chore: move the go code into a subfolder

apps/api/internal/repository/instance/aggregate.go

@@ -0,0 +1,30 @@
+package instance
+
+import (
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+const (
+	instanceEventTypePrefix = eventstore.EventType("instance.")
+)
+
+const (
+	AggregateType    = "instance"
+	AggregateVersion = "v1"
+)
+
+type Aggregate struct {
+	eventstore.Aggregate
+}
+
+func NewAggregate(instanceID string) *Aggregate {
+	return &Aggregate{
+		Aggregate: eventstore.Aggregate{
+			InstanceID:    instanceID,
+			Type:          AggregateType,
+			Version:       AggregateVersion,
+			ID:            instanceID,
+			ResourceOwner: instanceID,
+		},
+	}
+}

apps/api/internal/repository/instance/custom_text.go

@@ -0,0 +1,104 @@
+package instance
+
+import (
+	"context"
+
+	"golang.org/x/text/language"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/policy"
+)
+
+var (
+	CustomTextSetEventType             = instanceEventTypePrefix + policy.CustomTextSetEventType
+	CustomTextRemovedEventType         = instanceEventTypePrefix + policy.CustomTextRemovedEventType
+	CustomTextTemplateRemovedEventType = instanceEventTypePrefix + policy.CustomTextTemplateRemovedEventType
+)
+
+type CustomTextSetEvent struct {
+	policy.CustomTextSetEvent
+}
+
+func NewCustomTextSetEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	template,
+	key,
+	text string,
+	language language.Tag,
+) *CustomTextSetEvent {
+	return &CustomTextSetEvent{
+		CustomTextSetEvent: *policy.NewCustomTextSetEvent(
+			eventstore.NewBaseEventForPush(ctx, aggregate, CustomTextSetEventType),
+			template,
+			key,
+			text,
+			language),
+	}
+}
+
+func CustomTextSetEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.CustomTextSetEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &CustomTextSetEvent{CustomTextSetEvent: *e.(*policy.CustomTextSetEvent)}, nil
+}
+
+type CustomTextRemovedEvent struct {
+	policy.CustomTextRemovedEvent
+}
+
+func NewCustomTextRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	template,
+	key string,
+	language language.Tag,
+) *CustomTextRemovedEvent {
+	return &CustomTextRemovedEvent{
+		CustomTextRemovedEvent: *policy.NewCustomTextRemovedEvent(
+			eventstore.NewBaseEventForPush(ctx, aggregate, CustomTextRemovedEventType),
+			template,
+			key,
+			language),
+	}
+}
+
+func CustomTextRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.CustomTextRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &CustomTextRemovedEvent{CustomTextRemovedEvent: *e.(*policy.CustomTextRemovedEvent)}, nil
+}
+
+type CustomTextTemplateRemovedEvent struct {
+	policy.CustomTextTemplateRemovedEvent
+}
+
+func NewCustomTextTemplateRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	template string,
+	language language.Tag,
+) *CustomTextTemplateRemovedEvent {
+	return &CustomTextTemplateRemovedEvent{
+		CustomTextTemplateRemovedEvent: *policy.NewCustomTextTemplateRemovedEvent(
+			eventstore.NewBaseEventForPush(ctx, aggregate, CustomTextTemplateRemovedEventType),
+			template,
+			language,
+		),
+	}
+}
+
+func CustomTextTemplateRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.CustomTextTemplateRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &CustomTextTemplateRemovedEvent{CustomTextTemplateRemovedEvent: *e.(*policy.CustomTextTemplateRemovedEvent)}, nil
+}

apps/api/internal/repository/instance/debug_notification_file.go

@@ -0,0 +1,104 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/settings"
+)
+
+const (
+	fileType = ".file"
+)
+
+var (
+	DebugNotificationProviderFileAddedEventType   = instanceEventTypePrefix + settings.DebugNotificationPrefix + fileType + settings.DebugNotificationProviderAdded
+	DebugNotificationProviderFileChangedEventType = instanceEventTypePrefix + settings.DebugNotificationPrefix + fileType + settings.DebugNotificationProviderChanged
+	DebugNotificationProviderFileRemovedEventType = instanceEventTypePrefix + settings.DebugNotificationPrefix + fileType + settings.DebugNotificationProviderRemoved
+)
+
+type DebugNotificationProviderFileAddedEvent struct {
+	settings.DebugNotificationProviderAddedEvent
+}
+
+func NewDebugNotificationProviderFileAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	compact bool,
+) *DebugNotificationProviderFileAddedEvent {
+	return &DebugNotificationProviderFileAddedEvent{
+		DebugNotificationProviderAddedEvent: *settings.NewDebugNotificationProviderAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				DebugNotificationProviderFileAddedEventType),
+			compact),
+	}
+}
+
+func DebugNotificationProviderFileAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := settings.DebugNotificationProviderAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &DebugNotificationProviderFileAddedEvent{DebugNotificationProviderAddedEvent: *e.(*settings.DebugNotificationProviderAddedEvent)}, nil
+}
+
+type DebugNotificationProviderFileChangedEvent struct {
+	settings.DebugNotificationProviderChangedEvent
+}
+
+func NewDebugNotificationProviderFileChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	changes []settings.DebugNotificationProviderChanges,
+) (*DebugNotificationProviderFileChangedEvent, error) {
+	changedEvent, err := settings.NewDebugNotificationProviderChangedEvent(
+		eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			DebugNotificationProviderFileChangedEventType),
+		changes,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &DebugNotificationProviderFileChangedEvent{DebugNotificationProviderChangedEvent: *changedEvent}, nil
+}
+
+func DebugNotificationProviderFileChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := settings.DebugNotificationProviderChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &DebugNotificationProviderFileChangedEvent{DebugNotificationProviderChangedEvent: *e.(*settings.DebugNotificationProviderChangedEvent)}, nil
+}
+
+type DebugNotificationProviderFileRemovedEvent struct {
+	settings.DebugNotificationProviderRemovedEvent
+}
+
+func NewDebugNotificationProviderFileRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+) *DebugNotificationProviderFileRemovedEvent {
+	return &DebugNotificationProviderFileRemovedEvent{
+		DebugNotificationProviderRemovedEvent: *settings.NewDebugNotificationProviderRemovedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				DebugNotificationProviderFileRemovedEventType),
+		),
+	}
+}
+
+func DebugNotificationProviderFileRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := settings.DebugNotificationProviderRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &DebugNotificationProviderFileRemovedEvent{DebugNotificationProviderRemovedEvent: *e.(*settings.DebugNotificationProviderRemovedEvent)}, nil
+}

apps/api/internal/repository/instance/debug_notification_log.go

@@ -0,0 +1,106 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/settings"
+)
+
+const (
+	logType = ".log"
+)
+
+var (
+	DebugNotificationProviderLogAddedEventType    = instanceEventTypePrefix + settings.DebugNotificationPrefix + logType + settings.DebugNotificationProviderAdded
+	DebugNotificationProviderLogChangedEventType  = instanceEventTypePrefix + settings.DebugNotificationPrefix + logType + settings.DebugNotificationProviderChanged
+	DebugNotificationProviderLogEnabledEventType  = instanceEventTypePrefix + settings.DebugNotificationPrefix + logType + settings.DebugNotificationProviderEnabled
+	DebugNotificationProviderLogDisabledEventType = instanceEventTypePrefix + settings.DebugNotificationPrefix + logType + settings.DebugNotificationProviderDisabled
+	DebugNotificationProviderLogRemovedEventType  = instanceEventTypePrefix + settings.DebugNotificationPrefix + logType + settings.DebugNotificationProviderRemoved
+)
+
+type DebugNotificationProviderLogAddedEvent struct {
+	settings.DebugNotificationProviderAddedEvent
+}
+
+func NewDebugNotificationProviderLogAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	compact bool,
+) *DebugNotificationProviderLogAddedEvent {
+	return &DebugNotificationProviderLogAddedEvent{
+		DebugNotificationProviderAddedEvent: *settings.NewDebugNotificationProviderAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				DebugNotificationProviderLogAddedEventType),
+			compact),
+	}
+}
+
+func DebugNotificationProviderLogAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := settings.DebugNotificationProviderAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &DebugNotificationProviderLogAddedEvent{DebugNotificationProviderAddedEvent: *e.(*settings.DebugNotificationProviderAddedEvent)}, nil
+}
+
+type DebugNotificationProviderLogChangedEvent struct {
+	settings.DebugNotificationProviderChangedEvent
+}
+
+func NewDebugNotificationProviderLogChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	changes []settings.DebugNotificationProviderChanges,
+) (*DebugNotificationProviderLogChangedEvent, error) {
+	changedEvent, err := settings.NewDebugNotificationProviderChangedEvent(
+		eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			DebugNotificationProviderLogChangedEventType),
+		changes,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &DebugNotificationProviderLogChangedEvent{DebugNotificationProviderChangedEvent: *changedEvent}, nil
+}
+
+func DebugNotificationProviderLogChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := settings.DebugNotificationProviderChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &DebugNotificationProviderLogChangedEvent{DebugNotificationProviderChangedEvent: *e.(*settings.DebugNotificationProviderChangedEvent)}, nil
+}
+
+type DebugNotificationProviderLogRemovedEvent struct {
+	settings.DebugNotificationProviderRemovedEvent
+}
+
+func NewDebugNotificationProviderLogRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+) *DebugNotificationProviderLogRemovedEvent {
+	return &DebugNotificationProviderLogRemovedEvent{
+		DebugNotificationProviderRemovedEvent: *settings.NewDebugNotificationProviderRemovedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				DebugNotificationProviderLogRemovedEventType),
+		),
+	}
+}
+
+func DebugNotificationProviderLogRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := settings.DebugNotificationProviderRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &DebugNotificationProviderLogRemovedEvent{DebugNotificationProviderRemovedEvent: *e.(*settings.DebugNotificationProviderRemovedEvent)}, nil
+}

apps/api/internal/repository/instance/domain.go

@@ -0,0 +1,201 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	UniqueInstanceDomain              = "instance_domain"
+	domainEventPrefix                 = instanceEventTypePrefix + "domain."
+	InstanceDomainAddedEventType      = domainEventPrefix + "added"
+	InstanceDomainPrimarySetEventType = domainEventPrefix + "primary.set"
+	InstanceDomainRemovedEventType    = domainEventPrefix + "removed"
+
+	InstanceDomainSearchType     = "instance_domain"
+	InstanceDomainSearchField    = "domain"
+	InstanceDomainObjectRevision = uint8(1)
+)
+
+func NewAddInstanceDomainUniqueConstraint(domain string) *eventstore.UniqueConstraint {
+	return eventstore.NewAddGlobalUniqueConstraint(
+		UniqueInstanceDomain,
+		domain,
+		"Errors.Instance.Domain.AlreadyExists")
+}
+
+func NewRemoveInstanceDomainUniqueConstraint(domain string) *eventstore.UniqueConstraint {
+	return eventstore.NewRemoveGlobalUniqueConstraint(
+		UniqueInstanceDomain,
+		domain)
+}
+
+type DomainAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Domain    string `json:"domain,omitempty"`
+	Generated bool   `json:"generated,omitempty"`
+}
+
+func (e *DomainAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *DomainAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return []*eventstore.UniqueConstraint{NewAddInstanceDomainUniqueConstraint(e.Domain)}
+}
+
+func (e *DomainAddedEvent) Fields() []*eventstore.FieldOperation {
+	return []*eventstore.FieldOperation{
+		eventstore.SetField(
+			e.Aggregate(),
+			domainSearchObject(e.Domain),
+			InstanceDomainSearchField,
+			&eventstore.Value{
+				Value: e.Domain,
+				// TODO: (adlerhurst) ensure uniqueness if we go with fields table: https://github.com/zitadel/zitadel/issues/9009
+				MustBeUnique: false,
+				ShouldIndex:  true,
+			},
+
+			eventstore.FieldTypeInstanceID,
+			eventstore.FieldTypeResourceOwner,
+			eventstore.FieldTypeAggregateType,
+			eventstore.FieldTypeAggregateID,
+			eventstore.FieldTypeObjectType,
+			eventstore.FieldTypeObjectID,
+			eventstore.FieldTypeFieldName,
+		),
+	}
+}
+
+func NewDomainAddedEvent(ctx context.Context, aggregate *eventstore.Aggregate, domain string, generated bool) *DomainAddedEvent {
+	return &DomainAddedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			InstanceDomainAddedEventType,
+		),
+		Domain:    domain,
+		Generated: generated,
+	}
+}
+
+func DomainAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	domainAdded := &DomainAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(domainAdded)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "INSTANCE-3noij", "unable to unmarshal instance domain added")
+	}
+
+	return domainAdded, nil
+}
+
+type DomainPrimarySetEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Domain string `json:"domain,omitempty"`
+}
+
+func (e *DomainPrimarySetEvent) Payload() interface{} {
+	return e
+}
+
+func (e *DomainPrimarySetEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewDomainPrimarySetEvent(ctx context.Context, aggregate *eventstore.Aggregate, domain string) *DomainPrimarySetEvent {
+	return &DomainPrimarySetEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			InstanceDomainPrimarySetEventType,
+		),
+		Domain: domain,
+	}
+}
+
+func DomainPrimarySetEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	domainAdded := &DomainPrimarySetEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(domainAdded)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "INSTANCE-29jöF", "unable to unmarshal instance domain added")
+	}
+
+	return domainAdded, nil
+}
+
+type DomainRemovedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Domain string `json:"domain,omitempty"`
+}
+
+func (e *DomainRemovedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *DomainRemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return []*eventstore.UniqueConstraint{NewRemoveInstanceDomainUniqueConstraint(e.Domain)}
+}
+
+func (e *DomainRemovedEvent) Fields() []*eventstore.FieldOperation {
+	return []*eventstore.FieldOperation{
+		eventstore.SetField(
+			e.Aggregate(),
+			domainSearchObject(e.Domain),
+			InstanceDomainSearchField,
+			&eventstore.Value{
+				Value:        e.Domain,
+				MustBeUnique: true,
+				ShouldIndex:  true,
+			},
+
+			eventstore.FieldTypeInstanceID,
+			eventstore.FieldTypeResourceOwner,
+			eventstore.FieldTypeAggregateType,
+			eventstore.FieldTypeAggregateID,
+			eventstore.FieldTypeObjectType,
+			eventstore.FieldTypeObjectID,
+			eventstore.FieldTypeFieldName,
+		),
+	}
+}
+
+func NewDomainRemovedEvent(ctx context.Context, aggregate *eventstore.Aggregate, domain string) *DomainRemovedEvent {
+	return &DomainRemovedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			InstanceDomainRemovedEventType,
+		),
+		Domain: domain,
+	}
+}
+
+func DomainRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	domainRemoved := &DomainRemovedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(domainRemoved)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "INSTANCE-BngB2", "unable to unmarshal instance domain removed")
+	}
+
+	return domainRemoved, nil
+}
+
+func domainSearchObject(domain string) eventstore.Object {
+	return eventstore.Object{
+		Type:     InstanceDomainSearchType,
+		ID:       domain,
+		Revision: InstanceDomainObjectRevision,
+	}
+}

