@zitadel/api 0.1.0-alpha.16 → 0.1.0-alpha.18

package/src/generated/endpoints/zitadelNextGen.zod.ts

@@ -7,508 +7,6 @@
  */
 import * as zod from "zod";
 
-/**
- * Retrieve the OpenID Connect configuration
- * @summary Get OpenID Connect configuration
- */
-export const getOpenIDConfigurationResponseClaimsParameterSupportedDefault = false;
-export const getOpenIDConfigurationResponseRequestParameterSupportedDefault = false;
-export const getOpenIDConfigurationResponseRequestUriParameterSupportedDefault = true;
-export const getOpenIDConfigurationResponseRequireRequestUriRegistrationDefault = false;
-
-export const GetOpenIDConfigurationResponse = zod
-  .object({
-    issuer: zod
-      .url()
-      .describe(
-        "REQUIRED. URL using the https scheme with no query or fragment components that the OP asserts as its Issuer Identifier.",
-      ),
-    authorization_endpoint: zod
-      .url()
-      .describe("REQUIRED. URL of the OP's OAuth 2.0 Authorization Endpoint."),
-    token_endpoint: zod
-      .url()
-      .optional()
-      .describe(
-        "URL of the OP's OAuth 2.0 Token Endpoint. REQUIRED unless only the Implicit Flow is used.",
-      ),
-    userinfo_endpoint: zod
-      .url()
-      .optional()
-      .describe("RECOMMENDED. URL of the OP's UserInfo Endpoint."),
-    jwks_uri: zod
-      .url()
-      .describe(
-        "REQUIRED. URL of the OP's JWK Set document containing the signing key(s) the RP uses to validate signatures from the OP.",
-      ),
-    registration_endpoint: zod
-      .url()
-      .optional()
-      .describe("RECOMMENDED. URL of the OP's Dynamic Client Registration Endpoint."),
-    scopes_supported: zod
-      .array(zod.string())
-      .optional()
-      .describe(
-        "RECOMMENDED. JSON array containing a list of the OAuth 2.0 scope values that this server supports. The server MUST support the openid scope value.",
-      ),
-    response_types_supported: zod
-      .array(zod.string())
-      .describe(
-        "REQUIRED. JSON array containing a list of the OAuth 2.0 response_type values that this OP supports.",
-      ),
-    response_modes_supported: zod
-      .array(zod.string())
-      .optional()
-      .describe(
-        'OPTIONAL. JSON array containing a list of the OAuth 2.0 response_mode values that this OP supports. Default is [\"query\", \"fragment\"].',
-      ),
-    grant_types_supported: zod
-      .array(zod.string())
-      .optional()
-      .describe(
-        'OPTIONAL. JSON array containing a list of the OAuth 2.0 Grant Type values that this OP supports. Default is [\"authorization_code\", \"implicit\"].',
-      ),
-    acr_values_supported: zod
-      .array(zod.string())
-      .optional()
-      .describe(
-        "OPTIONAL. JSON array containing a list of the Authentication Context Class References that this OP supports.",
-      ),
-    subject_types_supported: zod
-      .array(zod.enum(["public", "pairwise"]))
-      .describe(
-        "REQUIRED. JSON array containing a list of the Subject Identifier types that this OP supports. Valid types include pairwise and public.",
-      ),
-    id_token_signing_alg_values_supported: zod
-      .array(zod.string())
-      .describe(
-        "REQUIRED. JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for the ID Token. The algorithm RS256 MUST be included.",
-      ),
-    id_token_encryption_alg_values_supported: zod
-      .array(zod.string())
-      .optional()
-      .describe(
-        "OPTIONAL. JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token.",
-      ),
-    id_token_encryption_enc_values_supported: zod
-      .array(zod.string())
-      .optional()
-      .describe(
-        "OPTIONAL. JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token.",
-      ),
-    userinfo_signing_alg_values_supported: zod
-      .array(zod.string())
-      .optional()
-      .describe(
-        "OPTIONAL. JSON array containing a list of the JWS signing algorithms (alg values) supported by the UserInfo Endpoint.",
-      ),
-    userinfo_encryption_alg_values_supported: zod
-      .array(zod.string())
-      .optional()
-      .describe(
-        "OPTIONAL. JSON array containing a list of the JWE encryption algorithms (alg values) supported by the UserInfo Endpoint.",
-      ),
-    userinfo_encryption_enc_values_supported: zod
-      .array(zod.string())
-      .optional()
-      .describe(
-        "OPTIONAL. JSON array containing a list of the JWE encryption algorithms (enc values) supported by the UserInfo Endpoint.",
-      ),
-    request_object_signing_alg_values_supported: zod
-      .array(zod.string())
-      .optional()
-      .describe(
-        "OPTIONAL. JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects. Servers SHOULD support none and RS256.",
-      ),
-    request_object_encryption_alg_values_supported: zod
-      .array(zod.string())
-      .optional()
-      .describe(
-        "OPTIONAL. JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects.",
-      ),
-    request_object_encryption_enc_values_supported: zod
-      .array(zod.string())
-      .optional()
-      .describe(
-        "OPTIONAL. JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects.",
-      ),
-    token_endpoint_auth_methods_supported: zod
-      .array(
-        zod.enum([
-          "client_secret_post",
-          "client_secret_basic",
-          "client_secret_jwt",
-          "private_key_jwt",
-        ]),
-      )
-      .optional()
-      .describe(
-        "OPTIONAL. JSON array containing a list of Client Authentication methods supported by the Token Endpoint. Default is client_secret_basic.",
-      ),
-    token_endpoint_auth_signing_alg_values_supported: zod
-      .array(zod.string())
-      .optional()
-      .describe(
-        "OPTIONAL. JSON array containing a list of the JWS signing algorithms supported by the Token Endpoint for private_key_jwt and client_secret_jwt authentication. The value none MUST NOT be used.",
-      ),
-    display_values_supported: zod
-      .array(zod.enum(["page", "popup", "touch", "wap"]))
-      .optional()
-      .describe(
-        "OPTIONAL. JSON array containing a list of the display parameter values that the OpenID Provider supports.",
-      ),
-    claim_types_supported: zod
-      .array(zod.enum(["normal", "aggregated", "distributed"]))
-      .optional()
-      .describe(
-        "OPTIONAL. JSON array containing a list of the Claim Types that the OpenID Provider supports. Default is normal.",
-      ),
-    claims_supported: zod
-      .array(zod.string())
-      .optional()
-      .describe(
-        "RECOMMENDED. JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for.",
-      ),
-    service_documentation: zod
-      .url()
-      .optional()
-      .describe(
-        "OPTIONAL. URL of a page containing human-readable information for developers using the OpenID Provider.",
-      ),
-    claims_locales_supported: zod
-      .array(zod.string())
-      .optional()
-      .describe(
-        "OPTIONAL. Languages and scripts supported for values in Claims being returned, as BCP47 language tag values.",
-      ),
-    ui_locales_supported: zod
-      .array(zod.string())
-      .optional()
-      .describe(
-        "OPTIONAL. Languages and scripts supported for the user interface, as BCP47 language tag values.",
-      ),
-    claims_parameter_supported: zod
-      .boolean()
-      .default(getOpenIDConfigurationResponseClaimsParameterSupportedDefault)
-      .describe(
-        "OPTIONAL. Boolean value specifying whether the OP supports use of the claims parameter. Default is false.",
-      ),
-    request_parameter_supported: zod
-      .boolean()
-      .default(getOpenIDConfigurationResponseRequestParameterSupportedDefault)
-      .describe(
-        "OPTIONAL. Boolean value specifying whether the OP supports use of the request parameter. Default is false.",
-      ),
-    request_uri_parameter_supported: zod
-      .boolean()
-      .default(getOpenIDConfigurationResponseRequestUriParameterSupportedDefault)
-      .describe(
-        "OPTIONAL. Boolean value specifying whether the OP supports use of the request_uri parameter. Default is true.",
-      ),
-    require_request_uri_registration: zod
-      .boolean()
-      .default(getOpenIDConfigurationResponseRequireRequestUriRegistrationDefault)
-      .describe(
-        "OPTIONAL. Boolean value specifying whether the OP requires any request_uri values used to be pre-registered. Default is false.",
-      ),
-    op_policy_uri: zod
-      .url()
-      .optional()
-      .describe(
-        "OPTIONAL. URL the OP provides to the person registering the Client about the OP's requirements on how the Relying Party can use the data provided.",
-      ),
-    op_tos_uri: zod
-      .url()
-      .optional()
-      .describe(
-        "OPTIONAL. URL the OP provides to the person registering the Client about the OpenID Provider's terms of service.",
-      ),
-  })
-  .describe(
-    "OpenID Connect configuration according to the OpenID Connect Discovery 1.0 specification.",
-  );
-
-/**
- * @summary Authorize a user
- */
-export const AuthorizeGetQueryParams = zod.strictObject({
-  acr_values: zod
-    .string()
-    .optional()
-    .describe(
-      "A space delimited list of Authentication Class References. This can be\nused to specify certain authentication methods or level of assurance \nthat is required for the authentication. For example, you could use \nthis to require multi-factor authentication.\n",
-    ),
-  client_id: zod
-    .string()
-    .describe(
-      "The client ID of the application that is requesting authorization. \nThis is a required parameter and must match the client ID of a \nregistered application.\n",
-    ),
-  code_challenge: zod
-    .string()
-    .optional()
-    .describe(
-      "The code challenge is a cryptographic string used in the PKCE (Proof \nKey for Code Exchange) flow to enhance security.\n",
-    ),
-  code_challenge_method: zod
-    .string()
-    .optional()
-    .describe(
-      'The code challenge method is used in conjunction with the code challenge \nin the PKCE flow. It specifies the method used to generate the code \nchallenge. Common values are \"S256\" for SHA-256 hashing and \"plain\" \nfor no hashing.\n',
-    ),
-  display: zod
-    .string()
-    .optional()
-    .describe(
-      'The display parameter is used to specify how the authorization server \nshould display the authentication and consent user interface. Common \nvalues include \"page\" for a full-page display, \"popup\" for a popup \nwindow, and \"touch\" for a mobile-optimized display.\n',
-    ),
-  id_token_hint: zod
-    .string()
-    .optional()
-    .describe(
-      "The ID token hint is a previously issued ID token that can be used to \npre-fill the authentication form or to provide information about the \nuser to the authorization server. This can be useful for single sign-on \nscenarios or for providing a smoother user experience.\n",
-    ),
-  login_hint: zod
-    .string()
-    .optional()
-    .describe(
-      "The login hint is a hint to the authorization server about the login \nidentifier of the user. This can be used to pre-fill the username or \nemail field in the authentication form, making it easier for the user \nto log in.\n",
-    ),
-  max_age: zod
-    .number()
-    .optional()
-    .describe(
-      "The max age parameter specifies the maximum amount of time in seconds \nthat has passed since the user last authenticated. If the user has not \nauthenticated within this time frame, they will be required to re-authenticate.\n",
-    ),
-  nonce: zod
-    .string()
-    .optional()
-    .describe(
-      "The nonce parameter is a random string that is used to associate a client \nsession with an ID token and to mitigate replay attacks. The authorization \nserver should include this value in the ID token that it issues, and the \nclient should verify that the value in the ID token matches the value it \nsent in the authorization request.\n",
-    ),
-  prompt: zod
-    .string()
-    .optional()
-    .describe(
-      'The prompt parameter is used to specify whether the authorization server \nshould prompt the user for re-authentication and consent. Common values \ninclude \"none\" for no prompts, \"login\" to prompt for re-authentication, \n\"consent\" to prompt for user consent, and \"select_account\" to prompt \nthe user to select an account if they are logged in with multiple accounts.\n',
-    ),
-  redirect_uri: zod
-    .string()
-    .optional()
-    .describe(
-      "The redirect URI is the URI to which the authorization server will redirect \nthe user after they have authorized or denied the request. This must match \none of the redirect URIs registered for the client application.\n",
-    ),
-  response_mode: zod
-    .string()
-    .optional()
-    .describe(
-      'The response mode parameter specifies how the authorization server should \nreturn the authorization response. Common values include \"query\" to return \nparameters in the query string, \"fragment\" to return parameters in the URL \nfragment, and \"form_post\" to return parameters in an HTTP POST request.\n',
-    ),
-  response_type: zod
-    .string()
-    .describe(
-      'The response type parameter specifies the type of response that the client \nis expecting from the authorization server. Common values include \"code\" \nfor the authorization code flow, \"token\" for the implicit flow, and \"id_token\" \nfor OpenID Connect authentication.\n',
-    ),
-  scope: zod
-    .string()
-    .optional()
-    .describe(
-      "The scope parameter is used to specify the permissions that the client is \nrequesting from the user. This is a space-delimited list of scope values, \nand the authorization server will use this information to determine what \naccess to grant to the client application.\n",
-    ),
-  state: zod
-    .string()
-    .optional()
-    .describe(
-      "The state parameter is a random string that is used to maintain state between \nthe authorization request and the callback. It is used to prevent cross-site \nrequest forgery (CSRF) attacks by ensuring that the response received from the \nauthorization server corresponds to the request that was sent.\n",
-    ),
-  ui_locales: zod
-    .string()
-    .optional()
-    .describe(
-      "The ui_locales parameter is used to specify the preferred languages and scripts \nfor the user interface that the authorization server should display. This is a \nspace-delimited list of BCP47 language tag values, and it can be used to provide \na localized user experience for users from different regions and language \npreferences.\n",
-    ),
-});
-
-/**
- * @summary Authorize a device
- */
-export const AuthorizeDeviceQueryParams = zod.strictObject({
-  client_id: zod
-    .string()
-    .describe(
-      "The client ID of the application that is requesting authorization. \nThis is a required parameter and must match the client ID of a \nregistered application.\n",
-    ),
-  scope: zod
-    .string()
-    .optional()
-    .describe(
-      "The scope parameter is used to specify the permissions that the client\nis requesting. This is a space delimited list of scopes. For example,\nyou could use this to request access to the user's profile information or\nto request permission to access certain APIs on behalf of the user.\n",
-    ),
-});
-
-export const AuthorizeDeviceResponse = zod.object({
-  device_code: zod
-    .string()
-    .optional()
-    .describe("The device code that the client will use to poll for authorization.\n"),
-  expires_in: zod
-    .number()
-    .optional()
-    .describe("The number of seconds until the device code expires.\n"),
-  interval: zod
-    .number()
-    .optional()
-    .describe(
-      "The minimum amount of time in seconds that the client should wait \nbetween polling requests.\n",
-    ),
-  user_code: zod
-    .string()
-    .optional()
-    .describe("The user code that the user will enter to authorize the device.\n"),
-  verification_uri: zod
-    .string()
-    .optional()
-    .describe("The URI where the user will enter the user code to authorize the device.\n"),
-  verification_uri_complete: zod
-    .string()
-    .optional()
-    .describe(
-      "The complete URI with the user code included, which the user can visit\nto authorize the device.\n",
-    ),
-});
-
-/**
- * @summary End a session
- */
-export const EndSessionQueryParams = zod.strictObject({
-  client_id: zod
-    .string()
-    .optional()
-    .describe(
-      "The client ID is the identifier for the client application that is making \nthe request. This is used by the authorization server to identify the \nclient and to determine whether it is authorized to perform the requested \naction.\n",
-    ),
-  id_token_hint: zod
-    .string()
-    .optional()
-    .describe(
-      "The ID token hint is a previously issued ID token that can be used to \npre-fill the authentication form or to provide information about the \nuser to the authorization server. This can be useful for single sign-on \nscenarios or for providing a smoother user experience.\n",
-    ),
-  logout_hint: zod
-    .string()
-    .optional()
-    .describe(
-      "The logout hint is a hint to the authorization server about the login \nidentifier of the user. This can be used to pre-fill the username or email\nfield in the logout form, making it easier for the user to log out.\n",
-    ),
-  post_logout_redirect_uri: zod
-    .string()
-    .optional()
-    .describe(
-      "The post logout redirect URI is the URI to which the user will be \nredirected after they have logged out. This must be a registered URI \nfor the client application and is used to ensure that the user is \nredirected to a safe location after logging out.\n",
-    ),
-  state: zod
-    .string()
-    .optional()
-    .describe(
-      "The state parameter is an opaque value that is used by the client to\nmaintain state between the request and the callback. It is typically used\nto prevent cross-site request forgery (CSRF) attacks by including a unique\nvalue in the request that the client can verify when it receives the callback.\n",
-    ),
-  ui_locales: zod
-    .string()
-    .optional()
-    .describe(
-      "The ui_locales parameter is a space-separated list of BCP47 language tags\nthat are used to indicate the preferred languages and scripts for the user\ninterface. This can be used by the authorization server to display the logout\npage in the user's preferred language.\n",
-    ),
-});
-
-/**
- * @summary Introspect a token
- */
-export const IntrospectResponse = zod.object({
-  active: zod.boolean().optional().describe("Indicates whether the token is active"),
-  aud: zod.string().optional().describe("The audience of the token (if applicable)"),
-  client_id: zod.string().optional().describe("The client ID associated with the token"),
-  exp: zod
-    .number()
-    .optional()
-    .describe("The expiration time of the token (in seconds since epoch)"),
-  iat: zod.number().optional().describe("The time the token was issued (in seconds since epoch)"),
-  iss: zod.string().optional().describe("The issuer of the token (if applicable)"),
-  jti: zod.string().optional().describe("The unique identifier for the token (if applicable)"),
-  nbf: zod
-    .number()
-    .optional()
-    .describe("The time before which the token is not valid (in seconds since epoch)"),
-  scope: zod.string().optional().describe("The scopes associated with the token"),
-  sub: zod.string().optional().describe("The subject of the token (if applicable)"),
-  token_type: zod
-    .string()
-    .optional()
-    .describe("The type of the token (access_token or refresh_token)"),
-  username: zod
-    .string()
-    .optional()
-    .describe("The username associated with the token (if applicable)"),
-});
-
-/**
- * @summary Get public keys
- */
-export const GetKeysResponse = zod.object({
-  keys: zod
-    .array(
-      zod.object({
-        use: zod.string().optional(),
-        kty: zod.string().optional(),
-        kid: zod.string().optional(),
-        crv: zod.string().optional(),
-        alg: zod.string().optional(),
-        k: zod.string().optional(),
-        x: zod.string().optional(),
-        y: zod.string().optional(),
-        n: zod.string().optional(),
-        e: zod.string().optional(),
-        d: zod.string().optional(),
-        p: zod.string().optional(),
-        q: zod.string().optional(),
-        dp: zod.string().optional(),
-        dq: zod.string().optional(),
-        qi: zod.string().optional(),
-        x5c: zod.array(zod.string()).optional(),
-        x5u: zod.string().optional(),
-        x5t: zod.string().optional(),
-        x5tS256: zod.string().optional(),
-      }),
-    )
-    .optional(),
-});
-
-/**
- * @summary Get access token
- */
-export const GetTokenResponse = zod.object({
-  access_token: zod
-    .string()
-    .optional()
-    .describe("The access token issued by the authorization server."),
-  token_type: zod.string().optional().describe("The type of the token issued (e.g., Bearer)."),
-  expires_in: zod.number().optional().describe("The lifetime in seconds of the access token."),
-  refresh_token: zod
-    .string()
-    .optional()
-    .describe("The refresh token which can be used to obtain new access tokens."),
-});
-
-/**
- * @summary Get user info
- */
-export const GetUserInfoResponse = zod.object({
-  sub: zod.string().optional().describe("The unique identifier for the user."),
-  name: zod.string().optional().describe("The full name of the user."),
-  email: zod.email().optional().describe("The email address of the user."),
-  preferred_username: zod.string().optional().describe("The preferred username of the user."),
-  picture: zod.url().optional().describe("The URL of the user's profile picture."),
-  given_name: zod.string().optional().describe("The given name of the user."),
-  family_name: zod.string().optional().describe("The family name of the user."),
-});
-
 /**
  * @summary Create user
  */
@@ -527,37 +25,96 @@ export const CreateUserQueryParams = zod.strictObject({
     .describe("The unique identifier of the team"),
 });
 
