@zitadel/testing 0.1.0-alpha.19 → 1.0.0-alpha.21

package/dist/{src-I0KAh1zU.cjs → src-DtCJTEId.cjs}

@@ -1,4 +1,4 @@
-const require_handshake = require("./handshake-CRKcgkfN.cjs");
+const require_handshake = require("./handshake-BOsVBPtn.cjs");
 require("node:fs");
 require("node:url");
 let node_fs_promises = require("node:fs/promises");
@@ -129,22 +129,28 @@ function safeJsonParse(text) {
 * OpenAPI spec version: 0.0.1
 */
 var zitadelNextGen_exports = /* @__PURE__ */ __exportAll({
+	beginUserPasskeyRegistration: () => beginUserPasskeyRegistration,
 	completeClaim: () => completeClaim,
 	createAuthAttempt: () => createAuthAttempt,
 	createBranding: () => createBranding,
 	createFlow: () => createFlow,
 	createFlowDefinition: () => createFlowDefinition,
+	createGrant: () => createGrant,
 	createHandoff: () => createHandoff,
 	createProject: () => createProject,
+	createRelease: () => createRelease,
 	createSchema: () => createSchema,
 	createSession: () => createSession,
 	createTeam: () => createTeam,
 	createUser: () => createUser,
 	deleteFlowDefinition: () => deleteFlowDefinition,
+	deleteGrant: () => deleteGrant,
 	deleteTeam: () => deleteTeam,
 	deleteUserByID: () => deleteUserByID,
 	exchangeHandoff: () => exchangeHandoff,
+	finishUserPasskeyRegistration: () => finishUserPasskeyRegistration,
 	getAuthAttempt: () => getAuthAttempt,
+	getBeginUserPasskeyRegistrationUrl: () => getBeginUserPasskeyRegistrationUrl,
 	getBrandingById: () => getBrandingById,
 	getClaimStatus: () => getClaimStatus,
 	getCompleteClaimUrl: () => getCompleteClaimUrl,
@@ -152,45 +158,55 @@ var zitadelNextGen_exports = /* @__PURE__ */ __exportAll({
 	getCreateBrandingUrl: () => getCreateBrandingUrl,
 	getCreateFlowDefinitionUrl: () => getCreateFlowDefinitionUrl,
 	getCreateFlowUrl: () => getCreateFlowUrl,
+	getCreateGrantUrl: () => getCreateGrantUrl,
 	getCreateHandoffUrl: () => getCreateHandoffUrl,
 	getCreateProjectUrl: () => getCreateProjectUrl,
+	getCreateReleaseUrl: () => getCreateReleaseUrl,
 	getCreateSchemaUrl: () => getCreateSchemaUrl,
 	getCreateSessionUrl: () => getCreateSessionUrl,
 	getCreateTeamUrl: () => getCreateTeamUrl,
 	getCreateUserUrl: () => getCreateUserUrl,
 	getDeleteFlowDefinitionUrl: () => getDeleteFlowDefinitionUrl,
+	getDeleteGrantUrl: () => getDeleteGrantUrl,
 	getDeleteTeamUrl: () => getDeleteTeamUrl,
 	getDeleteUserByIDUrl: () => getDeleteUserByIDUrl,
+	getEnvironmentByName: () => getEnvironmentByName,
 	getEvent: () => getEvent,
 	getExchangeHandoffUrl: () => getExchangeHandoffUrl,
+	getFinishUserPasskeyRegistrationUrl: () => getFinishUserPasskeyRegistrationUrl,
 	getFlowDefinition: () => getFlowDefinition,
 	getFlowStep: () => getFlowStep,
 	getGetAuthAttemptUrl: () => getGetAuthAttemptUrl,
 	getGetBrandingByIdUrl: () => getGetBrandingByIdUrl,
 	getGetClaimStatusUrl: () => getGetClaimStatusUrl,
+	getGetEnvironmentByNameUrl: () => getGetEnvironmentByNameUrl,
 	getGetEventUrl: () => getGetEventUrl,
 	getGetFlowDefinitionUrl: () => getGetFlowDefinitionUrl,
 	getGetFlowStepUrl: () => getGetFlowStepUrl,
+	getGetGrantUrl: () => getGetGrantUrl,
 	getGetHealthUrl: () => getGetHealthUrl,
 	getGetLiveUrl: () => getGetLiveUrl,
 	getGetMySessionUrl: () => getGetMySessionUrl,
 	getGetMyUserUrl: () => getGetMyUserUrl,
 	getGetProjectUrl: () => getGetProjectUrl,
 	getGetReadyUrl: () => getGetReadyUrl,
+	getGetReleaseByIdUrl: () => getGetReleaseByIdUrl,
 	getGetSchemaByIdUrl: () => getGetSchemaByIdUrl,
 	getGetSessionUrl: () => getGetSessionUrl,
 	getGetTeamUrl: () => getGetTeamUrl,
 	getGetUserByIDUrl: () => getGetUserByIDUrl,
