@zitadel/api 0.1.0-alpha.17 → 0.1.0-alpha.19

package/dist/generated/endpoints/zitadelNextGen.mjs

@@ -10,10 +10,9 @@ import { customFetch } from "../../runtime/fetch.mjs";
 * OpenAPI spec version: 0.0.1
 */
 var zitadelNextGen_exports = /* @__PURE__ */ __exportAll({
-	activateFlowDefinition: () => activateFlowDefinition,
-	authorizeDevice: () => authorizeDevice,
-	authorizeGet: () => authorizeGet,
+	completeClaim: () => completeClaim,
 	createAuthAttempt: () => createAuthAttempt,
+	createBranding: () => createBranding,
 	createFlow: () => createFlow,
 	createFlowDefinition: () => createFlowDefinition,
 	createHandoff: () => createHandoff,
@@ -22,15 +21,16 @@ var zitadelNextGen_exports = /* @__PURE__ */ __exportAll({
 	createSession: () => createSession,
 	createTeam: () => createTeam,
 	createUser: () => createUser,
-	deactivateFlowDefinition: () => deactivateFlowDefinition,
 	deleteFlowDefinition: () => deleteFlowDefinition,
-	endSession: () => endSession,
+	deleteTeam: () => deleteTeam,
+	deleteUserByID: () => deleteUserByID,
 	exchangeHandoff: () => exchangeHandoff,
-	getActivateFlowDefinitionUrl: () => getActivateFlowDefinitionUrl,
 	getAuthAttempt: () => getAuthAttempt,
-	getAuthorizeDeviceUrl: () => getAuthorizeDeviceUrl,
-	getAuthorizeGetUrl: () => getAuthorizeGetUrl,
+	getBrandingById: () => getBrandingById,
+	getClaimStatus: () => getClaimStatus,
+	getCompleteClaimUrl: () => getCompleteClaimUrl,
 	getCreateAuthAttemptUrl: () => getCreateAuthAttemptUrl,
+	getCreateBrandingUrl: () => getCreateBrandingUrl,
 	getCreateFlowDefinitionUrl: () => getCreateFlowDefinitionUrl,
 	getCreateFlowUrl: () => getCreateFlowUrl,
 	getCreateHandoffUrl: () => getCreateHandoffUrl,
@@ -39,230 +39,80 @@ var zitadelNextGen_exports = /* @__PURE__ */ __exportAll({
 	getCreateSessionUrl: () => getCreateSessionUrl,
 	getCreateTeamUrl: () => getCreateTeamUrl,
 	getCreateUserUrl: () => getCreateUserUrl,
-	getDeactivateFlowDefinitionUrl: () => getDeactivateFlowDefinitionUrl,
 	getDeleteFlowDefinitionUrl: () => getDeleteFlowDefinitionUrl,
-	getEndSessionUrl: () => getEndSessionUrl,
+	getDeleteTeamUrl: () => getDeleteTeamUrl,
+	getDeleteUserByIDUrl: () => getDeleteUserByIDUrl,
+	getEvent: () => getEvent,
 	getExchangeHandoffUrl: () => getExchangeHandoffUrl,
 	getFlowDefinition: () => getFlowDefinition,
 	getFlowStep: () => getFlowStep,
 	getGetAuthAttemptUrl: () => getGetAuthAttemptUrl,
+	getGetBrandingByIdUrl: () => getGetBrandingByIdUrl,
+	getGetClaimStatusUrl: () => getGetClaimStatusUrl,
+	getGetEventUrl: () => getGetEventUrl,
 	getGetFlowDefinitionUrl: () => getGetFlowDefinitionUrl,
 	getGetFlowStepUrl: () => getGetFlowStepUrl,
 	getGetHealthUrl: () => getGetHealthUrl,
-	getGetKeysUrl: () => getGetKeysUrl,
 	getGetLiveUrl: () => getGetLiveUrl,
 	getGetMySessionUrl: () => getGetMySessionUrl,
 	getGetMyUserUrl: () => getGetMyUserUrl,
-	getGetOpenIDConfigurationUrl: () => getGetOpenIDConfigurationUrl,
 	getGetProjectUrl: () => getGetProjectUrl,
 	getGetReadyUrl: () => getGetReadyUrl,
 	getGetSchemaByIdUrl: () => getGetSchemaByIdUrl,
 	getGetSessionUrl: () => getGetSessionUrl,
 	getGetTeamUrl: () => getGetTeamUrl,
-	getGetTokenUrl: () => getGetTokenUrl,
 	getGetUserByIDUrl: () => getGetUserByIDUrl,
-	getGetUserInfoUrl: () => getGetUserInfoUrl,
 	getHealth: () => getHealth,
-	getIntrospectUrl: () => getIntrospectUrl,
+	getInitClaimUrl: () => getInitClaimUrl,
 	getIssueChallengeUrl: () => getIssueChallengeUrl,
-	getKeys: () => getKeys,
+	getListBrandingUrl: () => getListBrandingUrl,
+	getListEventsUrl: () => getListEventsUrl,
 	getListFlowDefinitionsUrl: () => getListFlowDefinitionsUrl,
 	getListSchemasUrl: () => getListSchemasUrl,
-	getListSessionsUrl: () => getListSessionsUrl,
+	getListUserPasskeysUrl: () => getListUserPasskeysUrl,
+	getListUserTeamsUrl: () => getListUserTeamsUrl,
 	getListUsersUrl: () => getListUsersUrl,
 	getLive: () => getLive,
 	getMySession: () => getMySession,
 	getMyUser: () => getMyUser,
-	getOpenIDConfiguration: () => getOpenIDConfiguration,
 	getPatchProjectUrl: () => getPatchProjectUrl,
 	getProject: () => getProject,
 	getQueryProjectsUrl: () => getQueryProjectsUrl,
+	getQuerySessionsUrl: () => getQuerySessionsUrl,
+	getQueryTeamsUrl: () => getQueryTeamsUrl,
 	getReady: () => getReady,
 	getRevokeMySessionUrl: () => getRevokeMySessionUrl,
 	getRevokeSessionUrl: () => getRevokeSessionUrl,
-	getRevokeTokenUrl: () => getRevokeTokenUrl,
