@zitadel/api 0.1.0-alpha.16 → 0.1.0-alpha.18

package/dist/generated/endpoints/zitadelNextGen.zod.mjs

@@ -8,175 +8,6 @@ import * as zod from "zod";
 * OpenAPI spec version: 0.0.1
 */
 /**
-* Retrieve the OpenID Connect configuration
-* @summary Get OpenID Connect configuration
-*/
-const getOpenIDConfigurationResponseClaimsParameterSupportedDefault = false;
-const getOpenIDConfigurationResponseRequestParameterSupportedDefault = false;
-const getOpenIDConfigurationResponseRequestUriParameterSupportedDefault = true;
-const getOpenIDConfigurationResponseRequireRequestUriRegistrationDefault = false;
-const GetOpenIDConfigurationResponse = zod.object({
-	issuer: zod.url().describe("REQUIRED. URL using the https scheme with no query or fragment components that the OP asserts as its Issuer Identifier."),
-	authorization_endpoint: zod.url().describe("REQUIRED. URL of the OP's OAuth 2.0 Authorization Endpoint."),
-	token_endpoint: zod.url().optional().describe("URL of the OP's OAuth 2.0 Token Endpoint. REQUIRED unless only the Implicit Flow is used."),
-	userinfo_endpoint: zod.url().optional().describe("RECOMMENDED. URL of the OP's UserInfo Endpoint."),
-	jwks_uri: zod.url().describe("REQUIRED. URL of the OP's JWK Set document containing the signing key(s) the RP uses to validate signatures from the OP."),
-	registration_endpoint: zod.url().optional().describe("RECOMMENDED. URL of the OP's Dynamic Client Registration Endpoint."),
-	scopes_supported: zod.array(zod.string()).optional().describe("RECOMMENDED. JSON array containing a list of the OAuth 2.0 scope values that this server supports. The server MUST support the openid scope value."),
-	response_types_supported: zod.array(zod.string()).describe("REQUIRED. JSON array containing a list of the OAuth 2.0 response_type values that this OP supports."),
-	response_modes_supported: zod.array(zod.string()).optional().describe("OPTIONAL. JSON array containing a list of the OAuth 2.0 response_mode values that this OP supports. Default is [\"query\", \"fragment\"]."),
-	grant_types_supported: zod.array(zod.string()).optional().describe("OPTIONAL. JSON array containing a list of the OAuth 2.0 Grant Type values that this OP supports. Default is [\"authorization_code\", \"implicit\"]."),
-	acr_values_supported: zod.array(zod.string()).optional().describe("OPTIONAL. JSON array containing a list of the Authentication Context Class References that this OP supports."),
-	subject_types_supported: zod.array(zod.enum(["public", "pairwise"])).describe("REQUIRED. JSON array containing a list of the Subject Identifier types that this OP supports. Valid types include pairwise and public."),
-	id_token_signing_alg_values_supported: zod.array(zod.string()).describe("REQUIRED. JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for the ID Token. The algorithm RS256 MUST be included."),
-	id_token_encryption_alg_values_supported: zod.array(zod.string()).optional().describe("OPTIONAL. JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for the ID Token."),
-	id_token_encryption_enc_values_supported: zod.array(zod.string()).optional().describe("OPTIONAL. JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for the ID Token."),
-	userinfo_signing_alg_values_supported: zod.array(zod.string()).optional().describe("OPTIONAL. JSON array containing a list of the JWS signing algorithms (alg values) supported by the UserInfo Endpoint."),
-	userinfo_encryption_alg_values_supported: zod.array(zod.string()).optional().describe("OPTIONAL. JSON array containing a list of the JWE encryption algorithms (alg values) supported by the UserInfo Endpoint."),
-	userinfo_encryption_enc_values_supported: zod.array(zod.string()).optional().describe("OPTIONAL. JSON array containing a list of the JWE encryption algorithms (enc values) supported by the UserInfo Endpoint."),
-	request_object_signing_alg_values_supported: zod.array(zod.string()).optional().describe("OPTIONAL. JSON array containing a list of the JWS signing algorithms (alg values) supported by the OP for Request Objects. Servers SHOULD support none and RS256."),
-	request_object_encryption_alg_values_supported: zod.array(zod.string()).optional().describe("OPTIONAL. JSON array containing a list of the JWE encryption algorithms (alg values) supported by the OP for Request Objects."),
-	request_object_encryption_enc_values_supported: zod.array(zod.string()).optional().describe("OPTIONAL. JSON array containing a list of the JWE encryption algorithms (enc values) supported by the OP for Request Objects."),
-	token_endpoint_auth_methods_supported: zod.array(zod.enum([
-		"client_secret_post",
-		"client_secret_basic",
-		"client_secret_jwt",
-		"private_key_jwt"
-	])).optional().describe("OPTIONAL. JSON array containing a list of Client Authentication methods supported by the Token Endpoint. Default is client_secret_basic."),
-	token_endpoint_auth_signing_alg_values_supported: zod.array(zod.string()).optional().describe("OPTIONAL. JSON array containing a list of the JWS signing algorithms supported by the Token Endpoint for private_key_jwt and client_secret_jwt authentication. The value none MUST NOT be used."),
-	display_values_supported: zod.array(zod.enum([
-		"page",
-		"popup",
-		"touch",
-		"wap"
-	])).optional().describe("OPTIONAL. JSON array containing a list of the display parameter values that the OpenID Provider supports."),
-	claim_types_supported: zod.array(zod.enum([
-		"normal",
-		"aggregated",
-		"distributed"
-	])).optional().describe("OPTIONAL. JSON array containing a list of the Claim Types that the OpenID Provider supports. Default is normal."),
-	claims_supported: zod.array(zod.string()).optional().describe("RECOMMENDED. JSON array containing a list of the Claim Names of the Claims that the OpenID Provider MAY be able to supply values for."),
-	service_documentation: zod.url().optional().describe("OPTIONAL. URL of a page containing human-readable information for developers using the OpenID Provider."),
-	claims_locales_supported: zod.array(zod.string()).optional().describe("OPTIONAL. Languages and scripts supported for values in Claims being returned, as BCP47 language tag values."),
-	ui_locales_supported: zod.array(zod.string()).optional().describe("OPTIONAL. Languages and scripts supported for the user interface, as BCP47 language tag values."),
-	claims_parameter_supported: zod.boolean().default(false).describe("OPTIONAL. Boolean value specifying whether the OP supports use of the claims parameter. Default is false."),
-	request_parameter_supported: zod.boolean().default(false).describe("OPTIONAL. Boolean value specifying whether the OP supports use of the request parameter. Default is false."),
-	request_uri_parameter_supported: zod.boolean().default(true).describe("OPTIONAL. Boolean value specifying whether the OP supports use of the request_uri parameter. Default is true."),
-	require_request_uri_registration: zod.boolean().default(false).describe("OPTIONAL. Boolean value specifying whether the OP requires any request_uri values used to be pre-registered. Default is false."),
-	op_policy_uri: zod.url().optional().describe("OPTIONAL. URL the OP provides to the person registering the Client about the OP's requirements on how the Relying Party can use the data provided."),
-	op_tos_uri: zod.url().optional().describe("OPTIONAL. URL the OP provides to the person registering the Client about the OpenID Provider's terms of service.")
-}).describe("OpenID Connect configuration according to the OpenID Connect Discovery 1.0 specification.");
-/**
-* @summary Authorize a user
-*/
-const AuthorizeGetQueryParams = zod.strictObject({
-	acr_values: zod.string().optional().describe("A space delimited list of Authentication Class References. This can be\nused to specify certain authentication methods or level of assurance \nthat is required for the authentication. For example, you could use \nthis to require multi-factor authentication.\n"),
-	client_id: zod.string().describe("The client ID of the application that is requesting authorization. \nThis is a required parameter and must match the client ID of a \nregistered application.\n"),
-	code_challenge: zod.string().optional().describe("The code challenge is a cryptographic string used in the PKCE (Proof \nKey for Code Exchange) flow to enhance security.\n"),
-	code_challenge_method: zod.string().optional().describe("The code challenge method is used in conjunction with the code challenge \nin the PKCE flow. It specifies the method used to generate the code \nchallenge. Common values are \"S256\" for SHA-256 hashing and \"plain\" \nfor no hashing.\n"),
-	display: zod.string().optional().describe("The display parameter is used to specify how the authorization server \nshould display the authentication and consent user interface. Common \nvalues include \"page\" for a full-page display, \"popup\" for a popup \nwindow, and \"touch\" for a mobile-optimized display.\n"),
-	id_token_hint: zod.string().optional().describe("The ID token hint is a previously issued ID token that can be used to \npre-fill the authentication form or to provide information about the \nuser to the authorization server. This can be useful for single sign-on \nscenarios or for providing a smoother user experience.\n"),
-	login_hint: zod.string().optional().describe("The login hint is a hint to the authorization server about the login \nidentifier of the user. This can be used to pre-fill the username or \nemail field in the authentication form, making it easier for the user \nto log in.\n"),
-	max_age: zod.number().optional().describe("The max age parameter specifies the maximum amount of time in seconds \nthat has passed since the user last authenticated. If the user has not \nauthenticated within this time frame, they will be required to re-authenticate.\n"),
-	nonce: zod.string().optional().describe("The nonce parameter is a random string that is used to associate a client \nsession with an ID token and to mitigate replay attacks. The authorization \nserver should include this value in the ID token that it issues, and the \nclient should verify that the value in the ID token matches the value it \nsent in the authorization request.\n"),
-	prompt: zod.string().optional().describe("The prompt parameter is used to specify whether the authorization server \nshould prompt the user for re-authentication and consent. Common values \ninclude \"none\" for no prompts, \"login\" to prompt for re-authentication, \n\"consent\" to prompt for user consent, and \"select_account\" to prompt \nthe user to select an account if they are logged in with multiple accounts.\n"),
-	redirect_uri: zod.string().optional().describe("The redirect URI is the URI to which the authorization server will redirect \nthe user after they have authorized or denied the request. This must match \none of the redirect URIs registered for the client application.\n"),
-	response_mode: zod.string().optional().describe("The response mode parameter specifies how the authorization server should \nreturn the authorization response. Common values include \"query\" to return \nparameters in the query string, \"fragment\" to return parameters in the URL \nfragment, and \"form_post\" to return parameters in an HTTP POST request.\n"),
-	response_type: zod.string().describe("The response type parameter specifies the type of response that the client \nis expecting from the authorization server. Common values include \"code\" \nfor the authorization code flow, \"token\" for the implicit flow, and \"id_token\" \nfor OpenID Connect authentication.\n"),
-	scope: zod.string().optional().describe("The scope parameter is used to specify the permissions that the client is \nrequesting from the user. This is a space-delimited list of scope values, \nand the authorization server will use this information to determine what \naccess to grant to the client application.\n"),
-	state: zod.string().optional().describe("The state parameter is a random string that is used to maintain state between \nthe authorization request and the callback. It is used to prevent cross-site \nrequest forgery (CSRF) attacks by ensuring that the response received from the \nauthorization server corresponds to the request that was sent.\n"),
-	ui_locales: zod.string().optional().describe("The ui_locales parameter is used to specify the preferred languages and scripts \nfor the user interface that the authorization server should display. This is a \nspace-delimited list of BCP47 language tag values, and it can be used to provide \na localized user experience for users from different regions and language \npreferences.\n")
-});
-/**
-* @summary Authorize a device
-*/
-const AuthorizeDeviceQueryParams = zod.strictObject({
-	client_id: zod.string().describe("The client ID of the application that is requesting authorization. \nThis is a required parameter and must match the client ID of a \nregistered application.\n"),
-	scope: zod.string().optional().describe("The scope parameter is used to specify the permissions that the client\nis requesting. This is a space delimited list of scopes. For example,\nyou could use this to request access to the user's profile information or\nto request permission to access certain APIs on behalf of the user.\n")
-});
-const AuthorizeDeviceResponse = zod.object({
-	device_code: zod.string().optional().describe("The device code that the client will use to poll for authorization.\n"),
-	expires_in: zod.number().optional().describe("The number of seconds until the device code expires.\n"),
-	interval: zod.number().optional().describe("The minimum amount of time in seconds that the client should wait \nbetween polling requests.\n"),
-	user_code: zod.string().optional().describe("The user code that the user will enter to authorize the device.\n"),
-	verification_uri: zod.string().optional().describe("The URI where the user will enter the user code to authorize the device.\n"),
-	verification_uri_complete: zod.string().optional().describe("The complete URI with the user code included, which the user can visit\nto authorize the device.\n")
-});
-/**
-* @summary End a session
-*/
-const EndSessionQueryParams = zod.strictObject({
-	client_id: zod.string().optional().describe("The client ID is the identifier for the client application that is making \nthe request. This is used by the authorization server to identify the \nclient and to determine whether it is authorized to perform the requested \naction.\n"),
-	id_token_hint: zod.string().optional().describe("The ID token hint is a previously issued ID token that can be used to \npre-fill the authentication form or to provide information about the \nuser to the authorization server. This can be useful for single sign-on \nscenarios or for providing a smoother user experience.\n"),
-	logout_hint: zod.string().optional().describe("The logout hint is a hint to the authorization server about the login \nidentifier of the user. This can be used to pre-fill the username or email\nfield in the logout form, making it easier for the user to log out.\n"),
-	post_logout_redirect_uri: zod.string().optional().describe("The post logout redirect URI is the URI to which the user will be \nredirected after they have logged out. This must be a registered URI \nfor the client application and is used to ensure that the user is \nredirected to a safe location after logging out.\n"),
-	state: zod.string().optional().describe("The state parameter is an opaque value that is used by the client to\nmaintain state between the request and the callback. It is typically used\nto prevent cross-site request forgery (CSRF) attacks by including a unique\nvalue in the request that the client can verify when it receives the callback.\n"),
-	ui_locales: zod.string().optional().describe("The ui_locales parameter is a space-separated list of BCP47 language tags\nthat are used to indicate the preferred languages and scripts for the user\ninterface. This can be used by the authorization server to display the logout\npage in the user's preferred language.\n")
-});
-/**
-* @summary Introspect a token
-*/
-const IntrospectResponse = zod.object({
-	active: zod.boolean().optional().describe("Indicates whether the token is active"),
-	aud: zod.string().optional().describe("The audience of the token (if applicable)"),
-	client_id: zod.string().optional().describe("The client ID associated with the token"),
-	exp: zod.number().optional().describe("The expiration time of the token (in seconds since epoch)"),