apps/api/internal/repository/instance/event_default_language.go

@@ -0,0 +1,55 @@
+package instance
+
+import (
+	"context"
+
+	"golang.org/x/text/language"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	DefaultLanguageSetEventType eventstore.EventType = "instance.default.language.set"
+)
+
+type DefaultLanguageSetEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Language language.Tag `json:"language"`
+}
+
+func (e *DefaultLanguageSetEvent) Payload() interface{} {
+	return e
+}
+
+func (e *DefaultLanguageSetEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewDefaultLanguageSetEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	language language.Tag,
+) *DefaultLanguageSetEvent {
+	return &DefaultLanguageSetEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			DefaultLanguageSetEventType,
+		),
+		Language: language,
+	}
+}
+
+func DefaultLanguageSetMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &DefaultLanguageSetEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IAM-3j9fs", "unable to unmarshal default language set")
+	}
+
+	return e, nil
+}

apps/api/internal/repository/instance/event_iam_project_set.go

@@ -0,0 +1,98 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	ProjectSetEventType eventstore.EventType = "instance.iam.project.set"
+	ConsoleSetEventType eventstore.EventType = "instance.iam.console.set"
+)
+
+type ProjectSetEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ProjectID string `json:"iamProjectId"`
+}
+
+func (e *ProjectSetEvent) Payload() interface{} {
+	return e
+}
+
+func (e *ProjectSetEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewIAMProjectSetEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	projectID string,
+) *ProjectSetEvent {
+	return &ProjectSetEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			ProjectSetEventType,
+		),
+		ProjectID: projectID,
+	}
+}
+
+func ProjectSetMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &ProjectSetEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IAM-cdFZH", "unable to unmarshal global org set")
+	}
+
+	return e, nil
+}
+
+type ConsoleSetEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	ClientID string `json:"clientId"`
+	AppID    string `json:"appId"`
+}
+
+func (e *ConsoleSetEvent) Payload() interface{} {
+	return e
+}
+
+func (e *ConsoleSetEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewIAMConsoleSetEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	clientID,
+	appID *string,
+) *ConsoleSetEvent {
+	return &ConsoleSetEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			ConsoleSetEventType,
+		),
+		ClientID: *clientID,
+		AppID:    *appID,
+	}
+}
+
+func ConsoleSetMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &ConsoleSetEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IAM-cdFZH", "unable to unmarshal console set")
+	}
+
+	return e, nil
+}

apps/api/internal/repository/instance/event_org_set.go

@@ -0,0 +1,53 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	DefaultOrgSetEventType eventstore.EventType = "instance.default.org.set"
+)
+
+type DefaultOrgSetEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	OrgID string `json:"orgId"`
+}
+
+func (e *DefaultOrgSetEvent) Payload() interface{} {
+	return e
+}
+
+func (e *DefaultOrgSetEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewDefaultOrgSetEventEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	orgID string,
+) *DefaultOrgSetEvent {
+	return &DefaultOrgSetEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			DefaultOrgSetEventType,
+		),
+		OrgID: orgID,
+	}
+}
+
+func DefaultOrgSetMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &DefaultOrgSetEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IAM-cdFZH", "unable to unmarshal default org set")
+	}
+
+	return e, nil
+}

apps/api/internal/repository/instance/eventstore.go

@@ -0,0 +1,134 @@
+package instance
+
+import (
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+func init() {
+	eventstore.RegisterFilterEventMapper(AggregateType, DefaultOrgSetEventType, DefaultOrgSetMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, ProjectSetEventType, ProjectSetMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, ConsoleSetEventType, ConsoleSetMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, DefaultLanguageSetEventType, DefaultLanguageSetMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, SecretGeneratorAddedEventType, SecretGeneratorAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, SecretGeneratorChangedEventType, SecretGeneratorChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, SecretGeneratorRemovedEventType, SecretGeneratorRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, SMTPConfigAddedEventType, eventstore.GenericEventMapper[SMTPConfigAddedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMTPConfigChangedEventType, eventstore.GenericEventMapper[SMTPConfigChangedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMTPConfigActivatedEventType, eventstore.GenericEventMapper[SMTPConfigActivatedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMTPConfigDeactivatedEventType, eventstore.GenericEventMapper[SMTPConfigDeactivatedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMTPConfigPasswordChangedEventType, eventstore.GenericEventMapper[SMTPConfigPasswordChangedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMTPConfigHTTPAddedEventType, eventstore.GenericEventMapper[SMTPConfigHTTPAddedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMTPConfigHTTPChangedEventType, eventstore.GenericEventMapper[SMTPConfigHTTPChangedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMTPConfigRemovedEventType, eventstore.GenericEventMapper[SMTPConfigRemovedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMSConfigTwilioAddedEventType, eventstore.GenericEventMapper[SMSConfigTwilioAddedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMSConfigTwilioChangedEventType, eventstore.GenericEventMapper[SMSConfigTwilioChangedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMSConfigTwilioTokenChangedEventType, eventstore.GenericEventMapper[SMSConfigTwilioTokenChangedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMSConfigHTTPAddedEventType, eventstore.GenericEventMapper[SMSConfigHTTPAddedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMSConfigHTTPChangedEventType, eventstore.GenericEventMapper[SMSConfigHTTPChangedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMSConfigTwilioActivatedEventType, eventstore.GenericEventMapper[SMSConfigTwilioActivatedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMSConfigTwilioDeactivatedEventType, eventstore.GenericEventMapper[SMSConfigTwilioDeactivatedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMSConfigTwilioRemovedEventType, eventstore.GenericEventMapper[SMSConfigTwilioRemovedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMSConfigActivatedEventType, eventstore.GenericEventMapper[SMSConfigActivatedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMSConfigDeactivatedEventType, eventstore.GenericEventMapper[SMSConfigDeactivatedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, SMSConfigRemovedEventType, eventstore.GenericEventMapper[SMSConfigRemovedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, DebugNotificationProviderFileAddedEventType, DebugNotificationProviderFileAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, DebugNotificationProviderFileChangedEventType, DebugNotificationProviderFileChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, DebugNotificationProviderFileRemovedEventType, DebugNotificationProviderFileRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, DebugNotificationProviderLogAddedEventType, DebugNotificationProviderLogAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, DebugNotificationProviderLogChangedEventType, DebugNotificationProviderLogChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, DebugNotificationProviderLogRemovedEventType, DebugNotificationProviderLogRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OIDCSettingsAddedEventType, OIDCSettingsAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OIDCSettingsChangedEventType, OIDCSettingsChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, SecurityPolicySetEventType, SecurityPolicySetEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyAddedEventType, LabelPolicyAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyChangedEventType, LabelPolicyChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyActivatedEventType, LabelPolicyActivatedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyLogoAddedEventType, LabelPolicyLogoAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyLogoRemovedEventType, LabelPolicyLogoRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyIconAddedEventType, LabelPolicyIconAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyIconRemovedEventType, LabelPolicyIconRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyLogoDarkAddedEventType, LabelPolicyLogoDarkAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyLogoDarkRemovedEventType, LabelPolicyLogoDarkRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyIconDarkAddedEventType, LabelPolicyIconDarkAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyIconDarkRemovedEventType, LabelPolicyIconDarkRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyFontAddedEventType, LabelPolicyFontAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyFontRemovedEventType, LabelPolicyFontRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LabelPolicyAssetsRemovedEventType, LabelPolicyAssetsRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LoginPolicyAddedEventType, LoginPolicyAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LoginPolicyChangedEventType, LoginPolicyChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, DomainPolicyAddedEventType, DomainPolicyAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, DomainPolicyChangedEventType, DomainPolicyChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, PasswordAgePolicyAddedEventType, PasswordAgePolicyAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, PasswordAgePolicyChangedEventType, PasswordAgePolicyChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, PasswordComplexityPolicyAddedEventType, PasswordComplexityPolicyAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, PasswordComplexityPolicyChangedEventType, PasswordComplexityPolicyChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LockoutPolicyAddedEventType, LockoutPolicyAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LockoutPolicyChangedEventType, LockoutPolicyChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, PrivacyPolicyAddedEventType, PrivacyPolicyAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, PrivacyPolicyChangedEventType, PrivacyPolicyChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, MemberAddedEventType, MemberAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, MemberChangedEventType, MemberChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, MemberRemovedEventType, MemberRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, MemberCascadeRemovedEventType, MemberCascadeRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, IDPConfigAddedEventType, IDPConfigAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, IDPConfigChangedEventType, IDPConfigChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, IDPConfigRemovedEventType, IDPConfigRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, IDPConfigDeactivatedEventType, IDPConfigDeactivatedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, IDPConfigReactivatedEventType, IDPConfigReactivatedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, IDPOIDCConfigAddedEventType, IDPOIDCConfigAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, IDPOIDCConfigChangedEventType, IDPOIDCConfigChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, IDPJWTConfigAddedEventType, IDPJWTConfigAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, IDPJWTConfigChangedEventType, IDPJWTConfigChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OAuthIDPAddedEventType, OAuthIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OAuthIDPChangedEventType, OAuthIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OIDCIDPAddedEventType, OIDCIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OIDCIDPChangedEventType, OIDCIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OIDCIDPMigratedAzureADEventType, OIDCIDPMigratedAzureADEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, OIDCIDPMigratedGoogleEventType, OIDCIDPMigratedGoogleEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, JWTIDPAddedEventType, JWTIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, JWTIDPChangedEventType, JWTIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, AzureADIDPAddedEventType, AzureADIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, AzureADIDPChangedEventType, AzureADIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, GitHubIDPAddedEventType, GitHubIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, GitHubIDPChangedEventType, GitHubIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, GitHubEnterpriseIDPAddedEventType, GitHubEnterpriseIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, GitHubEnterpriseIDPChangedEventType, GitHubEnterpriseIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, GitLabIDPAddedEventType, GitLabIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, GitLabIDPChangedEventType, GitLabIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, GitLabSelfHostedIDPAddedEventType, GitLabSelfHostedIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, GitLabSelfHostedIDPChangedEventType, GitLabSelfHostedIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, GoogleIDPAddedEventType, GoogleIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, GoogleIDPChangedEventType, GoogleIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LDAPIDPAddedEventType, LDAPIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LDAPIDPChangedEventType, LDAPIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, AppleIDPAddedEventType, AppleIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, AppleIDPChangedEventType, AppleIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, SAMLIDPAddedEventType, SAMLIDPAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, SAMLIDPChangedEventType, SAMLIDPChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, IDPRemovedEventType, IDPRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LoginPolicyIDPProviderAddedEventType, IdentityProviderAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LoginPolicyIDPProviderRemovedEventType, IdentityProviderRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LoginPolicyIDPProviderCascadeRemovedEventType, IdentityProviderCascadeRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LoginPolicySecondFactorAddedEventType, SecondFactorAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LoginPolicySecondFactorRemovedEventType, SecondFactorRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LoginPolicyMultiFactorAddedEventType, MultiFactorAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, LoginPolicyMultiFactorRemovedEventType, MultiFactorRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, MailTemplateAddedEventType, MailTemplateAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, MailTemplateChangedEventType, MailTemplateChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, MailTextAddedEventType, MailTextAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, MailTextChangedEventType, MailTextChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, CustomTextSetEventType, CustomTextSetEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, CustomTextRemovedEventType, CustomTextRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, CustomTextTemplateRemovedEventType, CustomTextTemplateRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, InstanceDomainAddedEventType, DomainAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, InstanceDomainPrimarySetEventType, DomainPrimarySetEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, InstanceDomainRemovedEventType, DomainRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, InstanceAddedEventType, InstanceAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, InstanceChangedEventType, InstanceChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, InstanceRemovedEventType, InstanceRemovedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, NotificationPolicyAddedEventType, NotificationPolicyAddedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, NotificationPolicyChangedEventType, NotificationPolicyChangedEventMapper)
+	eventstore.RegisterFilterEventMapper(AggregateType, TrustedDomainAddedEventType, eventstore.GenericEventMapper[TrustedDomainAddedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, TrustedDomainRemovedEventType, eventstore.GenericEventMapper[TrustedDomainRemovedEvent])
+	eventstore.RegisterFilterEventMapper(AggregateType, HostedLoginTranslationSet, HostedLoginTranslationSetEventMapper)
+}

apps/api/internal/repository/instance/hosted_login_translation.go

@@ -0,0 +1,55 @@
+package instance
+
+import (
+	"context"
+
+	"golang.org/x/text/language"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	HostedLoginTranslationSet = instanceEventTypePrefix + "hosted_login_translation.set"
+)
+
+type HostedLoginTranslationSetEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Translation map[string]any `json:"translation,omitempty"`
+	Language    language.Tag   `json:"language,omitempty"`
+	Level       string         `json:"level,omitempty"`
+}
+
+func NewHostedLoginTranslationSetEvent(ctx context.Context, aggregate *eventstore.Aggregate, translation map[string]any, language language.Tag) *HostedLoginTranslationSetEvent {
+	return &HostedLoginTranslationSetEvent{
+		BaseEvent:   *eventstore.NewBaseEventForPush(ctx, aggregate, HostedLoginTranslationSet),
+		Translation: translation,
+		Language:    language,
+		Level:       string(aggregate.Type),
+	}
+}
+
+func (e *HostedLoginTranslationSetEvent) Payload() any {
+	return e
+}
+
+func (e *HostedLoginTranslationSetEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func (e *HostedLoginTranslationSetEvent) Fields() []*eventstore.FieldOperation {
+	return nil
+}
+
+func HostedLoginTranslationSetEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	translationSet := &HostedLoginTranslationSetEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(translationSet)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "INST-lOxtJJ", "unable to unmarshal hosted login translation set event")
+	}
+
+	return translationSet, nil
+}