 	getSchemaById: () => getSchemaById,
 	getSession: () => getSession,
 	getSetUserPasswordUrl: () => getSetUserPasswordUrl,
-	getSubmitFlowEventUrl: () => getSubmitFlowEventUrl,
 	getSubmitFlowStepUrl: () => getSubmitFlowStepUrl,
 	getTeam: () => getTeam,
-	getToken: () => getToken,
 	getUpdateFlowDefinitionUrl: () => getUpdateFlowDefinitionUrl,
+	getUpdateTeamUrl: () => getUpdateTeamUrl,
 	getUserByID: () => getUserByID,
-	getUserInfo: () => getUserInfo,
 	getVerifyChallengeProofUrl: () => getVerifyChallengeProofUrl,
-	introspect: () => introspect,
+	initClaim: () => initClaim,
 	issueChallenge: () => issueChallenge,
+	listBranding: () => listBranding,
+	listEvents: () => listEvents,
 	listFlowDefinitions: () => listFlowDefinitions,
 	listSchemas: () => listSchemas,
-	listSessions: () => listSessions,
+	listUserPasskeys: () => listUserPasskeys,
+	listUserTeams: () => listUserTeams,
 	listUsers: () => listUsers,
 	patchProject: () => patchProject,
 	queryProjects: () => queryProjects,
+	querySessions: () => querySessions,
+	queryTeams: () => queryTeams,
 	revokeMySession: () => revokeMySession,
 	revokeSession: () => revokeSession,
-	revokeToken: () => revokeToken,
 	setUserPassword: () => setUserPassword,
-	submitFlowEvent: () => submitFlowEvent,
 	submitFlowStep: () => submitFlowStep,
 	updateFlowDefinition: () => updateFlowDefinition,
+	updateTeam: () => updateTeam,
 	verifyChallengeProof: () => verifyChallengeProof
 });
-const getGetOpenIDConfigurationUrl = () => {
-	return `${getProxyPath()}/.well-known/openid-configuration`;
-};
-/**
-* Retrieve the OpenID Connect configuration
-* @summary Get OpenID Connect configuration
-*/
-const getOpenIDConfiguration = async (options) => {
-	return customFetch(getGetOpenIDConfigurationUrl(), {
-		...options,
-		method: "GET"
-	});
-};
-const getAuthorizeGetUrl = (params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/auth/authorize?${stringifiedParams}` : `${getProxyPath()}/auth/authorize`;
-};
-/**
-* @summary Authorize a user
-*/
-const authorizeGet = async (params, options) => {
-	return customFetch(getAuthorizeGetUrl(params), {
-		...options,
-		method: "GET"
-	});
-};
-const getAuthorizeDeviceUrl = (params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/auth/device-authorization?${stringifiedParams}` : `${getProxyPath()}/auth/device-authorization`;
-};
-/**
-* @summary Authorize a device
-*/
-const authorizeDevice = async (params, options) => {
-	return customFetch(getAuthorizeDeviceUrl(params), {
-		...options,
-		method: "GET"
-	});
-};
-const getEndSessionUrl = (params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/auth/end-session?${stringifiedParams}` : `${getProxyPath()}/auth/end-session`;
-};
-/**
-* @summary End a session
-*/
-const endSession = async (params, options) => {
-	return customFetch(getEndSessionUrl(params), {
-		...options,
-		method: "GET"
-	});
-};
-const getIntrospectUrl = () => {
-	return `${getProxyPath()}/auth/introspect`;
-};
-/**
-* @summary Introspect a token
-*/
-const introspect = async (introspectBody, options) => {
-	const formUrlEncoded = new URLSearchParams();
-	formUrlEncoded.append(`token`, introspectBody.token);
-	if (introspectBody.token_type_hint !== void 0) formUrlEncoded.append(`token_type_hint`, introspectBody.token_type_hint);
-	return customFetch(getIntrospectUrl(), {
-		...options,
-		method: "POST",
-		headers: {
-			"Content-Type": "application/x-www-form-urlencoded",
-			...options?.headers
-		},
-		body: formUrlEncoded
-	});
-};
-const getGetKeysUrl = () => {
-	return `${getProxyPath()}/auth/keys`;
-};
-/**
-* @summary Get public keys
-*/
-const getKeys = async (options) => {
-	return customFetch(getGetKeysUrl(), {
-		...options,
-		method: "GET"
-	});
-};
-const getRevokeTokenUrl = () => {
-	return `${getProxyPath()}/auth/revoke`;
-};
-/**
-* @summary Revoke an access token or refresh token
-*/
-const revokeToken = async (revokeTokenBody, options) => {
-	const formUrlEncoded = new URLSearchParams();
-	if (revokeTokenBody.token !== void 0) formUrlEncoded.append(`token`, revokeTokenBody.token);
-	if (revokeTokenBody.token_type_hint !== void 0) formUrlEncoded.append(`token_type_hint`, revokeTokenBody.token_type_hint);
-	return customFetch(getRevokeTokenUrl(), {
-		...options,
-		method: "POST",
-		headers: {
-			"Content-Type": "application/x-www-form-urlencoded",
-			...options?.headers
-		},
-		body: formUrlEncoded