+export const createUserBodyIdRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
+
 export const CreateUserBody = zod
-  .record(zod.string(), zod.unknown())
+  .object({
+    id: zod.string().regex(createUserBodyIdRegExp).optional(),
+    metadata: zod
+      .object({
+        created_at: zod.iso
+          .datetime({ offset: true })
+          .describe("The time when the user was created."),
+        updated_at: zod.iso
+          .datetime({ offset: true })
+          .describe("The time when the user was last updated."),
+        status: zod
+          .enum(["active", "suspended", "deactivated", "pending_purge"])
+          .describe("The status of the user."),
+        lifecycle_owner_team_id: zod
+          .union([zod.string(), zod.null()])
+          .optional()
+          .describe(
+            "The team that owns this user's identity lifecycle, or `null` when the\nuser is self-owned. This is a single team and a different concept from\nthe user's team roster: it decides who may deprovision the user, not\nwhich teams the user collaborates in. The roster is its own paginated\nresource — `GET \/users\/{user_id}\/teams`.\n",
+          ),
+      })
+      .optional(),
+  })
   .describe(
-    "A user represents an individual identity in the system. It can be used to \nrepresent a human user, but also a service account or any other type of \nidentity. The content of a user is determined by the configured schema for \nusers, this is only a base schema.\n",
+    "A user represents an individual identity in the system. It can be used to \nrepresent a human user, but also a service account or any other type of \nidentity. The content of a user is determined by the configured schema for \nusers, this is only a base schema.\n\nThe server assigns the resource primary key (`id`) on create. Clients must\nnot send `id` in the create body; it is returned in the create response.\n",
   );
 
 /**
  * @summary List users
  */
-export const listUsersQueryOffsetDefault = 0;
-export const listUsersQueryOffsetMin = 0;
-
 export const listUsersQueryLimitDefault = 20;
 export const listUsersQueryLimitMax = 100;
 
 export const ListUsersQueryParams = zod.strictObject({
-  offset: zod
-    .number()
-    .min(listUsersQueryOffsetMin)
-    .default(listUsersQueryOffsetDefault)
-    .describe("Number of items to skip before returning results."),
   limit: zod
     .number()
     .min(1)
     .max(listUsersQueryLimitMax)
     .default(listUsersQueryLimitDefault)
     .describe("Maximum number of items to return."),
+  page_token: zod
+    .string()
+    .optional()
+    .describe(
+      "Token for fetching the next page of results.\nObtain this value from `next_page_token` in the previous response.\nOmit to start from the beginning.\nIts format is opaque and may change between releases.\n",
+    ),
 });
 