-	iat: zod.number().optional().describe("The time the token was issued (in seconds since epoch)"),
-	iss: zod.string().optional().describe("The issuer of the token (if applicable)"),
-	jti: zod.string().optional().describe("The unique identifier for the token (if applicable)"),
-	nbf: zod.number().optional().describe("The time before which the token is not valid (in seconds since epoch)"),
-	scope: zod.string().optional().describe("The scopes associated with the token"),
-	sub: zod.string().optional().describe("The subject of the token (if applicable)"),
-	token_type: zod.string().optional().describe("The type of the token (access_token or refresh_token)"),
-	username: zod.string().optional().describe("The username associated with the token (if applicable)")
-});
-/**
-* @summary Get public keys
-*/
-const GetKeysResponse = zod.object({ keys: zod.array(zod.object({
-	use: zod.string().optional(),
-	kty: zod.string().optional(),
-	kid: zod.string().optional(),
-	crv: zod.string().optional(),
-	alg: zod.string().optional(),
-	k: zod.string().optional(),
-	x: zod.string().optional(),
-	y: zod.string().optional(),
-	n: zod.string().optional(),
-	e: zod.string().optional(),
-	d: zod.string().optional(),
-	p: zod.string().optional(),
-	q: zod.string().optional(),
-	dp: zod.string().optional(),
-	dq: zod.string().optional(),
-	qi: zod.string().optional(),
-	x5c: zod.array(zod.string()).optional(),
-	x5u: zod.string().optional(),
-	x5t: zod.string().optional(),
-	x5tS256: zod.string().optional()
-})).optional() });
-/**
-* @summary Get access token
-*/
-const GetTokenResponse = zod.object({
-	access_token: zod.string().optional().describe("The access token issued by the authorization server."),
-	token_type: zod.string().optional().describe("The type of the token issued (e.g., Bearer)."),
-	expires_in: zod.number().optional().describe("The lifetime in seconds of the access token."),
-	refresh_token: zod.string().optional().describe("The refresh token which can be used to obtain new access tokens.")
-});
-/**
-* @summary Get user info
-*/
-const GetUserInfoResponse = zod.object({
-	sub: zod.string().optional().describe("The unique identifier for the user."),
-	name: zod.string().optional().describe("The full name of the user."),
-	email: zod.email().optional().describe("The email address of the user."),
-	preferred_username: zod.string().optional().describe("The preferred username of the user."),
-	picture: zod.url().optional().describe("The URL of the user's profile picture."),
-	given_name: zod.string().optional().describe("The given name of the user."),
-	family_name: zod.string().optional().describe("The family name of the user.")
-});
-/**
 * @summary Create user
 */
 const createUserQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
@@ -185,20 +16,48 @@ const CreateUserQueryParams = zod.strictObject({
 	project_id: zod.string().regex(createUserQueryProjectIdRegExp).describe("The unique identifier of the project"),
 	team_id: zod.string().regex(createUserQueryTeamIdRegExp).optional().describe("The unique identifier of the team")
 });
-const CreateUserBody = zod.record(zod.string(), zod.unknown()).describe("A user represents an individual identity in the system. It can be used to \nrepresent a human user, but also a service account or any other type of \nidentity. The content of a user is determined by the configured schema for \nusers, this is only a base schema.\n");
+const createUserBodyIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
+const CreateUserBody = zod.object({
+	id: zod.string().regex(createUserBodyIdRegExp).optional(),
+	metadata: zod.object({
+		created_at: zod.iso.datetime({ offset: true }).describe("The time when the user was created."),
+		updated_at: zod.iso.datetime({ offset: true }).describe("The time when the user was last updated."),
+		status: zod.enum([
+			"active",
+			"suspended",
+			"deactivated",
+			"pending_purge"
+		]).describe("The status of the user."),
+		lifecycle_owner_team_id: zod.union([zod.string(), zod.null()]).optional().describe("The team that owns this user's identity lifecycle, or `null` when the\nuser is self-owned. This is a single team and a different concept from\nthe user's team roster: it decides who may deprovision the user, not\nwhich teams the user collaborates in. The roster is its own paginated\nresource — `GET /users/{user_id}/teams`.\n")
+	}).optional()
+}).describe("A user represents an individual identity in the system. It can be used to \nrepresent a human user, but also a service account or any other type of \nidentity. The content of a user is determined by the configured schema for \nusers, this is only a base schema.\n\nThe server assigns the resource primary key (`id`) on create. Clients must\nnot send `id` in the create body; it is returned in the create response.\n");
 /**
 * @summary List users
 */
-const listUsersQueryOffsetDefault = 0;
-const listUsersQueryOffsetMin = 0;
 const listUsersQueryLimitDefault = 20;
 const listUsersQueryLimitMax = 100;
 const ListUsersQueryParams = zod.strictObject({
-	offset: zod.number().min(0).default(0).describe("Number of items to skip before returning results."),
-	limit: zod.number().min(1).max(100).default(20).describe("Maximum number of items to return.")
+	limit: zod.number().min(1).max(100).default(20).describe("Maximum number of items to return."),
+	page_token: zod.string().optional().describe("Token for fetching the next page of results.\nObtain this value from `next_page_token` in the previous response.\nOmit to start from the beginning.\nIts format is opaque and may change between releases.\n")
 });
-const ListUsersResponseItem = zod.record(zod.string(), zod.unknown());
-const ListUsersResponse = zod.array(ListUsersResponseItem);
+const listUsersResponseUsersItemIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
+const ListUsersResponse = zod.object({
+	users: zod.array(zod.object({
+		id: zod.string().regex(listUsersResponseUsersItemIdRegExp).optional(),
+		metadata: zod.object({
+			created_at: zod.iso.datetime({ offset: true }).describe("The time when the user was created."),
+			updated_at: zod.iso.datetime({ offset: true }).describe("The time when the user was last updated."),
+			status: zod.enum([
+				"active",
+				"suspended",
+				"deactivated",
+				"pending_purge"
+			]).describe("The status of the user."),
+			lifecycle_owner_team_id: zod.union([zod.string(), zod.null()]).optional().describe("The team that owns this user's identity lifecycle, or `null` when the\nuser is self-owned. This is a single team and a different concept from\nthe user's team roster: it decides who may deprovision the user, not\nwhich teams the user collaborates in. The roster is its own paginated\nresource — `GET /users/{user_id}/teams`.\n")
+		}).optional()
+	}).describe("A user represents an individual identity in the system. It can be used to \nrepresent a human user, but also a service account or any other type of \nidentity. The content of a user is determined by the configured schema for \nusers, this is only a base schema.\n\nThe server assigns the resource primary key (`id`) on create. Clients must\nnot send `id` in the create body; it is returned in the create response.\n")),
+	next_page_token: zod.union([zod.string(), zod.null()]).optional().describe("Token to pass as `page_token` in the next request to fetch the following page.\nAbsent when there are no more results.\n")
+}).describe("Paginated list of users.");
 /**
 * @summary Get user by ID
 */
@@ -210,7 +69,49 @@ const GetUserByIDQueryParams = zod.strictObject({
 	project_id: zod.string().regex(getUserByIDQueryProjectIdRegExp).describe("The unique identifier of the project"),
 	team_id: zod.string().regex(getUserByIDQueryTeamIdRegExp).optional().describe("The unique identifier of the team")
 });
-const GetUserByIDResponse = zod.record(zod.string(), zod.unknown());
+const getUserByIDResponseIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
+const GetUserByIDResponse = zod.object({
+	id: zod.string().regex(getUserByIDResponseIdRegExp).optional(),
+	metadata: zod.object({
+		created_at: zod.iso.datetime({ offset: true }).describe("The time when the user was created."),
+		updated_at: zod.iso.datetime({ offset: true }).describe("The time when the user was last updated."),
+		status: zod.enum([
+			"active",
+			"suspended",
+			"deactivated",
+			"pending_purge"
+		]).describe("The status of the user."),
+		lifecycle_owner_team_id: zod.union([zod.string(), zod.null()]).optional().describe("The team that owns this user's identity lifecycle, or `null` when the\nuser is self-owned. This is a single team and a different concept from\nthe user's team roster: it decides who may deprovision the user, not\nwhich teams the user collaborates in. The roster is its own paginated\nresource — `GET /users/{user_id}/teams`.\n")
+	}).optional()
+}).describe("A user represents an individual identity in the system. It can be used to \nrepresent a human user, but also a service account or any other type of \nidentity. The content of a user is determined by the configured schema for \nusers, this is only a base schema.\n\nThe server assigns the resource primary key (`id`) on create. Clients must\nnot send `id` in the create body; it is returned in the create response.\n");
+/**
+* @summary Delete user by ID
+*/
+const deleteUserByIDPathUserIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
+const DeleteUserByIDParams = zod.object({ user_id: zod.string().regex(deleteUserByIDPathUserIdRegExp) });
+const deleteUserByIDQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const DeleteUserByIDQueryParams = zod.strictObject({ project_id: zod.string().regex(deleteUserByIDQueryProjectIdRegExp).describe("The unique identifier of the project") });
+/**
+* @summary List user passkeys
+*/
+const listUserPasskeysPathUserIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
+const ListUserPasskeysParams = zod.object({ user_id: zod.string().regex(listUserPasskeysPathUserIdRegExp) });
+const listUserPasskeysQueryLimitDefault = 20;
+const listUserPasskeysQueryLimitMax = 100;
+const listUserPasskeysQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const ListUserPasskeysQueryParams = zod.strictObject({
+	limit: zod.number().min(1).max(100).default(20).describe("Maximum number of items to return."),
+	page_token: zod.string().optional().describe("Token for fetching the next page of results.\nObtain this value from `next_page_token` in the previous response.\nOmit to start from the beginning.\nIts format is opaque and may change between releases.\n"),
+	project_id: zod.string().regex(listUserPasskeysQueryProjectIdRegExp).describe("The unique identifier of the project")
+});
+const ListUserPasskeysResponse = zod.object({
+	passkeys: zod.array(zod.object({
+		id: zod.string().describe("The unique identifier of the passkey."),
+		name: zod.string().describe("The name of the passkey."),
+		created_at: zod.iso.datetime({ offset: true }).describe("The timestamp when the passkey was created.")
+	})),
+	next_page_token: zod.union([zod.string(), zod.null()]).optional().describe("Token to pass as `page_token` in the next request to fetch the following page.\nAbsent when there are no more results.\n")
+}).describe("Response containing the user's passkeys.");
 /**
 * @summary Set user password
 */
@@ -220,19 +121,68 @@ const setUserPasswordQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z
 const SetUserPasswordQueryParams = zod.strictObject({ project_id: zod.string().regex(setUserPasswordQueryProjectIdRegExp).describe("The unique identifier of the project") });
 const SetUserPasswordBody = zod.object({
 	password: zod.string().describe("The new password for the user."),
-	isChangeRequired: zod.boolean().optional().describe("Whether the user is required to change their password on the next login.\nIf not provided, it will default to false.\n")
+	is_change_required: zod.boolean().optional().describe("Whether the user is required to change their password on the next login.\nIf not provided, it will default to false.\n")
 }).describe("Request to update the user's password.");
 /**
+* The user's team roster, ordered by team name. Each entry carries the
+team's name, so a client renders a page without resolving ids one by one.
+
+This is the N:N roster and it is not lifecycle ownership: the single team
+that owns the user's lifecycle is reported as `metadata.lifecycle_owner_team_id`
+on the user read endpoints. Memberships the user was removed from are not
+returned.
+
+* @summary List the teams a user belongs to
+*/
+const listUserTeamsPathUserIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
+const ListUserTeamsParams = zod.object({ user_id: zod.string().regex(listUserTeamsPathUserIdRegExp) });
+const listUserTeamsQueryLimitDefault = 20;
+const listUserTeamsQueryLimitMax = 100;
+const listUserTeamsQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const ListUserTeamsQueryParams = zod.strictObject({
+	limit: zod.number().min(1).max(100).default(20).describe("Maximum number of items to return."),
+	page_token: zod.string().optional().describe("Token for fetching the next page of results.\nObtain this value from `next_page_token` in the previous response.\nOmit to start from the beginning.\nIts format is opaque and may change between releases.\n"),
+	project_id: zod.string().regex(listUserTeamsQueryProjectIdRegExp).describe("The unique identifier of the project")
+});
+const ListUserTeamsResponse = zod.object({
+	teams: zod.array(zod.object({
+		id: zod.string().describe("The unique identifier of the team."),
+		name: zod.string().describe("The name of the team."),
+		membership_status: zod.enum([
+			"pending",
+			"active",
+			"inactive"
+		]).describe("The user's participation state on this team. Memberships the user was\nremoved from are not returned.\n"),
+		created_at: zod.iso.datetime({ offset: true }).describe("The time when the user joined this team."),
+		updated_at: zod.iso.datetime({ offset: true }).describe("The time when this membership was last changed.")
+	}).describe("One entry of a user's team roster: a team the user belongs to, with the\nmembership's participation state. The team's `name` travels with the entry, so\na page renders without a follow-up `POST /teams/query` per row.\n\nRoster membership is not lifecycle ownership. A user can belong to many teams\nwhile still owning their own lifecycle — that single owning team is reported\nas `metadata.lifecycle_owner_team_id` on the user itself.\n")),
+	next_page_token: zod.union([zod.string(), zod.null()]).optional().describe("Token to pass as `page_token` in the next request to fetch the following page.\nAbsent when there are no more results.\n")
+}).describe("Paginated list of the teams a user belongs to.");
+/**
 * @summary Get my user information
 */
-const GetMyUserResponse = zod.record(zod.string(), zod.unknown());
+const getMyUserResponseIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
+const GetMyUserResponse = zod.object({
+	id: zod.string().regex(getMyUserResponseIdRegExp).optional(),
+	metadata: zod.object({
+		created_at: zod.iso.datetime({ offset: true }).describe("The time when the user was created."),
+		updated_at: zod.iso.datetime({ offset: true }).describe("The time when the user was last updated."),
+		status: zod.enum([
+			"active",
+			"suspended",
+			"deactivated",
+			"pending_purge"
+		]).describe("The status of the user."),
+		lifecycle_owner_team_id: zod.union([zod.string(), zod.null()]).optional().describe("The team that owns this user's identity lifecycle, or `null` when the\nuser is self-owned. This is a single team and a different concept from\nthe user's team roster: it decides who may deprovision the user, not\nwhich teams the user collaborates in. The roster is its own paginated\nresource — `GET /users/{user_id}/teams`.\n")
+	}).optional()
+}).describe("A user represents an individual identity in the system. It can be used to \nrepresent a human user, but also a service account or any other type of \nidentity. The content of a user is determined by the configured schema for \nusers, this is only a base schema.\n\nThe server assigns the resource primary key (`id`) on create. Clients must\nnot send `id` in the create body; it is returned in the create response.\n");
 /**
 * Resolves a flow definition based on purpose + audience context and returns
 the first capability step. Creates a new session implicitly unless
 `session_id` is provided (for step-up / reauth on an existing session).
 