-	});
-};
-const getGetTokenUrl = () => {
-	return `${getProxyPath()}/auth/token`;
-};
-/**
-* @summary Get access token
-*/
-const getToken = async (getTokenBody, options) => {
-	const formUrlEncoded = new URLSearchParams();
-	if (getTokenBody.code !== void 0) formUrlEncoded.append(`code`, getTokenBody.code);
-	if (getTokenBody.client_assertion !== void 0) formUrlEncoded.append(`client_assertion`, getTokenBody.client_assertion);
-	if (getTokenBody.client_assertion_type !== void 0) formUrlEncoded.append(`client_assertion_type`, getTokenBody.client_assertion_type);
-	if (getTokenBody.client_id !== void 0) formUrlEncoded.append(`client_id`, getTokenBody.client_id);
-	if (getTokenBody.client_secret !== void 0) formUrlEncoded.append(`client_secret`, getTokenBody.client_secret);
-	if (getTokenBody.code_verifier !== void 0) formUrlEncoded.append(`code_verifier`, getTokenBody.code_verifier);
-	if (getTokenBody.grant_type !== void 0) formUrlEncoded.append(`grant_type`, getTokenBody.grant_type);
-	if (getTokenBody.redirect_uri !== void 0) formUrlEncoded.append(`redirect_uri`, getTokenBody.redirect_uri);
-	return customFetch(getGetTokenUrl(), {
-		...options,
-		method: "POST",
-		headers: {
-			"Content-Type": "application/x-www-form-urlencoded",
-			...options?.headers
-		},
-		body: formUrlEncoded
-	});
-};
-const getGetUserInfoUrl = () => {
-	return `${getProxyPath()}/auth/userinfo`;
-};
-/**
-* @summary Get user info
-*/
-const getUserInfo = async (options) => {
-	return customFetch(getGetUserInfoUrl(), {
-		...options,
-		method: "GET"
-	});
-};
 const getGetHealthUrl = () => {
 	return `${getProxyPath()}/healthz`;
 };
@@ -358,19 +208,43 @@ const getUserByID = async (userId, params, options) => {
 		method: "GET"
 	});
 };
-const getSetUserPasswordUrl = (userId, params) => {
+const getDeleteUserByIDUrl = (userId) => {
+	return `${getProxyPath()}/users/${userId}`;
+};
+/**
+* @summary Delete user by ID
+*/
+const deleteUserByID = async (userId, options) => {
+	return customFetch(getDeleteUserByIDUrl(userId), {
+		...options,
+		method: "DELETE"
+	});
+};
+const getListUserPasskeysUrl = (userId, params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
 		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
 	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/users/${userId}/password?${stringifiedParams}` : `${getProxyPath()}/users/${userId}/password`;
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/users/${userId}/passkeys?${stringifiedParams}` : `${getProxyPath()}/users/${userId}/passkeys`;
+};
+/**
+* @summary List user passkeys
+*/
+const listUserPasskeys = async (userId, params, options) => {
+	return customFetch(getListUserPasskeysUrl(userId, params), {
+		...options,
+		method: "GET"
+	});
+};
+const getSetUserPasswordUrl = (userId) => {
+	return `${getProxyPath()}/users/${userId}/password`;
 };
 /**
 * @summary Set user password
 */
-const setUserPassword = async (userId, setUserPasswordBody, params, options) => {
-	return customFetch(getSetUserPasswordUrl(userId, params), {
+const setUserPassword = async (userId, setUserPasswordBody, options) => {
+	return customFetch(getSetUserPasswordUrl(userId), {
 		...options,
 		method: "PUT",
 		headers: {
@@ -380,6 +254,31 @@ const setUserPassword = async (userId, setUserPasswordBody, params, options) =>
 		body: JSON.stringify(setUserPasswordBody)
 	});
 };
+const getListUserTeamsUrl = (userId, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/users/${userId}/teams?${stringifiedParams}` : `${getProxyPath()}/users/${userId}/teams`;
+};
+/**
+* The user's team roster, ordered by team name. Each entry carries the
+team's name, so a client renders a page without resolving ids one by one.
+
+This is the N:N roster and it is not lifecycle ownership: the single team
+that owns the user's lifecycle is reported as `metadata.lifecycle_owner_team_id`
+on the user read endpoints. Memberships the user was removed from are not
+returned.
+
+* @summary List the teams a user belongs to
+*/
+const listUserTeams = async (userId, params, options) => {
+	return customFetch(getListUserTeamsUrl(userId, params), {
+		...options,
+		method: "GET"
+	});
+};
 const getGetMyUserUrl = () => {
 	return `${getProxyPath()}/users/me`;
 };
@@ -401,7 +300,7 @@ the first capability step. Creates a new session implicitly unless
 `session_id` is provided (for step-up / reauth on an existing session).
 