apps/api/internal/repository/instance/idp_config.go

@@ -0,0 +1,185 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/idpconfig"
+)
+
+const (
+	IDPConfigAddedEventType       eventstore.EventType = "iam.idp.config.added"
+	IDPConfigChangedEventType     eventstore.EventType = "iam.idp.config.changed"
+	IDPConfigRemovedEventType     eventstore.EventType = "iam.idp.config.removed"
+	IDPConfigDeactivatedEventType eventstore.EventType = "iam.idp.config.deactivated"
+	IDPConfigReactivatedEventType eventstore.EventType = "iam.idp.config.reactivated"
+)
+
+type IDPConfigAddedEvent struct {
+	idpconfig.IDPConfigAddedEvent
+}
+
+func NewIDPConfigAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	configID,
+	name string,
+	configType domain.IDPConfigType,
+	stylingType domain.IDPConfigStylingType,
+	autoRegister bool,
+) *IDPConfigAddedEvent {
+
+	return &IDPConfigAddedEvent{
+		IDPConfigAddedEvent: *idpconfig.NewIDPConfigAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				IDPConfigAddedEventType,
+			),
+			configID,
+			name,
+			configType,
+			stylingType,
+			autoRegister,
+		),
+	}
+}
+
+func IDPConfigAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := idpconfig.IDPConfigAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &IDPConfigAddedEvent{IDPConfigAddedEvent: *e.(*idpconfig.IDPConfigAddedEvent)}, nil
+}
+
+type IDPConfigChangedEvent struct {
+	idpconfig.IDPConfigChangedEvent
+}
+
+func NewIDPConfigChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	configID,
+	oldName string,
+	changes []idpconfig.IDPConfigChanges,
+) (*IDPConfigChangedEvent, error) {
+	changeEvent, err := idpconfig.NewIDPConfigChangedEvent(
+		eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			IDPConfigChangedEventType),
+		configID,
+		oldName,
+		changes,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &IDPConfigChangedEvent{IDPConfigChangedEvent: *changeEvent}, nil
+}
+
+func IDPConfigChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := idpconfig.IDPConfigChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &IDPConfigChangedEvent{IDPConfigChangedEvent: *e.(*idpconfig.IDPConfigChangedEvent)}, nil
+}
+
+type IDPConfigRemovedEvent struct {
+	idpconfig.IDPConfigRemovedEvent
+}
+
+func NewIDPConfigRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	configID,
+	name string,
+) *IDPConfigRemovedEvent {
+	return &IDPConfigRemovedEvent{
+		IDPConfigRemovedEvent: *idpconfig.NewIDPConfigRemovedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				IDPConfigRemovedEventType,
+			),
+			configID,
+			name,
+		),
+	}
+}
+
+func IDPConfigRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := idpconfig.IDPConfigRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &IDPConfigRemovedEvent{IDPConfigRemovedEvent: *e.(*idpconfig.IDPConfigRemovedEvent)}, nil
+}
+
+type IDPConfigDeactivatedEvent struct {
+	idpconfig.IDPConfigDeactivatedEvent
+}
+
+func NewIDPConfigDeactivatedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	configID string,
+) *IDPConfigDeactivatedEvent {
+
+	return &IDPConfigDeactivatedEvent{
+		IDPConfigDeactivatedEvent: *idpconfig.NewIDPConfigDeactivatedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				IDPConfigDeactivatedEventType,
+			),
+			configID,
+		),
+	}
+}
+
+func IDPConfigDeactivatedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := idpconfig.IDPConfigDeactivatedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &IDPConfigDeactivatedEvent{IDPConfigDeactivatedEvent: *e.(*idpconfig.IDPConfigDeactivatedEvent)}, nil
+}
+
+type IDPConfigReactivatedEvent struct {
+	idpconfig.IDPConfigReactivatedEvent
+}
+
+func NewIDPConfigReactivatedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	configID string,
+) *IDPConfigReactivatedEvent {
+
+	return &IDPConfigReactivatedEvent{
+		IDPConfigReactivatedEvent: *idpconfig.NewIDPConfigReactivatedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				IDPConfigReactivatedEventType,
+			),
+			configID,
+		),
+	}
+}
+
+func IDPConfigReactivatedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := idpconfig.IDPConfigReactivatedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &IDPConfigReactivatedEvent{IDPConfigReactivatedEvent: *e.(*idpconfig.IDPConfigReactivatedEvent)}, nil
+}

apps/api/internal/repository/instance/idp_jwt_config.go

@@ -0,0 +1,84 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/idpconfig"
+)
+
+const (
+	IDPJWTConfigAddedEventType   eventstore.EventType = "iam.idp." + idpconfig.JWTConfigAddedEventType
+	IDPJWTConfigChangedEventType eventstore.EventType = "iam.idp." + idpconfig.JWTConfigChangedEventType
+)
+
+type IDPJWTConfigAddedEvent struct {
+	idpconfig.JWTConfigAddedEvent
+}
+
+func NewIDPJWTConfigAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	idpConfigID,
+	jwtEndpoint,
+	issuer,
+	keysEndpoint,
+	headerName string,
+) *IDPJWTConfigAddedEvent {
+	return &IDPJWTConfigAddedEvent{
+		JWTConfigAddedEvent: *idpconfig.NewJWTConfigAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				IDPJWTConfigAddedEventType,
+			),
+			idpConfigID,
+			jwtEndpoint,
+			issuer,
+			keysEndpoint,
+			headerName,
+		),
+	}
+}
+
+func IDPJWTConfigAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := idpconfig.JWTConfigAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &IDPJWTConfigAddedEvent{JWTConfigAddedEvent: *e.(*idpconfig.JWTConfigAddedEvent)}, nil
+}
+
+type IDPJWTConfigChangedEvent struct {
+	idpconfig.JWTConfigChangedEvent
+}
+
+func NewIDPJWTConfigChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	idpConfigID string,
+	changes []idpconfig.JWTConfigChanges,
+) (*IDPJWTConfigChangedEvent, error) {
+	changeEvent, err := idpconfig.NewJWTConfigChangedEvent(
+		eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			IDPJWTConfigChangedEventType),
+		idpConfigID,
+		changes,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &IDPJWTConfigChangedEvent{JWTConfigChangedEvent: *changeEvent}, nil
+}
+
+func IDPJWTConfigChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := idpconfig.JWTConfigChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &IDPJWTConfigChangedEvent{JWTConfigChangedEvent: *e.(*idpconfig.JWTConfigChangedEvent)}, nil
+}

apps/api/internal/repository/instance/idp_oidc_config.go

@@ -0,0 +1,95 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/idpconfig"
+)
+
+const (
+	IDPOIDCConfigAddedEventType   eventstore.EventType = "iam.idp." + idpconfig.OIDCConfigAddedEventType
+	IDPOIDCConfigChangedEventType eventstore.EventType = "iam.idp." + idpconfig.OIDCConfigChangedEventType
+)
+
+type IDPOIDCConfigAddedEvent struct {
+	idpconfig.OIDCConfigAddedEvent
+}
+
+func NewIDPOIDCConfigAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	clientID,
+	idpConfigID,
+	issuer,
+	authorizationEndpoint,
+	tokenEndpoint string,
+	clientSecret *crypto.CryptoValue,
+	idpDisplayNameMapping,
+	userNameMapping domain.OIDCMappingField,
+	scopes ...string,
+) *IDPOIDCConfigAddedEvent {
+
+	return &IDPOIDCConfigAddedEvent{
+		OIDCConfigAddedEvent: *idpconfig.NewOIDCConfigAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				IDPOIDCConfigAddedEventType,
+			),
+			clientID,
+			idpConfigID,
+			issuer,
+			authorizationEndpoint,
+			tokenEndpoint,
+			clientSecret,
+			idpDisplayNameMapping,
+			userNameMapping,
+			scopes...,
+		),
+	}
+}
+
+func IDPOIDCConfigAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := idpconfig.OIDCConfigAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &IDPOIDCConfigAddedEvent{OIDCConfigAddedEvent: *e.(*idpconfig.OIDCConfigAddedEvent)}, nil
+}
+
+type IDPOIDCConfigChangedEvent struct {
+	idpconfig.OIDCConfigChangedEvent
+}
+
+func NewIDPOIDCConfigChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	idpConfigID string,
+	changes []idpconfig.OIDCConfigChanges,
+) (*IDPOIDCConfigChangedEvent, error) {
+	changeEvent, err := idpconfig.NewOIDCConfigChangedEvent(
+		eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			IDPOIDCConfigChangedEventType),
+		idpConfigID,
+		changes,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &IDPOIDCConfigChangedEvent{OIDCConfigChangedEvent: *changeEvent}, nil
+}
+
+func IDPOIDCConfigChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := idpconfig.OIDCConfigChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &IDPOIDCConfigChangedEvent{OIDCConfigChangedEvent: *e.(*idpconfig.OIDCConfigChangedEvent)}, nil
+}

apps/api/internal/repository/instance/instance.go

@@ -0,0 +1,133 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	InstanceAddedEventType   = instanceEventTypePrefix + "added"
+	InstanceChangedEventType = instanceEventTypePrefix + "changed"
+	InstanceRemovedEventType = instanceEventTypePrefix + "removed"
+)
+
+type InstanceAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Name string `json:"name,omitempty"`
+}
+
+func (e *InstanceAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *InstanceAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewInstanceAddedEvent(ctx context.Context, aggregate *eventstore.Aggregate, name string) *InstanceAddedEvent {
+	return &InstanceAddedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			InstanceAddedEventType,
+		),
+		Name: name,
+	}
+}
+
+func InstanceAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	instanceAdded := &InstanceAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(instanceAdded)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "INSTANCE-s9l3F", "unable to unmarshal instance added")
+	}
+
+	return instanceAdded, nil
+}
+
+type InstanceChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Name string `json:"name,omitempty"`
+}
+
+func (e *InstanceChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *InstanceChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewInstanceChangedEvent(ctx context.Context, aggregate *eventstore.Aggregate, newName string) *InstanceChangedEvent {
+	return &InstanceChangedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			InstanceChangedEventType,
+		),
+		Name: newName,
+	}
+}
+
+func InstanceChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	instanceChanged := &InstanceChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(instanceChanged)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "INSTANCE-3hfo8", "unable to unmarshal instance changed")
+	}
+
+	return instanceChanged, nil
+}
+
+type InstanceRemovedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+	name                 string
+	domains              []string
+}
+
+func (e *InstanceRemovedEvent) Payload() interface{} {
+	return nil
+}
+
+func (e *InstanceRemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	constraints := make([]*eventstore.UniqueConstraint, len(e.domains)+1)
+	for i, domain := range e.domains {
+		constraints[i] = NewRemoveInstanceDomainUniqueConstraint(domain)
+	}
+	constraints[len(e.domains)] = eventstore.NewRemoveInstanceUniqueConstraints()
+	return constraints
+}
+
+func (e *InstanceRemovedEvent) Fields() []*eventstore.FieldOperation {
+	return []*eventstore.FieldOperation{
+		eventstore.RemoveSearchFields(map[eventstore.FieldType]any{
+			eventstore.FieldTypeInstanceID: e.Aggregate().ID,
+		}),
+	}
+}
+
+func NewInstanceRemovedEvent(ctx context.Context, aggregate *eventstore.Aggregate, name string, domains []string) *InstanceRemovedEvent {
+	return &InstanceRemovedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			InstanceRemovedEventType,
+		),
+		name:    name,
+		domains: domains,
+	}
+}
+
+func InstanceRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	return &InstanceRemovedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}, nil
+}

apps/api/internal/repository/instance/member.go

@@ -0,0 +1,160 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/member"
+)
+
+const (
+	MemberAddedEventType          = instanceEventTypePrefix + member.AddedEventType
+	MemberChangedEventType        = instanceEventTypePrefix + member.ChangedEventType
+	MemberRemovedEventType        = instanceEventTypePrefix + member.RemovedEventType
+	MemberCascadeRemovedEventType = instanceEventTypePrefix + member.CascadeRemovedEventType
+)
+
+const (
+	fieldPrefix = "instance"
+)
+
+type MemberAddedEvent struct {
+	member.MemberAddedEvent
+}
+
+func (e *MemberAddedEvent) Fields() []*eventstore.FieldOperation {
+	return e.FieldOperations(fieldPrefix)
+}
+
+func NewMemberAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	userID string,
+	roles ...string,
+) *MemberAddedEvent {
+
+	return &MemberAddedEvent{
+		MemberAddedEvent: *member.NewMemberAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				MemberAddedEventType,
+			),
+			userID,
+			roles...,
+		),
+	}
+}
+
+func MemberAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := member.MemberAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &MemberAddedEvent{MemberAddedEvent: *e.(*member.MemberAddedEvent)}, nil
+}
+
+type MemberChangedEvent struct {
+	member.MemberChangedEvent
+}
+
+func (e *MemberChangedEvent) Fields() []*eventstore.FieldOperation {
+	return e.FieldOperations(fieldPrefix)
+}
+
+func NewMemberChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	userID string,
+	roles ...string,
+) *MemberChangedEvent {
+	return &MemberChangedEvent{
+		MemberChangedEvent: *member.NewMemberChangedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				MemberChangedEventType,
+			),
+			userID,
+			roles...,
+		),
+	}
+}
+
+func MemberChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := member.ChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &MemberChangedEvent{MemberChangedEvent: *e.(*member.MemberChangedEvent)}, nil
+}
+
+type MemberRemovedEvent struct {
+	member.MemberRemovedEvent
+}
+
+func (e *MemberRemovedEvent) Fields() []*eventstore.FieldOperation {
+	return e.FieldOperations(fieldPrefix)
+}
+
+func NewMemberRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	userID string,
+) *MemberRemovedEvent {
+	return &MemberRemovedEvent{
+		MemberRemovedEvent: *member.NewRemovedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				MemberRemovedEventType,
+			),
+			userID,
+		),
+	}
+}
+
+func MemberRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := member.RemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &MemberRemovedEvent{MemberRemovedEvent: *e.(*member.MemberRemovedEvent)}, nil
+}
+
+type MemberCascadeRemovedEvent struct {
+	member.MemberCascadeRemovedEvent
+}
+
+func (e *MemberCascadeRemovedEvent) Fields() []*eventstore.FieldOperation {
+	return e.FieldOperations(fieldPrefix)
+}
+
+func NewMemberCascadeRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	userID string,
+) *MemberCascadeRemovedEvent {
+	return &MemberCascadeRemovedEvent{
+		MemberCascadeRemovedEvent: *member.NewCascadeRemovedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				MemberCascadeRemovedEventType,
+			),
+			userID,
+		),
+	}
+}
+
+func MemberCascadeRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := member.CascadeRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &MemberCascadeRemovedEvent{MemberCascadeRemovedEvent: *e.(*member.MemberCascadeRemovedEvent)}, nil
+}