 The response contains an `id` field — the flow handle. Use it as the path
-parameter for all subsequent `/flow/{id}/submit` and `/flow/{id}/event` calls.
+parameter for all subsequent `/flow/{id}/submit` calls.
 
 The response also sets an encrypted `HttpOnly` cookie (`_zflow`) containing
 the flow's orchestration state (current step, collected data, history).
@@ -285,6 +235,7 @@ const getFlowStepResponseStepActionsDefault = [];
 const getFlowStepResponseStepGatesDefault = {};
 const getFlowStepResponseStepSsoProvidersDefault = [];
 const getFlowStepResponseBrandingLayoutDefault = `centered`;
+const getFlowStepResponseBrandingLiquidTemplateMax = 131072;
 const GetFlowStepResponse = zod.object({
 	id: zod.string().describe("Flow handle. Use this as the path parameter for subsequent\nsubmit/event calls. May change between responses when a\nflow pivot or pop occurs.\n"),
 	session_id: zod.string().describe("Underlying session ID. Stable across all stacked flows."),
@@ -295,7 +246,7 @@ const GetFlowStepResponse = zod.object({
 			title_key: zod.string().optional().describe("Localization key for the step heading."),
 			description_key: zod.union([zod.string(), zod.null()]).optional().describe("Localization key for explanatory text.")
 		}).optional().describe("Step-level localization keys. Resolved client-side via the `| t` LiquidJS filter.\nThe backend never sends display text — only semantic keys.\n"),
-		error: zod.union([zod.string(), zod.null()]).optional().describe("Error from a previous failed submission. Field-validation failures\ncarry localisation text keys: `error.<field>_<rule>` per violation\n(e.g. `error.email_required`; the `format` rule is spelled\n`error.<field>_invalid`), multiple violations joined with `\"; \"`.\nField names appear verbatim, so clients localise unknown keys via\nthe generic `error.field_<rule>` catalog entries. Other failures\ncarry a verbatim diagnostic token instead (e.g. `user_not_found`,\n`auth_attempt.password_invalid`).\n"),
+		error: zod.union([zod.string(), zod.null()]).optional().describe("Error from a previous failed submission. Field-validation failures\ncarry localisation text keys: `error.<field>_<rule>` per violation\n(e.g. `error.email_required`; the `format` rule is spelled\n`error.<field>_invalid`), multiple violations joined with `\"; \"`.\nField names appear verbatim, so clients localise unknown keys via\nthe generic `error.field_<rule>` catalog entries. Other engine\nfailures carry `error.*` catalog keys as well (e.g.\n`error.invalid_credentials`, `error.passkey_invalid`); a\nnon-`error.` payload is an outcome token (e.g. `user_not_found`)\nthat clients keep verbatim.\n"),
 		complete: zod.enum(["redirect", "show"]).optional().describe("Present only on terminal steps. Tells the frontend what to do:\n- redirect: navigate to redirect_uri immediately (OIDC/SAML done)\n- show: render the step as a success screen (e.g., registration confirmed)\n"),
 		redirect_url: zod.url().optional().describe("URL to navigate to (e.g., SSO provider redirect)."),
 		fields: zod.array(zod.object({
@@ -356,12 +307,12 @@ const GetFlowStepResponse = zod.object({
 		}).optional().describe("A pending authentication challenge issued by the server. Present when the\nflow engine has issued a challenge via auth_attempts (e.g., after the user\nsubmits `action: \"passkey\"`). The `<zl-passkey>` component reads this and\ntriggers the appropriate WebAuthn ceremony.\n\nThe challenge is NOT present on the initial step — it appears only after\nthe user explicitly selects a ceremony-based action.\n")
 	}).describe("A step contains ordered capability arrays: what to collect (fields),\nwhat the user can do (actions), and what security gates must be satisfied (gates).\nThe LiquidJS template in `branding.liquid_template` iterates these arrays in order\nand builds name-keyed indexes locally for lookup.\n"),
 	branding: zod.object({
-		layout: zod.enum(["centered", "split"]).default(getFlowStepResponseBrandingLayoutDefault).describe("Layout preset selector. The default.liquid master template uses this\nto branch into layout variants. Customers who eject the template\ncan ignore this field entirely.\n"),
-		liquid_template: zod.string().optional().describe("The LiquidJS template string for rendering this step. The orchestrator\nparses this template, injects the capability dictionaries as context,\nand renders the output HTML into its Shadow DOM.\n"),
+		layout: zod.enum(["centered", "split"]).default(getFlowStepResponseBrandingLayoutDefault).describe("Layout preset selector. The default.liquid master template uses this\nto branch into layout variants. Customers who eject the template\ncan ignore this field entirely; it also serves as the degrade target\nwhen a custom template fails component-side validation.\n"),
+		liquid_template: zod.string().max(getFlowStepResponseBrandingLiquidTemplateMax).optional().describe("The LiquidJS template string for rendering this step. The orchestrator\nparses this template, injects the capability dictionaries as context,\nand renders the output HTML into its Shadow DOM.\n"),
 		logo_url: zod.url().optional().describe("Team logo URL."),
-		font_url: zod.url().optional().describe("Custom font URL (e.g., Google Fonts CSS)."),
+		font_url: zod.url().optional().describe("Custom font stylesheet URL (e.g., Google Fonts CSS). Read-only in\nv1: `POST /branding` rejects a non-empty value, because the login\ncomponent loads this stylesheet at document level (shadow-scoped\n`@font-face` rules never register faces) and an arbitrary URL would\ngrant `branding.write` page-wide CSS control over the embedding\napplication. Safe tenant font delivery is an ADR 040 follow-up;\nuntil then, load fonts from the embedding page.\n"),
 		hero_url: zod.url().optional().describe("Hero/background image URL (used by split layout).")
-	}).optional().describe("Resolved branding configuration. Inherited from the app → team → project\nhierarchy at flow creation time (most specific wins). Read-only projection —\nbranding is configured via the Team/App Branding API, not the Flow API.\n"),
+	}).optional().describe("Branding configuration. Appears in two places with one shape:\n\n- On flow responses as a read-only projection: the server resolves the\n  latest branding revision for the project per step response (falling\n  back to built-in defaults when none is stored). Branding is configured\n  via the Branding API / `zitadel apply`, not the Flow API.\n- As the request body of `POST /branding`, which publishes the same\n  shape as a new immutable revision (see ADR 040).\n"),
 	redirect_uri: zod.url().optional().describe("Present when `step.complete` is `redirect`."),
 	handoff_token: zod.string().optional().describe("Short-lived, audience-bound token produced on flow completion.\nExchange it for a session via `POST /sessions/exchange`.\nOnly present when `step.complete` is set.\n"),
 	handoff_token_expires_at: zod.iso.datetime({ offset: true }).optional().describe("Expiry timestamp for `handoff_token`. Only present when\n`handoff_token` is set.\n")
@@ -420,6 +371,7 @@ const submitFlowStepResponseStepActionsDefault = [];
 const submitFlowStepResponseStepGatesDefault = {};
 const submitFlowStepResponseStepSsoProvidersDefault = [];
 const submitFlowStepResponseBrandingLayoutDefault = `centered`;
+const submitFlowStepResponseBrandingLiquidTemplateMax = 131072;
 const SubmitFlowStepResponse = zod.object({
 	id: zod.string().describe("Flow handle. Use this as the path parameter for subsequent\nsubmit/event calls. May change between responses when a\nflow pivot or pop occurs.\n"),
 	session_id: zod.string().describe("Underlying session ID. Stable across all stacked flows."),
@@ -430,7 +382,7 @@ const SubmitFlowStepResponse = zod.object({
 			title_key: zod.string().optional().describe("Localization key for the step heading."),
 			description_key: zod.union([zod.string(), zod.null()]).optional().describe("Localization key for explanatory text.")
 		}).optional().describe("Step-level localization keys. Resolved client-side via the `| t` LiquidJS filter.\nThe backend never sends display text — only semantic keys.\n"),
-		error: zod.union([zod.string(), zod.null()]).optional().describe("Error from a previous failed submission. Field-validation failures\ncarry localisation text keys: `error.<field>_<rule>` per violation\n(e.g. `error.email_required`; the `format` rule is spelled\n`error.<field>_invalid`), multiple violations joined with `\"; \"`.\nField names appear verbatim, so clients localise unknown keys via\nthe generic `error.field_<rule>` catalog entries. Other failures\ncarry a verbatim diagnostic token instead (e.g. `user_not_found`,\n`auth_attempt.password_invalid`).\n"),
+		error: zod.union([zod.string(), zod.null()]).optional().describe("Error from a previous failed submission. Field-validation failures\ncarry localisation text keys: `error.<field>_<rule>` per violation\n(e.g. `error.email_required`; the `format` rule is spelled\n`error.<field>_invalid`), multiple violations joined with `\"; \"`.\nField names appear verbatim, so clients localise unknown keys via\nthe generic `error.field_<rule>` catalog entries. Other engine\nfailures carry `error.*` catalog keys as well (e.g.\n`error.invalid_credentials`, `error.passkey_invalid`); a\nnon-`error.` payload is an outcome token (e.g. `user_not_found`)\nthat clients keep verbatim.\n"),
 		complete: zod.enum(["redirect", "show"]).optional().describe("Present only on terminal steps. Tells the frontend what to do:\n- redirect: navigate to redirect_uri immediately (OIDC/SAML done)\n- show: render the step as a success screen (e.g., registration confirmed)\n"),
 		redirect_url: zod.url().optional().describe("URL to navigate to (e.g., SSO provider redirect)."),
 		fields: zod.array(zod.object({
@@ -491,29 +443,17 @@ const SubmitFlowStepResponse = zod.object({
 		}).optional().describe("A pending authentication challenge issued by the server. Present when the\nflow engine has issued a challenge via auth_attempts (e.g., after the user\nsubmits `action: \"passkey\"`). The `<zl-passkey>` component reads this and\ntriggers the appropriate WebAuthn ceremony.\n\nThe challenge is NOT present on the initial step — it appears only after\nthe user explicitly selects a ceremony-based action.\n")
 	}).describe("A step contains ordered capability arrays: what to collect (fields),\nwhat the user can do (actions), and what security gates must be satisfied (gates).\nThe LiquidJS template in `branding.liquid_template` iterates these arrays in order\nand builds name-keyed indexes locally for lookup.\n"),
 	branding: zod.object({
-		layout: zod.enum(["centered", "split"]).default(submitFlowStepResponseBrandingLayoutDefault).describe("Layout preset selector. The default.liquid master template uses this\nto branch into layout variants. Customers who eject the template\ncan ignore this field entirely.\n"),
-		liquid_template: zod.string().optional().describe("The LiquidJS template string for rendering this step. The orchestrator\nparses this template, injects the capability dictionaries as context,\nand renders the output HTML into its Shadow DOM.\n"),
+		layout: zod.enum(["centered", "split"]).default(submitFlowStepResponseBrandingLayoutDefault).describe("Layout preset selector. The default.liquid master template uses this\nto branch into layout variants. Customers who eject the template\ncan ignore this field entirely; it also serves as the degrade target\nwhen a custom template fails component-side validation.\n"),
+		liquid_template: zod.string().max(submitFlowStepResponseBrandingLiquidTemplateMax).optional().describe("The LiquidJS template string for rendering this step. The orchestrator\nparses this template, injects the capability dictionaries as context,\nand renders the output HTML into its Shadow DOM.\n"),
 		logo_url: zod.url().optional().describe("Team logo URL."),
-		font_url: zod.url().optional().describe("Custom font URL (e.g., Google Fonts CSS)."),
+		font_url: zod.url().optional().describe("Custom font stylesheet URL (e.g., Google Fonts CSS). Read-only in\nv1: `POST /branding` rejects a non-empty value, because the login\ncomponent loads this stylesheet at document level (shadow-scoped\n`@font-face` rules never register faces) and an arbitrary URL would\ngrant `branding.write` page-wide CSS control over the embedding\napplication. Safe tenant font delivery is an ADR 040 follow-up;\nuntil then, load fonts from the embedding page.\n"),
 		hero_url: zod.url().optional().describe("Hero/background image URL (used by split layout).")
-	}).optional().describe("Resolved branding configuration. Inherited from the app → team → project\nhierarchy at flow creation time (most specific wins). Read-only projection —\nbranding is configured via the Team/App Branding API, not the Flow API.\n"),
+	}).optional().describe("Branding configuration. Appears in two places with one shape:\n\n- On flow responses as a read-only projection: the server resolves the\n  latest branding revision for the project per step response (falling\n  back to built-in defaults when none is stored). Branding is configured\n  via the Branding API / `zitadel apply`, not the Flow API.\n- As the request body of `POST /branding`, which publishes the same\n  shape as a new immutable revision (see ADR 040).\n"),
 	redirect_uri: zod.url().optional().describe("Present when `step.complete` is `redirect`."),
 	handoff_token: zod.string().optional().describe("Short-lived, audience-bound token produced on flow completion.\nExchange it for a session via `POST /sessions/exchange`.\nOnly present when `step.complete` is set.\n"),
 	handoff_token_expires_at: zod.iso.datetime({ offset: true }).optional().describe("Expiry timestamp for `handoff_token`. Only present when\n`handoff_token` is set.\n")
 });
 /**
-* Submits telemetry or fingerprint data from the frontend.
-Does not advance the state machine. Used for risk evaluation.
-
-* @summary Submit client-side event
-*/
-const SubmitFlowEventParams = zod.object({ id: zod.string().describe("Flow ID returned by POST /flow or the latest POST /flow/{id}/submit.\nUsed to look up the correct flow state from the encrypted cookie,\nwhich can hold multiple concurrent flows. May change between responses\nwhen a flow pivot or pop occurs — always use the `id` from the latest response.\n") });
-const SubmitFlowEventBody = zod.object({
-	session_token: zod.string().optional().describe("Reserved for future rotation. The sealed `_zflow` cookie carries the flow state today."),
-	type: zod.enum(["fingerprint", "telemetry"]),
-	payload: zod.record(zod.string(), zod.unknown()).optional().describe("Event payload (fingerprint hash, timing data, etc.).")
-});
-/**
 * Starts a new authentication attempt. This is the entry point for the auth_attempts state machine.
 
 An attempt is an ephemeral (15-minute TTL) state machine that drives a single authentication round.
@@ -525,11 +465,11 @@ also include session_id to add factors to an existing session.
 * @summary Create a new authentication attempt
 */
 const createAuthAttemptBodyProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const createAuthAttemptBodySessionIdOneRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const createAuthAttemptBodySessionIdOneRegExp = /* @__PURE__ */ new RegExp("^sess_[a-zA-Z0-9_-]+$");
 const CreateAuthAttemptBody = zod.object({
 	project_id: zod.string().regex(createAuthAttemptBodyProjectIdRegExp),
 	challenge_nonce: zod.string().optional().describe("Origin-bound, single-use nonce obtained from `POST /bootstrap/challenge`.\nBinds the request to the browser that initiated the flow, preventing\ncross-origin replay.\n"),
-	session_id: zod.union([zod.string().regex(createAuthAttemptBodySessionIdOneRegExp).describe("Unique identifier for this session."), zod.null()]).optional().describe("Optional. If provided, this attempt adds factors to an existing session (step-up auth).\nIf omitted, a new session is created implicitly on successful handoff.\n")
+	session_id: zod.union([zod.string().regex(createAuthAttemptBodySessionIdOneRegExp).describe("Unique identifier for this session (dialect-minted prefixed opaque string)."), zod.null()]).optional().describe("Optional. If provided, this attempt adds factors to an existing session (step-up auth).\nIf omitted, a new session is created implicitly on successful handoff.\n")
 }).describe("Request to create a new authentication attempt");
 /**
 * Polls the current state of an authentication attempt.
@@ -542,16 +482,16 @@ a federated IdP callback or a device flow).
 
 * @summary Get authentication attempt state
 */
-const getAuthAttemptPathAttemptIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getAuthAttemptPathAttemptIdRegExp = /* @__PURE__ */ new RegExp("^att_[a-zA-Z0-9_-]+$");
 const GetAuthAttemptParams = zod.object({ attempt_id: zod.string().regex(getAuthAttemptPathAttemptIdRegExp).describe("The unique identifier of the authentication attempt") });
-const getAuthAttemptResponseAttemptIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getAuthAttemptResponseAttemptIdRegExp = /* @__PURE__ */ new RegExp("^att_[a-zA-Z0-9_-]+$");
 const getAuthAttemptResponseProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const getAuthAttemptResponseSessionIdOneRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getAuthAttemptResponseSessionIdOneRegExp = /* @__PURE__ */ new RegExp("^sess_[a-zA-Z0-9_-]+$");
 const getAuthAttemptResponseUserIdOneRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
 const getAuthAttemptResponseCompletedFactorsItemPayloadOneUserIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
-const getAuthAttemptResponseChallengesItemChallengeIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getAuthAttemptResponseChallengesItemChallengeIdRegExp = /* @__PURE__ */ new RegExp("^ch_[a-zA-Z0-9_-]+$");
 const GetAuthAttemptResponse = zod.object({
-	attempt_id: zod.string().regex(getAuthAttemptResponseAttemptIdRegExp).describe("Unique identifier for this authentication attempt"),
+	attempt_id: zod.string().regex(getAuthAttemptResponseAttemptIdRegExp).describe("Unique identifier for this authentication attempt (dialect-minted prefixed opaque string)."),
 	project_id: zod.string().regex(getAuthAttemptResponseProjectIdRegExp),
 	state: zod.enum([
 		"in_progress",
@@ -559,7 +499,7 @@ const GetAuthAttemptResponse = zod.object({
 		"failed",
 		"expired"
 	]).describe("Overall state of the authentication attempt:\n- `in_progress`: factors are still being collected; continue issuing challenges.\n- `completed`: all required factors have been verified; the attempt is ready for handoff.\n- `failed`: the attempt has failed (e.g. too many failed proofs) and cannot be continued.\n- `expired`: the 15-minute TTL has been exceeded.\n"),
-	session_id: zod.union([zod.string().regex(getAuthAttemptResponseSessionIdOneRegExp).describe("Unique identifier for this session."), zod.null()]).optional().describe("The session being authenticated into. Either newly created or passed in on POST.\nFor step-up (re-auth), this is the existing session_id provided on creation.\n"),
+	session_id: zod.union([zod.string().regex(getAuthAttemptResponseSessionIdOneRegExp).describe("Unique identifier for this session (dialect-minted prefixed opaque string)."), zod.null()]).optional().describe("The session being authenticated into. Either newly created or passed in on POST.\nFor step-up (re-auth), this is the existing session_id provided on creation.\n"),
 	user_id: zod.union([zod.string().regex(getAuthAttemptResponseUserIdOneRegExp), zod.null()]).optional().describe("The user ID, if known at this point in the flow.\nNull until an identifier challenge has been verified.\n"),
 	required_factors: zod.array(zod.enum([
 		"identifier",
@@ -586,7 +526,7 @@ const GetAuthAttemptResponse = zod.object({
 		]).optional().describe("Method-specific factor metadata. Structure depends on the `method` field.\n- `identifier`: includes user_id\n- `password`: no additional data\n- `passkey`: includes credential details and verification flags\n")
 	}).describe("A successfully verified authentication factor with verification metadata.\nMethod-specific details are included in the `payload` field.\n")).optional().describe("The factors that have been successfully verified in this attempt so far.\nEach item includes method-specific metadata in the payload field.\n\nThe flow engine uses verified_at timestamps to enforce time-based policies, such as\nrequiring password verification within the last 5 minutes for step-up auth to\naccess sensitive operations.\n\nA factor appears here once its challenge reaches `verified` state.\n"),
 	challenges: zod.array(zod.object({
-		challenge_id: zod.string().regex(getAuthAttemptResponseChallengesItemChallengeIdRegExp).describe("Unique identifier for this challenge"),
+		challenge_id: zod.string().regex(getAuthAttemptResponseChallengesItemChallengeIdRegExp).describe("Unique identifier for this challenge (dialect-minted prefixed opaque string)."),
 		method: zod.enum([
 			"identifier",
 			"password",
@@ -630,7 +570,7 @@ by calling POST /auth_attempts/{attempt_id}/challenges/{challenge_id}/verify.
 