 The response contains an `id` field — the flow handle. Use it as the path
-parameter for all subsequent `/flow/{id}/submit` and `/flow/{id}/event` calls.
+parameter for all subsequent `/flow/{id}/submit` calls.
 
 The response also sets an encrypted `HttpOnly` cookie (`_zflow`) containing
 the flow's orchestration state (current step, collected data, history).
@@ -481,26 +380,6 @@ const submitFlowStep = async (id, submitFlowStepBody, options) => {
 		body: JSON.stringify(submitFlowStepBody)
 	});
 };
-const getSubmitFlowEventUrl = (id) => {
-	return `${getProxyPath()}/flow/${id}/event`;
-};
-/**
-* Submits telemetry or fingerprint data from the frontend.
-Does not advance the state machine. Used for risk evaluation.
-
-* @summary Submit client-side event
-*/
-const submitFlowEvent = async (id, submitFlowEventBody, options) => {
-	return customFetch(getSubmitFlowEventUrl(id), {
-		...options,
-		method: "POST",
-		headers: {
-			"Content-Type": "application/json",
-			...options?.headers
-		},
-		body: JSON.stringify(submitFlowEventBody)
-	});
-};
 const getCreateAuthAttemptUrl = () => {
 	return `${getProxyPath()}/auth_attempts`;
 };
@@ -688,6 +567,68 @@ const patchProject = async (projectId, patchProjectBody, options) => {
 		body: JSON.stringify(patchProjectBody)
 	});
 };
+const getInitClaimUrl = (projectId) => {
+	return `${getProxyPath()}/projects/${projectId}/claim/init`;
+};
+/**
+* Starts a claim challenge for an unclaimed project. Authenticated by the
+project secret, this mints a single-use, short-lived challenge and returns
+the `claim_url` the developer opens in a browser to complete the claim,
+together with the `challenge_id` the CLI polls with. The exact expiry is
+carried by `expires_at` on the response.
+
+* @summary Initialize a project claim
+*/
+const initClaim = async (projectId, options) => {
+	return customFetch(getInitClaimUrl(projectId), {
+		...options,
+		method: "POST"
+	});
+};
+const getGetClaimStatusUrl = (projectId, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/projects/${projectId}/claim/status?${stringifiedParams}` : `${getProxyPath()}/projects/${projectId}/claim/status`;
+};
+/**
+* Polled by the CLI while a browser completes the claim. Authorized by the
+project secret that initiated the challenge. Returns `pending`, or
+`completed` with the owning team, the claim timestamp, and the dashboard
+URL once the browser leg has finished.
+
+* @summary Get claim status
+*/
+const getClaimStatus = async (projectId, params, options) => {
+	return customFetch(getGetClaimStatusUrl(projectId, params), {
+		...options,
+		method: "GET"
+	});
+};
+const getCompleteClaimUrl = (projectId) => {
+	return `${getProxyPath()}/projects/${projectId}/claim/complete`;
+};
+/**
+* Called by the browser after the developer authenticates on the claim page.
+Authenticated by the `__nextgen_session` cookie, it attaches the project to
+the developer's personal team using the `challenge_id` from the claim URL as
+its single-use, browser-safe authorization.
+
+* @summary Complete a project claim
+*/
+const completeClaim = async (projectId, completeClaimBody, options) => {
+	return customFetch(getCompleteClaimUrl(projectId), {
+		...options,
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(completeClaimBody)
+	});
+};
 const getCreateSessionUrl = () => {
 	return `${getProxyPath()}/sessions`;
 };
@@ -700,8 +641,16 @@ Use this explicitly when you want to:
 can be correlated with the eventual authenticated session from the start.
 - Track anonymous state (bot detection, device fingerprint) that survives until authentication.
 
-The returned `session_token` authorises GET and DELETE on this session.
-It is superseded when a handoff exchange completes — clients must replace it at that point.
+Creating a session is an app-plane operation on the project credential
+(`session.write`). The returned `session_token` is a session credential for the
+end-user client, not a management scope: it is delivered as the
+`__nextgen_session` cookie and authorises the self-service operations
+`GET /sessions/me` and `DELETE /sessions/me` (`nextgenSession` scheme). The
+by-id operations `GET /sessions/{session_id}` and `DELETE /sessions/{session_id}`
+are operator endpoints and require `session.read` / `session.delete` instead.
+
+The `session_token` is superseded when a handoff exchange completes — clients must
+replace it at that point.
 
 Anonymous sessions expire aggressively (10-minute TTL). The TTL resets to the configured
 full session TTL when the first authentication factor is written via a completing `auth_attempt`.
@@ -719,24 +668,30 @@ const createSession = async (createSessionBody, options) => {
 		body: JSON.stringify(createSessionBody)
 	});
 };
-const getListSessionsUrl = (params) => {
+const getQuerySessionsUrl = (params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
 		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
 	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/sessions?${stringifiedParams}` : `${getProxyPath()}/sessions`;
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/sessions/query?${stringifiedParams}` : `${getProxyPath()}/sessions/query`;
 };
 /**
-* Returns a paginated list of sessions for a project.
-Requires a project service key (OAuth2 client credentials).
+* Returns the sessions of a project, paginated with a cursor.
+Sessions of every lifecycle state are returned; each carries its `state`.
+Requires `session.read` permission.
 
