: \"brandingStyleTag\" },\n  \"no-inline-handlers\": { goRef: \"brandingInlineHandler\" },\n  \"no-javascript-urls\": { goRef: \"brandingJavascriptURL\" },\n  \"no-raw-filter\": { goRef: \"brandingRawFilter\" },\n  \"mandatory-gates\": { goRef: null },\n} as const;\n\nexport type TemplateValidationRuleId = keyof typeof TEMPLATE_VALIDATION_RULES;\n\nexport type TemplateValidationIssue = {\n  severity: TemplateValidationSeverity;\n  rule: TemplateValidationRuleId;\n  message: string;\n};\n\ntype BannedPattern = {\n  rule: TemplateValidationRuleId;\n  pattern: RegExp;\n  message: string;\n};\n\n/**\n * Lexical bans, identical to the Go gate. The inline-handler pattern only\n * matches inside an open tag so Liquid like `{% assign online = true %}`\n * doesn't false-positive; its separator class includes `/` because HTML\n * treats a slash between attributes as whitespace (`<img/onerror=…>`).\n */\nexport const BANNED_TEMPLATE_PATTERNS: readonly BannedPattern[] = [\n  {\n    rule: \"no-script-tag\",\n    pattern: /<\\s*script\\b/i,\n    message: \"Templates must not contain <script> tags.\",\n  },\n  {\n    rule: \"no-style-tag\",\n    pattern: /<\\s*style\\b/i,\n    message: \"Templates must not contain <style> tags — theming is orchestrator-owned via tokens.\",\n  },\n  {\n    rule: \"no-inline-handlers\",\n    pattern: /<[a-z][^>]*[\\s/]on[a-z]+\\s*=/i,\n    message: \"Templates must not contain inline event handlers (on*= attributes).\",\n  },\n  {\n    rule: \"no-javascript-urls\",\n    pattern: /javascript\\s*:/i,\n    message: \"Templates must not contain javascript: URLs.\",\n  },\n  {\n    rule: \"no-raw-filter\",\n    pattern: /\\|\\s*raw\\b/,\n    message:\n      \"Templates must not use the | raw filter. The renderer neuters it anyway; remove it from the template.\",\n  },\n] as const;\n\n// Derived from the exported tag name so a rename cannot silently diverge\n// the validator from the renderer contract.\nconst MANDATORY_GATES_PATTERN = new RegExp(`\\\\{%-?\\\\s*${MANDATORY_GATES_TAG}\\\\s*-?%\\\\}`);\n\nlet parseEngine: Liquid | undefined;\n\n/**\n * A parse-only engine mirroring the orchestrator's dialect options\n * (`packages/components/src/orchestrator/liquid.ts`); custom tags are\n * registered as no-ops because only parseability matters here.\n */\nfunction getParseEngine(): Liquid {\n  if (!parseEngine) {\n    const engine = new Liquid({\n      cache: false,\n      jsTruthy: true,\n      relativeReference: false,\n      strictFilters: false,\n      strictVariables: false,\n    });\n    for (const tag of TEMPLATE_TAGS) {\n      engine.registerTag(tag, {\n        parse() {\n          // no-op: the tag takes no arguments and no body\n        },\n        render() {\n          return \"\";\n        },\n      });\n    }\n    parseEngine = engine;\n  }\n  return parseEngine;\n}\n\n/**\n * Validates a login template. Pure and non-throwing, like\n * `validateFlowDefinition`: returns an issue list, empty when the template\n * is valid.