 * @summary Issue a factor challenge
 */
-const issueChallengePathAttemptIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const issueChallengePathAttemptIdRegExp = /* @__PURE__ */ new RegExp("^att_[a-zA-Z0-9_-]+$");
 const IssueChallengeParams = zod.object({ attempt_id: zod.string().regex(issueChallengePathAttemptIdRegExp).describe("The unique identifier of the authentication attempt") });
 const IssueChallengeBody = zod.object({
 	method: zod.enum([
@@ -662,8 +602,8 @@ The attempt moves to the next pending challenge or completes if all required fac
 
 * @summary Verify a factor proof
 */
-const verifyChallengeProofPathAttemptIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const verifyChallengeProofPathChallengeIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const verifyChallengeProofPathAttemptIdRegExp = /* @__PURE__ */ new RegExp("^att_[a-zA-Z0-9_-]+$");
+const verifyChallengeProofPathChallengeIdRegExp = /* @__PURE__ */ new RegExp("^ch_[a-zA-Z0-9_-]+$");
 const VerifyChallengeProofParams = zod.object({
 	attempt_id: zod.string().regex(verifyChallengeProofPathAttemptIdRegExp).describe("The unique identifier of the authentication attempt"),
 	challenge_id: zod.string().regex(verifyChallengeProofPathChallengeIdRegExp).describe("The unique identifier of this challenge.")
@@ -674,14 +614,14 @@ const VerifyChallengeProofBody = zod.union([
 	zod.object({ password: zod.string().describe("The password being verified") }).describe("Proof for `password` method"),
 	zod.object({ passkey: zod.object({ assertion: zod.record(zod.string(), zod.unknown()).describe("The WebAuthn AssertionResponse object") }).describe("WebAuthn passkey assertion") }).describe("Proof for `passkey` method")
 ]).describe("Proof for verifying a factor challenge.\n\nThe exact format depends on the challenge method. The proof object should contain\nonly the credential/code/assertion relevant to the challenge method being verified.\n");
-const verifyChallengeProofResponseAttemptIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const verifyChallengeProofResponseAttemptIdRegExp = /* @__PURE__ */ new RegExp("^att_[a-zA-Z0-9_-]+$");
 const verifyChallengeProofResponseProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const verifyChallengeProofResponseSessionIdOneRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const verifyChallengeProofResponseSessionIdOneRegExp = /* @__PURE__ */ new RegExp("^sess_[a-zA-Z0-9_-]+$");
 const verifyChallengeProofResponseUserIdOneRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
 const verifyChallengeProofResponseCompletedFactorsItemPayloadOneUserIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
-const verifyChallengeProofResponseChallengesItemChallengeIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const verifyChallengeProofResponseChallengesItemChallengeIdRegExp = /* @__PURE__ */ new RegExp("^ch_[a-zA-Z0-9_-]+$");
 const VerifyChallengeProofResponse = zod.object({
-	attempt_id: zod.string().regex(verifyChallengeProofResponseAttemptIdRegExp).describe("Unique identifier for this authentication attempt"),
+	attempt_id: zod.string().regex(verifyChallengeProofResponseAttemptIdRegExp).describe("Unique identifier for this authentication attempt (dialect-minted prefixed opaque string)."),
 	project_id: zod.string().regex(verifyChallengeProofResponseProjectIdRegExp),
 	state: zod.enum([
 		"in_progress",
@@ -689,7 +629,7 @@ const VerifyChallengeProofResponse = zod.object({
 		"failed",
 		"expired"
 	]).describe("Overall state of the authentication attempt:\n- `in_progress`: factors are still being collected; continue issuing challenges.\n- `completed`: all required factors have been verified; the attempt is ready for handoff.\n- `failed`: the attempt has failed (e.g. too many failed proofs) and cannot be continued.\n- `expired`: the 15-minute TTL has been exceeded.\n"),
-	session_id: zod.union([zod.string().regex(verifyChallengeProofResponseSessionIdOneRegExp).describe("Unique identifier for this session."), zod.null()]).optional().describe("The session being authenticated into. Either newly created or passed in on POST.\nFor step-up (re-auth), this is the existing session_id provided on creation.\n"),
+	session_id: zod.union([zod.string().regex(verifyChallengeProofResponseSessionIdOneRegExp).describe("Unique identifier for this session (dialect-minted prefixed opaque string)."), zod.null()]).optional().describe("The session being authenticated into. Either newly created or passed in on POST.\nFor step-up (re-auth), this is the existing session_id provided on creation.\n"),
 	user_id: zod.union([zod.string().regex(verifyChallengeProofResponseUserIdOneRegExp), zod.null()]).optional().describe("The user ID, if known at this point in the flow.\nNull until an identifier challenge has been verified.\n"),
 	required_factors: zod.array(zod.enum([
 		"identifier",
@@ -716,7 +656,7 @@ const VerifyChallengeProofResponse = zod.object({
 		]).optional().describe("Method-specific factor metadata. Structure depends on the `method` field.\n- `identifier`: includes user_id\n- `password`: no additional data\n- `passkey`: includes credential details and verification flags\n")
 	}).describe("A successfully verified authentication factor with verification metadata.\nMethod-specific details are included in the `payload` field.\n")).optional().describe("The factors that have been successfully verified in this attempt so far.\nEach item includes method-specific metadata in the payload field.\n\nThe flow engine uses verified_at timestamps to enforce time-based policies, such as\nrequiring password verification within the last 5 minutes for step-up auth to\naccess sensitive operations.\n\nA factor appears here once its challenge reaches `verified` state.\n"),
 	challenges: zod.array(zod.object({
-		challenge_id: zod.string().regex(verifyChallengeProofResponseChallengesItemChallengeIdRegExp).describe("Unique identifier for this challenge"),
+		challenge_id: zod.string().regex(verifyChallengeProofResponseChallengesItemChallengeIdRegExp).describe("Unique identifier for this challenge (dialect-minted prefixed opaque string)."),
 		method: zod.enum([
 			"identifier",
 			"password",
@@ -764,7 +704,7 @@ The handoff token is:
 
 * @summary Complete authentication and create handoff token
 */
-const createHandoffPathAttemptIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const createHandoffPathAttemptIdRegExp = /* @__PURE__ */ new RegExp("^att_[a-zA-Z0-9_-]+$");
 const CreateHandoffParams = zod.object({ attempt_id: zod.string().regex(createHandoffPathAttemptIdRegExp).describe("The unique identifier of the authentication attempt") });
 const CreateHandoffHeader = zod.strictObject({ "Idempotency-Key": zod.string().optional().describe("Optional retry key for safe retries of the call.\nRetries carrying the same key within the call window return the cached\npayload without creating a new resource. See details in the endpoint description.\n") });
 const CreateHandoffResponse = zod.object({
@@ -777,8 +717,8 @@ const CreateHandoffResponse = zod.object({
 const createProjectBodySeedDefaultsDefault = true;
 const CreateProjectBody = zod.object({
 	name: zod.string().describe("The name of the project."),
-	previewOrigins: zod.array(zod.string()).optional().describe("Origins which are allowed for previewing and testing the project.\n"),
-	seedDefaults: zod.boolean().default(true).describe("Whether the server should provision fallback default user schema and flow\nresources for the project. CLI-managed projects set this to false and\nupload their local .zitadel config files through the schema and flow APIs.\n")
+	preview_origins: zod.array(zod.string()).optional().describe("Origins which are allowed for previewing and testing the project.\n"),
+	seed_defaults: zod.boolean().default(true).describe("Whether the server should provision fallback default user schema and flow\nresources for the project. CLI-managed projects set this to false and\nupload their local .zitadel config files through the schema and flow APIs.\n")
 });
 /**
 * @summary Query projects
@@ -787,13 +727,13 @@ const queryProjectsBodyLimitDefault = 20;
 const queryProjectsBodyLimitMax = 100;
 const QueryProjectsBody = zod.object({
 	limit: zod.number().min(1).max(100).default(20),
-	page_token: zod.union([zod.string(), zod.null()]).optional().describe("Token to retrieve the next page of results."),
+	page_token: zod.union([zod.string(), zod.null()]).optional().describe("Token to retrieve the next page of results. Must be sent with the same\n`sorting` as the request that issued the token. Omitting `sorting` reuses\nthe default sort and only succeeds when that default matches the token.\n"),
 	sorting: zod.object({
-		field: zod.enum(["name", "createdAt"]),
+		field: zod.enum(["created_at"]),
 		direction: zod.enum(["asc", "desc"])
 	}).optional(),
 	filter: zod.array(zod.object({
-		field: zod.enum(["name", "createdAt"]),
+		field: zod.enum(["created_at"]),
 		value: zod.union([
 			zod.string(),
 			zod.number(),
@@ -816,11 +756,11 @@ const QueryProjectsResponse = zod.object({
 	projects: zod.array(zod.object({
 		id: zod.string().describe("The unique identifier of the project."),
 		name: zod.string().describe("The name of the project."),
-		previewOrigins: zod.array(zod.string()).optional().describe("Origins which are allowed for previewing and testing the project.\n"),
-		createdAt: zod.iso.datetime({ offset: true }).describe("The time when the project was created."),
-		updatedAt: zod.iso.datetime({ offset: true }).describe("The time when the project was last updated.")
+		preview_origins: zod.array(zod.string()).optional().describe("Origins which are allowed for previewing and testing the project.\n"),
+		created_at: zod.iso.datetime({ offset: true }).describe("The time when the project was created."),
+		updated_at: zod.iso.datetime({ offset: true }).describe("The time when the project was last updated.")
 	}).describe("The current state of a project.")),
-	next_page_token: zod.union([zod.string(), zod.null()]).optional().describe("Token to pass as `page_token` in the next request to fetch the following page.\nAbsent when there are no more results.\n")
+	next_page_token: zod.union([zod.string(), zod.null()]).optional().describe("Token to pass as `page_token` in the next request to fetch the following page.\nAbsent when there are no more results. The follow-up request must repeat the\nsame `sorting` that produced this token (omit only when both pages use the default).\n")
 }).describe("Paginated list of projects.");
 /**
 * Returns the current state of a project.
@@ -832,9 +772,9 @@ const GetProjectParams = zod.object({ project_id: zod.string().regex(getProjectP
 const GetProjectResponse = zod.object({
 	id: zod.string().describe("The unique identifier of the project."),
 	name: zod.string().describe("The name of the project."),
-	previewOrigins: zod.array(zod.string()).optional().describe("Origins which are allowed for previewing and testing the project.\n"),
-	createdAt: zod.iso.datetime({ offset: true }).describe("The time when the project was created."),
-	updatedAt: zod.iso.datetime({ offset: true }).describe("The time when the project was last updated.")
+	preview_origins: zod.array(zod.string()).optional().describe("Origins which are allowed for previewing and testing the project.\n"),
+	created_at: zod.iso.datetime({ offset: true }).describe("The time when the project was created."),
+	updated_at: zod.iso.datetime({ offset: true }).describe("The time when the project was last updated.")
 }).describe("The current state of a project.");
 /**
 * Updates the state of a project.
@@ -847,11 +787,60 @@ const PatchProjectBody = zod.object({ name: zod.union([zod.null(), zod.string()]
 const PatchProjectResponse = zod.object({
 	id: zod.string().describe("The unique identifier of the project."),
 	name: zod.string().describe("The name of the project."),
-	previewOrigins: zod.array(zod.string()).optional().describe("Origins which are allowed for previewing and testing the project.\n"),
-	createdAt: zod.iso.datetime({ offset: true }).describe("The time when the project was created."),
-	updatedAt: zod.iso.datetime({ offset: true }).describe("The time when the project was last updated.")
+	preview_origins: zod.array(zod.string()).optional().describe("Origins which are allowed for previewing and testing the project.\n"),
+	created_at: zod.iso.datetime({ offset: true }).describe("The time when the project was created."),
+	updated_at: zod.iso.datetime({ offset: true }).describe("The time when the project was last updated.")
 }).describe("The current state of a project.");
 /**
+* Starts a claim challenge for an unclaimed project. Authenticated by the
+project secret, this mints a single-use, short-lived challenge and returns
+the `claim_url` the developer opens in a browser to complete the claim,
+together with the `challenge_id` the CLI polls with. The exact expiry is
+carried by `expires_at` on the response.
+
+* @summary Initialize a project claim
+*/
+const initClaimPathProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const InitClaimParams = zod.object({ project_id: zod.string().regex(initClaimPathProjectIdRegExp) });
+/**
+* Polled by the CLI while a browser completes the claim. Authorized by the
+project secret that initiated the challenge. Returns `pending`, or
+`completed` with the owning team, the claim timestamp, and the dashboard
+URL once the browser leg has finished.
+
+* @summary Get claim status
+*/
+const getClaimStatusPathProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const GetClaimStatusParams = zod.object({ project_id: zod.string().regex(getClaimStatusPathProjectIdRegExp) });
+const getClaimStatusQueryChallengeIdRegExp = /* @__PURE__ */ new RegExp("^ch_[a-zA-Z0-9_-]+$");
+const GetClaimStatusQueryParams = zod.strictObject({ challenge_id: zod.string().regex(getClaimStatusQueryChallengeIdRegExp).describe("The challenge minted by the matching claim init.") });
+const getClaimStatusResponseTwoTeamIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const GetClaimStatusResponse = zod.union([zod.object({ status: zod.enum(["pending"]).describe("The claim has not completed yet.") }).describe("A claim challenge that is still awaiting the browser leg."), zod.object({
+	status: zod.enum(["completed"]).describe("The claim has completed."),
+	team_id: zod.string().regex(getClaimStatusResponseTwoTeamIdRegExp),
+	claimed_at: zod.iso.datetime({ offset: true }).describe("The time when the project was claimed."),
+	dashboard_url: zod.url().describe("The dashboard URL for the owning team.")
+}).describe("A completed claim. Carries the owning team, when the claim landed, and the\ndashboard where it can be managed, so a generated client can rely on those\nfields being present whenever `status` is `completed`.\n")]).describe("The state of a claim challenge. While pending it carries only `status`; once\ncompleted it also carries the owning team, the claim timestamp, and the\ndashboard URL. Modelled as discriminated variants so a `pending` response can\nnever carry stale completion fields and a `completed` response always carries\nthem.\n");
+/**
+* Called by the browser after the developer authenticates on the claim page.
+Authenticated by the `__nextgen_session` cookie, it attaches the project to
+the developer's personal team using the `challenge_id` from the claim URL as
+its single-use, browser-safe authorization.
+
+* @summary Complete a project claim
+*/
+const completeClaimPathProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const CompleteClaimParams = zod.object({ project_id: zod.string().regex(completeClaimPathProjectIdRegExp) });
+const completeClaimBodyChallengeIdRegExp = /* @__PURE__ */ new RegExp("^ch_[a-zA-Z0-9_-]+$");
+const CompleteClaimBody = zod.object({ challenge_id: zod.string().regex(completeClaimBodyChallengeIdRegExp).describe("Unique identifier for this challenge (dialect-minted prefixed opaque string).") }).describe("The request to complete a project claim.");
+const completeClaimResponseProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const completeClaimResponseTeamIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const CompleteClaimResponse = zod.object({
+	project_id: zod.string().regex(completeClaimResponseProjectIdRegExp),
+	team_id: zod.string().regex(completeClaimResponseTeamIdRegExp),
+	claimed_at: zod.iso.datetime({ offset: true }).describe("The time when the project was claimed.")
+}).describe("The result of a completed project claim.");
+/**
 * Creates an anonymous session shell with no user and no factors (`state: building`).
 