apps/api/internal/repository/instance/oidc_settings.go

@@ -0,0 +1,142 @@
+package instance
+
+import (
+	"context"
+	"time"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	oidcSettingsPrefix           = "oidc.settings."
+	OIDCSettingsAddedEventType   = instanceEventTypePrefix + oidcSettingsPrefix + "added"
+	OIDCSettingsChangedEventType = instanceEventTypePrefix + oidcSettingsPrefix + "changed"
+)
+
+type OIDCSettingsAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	AccessTokenLifetime        time.Duration `json:"accessTokenLifetime,omitempty"`
+	IdTokenLifetime            time.Duration `json:"idTokenLifetime,omitempty"`
+	RefreshTokenIdleExpiration time.Duration `json:"refreshTokenIdleExpiration,omitempty"`
+	RefreshTokenExpiration     time.Duration `json:"refreshTokenExpiration,omitempty"`
+}
+
+func NewOIDCSettingsAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	accessTokenLifetime,
+	idTokenLifetime,
+	refreshTokenIdleExpiration,
+	refreshTokenExpiration time.Duration,
+) *OIDCSettingsAddedEvent {
+	return &OIDCSettingsAddedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			OIDCSettingsAddedEventType,
+		),
+		AccessTokenLifetime:        accessTokenLifetime,
+		IdTokenLifetime:            idTokenLifetime,
+		RefreshTokenIdleExpiration: refreshTokenIdleExpiration,
+		RefreshTokenExpiration:     refreshTokenExpiration,
+	}
+}
+
+func (e *OIDCSettingsAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *OIDCSettingsAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func OIDCSettingsAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	oidcSettingsAdded := &OIDCSettingsAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(oidcSettingsAdded)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IAM-soiwj", "unable to unmarshal oidc config added")
+	}
+
+	return oidcSettingsAdded, nil
+}
+
+type OIDCSettingsChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	AccessTokenLifetime        *time.Duration `json:"accessTokenLifetime,omitempty"`
+	IdTokenLifetime            *time.Duration `json:"idTokenLifetime,omitempty"`
+	RefreshTokenIdleExpiration *time.Duration `json:"refreshTokenIdleExpiration,omitempty"`
+	RefreshTokenExpiration     *time.Duration `json:"refreshTokenExpiration,omitempty"`
+}
+
+func (e *OIDCSettingsChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *OIDCSettingsChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewOIDCSettingsChangeEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	changes []OIDCSettingsChanges,
+) (*OIDCSettingsChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IAM-dnlwe", "Errors.NoChangesFound")
+	}
+	changeEvent := &OIDCSettingsChangedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			OIDCSettingsChangedEventType,
+		),
+	}
+	for _, change := range changes {
+		change(changeEvent)
+	}
+	return changeEvent, nil
+}
+
+type OIDCSettingsChanges func(event *OIDCSettingsChangedEvent)
+
+func ChangeOIDCSettingsAccessTokenLifetime(accessTokenLifetime time.Duration) func(event *OIDCSettingsChangedEvent) {
+	return func(e *OIDCSettingsChangedEvent) {
+		e.AccessTokenLifetime = &accessTokenLifetime
+	}
+}
+
+func ChangeOIDCSettingsIdTokenLifetime(idTokenLifetime time.Duration) func(event *OIDCSettingsChangedEvent) {
+	return func(e *OIDCSettingsChangedEvent) {
+		e.IdTokenLifetime = &idTokenLifetime
+	}
+}
+
+func ChangeOIDCSettingsRefreshTokenIdleExpiration(refreshTokenIdleExpiration time.Duration) func(event *OIDCSettingsChangedEvent) {
+	return func(e *OIDCSettingsChangedEvent) {
+		e.RefreshTokenIdleExpiration = &refreshTokenIdleExpiration
+	}
+}
+
+func ChangeOIDCSettingsRefreshTokenExpiration(refreshTokenExpiration time.Duration) func(event *OIDCSettingsChangedEvent) {
+	return func(e *OIDCSettingsChangedEvent) {
+		e.RefreshTokenExpiration = &refreshTokenExpiration
+	}
+}
+
+func OIDCSettingsChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &OIDCSettingsChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IAM-f98uf", "unable to unmarshal oidc settings changed")
+	}
+
+	return e, nil
+}

apps/api/internal/repository/instance/policy_domain.go

@@ -0,0 +1,77 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/policy"
+)
+
+var (
+	DomainPolicyAddedEventType   = instanceEventTypePrefix + policy.DomainPolicyAddedEventType
+	DomainPolicyChangedEventType = instanceEventTypePrefix + policy.DomainPolicyChangedEventType
+)
+
+type DomainPolicyAddedEvent struct {
+	policy.DomainPolicyAddedEvent
+}
+
+func NewDomainPolicyAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	userLoginMustBeDomain,
+	validateOrgDomain,
+	smtpSenderAddressMatchesInstanceDomain bool,
+) *DomainPolicyAddedEvent {
+	return &DomainPolicyAddedEvent{
+		DomainPolicyAddedEvent: *policy.NewDomainPolicyAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				DomainPolicyAddedEventType),
+			userLoginMustBeDomain,
+			validateOrgDomain,
+			smtpSenderAddressMatchesInstanceDomain,
+		),
+	}
+}
+
+func DomainPolicyAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.DomainPolicyAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &DomainPolicyAddedEvent{DomainPolicyAddedEvent: *e.(*policy.DomainPolicyAddedEvent)}, nil
+}
+
+type DomainPolicyChangedEvent struct {
+	policy.DomainPolicyChangedEvent
+}
+
+func NewDomainPolicyChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	changes []policy.DomainPolicyChanges,
+) (*DomainPolicyChangedEvent, error) {
+	changedEvent, err := policy.NewDomainPolicyChangedEvent(
+		eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			DomainPolicyChangedEventType),
+		changes,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &DomainPolicyChangedEvent{DomainPolicyChangedEvent: *changedEvent}, nil
+}
+
+func DomainPolicyChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.DomainPolicyChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &DomainPolicyChangedEvent{DomainPolicyChangedEvent: *e.(*policy.DomainPolicyChangedEvent)}, nil
+}

apps/api/internal/repository/instance/policy_label.go

@@ -0,0 +1,462 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/policy"
+)
+
+var (
+	LabelPolicyAddedEventType     = instanceEventTypePrefix + policy.LabelPolicyAddedEventType
+	LabelPolicyChangedEventType   = instanceEventTypePrefix + policy.LabelPolicyChangedEventType
+	LabelPolicyActivatedEventType = instanceEventTypePrefix + policy.LabelPolicyActivatedEventType
+
+	LabelPolicyLogoAddedEventType       = instanceEventTypePrefix + policy.LabelPolicyLogoAddedEventType
+	LabelPolicyLogoRemovedEventType     = instanceEventTypePrefix + policy.LabelPolicyLogoRemovedEventType
+	LabelPolicyIconAddedEventType       = instanceEventTypePrefix + policy.LabelPolicyIconAddedEventType
+	LabelPolicyIconRemovedEventType     = instanceEventTypePrefix + policy.LabelPolicyIconRemovedEventType
+	LabelPolicyLogoDarkAddedEventType   = instanceEventTypePrefix + policy.LabelPolicyLogoDarkAddedEventType
+	LabelPolicyLogoDarkRemovedEventType = instanceEventTypePrefix + policy.LabelPolicyLogoDarkRemovedEventType
+	LabelPolicyIconDarkAddedEventType   = instanceEventTypePrefix + policy.LabelPolicyIconDarkAddedEventType
+	LabelPolicyIconDarkRemovedEventType = instanceEventTypePrefix + policy.LabelPolicyIconDarkRemovedEventType
+
+	LabelPolicyFontAddedEventType   = instanceEventTypePrefix + policy.LabelPolicyFontAddedEventType
+	LabelPolicyFontRemovedEventType = instanceEventTypePrefix + policy.LabelPolicyFontRemovedEventType
+
+	LabelPolicyAssetsRemovedEventType = instanceEventTypePrefix + policy.LabelPolicyAssetsRemovedEventType
+)
+
+type LabelPolicyAddedEvent struct {
+	policy.LabelPolicyAddedEvent
+}
+
+func NewLabelPolicyAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	primaryColor,
+	backgroundColor,
+	warnColor,
+	fontColor,
+	primaryColorDark,
+	backgroundColorDark,
+	warnColorDark,
+	fontColorDark string,
+	hideLoginNameSuffix,
+	errorMsgPopup,
+	disableWatermark bool,
+	themeMode domain.LabelPolicyThemeMode,
+) *LabelPolicyAddedEvent {
+	return &LabelPolicyAddedEvent{
+		LabelPolicyAddedEvent: *policy.NewLabelPolicyAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LabelPolicyAddedEventType),
+			primaryColor,
+			backgroundColor,
+			warnColor,
+			fontColor,
+			primaryColorDark,
+			backgroundColorDark,
+			warnColorDark,
+			fontColorDark,
+			hideLoginNameSuffix,
+			errorMsgPopup,
+			disableWatermark,
+			themeMode),
+	}
+}
+
+func LabelPolicyAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LabelPolicyAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LabelPolicyAddedEvent{LabelPolicyAddedEvent: *e.(*policy.LabelPolicyAddedEvent)}, nil
+}
+
+type LabelPolicyChangedEvent struct {
+	policy.LabelPolicyChangedEvent
+}
+
+func NewLabelPolicyChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	changes []policy.LabelPolicyChanges,
+) (*LabelPolicyChangedEvent, error) {
+	changedEvent, err := policy.NewLabelPolicyChangedEvent(
+		eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			LabelPolicyChangedEventType),
+		changes,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &LabelPolicyChangedEvent{LabelPolicyChangedEvent: *changedEvent}, nil
+}
+
+func LabelPolicyChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LabelPolicyChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LabelPolicyChangedEvent{LabelPolicyChangedEvent: *e.(*policy.LabelPolicyChangedEvent)}, nil
+}
+
+type LabelPolicyActivatedEvent struct {
+	policy.LabelPolicyActivatedEvent
+}
+
+func NewLabelPolicyActivatedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+) *LabelPolicyActivatedEvent {
+	return &LabelPolicyActivatedEvent{
+		LabelPolicyActivatedEvent: *policy.NewLabelPolicyActivatedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LabelPolicyActivatedEventType),
+		),
+	}
+}
+
+func LabelPolicyActivatedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LabelPolicyActivatedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LabelPolicyActivatedEvent{LabelPolicyActivatedEvent: *e.(*policy.LabelPolicyActivatedEvent)}, nil
+}
+
+type LabelPolicyLogoAddedEvent struct {
+	policy.LabelPolicyLogoAddedEvent
+}
+
+func NewLabelPolicyLogoAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	storageKey string,
+) *LabelPolicyLogoAddedEvent {
+	return &LabelPolicyLogoAddedEvent{
+		LabelPolicyLogoAddedEvent: *policy.NewLabelPolicyLogoAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LabelPolicyLogoAddedEventType),
+			storageKey,
+		),
+	}
+}
+
+func LabelPolicyLogoAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LabelPolicyLogoAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LabelPolicyLogoAddedEvent{LabelPolicyLogoAddedEvent: *e.(*policy.LabelPolicyLogoAddedEvent)}, nil
+}
+
+type LabelPolicyLogoRemovedEvent struct {
+	policy.LabelPolicyLogoRemovedEvent
+}
+
+func NewLabelPolicyLogoRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	storageKey string,
+) *LabelPolicyLogoRemovedEvent {
+	return &LabelPolicyLogoRemovedEvent{
+		LabelPolicyLogoRemovedEvent: *policy.NewLabelPolicyLogoRemovedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LabelPolicyLogoRemovedEventType),
+			storageKey,
+		),
+	}
+}
+
+func LabelPolicyLogoRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LabelPolicyLogoRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LabelPolicyLogoRemovedEvent{LabelPolicyLogoRemovedEvent: *e.(*policy.LabelPolicyLogoRemovedEvent)}, nil
+}
+
+type LabelPolicyIconAddedEvent struct {
+	policy.LabelPolicyIconAddedEvent
+}
+
+func NewLabelPolicyIconAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	storageKey string,
+) *LabelPolicyIconAddedEvent {
+	return &LabelPolicyIconAddedEvent{
+		LabelPolicyIconAddedEvent: *policy.NewLabelPolicyIconAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LabelPolicyIconAddedEventType),
+			storageKey,
+		),
+	}
+}
+
+func LabelPolicyIconAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LabelPolicyIconAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LabelPolicyIconAddedEvent{LabelPolicyIconAddedEvent: *e.(*policy.LabelPolicyIconAddedEvent)}, nil
+}
+
+type LabelPolicyIconRemovedEvent struct {
+	policy.LabelPolicyIconRemovedEvent
+}
+
+func NewLabelPolicyIconRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	storageKey string,
+) *LabelPolicyIconRemovedEvent {
+	return &LabelPolicyIconRemovedEvent{
+		LabelPolicyIconRemovedEvent: *policy.NewLabelPolicyIconRemovedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LabelPolicyIconRemovedEventType),
+			storageKey,
+		),
+	}
+}
+
+func LabelPolicyIconRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LabelPolicyIconRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LabelPolicyIconRemovedEvent{LabelPolicyIconRemovedEvent: *e.(*policy.LabelPolicyIconRemovedEvent)}, nil
+}
+
+type LabelPolicyLogoDarkAddedEvent struct {
+	policy.LabelPolicyLogoDarkAddedEvent
+}
+
+func NewLabelPolicyLogoDarkAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	storageKey string,
+) *LabelPolicyLogoDarkAddedEvent {
+	return &LabelPolicyLogoDarkAddedEvent{
+		LabelPolicyLogoDarkAddedEvent: *policy.NewLabelPolicyLogoDarkAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LabelPolicyLogoDarkAddedEventType),
+			storageKey,
+		),
+	}
+}
+
+func LabelPolicyLogoDarkAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LabelPolicyLogoDarkAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LabelPolicyLogoDarkAddedEvent{LabelPolicyLogoDarkAddedEvent: *e.(*policy.LabelPolicyLogoDarkAddedEvent)}, nil
+}
+
+type LabelPolicyLogoDarkRemovedEvent struct {
+	policy.LabelPolicyLogoDarkRemovedEvent
+}
+
+func NewLabelPolicyLogoDarkRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	storageKey string,
+) *LabelPolicyLogoDarkRemovedEvent {
+	return &LabelPolicyLogoDarkRemovedEvent{
+		LabelPolicyLogoDarkRemovedEvent: *policy.NewLabelPolicyLogoDarkRemovedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LabelPolicyLogoDarkRemovedEventType),
+			storageKey,
+		),
+	}
+}
+
+func LabelPolicyLogoDarkRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LabelPolicyLogoDarkRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LabelPolicyLogoDarkRemovedEvent{LabelPolicyLogoDarkRemovedEvent: *e.(*policy.LabelPolicyLogoDarkRemovedEvent)}, nil
+}
+
+type LabelPolicyIconDarkAddedEvent struct {
+	policy.LabelPolicyIconDarkAddedEvent
+}
+
+func NewLabelPolicyIconDarkAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	storageKey string,
+) *LabelPolicyIconDarkAddedEvent {
+	return &LabelPolicyIconDarkAddedEvent{
+		LabelPolicyIconDarkAddedEvent: *policy.NewLabelPolicyIconDarkAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LabelPolicyIconDarkAddedEventType),
+			storageKey,
+		),
+	}
+}
+
+func LabelPolicyIconDarkAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LabelPolicyIconDarkAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LabelPolicyIconDarkAddedEvent{LabelPolicyIconDarkAddedEvent: *e.(*policy.LabelPolicyIconDarkAddedEvent)}, nil
+}
+
+type LabelPolicyIconDarkRemovedEvent struct {
+	policy.LabelPolicyIconDarkRemovedEvent
+}
+
+func NewLabelPolicyIconDarkRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	storageKey string,
+) *LabelPolicyIconDarkRemovedEvent {
+	return &LabelPolicyIconDarkRemovedEvent{
+		LabelPolicyIconDarkRemovedEvent: *policy.NewLabelPolicyIconDarkRemovedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LabelPolicyIconDarkRemovedEventType),
+			storageKey,
+		),
+	}
+}
+
+func LabelPolicyIconDarkRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LabelPolicyIconDarkRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LabelPolicyIconDarkRemovedEvent{LabelPolicyIconDarkRemovedEvent: *e.(*policy.LabelPolicyIconDarkRemovedEvent)}, nil
+}
+
+type LabelPolicyFontAddedEvent struct {
+	policy.LabelPolicyFontAddedEvent
+}
+
+func NewLabelPolicyFontAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	storageKey string,
+) *LabelPolicyFontAddedEvent {
+	return &LabelPolicyFontAddedEvent{
+		LabelPolicyFontAddedEvent: *policy.NewLabelPolicyFontAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LabelPolicyFontAddedEventType),
+			storageKey,
+		),
+	}
+}
+
+func LabelPolicyFontAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LabelPolicyFontAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LabelPolicyFontAddedEvent{LabelPolicyFontAddedEvent: *e.(*policy.LabelPolicyFontAddedEvent)}, nil
+}
+
+type LabelPolicyFontRemovedEvent struct {
+	policy.LabelPolicyFontRemovedEvent
+}
+
+func NewLabelPolicyFontRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	storageKey string,
+) *LabelPolicyFontRemovedEvent {
+	return &LabelPolicyFontRemovedEvent{
+		LabelPolicyFontRemovedEvent: *policy.NewLabelPolicyFontRemovedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LabelPolicyFontRemovedEventType),
+			storageKey,
+		),
+	}
+}
+
+func LabelPolicyFontRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LabelPolicyFontRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LabelPolicyFontRemovedEvent{LabelPolicyFontRemovedEvent: *e.(*policy.LabelPolicyFontRemovedEvent)}, nil
+}
+
+type LabelPolicyAssetsRemovedEvent struct {
+	policy.LabelPolicyAssetsRemovedEvent
+}
+
+func (e *LabelPolicyAssetsRemovedEvent) Payload() interface{} {
+	return nil
+}
+
+func (e *LabelPolicyAssetsRemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewLabelPolicyAssetsRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+) *LabelPolicyAssetsRemovedEvent {
+	return &LabelPolicyAssetsRemovedEvent{
+		LabelPolicyAssetsRemovedEvent: *policy.NewLabelPolicyAssetsRemovedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LabelPolicyAssetsRemovedEventType),
+		),
+	}
+}
+
+func LabelPolicyAssetsRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LabelPolicyAssetsRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LabelPolicyAssetsRemovedEvent{LabelPolicyAssetsRemovedEvent: *e.(*policy.LabelPolicyAssetsRemovedEvent)}, nil
+}