\n */\nexport function validateLoginTemplate(template: string): TemplateValidationIssue[] {\n  const issues: TemplateValidationIssue[] = [];\n\n  const bytes = new TextEncoder().encode(template).length;\n  if (bytes > MAX_TEMPLATE_BYTES) {\n    issues.push({\n      severity: \"error\",\n      rule: \"size\",\n      message: `Template is ${bytes} bytes; the platform caps liquid_template at ${MAX_TEMPLATE_BYTES} bytes.`,\n    });\n  }\n\n  for (const banned of BANNED_TEMPLATE_PATTERNS) {\n    if (banned.pattern.test(template)) {\n      issues.push({ severity: \"error\", rule: banned.rule, message: banned.message });\n    }\n  }\n\n  if (!MANDATORY_GATES_PATTERN.test(template)) {\n    issues.push({\n      severity: \"error\",\n      rule: \"mandatory-gates\",\n      message:\n        \"Template must contain a trailing {% mandatory_gates %} tag — the runtime safety net that appends any required field and the primary action a template left out.\",\n    });\n  }\n\n  try {\n    getParseEngine().parse(template);\n  } catch (error) {\n    issues.push({\n      severity: \"error\",\n      rule: \"parse\",\n      message: `Template is not valid LiquidJS: ${error instanceof Error ? error.message : String(error)}`,\n    });\n  }\n\n  return issues;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAkBA,MAAa,sBAAsB;;;;;;AAOnC,MAAa,gBAAgB,CAAC,oBAAoB;;;;;;AAOlD,MAAa,qBAAqB;;;;;;;;AAWlC,MAAa,4BAA4B;CACvC,OAAO,EAAE,OAAO,MAAM;CACtB,MAAM,EAAE,OAAO,4BAA4B;CAC3C,iBAAiB,EAAE,OAAO,qBAAqB;CAC/C,gBAAgB,EAAE,OAAO,oBAAoB;CAC7C,sBAAsB,EAAE,OAAO,yBAAyB;CACxD,sBAAsB,EAAE,OAAO,yBAAyB;CACxD,iBAAiB,EAAE,OAAO,qBAAqB;CAC/C,mBAAmB,EAAE,OAAO,MAAM;CACnC;;;;;;;AAsBD,MAAa,2BAAqD;CAChE;EACE,MAAM;EACN,SAAS;EACT,SAAS;EACV;CACD;EACE,MAAM;EACN,SAAS;EACT,SAAS;EACV;CACD;EACE,MAAM;EACN,SAAS;EACT,SAAS;EACV;CACD;EACE,MAAM;EACN,SAAS;EACT,SAAS;EACV;CACD;EACE,MAAM;EACN,SAAS;EACT,SACE;EACH;CACF;AAID,MAAM,0BAA0B,IAAI,OAAO,aAAa,oBAAoB,YAAY;AAExF,IAAI;;;;;;AAOJ,SAAS,iBAAyB;AAChC,KAAI,CAAC,aAAa;EAChB,MAAM,SAAS,IAAI,OAAO;GACxB,OAAO;GACP,UAAU;GACV,mBAAmB;GACnB,eAAe;GACf,iBAAiB;GAClB,CAAC;AACF,OAAK,MAAM,OAAO,cAChB,QAAO,YAAY,KAAK;GACtB,QAAQ;GAGR,SAAS;AACP,WAAO;;GAEV,CAAC;AAEJ,gBAAc;;AAEhB,QAAO;;;;;;;AAQT,SAAgB,sBAAsB,UAA6C;CACjF,MAAM,SAAoC,EAAE;CAE5C,MAAM,QAAQ,IAAI,aAAa,CAAC,OAAO,SAAS,CAAC;AACjD,KAAI,QAAA,OACF,QAAO,KAAK;EACV,UAAU;EACV,MAAM;EACN,SAAS,eAAe,MAAM,+CAA+C,mBAAmB;EACjG,CAAC;AAGJ,MAAK,MAAM,UAAU,yBACnB,KAAI,OAAO,QAAQ,KAAK,SAAS,CAC/B,QAAO,KAAK;EAAE,UAAU;EAAS,MAAM,OAAO;EAAM,SAAS,OAAO;EAAS,CAAC;AAIlF,KAAI,CAAC,wBAAwB,KAAK,SAAS,CACzC,QAAO,KAAK;EACV,UAAU;EACV,MAAM;EACN,SACE;EACH,CAAC;AAGJ,KAAI;AACF,kBAAgB,CAAC,MAAM,SAAS;UACzB,OAAO;AACd,SAAO,KAAK;GACV,UAAU;GACV,MAAM;GACN,SAAS,mCAAmC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;GACnG,CAAC;;AAGJ,QAAO"}