-export const ListUsersResponseItem = zod.record(zod.string(), zod.unknown());
-export const ListUsersResponse = zod.array(ListUsersResponseItem);
+export const listUsersResponseUsersItemIdRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
+
+export const ListUsersResponse = zod
+  .object({
+    users: zod.array(
+      zod
+        .object({
+          id: zod.string().regex(listUsersResponseUsersItemIdRegExp).optional(),
+          metadata: zod
+            .object({
+              created_at: zod.iso
+                .datetime({ offset: true })
+                .describe("The time when the user was created."),
+              updated_at: zod.iso
+                .datetime({ offset: true })
+                .describe("The time when the user was last updated."),
+              status: zod
+                .enum(["active", "suspended", "deactivated", "pending_purge"])
+                .describe("The status of the user."),
+              lifecycle_owner_team_id: zod
+                .union([zod.string(), zod.null()])
+                .optional()
+                .describe(
+                  "The team that owns this user's identity lifecycle, or `null` when the\nuser is self-owned. This is a single team and a different concept from\nthe user's team roster: it decides who may deprovision the user, not\nwhich teams the user collaborates in. The roster is its own paginated\nresource — `GET \/users\/{user_id}\/teams`.\n",
+                ),
+            })
+            .optional(),
+        })
+        .describe(
+          "A user represents an individual identity in the system. It can be used to \nrepresent a human user, but also a service account or any other type of \nidentity. The content of a user is determined by the configured schema for \nusers, this is only a base schema.\n\nThe server assigns the resource primary key (`id`) on create. Clients must\nnot send `id` in the create body; it is returned in the create response.\n",
+        ),
+    ),
+    next_page_token: zod
+      .union([zod.string(), zod.null()])
+      .optional()
+      .describe(
+        "Token to pass as `page_token` in the next request to fetch the following page.\nAbsent when there are no more results.\n",
+      ),
+  })
+  .describe("Paginated list of users.");
 
 /**
  * @summary Get user by ID
@@ -583,7 +140,105 @@ export const GetUserByIDQueryParams = zod.strictObject({
     .describe("The unique identifier of the team"),
 });
 
-export const GetUserByIDResponse = zod.record(zod.string(), zod.unknown());
+export const getUserByIDResponseIdRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
+
+export const GetUserByIDResponse = zod
+  .object({
+    id: zod.string().regex(getUserByIDResponseIdRegExp).optional(),
+    metadata: zod
+      .object({
+        created_at: zod.iso
+          .datetime({ offset: true })
+          .describe("The time when the user was created."),
+        updated_at: zod.iso
+          .datetime({ offset: true })
+          .describe("The time when the user was last updated."),
+        status: zod
+          .enum(["active", "suspended", "deactivated", "pending_purge"])
+          .describe("The status of the user."),
+        lifecycle_owner_team_id: zod
+          .union([zod.string(), zod.null()])
+          .optional()
+          .describe(
+            "The team that owns this user's identity lifecycle, or `null` when the\nuser is self-owned. This is a single team and a different concept from\nthe user's team roster: it decides who may deprovision the user, not\nwhich teams the user collaborates in. The roster is its own paginated\nresource — `GET \/users\/{user_id}\/teams`.\n",
+          ),
+      })
+      .optional(),
+  })
+  .describe(
+    "A user represents an individual identity in the system. It can be used to \nrepresent a human user, but also a service account or any other type of \nidentity. The content of a user is determined by the configured schema for \nusers, this is only a base schema.\n\nThe server assigns the resource primary key (`id`) on create. Clients must\nnot send `id` in the create body; it is returned in the create response.\n",
+  );
+
+/**
+ * @summary Delete user by ID
+ */
+export const deleteUserByIDPathUserIdRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
+
+export const DeleteUserByIDParams = zod.object({
+  user_id: zod.string().regex(deleteUserByIDPathUserIdRegExp),
+});
+
+export const deleteUserByIDQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const DeleteUserByIDQueryParams = zod.strictObject({
+  project_id: zod
+    .string()
+    .regex(deleteUserByIDQueryProjectIdRegExp)
+    .describe("The unique identifier of the project"),
+});
+
+/**
+ * @summary List user passkeys
+ */
+export const listUserPasskeysPathUserIdRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
+
+export const ListUserPasskeysParams = zod.object({
+  user_id: zod.string().regex(listUserPasskeysPathUserIdRegExp),
+});
+
+export const listUserPasskeysQueryLimitDefault = 20;
+export const listUserPasskeysQueryLimitMax = 100;
+
+export const listUserPasskeysQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const ListUserPasskeysQueryParams = zod.strictObject({
+  limit: zod
+    .number()
+    .min(1)
+    .max(listUserPasskeysQueryLimitMax)
+    .default(listUserPasskeysQueryLimitDefault)
+    .describe("Maximum number of items to return."),
+  page_token: zod
+    .string()
+    .optional()
+    .describe(
+      "Token for fetching the next page of results.\nObtain this value from `next_page_token` in the previous response.\nOmit to start from the beginning.\nIts format is opaque and may change between releases.\n",
+    ),
+  project_id: zod
+    .string()
+    .regex(listUserPasskeysQueryProjectIdRegExp)
+    .describe("The unique identifier of the project"),
+});
+
+export const ListUserPasskeysResponse = zod
+  .object({
+    passkeys: zod.array(
+      zod.object({
+        id: zod.string().describe("The unique identifier of the passkey."),
+        name: zod.string().describe("The name of the passkey."),
+        created_at: zod.iso
+          .datetime({ offset: true })
+          .describe("The timestamp when the passkey was created."),
+      }),
+    ),
+    next_page_token: zod
+      .union([zod.string(), zod.null()])
+      .optional()
+      .describe(
+        "Token to pass as `page_token` in the next request to fetch the following page.\nAbsent when there are no more results.\n",
+      ),
+  })
+  .describe("Response containing the user's passkeys.");
 
 /**
  * @summary Set user password
@@ -606,7 +261,7 @@ export const SetUserPasswordQueryParams = zod.strictObject({
 export const SetUserPasswordBody = zod
   .object({
     password: zod.string().describe("The new password for the user."),
-    isChangeRequired: zod
+    is_change_required: zod
       .boolean()
       .optional()
       .describe(
@@ -615,10 +270,110 @@ export const SetUserPasswordBody = zod
   })
   .describe("Request to update the user's password.");
 
+/**
+ * The user's team roster, ordered by team name. Each entry carries the
+team's name, so a client renders a page without resolving ids one by one.
+
+This is the N:N roster and it is not lifecycle ownership: the single team
+that owns the user's lifecycle is reported as `metadata.lifecycle_owner_team_id`
+on the user read endpoints. Memberships the user was removed from are not
+returned.
+
+ * @summary List the teams a user belongs to
+ */
+export const listUserTeamsPathUserIdRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
+
+export const ListUserTeamsParams = zod.object({
+  user_id: zod.string().regex(listUserTeamsPathUserIdRegExp),
+});
+
+export const listUserTeamsQueryLimitDefault = 20;
+export const listUserTeamsQueryLimitMax = 100;
+
+export const listUserTeamsQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const ListUserTeamsQueryParams = zod.strictObject({
+  limit: zod
+    .number()
+    .min(1)
+    .max(listUserTeamsQueryLimitMax)
+    .default(listUserTeamsQueryLimitDefault)
+    .describe("Maximum number of items to return."),
+  page_token: zod
+    .string()
+    .optional()
+    .describe(
+      "Token for fetching the next page of results.\nObtain this value from `next_page_token` in the previous response.\nOmit to start from the beginning.\nIts format is opaque and may change between releases.\n",
+    ),
+  project_id: zod
+    .string()
+    .regex(listUserTeamsQueryProjectIdRegExp)
+    .describe("The unique identifier of the project"),
+});
+
+export const ListUserTeamsResponse = zod
+  .object({
+    teams: zod.array(
+      zod
+        .object({
+          id: zod.string().describe("The unique identifier of the team."),
+          name: zod.string().describe("The name of the team."),
+          membership_status: zod
+            .enum(["pending", "active", "inactive"])
+            .describe(
+              "The user's participation state on this team. Memberships the user was\nremoved from are not returned.\n",
+            ),
+          created_at: zod.iso
+            .datetime({ offset: true })
+            .describe("The time when the user joined this team."),
+          updated_at: zod.iso
+            .datetime({ offset: true })
+            .describe("The time when this membership was last changed."),
+        })
+        .describe(
+          "One entry of a user's team roster: a team the user belongs to, with the\nmembership's participation state. The team's `name` travels with the entry, so\na page renders without a follow-up `POST \/teams\/query` per row.\n\nRoster membership is not lifecycle ownership. A user can belong to many teams\nwhile still owning their own lifecycle — that single owning team is reported\nas `metadata.lifecycle_owner_team_id` on the user itself.\n",
+        ),
+    ),
+    next_page_token: zod
+      .union([zod.string(), zod.null()])
+      .optional()
+      .describe(
+        "Token to pass as `page_token` in the next request to fetch the following page.\nAbsent when there are no more results.\n",
+      ),
+  })
+  .describe("Paginated list of the teams a user belongs to.");
+
 /**
  * @summary Get my user information
  */
-export const GetMyUserResponse = zod.record(zod.string(), zod.unknown());
+export const getMyUserResponseIdRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
+
+export const GetMyUserResponse = zod
+  .object({
+    id: zod.string().regex(getMyUserResponseIdRegExp).optional(),
+    metadata: zod
+      .object({
+        created_at: zod.iso
+          .datetime({ offset: true })
+          .describe("The time when the user was created."),
+        updated_at: zod.iso
+          .datetime({ offset: true })
+          .describe("The time when the user was last updated."),
+        status: zod
+          .enum(["active", "suspended", "deactivated", "pending_purge"])
+          .describe("The status of the user."),
+        lifecycle_owner_team_id: zod
+          .union([zod.string(), zod.null()])
+          .optional()
+          .describe(
+            "The team that owns this user's identity lifecycle, or `null` when the\nuser is self-owned. This is a single team and a different concept from\nthe user's team roster: it decides who may deprovision the user, not\nwhich teams the user collaborates in. The roster is its own paginated\nresource — `GET \/users\/{user_id}\/teams`.\n",
+          ),
+      })
+      .optional(),
+  })
+  .describe(
+    "A user represents an individual identity in the system. It can be used to \nrepresent a human user, but also a service account or any other type of \nidentity. The content of a user is determined by the configured schema for \nusers, this is only a base schema.\n\nThe server assigns the resource primary key (`id`) on create. Clients must\nnot send `id` in the create body; it is returned in the create response.\n",
+  );
 
 /**
  * Resolves a flow definition based on purpose + audience context and returns
@@ -626,7 +381,7 @@ the first capability step. Creates a new session implicitly unless
 `session_id` is provided (for step-up / reauth on an existing session).
 
 The response contains an `id` field — the flow handle. Use it as the path
-parameter for all subsequent `/flow/{id}/submit` and `/flow/{id}/event` calls.
+parameter for all subsequent `/flow/{id}/submit` calls.
 