apps/api/internal/repository/instance/policy_login.go

@@ -0,0 +1,106 @@
+package instance
+
+import (
+	"context"
+	"time"
+
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/policy"
+)
+
+var (
+	LoginPolicyAddedEventType   = instanceEventTypePrefix + policy.LoginPolicyAddedEventType
+	LoginPolicyChangedEventType = instanceEventTypePrefix + policy.LoginPolicyChangedEventType
+)
+
+type LoginPolicyAddedEvent struct {
+	policy.LoginPolicyAddedEvent
+}
+
+func NewLoginPolicyAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	allowUsernamePassword,
+	allowRegister,
+	allowExternalIDP,
+	forceMFA,
+	forceMFALocalOnly,
+	hidePasswordReset,
+	ignoreUnknownUsernames,
+	allowDomainDiscovery,
+	disableLoginWithEmail,
+	disableLoginWithPhone bool,
+	passwordlessType domain.PasswordlessType,
+	defaultRedirectURI string,
+	passwordCheckLifetime,
+	externalLoginCheckLifetime,
+	mfaInitSkipLifetime,
+	secondFactorCheckLifetime,
+	multiFactorCheckLifetime time.Duration,
+) *LoginPolicyAddedEvent {
+	return &LoginPolicyAddedEvent{
+		LoginPolicyAddedEvent: *policy.NewLoginPolicyAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LoginPolicyAddedEventType),
+			allowUsernamePassword,
+			allowRegister,
+			allowExternalIDP,
+			forceMFA,
+			forceMFALocalOnly,
+			hidePasswordReset,
+			ignoreUnknownUsernames,
+			allowDomainDiscovery,
+			disableLoginWithEmail,
+			disableLoginWithPhone,
+			passwordlessType,
+			defaultRedirectURI,
+			passwordCheckLifetime,
+			externalLoginCheckLifetime,
+			mfaInitSkipLifetime,
+			secondFactorCheckLifetime,
+			multiFactorCheckLifetime),
+	}
+}
+
+func LoginPolicyAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LoginPolicyAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LoginPolicyAddedEvent{LoginPolicyAddedEvent: *e.(*policy.LoginPolicyAddedEvent)}, nil
+}
+
+type LoginPolicyChangedEvent struct {
+	policy.LoginPolicyChangedEvent
+}
+
+func NewLoginPolicyChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	changes []policy.LoginPolicyChanges,
+) (*LoginPolicyChangedEvent, error) {
+	changedEvent, err := policy.NewLoginPolicyChangedEvent(
+		eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			LoginPolicyChangedEventType),
+		changes,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &LoginPolicyChangedEvent{LoginPolicyChangedEvent: *changedEvent}, nil
+}
+
+func LoginPolicyChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LoginPolicyChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LoginPolicyChangedEvent{LoginPolicyChangedEvent: *e.(*policy.LoginPolicyChangedEvent)}, nil
+}

apps/api/internal/repository/instance/policy_login_factors.go

@@ -0,0 +1,139 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/policy"
+)
+
+var (
+	LoginPolicySecondFactorAddedEventType   = instanceEventTypePrefix + policy.LoginPolicySecondFactorAddedEventType
+	LoginPolicySecondFactorRemovedEventType = instanceEventTypePrefix + policy.LoginPolicySecondFactorRemovedEventType
+
+	LoginPolicyMultiFactorAddedEventType   = instanceEventTypePrefix + policy.LoginPolicyMultiFactorAddedEventType
+	LoginPolicyMultiFactorRemovedEventType = instanceEventTypePrefix + policy.LoginPolicyMultiFactorRemovedEventType
+)
+
+type LoginPolicySecondFactorAddedEvent struct {
+	policy.SecondFactorAddedEvent
+}
+
+func NewLoginPolicySecondFactorAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	mfaType domain.SecondFactorType,
+) *LoginPolicySecondFactorAddedEvent {
+	return &LoginPolicySecondFactorAddedEvent{
+		SecondFactorAddedEvent: *policy.NewSecondFactorAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LoginPolicySecondFactorAddedEventType),
+			mfaType),
+	}
+}
+
+func SecondFactorAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.SecondFactorAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LoginPolicySecondFactorAddedEvent{
+		SecondFactorAddedEvent: *e.(*policy.SecondFactorAddedEvent),
+	}, nil
+}
+
+type LoginPolicySecondFactorRemovedEvent struct {
+	policy.SecondFactorRemovedEvent
+}
+
+func NewLoginPolicySecondFactorRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	mfaType domain.SecondFactorType,
+) *LoginPolicySecondFactorRemovedEvent {
+
+	return &LoginPolicySecondFactorRemovedEvent{
+		SecondFactorRemovedEvent: *policy.NewSecondFactorRemovedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LoginPolicySecondFactorRemovedEventType),
+			mfaType),
+	}
+}
+
+func SecondFactorRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.SecondFactorRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LoginPolicySecondFactorRemovedEvent{
+		SecondFactorRemovedEvent: *e.(*policy.SecondFactorRemovedEvent),
+	}, nil
+}
+
+type LoginPolicyMultiFactorAddedEvent struct {
+	policy.MultiFactorAddedEvent
+}
+
+func NewLoginPolicyMultiFactorAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	mfaType domain.MultiFactorType,
+) *LoginPolicyMultiFactorAddedEvent {
+	return &LoginPolicyMultiFactorAddedEvent{
+		MultiFactorAddedEvent: *policy.NewMultiFactorAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LoginPolicyMultiFactorAddedEventType),
+			mfaType),
+	}
+}
+
+func MultiFactorAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.MultiFactorAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LoginPolicyMultiFactorAddedEvent{
+		MultiFactorAddedEvent: *e.(*policy.MultiFactorAddedEvent),
+	}, nil
+}
+
+type LoginPolicyMultiFactorRemovedEvent struct {
+	policy.MultiFactorRemovedEvent
+}
+
+func NewLoginPolicyMultiFactorRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	mfaType domain.MultiFactorType,
+) *LoginPolicyMultiFactorRemovedEvent {
+
+	return &LoginPolicyMultiFactorRemovedEvent{
+		MultiFactorRemovedEvent: *policy.NewMultiFactorRemovedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LoginPolicyMultiFactorRemovedEventType),
+			mfaType),
+	}
+}
+
+func MultiFactorRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.MultiFactorRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LoginPolicyMultiFactorRemovedEvent{
+		MultiFactorRemovedEvent: *e.(*policy.MultiFactorRemovedEvent),
+	}, nil
+}

apps/api/internal/repository/instance/policy_login_identity_provider.go

@@ -0,0 +1,104 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/policy"
+)
+
+var (
+	LoginPolicyIDPProviderAddedEventType          = instanceEventTypePrefix + policy.LoginPolicyIDPProviderAddedType
+	LoginPolicyIDPProviderRemovedEventType        = instanceEventTypePrefix + policy.LoginPolicyIDPProviderRemovedType
+	LoginPolicyIDPProviderCascadeRemovedEventType = instanceEventTypePrefix + policy.LoginPolicyIDPProviderCascadeRemovedType
+)
+
+type IdentityProviderAddedEvent struct {
+	policy.IdentityProviderAddedEvent
+}
+
+func NewIdentityProviderAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	idpConfigID string,
+) *IdentityProviderAddedEvent {
+
+	return &IdentityProviderAddedEvent{
+		IdentityProviderAddedEvent: *policy.NewIdentityProviderAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LoginPolicyIDPProviderAddedEventType),
+			idpConfigID,
+			domain.IdentityProviderTypeSystem),
+	}
+}
+
+func IdentityProviderAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.IdentityProviderAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &IdentityProviderAddedEvent{
+		IdentityProviderAddedEvent: *e.(*policy.IdentityProviderAddedEvent),
+	}, nil
+}
+
+type IdentityProviderRemovedEvent struct {
+	policy.IdentityProviderRemovedEvent
+}
+
+func NewIdentityProviderRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	idpConfigID string,
+) *IdentityProviderRemovedEvent {
+	return &IdentityProviderRemovedEvent{
+		IdentityProviderRemovedEvent: *policy.NewIdentityProviderRemovedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LoginPolicyIDPProviderRemovedEventType),
+			idpConfigID),
+	}
+}
+
+func IdentityProviderRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.IdentityProviderRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &IdentityProviderRemovedEvent{
+		IdentityProviderRemovedEvent: *e.(*policy.IdentityProviderRemovedEvent),
+	}, nil
+}
+
+type IdentityProviderCascadeRemovedEvent struct {
+	policy.IdentityProviderCascadeRemovedEvent
+}
+
+func NewIdentityProviderCascadeRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	idpConfigID string,
+) *IdentityProviderCascadeRemovedEvent {
+	return &IdentityProviderCascadeRemovedEvent{
+		IdentityProviderCascadeRemovedEvent: *policy.NewIdentityProviderCascadeRemovedEvent(
+			eventstore.NewBaseEventForPush(ctx, aggregate, LoginPolicyIDPProviderCascadeRemovedEventType),
+			idpConfigID),
+	}
+}
+
+func IdentityProviderCascadeRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.IdentityProviderCascadeRemovedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &IdentityProviderCascadeRemovedEvent{
+		IdentityProviderCascadeRemovedEvent: *e.(*policy.IdentityProviderCascadeRemovedEvent),
+	}, nil
+}

apps/api/internal/repository/instance/policy_mail_template.go

@@ -0,0 +1,66 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/policy"
+)
+
+var (
+	MailTemplateAddedEventType   = instanceEventTypePrefix + policy.MailTemplatePolicyAddedEventType
+	MailTemplateChangedEventType = instanceEventTypePrefix + policy.MailTemplatePolicyChangedEventType
+)
+
+type MailTemplateAddedEvent struct {
+	policy.MailTemplateAddedEvent
+}
+
+func NewMailTemplateAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	template []byte,
+) *MailTemplateAddedEvent {
+	return &MailTemplateAddedEvent{
+		MailTemplateAddedEvent: *policy.NewMailTemplateAddedEvent(
+			eventstore.NewBaseEventForPush(ctx, aggregate, MailTemplateAddedEventType),
+			template),
+	}
+}
+
+func MailTemplateAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.MailTemplateAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &MailTemplateAddedEvent{MailTemplateAddedEvent: *e.(*policy.MailTemplateAddedEvent)}, nil
+}
+
+type MailTemplateChangedEvent struct {
+	policy.MailTemplateChangedEvent
+}
+
+func NewMailTemplateChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	changes []policy.MailTemplateChanges,
+) (*MailTemplateChangedEvent, error) {
+	changedEvent, err := policy.NewMailTemplateChangedEvent(
+		eventstore.NewBaseEventForPush(ctx, aggregate, MailTemplateChangedEventType),
+		changes,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &MailTemplateChangedEvent{MailTemplateChangedEvent: *changedEvent}, nil
+}
+
+func MailTemplateChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.MailTemplateChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &MailTemplateChangedEvent{MailTemplateChangedEvent: *e.(*policy.MailTemplateChangedEvent)}, nil
+}