+{"version":3,"file":"template.mjs","names":[],"sources":["../src/template.ts"],"sourcesContent":["/**\n * The authoritative login-template validator (ADR 040).\n *\n * Runs where authoring happens — `zitadel plan`/`apply`, and later editors —\n * against the same LiquidJS dialect `@zitadel/components` renders. The Go\n * server cannot parse this dialect faithfully, so it only mirrors the\n * lexical subset below (`internal/domain/branding_validator.go`, see the\n * `goRef` entries in {@link TEMPLATE_VALIDATION_RULES}); keep the two\n * pattern lists in sync.\n *\n * Render-time safety does not depend on this validator: the component\n * escapes all output, neuters `| raw`, sanitises via DOMPurify, and patches\n * missing required UI with `{% mandatory_gates %}`\n * (`docs/design/flowengine/template-security.md`).\n */\nimport { Liquid } from \"liquidjs\";\n\n/** The `{% mandatory_gates %}` runtime safety-net tag every template must emit. */\nexport const MANDATORY_GATES_TAG = \"mandatory_gates\";\n\n/**\n * Custom Liquid tags the login orchestrator registers beyond the standard\n * set. Validators must register them (as no-ops) or parsing valid templates\n * fails; `@zitadel/components` registers the real implementations.\n */\nexport const TEMPLATE_TAGS = [MANDATORY_GATES_TAG] as const;\n\n/**\n * Byte cap for stored templates. Mirrors `maxLength` on\n * `branding.liquid_template` in the OpenAPI contract and\n * `MaxBrandingTemplateBytes` in the Go gate.\n */\nexport const MAX_TEMPLATE_BYTES = 131072;\n\nexport type TemplateValidationSeverity = \"error\" | \"warning\";\n\n/**\n * Rule catalog with pointers into the Go lexical gate\n * (`internal/domain/branding_validator.go`) where a server-side mirror\n * exists. `parse` and `mandatory-gates` are authoring-only: the server\n * cannot check them (wrong dialect) and render-time behavior degrades\n * safely without them.\n */\nexport const TEMPLATE_VALIDATION_RULES = {\n  parse: { goRef: null },\n  size: { goRef: \"MaxBrandingTemplateBytes\" },\n  \"no-script-tag\": { goRef: \"brandingScriptTag\" },\n  \"no-style-tag\": { goRef: \"brandingStyleTag\" },\n  \"no-inline-handlers\": { goRef: \"brandingInlineHandler\" },\n  \"no-javascript-urls\": { goRef: \"brandingJavascriptURL\" },\n  \"no-raw-filter\": { goRef: \"brandingRawFilter\" },\n  \"mandatory-gates\": { goRef: null },\n} as const;\n\nexport type TemplateValidationRuleId = keyof typeof TEMPLATE_VALIDATION_RULES;\n\nexport type TemplateValidationIssue = {\n  severity: TemplateValidationSeverity;\n  rule: TemplateValidationRuleId;\n  message: string;\n};\n\ntype BannedPattern = {\n  rule: TemplateValidationRuleId;\n  pattern: RegExp;\n  message: string;\n};\n\n/**\n * Lexical bans, identical to the Go gate. The inline-handler pattern only\n * matches inside an open tag so Liquid like `{% assign online = true %}`\n * doesn't false-positive; its separator class includes `/` because HTML\n * treats a slash between attributes as whitespace (`<img/onerror=…>`).