 This is optional — an `auth_attempt` will create a session implicitly if none is provided.
@@ -860,8 +849,16 @@ Use this explicitly when you want to:
 can be correlated with the eventual authenticated session from the start.
 - Track anonymous state (bot detection, device fingerprint) that survives until authentication.
 
-The returned `session_token` authorises GET and DELETE on this session.
-It is superseded when a handoff exchange completes — clients must replace it at that point.
+Creating a session is an app-plane operation on the project credential
+(`session.write`). The returned `session_token` is a session credential for the
+end-user client, not a management scope: it is delivered as the
+`__nextgen_session` cookie and authorises the self-service operations
+`GET /sessions/me` and `DELETE /sessions/me` (`nextgenSession` scheme). The
+by-id operations `GET /sessions/{session_id}` and `DELETE /sessions/{session_id}`
+are operator endpoints and require `session.read` / `session.delete` instead.
+
+The `session_token` is superseded when a handoff exchange completes — clients must
+replace it at that point.
 
 Anonymous sessions expire aggressively (10-minute TTL). The TTL resets to the configured
 full session TTL when the first authentication factor is written via a completing `auth_attempt`.
@@ -877,42 +874,61 @@ const CreateSessionBody = zod.object({
 	}).optional().describe("Optional user agent / device context to attach to the session.\nUseful for correlating telemetry and device signals with the eventual\nauthenticated session from the start.\n")
 }).describe("Request to create an anonymous session shell.");
 /**
-* Returns a paginated list of sessions for a project.
-Requires a project service key (OAuth2 client credentials).
+* Returns the sessions of a project, paginated with a cursor.
+Sessions of every lifecycle state are returned; each carries its `state`.
+Requires `session.read` permission.
 
-* @summary List sessions
+* @summary Query sessions
 */
-const listSessionsQueryLimitDefault = 20;
-const listSessionsQueryLimitMax = 100;
-const listSessionsQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const listSessionsQueryUserIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
-const ListSessionsQueryParams = zod.strictObject({
-	limit: zod.number().min(1).max(100).default(20).describe("Maximum number of items to return."),
-	page_token: zod.string().optional().describe("Token for fetching the next page of results.\nObtain this value from `next_page_token` in the previous response.\nOmit to start from the beginning.\nIts format is opaque and may change between releases.\n"),
-	project_id: zod.string().regex(listSessionsQueryProjectIdRegExp).describe("The unique identifier of the project"),
-	state: zod.enum([
-		"building",
-		"active",
-		"expired",
-		"revoked"
-	]).optional().describe("Filter sessions by lifecycle state."),
-	user_id: zod.string().regex(listSessionsQueryUserIdRegExp).optional().describe("Filter sessions by user.")
-});
-const listSessionsResponseSessionsItemSessionIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const listSessionsResponseSessionsItemProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const listSessionsResponseSessionsItemUserIdOneRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
-const listSessionsResponseSessionsItemFactorsItemPayloadOneUserIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
-const ListSessionsResponse = zod.object({
+const querySessionsQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const QuerySessionsQueryParams = zod.strictObject({ project_id: zod.string().regex(querySessionsQueryProjectIdRegExp).describe("The unique identifier of the project") });
+const querySessionsBodyLimitDefault = 20;
+const querySessionsBodyLimitMax = 100;
+const QuerySessionsBody = zod.object({
+	limit: zod.number().min(1).max(100).default(20),
+	page_token: zod.union([zod.string(), zod.null()]).optional().describe("Token to retrieve the next page of results."),
+	sorting: zod.object({
+		field: zod.enum(["created_at", "user_id"]).describe("Field to sort sessions by. Only stored columns are sortable: the keyset\ncursor holds the last row's sort values, so a computed value such as\n`state` would skip or duplicate rows between pages.\n"),
+		direction: zod.enum(["asc", "desc"])
+	}).optional(),
+	filter: zod.array(zod.object({
+		field: zod.enum([
+			"created_at",
+			"user_id",
+			"state"
+		]).describe("Field to filter sessions by:\n- `created_at`: RFC3339 timestamp\n- `user_id`: user id\n- `state`: one of `building`, `active`, `expired`\n"),
+		value: zod.union([
+			zod.string(),
+			zod.number(),
+			zod.boolean(),
+			zod.null()
+		]).optional().describe("Filter-value specifies which values can be filtered by a query endpoint. This\nis a union of types. When a value is specified which is not assignable to the\nfield which is being filtered, a 400 error will be returned.\n"),
+		operation: zod.enum([
+			"equals",
+			"not_equals",
+			"contains",
+			"not_contains",
+			"less_than",
+			"less_than_or_equal",
+			"greater_than",
+			"greater_than_or_equal"
+		]).describe("Filter operation defines the operations which can be used when filtering on a\nquery endpoint.\n")
+	})).optional().describe("Filter criteria for querying sessions.")
+}).describe("Request to query the sessions of a project.");
+const querySessionsResponseSessionsItemSessionIdRegExp = /* @__PURE__ */ new RegExp("^sess_[a-zA-Z0-9_-]+$");
+const querySessionsResponseSessionsItemProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const querySessionsResponseSessionsItemUserIdOneRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
+const querySessionsResponseSessionsItemFactorsItemPayloadOneUserIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
+const QuerySessionsResponse = zod.object({
 	sessions: zod.array(zod.object({
-		session_id: zod.string().regex(listSessionsResponseSessionsItemSessionIdRegExp).describe("Unique identifier for this session."),
-		project_id: zod.string().regex(listSessionsResponseSessionsItemProjectIdRegExp),
+		session_id: zod.string().regex(querySessionsResponseSessionsItemSessionIdRegExp).describe("Unique identifier for this session (dialect-minted prefixed opaque string)."),
+		project_id: zod.string().regex(querySessionsResponseSessionsItemProjectIdRegExp),
 		state: zod.enum([
 			"building",
 			"active",
-			"expired",
-			"revoked"
-		]).describe("Current lifecycle state of the session:\n- `building`: has a user factor but is still gathering authentication factors\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n- `revoked`: explicitly revoked via DELETE\n"),
-		user_id: zod.union([zod.string().regex(listSessionsResponseSessionsItemUserIdOneRegExp), zod.null()]).optional().describe("The authenticated user. Null for anonymous sessions and until the `user`\nfactor has been verified through an `auth_attempt`.\n"),
+			"expired"
+		]).describe("Current lifecycle state of the session:\n- `building`: has a user factor but is still gathering authentication factors\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n"),
+		user_id: zod.union([zod.string().regex(querySessionsResponseSessionsItemUserIdOneRegExp), zod.null()]).optional().describe("The authenticated user. Null for anonymous sessions and until the `user`\nfactor has been verified through an `auth_attempt`.\n"),
 		name: zod.string().optional().describe("Human-readable name of the authenticated user, resolved from the\nconventional user-schema properties: `name` when defined, otherwise\nthe given and family name parts joined — `givenName`/`familyName`\n(the shipped presets' spelling) or `given_name`/`family_name`. Only\npresent on reads that hydrate the user's identity\n(`GET /sessions/me`) and only when the session has an authenticated\nuser whose schema carries those properties; clients fall back to\n`email`, then `user_id`.\n"),
 		email: zod.string().optional().describe("Email address of the authenticated user, resolved from the\nconventional `email` user-schema property. Only present on reads\nthat hydrate the user's identity (`GET /sessions/me`) and only when\nthe session has an authenticated user whose schema carries that\nproperty.\n"),
 		factors: zod.array(zod.object({
@@ -923,7 +939,7 @@ const ListSessionsResponse = zod.object({
 			]).describe("An authentication factor method."),
 			verified_at: zod.iso.datetime({ offset: true }).describe("When this factor was successfully verified"),
 			payload: zod.union([
-				zod.object({ user_id: zod.string().regex(listSessionsResponseSessionsItemFactorsItemPayloadOneUserIdRegExp) }).describe("Identifier-specific factor metadata"),
+				zod.object({ user_id: zod.string().regex(querySessionsResponseSessionsItemFactorsItemPayloadOneUserIdRegExp) }).describe("Identifier-specific factor metadata"),
 				zod.object({}).describe("Password authentication has no additional metadata beyond the base factor fields"),
 				zod.object({
 					credential_id: zod.string().describe("The credential ID that was used"),
@@ -973,20 +989,19 @@ const ExchangeHandoffBody = zod.object({
 	handoff_token: zod.string().describe("The one-time handoff token minted by `POST /auth_attempts/{id}/handoff`.\nSingle-use — replaying it after a successful exchange returns `410 Gone`.\n"),
 	ttl: zod.string().optional().describe("Optional session lifetime after exchange as an ISO-8601 duration. When omitted, the server\nuses the configured default. Must not exceed the configured maximum.\n")
 }).describe("Request to exchange a handoff token for a session and session_token.");
-const exchangeHandoffResponseSessionSessionIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const exchangeHandoffResponseSessionSessionIdRegExp = /* @__PURE__ */ new RegExp("^sess_[a-zA-Z0-9_-]+$");
 const exchangeHandoffResponseSessionProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
 const exchangeHandoffResponseSessionUserIdOneRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
 const exchangeHandoffResponseSessionFactorsItemPayloadOneUserIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
 const ExchangeHandoffResponse = zod.object({
 	session: zod.object({
-		session_id: zod.string().regex(exchangeHandoffResponseSessionSessionIdRegExp).describe("Unique identifier for this session."),
+		session_id: zod.string().regex(exchangeHandoffResponseSessionSessionIdRegExp).describe("Unique identifier for this session (dialect-minted prefixed opaque string)."),
 		project_id: zod.string().regex(exchangeHandoffResponseSessionProjectIdRegExp),
 		state: zod.enum([
 			"building",
 			"active",
-			"expired",
-			"revoked"
-		]).describe("Current lifecycle state of the session:\n- `building`: has a user factor but is still gathering authentication factors\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n- `revoked`: explicitly revoked via DELETE\n"),
+			"expired"
+		]).describe("Current lifecycle state of the session:\n- `building`: has a user factor but is still gathering authentication factors\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n"),
 		user_id: zod.union([zod.string().regex(exchangeHandoffResponseSessionUserIdOneRegExp), zod.null()]).optional().describe("The authenticated user. Null for anonymous sessions and until the `user`\nfactor has been verified through an `auth_attempt`.\n"),
 		name: zod.string().optional().describe("Human-readable name of the authenticated user, resolved from the\nconventional user-schema properties: `name` when defined, otherwise\nthe given and family name parts joined — `givenName`/`familyName`\n(the shipped presets' spelling) or `given_name`/`family_name`. Only\npresent on reads that hydrate the user's identity\n(`GET /sessions/me`) and only when the session has an authenticated\nuser whose schema carries those properties; clients fall back to\n`email`, then `user_id`.\n"),
 		email: zod.string().optional().describe("Email address of the authenticated user, resolved from the\nconventional `email` user-schema property. Only present on reads\nthat hydrate the user's identity (`GET /sessions/me`) and only when\nthe session has an authenticated user whose schema carries that\nproperty.\n"),
@@ -1030,23 +1045,22 @@ against the same `session_id`) to restore a dropped assurance level.
 
 * @summary Get session state
 */
-const getSessionPathSessionIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getSessionPathSessionIdRegExp = /* @__PURE__ */ new RegExp("^sess_[a-zA-Z0-9_-]+$");
 const GetSessionParams = zod.object({ session_id: zod.string().regex(getSessionPathSessionIdRegExp).describe("The unique identifier of the session.") });
 const getSessionQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
 const GetSessionQueryParams = zod.strictObject({ project_id: zod.string().regex(getSessionQueryProjectIdRegExp).describe("The unique identifier of the project") });
-const getSessionResponseSessionIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getSessionResponseSessionIdRegExp = /* @__PURE__ */ new RegExp("^sess_[a-zA-Z0-9_-]+$");
 const getSessionResponseProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
 const getSessionResponseUserIdOneRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
 const getSessionResponseFactorsItemPayloadOneUserIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
 const GetSessionResponse = zod.object({
-	session_id: zod.string().regex(getSessionResponseSessionIdRegExp).describe("Unique identifier for this session."),
+	session_id: zod.string().regex(getSessionResponseSessionIdRegExp).describe("Unique identifier for this session (dialect-minted prefixed opaque string)."),
 	project_id: zod.string().regex(getSessionResponseProjectIdRegExp),
 	state: zod.enum([
 		"building",
 		"active",
-		"expired",
-		"revoked"
-	]).describe("Current lifecycle state of the session:\n- `building`: has a user factor but is still gathering authentication factors\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n- `revoked`: explicitly revoked via DELETE\n"),
+		"expired"
+	]).describe("Current lifecycle state of the session:\n- `building`: has a user factor but is still gathering authentication factors\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n"),
 	user_id: zod.union([zod.string().regex(getSessionResponseUserIdOneRegExp), zod.null()]).optional().describe("The authenticated user. Null for anonymous sessions and until the `user`\nfactor has been verified through an `auth_attempt`.\n"),
 	name: zod.string().optional().describe("Human-readable name of the authenticated user, resolved from the\nconventional user-schema properties: `name` when defined, otherwise\nthe given and family name parts joined — `givenName`/`familyName`\n(the shipped presets' spelling) or `given_name`/`family_name`. Only\npresent on reads that hydrate the user's identity\n(`GET /sessions/me`) and only when the session has an authenticated\nuser whose schema carries those properties; clients fall back to\n`email`, then `user_id`.\n"),
 	email: zod.string().optional().describe("Email address of the authenticated user, resolved from the\nconventional `email` user-schema property. Only present on reads\nthat hydrate the user's identity (`GET /sessions/me`) and only when\nthe session has an authenticated user whose schema carries that\nproperty.\n"),
@@ -1079,14 +1093,19 @@ const GetSessionResponse = zod.object({
 	expires_at: zod.iso.datetime({ offset: true }).describe("When this session expires. Short TTL (10 min) for anonymous sessions;\nreset to the full configured session TTL once the first authentication factor is written.\n")
 }).describe("The current state of a session.\n\nA session is the durable post-auth primitive. It accumulates verified authentication\nfactors and exposes `assurance_levels[]` — the set of assurance profiles its current\nfactors satisfy. Sessions are read-only from the client's perspective: factors flow\nin through `auth_attempts`.\n");
 /**
-* Revokes the session immediately (`state: revoked`). This is the logout operation.
+* Permanently deletes the session, terminating it immediately.
 