-* @summary List sessions
+* @summary Query sessions
 */
-const listSessions = async (params, options) => {
-	return customFetch(getListSessionsUrl(params), {
+const querySessions = async (querySessionsBody, params, options) => {
+	return customFetch(getQuerySessionsUrl(params), {
 		...options,
-		method: "GET"
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(querySessionsBody)
 	});
 };
 const getExchangeHandoffUrl = (params) => {
@@ -779,13 +734,8 @@ const exchangeHandoff = async (exchangeHandoffBody, params, options) => {
 		body: JSON.stringify(exchangeHandoffBody)
 	});
 };
-const getGetSessionUrl = (sessionId, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/sessions/${sessionId}?${stringifiedParams}` : `${getProxyPath()}/sessions/${sessionId}`;
+const getGetSessionUrl = (sessionId) => {
+	return `${getProxyPath()}/sessions/${sessionId}`;
 };
 /**
 * Returns the current state of a session including its factors and all currently
@@ -797,30 +747,30 @@ against the same `session_id`) to restore a dropped assurance level.
 
 * @summary Get session state
 */
-const getSession = async (sessionId, params, options) => {
-	return customFetch(getGetSessionUrl(sessionId, params), {
+const getSession = async (sessionId, options) => {
+	return customFetch(getGetSessionUrl(sessionId), {
 		...options,
 		method: "GET"
 	});
 };
-const getRevokeSessionUrl = (sessionId, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/sessions/${sessionId}?${stringifiedParams}` : `${getProxyPath()}/sessions/${sessionId}`;
+const getRevokeSessionUrl = (sessionId) => {
+	return `${getProxyPath()}/sessions/${sessionId}`;
 };
 /**
-* Revokes the session immediately (`state: revoked`). This is the logout operation.
+* Permanently deletes the session, terminating it immediately.
 
-The session_token issued at creation (or superseded by a handoff exchange) is required.
-After revocation, any tokens derived from this session are invalidated.
+This is the operator revoke path and requires the `session.delete` scope on a
+project-bound credential. End-user logout with the `__nextgen_session` cookie is
+`DELETE /sessions/me` (`nextgenSession` scheme).
+
+Idempotent: deleting a session that does not exist (or was already deleted)
+still returns 204. After deletion, any tokens derived from the session are
+invalidated.
 
 * @summary Revoke session
 */
-const revokeSession = async (sessionId, params, options) => {
-	return customFetch(getRevokeSessionUrl(sessionId, params), {
+const revokeSession = async (sessionId, options) => {
+	return customFetch(getRevokeSessionUrl(sessionId), {
 		...options,
 		method: "DELETE"
 	});
@@ -848,10 +798,12 @@ const getRevokeMySessionUrl = () => {
 	return `${getProxyPath()}/sessions/me`;
 };
 /**
-* Revokes the session immediately (`state: revoked`). This is the logout operation.
+* Logs out by permanently deleting the session.
 
-The __nextgen_session cookie issued at creation (or superseded by a handoff exchange) is required.
-After revocation, any tokens derived from this session are invalidated including the cookie itself, which is cleared in the response.
+The `__nextgen_session` cookie issued at creation (or superseded by a handoff
+exchange) is required. Idempotent: if the session is already gone this still
+returns 204. Any tokens derived from the session are invalidated, and the
+cookie itself is cleared in the response.
 
 * @summary Revoke my session
 */
@@ -870,10 +822,12 @@ const getCreateSchemaUrl = (params) => {
 	return stringifiedParams.length > 0 ? `${getProxyPath()}/schemas?${stringifiedParams}` : `${getProxyPath()}/schemas`;
 };
 /**
-* Create a new schema. The schema definition must include a unique $id field,
-which will be used to identify the schema in future requests. The $id must
-be a valid URI and should ideally point to the location where the schema
-can be accessed.
+* Create a new schema. The optional `$id` field is the JSON Schema document
+URI used to identify the schema in future requests (GitOps-stable identity,
+not a free-form resource primary key). When `$id` is omitted, the server
+generates a `sch_*` URL. When provided, `$id` must be unique within the
+project and should ideally be a valid URI pointing at where the schema can
+be accessed.
 
 The schema can either be a concrete schema, e.g. a user schema, or a
 schema-url which will be resolved by the server.
@@ -972,31 +926,21 @@ const listFlowDefinitions = async (params, options) => {
 		method: "GET"
 	});
 };
-const getGetFlowDefinitionUrl = (id, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions/${id}?${stringifiedParams}` : `${getProxyPath()}/flow_definitions/${id}`;
+const getGetFlowDefinitionUrl = (id) => {
+	return `${getProxyPath()}/flow_definitions/${id}`;
 };
 /**
 * Get a flow definition by id
 * @summary Get a flow definition by id
 */
-const getFlowDefinition = async (id, params, options) => {
-	return customFetch(getGetFlowDefinitionUrl(id, params), {
+const getFlowDefinition = async (id, options) => {
+	return customFetch(getGetFlowDefinitionUrl(id), {
 		...options,
 		method: "GET"
 	});
 };
-const getUpdateFlowDefinitionUrl = (id, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions/${id}?${stringifiedParams}` : `${getProxyPath()}/flow_definitions/${id}`;
+const getUpdateFlowDefinitionUrl = (id) => {
+	return `${getProxyPath()}/flow_definitions/${id}`;
 };
 /**
 * Update a flow definition by id. This endpoint replaces the existing flow definition.
@@ -1004,8 +948,8 @@ If `flow_definition.status` is omitted, the current status is preserved
 