\n */\nexport const BANNED_TEMPLATE_PATTERNS: readonly BannedPattern[] = [\n  {\n    rule: \"no-script-tag\",\n    pattern: /<\\s*script\\b/i,\n    message: \"Templates must not contain <script> tags.\",\n  },\n  {\n    rule: \"no-style-tag\",\n    pattern: /<\\s*style\\b/i,\n    message: \"Templates must not contain <style> tags — theming is orchestrator-owned via tokens.\",\n  },\n  {\n    rule: \"no-inline-handlers\",\n    pattern: /<[a-z][^>]*[\\s/]on[a-z]+\\s*=/i,\n    message: \"Templates must not contain inline event handlers (on*= attributes).\",\n  },\n  {\n    rule: \"no-javascript-urls\",\n    pattern: /javascript\\s*:/i,\n    message: \"Templates must not contain javascript: URLs.\",\n  },\n  {\n    rule: \"no-raw-filter\",\n    pattern: /\\|\\s*raw\\b/,\n    message:\n      \"Templates must not use the | raw filter. The renderer neuters it anyway; remove it from the template.\",\n  },\n] as const;\n\n// Derived from the exported tag name so a rename cannot silently diverge\n// the validator from the renderer contract.\nconst MANDATORY_GATES_PATTERN = new RegExp(`\\\\{%-?\\\\s*${MANDATORY_GATES_TAG}\\\\s*-?%\\\\}`);\n\nlet parseEngine: Liquid | undefined;\n\n/**\n * A parse-only engine mirroring the orchestrator's dialect options\n * (`packages/components/src/orchestrator/liquid.ts`); custom tags are\n * registered as no-ops because only parseability matters here.\n */\nfunction getParseEngine(): Liquid {\n  if (!parseEngine) {\n    const engine = new Liquid({\n      cache: false,\n      jsTruthy: true,\n      relativeReference: false,\n      strictFilters: false,\n      strictVariables: false,\n    });\n    for (const tag of TEMPLATE_TAGS) {\n      engine.registerTag(tag, {\n        parse() {\n          // no-op: the tag takes no arguments and no body\n        },\n        render() {\n          return \"\";\n        },\n      });\n    }\n    parseEngine = engine;\n  }\n  return parseEngine;\n}\n\n/**\n * Validates a login template. Pure and non-throwing, like\n * `validateFlowDefinition`: returns an issue list, empty when the template\n * is valid.\n */\nexport function validateLoginTemplate(template: string): TemplateValidationIssue[] {\n  const issues: TemplateValidationIssue[] = [];\n\n  const bytes = new TextEncoder().encode(template).length;\n  if (bytes > MAX_TEMPLATE_BYTES) {\n    issues.push({\n      severity: \"error\",\n      rule: \"size\",\n      message: `Template is ${bytes} bytes; the platform caps liquid_template at ${MAX_TEMPLATE_BYTES} bytes.`,\n    });\n  }\n\n  for (const banned of BANNED_TEMPLATE_PATTERNS) {\n    if (banned.pattern.test(template)) {\n      issues.push({ severity: \"error\", rule: banned.rule, message: banned.message });\n    }\n  }\n\n  if (!MANDATORY_GATES_PATTERN.test(template)) {\n    issues.push({\n      severity: \"error\",\n      rule: \"mandatory-gates\",\n      message:\n        \"Template must contain a trailing {% mandatory_gates %} tag — the runtime safety net that appends any required field and the primary action a template left out.