apps/api/internal/repository/instance/policy_mail_text.go

@@ -0,0 +1,84 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/policy"
+)
+
+var (
+	MailTextAddedEventType   = instanceEventTypePrefix + policy.MailTextPolicyAddedEventType
+	MailTextChangedEventType = instanceEventTypePrefix + policy.MailTextPolicyChangedEventType
+)
+
+type MailTextAddedEvent struct {
+	policy.MailTextAddedEvent
+}
+
+func NewMailTextAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	mailTextType,
+	language,
+	title,
+	preHeader,
+	subject,
+	greeting,
+	text,
+	buttonText string,
+) *MailTextAddedEvent {
+	return &MailTextAddedEvent{
+		MailTextAddedEvent: *policy.NewMailTextAddedEvent(
+			eventstore.NewBaseEventForPush(ctx, aggregate, MailTextAddedEventType),
+			mailTextType,
+			language,
+			title,
+			preHeader,
+			subject,
+			greeting,
+			text,
+			buttonText),
+	}
+}
+
+func MailTextAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.MailTextAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &MailTextAddedEvent{MailTextAddedEvent: *e.(*policy.MailTextAddedEvent)}, nil
+}
+
+type MailTextChangedEvent struct {
+	policy.MailTextChangedEvent
+}
+
+func NewMailTextChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	mailTextType,
+	language string,
+	changes []policy.MailTextChanges,
+) (*MailTextChangedEvent, error) {
+	changedEvent, err := policy.NewMailTextChangedEvent(
+		eventstore.NewBaseEventForPush(ctx, aggregate, MailTextChangedEventType),
+		mailTextType,
+		language,
+		changes,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &MailTextChangedEvent{MailTextChangedEvent: *changedEvent}, nil
+}
+
+func MailTextChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.MailTextChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &MailTextChangedEvent{MailTextChangedEvent: *e.(*policy.MailTextChangedEvent)}, nil
+}

apps/api/internal/repository/instance/policy_notification.go

@@ -0,0 +1,72 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/policy"
+)
+
+const (
+	NotificationPolicyAddedEventType   = instanceEventTypePrefix + policy.NotificationPolicyAddedEventType
+	NotificationPolicyChangedEventType = instanceEventTypePrefix + policy.NotificationPolicyChangedEventType
+)
+
+type NotificationPolicyAddedEvent struct {
+	policy.NotificationPolicyAddedEvent
+}
+
+func NewNotificationPolicyAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	passwordChange bool,
+) *NotificationPolicyAddedEvent {
+	return &NotificationPolicyAddedEvent{
+		NotificationPolicyAddedEvent: *policy.NewNotificationPolicyAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				NotificationPolicyAddedEventType),
+			passwordChange),
+	}
+}
+
+func NotificationPolicyAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.NotificationPolicyAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &NotificationPolicyAddedEvent{NotificationPolicyAddedEvent: *e.(*policy.NotificationPolicyAddedEvent)}, nil
+}
+
+type NotificationPolicyChangedEvent struct {
+	policy.NotificationPolicyChangedEvent
+}
+
+func NewNotificationPolicyChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	changes []policy.NotificationPolicyChanges,
+) (*NotificationPolicyChangedEvent, error) {
+	changedEvent, err := policy.NewNotificationPolicyChangedEvent(
+		eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			NotificationPolicyChangedEventType),
+		changes,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &NotificationPolicyChangedEvent{NotificationPolicyChangedEvent: *changedEvent}, nil
+}
+
+func NotificationPolicyChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.NotificationPolicyChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &NotificationPolicyChangedEvent{NotificationPolicyChangedEvent: *e.(*policy.NotificationPolicyChangedEvent)}, nil
+}

apps/api/internal/repository/instance/policy_password_age.go

@@ -0,0 +1,74 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/policy"
+)
+
+var (
+	PasswordAgePolicyAddedEventType   = instanceEventTypePrefix + policy.PasswordAgePolicyAddedEventType
+	PasswordAgePolicyChangedEventType = instanceEventTypePrefix + policy.PasswordAgePolicyChangedEventType
+)
+
+type PasswordAgePolicyAddedEvent struct {
+	policy.PasswordAgePolicyAddedEvent
+}
+
+func NewPasswordAgePolicyAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	expireWarnDays,
+	maxAgeDays uint64,
+) *PasswordAgePolicyAddedEvent {
+	return &PasswordAgePolicyAddedEvent{
+		PasswordAgePolicyAddedEvent: *policy.NewPasswordAgePolicyAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				PasswordAgePolicyAddedEventType),
+			expireWarnDays,
+			maxAgeDays),
+	}
+}
+
+func PasswordAgePolicyAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.PasswordAgePolicyAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &PasswordAgePolicyAddedEvent{PasswordAgePolicyAddedEvent: *e.(*policy.PasswordAgePolicyAddedEvent)}, nil
+}
+
+type PasswordAgePolicyChangedEvent struct {
+	policy.PasswordAgePolicyChangedEvent
+}
+
+func NewPasswordAgePolicyChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	changes []policy.PasswordAgePolicyChanges,
+) (*PasswordAgePolicyChangedEvent, error) {
+	changedEvent, err := policy.NewPasswordAgePolicyChangedEvent(
+		eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			PasswordAgePolicyChangedEventType),
+		changes,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &PasswordAgePolicyChangedEvent{PasswordAgePolicyChangedEvent: *changedEvent}, nil
+}
+
+func PasswordAgePolicyChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.PasswordAgePolicyChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &PasswordAgePolicyChangedEvent{PasswordAgePolicyChangedEvent: *e.(*policy.PasswordAgePolicyChangedEvent)}, nil
+}

apps/api/internal/repository/instance/policy_password_complexity.go

@@ -0,0 +1,80 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/policy"
+)
+
+const (
+	PasswordComplexityPolicyAddedEventType   = instanceEventTypePrefix + policy.PasswordComplexityPolicyAddedEventType
+	PasswordComplexityPolicyChangedEventType = instanceEventTypePrefix + policy.PasswordComplexityPolicyChangedEventType
+)
+
+type PasswordComplexityPolicyAddedEvent struct {
+	policy.PasswordComplexityPolicyAddedEvent
+}
+
+func NewPasswordComplexityPolicyAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	minLength uint64,
+	hasLowercase,
+	hasUppercase,
+	hasNumber,
+	hasSymbol bool,
+) *PasswordComplexityPolicyAddedEvent {
+	return &PasswordComplexityPolicyAddedEvent{
+		PasswordComplexityPolicyAddedEvent: *policy.NewPasswordComplexityPolicyAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				PasswordComplexityPolicyAddedEventType),
+			minLength,
+			hasLowercase,
+			hasUppercase,
+			hasNumber,
+			hasSymbol),
+	}
+}
+
+func PasswordComplexityPolicyAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.PasswordComplexityPolicyAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &PasswordComplexityPolicyAddedEvent{PasswordComplexityPolicyAddedEvent: *e.(*policy.PasswordComplexityPolicyAddedEvent)}, nil
+}
+
+type PasswordComplexityPolicyChangedEvent struct {
+	policy.PasswordComplexityPolicyChangedEvent
+}
+
+func NewPasswordComplexityPolicyChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	changes []policy.PasswordComplexityPolicyChanges,
+) (*PasswordComplexityPolicyChangedEvent, error) {
+	changedEvent, err := policy.NewPasswordComplexityPolicyChangedEvent(
+		eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			PasswordComplexityPolicyChangedEventType),
+		changes,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &PasswordComplexityPolicyChangedEvent{PasswordComplexityPolicyChangedEvent: *changedEvent}, nil
+}
+
+func PasswordComplexityPolicyChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.PasswordComplexityPolicyChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &PasswordComplexityPolicyChangedEvent{PasswordComplexityPolicyChangedEvent: *e.(*policy.PasswordComplexityPolicyChangedEvent)}, nil
+}

apps/api/internal/repository/instance/policy_password_lockout.go

@@ -0,0 +1,76 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/policy"
+)
+
+var (
+	LockoutPolicyAddedEventType   = instanceEventTypePrefix + policy.LockoutPolicyAddedEventType
+	LockoutPolicyChangedEventType = instanceEventTypePrefix + policy.LockoutPolicyChangedEventType
+)
+
+type LockoutPolicyAddedEvent struct {
+	policy.LockoutPolicyAddedEvent
+}
+
+func NewLockoutPolicyAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	maxPasswordAttempts,
+	maxOTPAttempts uint64,
+	showLockoutFailure bool,
+) *LockoutPolicyAddedEvent {
+	return &LockoutPolicyAddedEvent{
+		LockoutPolicyAddedEvent: *policy.NewLockoutPolicyAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				LockoutPolicyAddedEventType),
+			maxPasswordAttempts,
+			maxOTPAttempts,
+			showLockoutFailure),
+	}
+}
+
+func LockoutPolicyAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LockoutPolicyAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LockoutPolicyAddedEvent{LockoutPolicyAddedEvent: *e.(*policy.LockoutPolicyAddedEvent)}, nil
+}
+
+type LockoutPolicyChangedEvent struct {
+	policy.LockoutPolicyChangedEvent
+}
+
+func NewLockoutPolicyChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	changes []policy.LockoutPolicyChanges,
+) (*LockoutPolicyChangedEvent, error) {
+	changedEvent, err := policy.NewLockoutPolicyChangedEvent(
+		eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			LockoutPolicyChangedEventType),
+		changes,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &LockoutPolicyChangedEvent{LockoutPolicyChangedEvent: *changedEvent}, nil
+}
+
+func LockoutPolicyChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.LockoutPolicyChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &LockoutPolicyChangedEvent{LockoutPolicyChangedEvent: *e.(*policy.LockoutPolicyChangedEvent)}, nil
+}

apps/api/internal/repository/instance/policy_privacy.go

@@ -0,0 +1,83 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/repository/policy"
+)
+
+const (
+	PrivacyPolicyAddedEventType   = instanceEventTypePrefix + policy.PrivacyPolicyAddedEventType
+	PrivacyPolicyChangedEventType = instanceEventTypePrefix + policy.PrivacyPolicyChangedEventType
+)
+
+type PrivacyPolicyAddedEvent struct {
+	policy.PrivacyPolicyAddedEvent
+}
+
+func NewPrivacyPolicyAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	tosLink,
+	privacyLink,
+	helpLink string,
+	supportEmail domain.EmailAddress,
+	docsLink, customLink, customLinkText string,
+) *PrivacyPolicyAddedEvent {
+	return &PrivacyPolicyAddedEvent{
+		PrivacyPolicyAddedEvent: *policy.NewPrivacyPolicyAddedEvent(
+			eventstore.NewBaseEventForPush(
+				ctx,
+				aggregate,
+				PrivacyPolicyAddedEventType),
+			tosLink,
+			privacyLink,
+			helpLink,
+			supportEmail,
+			docsLink,
+			customLink,
+			customLinkText),
+	}
+}
+
+func PrivacyPolicyAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.PrivacyPolicyAddedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &PrivacyPolicyAddedEvent{PrivacyPolicyAddedEvent: *e.(*policy.PrivacyPolicyAddedEvent)}, nil
+}
+
+type PrivacyPolicyChangedEvent struct {
+	policy.PrivacyPolicyChangedEvent
+}
+
+func NewPrivacyPolicyChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	changes []policy.PrivacyPolicyChanges,
+) (*PrivacyPolicyChangedEvent, error) {
+	changedEvent, err := policy.NewPrivacyPolicyChangedEvent(
+		eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			PrivacyPolicyChangedEventType),
+		changes,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &PrivacyPolicyChangedEvent{PrivacyPolicyChangedEvent: *changedEvent}, nil
+}
+
+func PrivacyPolicyChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e, err := policy.PrivacyPolicyChangedEventMapper(event)
+	if err != nil {
+		return nil, err
+	}
+
+	return &PrivacyPolicyChangedEvent{PrivacyPolicyChangedEvent: *e.(*policy.PrivacyPolicyChangedEvent)}, nil
+}

apps/api/internal/repository/instance/policy_security.go

@@ -0,0 +1,88 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	securityPolicyPrefix       = "policy.security."
+	SecurityPolicySetEventType = instanceEventTypePrefix + securityPolicyPrefix + "set"
+)
+
+type SecurityPolicySetEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	// Enabled is a legacy field which was used before for Iframe Embedding.
+	// It is kept so older events can still be reduced.
+	Enabled               *bool     `json:"enabled,omitempty"`
+	EnableIframeEmbedding *bool     `json:"enable_iframe_embedding,omitempty"`
+	AllowedOrigins        *[]string `json:"allowedOrigins,omitempty"`
+	EnableImpersonation   *bool     `json:"enable_impersonation,omitempty"`
+}
+
+func NewSecurityPolicySetEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	changes []SecurityPolicyChanges,
+) (*SecurityPolicySetEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "POLICY-EWsf3", "Errors.NoChangesFound")
+	}
+	event := &SecurityPolicySetEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SecurityPolicySetEventType,
+		),
+	}
+	for _, change := range changes {
+		change(event)
+	}
+	return event, nil
+}
+
+type SecurityPolicyChanges func(event *SecurityPolicySetEvent)
+
+func ChangeSecurityPolicyEnableIframeEmbedding(enabled bool) func(event *SecurityPolicySetEvent) {
+	return func(e *SecurityPolicySetEvent) {
+		e.EnableIframeEmbedding = &enabled
+	}
+}
+
+func ChangeSecurityPolicyAllowedOrigins(allowedOrigins []string) func(event *SecurityPolicySetEvent) {
+	return func(e *SecurityPolicySetEvent) {
+		if len(allowedOrigins) == 0 {
+			allowedOrigins = []string{}
+		}
+		e.AllowedOrigins = &allowedOrigins
+	}
+}
+
+func ChangeSecurityPolicyEnableImpersonation(enabled bool) func(event *SecurityPolicySetEvent) {
+	return func(e *SecurityPolicySetEvent) {
+		e.EnableImpersonation = &enabled
+	}
+}
+
+func (e *SecurityPolicySetEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SecurityPolicySetEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func SecurityPolicySetEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	securityPolicyAdded := &SecurityPolicySetEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(securityPolicyAdded)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IAM-soiwj", "unable to unmarshal oidc config added")
+	}
+
+	return securityPolicyAdded, nil
+}