 The response also sets an encrypted `HttpOnly` cookie (`_zflow`) containing
 the flow's orchestration state (current step, collected data, history).
@@ -718,6 +473,7 @@ export const getFlowStepResponseStepActionsDefault = [];
 export const getFlowStepResponseStepGatesDefault = {} as const;
 export const getFlowStepResponseStepSsoProvidersDefault = [];
 export const getFlowStepResponseBrandingLayoutDefault = `centered`;
+export const getFlowStepResponseBrandingLiquidTemplateMax = 131072;
 
 export const GetFlowStepResponse = zod.object({
   id: zod
@@ -751,7 +507,7 @@ export const GetFlowStepResponse = zod.object({
         .union([zod.string(), zod.null()])
         .optional()
         .describe(
-          'Error from a previous failed submission. Field-validation failures\ncarry localisation text keys: `error.<field>_<rule>` per violation\n(e.g. `error.email_required`; the `format` rule is spelled\n`error.<field>_invalid`), multiple violations joined with `\"; \"`.\nField names appear verbatim, so clients localise unknown keys via\nthe generic `error.field_<rule>` catalog entries. Other failures\ncarry a verbatim diagnostic token instead (e.g. `user_not_found`,\n`auth_attempt.password_invalid`).\n',
+          'Error from a previous failed submission. Field-validation failures\ncarry localisation text keys: `error.<field>_<rule>` per violation\n(e.g. `error.email_required`; the `format` rule is spelled\n`error.<field>_invalid`), multiple violations joined with `\"; \"`.\nField names appear verbatim, so clients localise unknown keys via\nthe generic `error.field_<rule>` catalog entries. Other engine\nfailures carry `error.\*` catalog keys as well (e.g.\n`error.invalid_credentials`, `error.passkey_invalid`); a\nnon-`error.` payload is an outcome token (e.g. `user_not_found`)\nthat clients keep verbatim.\n',
         ),
       complete: zod
         .enum(["redirect", "show"])
@@ -945,21 +701,27 @@ export const GetFlowStepResponse = zod.object({
         .enum(["centered", "split"])
         .default(getFlowStepResponseBrandingLayoutDefault)
         .describe(
-          "Layout preset selector. The default.liquid master template uses this\nto branch into layout variants. Customers who eject the template\ncan ignore this field entirely.\n",
+          "Layout preset selector. The default.liquid master template uses this\nto branch into layout variants. Customers who eject the template\ncan ignore this field entirely; it also serves as the degrade target\nwhen a custom template fails component-side validation.\n",
         ),
       liquid_template: zod
         .string()
+        .max(getFlowStepResponseBrandingLiquidTemplateMax)
         .optional()
         .describe(
           "The LiquidJS template string for rendering this step. The orchestrator\nparses this template, injects the capability dictionaries as context,\nand renders the output HTML into its Shadow DOM.\n",
         ),
       logo_url: zod.url().optional().describe("Team logo URL."),
-      font_url: zod.url().optional().describe("Custom font URL (e.g., Google Fonts CSS)."),
+      font_url: zod
+        .url()
+        .optional()
+        .describe(
+          "Custom font stylesheet URL (e.g., Google Fonts CSS). Read-only in\nv1: `POST \/branding` rejects a non-empty value, because the login\ncomponent loads this stylesheet at document level (shadow-scoped\n`@font-face` rules never register faces) and an arbitrary URL would\ngrant `branding.write` page-wide CSS control over the embedding\napplication. Safe tenant font delivery is an ADR 040 follow-up;\nuntil then, load fonts from the embedding page.\n",
+        ),
       hero_url: zod.url().optional().describe("Hero\/background image URL (used by split layout)."),
     })
     .optional()
     .describe(
-      "Resolved branding configuration. Inherited from the app → team → project\nhierarchy at flow creation time (most specific wins). Read-only projection —\nbranding is configured via the Team\/App Branding API, not the Flow API.\n",
+      "Branding configuration. Appears in two places with one shape:\n\n- On flow responses as a read-only projection: the server resolves the\n  latest branding revision for the project per step response (falling\n  back to built-in defaults when none is stored). Branding is configured\n  via the Branding API \/ `zitadel apply`, not the Flow API.\n- As the request body of `POST \/branding`, which publishes the same\n  shape as a new immutable revision (see ADR 040).\n",
     ),
   redirect_uri: zod.url().optional().describe("Present when `step.complete` is `redirect`."),
   handoff_token: zod
@@ -1086,6 +848,7 @@ export const submitFlowStepResponseStepActionsDefault = [];
 export const submitFlowStepResponseStepGatesDefault = {} as const;
 export const submitFlowStepResponseStepSsoProvidersDefault = [];
 export const submitFlowStepResponseBrandingLayoutDefault = `centered`;
+export const submitFlowStepResponseBrandingLiquidTemplateMax = 131072;
 
 export const SubmitFlowStepResponse = zod.object({
   id: zod
@@ -1119,7 +882,7 @@ export const SubmitFlowStepResponse = zod.object({
         .union([zod.string(), zod.null()])
         .optional()
         .describe(
-          'Error from a previous failed submission. Field-validation failures\ncarry localisation text keys: `error.<field>_<rule>` per violation\n(e.g. `error.email_required`; the `format` rule is spelled\n`error.<field>_invalid`), multiple violations joined with `\"; \"`.\nField names appear verbatim, so clients localise unknown keys via\nthe generic `error.field_<rule>` catalog entries. Other failures\ncarry a verbatim diagnostic token instead (e.g. `user_not_found`,\n`auth_attempt.password_invalid`).\n',
+          'Error from a previous failed submission. Field-validation failures\ncarry localisation text keys: `error.<field>_<rule>` per violation\n(e.g. `error.email_required`; the `format` rule is spelled\n`error.<field>_invalid`), multiple violations joined with `\"; \"`.\nField names appear verbatim, so clients localise unknown keys via\nthe generic `error.field_<rule>` catalog entries. Other engine\nfailures carry `error.\*` catalog keys as well (e.g.\n`error.invalid_credentials`, `error.passkey_invalid`); a\nnon-`error.` payload is an outcome token (e.g. `user_not_found`)\nthat clients keep verbatim.\n',
         ),
       complete: zod
         .enum(["redirect", "show"])
@@ -1313,21 +1076,27 @@ export const SubmitFlowStepResponse = zod.object({
         .enum(["centered", "split"])
         .default(submitFlowStepResponseBrandingLayoutDefault)
         .describe(
-          "Layout preset selector. The default.liquid master template uses this\nto branch into layout variants. Customers who eject the template\ncan ignore this field entirely.\n",
+          "Layout preset selector. The default.liquid master template uses this\nto branch into layout variants. Customers who eject the template\ncan ignore this field entirely; it also serves as the degrade target\nwhen a custom template fails component-side validation.\n",
         ),
       liquid_template: zod
         .string()
+        .max(submitFlowStepResponseBrandingLiquidTemplateMax)
         .optional()
         .describe(
           "The LiquidJS template string for rendering this step. The orchestrator\nparses this template, injects the capability dictionaries as context,\nand renders the output HTML into its Shadow DOM.\n",
         ),
       logo_url: zod.url().optional().describe("Team logo URL."),
-      font_url: zod.url().optional().describe("Custom font URL (e.g., Google Fonts CSS)."),
+      font_url: zod
+        .url()
+        .optional()
+        .describe(
+          "Custom font stylesheet URL (e.g., Google Fonts CSS). Read-only in\nv1: `POST \/branding` rejects a non-empty value, because the login\ncomponent loads this stylesheet at document level (shadow-scoped\n`@font-face` rules never register faces) and an arbitrary URL would\ngrant `branding.write` page-wide CSS control over the embedding\napplication. Safe tenant font delivery is an ADR 040 follow-up;\nuntil then, load fonts from the embedding page.\n",
+        ),
       hero_url: zod.url().optional().describe("Hero\/background image URL (used by split layout)."),
     })
     .optional()
     .describe(
-      "Resolved branding configuration. Inherited from the app → team → project\nhierarchy at flow creation time (most specific wins). Read-only projection —\nbranding is configured via the Team\/App Branding API, not the Flow API.\n",
+      "Branding configuration. Appears in two places with one shape:\n\n- On flow responses as a read-only projection: the server resolves the\n  latest branding revision for the project per step response (falling\n  back to built-in defaults when none is stored). Branding is configured\n  via the Branding API \/ `zitadel apply`, not the Flow API.\n- As the request body of `POST \/branding`, which publishes the same\n  shape as a new immutable revision (see ADR 040).\n",
     ),
   redirect_uri: zod.url().optional().describe("Present when `step.complete` is `redirect`."),
   handoff_token: zod
@@ -1342,34 +1111,6 @@ export const SubmitFlowStepResponse = zod.object({
     .describe("Expiry timestamp for `handoff_token`. Only present when\n`handoff_token` is set.\n"),
 });
 
-/**
- * Submits telemetry or fingerprint data from the frontend.
-Does not advance the state machine. Used for risk evaluation.
-
- * @summary Submit client-side event
- */
-export const SubmitFlowEventParams = zod.object({
-  id: zod
-    .string()
-    .describe(
-      "Flow ID returned by POST \/flow or the latest POST \/flow\/{id}\/submit.\nUsed to look up the correct flow state from the encrypted cookie,\nwhich can hold multiple concurrent flows. May change between responses\nwhen a flow pivot or pop occurs — always use the `id` from the latest response.\n",
-    ),
-});
-
-export const SubmitFlowEventBody = zod.object({
-  session_token: zod
-    .string()
-    .optional()
-    .describe(
-      "Reserved for future rotation. The sealed `_zflow` cookie carries the flow state today.",
-    ),
-  type: zod.enum(["fingerprint", "telemetry"]),
-  payload: zod
-    .record(zod.string(), zod.unknown())
-    .optional()
-    .describe("Event payload (fingerprint hash, timing data, etc.)."),
-});
-
 /**
  * Starts a new authentication attempt. This is the entry point for the auth_attempts state machine.
 
@@ -1382,7 +1123,7 @@ also include session_id to add factors to an existing session.
  * @summary Create a new authentication attempt
  */
 export const createAuthAttemptBodyProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
-export const createAuthAttemptBodySessionIdOneRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const createAuthAttemptBodySessionIdOneRegExp = new RegExp("^sess_[a-zA-Z0-9_-]+$");
 
 export const CreateAuthAttemptBody = zod
   .object({
@@ -1398,7 +1139,7 @@ export const CreateAuthAttemptBody = zod
         zod
           .string()
           .regex(createAuthAttemptBodySessionIdOneRegExp)
-          .describe("Unique identifier for this session."),
+          .describe("Unique identifier for this session (dialect-minted prefixed opaque string)."),
         zod.null(),
       ])
       .optional()
@@ -1419,7 +1160,7 @@ a federated IdP callback or a device flow).
 