\",\n    });\n  }\n\n  try {\n    getParseEngine().parse(template);\n  } catch (error) {\n    issues.push({\n      severity: \"error\",\n      rule: \"parse\",\n      message: `Template is not valid LiquidJS: ${error instanceof Error ? error.message : String(error)}`,\n    });\n  }\n\n  return issues;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAkBA,MAAa,sBAAsB;;;;;;AAOnC,MAAa,gBAAgB,CAAC,mBAAmB;;;;;;AAOjD,MAAa,qBAAqB;;;;;;;;AAWlC,MAAa,4BAA4B;CACvC,OAAO,EAAE,OAAO,KAAK;CACrB,MAAM,EAAE,OAAO,2BAA2B;CAC1C,iBAAiB,EAAE,OAAO,oBAAoB;CAC9C,gBAAgB,EAAE,OAAO,mBAAmB;CAC5C,sBAAsB,EAAE,OAAO,wBAAwB;CACvD,sBAAsB,EAAE,OAAO,wBAAwB;CACvD,iBAAiB,EAAE,OAAO,oBAAoB;CAC9C,mBAAmB,EAAE,OAAO,KAAK;AACnC;;;;;;;AAsBA,MAAa,2BAAqD;CAChE;EACE,MAAM;EACN,SAAS;EACT,SAAS;CACX;CACA;EACE,MAAM;EACN,SAAS;EACT,SAAS;CACX;CACA;EACE,MAAM;EACN,SAAS;EACT,SAAS;CACX;CACA;EACE,MAAM;EACN,SAAS;EACT,SAAS;CACX;CACA;EACE,MAAM;EACN,SAAS;EACT,SACE;CACJ;AACF;AAIA,MAAM,0BAA0B,IAAI,OAAO,aAAa,oBAAoB,WAAW;AAEvF,IAAI;;;;;;AAOJ,SAAS,iBAAyB;CAChC,IAAI,CAAC,aAAa;EAChB,MAAM,SAAS,IAAI,OAAO;GACxB,OAAO;GACP,UAAU;GACV,mBAAmB;GACnB,eAAe;GACf,iBAAiB;EACnB,CAAC;EACD,KAAK,MAAM,OAAO,eAChB,OAAO,YAAY,KAAK;GACtB,QAAQ,CAER;GACA,SAAS;IACP,OAAO;GACT;EACF,CAAC;EAEH,cAAc;CAChB;CACA,OAAO;AACT;;;;;;AAOA,SAAgB,sBAAsB,UAA6C;CACjF,MAAM,SAAoC,CAAC;CAE3C,MAAM,QAAQ,IAAI,YAAY,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC;CACjD,IAAI,QAAA,QACF,OAAO,KAAK;EACV,UAAU;EACV,MAAM;EACN,SAAS,eAAe,MAAM,+CAA+C,mBAAmB;CAClG,CAAC;CAGH,KAAK,MAAM,UAAU,0BACnB,IAAI,OAAO,QAAQ,KAAK,QAAQ,GAC9B,OAAO,KAAK;EAAE,UAAU;EAAS,MAAM,OAAO;EAAM,SAAS,OAAO;CAAQ,CAAC;CAIjF,IAAI,CAAC,wBAAwB,KAAK,QAAQ,GACxC,OAAO,KAAK;EACV,UAAU;EACV,MAAM;EACN,SACE;CACJ,CAAC;CAGH,IAAI;EACF,eAAe,CAAC,CAAC,MAAM,QAAQ;CACjC,SAAS,OAAO;EACd,OAAO,KAAK;GACV,UAAU;GACV,MAAM;GACN,SAAS,mCAAmC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EACnG,CAAC;CACH;CAEA,OAAO;AACT"}

package/dist/validate.d.mts

@@ -28,18 +28,21 @@
  * validator all go away. New rules land in Go first and are ported here
  * only until then.
  */
-type FlowValidationSeverity = "error" | "warning";
-type FlowValidationIssue = {
-  severity: FlowValidationSeverity; /** Stable rule id from {@link FLOW_VALIDATION_RULES}. */
-  rule: FlowValidationRuleId; /** Mirrors the Go `ErrFlowDefinitionInvalid` detail string where a Go rule exists. */
-  message: string; /** Step the issue is anchored to, when applicable. */
+export type FlowValidationSeverity = "error" | "warning";
+export type FlowValidationIssue = {
+  severity: FlowValidationSeverity;
+  /** Stable rule id from {@link FLOW_VALIDATION_RULES}. */
+  rule: FlowValidationRuleId;
+  /** Mirrors the Go `ErrFlowDefinitionInvalid` detail string where a Go rule exists. */
+  message: string;
+  /** Step the issue is anchored to, when applicable. */
   step?: string;
 };
 /**
  * Rule registry: rule id → the Go function it ports. `goRef: null` marks
  * CLI-only guidance with no server counterpart.