 * @summary Update a flow definition by id
 */
-const updateFlowDefinition = async (id, updateFlowDefinitionBody, params, options) => {
-	return customFetch(getUpdateFlowDefinitionUrl(id, params), {
+const updateFlowDefinition = async (id, updateFlowDefinitionBody, options) => {
+	return customFetch(getUpdateFlowDefinitionUrl(id), {
 		...options,
 		method: "PUT",
 		headers: {
@@ -1015,13 +959,8 @@ const updateFlowDefinition = async (id, updateFlowDefinitionBody, params, option
 		body: JSON.stringify(updateFlowDefinitionBody)
 	});
 };
-const getDeleteFlowDefinitionUrl = (id, params) => {
-	const normalizedParams = new URLSearchParams();
-	Object.entries(params || {}).forEach(([key, value]) => {
-		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
-	});
-	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions/${id}?${stringifiedParams}` : `${getProxyPath()}/flow_definitions/${id}`;
+const getDeleteFlowDefinitionUrl = (id) => {
+	return `${getProxyPath()}/flow_definitions/${id}`;
 };
 /**
 * Delete a flow definition by id.
@@ -1030,95 +969,239 @@ If the flow definition is the last active flow definition for a given purpose, t
 
 * @summary Delete a flow definition by id
 */
-const deleteFlowDefinition = async (id, params, options) => {
-	return customFetch(getDeleteFlowDefinitionUrl(id, params), {
+const deleteFlowDefinition = async (id, options) => {
+	return customFetch(getDeleteFlowDefinitionUrl(id), {
 		...options,
 		method: "DELETE"
 	});
 };
-const getActivateFlowDefinitionUrl = (id, params) => {
+const getCreateTeamUrl = (params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
 		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
 	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions/${id}/activate?${stringifiedParams}` : `${getProxyPath()}/flow_definitions/${id}/activate`;
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/teams?${stringifiedParams}` : `${getProxyPath()}/teams`;
 };
 /**
-* Activate a flow definition by transitioning it from a `draft` state to an `active` state.
-Alternatively, the status of a flow definition can also be set via the `POST /flow_definitions` and `PUT /flow_definitions/{id}` endpoints by setting the `status` attribute in the flow definition payload.
-
-* @summary Activate a flow definition by ID.
+* @summary Create team
 */
-const activateFlowDefinition = async (id, params, options) => {
-	return customFetch(getActivateFlowDefinitionUrl(id, params), {
+const createTeam = async (createTeamBody, params, options) => {
+	return customFetch(getCreateTeamUrl(params), {
 		...options,
-		method: "POST"
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(createTeamBody)
 	});
 };
-const getDeactivateFlowDefinitionUrl = (id, params) => {
+const getQueryTeamsUrl = (params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
 		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
 	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/flow_definitions/${id}/deactivate?${stringifiedParams}` : `${getProxyPath()}/flow_definitions/${id}/deactivate`;
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/teams/query?${stringifiedParams}` : `${getProxyPath()}/teams/query`;
 };
 /**
-* Deactivates a flow definition in the `active` state by transitioning it to the `draft` state.
-Flow definitions in `draft` state cannot be used to start new flows. Existing flows that use the deactivated flow definition must gracefully handle this.
-Alternatively, the status of a flow definition can also be set via the `POST /flow_definitions` and `PUT /flow_definitions/{id}` endpoints by setting the `status` attribute in the flow definition payload.
+* Returns the teams of a project, paginated with a cursor.
 