  * @summary Get authentication attempt state
  */
-export const getAuthAttemptPathAttemptIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const getAuthAttemptPathAttemptIdRegExp = new RegExp("^att_[a-zA-Z0-9_-]+$");
 
 export const GetAuthAttemptParams = zod.object({
   attempt_id: zod
@@ -1428,21 +1169,25 @@ export const GetAuthAttemptParams = zod.object({
     .describe("The unique identifier of the authentication attempt"),
 });
 
-export const getAuthAttemptResponseAttemptIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const getAuthAttemptResponseAttemptIdRegExp = new RegExp("^att_[a-zA-Z0-9_-]+$");
 export const getAuthAttemptResponseProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
-export const getAuthAttemptResponseSessionIdOneRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const getAuthAttemptResponseSessionIdOneRegExp = new RegExp("^sess_[a-zA-Z0-9_-]+$");
 export const getAuthAttemptResponseUserIdOneRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
 export const getAuthAttemptResponseCompletedFactorsItemPayloadOneUserIdRegExp = new RegExp(
   "^user_[a-zA-Z0-9_-]+$",
 );
-export const getAuthAttemptResponseChallengesItemChallengeIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const getAuthAttemptResponseChallengesItemChallengeIdRegExp = new RegExp(
+  "^ch_[a-zA-Z0-9_-]+$",
+);
 
 export const GetAuthAttemptResponse = zod
   .object({
     attempt_id: zod
       .string()
       .regex(getAuthAttemptResponseAttemptIdRegExp)
-      .describe("Unique identifier for this authentication attempt"),
+      .describe(
+        "Unique identifier for this authentication attempt (dialect-minted prefixed opaque string).",
+      ),
     project_id: zod.string().regex(getAuthAttemptResponseProjectIdRegExp),
     state: zod
       .enum(["in_progress", "completed", "failed", "expired"])
@@ -1454,7 +1199,7 @@ export const GetAuthAttemptResponse = zod
         zod
           .string()
           .regex(getAuthAttemptResponseSessionIdOneRegExp)
-          .describe("Unique identifier for this session."),
+          .describe("Unique identifier for this session (dialect-minted prefixed opaque string)."),
         zod.null(),
       ])
       .optional()
@@ -1544,7 +1289,9 @@ export const GetAuthAttemptResponse = zod
             challenge_id: zod
               .string()
               .regex(getAuthAttemptResponseChallengesItemChallengeIdRegExp)
-              .describe("Unique identifier for this challenge"),
+              .describe(
+                "Unique identifier for this challenge (dialect-minted prefixed opaque string).",
+              ),
             method: zod
               .enum(["identifier", "password", "passkey"])
               .describe("An authentication factor method."),
@@ -1633,7 +1380,7 @@ by calling POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify.
 
  * @summary Issue a factor challenge
  */
-export const issueChallengePathAttemptIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const issueChallengePathAttemptIdRegExp = new RegExp("^att_[a-zA-Z0-9_-]+$");
 
 export const IssueChallengeParams = zod.object({
   attempt_id: zod
@@ -1684,8 +1431,8 @@ The attempt moves to the next pending challenge or completes if all required fac
 
  * @summary Verify a factor proof
  */
-export const verifyChallengeProofPathAttemptIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
-export const verifyChallengeProofPathChallengeIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const verifyChallengeProofPathAttemptIdRegExp = new RegExp("^att_[a-zA-Z0-9_-]+$");
+export const verifyChallengeProofPathChallengeIdRegExp = new RegExp("^ch_[a-zA-Z0-9_-]+$");
 
 export const VerifyChallengeProofParams = zod.object({
   attempt_id: zod
@@ -1735,15 +1482,15 @@ export const VerifyChallengeProofBody = zod
     "Proof for verifying a factor challenge.\n\nThe exact format depends on the challenge method. The proof object should contain\nonly the credential\/code\/assertion relevant to the challenge method being verified.\n",
   );
 
-export const verifyChallengeProofResponseAttemptIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const verifyChallengeProofResponseAttemptIdRegExp = new RegExp("^att_[a-zA-Z0-9_-]+$");
 export const verifyChallengeProofResponseProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
-export const verifyChallengeProofResponseSessionIdOneRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const verifyChallengeProofResponseSessionIdOneRegExp = new RegExp("^sess_[a-zA-Z0-9_-]+$");
 export const verifyChallengeProofResponseUserIdOneRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
 export const verifyChallengeProofResponseCompletedFactorsItemPayloadOneUserIdRegExp = new RegExp(
   "^user_[a-zA-Z0-9_-]+$",
 );
 export const verifyChallengeProofResponseChallengesItemChallengeIdRegExp = new RegExp(
-  "^[a-zA-Z0-9_-]+$",
+  "^ch_[a-zA-Z0-9_-]+$",
 );
 
 export const VerifyChallengeProofResponse = zod
@@ -1751,7 +1498,9 @@ export const VerifyChallengeProofResponse = zod
     attempt_id: zod
       .string()
       .regex(verifyChallengeProofResponseAttemptIdRegExp)
-      .describe("Unique identifier for this authentication attempt"),
+      .describe(
+        "Unique identifier for this authentication attempt (dialect-minted prefixed opaque string).",
+      ),
     project_id: zod.string().regex(verifyChallengeProofResponseProjectIdRegExp),
     state: zod
       .enum(["in_progress", "completed", "failed", "expired"])
@@ -1763,7 +1512,7 @@ export const VerifyChallengeProofResponse = zod
         zod
           .string()
           .regex(verifyChallengeProofResponseSessionIdOneRegExp)
-          .describe("Unique identifier for this session."),
+          .describe("Unique identifier for this session (dialect-minted prefixed opaque string)."),
         zod.null(),
       ])
       .optional()
@@ -1855,7 +1604,9 @@ export const VerifyChallengeProofResponse = zod
             challenge_id: zod
               .string()
               .regex(verifyChallengeProofResponseChallengesItemChallengeIdRegExp)
-              .describe("Unique identifier for this challenge"),
+              .describe(
+                "Unique identifier for this challenge (dialect-minted prefixed opaque string).",
+              ),
             method: zod
               .enum(["identifier", "password", "passkey"])
               .describe("An authentication factor method."),
@@ -1948,7 +1699,7 @@ The handoff token is:
 
  * @summary Complete authentication and create handoff token
  */
-export const createHandoffPathAttemptIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const createHandoffPathAttemptIdRegExp = new RegExp("^att_[a-zA-Z0-9_-]+$");
 
 export const CreateHandoffParams = zod.object({
   attempt_id: zod
@@ -1986,11 +1737,11 @@ export const createProjectBodySeedDefaultsDefault = true;
 
 export const CreateProjectBody = zod.object({
   name: zod.string().describe("The name of the project."),
-  previewOrigins: zod
+  preview_origins: zod
     .array(zod.string())
     .optional()
     .describe("Origins which are allowed for previewing and testing the project.\n"),
-  seedDefaults: zod
+  seed_defaults: zod
     .boolean()
     .default(createProjectBodySeedDefaultsDefault)
     .describe(
@@ -2014,17 +1765,19 @@ export const QueryProjectsBody = zod
     page_token: zod
       .union([zod.string(), zod.null()])
       .optional()
-      .describe("Token to retrieve the next page of results."),
+      .describe(
+        "Token to retrieve the next page of results. Must be sent with the same\n`sorting` as the request that issued the token. Omitting `sorting` reuses\nthe default sort and only succeeds when that default matches the token.\n",
+      ),
     sorting: zod
       .object({
-        field: zod.enum(["name", "createdAt"]),
+        field: zod.enum(["created_at"]),
         direction: zod.enum(["asc", "desc"]),
       })
       .optional(),
     filter: zod
       .array(
         zod.object({
-          field: zod.enum(["name", "createdAt"]),
+          field: zod.enum(["created_at"]),
           value: zod
             .union([zod.string(), zod.number(), zod.boolean(), zod.null()])
             .optional()
@@ -2059,14 +1812,14 @@ export const QueryProjectsResponse = zod
         .object({
           id: zod.string().describe("The unique identifier of the project."),
           name: zod.string().describe("The name of the project."),
-          previewOrigins: zod
+          preview_origins: zod
             .array(zod.string())
             .optional()
             .describe("Origins which are allowed for previewing and testing the project.\n"),
-          createdAt: zod.iso
+          created_at: zod.iso
             .datetime({ offset: true })
             .describe("The time when the project was created."),
-          updatedAt: zod.iso
+          updated_at: zod.iso
             .datetime({ offset: true })
             .describe("The time when the project was last updated."),
         })
@@ -2076,7 +1829,7 @@ export const QueryProjectsResponse = zod
       .union([zod.string(), zod.null()])
       .optional()
       .describe(
-        "Token to pass as `page_token` in the next request to fetch the following page.\nAbsent when there are no more results.\n",
+        "Token to pass as `page_token` in the next request to fetch the following page.\nAbsent when there are no more results. The follow-up request must repeat the\nsame `sorting` that produced this token (omit only when both pages use the default).\n",
       ),
   })
   .describe("Paginated list of projects.");
@@ -2096,14 +1849,14 @@ export const GetProjectResponse = zod
   .object({
     id: zod.string().describe("The unique identifier of the project."),
     name: zod.string().describe("The name of the project."),
-    previewOrigins: zod
+    preview_origins: zod
       .array(zod.string())
       .optional()
       .describe("Origins which are allowed for previewing and testing the project.\n"),
-    createdAt: zod.iso
+    created_at: zod.iso
       .datetime({ offset: true })
       .describe("The time when the project was created."),
-    updatedAt: zod.iso
+    updated_at: zod.iso
       .datetime({ offset: true })
       .describe("The time when the project was last updated."),
   })
@@ -2128,18 +1881,120 @@ export const PatchProjectResponse = zod
   .object({
     id: zod.string().describe("The unique identifier of the project."),
     name: zod.string().describe("The name of the project."),
-    previewOrigins: zod
+    preview_origins: zod
       .array(zod.string())
       .optional()
       .describe("Origins which are allowed for previewing and testing the project.\n"),
-    createdAt: zod.iso
+    created_at: zod.iso
       .datetime({ offset: true })
       .describe("The time when the project was created."),
-    updatedAt: zod.iso
+    updated_at: zod.iso
       .datetime({ offset: true })
       .describe("The time when the project was last updated."),
   })
-  .describe("The current state of a project.");
+  .describe("The current state of a project.");
+
+/**
+ * Starts a claim challenge for an unclaimed project. Authenticated by the
+project secret, this mints a single-use, short-lived challenge and returns
+the `claim_url` the developer opens in a browser to complete the claim,
+together with the `challenge_id` the CLI polls with. The exact expiry is
+carried by `expires_at` on the response.
+
+ * @summary Initialize a project claim
+ */
+export const initClaimPathProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const InitClaimParams = zod.object({
+  project_id: zod.string().regex(initClaimPathProjectIdRegExp),
+});
+
+/**
+ * Polled by the CLI while a browser completes the claim. Authorized by the
+project secret that initiated the challenge. Returns `pending`, or
+`completed` with the owning team, the claim timestamp, and the dashboard
+URL once the browser leg has finished.
+
+ * @summary Get claim status
+ */
+export const getClaimStatusPathProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const GetClaimStatusParams = zod.object({
+  project_id: zod.string().regex(getClaimStatusPathProjectIdRegExp),
+});
+
+export const getClaimStatusQueryChallengeIdRegExp = new RegExp("^ch_[a-zA-Z0-9_-]+$");
+
+export const GetClaimStatusQueryParams = zod.strictObject({
+  challenge_id: zod
+    .string()
+    .regex(getClaimStatusQueryChallengeIdRegExp)
+    .describe("The challenge minted by the matching claim init."),
+});
+
+export const getClaimStatusResponseTwoTeamIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const GetClaimStatusResponse = zod
+  .union([
+    zod
+      .object({
+        status: zod.enum(["pending"]).describe("The claim has not completed yet."),
+      })
+      .describe("A claim challenge that is still awaiting the browser leg."),
+    zod
+      .object({
+        status: zod.enum(["completed"]).describe("The claim has completed."),
+        team_id: zod.string().regex(getClaimStatusResponseTwoTeamIdRegExp),
+        claimed_at: zod.iso
+          .datetime({ offset: true })
+          .describe("The time when the project was claimed."),
+        dashboard_url: zod.url().describe("The dashboard URL for the owning team."),
+      })
+      .describe(
+        "A completed claim. Carries the owning team, when the claim landed, and the\ndashboard where it can be managed, so a generated client can rely on those\nfields being present whenever `status` is `completed`.\n",
+      ),
+  ])
+  .describe(
+    "The state of a claim challenge. While pending it carries only `status`; once\ncompleted it also carries the owning team, the claim timestamp, and the\ndashboard URL. Modelled as discriminated variants so a `pending` response can\nnever carry stale completion fields and a `completed` response always carries\nthem.\n",
+  );
+
+/**
+ * Called by the browser after the developer authenticates on the claim page.
+Authenticated by the `__nextgen_session` cookie, it attaches the project to
+the developer's personal team using the `challenge_id` from the claim URL as
+its single-use, browser-safe authorization.
+
+ * @summary Complete a project claim
+ */
+export const completeClaimPathProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const CompleteClaimParams = zod.object({
+  project_id: zod.string().regex(completeClaimPathProjectIdRegExp),
+});
+
+export const completeClaimBodyChallengeIdRegExp = new RegExp("^ch_[a-zA-Z0-9_-]+$");
+
+export const CompleteClaimBody = zod
+  .object({
+    challenge_id: zod
+      .string()
+      .regex(completeClaimBodyChallengeIdRegExp)
+      .describe("Unique identifier for this challenge (dialect-minted prefixed opaque string)."),
+  })
+  .describe("The request to complete a project claim.");
+
+export const completeClaimResponseProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const completeClaimResponseTeamIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const CompleteClaimResponse = zod
+  .object({
+    project_id: zod.string().regex(completeClaimResponseProjectIdRegExp),
+    team_id: zod.string().regex(completeClaimResponseTeamIdRegExp),
+    claimed_at: zod.iso
+      .datetime({ offset: true })
+      .describe("The time when the project was claimed."),
+  })
+  .describe("The result of a completed project claim.");
 
