Merge branch 'main' into claude/ci-affected-rung2

Author: fforootd

.changeset/add-team-delete-endpoint.md

@@ -0,0 +1,5 @@
+---
+"@zitadel/server": minor
+---
+
+Add a team delete endpoint to the API. Deleting a team deactivates it and cascades to its memberships and lifecycle-owned users.

.changeset/claim-openapi-contract.md

@@ -0,0 +1,6 @@
+---
+"@zitadel/server": minor
+"@zitadel/api": minor
+---
+
+Add the project claim lifecycle endpoints to the API: `POST /projects/{project_id}/claim/init`, `GET /projects/{project_id}/claim/status`, and `POST /projects/{project_id}/claim/complete`, with matching methods on the generated `@zitadel/api` client. These let a developer start a claim from the CLI, poll its status, and finish it from the browser. The status response is modelled as discriminated `pending`/`completed` variants, and the contract carries the `proj.already_claimed` (409) and `proj.claim_expired` (410) error codes plus `429` rate-limit responses on polling and completion. The server handlers arrive separately, so the operations currently respond `501 Not Implemented`.

.changeset/claim-storage-statements.md

@@ -0,0 +1,5 @@
+---
+"@zitadel/server": patch
+---
+
+Add claim challenge storage statements (create, get, mark completed) and the personal-team lookup across Postgres, Spanner, and SQLite, groundwork for the claim lifecycle (ADR 046).

.changeset/cli-claim-command.md

@@ -0,0 +1,11 @@
+---
+"@zitadel/cli": minor
+---
+
+Add `zitadel claim`, which attaches a project to a team so it becomes permanent. The command mints a short-lived link with the project secret, opens it in a browser, and blocks until the developer finishes signing in there, then records `claimed_at` and `team_id` in `.zitadel/secret`.
+
+Nothing about the project changes: the issuer, users, passkeys, and applications keep working, and the project secret is not rotated. Running it again once the project belongs to a team is a clean `status: "skipped"` with `reason: "already-claimed"`, whether that is known locally or learned from the platform, so agents can retry safely. Links last 10 minutes; once one lapses the command exits `E_VALIDATION` and points at a fresh run.
+
+`--dry-run` stops before anything is minted and reports `status: "skipped"`, `reason: "dry-run"`. There is nothing to preview, because a claim is decided in a browser rather than by anything the CLI computes.
+
+The link is always printed before any browser opens, so headless machines, SSH sessions, and `--no-open` need no special handling. Where a browser can be launched, `BROWSER`, macOS, Windows, WSL, and the usual Linux openers (`xdg-open`, `gio open`, `x-www-browser`, `sensible-browser`, `gnome-open`, `kde-open`) are all handled. `--timeout <seconds>` stops waiting sooner than the link's own expiry.

.changeset/components-orval-wireup.md

@@ -48,11 +48,14 @@ Removed attributes/properties on `<zitadel-login>`:
   or use the new `api-base` attribute for declarative setups. A new
   `resume-flow-id` attribute resumes an existing flow handle.
 
-Removed attribute on `<zitadel-logout>`:
+Removed attributes on `<zitadel-logout>`:
 
-- `proxy-base`. The element now calls the typed `endSession`
-  operation (`GET /auth/end-session`) and forwards `client-id` /
-  `post-sign-out-url` as query parameters.
+- `proxy-base`.
+- `client-id`. The OIDC end-session surface is not part of the
+  OpenAPI contract, so the element no longer exposes
+  `getEndSessionUrl()`. Sign-out calls the typed `revokeMySession`
+  operation (`DELETE /sessions/me`) and then navigates to
+  `post-sign-out-url`.
 
 Behaviour changes:
 

.changeset/console-user-detail.md

@@ -0,0 +1,5 @@
+---
+"@zitadel/server": minor
+---
+
+The console's user detail screen now shows a user's profile as their schema defines it, split across Overview and Authentication tabs, with their registered passkeys and an action to delete the user. Profile values are read-only for now, because the API has no endpoint for updating a user.