-* @summary Deactivate a flow definition by ID.
+* @summary Query teams
 */
-const deactivateFlowDefinition = async (id, params, options) => {
-	return customFetch(getDeactivateFlowDefinitionUrl(id, params), {
+const queryTeams = async (queryTeamsBody, params, options) => {
+	return customFetch(getQueryTeamsUrl(params), {
 		...options,
-		method: "POST"
+		method: "POST",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(queryTeamsBody)
 	});
 };
-const getCreateTeamUrl = (params) => {
+const getGetTeamUrl = (teamId) => {
+	return `${getProxyPath()}/teams/${teamId}`;
+};
+/**
+* Returns a Team by its id.
+
+* @summary Get team
+*/
+const getTeam = async (teamId, options) => {
+	return customFetch(getGetTeamUrl(teamId), {
+		...options,
+		method: "GET"
+	});
+};
+const getDeleteTeamUrl = (teamId) => {
+	return `${getProxyPath()}/teams/${teamId}`;
+};
+/**
+* Deactivates the team.
+
+The team is tombstoned rather than erased: it stays readable through
+getTeam with status `deactivated`. Its memberships are removed and the
+users whose lifecycle it owns are deactivated with it.
+
+The request is idempotent. Deleting a team that is already deactivated
+or doesn't exist succeeds without changing anything.
+
+* @summary Delete team
+*/
+const deleteTeam = async (teamId, options) => {
+	return customFetch(getDeleteTeamUrl(teamId), {
+		...options,
+		method: "DELETE"
+	});
+};
+const getUpdateTeamUrl = (teamId) => {
+	return `${getProxyPath()}/teams/${teamId}`;
+};
+/**
+* Update team. Only active teams can be updated.
+
+* @summary Update team
+*/
+const updateTeam = async (teamId, updateTeamBody, options) => {
+	return customFetch(getUpdateTeamUrl(teamId), {
+		...options,
+		method: "PATCH",
+		headers: {
+			"Content-Type": "application/json",
+			...options?.headers
+		},
+		body: JSON.stringify(updateTeamBody)
+	});
+};
+const getCreateBrandingUrl = (params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
 		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
 	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/teams?${stringifiedParams}` : `${getProxyPath()}/teams`;
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/branding?${stringifiedParams}` : `${getProxyPath()}/branding`;
 };
 /**
-* @summary Create team
+* Publishes a new immutable branding revision for the project. Branding
+revisions cannot be updated or deleted; every edit publishes a new
+revision, and flow responses resolve the latest revision per project
+(see ADR 040).
+
+The `liquid_template` is validated lexically on save (size, encoding,
+banned patterns such as `<script>` tags, inline event handlers, and the
+`| raw` filter). Authoritative LiquidJS validation runs at authoring
+time via `zitadel plan` / `zitadel apply`.
+
+* @summary Publish a new branding revision
 */
-const createTeam = async (params, createTeamBody, options) => {
-	return customFetch(getCreateTeamUrl(params), {
+const createBranding = async (createBrandingBody, params, options) => {
+	return customFetch(getCreateBrandingUrl(params), {
 		...options,
 		method: "POST",
 		headers: {
 			"Content-Type": "application/json",
 			...options?.headers
 		},
-		body: JSON.stringify(createTeamBody)
+		body: JSON.stringify(createBrandingBody)
 	});
 };
-const getGetTeamUrl = (teamId, params) => {
+const getListBrandingUrl = (params) => {
 	const normalizedParams = new URLSearchParams();
 	Object.entries(params || {}).forEach(([key, value]) => {
 		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
 	});
 	const stringifiedParams = normalizedParams.toString();
-	return stringifiedParams.length > 0 ? `${getProxyPath()}/teams/${teamId}?${stringifiedParams}` : `${getProxyPath()}/teams/${teamId}`;
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/branding?${stringifiedParams}` : `${getProxyPath()}/branding`;
 };
 /**
-* Returns the current state of a team.
+* Lists branding revisions for the project, newest first, capped at the
+100 most recent. The first entry is the revision flow responses
+currently resolve. Deliberately unpaginated in v1 — list endpoints
+gain a real query mechanism together (ADR 031); advertising pagination
+parameters the server ignores would be worse than none.
 