apps/api/internal/repository/instance/secret_generator.go

@@ -0,0 +1,226 @@
+package instance
+
+import (
+	"context"
+	"time"
+
+	"github.com/zitadel/zitadel/internal/domain"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	UniqueSecretGeneratorType       = "secret_generator"
+	secretGeneratorPrefix           = "secret.generator."
+	SecretGeneratorAddedEventType   = instanceEventTypePrefix + secretGeneratorPrefix + "added"
+	SecretGeneratorChangedEventType = instanceEventTypePrefix + secretGeneratorPrefix + "changed"
+	SecretGeneratorRemovedEventType = instanceEventTypePrefix + secretGeneratorPrefix + "removed"
+)
+
+func NewAddSecretGeneratorTypeUniqueConstraint(generatorType domain.SecretGeneratorType) *eventstore.UniqueConstraint {
+	return eventstore.NewAddEventUniqueConstraint(
+		UniqueSecretGeneratorType,
+		string(generatorType),
+		"Errors.SecretGenerator.AlreadyExists")
+}
+
+func NewRemoveSecretGeneratorTypeUniqueConstraint(generatorType domain.SecretGeneratorType) *eventstore.UniqueConstraint {
+	return eventstore.NewRemoveUniqueConstraint(
+		UniqueSecretGeneratorType,
+		string(generatorType))
+}
+
+type SecretGeneratorAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	GeneratorType       domain.SecretGeneratorType `json:"generatorType"`
+	Length              uint                       `json:"length,omitempty"`
+	Expiry              time.Duration              `json:"expiry,omitempty"`
+	IncludeLowerLetters bool                       `json:"includeLowerLetters,omitempty"`
+	IncludeUpperLetters bool                       `json:"includeUpperLetters,omitempty"`
+	IncludeDigits       bool                       `json:"includeDigits,omitempty"`
+	IncludeSymbols      bool                       `json:"includeSymbols,omitempty"`
+}
+
+func NewSecretGeneratorAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	generatorType domain.SecretGeneratorType,
+	length uint,
+	expiry time.Duration,
+	includeLowerLetters,
+	includeUpperLetters,
+	includeDigits,
+	includeSymbols bool,
+) *SecretGeneratorAddedEvent {
+	return &SecretGeneratorAddedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SecretGeneratorAddedEventType,
+		),
+		GeneratorType:       generatorType,
+		Length:              length,
+		Expiry:              expiry,
+		IncludeLowerLetters: includeLowerLetters,
+		IncludeUpperLetters: includeUpperLetters,
+		IncludeDigits:       includeDigits,
+		IncludeSymbols:      includeSymbols,
+	}
+}
+
+func (e *SecretGeneratorAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SecretGeneratorAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return []*eventstore.UniqueConstraint{NewAddSecretGeneratorTypeUniqueConstraint(e.GeneratorType)}
+}
+
+func SecretGeneratorAddedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	secretGeneratorAdded := &SecretGeneratorAddedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+	err := event.Unmarshal(secretGeneratorAdded)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IAM-en9f4", "unable to unmarshal secret generator added")
+	}
+
+	return secretGeneratorAdded, nil
+}
+
+type SecretGeneratorChangedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	GeneratorType       domain.SecretGeneratorType `json:"generatorType"`
+	Length              *uint                      `json:"length,omitempty"`
+	Expiry              *time.Duration             `json:"expiry,omitempty"`
+	IncludeLowerLetters *bool                      `json:"includeLowerLetters,omitempty"`
+	IncludeUpperLetters *bool                      `json:"includeUpperLetters,omitempty"`
+	IncludeDigits       *bool                      `json:"includeDigits,omitempty"`
+	IncludeSymbols      *bool                      `json:"includeSymbols,omitempty"`
+}
+
+func (e *SecretGeneratorChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SecretGeneratorChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewSecretGeneratorChangeEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	generatorType domain.SecretGeneratorType,
+	changes []SecretGeneratorChanges,
+) (*SecretGeneratorChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IAM-j2jfw", "Errors.NoChangesFound")
+	}
+	changeEvent := &SecretGeneratorChangedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SecretGeneratorChangedEventType,
+		),
+		GeneratorType: generatorType,
+	}
+	for _, change := range changes {
+		change(changeEvent)
+	}
+	return changeEvent, nil
+}
+
+type SecretGeneratorChanges func(event *SecretGeneratorChangedEvent)
+
+func ChangeSecretGeneratorLength(length uint) func(event *SecretGeneratorChangedEvent) {
+	return func(e *SecretGeneratorChangedEvent) {
+		e.Length = &length
+	}
+}
+
+func ChangeSecretGeneratorExpiry(expiry time.Duration) func(event *SecretGeneratorChangedEvent) {
+	return func(e *SecretGeneratorChangedEvent) {
+		e.Expiry = &expiry
+	}
+}
+
+func ChangeSecretGeneratorIncludeLowerLetters(includeLowerLetters bool) func(event *SecretGeneratorChangedEvent) {
+	return func(e *SecretGeneratorChangedEvent) {
+		e.IncludeLowerLetters = &includeLowerLetters
+	}
+}
+
+func ChangeSecretGeneratorIncludeUpperLetters(includeUpperLetters bool) func(event *SecretGeneratorChangedEvent) {
+	return func(e *SecretGeneratorChangedEvent) {
+		e.IncludeUpperLetters = &includeUpperLetters
+	}
+}
+
+func ChangeSecretGeneratorIncludeDigits(includeDigits bool) func(event *SecretGeneratorChangedEvent) {
+	return func(e *SecretGeneratorChangedEvent) {
+		e.IncludeDigits = &includeDigits
+	}
+}
+
+func ChangeSecretGeneratorIncludeSymbols(includeSymbols bool) func(event *SecretGeneratorChangedEvent) {
+	return func(e *SecretGeneratorChangedEvent) {
+		e.IncludeSymbols = &includeSymbols
+	}
+}
+
+func SecretGeneratorChangedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &SecretGeneratorChangedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IAM-2m09e", "unable to unmarshal secret generator changed")
+	}
+
+	return e, nil
+}
+
+type SecretGeneratorRemovedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	GeneratorType domain.SecretGeneratorType `json:"generatorType"`
+}
+
+func (e *SecretGeneratorRemovedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SecretGeneratorRemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return []*eventstore.UniqueConstraint{NewRemoveSecretGeneratorTypeUniqueConstraint(e.GeneratorType)}
+}
+
+func NewSecretGeneratorRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	generatorType domain.SecretGeneratorType,
+) *SecretGeneratorRemovedEvent {
+	return &SecretGeneratorRemovedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SecretGeneratorRemovedEventType,
+		),
+		GeneratorType: generatorType,
+	}
+}
+
+func SecretGeneratorRemovedEventMapper(event eventstore.Event) (eventstore.Event, error) {
+	e := &SecretGeneratorRemovedEvent{
+		BaseEvent: *eventstore.BaseEventFromRepo(event),
+	}
+
+	err := event.Unmarshal(e)
+	if err != nil {
+		return nil, zerrors.ThrowInternal(err, "IAM-m09ke", "unable to unmarshal secret generator removed")
+	}
+
+	return e, nil
+}

apps/api/internal/repository/instance/sms.go

@@ -0,0 +1,423 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	smsConfigPrefix                      = "sms.config"
+	smsConfigTwilioPrefix                = "twilio."
+	smsConfigHTTPPrefix                  = "http."
+	SMSConfigTwilioAddedEventType        = instanceEventTypePrefix + smsConfigPrefix + smsConfigTwilioPrefix + "added"
+	SMSConfigTwilioChangedEventType      = instanceEventTypePrefix + smsConfigPrefix + smsConfigTwilioPrefix + "changed"
+	SMSConfigHTTPAddedEventType          = instanceEventTypePrefix + smsConfigPrefix + smsConfigHTTPPrefix + "added"
+	SMSConfigHTTPChangedEventType        = instanceEventTypePrefix + smsConfigPrefix + smsConfigHTTPPrefix + "changed"
+	SMSConfigTwilioTokenChangedEventType = instanceEventTypePrefix + smsConfigPrefix + smsConfigTwilioPrefix + "token.changed"
+	SMSConfigTwilioActivatedEventType    = instanceEventTypePrefix + smsConfigPrefix + smsConfigTwilioPrefix + "activated"
+	SMSConfigTwilioDeactivatedEventType  = instanceEventTypePrefix + smsConfigPrefix + smsConfigTwilioPrefix + "deactivated"
+	SMSConfigTwilioRemovedEventType      = instanceEventTypePrefix + smsConfigPrefix + smsConfigTwilioPrefix + "removed"
+	SMSConfigActivatedEventType          = instanceEventTypePrefix + smsConfigPrefix + "activated"
+	SMSConfigDeactivatedEventType        = instanceEventTypePrefix + smsConfigPrefix + "deactivated"
+	SMSConfigRemovedEventType            = instanceEventTypePrefix + smsConfigPrefix + "removed"
+)
+
+type SMSConfigTwilioAddedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+
+	ID               string              `json:"id,omitempty"`
+	Description      string              `json:"description,omitempty"`
+	SID              string              `json:"sid,omitempty"`
+	Token            *crypto.CryptoValue `json:"token,omitempty"`
+	SenderNumber     string              `json:"senderNumber,omitempty"`
+	VerifyServiceSID string              `json:"verifyServiceSid,omitempty"`
+}
+
+func NewSMSConfigTwilioAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id,
+	description string,
+	sid,
+	senderNumber string,
+	token *crypto.CryptoValue,
+	verifyServiceSid string,
+) *SMSConfigTwilioAddedEvent {
+	return &SMSConfigTwilioAddedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMSConfigTwilioAddedEventType,
+		),
+		ID:               id,
+		Description:      description,
+		SID:              sid,
+		Token:            token,
+		SenderNumber:     senderNumber,
+		VerifyServiceSID: verifyServiceSid,
+	}
+}
+
+func (e *SMSConfigTwilioAddedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMSConfigTwilioAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMSConfigTwilioAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SMSConfigTwilioChangedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+
+	ID               string  `json:"id,omitempty"`
+	Description      *string `json:"description,omitempty"`
+	SID              *string `json:"sid,omitempty"`
+	SenderNumber     *string `json:"senderNumber,omitempty"`
+	VerifyServiceSID *string `json:"verifyServiceSid,omitempty"`
+}
+
+func NewSMSConfigTwilioChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id string,
+	changes []SMSConfigTwilioChanges,
+) (*SMSConfigTwilioChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IAM-smn8e", "Errors.NoChangesFound")
+	}
+	changeEvent := &SMSConfigTwilioChangedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMSConfigTwilioChangedEventType,
+		),
+		ID: id,
+	}
+	for _, change := range changes {
+		change(changeEvent)
+	}
+	return changeEvent, nil
+}
+
+type SMSConfigTwilioChanges func(event *SMSConfigTwilioChangedEvent)
+
+func ChangeSMSConfigTwilioSID(sid string) func(event *SMSConfigTwilioChangedEvent) {
+	return func(e *SMSConfigTwilioChangedEvent) {
+		e.SID = &sid
+	}
+}
+
+func ChangeSMSConfigTwilioDescription(description string) func(event *SMSConfigTwilioChangedEvent) {
+	return func(e *SMSConfigTwilioChangedEvent) {
+		e.Description = &description
+	}
+}
+
+func ChangeSMSConfigTwilioSenderNumber(senderNumber string) func(event *SMSConfigTwilioChangedEvent) {
+	return func(e *SMSConfigTwilioChangedEvent) {
+		e.SenderNumber = &senderNumber
+	}
+}
+
+func ChangeSMSConfigTwilioVerifyServiceSID(verifyServiceSID string) func(event *SMSConfigTwilioChangedEvent) {
+	return func(e *SMSConfigTwilioChangedEvent) {
+		e.VerifyServiceSID = &verifyServiceSID
+	}
+}
+
+func (e *SMSConfigTwilioChangedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMSConfigTwilioChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMSConfigTwilioChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SMSConfigTwilioTokenChangedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+
+	ID    string              `json:"id,omitempty"`
+	Token *crypto.CryptoValue `json:"token,omitempty"`
+}
+
+func NewSMSConfigTokenChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id string,
+	token *crypto.CryptoValue,
+) *SMSConfigTwilioTokenChangedEvent {
+	return &SMSConfigTwilioTokenChangedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMSConfigTwilioTokenChangedEventType,
+		),
+		ID:    id,
+		Token: token,
+	}
+}
+
+func (e *SMSConfigTwilioTokenChangedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMSConfigTwilioTokenChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMSConfigTwilioTokenChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SMSConfigHTTPAddedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+
+	ID          string `json:"id,omitempty"`
+	Description string `json:"description,omitempty"`
+	Endpoint    string `json:"endpoint,omitempty"`
+}
+
+func NewSMSConfigHTTPAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id,
+	description,
+	endpoint string,
+) *SMSConfigHTTPAddedEvent {
+	return &SMSConfigHTTPAddedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMSConfigHTTPAddedEventType,
+		),
+		ID:          id,
+		Description: description,
+		Endpoint:    endpoint,
+	}
+}
+
+func (e *SMSConfigHTTPAddedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMSConfigHTTPAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMSConfigHTTPAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SMSConfigHTTPChangedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+
+	ID          string  `json:"id,omitempty"`
+	Description *string `json:"description,omitempty"`
+	Endpoint    *string `json:"endpoint,omitempty"`
+}
+
+func NewSMSConfigHTTPChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id string,
+	changes []SMSConfigHTTPChanges,
+) (*SMSConfigHTTPChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IAM-smn8e", "Errors.NoChangesFound")
+	}
+	changeEvent := &SMSConfigHTTPChangedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMSConfigHTTPChangedEventType,
+		),
+		ID: id,
+	}
+	for _, change := range changes {
+		change(changeEvent)
+	}
+	return changeEvent, nil
+}
+
+type SMSConfigHTTPChanges func(event *SMSConfigHTTPChangedEvent)
+
+func ChangeSMSConfigHTTPDescription(description string) func(event *SMSConfigHTTPChangedEvent) {
+	return func(e *SMSConfigHTTPChangedEvent) {
+		e.Description = &description
+	}
+}
+func ChangeSMSConfigHTTPEndpoint(endpoint string) func(event *SMSConfigHTTPChangedEvent) {
+	return func(e *SMSConfigHTTPChangedEvent) {
+		e.Endpoint = &endpoint
+	}
+}
+
+func (e *SMSConfigHTTPChangedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMSConfigHTTPChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMSConfigHTTPChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SMSConfigTwilioActivatedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+	ID                    string `json:"id,omitempty"`
+}
+
+func (e *SMSConfigTwilioActivatedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMSConfigTwilioActivatedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMSConfigTwilioActivatedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SMSConfigActivatedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+	ID                    string `json:"id,omitempty"`
+}
+
+func NewSMSConfigActivatedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id string,
+) *SMSConfigActivatedEvent {
+	return &SMSConfigActivatedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMSConfigActivatedEventType,
+		),
+		ID: id,
+	}
+}
+
+func (e *SMSConfigActivatedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMSConfigActivatedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMSConfigActivatedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SMSConfigTwilioDeactivatedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+	ID                    string `json:"id,omitempty"`
+}
+
+func (e *SMSConfigTwilioDeactivatedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMSConfigTwilioDeactivatedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMSConfigTwilioDeactivatedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SMSConfigDeactivatedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+	ID                    string `json:"id,omitempty"`
+}
+
+func NewSMSConfigDeactivatedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id string,
+) *SMSConfigDeactivatedEvent {
+	return &SMSConfigDeactivatedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMSConfigDeactivatedEventType,
+		),
+		ID: id,
+	}
+}
+
+func (e *SMSConfigDeactivatedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMSConfigDeactivatedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMSConfigDeactivatedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SMSConfigTwilioRemovedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+	ID                    string `json:"id,omitempty"`
+}
+
+func (e *SMSConfigTwilioRemovedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMSConfigTwilioRemovedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMSConfigTwilioRemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SMSConfigRemovedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+	ID                    string `json:"id,omitempty"`
+}
+
+func NewSMSConfigRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id string,
+) *SMSConfigRemovedEvent {
+	return &SMSConfigRemovedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMSConfigRemovedEventType,
+		),
+		ID: id,
+	}
+}
+
+func (e *SMSConfigRemovedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMSConfigRemovedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMSConfigRemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}