.changeset/drop-oidc-oauth-openapi-surface.md

@@ -0,0 +1,24 @@
+---
+"@zitadel/api": minor
+"@zitadel/server": patch
+---
+
+Drop the OIDC/OAuth surface from the OpenAPI contract. The spec described
+discovery, authorize, token, keys, userinfo, revoke, introspect, device
+authorization, and end-session endpoints that this server does not serve,
+so the generated clients advertised operations that could never succeed.
+
+Removed operations from the generated `@zitadel/api` client:
+
+- `getOpenIDConfiguration`, `authorizeGet`, `authorizeDevice`, `getToken`,
+  `getUserInfo`, `getKeys`, `revokeToken`, `introspect`, `endSession`
+- `submitFlowEvent` (`POST /flow/{id}/event`)
+- `activateFlowDefinition` / `deactivateFlowDefinition`
+  (`POST /flow_definitions/{id}/activate` and `/deactivate`)
+
+The `usernamePassword` security scheme is gone with them; `oauth2` and
+`nextgenSession` are unchanged.
+
+Sign-out is the `revokeMySession` operation (`DELETE /sessions/me`). JWKS
+for local development is still served by `@zitadel/api-mock` at
+`/auth/keys`, but as a mock-only route rather than a contract operation.

.changeset/drop-revoked-session-state.md

@@ -0,0 +1,5 @@
+---
+"@zitadel/server": patch
+---
+
+A session's `state` is now one of `building`, `active`, or `expired`. The `revoked` state is gone from the session response and from the `state` filter of `POST /sessions/query`.

.changeset/list-user-teams-endpoint.md

@@ -0,0 +1,22 @@
+---
+"@zitadel/server": minor
+"@zitadel/api": minor
+---
+
+New endpoint `GET /users/{user_id}/teams` serves a user's team roster, so a
+client can finally get from a user to the teams they belong to.
+
+Each entry is `{ id, name, membership_status, created_at, updated_at }`. The
+team's **name** travels with the entry, so a page of the roster renders without
+a follow-up `POST /teams/query` per row. Entries come back ordered by team name
+and page with `limit` / `page_token` like the other list endpoints;
+memberships the user was removed from are not returned. An unknown user is a
+404, which is a different answer from a user with an empty roster.
+
+The user read endpoints (`GET /users`, `GET /users/{user_id}`,
+`GET /users/me`) also gain `metadata.lifecycle_owner_team_id` — the single team
+that owns the user's identity lifecycle, or `null` when the user is self-owned.
+That is a different concept from the roster and the two need not agree
+(ADR 024): roster membership is collaboration, lifecycle ownership decides who
+may deprovision the user. The roster itself stays out of the user payload; it
+is unbounded, so it gets its own paginated resource.

.changeset/openapi-snake-case-fields.md

@@ -0,0 +1,24 @@
+---
+"@zitadel/server": minor
+---
+
+Rename the last camelCase wire fields in the OpenAPI spec to snake_case, so the whole API uses one convention.
+
+**Breaking:** every renamed property changes on the wire. An unknown property is dropped rather than rejected, so a client left on the old names sends and reads silently empty values instead of failing loudly — update all of them together.
+Dropped request fields fall back to their schema default, not to empty. `seed_defaults`
+defaults to `true` and `is_change_required` to `false`, so an old client gets the project
+resources it opted out of and loses the forced password change it asked for.
+
+Request and response properties:
+
+- `POST /projects` request: `previewOrigins` → `preview_origins`, `seedDefaults` → `seed_defaults`
+- `POST /projects` response: `projectSecret` → `project_secret`, `previewSecret` → `preview_secret`, `previewOrigins` → `preview_origins`, `createdAt` → `created_at`
+- `GET /projects/{project_id}` and the project query response: `previewOrigins` → `preview_origins`, `createdAt` → `created_at`, `updatedAt` → `updated_at`
+- Team responses: `createdAt` → `created_at`, `updatedAt` → `updated_at`
+- User `metadata`: `createdAt` → `created_at`, `updatedAt` → `updated_at`
+- `PUT /users/{user_id}/password` request: `isChangeRequired` → `is_change_required`
+- `GET /schemas` response items: `createdAt` → `created_at`
+
+Filter and sort field values (the enum value, not the property name): `POST /projects/query` and `POST /teams/query` take `created_at` instead of `createdAt` in `filter[].field` and `sorting.field`. An old `createdAt` value is now rejected as an invalid enum value.
+
+Stored user-schema documents are unaffected: `objectType` and `metaSchema` keep their names, since they are schema content rather than envelope fields.