+	getGrant: () => getGrant,
 	getHealth: () => getHealth,
 	getInitClaimUrl: () => getInitClaimUrl,
 	getIssueChallengeUrl: () => getIssueChallengeUrl,
 	getListBrandingUrl: () => getListBrandingUrl,
+	getListEnvironmentsUrl: () => getListEnvironmentsUrl,
 	getListEventsUrl: () => getListEventsUrl,
 	getListFlowDefinitionsUrl: () => getListFlowDefinitionsUrl,
+	getListReleasesUrl: () => getListReleasesUrl,
 	getListSchemasUrl: () => getListSchemasUrl,
 	getListUserPasskeysUrl: () => getListUserPasskeysUrl,
 	getListUserTeamsUrl: () => getListUserTeamsUrl,
-	getListUsersUrl: () => getListUsersUrl,
 	getLive: () => getLive,
 	getMySession: () => getMySession,
 	getMyUser: () => getMyUser,
@@ -199,7 +215,9 @@ var zitadelNextGen_exports = /* @__PURE__ */ __exportAll({
 	getQueryProjectsUrl: () => getQueryProjectsUrl,
 	getQuerySessionsUrl: () => getQuerySessionsUrl,
 	getQueryTeamsUrl: () => getQueryTeamsUrl,
+	getQueryUsersUrl: () => getQueryUsersUrl,
 	getReady: () => getReady,
+	getReleaseById: () => getReleaseById,
 	getRevokeMySessionUrl: () => getRevokeMySessionUrl,
 	getRevokeSessionUrl: () => getRevokeSessionUrl,
 	getSchemaById: () => getSchemaById,
@@ -214,16 +232,18 @@ var zitadelNextGen_exports = /* @__PURE__ */ __exportAll({
 	initClaim: () => initClaim,
 	issueChallenge: () => issueChallenge,
 	listBranding: () => listBranding,
+	listEnvironments: () => listEnvironments,
 	listEvents: () => listEvents,
 	listFlowDefinitions: () => listFlowDefinitions,
+	listReleases: () => listReleases,
 	listSchemas: () => listSchemas,
 	listUserPasskeys: () => listUserPasskeys,
 	listUserTeams: () => listUserTeams,
-	listUsers: () => listUsers,
 	patchProject: () => patchProject,
 	queryProjects: () => queryProjects,
 	querySessions: () => querySessions,
 	queryTeams: () => queryTeams,
+	queryUsers: () => queryUsers,
 	revokeMySession: () => revokeMySession,
 	revokeSession: () => revokeSession,
 	setUserPassword: () => setUserPassword,
@@ -293,21 +313,27 @@ const createUser = async (createUserBody, params, options) => {
 		body: JSON.stringify(createUserBody)
 	});
 };
-const getListUsersUrl = (params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/users?${stringifiedParams}` : `${getProxyPath()}/users`;
+const getQueryUsersUrl = () => {
+	return `${getProxyPath()}/users/query`;
 };
 /**
-* @summary List users
+* Returns the users of a project, paginated with a cursor.
+
+The project comes from the credential, not from a parameter: the operation
+is bound to the token's own project by construction. This is why it takes
+no `project_id`, unlike the other query endpoints.
+
+* @summary Query users
 */
-const listUsers = async (params, options) => {
-	return customFetch(getListUsersUrl(params), {
+const queryUsers = async (queryUsersBody, options) => {
+	return customFetch(getQueryUsersUrl(), {
 		...options,
-		method: "GET"
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(queryUsersBody)
 	});
 };
 const getGetUserByIDUrl = (userId, params) => {
@@ -356,6 +382,53 @@ const listUserPasskeys = async (userId, params, options) => {
 		method: "GET"
 	});
 };
+const getBeginUserPasskeyRegistrationUrl = (userId) => {
+	return `${getProxyPath()}/users/${userId}/passkeys/registrations`;
+};
+/**
+* Starts a WebAuthn registration ceremony for the user and returns the
+creation options for `navigator.credentials.create()`. Complete the
+ceremony with `POST /users/{user_id}/passkeys/registrations/{registration_id}` within
+five minutes. Credentials already registered for the user are excluded
+automatically.