 /**
  * Creates an anonymous session shell with no user and no factors (`state: building`).
@@ -2150,8 +2005,16 @@ Use this explicitly when you want to:
   can be correlated with the eventual authenticated session from the start.
 - Track anonymous state (bot detection, device fingerprint) that survives until authentication.
 
-The returned `session_token` authorises GET and DELETE on this session.
-It is superseded when a handoff exchange completes — clients must replace it at that point.
+Creating a session is an app-plane operation on the project credential
+(`session.write`). The returned `session_token` is a session credential for the
+end-user client, not a management scope: it is delivered as the
+`__nextgen_session` cookie and authorises the self-service operations
+`GET /sessions/me` and `DELETE /sessions/me` (`nextgenSession` scheme). The
+by-id operations `GET /sessions/{session_id}` and `DELETE /sessions/{session_id}`
+are operator endpoints and require `session.read` / `session.delete` instead.
+
+The `session_token` is superseded when a handoff exchange completes — clients must
+replace it at that point.
 
 Anonymous sessions expire aggressively (10-minute TTL). The TTL resets to the configured
 full session TTL when the first authentication factor is written via a completing `auth_attempt`.
@@ -2176,70 +2039,107 @@ export const CreateSessionBody = zod
   .describe("Request to create an anonymous session shell.");
 
 /**
- * Returns a paginated list of sessions for a project.
-Requires a project service key (OAuth2 client credentials).
+ * Returns the sessions of a project, paginated with a cursor.
+Sessions of every lifecycle state are returned; each carries its `state`.
+Requires `session.read` permission.
 
- * @summary List sessions
+ * @summary Query sessions
  */
-export const listSessionsQueryLimitDefault = 20;
-export const listSessionsQueryLimitMax = 100;
-
-export const listSessionsQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
-export const listSessionsQueryUserIdRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
+export const querySessionsQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
 
-export const ListSessionsQueryParams = zod.strictObject({
-  limit: zod
-    .number()
-    .min(1)
-    .max(listSessionsQueryLimitMax)
-    .default(listSessionsQueryLimitDefault)
-    .describe("Maximum number of items to return."),
-  page_token: zod
-    .string()
-    .optional()
-    .describe(
-      "Token for fetching the next page of results.\nObtain this value from `next_page_token` in the previous response.\nOmit to start from the beginning.\nIts format is opaque and may change between releases.\n",
-    ),
+export const QuerySessionsQueryParams = zod.strictObject({
   project_id: zod
     .string()
-    .regex(listSessionsQueryProjectIdRegExp)
+    .regex(querySessionsQueryProjectIdRegExp)
     .describe("The unique identifier of the project"),
-  state: zod
-    .enum(["building", "active", "expired", "revoked"])
-    .optional()
-    .describe("Filter sessions by lifecycle state."),
-  user_id: zod
-    .string()
-    .regex(listSessionsQueryUserIdRegExp)
-    .optional()
-    .describe("Filter sessions by user."),
 });
 
-export const listSessionsResponseSessionsItemSessionIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
-export const listSessionsResponseSessionsItemProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
-export const listSessionsResponseSessionsItemUserIdOneRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
-export const listSessionsResponseSessionsItemFactorsItemPayloadOneUserIdRegExp = new RegExp(
+export const querySessionsBodyLimitDefault = 20;
+export const querySessionsBodyLimitMax = 100;
+
+export const QuerySessionsBody = zod
+  .object({
+    limit: zod
+      .number()
+      .min(1)
+      .max(querySessionsBodyLimitMax)
+      .default(querySessionsBodyLimitDefault),
+    page_token: zod
+      .union([zod.string(), zod.null()])
+      .optional()
+      .describe("Token to retrieve the next page of results."),
+    sorting: zod
+      .object({
+        field: zod
+          .enum(["created_at", "user_id"])
+          .describe(
+            "Field to sort sessions by. Only stored columns are sortable: the keyset\ncursor holds the last row's sort values, so a computed value such as\n`state` would skip or duplicate rows between pages.\n",
+          ),
+        direction: zod.enum(["asc", "desc"]),
+      })
+      .optional(),
+    filter: zod
+      .array(
+        zod.object({
+          field: zod
+            .enum(["created_at", "user_id", "state"])
+            .describe(
+              "Field to filter sessions by:\n- `created_at`: RFC3339 timestamp\n- `user_id`: user id\n- `state`: one of `building`, `active`, `expired`\n",
+            ),
+          value: zod
+            .union([zod.string(), zod.number(), zod.boolean(), zod.null()])
+            .optional()
+            .describe(
+              "Filter-value specifies which values can be filtered by a query endpoint. This\nis a union of types. When a value is specified which is not assignable to the\nfield which is being filtered, a 400 error will be returned.\n",
+            ),
+          operation: zod
+            .enum([
+              "equals",
+              "not_equals",
+              "contains",
+              "not_contains",
+              "less_than",
+              "less_than_or_equal",
+              "greater_than",
+              "greater_than_or_equal",
+            ])
+            .describe(
+              "Filter operation defines the operations which can be used when filtering on a\nquery endpoint.\n",
+            ),
+        }),
+      )
+      .optional()
+      .describe("Filter criteria for querying sessions."),
+  })
+  .describe("Request to query the sessions of a project.");
+
+export const querySessionsResponseSessionsItemSessionIdRegExp = new RegExp("^sess_[a-zA-Z0-9_-]+$");
+export const querySessionsResponseSessionsItemProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const querySessionsResponseSessionsItemUserIdOneRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
+export const querySessionsResponseSessionsItemFactorsItemPayloadOneUserIdRegExp = new RegExp(
   "^user_[a-zA-Z0-9_-]+$",
 );
 
-export const ListSessionsResponse = zod
+export const QuerySessionsResponse = zod
   .object({
     sessions: zod.array(
       zod
         .object({
           session_id: zod
             .string()
-            .regex(listSessionsResponseSessionsItemSessionIdRegExp)
-            .describe("Unique identifier for this session."),
-          project_id: zod.string().regex(listSessionsResponseSessionsItemProjectIdRegExp),
+            .regex(querySessionsResponseSessionsItemSessionIdRegExp)
+            .describe(
+              "Unique identifier for this session (dialect-minted prefixed opaque string).",
+            ),
+          project_id: zod.string().regex(querySessionsResponseSessionsItemProjectIdRegExp),
           state: zod
-            .enum(["building", "active", "expired", "revoked"])
+            .enum(["building", "active", "expired"])
             .describe(
-              "Current lifecycle state of the session:\n- `building`: has a user factor but is still gathering authentication factors\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n- `revoked`: explicitly revoked via DELETE\n",
+              "Current lifecycle state of the session:\n- `building`: has a user factor but is still gathering authentication factors\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n",
             ),
           user_id: zod
             .union([
-              zod.string().regex(listSessionsResponseSessionsItemUserIdOneRegExp),
+              zod.string().regex(querySessionsResponseSessionsItemUserIdOneRegExp),
               zod.null(),
             ])
             .optional()
@@ -2275,7 +2175,7 @@ export const ListSessionsResponse = zod
                           user_id: zod
                             .string()
                             .regex(
-                              listSessionsResponseSessionsItemFactorsItemPayloadOneUserIdRegExp,
+                              querySessionsResponseSessionsItemFactorsItemPayloadOneUserIdRegExp,
                             ),
                         })
                         .describe("Identifier-specific factor metadata"),
@@ -2420,7 +2320,7 @@ export const ExchangeHandoffBody = zod
   })
   .describe("Request to exchange a handoff token for a session and session_token.");
 
-export const exchangeHandoffResponseSessionSessionIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const exchangeHandoffResponseSessionSessionIdRegExp = new RegExp("^sess_[a-zA-Z0-9_-]+$");
 export const exchangeHandoffResponseSessionProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
 export const exchangeHandoffResponseSessionUserIdOneRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
 export const exchangeHandoffResponseSessionFactorsItemPayloadOneUserIdRegExp = new RegExp(
@@ -2434,12 +2334,12 @@ export const ExchangeHandoffResponse = zod
         session_id: zod
           .string()
           .regex(exchangeHandoffResponseSessionSessionIdRegExp)
-          .describe("Unique identifier for this session."),
+          .describe("Unique identifier for this session (dialect-minted prefixed opaque string)."),
         project_id: zod.string().regex(exchangeHandoffResponseSessionProjectIdRegExp),
         state: zod
-          .enum(["building", "active", "expired", "revoked"])
+          .enum(["building", "active", "expired"])
           .describe(
-            "Current lifecycle state of the session:\n- `building`: has a user factor but is still gathering authentication factors\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n- `revoked`: explicitly revoked via DELETE\n",
+            "Current lifecycle state of the session:\n- `building`: has a user factor but is still gathering authentication factors\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n",
           ),
         user_id: zod
           .union([zod.string().regex(exchangeHandoffResponseSessionUserIdOneRegExp), zod.null()])
@@ -2568,7 +2468,7 @@ against the same `session_id`) to restore a dropped assurance level.
 