-The session_token issued at creation (or superseded by a handoff exchange) is required.
-After revocation, any tokens derived from this session are invalidated.
+This is the operator revoke path and requires the `session.delete` scope on a
+project-bound credential. End-user logout with the `__nextgen_session` cookie is
+`DELETE /sessions/me` (`nextgenSession` scheme).
+
+Idempotent: deleting a session that does not exist (or was already deleted)
+still returns 204. After deletion, any tokens derived from the session are
+invalidated.
 
 * @summary Revoke session
 */
-const revokeSessionPathSessionIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const revokeSessionPathSessionIdRegExp = /* @__PURE__ */ new RegExp("^sess_[a-zA-Z0-9_-]+$");
 const RevokeSessionParams = zod.object({ session_id: zod.string().regex(revokeSessionPathSessionIdRegExp).describe("The unique identifier of the session.") });
 const revokeSessionQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
 const RevokeSessionQueryParams = zod.strictObject({ project_id: zod.string().regex(revokeSessionQueryProjectIdRegExp).describe("The unique identifier of the project") });
@@ -1100,19 +1119,18 @@ against the same `session_id`) to restore a dropped assurance level.
 
 * @summary Get my session state
 */
-const getMySessionResponseSessionIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const getMySessionResponseSessionIdRegExp = /* @__PURE__ */ new RegExp("^sess_[a-zA-Z0-9_-]+$");
 const getMySessionResponseProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
 const getMySessionResponseUserIdOneRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
 const getMySessionResponseFactorsItemPayloadOneUserIdRegExp = /* @__PURE__ */ new RegExp("^user_[a-zA-Z0-9_-]+$");
 const GetMySessionResponse = zod.object({
-	session_id: zod.string().regex(getMySessionResponseSessionIdRegExp).describe("Unique identifier for this session."),
+	session_id: zod.string().regex(getMySessionResponseSessionIdRegExp).describe("Unique identifier for this session (dialect-minted prefixed opaque string)."),
 	project_id: zod.string().regex(getMySessionResponseProjectIdRegExp),
 	state: zod.enum([
 		"building",
 		"active",
-		"expired",
-		"revoked"
-	]).describe("Current lifecycle state of the session:\n- `building`: has a user factor but is still gathering authentication factors\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n- `revoked`: explicitly revoked via DELETE\n"),
+		"expired"
+	]).describe("Current lifecycle state of the session:\n- `building`: has a user factor but is still gathering authentication factors\n- `active`: has at least one verified authentication factor; `assurance_levels[]` may shrink as factors age\n- `expired`: TTL elapsed\n"),
 	user_id: zod.union([zod.string().regex(getMySessionResponseUserIdOneRegExp), zod.null()]).optional().describe("The authenticated user. Null for anonymous sessions and until the `user`\nfactor has been verified through an `auth_attempt`.\n"),
 	name: zod.string().optional().describe("Human-readable name of the authenticated user, resolved from the\nconventional user-schema properties: `name` when defined, otherwise\nthe given and family name parts joined — `givenName`/`familyName`\n(the shipped presets' spelling) or `given_name`/`family_name`. Only\npresent on reads that hydrate the user's identity\n(`GET /sessions/me`) and only when the session has an authenticated\nuser whose schema carries those properties; clients fall back to\n`email`, then `user_id`.\n"),
 	email: zod.string().optional().describe("Email address of the authenticated user, resolved from the\nconventional `email` user-schema property. Only present on reads\nthat hydrate the user's identity (`GET /sessions/me`) and only when\nthe session has an authenticated user whose schema carries that\nproperty.\n"),
@@ -1145,10 +1163,12 @@ const GetMySessionResponse = zod.object({
 	expires_at: zod.iso.datetime({ offset: true }).describe("When this session expires. Short TTL (10 min) for anonymous sessions;\nreset to the full configured session TTL once the first authentication factor is written.\n")
 }).describe("The current state of a session.\n\nA session is the durable post-auth primitive. It accumulates verified authentication\nfactors and exposes `assurance_levels[]` — the set of assurance profiles its current\nfactors satisfy. Sessions are read-only from the client's perspective: factors flow\nin through `auth_attempts`.\n");
 /**
-* Create a new schema. The schema definition must include a unique $id field,
-which will be used to identify the schema in future requests. The $id must
-be a valid URI and should ideally point to the location where the schema
-can be accessed.
+* Create a new schema. The optional `$id` field is the JSON Schema document
+URI used to identify the schema in future requests (GitOps-stable identity,
+not a free-form resource primary key). When `$id` is omitted, the server
+generates a `sch_*` URL. When provided, `$id` must be unique within the
+project and should ideally be a valid URI pointing at where the schema can
+be accessed.
 
 The schema can either be a concrete schema, e.g. a user schema, or a
 schema-url which will be resolved by the server.
@@ -1206,9 +1226,9 @@ const CreateSchemaBody = zod.union([zod.object({
 		"x-claim": zod.union([zod.string(), zod.null()]).optional().describe("The claim name for this property, if applicable"),
 		"x-editable": zod.boolean().default(true).describe("Whether this property is editable by the user or not"),
 		"x-sensitive": zod.boolean().default(false).describe("Whether this property contains sensitive information or not"),
-		"x-mfa": zod.boolean().default(false).describe("Whether this property is used for multi-factor authentication or not"),
-		properties: zod.record(zod.string(), zod.unknown()).optional().describe("A map of additional properties for the user definition, where the key is the property name and the value is the property schema")
-	}).describe("This schema is missing `\"allOf\": [{\"$ref\": \"https://json-schema.org/draft/2020-12/schema\"}],`. \nThis is done because a lot of code generators cannot handle that.\n")).optional().describe("A map of additional properties for the user definition, where the\nkey is the property name and the value is the property schema\n")
+		"x-mfa": zod.boolean().default(false).describe("Whether this property is used for multi-factor authentication or not\n"),
+		properties: zod.record(zod.string(), zod.unknown()).optional().describe("A map of additional properties for the user definition, where the key is\nthe property name and the value is the property schema.\n")
+	}).describe("This schema is missing `\"allOf\": [{\"$ref\": \"https://json-schema.org/draft/2020-12/schema\"}],`. \nThis is done because a lot of code generators cannot handle that.\n\nA few properties are reserved:\n- id: is used to return the id of the user \n- metadata: is used to embed metadata of the user, like creation date, \n  status,... in a return object\n")).optional().describe("A map of additional properties for the user definition, where the\nkey is the property name and the value is the property schema\n")
 }).describe("This schema is missing `\"allOf\": [{\"$ref\": \"https://json-schema.org/draft/2020-12/schema\"}],`. \nThis is done because a lot of code generators cannot handle that.\n"), zod.object({
 	kind: zod.literal("schema-url").describe("Discriminator value for a user schema create request."),
 	url: zod.url().describe("URL to the schema definition.")
@@ -1231,7 +1251,7 @@ const ListSchemasQueryParams = zod.strictObject({
 });
 const ListSchemasResponseItem = zod.object({
 	id: zod.string().describe("The unique identifier for this schema."),
-	createdAt: zod.iso.datetime({ offset: true })
+	created_at: zod.iso.datetime({ offset: true })
 });
 const ListSchemasResponse = zod.array(ListSchemasResponseItem);
 /**
@@ -1290,9 +1310,9 @@ const GetSchemaByIdResponse = zod.object({
 		"x-claim": zod.union([zod.string(), zod.null()]).optional().describe("The claim name for this property, if applicable"),
 		"x-editable": zod.boolean().default(true).describe("Whether this property is editable by the user or not"),
 		"x-sensitive": zod.boolean().default(false).describe("Whether this property contains sensitive information or not"),
-		"x-mfa": zod.boolean().default(false).describe("Whether this property is used for multi-factor authentication or not"),
-		properties: zod.record(zod.string(), zod.unknown()).optional().describe("A map of additional properties for the user definition, where the key is the property name and the value is the property schema")
-	}).describe("This schema is missing `\"allOf\": [{\"$ref\": \"https://json-schema.org/draft/2020-12/schema\"}],`. \nThis is done because a lot of code generators cannot handle that.\n")).optional().describe("A map of additional properties for the user definition, where the\nkey is the property name and the value is the property schema\n")
+		"x-mfa": zod.boolean().default(false).describe("Whether this property is used for multi-factor authentication or not\n"),
+		properties: zod.record(zod.string(), zod.unknown()).optional().describe("A map of additional properties for the user definition, where the key is\nthe property name and the value is the property schema.\n")
+	}).describe("This schema is missing `\"allOf\": [{\"$ref\": \"https://json-schema.org/draft/2020-12/schema\"}],`. \nThis is done because a lot of code generators cannot handle that.\n\nA few properties are reserved:\n- id: is used to return the id of the user \n- metadata: is used to embed metadata of the user, like creation date, \n  status,... in a return object\n")).optional().describe("A map of additional properties for the user definition, where the\nkey is the property name and the value is the property schema\n")
 }).describe("This schema is missing `\"allOf\": [{\"$ref\": \"https://json-schema.org/draft/2020-12/schema\"}],`. \nThis is done because a lot of code generators cannot handle that.\n");
 /**
 * Creates a new flow definition.
@@ -1577,32 +1597,61 @@ const DeleteFlowDefinitionParams = zod.object({ id: zod.string().describe("The i
 const deleteFlowDefinitionQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
 const DeleteFlowDefinitionQueryParams = zod.strictObject({ project_id: zod.string().regex(deleteFlowDefinitionQueryProjectIdRegExp).describe("The project id to filter by.") });
 /**
-* Activate a flow definition by transitioning it from a `draft` state to an `active` state.
-Alternatively, the status of a flow definition can also be set via the `POST /flow_definitions` and `PUT /flow_definitions/{id}` endpoints by setting the `status` attribute in the flow definition payload.
-
-* @summary Activate a flow definition by ID.
-*/
-const ActivateFlowDefinitionParams = zod.object({ id: zod.string().describe("The id returned by the POST /flow_definitions endpoint.\n") });
-const activateFlowDefinitionQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const ActivateFlowDefinitionQueryParams = zod.strictObject({ project_id: zod.string().regex(activateFlowDefinitionQueryProjectIdRegExp).describe("The unique identifier of the project") });
-/**
-* Deactivates a flow definition in the `active` state by transitioning it to the `draft` state.
-Flow definitions in `draft` state cannot be used to start new flows. Existing flows that use the deactivated flow definition must gracefully handle this.
-Alternatively, the status of a flow definition can also be set via the `POST /flow_definitions` and `PUT /flow_definitions/{id}` endpoints by setting the `status` attribute in the flow definition payload.
-
-* @summary Deactivate a flow definition by ID.
-*/
-const DeactivateFlowDefinitionParams = zod.object({ id: zod.string().describe("The id returned by the POST /flow_definitions endpoint.\n") });
-const deactivateFlowDefinitionQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
-const DeactivateFlowDefinitionQueryParams = zod.strictObject({ project_id: zod.string().regex(deactivateFlowDefinitionQueryProjectIdRegExp).describe("The unique identifier of the project") });
-/**
 * @summary Create team
 */
 const createTeamQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
 const CreateTeamQueryParams = zod.strictObject({ project_id: zod.string().regex(createTeamQueryProjectIdRegExp).describe("The unique identifier of the project") });
-const CreateTeamBody = zod.looseObject({});
+const createTeamBodyNameMax = 200;
+const CreateTeamBody = zod.object({ name: zod.string().min(1).max(200).describe("The name of the team. Must be unique within the project.") });
 /**
-* Returns the current state of a team.
+* Returns the teams of a project, paginated with a cursor.
+Teams of every lifecycle status are returned; each carries its `status`.
+
+* @summary Query teams
+*/
+const queryTeamsQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const QueryTeamsQueryParams = zod.strictObject({ project_id: zod.string().regex(queryTeamsQueryProjectIdRegExp).describe("The unique identifier of the project") });
+const queryTeamsBodyLimitDefault = 20;
+const queryTeamsBodyLimitMax = 100;
+const QueryTeamsBody = zod.object({
+	limit: zod.number().min(1).max(100).default(20),
+	page_token: zod.union([zod.string(), zod.null()]).optional().describe("Token to retrieve the next page of results. Must be sent with the same\n`sorting` as the request that issued the token. Omitting `sorting` reuses\nthe default sort and only succeeds when that default matches the token.\n"),
+	sorting: zod.object({
+		field: zod.enum(["created_at"]),
+		direction: zod.enum(["asc", "desc"])
+	}).optional(),
+	filter: zod.array(zod.object({
+		field: zod.enum(["created_at"]),
+		value: zod.union([
+			zod.string(),
+			zod.number(),
+			zod.boolean(),
+			zod.null()
+		]).optional().describe("Filter-value specifies which values can be filtered by a query endpoint. This\nis a union of types. When a value is specified which is not assignable to the\nfield which is being filtered, a 400 error will be returned.\n"),
+		operation: zod.enum([
+			"equals",
+			"not_equals",
+			"contains",
+			"not_contains",
+			"less_than",
+			"less_than_or_equal",
+			"greater_than",
+			"greater_than_or_equal"
+		]).describe("Filter operation defines the operations which can be used when filtering on a\nquery endpoint.\n")
+	})).optional().describe("Filter criteria for querying teams.")
+}).describe("Request to query the teams of a project.");
+const QueryTeamsResponse = zod.object({
+	teams: zod.array(zod.object({
+		id: zod.string().describe("The unique identifier of the team."),
+		name: zod.string().describe("The name of the team."),
+		status: zod.enum(["active", "deactivated"]).describe("The lifecycle state of a team.\n\nactive: The team is available for use.\ndeactivated: The team is no longer active but is retained for historical and audit purposes.\n"),
+		created_at: zod.iso.datetime({ offset: true }).describe("The time when the team was created."),
+		updated_at: zod.iso.datetime({ offset: true }).describe("The time when the team was last updated.")
+	}).describe("Details of a team.")),
+	next_page_token: zod.union([zod.string(), zod.null()]).optional().describe("Token to pass as `page_token` in the next request to fetch the following page.\nAbsent when there are no more results. The follow-up request must repeat the\nsame `sorting` that produced this token (omit only when both pages use the default).\n")
+}).describe("Paginated list of teams.");
+/**
+* Returns a Team by its id.
 