+
+* @summary Begin passkey registration
+*/
+const beginUserPasskeyRegistration = async (userId, beginUserPasskeyRegistrationBody, options) => {
+	return customFetch(getBeginUserPasskeyRegistrationUrl(userId), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(beginUserPasskeyRegistrationBody)
+	});
+};
+const getFinishUserPasskeyRegistrationUrl = (userId, registrationId) => {
+	return `${getProxyPath()}/users/${userId}/passkeys/registrations/${registrationId}`;
+};
+/**
+* Verifies the attestation against the ceremony started by
+`POST /users/{user_id}/passkeys/registrations` and persists the new credential. A
+rejected attestation counts against the ceremony's failure budget and the
+ceremony stays open for a retry. An expired ceremony surfaces as
+`att.stale_challenge`; an unknown or already-consumed registration id
+surfaces as `att.not_found`.
+
+* @summary Finish passkey registration
+*/
+const finishUserPasskeyRegistration = async (userId, registrationId, finishUserPasskeyRegistrationBody, options) => {
+	return customFetch(getFinishUserPasskeyRegistrationUrl(userId, registrationId), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(finishUserPasskeyRegistrationBody)
+	});
+};
 const getSetUserPasswordUrl = (userId) => {
 	return `${getProxyPath()}/users/${userId}/password`;
 };
@@ -993,7 +1066,10 @@ const getGetSchemaByIdUrl = (id, params) => {
 	return stringifiedParams.length > 0 ? `${getProxyPath()}/schemas/${id}?${stringifiedParams}` : `${getProxyPath()}/schemas/${id}`;
 };
 /**
-* Get a schema by its ID. This will return the default revision of the schema.
+* Get a schema by its ID. A schema ID identifies one immutable revision, so
+this returns exactly that revision. To find the current revision of an
+object type, list with `revisions=latest`.
+
 * @summary Get schema by ID
 */
 const getSchemaById = async (id, params, options) => {
@@ -1194,6 +1270,47 @@ const updateTeam = async (teamId, updateTeamBody, options) => {
 		body: JSON.stringify(updateTeamBody)
 	});
 };
+const getListEnvironmentsUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/environments?${stringifiedParams}` : `${getProxyPath()}/environments`;
+};
+/**
+* Lists the project's environments ordered by name.
+
+* @summary List environments
+*/
+const listEnvironments = async (params, options) => {
+	return customFetch(getListEnvironmentsUrl(params), {
+		...options,
+		method: "GET"
+	});
+};
+const getGetEnvironmentByNameUrl = (name, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/environments/${name}?${stringifiedParams}` : `${getProxyPath()}/environments/${name}`;
+};
+/**
+* Reads one environment of the project by its name.
+
+The lookup is scoped to the project in `project_id`: a name that exists in
+another project answers `env.not_found` exactly as an unused name does.
+
+* @summary Get an environment by name
+*/
+const getEnvironmentByName = async (name, params, options) => {
+	return customFetch(getGetEnvironmentByNameUrl(name, params), {
+		...options,
+		method: "GET"
+	});
+};
 const getCreateBrandingUrl = (params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
@@ -1262,6 +1379,171 @@ const getBrandingById = async (id, options) => {
 		method: "GET"
 	});
 };
+const getCreateReleaseUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/releases?${stringifiedParams}` : `${getProxyPath()}/releases`;
+};
+/**
+* Bundles a release from revisions that already exist, supplied as
+`(kind, revision_id)` pairs. No new revisions are allocated — use the
+per-kind create endpoints for that, then pin the ids here.
+
+Every referenced `revision_id` must exist in the project. Each one's handle
+is read from the revision itself and recorded on the release, so a resource
+is always pinned under the identity it declares.
+
+Creating a release does not deploy it. A release is environment-agnostic
+and the same release can later be deployed to any number of environments
+unchanged.
+
+Idempotent on the pinned set: metadata is excluded from the comparison, so
+re-submitting the same revisions with a different `message` returns the
+release that already pins them rather than creating a second one.
+
+* @summary Create a release
+*/
+const createRelease = async (createReleaseBody, params, options) => {
+	return customFetch(getCreateReleaseUrl(params), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(createReleaseBody)
+	});
+};
+const getListReleasesUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/releases?${stringifiedParams}` : `${getProxyPath()}/releases`;
+};
+/**
+* Lists the project's releases, newest first.
+
+Entries carry metadata only — the pinned set is omitted. Read one release
+with `GET /releases/{release_id}` to get its pointers.