  * @summary Get session state
  */
-export const getSessionPathSessionIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const getSessionPathSessionIdRegExp = new RegExp("^sess_[a-zA-Z0-9_-]+$");
 
 export const GetSessionParams = zod.object({
   session_id: zod
@@ -2586,7 +2486,7 @@ export const GetSessionQueryParams = zod.strictObject({
     .describe("The unique identifier of the project"),
 });
 
-export const getSessionResponseSessionIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const getSessionResponseSessionIdRegExp = new RegExp("^sess_[a-zA-Z0-9_-]+$");
 export const getSessionResponseProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
 export const getSessionResponseUserIdOneRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
 export const getSessionResponseFactorsItemPayloadOneUserIdRegExp = new RegExp(
@@ -2598,12 +2498,12 @@ export const GetSessionResponse = zod
     session_id: zod
       .string()
       .regex(getSessionResponseSessionIdRegExp)
-      .describe("Unique identifier for this session."),
+      .describe("Unique identifier for this session (dialect-minted prefixed opaque string)."),
     project_id: zod.string().regex(getSessionResponseProjectIdRegExp),
     state: zod
-      .enum(["building", "active", "expired", "revoked"])
+      .enum(["building", "active", "expired"])
       .describe(
-        "Current lifecycle state of the session:\n- `building`: has a user factor but is still gathering authentication factors\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n- `revoked`: explicitly revoked via DELETE\n",
+        "Current lifecycle state of the session:\n- `building`: has a user factor but is still gathering authentication factors\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n",
       ),
     user_id: zod
       .union([zod.string().regex(getSessionResponseUserIdOneRegExp), zod.null()])
@@ -2714,14 +2614,19 @@ export const GetSessionResponse = zod
   );
 
 /**
- * Revokes the session immediately (`state: revoked`). This is the logout operation.
+ * Permanently deletes the session, terminating it immediately.
+
+This is the operator revoke path and requires the `session.delete` scope on a
+project-bound credential. End-user logout with the `__nextgen_session` cookie is
+`DELETE /sessions/me` (`nextgenSession` scheme).
 
-The session_token issued at creation (or superseded by a handoff exchange) is required.
-After revocation, any tokens derived from this session are invalidated.
+Idempotent: deleting a session that does not exist (or was already deleted)
+still returns 204. After deletion, any tokens derived from the session are
+invalidated.
 
  * @summary Revoke session
  */
-export const revokeSessionPathSessionIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const revokeSessionPathSessionIdRegExp = new RegExp("^sess_[a-zA-Z0-9_-]+$");
 
 export const RevokeSessionParams = zod.object({
   session_id: zod
@@ -2749,7 +2654,7 @@ against the same `session_id`) to restore a dropped assurance level.
 
  * @summary Get my session state
  */
-export const getMySessionResponseSessionIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const getMySessionResponseSessionIdRegExp = new RegExp("^sess_[a-zA-Z0-9_-]+$");
 export const getMySessionResponseProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
 export const getMySessionResponseUserIdOneRegExp = new RegExp("^user_[a-zA-Z0-9_-]+$");
 export const getMySessionResponseFactorsItemPayloadOneUserIdRegExp = new RegExp(
@@ -2761,12 +2666,12 @@ export const GetMySessionResponse = zod
     session_id: zod
       .string()
       .regex(getMySessionResponseSessionIdRegExp)
-      .describe("Unique identifier for this session."),
+      .describe("Unique identifier for this session (dialect-minted prefixed opaque string)."),
     project_id: zod.string().regex(getMySessionResponseProjectIdRegExp),
     state: zod
-      .enum(["building", "active", "expired", "revoked"])
+      .enum(["building", "active", "expired"])
       .describe(
-        "Current lifecycle state of the session:\n- `building`: has a user factor but is still gathering authentication factors\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n- `revoked`: explicitly revoked via DELETE\n",
+        "Current lifecycle state of the session:\n- `building`: has a user factor but is still gathering authentication factors\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n",
       ),
     user_id: zod
       .union([zod.string().regex(getMySessionResponseUserIdOneRegExp), zod.null()])
@@ -2877,10 +2782,12 @@ export const GetMySessionResponse = zod
   );
 
 /**
- * Create a new schema. The schema definition must include a unique $id field,
-which will be used to identify the schema in future requests. The $id must
-be a valid URI and should ideally point to the location where the schema
-can be accessed.
+ * Create a new schema. The optional `$id` field is the JSON Schema document
+URI used to identify the schema in future requests (GitOps-stable identity,
+not a free-form resource primary key). When `$id` is omitted, the server
+generates a `sch_*` URL. When provided, `$id` must be unique within the
+project and should ideally be a valid URI pointing at where the schema can
+be accessed.
 
 The schema can either be a concrete schema, e.g. a user schema, or a
 schema-url which will be resolved by the server.
@@ -3027,16 +2934,16 @@ export const CreateSchemaBody = zod.union([
               "x-mfa": zod
                 .boolean()
                 .default(createSchemaBodyOnePropertiesXMfaDefault)
-                .describe("Whether this property is used for multi-factor authentication or not"),
+                .describe("Whether this property is used for multi-factor authentication or not\n"),
               properties: zod
                 .record(zod.string(), zod.unknown())
                 .optional()
                 .describe(
-                  "A map of additional properties for the user definition, where the key is the property name and the value is the property schema",
+                  "A map of additional properties for the user definition, where the key is\nthe property name and the value is the property schema.\n",
                 ),
             })
             .describe(
-              'This schema is missing `\"allOf\": [{\"$ref\": \"https:\/\/json-schema.org\/draft\/2020-12\/schema\"}],`. \nThis is done because a lot of code generators cannot handle that.\n',
+              'This schema is missing `\"allOf\": [{\"$ref\": \"https:\/\/json-schema.org\/draft\/2020-12\/schema\"}],`. \nThis is done because a lot of code generators cannot handle that.\n\nA few properties are reserved:\n- id: is used to return the id of the user \n- metadata: is used to embed metadata of the user, like creation date, \n  status,... in a return object\n',
             ),
         )
         .optional()
@@ -3096,7 +3003,7 @@ export const ListSchemasQueryParams = zod.strictObject({
 
 export const ListSchemasResponseItem = zod.object({
   id: zod.string().describe("The unique identifier for this schema."),
-  createdAt: zod.iso.datetime({ offset: true }),
+  created_at: zod.iso.datetime({ offset: true }),
 });
 export const ListSchemasResponse = zod.array(ListSchemasResponseItem);
 
@@ -3237,16 +3144,16 @@ export const GetSchemaByIdResponse = zod
             "x-mfa": zod
               .boolean()
               .default(getSchemaByIdResponseOnePropertiesXMfaDefault)
-              .describe("Whether this property is used for multi-factor authentication or not"),
+              .describe("Whether this property is used for multi-factor authentication or not\n"),
             properties: zod
               .record(zod.string(), zod.unknown())
               .optional()
               .describe(
-                "A map of additional properties for the user definition, where the key is the property name and the value is the property schema",
+                "A map of additional properties for the user definition, where the key is\nthe property name and the value is the property schema.\n",
               ),
           })
           .describe(
-            'This schema is missing `\"allOf\": [{\"$ref\": \"https:\/\/json-schema.org\/draft\/2020-12\/schema\"}],`. \nThis is done because a lot of code generators cannot handle that.\n',
+            'This schema is missing `\"allOf\": [{\"$ref\": \"https:\/\/json-schema.org\/draft\/2020-12\/schema\"}],`. \nThis is done because a lot of code generators cannot handle that.\n\nA few properties are reserved:\n- id: is used to return the id of the user \n- metadata: is used to embed metadata of the user, like creation date, \n  status,... in a return object\n',
           ),
       )
       .optional()
@@ -4200,60 +4107,123 @@ export const DeleteFlowDefinitionQueryParams = zod.strictObject({
 });
 
 /**
- * Activate a flow definition by transitioning it from a `draft` state to an `active` state.
-Alternatively, the status of a flow definition can also be set via the `POST /flow_definitions` and `PUT /flow_definitions/{id}` endpoints by setting the `status` attribute in the flow definition payload.
-
- * @summary Activate a flow definition by ID.
+ * @summary Create team
  */
-export const ActivateFlowDefinitionParams = zod.object({
-  id: zod.string().describe("The id returned by the POST \/flow_definitions endpoint.\n"),
-});
-
-export const activateFlowDefinitionQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const createTeamQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
 
-export const ActivateFlowDefinitionQueryParams = zod.strictObject({
+export const CreateTeamQueryParams = zod.strictObject({
   project_id: zod
     .string()
-    .regex(activateFlowDefinitionQueryProjectIdRegExp)
+    .regex(createTeamQueryProjectIdRegExp)
     .describe("The unique identifier of the project"),
 });
 
-/**
- * Deactivates a flow definition in the `active` state by transitioning it to the `draft` state.
-Flow definitions in `draft` state cannot be used to start new flows. Existing flows that use the deactivated flow definition must gracefully handle this.
-Alternatively, the status of a flow definition can also be set via the `POST /flow_definitions` and `PUT /flow_definitions/{id}` endpoints by setting the `status` attribute in the flow definition payload.
-
- * @summary Deactivate a flow definition by ID.
- */
-export const DeactivateFlowDefinitionParams = zod.object({
-  id: zod.string().describe("The id returned by the POST \/flow_definitions endpoint.\n"),
-});
-
-export const deactivateFlowDefinitionQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const createTeamBodyNameMax = 200;
 
-export const DeactivateFlowDefinitionQueryParams = zod.strictObject({
-  project_id: zod
+export const CreateTeamBody = zod.object({
+  name: zod
     .string()
-    .regex(deactivateFlowDefinitionQueryProjectIdRegExp)
-    .describe("The unique identifier of the project"),
+    .min(1)
+    .max(createTeamBodyNameMax)
+    .describe("The name of the team. Must be unique within the project."),
 });
 
 /**
- * @summary Create team
+ * Returns the teams of a project, paginated with a cursor.
+Teams of every lifecycle status are returned; each carries its `status`.
+
+ * @summary Query teams
  */
-export const createTeamQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+export const queryTeamsQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
 
-export const CreateTeamQueryParams = zod.strictObject({
+export const QueryTeamsQueryParams = zod.strictObject({
   project_id: zod
     .string()
-    .regex(createTeamQueryProjectIdRegExp)
+    .regex(queryTeamsQueryProjectIdRegExp)
     .describe("The unique identifier of the project"),
 });
 
-export const CreateTeamBody = zod.looseObject({});
+export const queryTeamsBodyLimitDefault = 20;
+export const queryTeamsBodyLimitMax = 100;
+
+export const QueryTeamsBody = zod
+  .object({
+    limit: zod.number().min(1).max(queryTeamsBodyLimitMax).default(queryTeamsBodyLimitDefault),
+    page_token: zod
+      .union([zod.string(), zod.null()])
+      .optional()
+      .describe(
+        "Token to retrieve the next page of results. Must be sent with the same\n`sorting` as the request that issued the token. Omitting `sorting` reuses\nthe default sort and only succeeds when that default matches the token.\n",
+      ),
+    sorting: zod
+      .object({
+        field: zod.enum(["created_at"]),
+        direction: zod.enum(["asc", "desc"]),
+      })
+      .optional(),
+    filter: zod
+      .array(
+        zod.object({
+          field: zod.enum(["created_at"]),
+          value: zod
+            .union([zod.string(), zod.number(), zod.boolean(), zod.null()])
+            .optional()
+            .describe(
+              "Filter-value specifies which values can be filtered by a query endpoint. This\nis a union of types. When a value is specified which is not assignable to the\nfield which is being filtered, a 400 error will be returned.\n",
+            ),
+          operation: zod
+            .enum([
+              "equals",
+              "not_equals",
+              "contains",
+              "not_contains",
+              "less_than",
+              "less_than_or_equal",
+              "greater_than",
+              "greater_than_or_equal",
+            ])
+            .describe(
+              "Filter operation defines the operations which can be used when filtering on a\nquery endpoint.\n",
+            ),
+        }),
+      )
+      .optional()
+      .describe("Filter criteria for querying teams."),
+  })
+  .describe("Request to query the teams of a project.");
+
+export const QueryTeamsResponse = zod
+  .object({
+    teams: zod.array(
+      zod
+        .object({
+          id: zod.string().describe("The unique identifier of the team."),
+          name: zod.string().describe("The name of the team."),
+          status: zod
+            .enum(["active", "deactivated"])
+            .describe(
+              "The lifecycle state of a team.\n\nactive: The team is available for use.\ndeactivated: The team is no longer active but is retained for historical and audit purposes.\n",
+            ),
+          created_at: zod.iso
+            .datetime({ offset: true })
+            .describe("The time when the team was created."),
+          updated_at: zod.iso
+            .datetime({ offset: true })
+            .describe("The time when the team was last updated."),
+        })
+        .describe("Details of a team."),
+    ),
+    next_page_token: zod
+      .union([zod.string(), zod.null()])
+      .optional()
+      .describe(
+        "Token to pass as `page_token` in the next request to fetch the following page.\nAbsent when there are no more results. The follow-up request must repeat the\nsame `sorting` that produced this token (omit only when both pages use the default).\n",
+      ),
+  })
+  .describe("Paginated list of teams.");
 
 /**
- * Returns the current state of a team.
+ * Returns a Team by its id.
 
  * @summary Get team
  */
@@ -4275,9 +4245,225 @@ export const GetTeamQueryParams = zod.strictObject({
 export const GetTeamResponse = zod
   .object({
     id: zod.string().describe("The unique identifier of the team."),
-    createdAt: zod.iso.datetime({ offset: true }).describe("The time when the team was created."),
-    updatedAt: zod.iso
+    name: zod.string().describe("The name of the team."),
+    status: zod
+      .enum(["active", "deactivated"])
+      .describe(
+        "The lifecycle state of a team.\n\nactive: The team is available for use.\ndeactivated: The team is no longer active but is retained for historical and audit purposes.\n",
+      ),
+    created_at: zod.iso.datetime({ offset: true }).describe("The time when the team was created."),
+    updated_at: zod.iso
+      .datetime({ offset: true })
+      .describe("The time when the team was last updated."),
+  })
+  .describe("Details of a team.");
+
+/**
+ * Deactivates the team.
+
+The team is tombstoned rather than erased: it stays readable through
+getTeam with status `deactivated`. Its memberships are removed and the
+users whose lifecycle it owns are deactivated with it.
+
+The request is idempotent. Deleting a team that is already deactivated
+or doesn't exist succeeds without changing anything.
+
+ * @summary Delete team
+ */
+export const deleteTeamPathTeamIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const DeleteTeamParams = zod.object({
+  team_id: zod.string().regex(deleteTeamPathTeamIdRegExp),
+});
+
+export const deleteTeamQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const DeleteTeamQueryParams = zod.strictObject({
+  project_id: zod
+    .string()
+    .regex(deleteTeamQueryProjectIdRegExp)
+    .describe("The unique identifier of the project"),
+});
+
+/**
+ * Update team. Only active teams can be updated.
+
+ * @summary Update team
+ */
+export const updateTeamPathTeamIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const UpdateTeamParams = zod.object({
+  team_id: zod.string().regex(updateTeamPathTeamIdRegExp),
+});
+
+export const updateTeamQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const UpdateTeamQueryParams = zod.strictObject({
+  project_id: zod
+    .string()
+    .regex(updateTeamQueryProjectIdRegExp)
+    .describe("The unique identifier of the project"),
+});
+
+export const updateTeamBodyNameMax = 200;
+
+export const UpdateTeamBody = zod.object({
+  name: zod
+    .string()
+    .min(1)
+    .max(updateTeamBodyNameMax)
+    .optional()
+    .describe("The name of the team. Must be unique within the project."),
+});
+
+export const UpdateTeamResponse = zod
+  .object({
+    id: zod.string().describe("The unique identifier of the team."),
+    name: zod.string().describe("The name of the team."),
+    status: zod
+      .enum(["active", "deactivated"])
+      .describe(
+        "The lifecycle state of a team.\n\nactive: The team is available for use.\ndeactivated: The team is no longer active but is retained for historical and audit purposes.\n",
+      ),
+    created_at: zod.iso.datetime({ offset: true }).describe("The time when the team was created."),
+    updated_at: zod.iso
       .datetime({ offset: true })
       .describe("The time when the team was last updated."),
   })
-  .describe("The current state of a team.");
+  .describe("Details of a team.");
+
+/**
+ * Publishes a new immutable branding revision for the project. Branding
+revisions cannot be updated or deleted; every edit publishes a new
+revision, and flow responses resolve the latest revision per project
+(see ADR 040).
+
+The `liquid_template` is validated lexically on save (size, encoding,
+banned patterns such as `<script>` tags, inline event handlers, and the
+`| raw` filter). Authoritative LiquidJS validation runs at authoring
+time via `zitadel plan` / `zitadel apply`.
+
+ * @summary Publish a new branding revision
+ */
+export const createBrandingQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const CreateBrandingQueryParams = zod.strictObject({
+  project_id: zod
+    .string()
+    .regex(createBrandingQueryProjectIdRegExp)
+    .describe("The unique identifier of the project"),
+});
+
+export const createBrandingBodyLayoutDefault = `centered`;
+export const createBrandingBodyLiquidTemplateMax = 131072;
+
+export const CreateBrandingBody = zod
+  .object({
+    layout: zod
+      .enum(["centered", "split"])
+      .default(createBrandingBodyLayoutDefault)
+      .describe(
+        "Layout preset selector. The default.liquid master template uses this\nto branch into layout variants. Customers who eject the template\ncan ignore this field entirely; it also serves as the degrade target\nwhen a custom template fails component-side validation.\n",
+      ),
+    liquid_template: zod
+      .string()
+      .max(createBrandingBodyLiquidTemplateMax)
+      .optional()
+      .describe(
+        "The LiquidJS template string for rendering this step. The orchestrator\nparses this template, injects the capability dictionaries as context,\nand renders the output HTML into its Shadow DOM.\n",
+      ),
+    logo_url: zod.url().optional().describe("Team logo URL."),
+    font_url: zod
+      .url()
+      .optional()
+      .describe(
+        "Custom font stylesheet URL (e.g., Google Fonts CSS). Read-only in\nv1: `POST \/branding` rejects a non-empty value, because the login\ncomponent loads this stylesheet at document level (shadow-scoped\n`@font-face` rules never register faces) and an arbitrary URL would\ngrant `branding.write` page-wide CSS control over the embedding\napplication. Safe tenant font delivery is an ADR 040 follow-up;\nuntil then, load fonts from the embedding page.\n",
+      ),
+    hero_url: zod.url().optional().describe("Hero\/background image URL (used by split layout)."),
+  })
+  .describe(
+    "Branding configuration. Appears in two places with one shape:\n\n- On flow responses as a read-only projection: the server resolves the\n  latest branding revision for the project per step response (falling\n  back to built-in defaults when none is stored). Branding is configured\n  via the Branding API \/ `zitadel apply`, not the Flow API.\n- As the request body of `POST \/branding`, which publishes the same\n  shape as a new immutable revision (see ADR 040).\n",
+  );
+
+/**
+ * Lists branding revisions for the project, newest first, capped at the
+100 most recent. The first entry is the revision flow responses
+currently resolve. Deliberately unpaginated in v1 — list endpoints
+gain a real query mechanism together (ADR 031); advertising pagination
+parameters the server ignores would be worse than none.
+
+ * @summary List branding revisions
+ */
+export const listBrandingQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const ListBrandingQueryParams = zod.strictObject({
+  project_id: zod
+    .string()
+    .regex(listBrandingQueryProjectIdRegExp)
+    .describe("The unique identifier of the project"),
+});
+
+export const ListBrandingResponseItem = zod.object({
+  id: zod.string().describe("The unique identifier of this branding revision."),
+  created_at: zod.iso.datetime({ offset: true }).describe("When this revision was published."),
+});
+export const ListBrandingResponse = zod.array(ListBrandingResponseItem);
+
+/**
+ * Retrieves a single branding revision, including its stored configuration.
+ * @summary Get a branding revision by ID
+ */
+export const GetBrandingByIdParams = zod.object({
+  id: zod.string(),
+});
+
+export const getBrandingByIdQueryProjectIdRegExp = new RegExp("^[a-zA-Z0-9_-]+$");
+
+export const GetBrandingByIdQueryParams = zod.strictObject({
+  project_id: zod
+    .string()
+    .regex(getBrandingByIdQueryProjectIdRegExp)
+    .describe("The unique identifier of the project"),
+});
+
+export const getBrandingByIdResponseBrandingLayoutDefault = `centered`;
+export const getBrandingByIdResponseBrandingLiquidTemplateMax = 131072;
+
+export const GetBrandingByIdResponse = zod
+  .object({
+    id: zod.string().describe("The unique identifier of this branding revision."),
+    created_at: zod.iso.datetime({ offset: true }).describe("When this revision was published."),
+    branding: zod
+      .object({
+        layout: zod
+          .enum(["centered", "split"])
+          .default(getBrandingByIdResponseBrandingLayoutDefault)
+          .describe(
+            "Layout preset selector. The default.liquid master template uses this\nto branch into layout variants. Customers who eject the template\ncan ignore this field entirely; it also serves as the degrade target\nwhen a custom template fails component-side validation.\n",
+          ),
+        liquid_template: zod
+          .string()
+          .max(getBrandingByIdResponseBrandingLiquidTemplateMax)
+          .optional()
+          .describe(
+            "The LiquidJS template string for rendering this step. The orchestrator\nparses this template, injects the capability dictionaries as context,\nand renders the output HTML into its Shadow DOM.\n",
+          ),
+        logo_url: zod.url().optional().describe("Team logo URL."),
+        font_url: zod
+          .url()
+          .optional()
+          .describe(
+            "Custom font stylesheet URL (e.g., Google Fonts CSS). Read-only in\nv1: `POST \/branding` rejects a non-empty value, because the login\ncomponent loads this stylesheet at document level (shadow-scoped\n`@font-face` rules never register faces) and an arbitrary URL would\ngrant `branding.write` page-wide CSS control over the embedding\napplication. Safe tenant font delivery is an ADR 040 follow-up;\nuntil then, load fonts from the embedding page.\n",
+          ),
+        hero_url: zod
+          .url()
+          .optional()
+          .describe("Hero\/background image URL (used by split layout)."),
+      })
+      .describe(
+        "Branding configuration. Appears in two places with one shape:\n\n- On flow responses as a read-only projection: the server resolves the\n  latest branding revision for the project per step response (falling\n  back to built-in defaults when none is stored). Branding is configured\n  via the Branding API \/ `zitadel apply`, not the Flow API.\n- As the request body of `POST \/branding`, which publishes the same\n  shape as a new immutable revision (see ADR 040).\n",
+      ),
+  })
+  .describe(
+    "A stored branding revision. `branding` echoes the canonical stored\nconfiguration so clients (e.g. the CLI sync engine) can reconcile local\nfiles with the server's stored state.\n",
+  );