-* @summary Get team
+* @summary List branding revisions
+*/
+const listBranding = async (params, options) => {
+	return customFetch(getListBrandingUrl(params), {
+		...options,
+		method: "GET"
+	});
+};
+const getGetBrandingByIdUrl = (id) => {
+	return `${getProxyPath()}/branding/${id}`;
+};
+/**
+* Retrieves a single branding revision, including its stored configuration.
+* @summary Get a branding revision by ID
+*/
+const getBrandingById = async (id, options) => {
+	return customFetch(getGetBrandingByIdUrl(id), {
+		...options,
+		method: "GET"
+	});
+};
+const getListEventsUrl = (params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (Array.isArray(value) && ["category", "event_type"].includes(key)) {
+			value.forEach((v) => {
+				normalizedParams.append(key, v === null ? "null" : v.toString());
+			});
+			return;
+		}
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/events?${stringifiedParams}` : `${getProxyPath()}/events`;
+};
+/**
+* Returns project-scoped audit events, newest-first by keyset on
+`(created_at, id)` (ADR 027 / ADR 049). Pass `order=asc` for oldest-first.
+Requires `events.read`.
+
+Pre-claim projects return an empty list (events are stored but not
+visible until claim succeeds). Team-scoped credentials see only events
+whose emit-time `team_id` matches the credential team (enforced when
+team-scoped tokens exist).
+
+Clients discriminate each item via `event_type` (OpenAPI Event oneOf) —
+see docs/design/api/events-catalog.md.
+
+* @summary List events
+*/
+const listEvents = async (params, options) => {
+	return customFetch(getListEventsUrl(params), {
+		...options,
+		method: "GET"
+	});
+};
+const getGetEventUrl = (id, params) => {
+	const normalizedParams = new URLSearchParams();
+	Object.entries(params || {}).forEach(([key, value]) => {
+		if (value !== void 0) normalizedParams.append(key, value === null ? "null" : value.toString());
+	});
+	const stringifiedParams = normalizedParams.toString();
+	return stringifiedParams.length > 0 ? `${getProxyPath()}/events/${id}?${stringifiedParams}` : `${getProxyPath()}/events/${id}`;
+};
+/**
+* Loads a single event by `(project_id, id)`. Requires `events.read`.
+Events are not registered in `resource_scope_index`; project scope is
+required on the query (ADR 049). Misses and cross-project ids return 404.
+
+Pre-claim projects return 404 (stored events stay invisible until claim).
+
+* @summary Get event by ID
 */
-const getTeam = async (teamId, params, options) => {
-	return customFetch(getGetTeamUrl(teamId, params), {
+const getEvent = async (id, params, options) => {
+	return customFetch(getGetEventUrl(id, params), {
 		...options,
 		method: "GET"
 	});
 };
 //#endregion
-export { activateFlowDefinition, authorizeDevice, authorizeGet, createAuthAttempt, createFlow, createFlowDefinition, createHandoff, createProject, createSchema, createSession, createTeam, createUser, deactivateFlowDefinition, deleteFlowDefinition, endSession, exchangeHandoff, getActivateFlowDefinitionUrl, getAuthAttempt, getAuthorizeDeviceUrl, getAuthorizeGetUrl, getCreateAuthAttemptUrl, getCreateFlowDefinitionUrl, getCreateFlowUrl, getCreateHandoffUrl, getCreateProjectUrl, getCreateSchemaUrl, getCreateSessionUrl, getCreateTeamUrl, getCreateUserUrl, getDeactivateFlowDefinitionUrl, getDeleteFlowDefinitionUrl, getEndSessionUrl, getExchangeHandoffUrl, getFlowDefinition, getFlowStep, getGetAuthAttemptUrl, getGetFlowDefinitionUrl, getGetFlowStepUrl, getGetHealthUrl, getGetKeysUrl, getGetLiveUrl, getGetMySessionUrl, getGetMyUserUrl, getGetOpenIDConfigurationUrl, getGetProjectUrl, getGetReadyUrl, getGetSchemaByIdUrl, getGetSessionUrl, getGetTeamUrl, getGetTokenUrl, getGetUserByIDUrl, getGetUserInfoUrl, getHealth, getIntrospectUrl, getIssueChallengeUrl, getKeys, getListFlowDefinitionsUrl, getListSchemasUrl, getListSessionsUrl, getListUsersUrl, getLive, getMySession, getMyUser, getOpenIDConfiguration, getPatchProjectUrl, getProject, getQueryProjectsUrl, getReady, getRevokeMySessionUrl, getRevokeSessionUrl, getRevokeTokenUrl, getSchemaById, getSession, getSetUserPasswordUrl, getSubmitFlowEventUrl, getSubmitFlowStepUrl, getTeam, getToken, getUpdateFlowDefinitionUrl, getUserByID, getUserInfo, getVerifyChallengeProofUrl, introspect, issueChallenge, listFlowDefinitions, listSchemas, listSessions, listUsers, patchProject, queryProjects, revokeMySession, revokeSession, revokeToken, setUserPassword, submitFlowEvent, submitFlowStep, zitadelNextGen_exports as t, updateFlowDefinition, verifyChallengeProof };
+export { completeClaim, createAuthAttempt, createBranding, createFlow, createFlowDefinition, createHandoff, createProject, createSchema, createSession, createTeam, createUser, deleteFlowDefinition, deleteTeam, deleteUserByID, exchangeHandoff, getAuthAttempt, getBrandingById, getClaimStatus, getCompleteClaimUrl, getCreateAuthAttemptUrl, getCreateBrandingUrl, getCreateFlowDefinitionUrl, getCreateFlowUrl, getCreateHandoffUrl, getCreateProjectUrl, getCreateSchemaUrl, getCreateSessionUrl, getCreateTeamUrl, getCreateUserUrl, getDeleteFlowDefinitionUrl, getDeleteTeamUrl, getDeleteUserByIDUrl, getEvent, getExchangeHandoffUrl, getFlowDefinition, getFlowStep, getGetAuthAttemptUrl, getGetBrandingByIdUrl, getGetClaimStatusUrl, getGetEventUrl, getGetFlowDefinitionUrl, getGetFlowStepUrl, getGetHealthUrl, getGetLiveUrl, getGetMySessionUrl, getGetMyUserUrl, getGetProjectUrl, getGetReadyUrl, getGetSchemaByIdUrl, getGetSessionUrl, getGetTeamUrl, getGetUserByIDUrl, getHealth, getInitClaimUrl, getIssueChallengeUrl, getListBrandingUrl, getListEventsUrl, getListFlowDefinitionsUrl, getListSchemasUrl, getListUserPasskeysUrl, getListUserTeamsUrl, getListUsersUrl, getLive, getMySession, getMyUser, getPatchProjectUrl, getProject, getQueryProjectsUrl, getQuerySessionsUrl, getQueryTeamsUrl, getReady, getRevokeMySessionUrl, getRevokeSessionUrl, getSchemaById, getSession, getSetUserPasswordUrl, getSubmitFlowStepUrl, getTeam, getUpdateFlowDefinitionUrl, getUpdateTeamUrl, getUserByID, getVerifyChallengeProofUrl, initClaim, issueChallenge, listBranding, listEvents, listFlowDefinitions, listSchemas, listUserPasskeys, listUserTeams, listUsers, patchProject, queryProjects, querySessions, queryTeams, revokeMySession, revokeSession, setUserPassword, submitFlowStep, zitadelNextGen_exports as t, updateFlowDefinition, updateTeam, verifyChallengeProof };
 
 //# sourceMappingURL=zitadelNextGen.mjs.map