 * @summary Get team
 */
@@ -1612,10 +1661,106 @@ const getTeamQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$
 const GetTeamQueryParams = zod.strictObject({ project_id: zod.string().regex(getTeamQueryProjectIdRegExp).describe("The unique identifier of the project") });
 const GetTeamResponse = zod.object({
 	id: zod.string().describe("The unique identifier of the team."),
-	createdAt: zod.iso.datetime({ offset: true }).describe("The time when the team was created."),
-	updatedAt: zod.iso.datetime({ offset: true }).describe("The time when the team was last updated.")
-}).describe("The current state of a team.");
+	name: zod.string().describe("The name of the team."),
+	status: zod.enum(["active", "deactivated"]).describe("The lifecycle state of a team.\n\nactive: The team is available for use.\ndeactivated: The team is no longer active but is retained for historical and audit purposes.\n"),
+	created_at: zod.iso.datetime({ offset: true }).describe("The time when the team was created."),
+	updated_at: zod.iso.datetime({ offset: true }).describe("The time when the team was last updated.")
+}).describe("Details of a team.");
+/**
+* Deactivates the team.
+
+The team is tombstoned rather than erased: it stays readable through
+getTeam with status `deactivated`. Its memberships are removed and the
+users whose lifecycle it owns are deactivated with it.
+
+The request is idempotent. Deleting a team that is already deactivated
+or doesn't exist succeeds without changing anything.
+
+* @summary Delete team
+*/
+const deleteTeamPathTeamIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const DeleteTeamParams = zod.object({ team_id: zod.string().regex(deleteTeamPathTeamIdRegExp) });
+const deleteTeamQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const DeleteTeamQueryParams = zod.strictObject({ project_id: zod.string().regex(deleteTeamQueryProjectIdRegExp).describe("The unique identifier of the project") });
+/**
+* Update team. Only active teams can be updated.
+
+* @summary Update team
+*/
+const updateTeamPathTeamIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const UpdateTeamParams = zod.object({ team_id: zod.string().regex(updateTeamPathTeamIdRegExp) });
+const updateTeamQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const UpdateTeamQueryParams = zod.strictObject({ project_id: zod.string().regex(updateTeamQueryProjectIdRegExp).describe("The unique identifier of the project") });
+const updateTeamBodyNameMax = 200;
+const UpdateTeamBody = zod.object({ name: zod.string().min(1).max(200).optional().describe("The name of the team. Must be unique within the project.") });
+const UpdateTeamResponse = zod.object({
+	id: zod.string().describe("The unique identifier of the team."),
+	name: zod.string().describe("The name of the team."),
+	status: zod.enum(["active", "deactivated"]).describe("The lifecycle state of a team.\n\nactive: The team is available for use.\ndeactivated: The team is no longer active but is retained for historical and audit purposes.\n"),
+	created_at: zod.iso.datetime({ offset: true }).describe("The time when the team was created."),
+	updated_at: zod.iso.datetime({ offset: true }).describe("The time when the team was last updated.")
+}).describe("Details of a team.");
+/**
+* Publishes a new immutable branding revision for the project. Branding
+revisions cannot be updated or deleted; every edit publishes a new
+revision, and flow responses resolve the latest revision per project
+(see ADR 040).
+
+The `liquid_template` is validated lexically on save (size, encoding,
+banned patterns such as `<script>` tags, inline event handlers, and the
+`| raw` filter). Authoritative LiquidJS validation runs at authoring
+time via `zitadel plan` / `zitadel apply`.
+
+* @summary Publish a new branding revision
+*/
+const createBrandingQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const CreateBrandingQueryParams = zod.strictObject({ project_id: zod.string().regex(createBrandingQueryProjectIdRegExp).describe("The unique identifier of the project") });
+const createBrandingBodyLayoutDefault = `centered`;
+const createBrandingBodyLiquidTemplateMax = 131072;
+const CreateBrandingBody = zod.object({
+	layout: zod.enum(["centered", "split"]).default(createBrandingBodyLayoutDefault).describe("Layout preset selector. The default.liquid master template uses this\nto branch into layout variants. Customers who eject the template\ncan ignore this field entirely; it also serves as the degrade target\nwhen a custom template fails component-side validation.\n"),
+	liquid_template: zod.string().max(createBrandingBodyLiquidTemplateMax).optional().describe("The LiquidJS template string for rendering this step. The orchestrator\nparses this template, injects the capability dictionaries as context,\nand renders the output HTML into its Shadow DOM.\n"),
+	logo_url: zod.url().optional().describe("Team logo URL."),
+	font_url: zod.url().optional().describe("Custom font stylesheet URL (e.g., Google Fonts CSS). Read-only in\nv1: `POST /branding` rejects a non-empty value, because the login\ncomponent loads this stylesheet at document level (shadow-scoped\n`@font-face` rules never register faces) and an arbitrary URL would\ngrant `branding.write` page-wide CSS control over the embedding\napplication. Safe tenant font delivery is an ADR 040 follow-up;\nuntil then, load fonts from the embedding page.\n"),
+	hero_url: zod.url().optional().describe("Hero/background image URL (used by split layout).")
+}).describe("Branding configuration. Appears in two places with one shape:\n\n- On flow responses as a read-only projection: the server resolves the\n  latest branding revision for the project per step response (falling\n  back to built-in defaults when none is stored). Branding is configured\n  via the Branding API / `zitadel apply`, not the Flow API.\n- As the request body of `POST /branding`, which publishes the same\n  shape as a new immutable revision (see ADR 040).\n");
+/**
+* Lists branding revisions for the project, newest first, capped at the
+100 most recent. The first entry is the revision flow responses
+currently resolve. Deliberately unpaginated in v1 — list endpoints
+gain a real query mechanism together (ADR 031); advertising pagination
+parameters the server ignores would be worse than none.
+
+* @summary List branding revisions
+*/
+const listBrandingQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const ListBrandingQueryParams = zod.strictObject({ project_id: zod.string().regex(listBrandingQueryProjectIdRegExp).describe("The unique identifier of the project") });
+const ListBrandingResponseItem = zod.object({
+	id: zod.string().describe("The unique identifier of this branding revision."),
+	created_at: zod.iso.datetime({ offset: true }).describe("When this revision was published.")
+});
+const ListBrandingResponse = zod.array(ListBrandingResponseItem);
+/**
+* Retrieves a single branding revision, including its stored configuration.
+* @summary Get a branding revision by ID
+*/
+const GetBrandingByIdParams = zod.object({ id: zod.string() });
+const getBrandingByIdQueryProjectIdRegExp = /* @__PURE__ */ new RegExp("^[a-zA-Z0-9_-]+$");
+const GetBrandingByIdQueryParams = zod.strictObject({ project_id: zod.string().regex(getBrandingByIdQueryProjectIdRegExp).describe("The unique identifier of the project") });
+const getBrandingByIdResponseBrandingLayoutDefault = `centered`;
+const getBrandingByIdResponseBrandingLiquidTemplateMax = 131072;
+const GetBrandingByIdResponse = zod.object({
+	id: zod.string().describe("The unique identifier of this branding revision."),
+	created_at: zod.iso.datetime({ offset: true }).describe("When this revision was published."),
+	branding: zod.object({
+		layout: zod.enum(["centered", "split"]).default(getBrandingByIdResponseBrandingLayoutDefault).describe("Layout preset selector. The default.liquid master template uses this\nto branch into layout variants. Customers who eject the template\ncan ignore this field entirely; it also serves as the degrade target\nwhen a custom template fails component-side validation.\n"),
+		liquid_template: zod.string().max(getBrandingByIdResponseBrandingLiquidTemplateMax).optional().describe("The LiquidJS template string for rendering this step. The orchestrator\nparses this template, injects the capability dictionaries as context,\nand renders the output HTML into its Shadow DOM.\n"),
+		logo_url: zod.url().optional().describe("Team logo URL."),
+		font_url: zod.url().optional().describe("Custom font stylesheet URL (e.g., Google Fonts CSS). Read-only in\nv1: `POST /branding` rejects a non-empty value, because the login\ncomponent loads this stylesheet at document level (shadow-scoped\n`@font-face` rules never register faces) and an arbitrary URL would\ngrant `branding.write` page-wide CSS control over the embedding\napplication. Safe tenant font delivery is an ADR 040 follow-up;\nuntil then, load fonts from the embedding page.\n"),
+		hero_url: zod.url().optional().describe("Hero/background image URL (used by split layout).")
+	}).describe("Branding configuration. Appears in two places with one shape:\n\n- On flow responses as a read-only projection: the server resolves the\n  latest branding revision for the project per step response (falling\n  back to built-in defaults when none is stored). Branding is configured\n  via the Branding API / `zitadel apply`, not the Flow API.\n- As the request body of `POST /branding`, which publishes the same\n  shape as a new immutable revision (see ADR 040).\n")
+}).describe("A stored branding revision. `branding` echoes the canonical stored\nconfiguration so clients (e.g. the CLI sync engine) can reconcile local\nfiles with the server's stored state.\n");
 //#endregion
-export { ActivateFlowDefinitionParams, ActivateFlowDefinitionQueryParams, AuthorizeDeviceQueryParams, AuthorizeDeviceResponse, AuthorizeGetQueryParams, CreateAuthAttemptBody, CreateFlowBody, CreateFlowDefinitionBody, CreateHandoffHeader, CreateHandoffParams, CreateHandoffResponse, CreateProjectBody, CreateSchemaBody, CreateSchemaQueryParams, CreateSessionBody, CreateTeamBody, CreateTeamQueryParams, CreateUserBody, CreateUserQueryParams, DeactivateFlowDefinitionParams, DeactivateFlowDefinitionQueryParams, DeleteFlowDefinitionParams, DeleteFlowDefinitionQueryParams, EndSessionQueryParams, ExchangeHandoffBody, ExchangeHandoffHeader, ExchangeHandoffQueryParams, ExchangeHandoffResponse, GetAuthAttemptParams, GetAuthAttemptResponse, GetFlowDefinitionParams, GetFlowDefinitionQueryParams, GetFlowDefinitionResponse, GetFlowStepParams, GetFlowStepResponse, GetKeysResponse, GetMySessionResponse, GetMyUserResponse, GetOpenIDConfigurationResponse, GetProjectParams, GetProjectResponse, GetSchemaByIdParams, GetSchemaByIdQueryParams, GetSchemaByIdResponse, GetSessionParams, GetSessionQueryParams, GetSessionResponse, GetTeamParams, GetTeamQueryParams, GetTeamResponse, GetTokenResponse, GetUserByIDParams, GetUserByIDQueryParams, GetUserByIDResponse, GetUserInfoResponse, IntrospectResponse, IssueChallengeBody, IssueChallengeParams, ListFlowDefinitionsQueryParams, ListFlowDefinitionsResponse, ListSchemasQueryParams, ListSchemasResponse, ListSchemasResponseItem, ListSessionsQueryParams, ListSessionsResponse, ListUsersQueryParams, ListUsersResponse, ListUsersResponseItem, PatchProjectBody, PatchProjectParams, PatchProjectResponse, QueryProjectsBody, QueryProjectsResponse, RevokeSessionParams, RevokeSessionQueryParams, SetUserPasswordBody, SetUserPasswordParams, SetUserPasswordQueryParams, SubmitFlowEventBody, SubmitFlowEventParams, SubmitFlowStepBody, SubmitFlowStepHeader, SubmitFlowStepParams, SubmitFlowStepResponse, UpdateFlowDefinitionBody, UpdateFlowDefinitionParams, UpdateFlowDefinitionQueryParams, UpdateFlowDefinitionResponse, VerifyChallengeProofBody, VerifyChallengeProofHeader, VerifyChallengeProofParams, VerifyChallengeProofResponse, activateFlowDefinitionQueryProjectIdRegExp, createAuthAttemptBodyProjectIdRegExp, createAuthAttemptBodySessionIdOneRegExp, createFlowBodyDryRunDefault, createFlowBodyFlowDefinitionNameRegExp, createFlowBodyProjectIdRegExp, createFlowBodySchemaVersionRegExp, createFlowDefinitionBodyFlowDefinitionNameRegExp, createFlowDefinitionBodyFlowDefinitionStepsItemActionsDefault, createFlowDefinitionBodyFlowDefinitionStepsItemActionsItemPrimaryDefault, createFlowDefinitionBodyFlowDefinitionStepsItemFieldsDefault, createFlowDefinitionBodyFlowDefinitionStepsItemGatesDefault, createFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersDefault, createFlowDefinitionBodyProjectIdRegExp, createHandoffPathAttemptIdRegExp, createProjectBodySeedDefaultsDefault, createSchemaBodyOneObjectTypeMax, createSchemaBodyOnePropertiesXEditableDefault, createSchemaBodyOnePropertiesXMfaDefault, createSchemaBodyOnePropertiesXSensitiveDefault, createSchemaBodyOneXAuthMethodsMagicLinkPositionMin, createSchemaBodyOneXAuthMethodsOtpPositionMin, createSchemaBodyOneXAuthMethodsPasskeyPositionMin, createSchemaBodyOneXAuthMethodsPasswordPositionMin, createSchemaBodyOneXAuthMethodsSsoPositionMin, createSchemaQueryProjectIdRegExp, createSchemaQueryTeamIdRegExp, createSessionBodyProjectIdRegExp, createTeamQueryProjectIdRegExp, createUserQueryProjectIdRegExp, createUserQueryTeamIdRegExp, deactivateFlowDefinitionQueryProjectIdRegExp, deleteFlowDefinitionQueryProjectIdRegExp, exchangeHandoffQueryProjectIdRegExp, exchangeHandoffResponseSessionFactorsItemPayloadOneUserIdRegExp, exchangeHandoffResponseSessionProjectIdRegExp, exchangeHandoffResponseSessionSessionIdRegExp, exchangeHandoffResponseSessionUserIdOneRegExp, getAuthAttemptPathAttemptIdRegExp, getAuthAttemptResponseAttemptIdRegExp, getAuthAttemptResponseChallengesItemChallengeIdRegExp, getAuthAttemptResponseCompletedFactorsItemPayloadOneUserIdRegExp, getAuthAttemptResponseProjectIdRegExp, getAuthAttemptResponseSessionIdOneRegExp, getAuthAttemptResponseUserIdOneRegExp, getFlowDefinitionQueryProjectIdRegExp, getFlowDefinitionResponseFlowDefinitionNameRegExp, getFlowDefinitionResponseFlowDefinitionStepsItemActionsDefault, getFlowDefinitionResponseFlowDefinitionStepsItemActionsItemPrimaryDefault, getFlowDefinitionResponseFlowDefinitionStepsItemFieldsDefault, getFlowDefinitionResponseFlowDefinitionStepsItemGatesDefault, getFlowDefinitionResponseFlowDefinitionStepsItemSsoProvidersDefault, getFlowStepResponseBrandingLayoutDefault, getFlowStepResponseStepActionsDefault, getFlowStepResponseStepActionsItemPrimaryDefault, getFlowStepResponseStepFieldsDefault, getFlowStepResponseStepFieldsItemRequiredDefault, getFlowStepResponseStepFieldsItemValidationMaxLengthMin, getFlowStepResponseStepFieldsItemValidationMinLengthMin, getFlowStepResponseStepGatesDefault, getFlowStepResponseStepSsoProvidersDefault, getMySessionResponseFactorsItemPayloadOneUserIdRegExp, getMySessionResponseProjectIdRegExp, getMySessionResponseSessionIdRegExp, getMySessionResponseUserIdOneRegExp, getOpenIDConfigurationResponseClaimsParameterSupportedDefault, getOpenIDConfigurationResponseRequestParameterSupportedDefault, getOpenIDConfigurationResponseRequestUriParameterSupportedDefault, getOpenIDConfigurationResponseRequireRequestUriRegistrationDefault, getProjectPathProjectIdRegExp, getSchemaByIdQueryProjectIdRegExp, getSchemaByIdQueryTeamIdRegExp, getSchemaByIdResponseOneObjectTypeMax, getSchemaByIdResponseOnePropertiesXEditableDefault, getSchemaByIdResponseOnePropertiesXMfaDefault, getSchemaByIdResponseOnePropertiesXSensitiveDefault, getSchemaByIdResponseOneXAuthMethodsMagicLinkPositionMin, getSchemaByIdResponseOneXAuthMethodsOtpPositionMin, getSchemaByIdResponseOneXAuthMethodsPasskeyPositionMin, getSchemaByIdResponseOneXAuthMethodsPasswordPositionMin, getSchemaByIdResponseOneXAuthMethodsSsoPositionMin, getSessionPathSessionIdRegExp, getSessionQueryProjectIdRegExp, getSessionResponseFactorsItemPayloadOneUserIdRegExp, getSessionResponseProjectIdRegExp, getSessionResponseSessionIdRegExp, getSessionResponseUserIdOneRegExp, getTeamPathTeamIdRegExp, getTeamQueryProjectIdRegExp, getUserByIDPathUserIdRegExp, getUserByIDQueryProjectIdRegExp, getUserByIDQueryTeamIdRegExp, issueChallengePathAttemptIdRegExp, listFlowDefinitionsQueryLimitDefault, listFlowDefinitionsQueryLimitMax, listFlowDefinitionsQueryProjectIdRegExp, listFlowDefinitionsResponseFlowDefinitionsItemNameRegExp, listSchemasQueryObjectTypeMax, listSchemasQueryOffsetDefault, listSchemasQueryOffsetMin, listSchemasQueryProjectIdRegExp, listSessionsQueryLimitDefault, listSessionsQueryLimitMax, listSessionsQueryProjectIdRegExp, listSessionsQueryUserIdRegExp, listSessionsResponseSessionsItemFactorsItemPayloadOneUserIdRegExp, listSessionsResponseSessionsItemProjectIdRegExp, listSessionsResponseSessionsItemSessionIdRegExp, listSessionsResponseSessionsItemUserIdOneRegExp, listUsersQueryLimitDefault, listUsersQueryLimitMax, listUsersQueryOffsetDefault, listUsersQueryOffsetMin, patchProjectPathProjectIdRegExp, queryProjectsBodyLimitDefault, queryProjectsBodyLimitMax, revokeSessionPathSessionIdRegExp, revokeSessionQueryProjectIdRegExp, setUserPasswordPathUserIdRegExp, setUserPasswordQueryProjectIdRegExp, submitFlowStepResponseBrandingLayoutDefault, submitFlowStepResponseStepActionsDefault, submitFlowStepResponseStepActionsItemPrimaryDefault, submitFlowStepResponseStepFieldsDefault, submitFlowStepResponseStepFieldsItemRequiredDefault, submitFlowStepResponseStepFieldsItemValidationMaxLengthMin, submitFlowStepResponseStepFieldsItemValidationMinLengthMin, submitFlowStepResponseStepGatesDefault, submitFlowStepResponseStepSsoProvidersDefault, updateFlowDefinitionBodyFlowDefinitionNameRegExp, updateFlowDefinitionBodyFlowDefinitionStepsItemActionsDefault, updateFlowDefinitionBodyFlowDefinitionStepsItemActionsItemPrimaryDefault, updateFlowDefinitionBodyFlowDefinitionStepsItemFieldsDefault, updateFlowDefinitionBodyFlowDefinitionStepsItemGatesDefault, updateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersDefault, updateFlowDefinitionQueryProjectIdRegExp, updateFlowDefinitionResponseFlowDefinitionNameRegExp, updateFlowDefinitionResponseFlowDefinitionStepsItemActionsDefault, updateFlowDefinitionResponseFlowDefinitionStepsItemActionsItemPrimaryDefault, updateFlowDefinitionResponseFlowDefinitionStepsItemFieldsDefault, updateFlowDefinitionResponseFlowDefinitionStepsItemGatesDefault, updateFlowDefinitionResponseFlowDefinitionStepsItemSsoProvidersDefault, verifyChallengeProofPathAttemptIdRegExp, verifyChallengeProofPathChallengeIdRegExp, verifyChallengeProofResponseAttemptIdRegExp, verifyChallengeProofResponseChallengesItemChallengeIdRegExp, verifyChallengeProofResponseCompletedFactorsItemPayloadOneUserIdRegExp, verifyChallengeProofResponseProjectIdRegExp, verifyChallengeProofResponseSessionIdOneRegExp, verifyChallengeProofResponseUserIdOneRegExp };
+export { CompleteClaimBody, CompleteClaimParams, CompleteClaimResponse, CreateAuthAttemptBody, CreateBrandingBody, CreateBrandingQueryParams, CreateFlowBody, CreateFlowDefinitionBody, CreateHandoffHeader, CreateHandoffParams, CreateHandoffResponse, CreateProjectBody, CreateSchemaBody, CreateSchemaQueryParams, CreateSessionBody, CreateTeamBody, CreateTeamQueryParams, CreateUserBody, CreateUserQueryParams, DeleteFlowDefinitionParams, DeleteFlowDefinitionQueryParams, DeleteTeamParams, DeleteTeamQueryParams, DeleteUserByIDParams, DeleteUserByIDQueryParams, ExchangeHandoffBody, ExchangeHandoffHeader, ExchangeHandoffQueryParams, ExchangeHandoffResponse, GetAuthAttemptParams, GetAuthAttemptResponse, GetBrandingByIdParams, GetBrandingByIdQueryParams, GetBrandingByIdResponse, GetClaimStatusParams, GetClaimStatusQueryParams, GetClaimStatusResponse, GetFlowDefinitionParams, GetFlowDefinitionQueryParams, GetFlowDefinitionResponse, GetFlowStepParams, GetFlowStepResponse, GetMySessionResponse, GetMyUserResponse, GetProjectParams, GetProjectResponse, GetSchemaByIdParams, GetSchemaByIdQueryParams, GetSchemaByIdResponse, GetSessionParams, GetSessionQueryParams, GetSessionResponse, GetTeamParams, GetTeamQueryParams, GetTeamResponse, GetUserByIDParams, GetUserByIDQueryParams, GetUserByIDResponse, InitClaimParams, IssueChallengeBody, IssueChallengeParams, ListBrandingQueryParams, ListBrandingResponse, ListBrandingResponseItem, ListFlowDefinitionsQueryParams, ListFlowDefinitionsResponse, ListSchemasQueryParams, ListSchemasResponse, ListSchemasResponseItem, ListUserPasskeysParams, ListUserPasskeysQueryParams, ListUserPasskeysResponse, ListUserTeamsParams, ListUserTeamsQueryParams, ListUserTeamsResponse, ListUsersQueryParams, ListUsersResponse, PatchProjectBody, PatchProjectParams, PatchProjectResponse, QueryProjectsBody, QueryProjectsResponse, QuerySessionsBody, QuerySessionsQueryParams, QuerySessionsResponse, QueryTeamsBody, QueryTeamsQueryParams, QueryTeamsResponse, RevokeSessionParams, RevokeSessionQueryParams, SetUserPasswordBody, SetUserPasswordParams, SetUserPasswordQueryParams, SubmitFlowStepBody, SubmitFlowStepHeader, SubmitFlowStepParams, SubmitFlowStepResponse, UpdateFlowDefinitionBody, UpdateFlowDefinitionParams, UpdateFlowDefinitionQueryParams, UpdateFlowDefinitionResponse, UpdateTeamBody, UpdateTeamParams, UpdateTeamQueryParams, UpdateTeamResponse, VerifyChallengeProofBody, VerifyChallengeProofHeader, VerifyChallengeProofParams, VerifyChallengeProofResponse, completeClaimBodyChallengeIdRegExp, completeClaimPathProjectIdRegExp, completeClaimResponseProjectIdRegExp, completeClaimResponseTeamIdRegExp, createAuthAttemptBodyProjectIdRegExp, createAuthAttemptBodySessionIdOneRegExp, createBrandingBodyLayoutDefault, createBrandingBodyLiquidTemplateMax, createBrandingQueryProjectIdRegExp, createFlowBodyDryRunDefault, createFlowBodyFlowDefinitionNameRegExp, createFlowBodyProjectIdRegExp, createFlowBodySchemaVersionRegExp, createFlowDefinitionBodyFlowDefinitionNameRegExp, createFlowDefinitionBodyFlowDefinitionStepsItemActionsDefault, createFlowDefinitionBodyFlowDefinitionStepsItemActionsItemPrimaryDefault, createFlowDefinitionBodyFlowDefinitionStepsItemFieldsDefault, createFlowDefinitionBodyFlowDefinitionStepsItemGatesDefault, createFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersDefault, createFlowDefinitionBodyProjectIdRegExp, createHandoffPathAttemptIdRegExp, createProjectBodySeedDefaultsDefault, createSchemaBodyOneObjectTypeMax, createSchemaBodyOnePropertiesXEditableDefault, createSchemaBodyOnePropertiesXMfaDefault, createSchemaBodyOnePropertiesXSensitiveDefault, createSchemaBodyOneXAuthMethodsMagicLinkPositionMin, createSchemaBodyOneXAuthMethodsOtpPositionMin, createSchemaBodyOneXAuthMethodsPasskeyPositionMin, createSchemaBodyOneXAuthMethodsPasswordPositionMin, createSchemaBodyOneXAuthMethodsSsoPositionMin, createSchemaQueryProjectIdRegExp, createSchemaQueryTeamIdRegExp, createSessionBodyProjectIdRegExp, createTeamBodyNameMax, createTeamQueryProjectIdRegExp, createUserBodyIdRegExp, createUserQueryProjectIdRegExp, createUserQueryTeamIdRegExp, deleteFlowDefinitionQueryProjectIdRegExp, deleteTeamPathTeamIdRegExp, deleteTeamQueryProjectIdRegExp, deleteUserByIDPathUserIdRegExp, deleteUserByIDQueryProjectIdRegExp, exchangeHandoffQueryProjectIdRegExp, exchangeHandoffResponseSessionFactorsItemPayloadOneUserIdRegExp, exchangeHandoffResponseSessionProjectIdRegExp, exchangeHandoffResponseSessionSessionIdRegExp, exchangeHandoffResponseSessionUserIdOneRegExp, getAuthAttemptPathAttemptIdRegExp, getAuthAttemptResponseAttemptIdRegExp, getAuthAttemptResponseChallengesItemChallengeIdRegExp, getAuthAttemptResponseCompletedFactorsItemPayloadOneUserIdRegExp, getAuthAttemptResponseProjectIdRegExp, getAuthAttemptResponseSessionIdOneRegExp, getAuthAttemptResponseUserIdOneRegExp, getBrandingByIdQueryProjectIdRegExp, getBrandingByIdResponseBrandingLayoutDefault, getBrandingByIdResponseBrandingLiquidTemplateMax, getClaimStatusPathProjectIdRegExp, getClaimStatusQueryChallengeIdRegExp, getClaimStatusResponseTwoTeamIdRegExp, getFlowDefinitionQueryProjectIdRegExp, getFlowDefinitionResponseFlowDefinitionNameRegExp, getFlowDefinitionResponseFlowDefinitionStepsItemActionsDefault, getFlowDefinitionResponseFlowDefinitionStepsItemActionsItemPrimaryDefault, getFlowDefinitionResponseFlowDefinitionStepsItemFieldsDefault, getFlowDefinitionResponseFlowDefinitionStepsItemGatesDefault, getFlowDefinitionResponseFlowDefinitionStepsItemSsoProvidersDefault, getFlowStepResponseBrandingLayoutDefault, getFlowStepResponseBrandingLiquidTemplateMax, getFlowStepResponseStepActionsDefault, getFlowStepResponseStepActionsItemPrimaryDefault, getFlowStepResponseStepFieldsDefault, getFlowStepResponseStepFieldsItemRequiredDefault, getFlowStepResponseStepFieldsItemValidationMaxLengthMin, getFlowStepResponseStepFieldsItemValidationMinLengthMin, getFlowStepResponseStepGatesDefault, getFlowStepResponseStepSsoProvidersDefault, getMySessionResponseFactorsItemPayloadOneUserIdRegExp, getMySessionResponseProjectIdRegExp, getMySessionResponseSessionIdRegExp, getMySessionResponseUserIdOneRegExp, getMyUserResponseIdRegExp, getProjectPathProjectIdRegExp, getSchemaByIdQueryProjectIdRegExp, getSchemaByIdQueryTeamIdRegExp, getSchemaByIdResponseOneObjectTypeMax, getSchemaByIdResponseOnePropertiesXEditableDefault, getSchemaByIdResponseOnePropertiesXMfaDefault, getSchemaByIdResponseOnePropertiesXSensitiveDefault, getSchemaByIdResponseOneXAuthMethodsMagicLinkPositionMin, getSchemaByIdResponseOneXAuthMethodsOtpPositionMin, getSchemaByIdResponseOneXAuthMethodsPasskeyPositionMin, getSchemaByIdResponseOneXAuthMethodsPasswordPositionMin, getSchemaByIdResponseOneXAuthMethodsSsoPositionMin, getSessionPathSessionIdRegExp, getSessionQueryProjectIdRegExp, getSessionResponseFactorsItemPayloadOneUserIdRegExp, getSessionResponseProjectIdRegExp, getSessionResponseSessionIdRegExp, getSessionResponseUserIdOneRegExp, getTeamPathTeamIdRegExp, getTeamQueryProjectIdRegExp, getUserByIDPathUserIdRegExp, getUserByIDQueryProjectIdRegExp, getUserByIDQueryTeamIdRegExp, getUserByIDResponseIdRegExp, initClaimPathProjectIdRegExp, issueChallengePathAttemptIdRegExp, listBrandingQueryProjectIdRegExp, listFlowDefinitionsQueryLimitDefault, listFlowDefinitionsQueryLimitMax, listFlowDefinitionsQueryProjectIdRegExp, listFlowDefinitionsResponseFlowDefinitionsItemNameRegExp, listSchemasQueryObjectTypeMax, listSchemasQueryOffsetDefault, listSchemasQueryOffsetMin, listSchemasQueryProjectIdRegExp, listUserPasskeysPathUserIdRegExp, listUserPasskeysQueryLimitDefault, listUserPasskeysQueryLimitMax, listUserPasskeysQueryProjectIdRegExp, listUserTeamsPathUserIdRegExp, listUserTeamsQueryLimitDefault, listUserTeamsQueryLimitMax, listUserTeamsQueryProjectIdRegExp, listUsersQueryLimitDefault, listUsersQueryLimitMax, listUsersResponseUsersItemIdRegExp, patchProjectPathProjectIdRegExp, queryProjectsBodyLimitDefault, queryProjectsBodyLimitMax, querySessionsBodyLimitDefault, querySessionsBodyLimitMax, querySessionsQueryProjectIdRegExp, querySessionsResponseSessionsItemFactorsItemPayloadOneUserIdRegExp, querySessionsResponseSessionsItemProjectIdRegExp, querySessionsResponseSessionsItemSessionIdRegExp, querySessionsResponseSessionsItemUserIdOneRegExp, queryTeamsBodyLimitDefault, queryTeamsBodyLimitMax, queryTeamsQueryProjectIdRegExp, revokeSessionPathSessionIdRegExp, revokeSessionQueryProjectIdRegExp, setUserPasswordPathUserIdRegExp, setUserPasswordQueryProjectIdRegExp, submitFlowStepResponseBrandingLayoutDefault, submitFlowStepResponseBrandingLiquidTemplateMax, submitFlowStepResponseStepActionsDefault, submitFlowStepResponseStepActionsItemPrimaryDefault, submitFlowStepResponseStepFieldsDefault, submitFlowStepResponseStepFieldsItemRequiredDefault, submitFlowStepResponseStepFieldsItemValidationMaxLengthMin, submitFlowStepResponseStepFieldsItemValidationMinLengthMin, submitFlowStepResponseStepGatesDefault, submitFlowStepResponseStepSsoProvidersDefault, updateFlowDefinitionBodyFlowDefinitionNameRegExp, updateFlowDefinitionBodyFlowDefinitionStepsItemActionsDefault, updateFlowDefinitionBodyFlowDefinitionStepsItemActionsItemPrimaryDefault, updateFlowDefinitionBodyFlowDefinitionStepsItemFieldsDefault, updateFlowDefinitionBodyFlowDefinitionStepsItemGatesDefault, updateFlowDefinitionBodyFlowDefinitionStepsItemSsoProvidersDefault, updateFlowDefinitionQueryProjectIdRegExp, updateFlowDefinitionResponseFlowDefinitionNameRegExp, updateFlowDefinitionResponseFlowDefinitionStepsItemActionsDefault, updateFlowDefinitionResponseFlowDefinitionStepsItemActionsItemPrimaryDefault, updateFlowDefinitionResponseFlowDefinitionStepsItemFieldsDefault, updateFlowDefinitionResponseFlowDefinitionStepsItemGatesDefault, updateFlowDefinitionResponseFlowDefinitionStepsItemSsoProvidersDefault, updateTeamBodyNameMax, updateTeamPathTeamIdRegExp, updateTeamQueryProjectIdRegExp, verifyChallengeProofPathAttemptIdRegExp, verifyChallengeProofPathChallengeIdRegExp, verifyChallengeProofResponseAttemptIdRegExp, verifyChallengeProofResponseChallengesItemChallengeIdRegExp, verifyChallengeProofResponseCompletedFactorsItemPayloadOneUserIdRegExp, verifyChallengeProofResponseProjectIdRegExp, verifyChallengeProofResponseSessionIdOneRegExp, verifyChallengeProofResponseUserIdOneRegExp };
 
 //# sourceMappingURL=zitadelNextGen.zod.mjs.map