  */
-declare const FLOW_VALIDATION_RULES: {
+export declare const FLOW_VALIDATION_RULES: {
   readonly "step-names": {
     readonly goRef: "stepNamesMap";
   };
@@ -74,19 +77,19 @@ declare const FLOW_VALIDATION_RULES: {
     readonly goRef: null;
   };
 };
-type FlowValidationRuleId = keyof typeof FLOW_VALIDATION_RULES;
+export type FlowValidationRuleId = keyof typeof FLOW_VALIDATION_RULES;
 /** Mirrors `reservedOutcomes` in flow_definition_validator.go. */
-declare const RESERVED_OUTCOMES: readonly ["user_not_found", "user_already_exists", "identity_unknown", "callback"];
+export declare const RESERVED_OUTCOMES: readonly ["user_not_found", "user_already_exists", "sso_user_not_found", "sso_authenticated"];
 /** Mirrors the `FlowDefinitionPurpose` enum (snake transform) in flow_definition.go. */
-declare const FLOW_PURPOSES: readonly ["login", "register", "recovery", "profiling", "reauth", "link_account"];
+export declare const FLOW_PURPOSES: readonly ["login", "register", "recovery", "profiling", "reauth", "link_account"];
 /**
  * Mirrors `purposeFlipTargets` in flow_definition_validator.go: the
- * identifier outcomes only. `identity_unknown` comes only from SSO
+ * identifier outcomes only. `sso_user_not_found` comes only from SSO
  * resolution and is left out here; requiring it on every combined entry
  * step would reject the shipped default flow. A rule on steps carrying
  * sso_providers is future work (#1044).
  */
-declare const PURPOSE_FLIP_TARGETS: Readonly<Record<string, Readonly<Record<string, string>>>>;
+export declare const PURPOSE_FLIP_TARGETS: Readonly<Record<string, Readonly<Record<string, string>>>>;
 /**
  * Validate a flow-definition config body (the `.zitadel/flows/*.json`
  * content) against the rules the server enforces on apply. `schema` is
@@ -94,7 +97,6 @@ declare const PURPOSE_FLIP_TARGETS: Readonly<Record<string, Readonly<Record<stri
  * omitted, schema-dependent rules are skipped. Pure — collects all
  * issues, never throws.
  */
-declare function validateFlowDefinition(flow: object, schema?: object): FlowValidationIssue[];
+export declare function validateFlowDefinition(flow: object, schema?: object): FlowValidationIssue[];
 //#endregion
-export { FLOW_PURPOSES, FLOW_VALIDATION_RULES, FlowValidationIssue, FlowValidationRuleId, FlowValidationSeverity, PURPOSE_FLIP_TARGETS, RESERVED_OUTCOMES, validateFlowDefinition };
 //# sourceMappingURL=validate.d.mts.map

package/dist/validate.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"validate.d.mts","names":[],"sources":["../src/validate.ts"],"mappings":";;AA8BA;;;;;AAEA;;;;;;;;;;;;AAcA;;;;;;;;;;;KAhBY,sBAAA;AAAA,KAEA,mBAAA;EACV,QAAA,EAAU,sBAAA;EAEV,IAAA,EAAM,oBAAA;EAEN,OAAA;EAEA,IAAA;AAAA;;;;;cAOW,qBAAA;EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAcD,oBAAA,gBAAoC,qBAAA;;cAGnC,iBAAA;;cAQA,aAAA;;;;;;;;cAgBA,oBAAA,EAAsB,QAAA,CAAS,MAAA,SAAe,QAAA,CAAS,MAAA;;;;;;;;iBAoCpD,sBAAA,CAAuB,IAAA,UAAc,MAAA,YAAkB,mBAAA"}
+{"version":3,"file":"validate.d.mts","names":[],"sources":["../src/validate.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YA8BY;YAEA;EACV,UAAU;;EAEV,MAAM;;EAEN;;EAEA;;;;;;qBAOW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAcD,oCAAoC;;qBAGnC;;qBAQA;;;;;;;;qBAgBA,sBAAsB,SAAS,eAAe,SAAS;;;;;;;;wBA2CpD,uBAAuB,cAAc,kBAAkB"}