apps/api/internal/repository/instance/smtp_config.go

@@ -0,0 +1,410 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/crypto"
+	"github.com/zitadel/zitadel/internal/eventstore"
+	"github.com/zitadel/zitadel/internal/zerrors"
+)
+
+const (
+	smtpConfigPrefix                   = "smtp.config."
+	httpConfigPrefix                   = "http."
+	SMTPConfigAddedEventType           = instanceEventTypePrefix + smtpConfigPrefix + "added"
+	SMTPConfigChangedEventType         = instanceEventTypePrefix + smtpConfigPrefix + "changed"
+	SMTPConfigPasswordChangedEventType = instanceEventTypePrefix + smtpConfigPrefix + "password.changed"
+	SMTPConfigHTTPAddedEventType       = instanceEventTypePrefix + smtpConfigPrefix + httpConfigPrefix + "added"
+	SMTPConfigHTTPChangedEventType     = instanceEventTypePrefix + smtpConfigPrefix + httpConfigPrefix + "changed"
+	SMTPConfigRemovedEventType         = instanceEventTypePrefix + smtpConfigPrefix + "removed"
+	SMTPConfigActivatedEventType       = instanceEventTypePrefix + smtpConfigPrefix + "activated"
+	SMTPConfigDeactivatedEventType     = instanceEventTypePrefix + smtpConfigPrefix + "deactivated"
+)
+
+type SMTPConfigAddedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+
+	ID             string              `json:"id,omitempty"`
+	Description    string              `json:"description,omitempty"`
+	SenderAddress  string              `json:"senderAddress,omitempty"`
+	SenderName     string              `json:"senderName,omitempty"`
+	ReplyToAddress string              `json:"replyToAddress,omitempty"`
+	TLS            bool                `json:"tls,omitempty"`
+	Host           string              `json:"host,omitempty"`
+	User           string              `json:"user,omitempty"`
+	Password       *crypto.CryptoValue `json:"password,omitempty"`
+}
+
+func NewSMTPConfigAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id, description string,
+	tls bool,
+	senderAddress,
+	senderName,
+	replyToAddress,
+	host,
+	user string,
+	password *crypto.CryptoValue,
+) *SMTPConfigAddedEvent {
+	return &SMTPConfigAddedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMTPConfigAddedEventType,
+		),
+		ID:             id,
+		Description:    description,
+		TLS:            tls,
+		SenderAddress:  senderAddress,
+		SenderName:     senderName,
+		ReplyToAddress: replyToAddress,
+		Host:           host,
+		User:           user,
+		Password:       password,
+	}
+}
+func (e *SMTPConfigAddedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMTPConfigAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMTPConfigAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SMTPConfigChangedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+	ID                    string              `json:"id,omitempty"`
+	Description           *string             `json:"description,omitempty"`
+	FromAddress           *string             `json:"senderAddress,omitempty"`
+	FromName              *string             `json:"senderName,omitempty"`
+	ReplyToAddress        *string             `json:"replyToAddress,omitempty"`
+	TLS                   *bool               `json:"tls,omitempty"`
+	Host                  *string             `json:"host,omitempty"`
+	User                  *string             `json:"user,omitempty"`
+	Password              *crypto.CryptoValue `json:"password,omitempty"`
+}
+
+func (e *SMTPConfigChangedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMTPConfigChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMTPConfigChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewSMTPConfigChangeEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id string,
+	changes []SMTPConfigChanges,
+) (*SMTPConfigChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IAM-o0pWf", "Errors.NoChangesFound")
+	}
+	changeEvent := &SMTPConfigChangedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMTPConfigChangedEventType,
+		),
+		ID: id,
+	}
+	for _, change := range changes {
+		change(changeEvent)
+	}
+	return changeEvent, nil
+}
+
+type SMTPConfigChanges func(event *SMTPConfigChangedEvent)
+
+func ChangeSMTPConfigID(id string) func(event *SMTPConfigChangedEvent) {
+	return func(e *SMTPConfigChangedEvent) {
+		e.ID = id
+	}
+}
+
+func ChangeSMTPConfigDescription(description string) func(event *SMTPConfigChangedEvent) {
+	return func(e *SMTPConfigChangedEvent) {
+		e.Description = &description
+	}
+}
+
+func ChangeSMTPConfigTLS(tls bool) func(event *SMTPConfigChangedEvent) {
+	return func(e *SMTPConfigChangedEvent) {
+		e.TLS = &tls
+	}
+}
+
+func ChangeSMTPConfigFromAddress(senderAddress string) func(event *SMTPConfigChangedEvent) {
+	return func(e *SMTPConfigChangedEvent) {
+		e.FromAddress = &senderAddress
+	}
+}
+
+func ChangeSMTPConfigFromName(senderName string) func(event *SMTPConfigChangedEvent) {
+	return func(e *SMTPConfigChangedEvent) {
+		e.FromName = &senderName
+	}
+}
+
+func ChangeSMTPConfigReplyToAddress(replyToAddress string) func(event *SMTPConfigChangedEvent) {
+	return func(e *SMTPConfigChangedEvent) {
+		e.ReplyToAddress = &replyToAddress
+	}
+}
+
+func ChangeSMTPConfigSMTPHost(smtpHost string) func(event *SMTPConfigChangedEvent) {
+	return func(e *SMTPConfigChangedEvent) {
+		e.Host = &smtpHost
+	}
+}
+
+func ChangeSMTPConfigSMTPUser(smtpUser string) func(event *SMTPConfigChangedEvent) {
+	return func(e *SMTPConfigChangedEvent) {
+		e.User = &smtpUser
+	}
+}
+
+func ChangeSMTPConfigSMTPPassword(password *crypto.CryptoValue) func(event *SMTPConfigChangedEvent) {
+	return func(e *SMTPConfigChangedEvent) {
+		e.Password = password
+	}
+}
+
+type SMTPConfigPasswordChangedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+	ID                    string              `json:"id,omitempty"`
+	Password              *crypto.CryptoValue `json:"password,omitempty"`
+}
+
+func NewSMTPConfigPasswordChangedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id string,
+	password *crypto.CryptoValue,
+) *SMTPConfigPasswordChangedEvent {
+	return &SMTPConfigPasswordChangedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMTPConfigPasswordChangedEventType,
+		),
+		Password: password,
+	}
+}
+
+func (e *SMTPConfigPasswordChangedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMTPConfigPasswordChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMTPConfigPasswordChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SMTPConfigHTTPAddedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+
+	ID          string `json:"id,omitempty"`
+	Description string `json:"description,omitempty"`
+	Endpoint    string `json:"endpoint,omitempty"`
+}
+
+func NewSMTPConfigHTTPAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id, description string,
+	endpoint string,
+) *SMTPConfigHTTPAddedEvent {
+	return &SMTPConfigHTTPAddedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMTPConfigHTTPAddedEventType,
+		),
+		ID:          id,
+		Description: description,
+		Endpoint:    endpoint,
+	}
+}
+
+func (e *SMTPConfigHTTPAddedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMTPConfigHTTPAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMTPConfigHTTPAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SMTPConfigHTTPChangedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+	ID                    string  `json:"id,omitempty"`
+	Description           *string `json:"description,omitempty"`
+	Endpoint              *string `json:"endpoint,omitempty"`
+}
+
+func (e *SMTPConfigHTTPChangedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMTPConfigHTTPChangedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMTPConfigHTTPChangedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+func NewSMTPConfigHTTPChangeEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id string,
+	changes []SMTPConfigHTTPChanges,
+) (*SMTPConfigHTTPChangedEvent, error) {
+	if len(changes) == 0 {
+		return nil, zerrors.ThrowPreconditionFailed(nil, "IAM-o0pWf", "Errors.NoChangesFound")
+	}
+	changeEvent := &SMTPConfigHTTPChangedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMTPConfigHTTPChangedEventType,
+		),
+		ID: id,
+	}
+	for _, change := range changes {
+		change(changeEvent)
+	}
+	return changeEvent, nil
+}
+
+type SMTPConfigHTTPChanges func(event *SMTPConfigHTTPChangedEvent)
+
+func ChangeSMTPConfigHTTPID(id string) func(event *SMTPConfigHTTPChangedEvent) {
+	return func(e *SMTPConfigHTTPChangedEvent) {
+		e.ID = id
+	}
+}
+
+func ChangeSMTPConfigHTTPDescription(description string) func(event *SMTPConfigHTTPChangedEvent) {
+	return func(e *SMTPConfigHTTPChangedEvent) {
+		e.Description = &description
+	}
+}
+
+func ChangeSMTPConfigHTTPEndpoint(endpoint string) func(event *SMTPConfigHTTPChangedEvent) {
+	return func(e *SMTPConfigHTTPChangedEvent) {
+		e.Endpoint = &endpoint
+	}
+}
+
+type SMTPConfigActivatedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+	ID                    string `json:"id,omitempty"`
+}
+
+func NewSMTPConfigActivatedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id string,
+) *SMTPConfigActivatedEvent {
+	return &SMTPConfigActivatedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMTPConfigActivatedEventType,
+		),
+		ID: id,
+	}
+}
+
+func (e *SMTPConfigActivatedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMTPConfigActivatedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMTPConfigActivatedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SMTPConfigDeactivatedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+	ID                    string `json:"id,omitempty"`
+}
+
+func NewSMTPConfigDeactivatedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id string,
+) *SMTPConfigDeactivatedEvent {
+	return &SMTPConfigDeactivatedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMTPConfigDeactivatedEventType,
+		),
+		ID: id,
+	}
+}
+
+func (e *SMTPConfigDeactivatedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+
+func (e *SMTPConfigDeactivatedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMTPConfigDeactivatedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}
+
+type SMTPConfigRemovedEvent struct {
+	*eventstore.BaseEvent `json:"-"`
+	ID                    string `json:"id,omitempty"`
+}
+
+func NewSMTPConfigRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	id string,
+) *SMTPConfigRemovedEvent {
+	return &SMTPConfigRemovedEvent{
+		BaseEvent: eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			SMTPConfigRemovedEventType,
+		),
+		ID: id,
+	}
+}
+
+func (e *SMTPConfigRemovedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = event
+}
+func (e *SMTPConfigRemovedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *SMTPConfigRemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return nil
+}

apps/api/internal/repository/instance/trusted_domain.go

@@ -0,0 +1,95 @@
+package instance
+
+import (
+	"context"
+
+	"github.com/zitadel/zitadel/internal/eventstore"
+)
+
+const (
+	trustedDomainPrefix           = "trusted_domains."
+	UniqueTrustedDomain           = "trusted_domain"
+	TrustedDomainAddedEventType   = instanceEventTypePrefix + trustedDomainPrefix + "added"
+	TrustedDomainRemovedEventType = instanceEventTypePrefix + trustedDomainPrefix + "removed"
+)
+
+func NewAddTrustedDomainUniqueConstraint(trustedDomain string) *eventstore.UniqueConstraint {
+	return eventstore.NewAddEventUniqueConstraint(
+		UniqueTrustedDomain,
+		trustedDomain,
+		"Errors.Instance.Domain.AlreadyExists")
+}
+
+func NewRemoveTrustedDomainUniqueConstraint(trustedDomain string) *eventstore.UniqueConstraint {
+	return eventstore.NewRemoveUniqueConstraint(
+		UniqueTrustedDomain,
+		trustedDomain)
+}
+
+type TrustedDomainAddedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Domain string `json:"domain"`
+}
+
+func (e *TrustedDomainAddedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = *event
+}
+
+func NewTrustedDomainAddedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	trustedDomain string,
+) *TrustedDomainAddedEvent {
+	event := &TrustedDomainAddedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			TrustedDomainAddedEventType,
+		),
+		Domain: trustedDomain,
+	}
+	return event
+}
+
+func (e *TrustedDomainAddedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *TrustedDomainAddedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return []*eventstore.UniqueConstraint{NewAddTrustedDomainUniqueConstraint(e.Domain)}
+}
+
+type TrustedDomainRemovedEvent struct {
+	eventstore.BaseEvent `json:"-"`
+
+	Domain string `json:"domain"`
+}
+
+func (e *TrustedDomainRemovedEvent) SetBaseEvent(event *eventstore.BaseEvent) {
+	e.BaseEvent = *event
+}
+
+func NewTrustedDomainRemovedEvent(
+	ctx context.Context,
+	aggregate *eventstore.Aggregate,
+	trustedDomain string,
+) *TrustedDomainRemovedEvent {
+	event := &TrustedDomainRemovedEvent{
+		BaseEvent: *eventstore.NewBaseEventForPush(
+			ctx,
+			aggregate,
+			TrustedDomainRemovedEventType,
+		),
+		Domain: trustedDomain,
+	}
+	return event
+}
+
+func (e *TrustedDomainRemovedEvent) Payload() interface{} {
+	return e
+}
+
+func (e *TrustedDomainRemovedEvent) UniqueConstraints() []*eventstore.UniqueConstraint {
+	return []*eventstore.UniqueConstraint{NewRemoveTrustedDomainUniqueConstraint(e.Domain)}
+}