+
+* @summary List releases
+*/
+const listReleases = async (params, options) => {
+	return customFetch(getListReleasesUrl(params), {
+		...options,
+		method: "GET"
+	});
+};
+const getGetReleaseByIdUrl = (releaseId, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/releases/${releaseId}?${stringifiedParams}` : `${getProxyPath()}/releases/${releaseId}`;
+};
+/**
+* Reads one release: its metadata and the `(kind, handle, revision_id)`
+tuples it pins.
+
+Does not embed resource content. Resolve each `revision_id` through the
+per-kind read endpoints when the bytes are needed.
+
+The lookup is scoped to the project in `project_id`: a release id belonging
+to another project answers not found exactly as an unknown id does, so the
+endpoint cannot be used to probe for releases in projects the caller cannot
+read.
+
+* @summary Get a release by id
+*/
+const getReleaseById = async (releaseId, params, options) => {
+	return customFetch(getGetReleaseByIdUrl(releaseId, params), {
+		...options,
+		method: "GET"
+	});
+};
+const getCreateGrantUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/grants?${stringifiedParams}` : `${getProxyPath()}/grants`;
+};
+/**
+* Bind a user or team to `project.viewer`, `project.editor`, or
+`project.admin` on the project identified by the `project-id` header.
+IDs are `asgn_<opaque>`. Owning-team (`project.team`) grants are not
+created here — claim owns that path. An unrevoked grant with the same
+principal and relation occupies the unique key even after `expires_at`;
+DELETE it before re-creating.
+
+* @summary Create grant
+*/
+const createGrant = async (createGrantBody, params, options) => {
+	return customFetch(getCreateGrantUrl(params), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(createGrantBody)
+	});
+};
+const getGetGrantUrl = (id, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/grants/${id}?${stringifiedParams}` : `${getProxyPath()}/grants/${id}`;
+};
+/**
+* Loads a grant by `(project_id, id)` that this API manages (user or team
+bound to viewer, editor, or admin) and that has not been revoked.
+"Active" here means not revoked: expired grants stay visible so the
+client can DELETE before re-granting the same binding. Authorization
+still ignores expired grants. Grants are not registered in
+`resource_scope_index`; project scope is required on the query (same as
+events). Misses, revoked rows, project-secret setup (`sk_proj`),
+owning-team (`relation=team`) rows, and cross-project ids return 404.
+
+* @summary Get grant
+*/
+const getGrant = async (id, params, options) => {
+	return customFetch(getGetGrantUrl(id, params), {
+		...options,
+		method: "GET"
+	});
+};
+const getDeleteGrantUrl = (id, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/grants/${id}?${stringifiedParams}` : `${getProxyPath()}/grants/${id}`;
+};
+/**
+* Soft-revokes a grant this API manages and emits `authz.revoked`.
+Already-revoked, missing, project-secret setup, and owning-team grants
+return 404. The row is not un-revoked. Expired grants can still be
+revoked so the unique binding can be reused.
+
+* @summary Revoke grant
+*/
+const deleteGrant = async (id, params, options) => {
+	return customFetch(getDeleteGrantUrl(id, params), {
+		...options,
+		method: "DELETE"
+	});
+};
 const getListEventsUrl = (params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
@@ -1363,7 +1645,7 @@ function createZitadelClient(opts) {
 	} });
 }
 //#endregion
-//#region ../config/dist/defaults-eiGHyI5Y.mjs
+//#region ../config/dist/defaults-DPq0o3iU.mjs
 var default_human_user_default = {
 	title: "DefaultHumanUserSchema",
 	$schema: "https://json-schema.org/draft/2020-12/schema",
@@ -1372,6 +1654,7 @@ var default_human_user_default = {
 	objectType: "human-user",
 	kind: "user-schema",
 	type: "object",
+	"x-identifier": "email",
 	description: "The default editable schema for human users.",
 	"x-auth-methods": {
 		"password": { "enabled": true },
@@ -1509,6 +1792,7 @@ var human_user_default = {
 	objectType: "human-user",
 	kind: "user-schema",
 	type: "object",
+	"x-identifier": "email",
 	description: "The default editable schema for human users (passkey-first sign-in).",
 	"x-auth-methods": {
 		"passkey": { "enabled": true },
@@ -2371,4 +2655,4 @@ Object.defineProperty(exports, "startLocalZitadel", {
 	}
 });
 
-//# sourceMappingURL=src-I0KAh1zU.cjs.map
+//# sourceMappingURL=src-DtCJTEId.cjs.map